?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
interconnect: Add a common standard aggregate function
[linux/fpc-iii.git] / security / selinux / hooks.c
blob116b4d644f68935a82083cdbdd232c5243d203cc
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * NSA Security-Enhanced Linux (SELinux) security module
4 *
5 * This file contains the SELinux hook function implementations.
6 *
7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
11 *
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
22 */
23
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/tracehook.h>
28 #include <linux/errno.h>
29 #include <linux/sched/signal.h>
30 #include <linux/sched/task.h>
31 #include <linux/lsm_hooks.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/proc_fs.h>
40 #include <linux/swap.h>
41 #include <linux/spinlock.h>
42 #include <linux/syscalls.h>
43 #include <linux/dcache.h>
44 #include <linux/file.h>
45 #include <linux/fdtable.h>
46 #include <linux/namei.h>
47 #include <linux/mount.h>
48 #include <linux/fs_context.h>
49 #include <linux/fs_parser.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
53 #include <net/icmp.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/sctp.h>
70 #include <net/sctp/structs.h>
71 #include <linux/quota.h>
72 #include <linux/un.h> /* for Unix socket types */
73 #include <net/af_unix.h> /* for Unix socket types */
74 #include <linux/parser.h>
75 #include <linux/nfs_mount.h>
76 #include <net/ipv6.h>
77 #include <linux/hugetlb.h>
78 #include <linux/personality.h>
79 #include <linux/audit.h>
80 #include <linux/string.h>
81 #include <linux/mutex.h>
82 #include <linux/posix-timers.h>
83 #include <linux/syslog.h>
84 #include <linux/user_namespace.h>
85 #include <linux/export.h>
86 #include <linux/msg.h>
87 #include <linux/shm.h>
88 #include <linux/bpf.h>
89 #include <linux/kernfs.h>
90 #include <linux/stringhash.h> /* for hashlen_string() */
91 #include <uapi/linux/mount.h>
92 #include <linux/fsnotify.h>
93 #include <linux/fanotify.h>
94
95 #include "avc.h"
96 #include "objsec.h"
97 #include "netif.h"
98 #include "netnode.h"
99 #include "netport.h"
100 #include "ibpkey.h"
101 #include "xfrm.h"
102 #include "netlabel.h"
103 #include "audit.h"
104 #include "avc_ss.h"
105
106 struct selinux_state selinux_state;
107
108 /* SECMARK reference count */
109 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
110
111 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
112 static int selinux_enforcing_boot;
113
114 static int __init enforcing_setup(char *str)
115 {
116 unsigned long enforcing;
117 if (!kstrtoul(str, 0, &enforcing))
118 selinux_enforcing_boot = enforcing ? 1 : 0;
119 return 1;
120 }
121 __setup("enforcing=", enforcing_setup);
122 #else
123 #define selinux_enforcing_boot 1
124 #endif
125
126 int selinux_enabled __lsm_ro_after_init = 1;
127 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
128 static int __init selinux_enabled_setup(char *str)
129 {
130 unsigned long enabled;
131 if (!kstrtoul(str, 0, &enabled))
132 selinux_enabled = enabled ? 1 : 0;
133 return 1;
134 }
135 __setup("selinux=", selinux_enabled_setup);
136 #endif
137
138 static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141 static int __init checkreqprot_setup(char *str)
142 {
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot))
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 return 1;
148 }
149 __setup("checkreqprot=", checkreqprot_setup);
150
151 /**
152 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
153 *
154 * Description:
155 * This function checks the SECMARK reference counter to see if any SECMARK
156 * targets are currently configured, if the reference counter is greater than
157 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
158 * enabled, false (0) if SECMARK is disabled. If the always_check_network
159 * policy capability is enabled, SECMARK is always considered enabled.
160 *
161 */
162 static int selinux_secmark_enabled(void)
163 {
164 return (selinux_policycap_alwaysnetwork() ||
165 atomic_read(&selinux_secmark_refcount));
166 }
167
168 /**
169 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
170 *
171 * Description:
172 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
173 * (1) if any are enabled or false (0) if neither are enabled. If the
174 * always_check_network policy capability is enabled, peer labeling
175 * is always considered enabled.
176 *
177 */
178 static int selinux_peerlbl_enabled(void)
179 {
180 return (selinux_policycap_alwaysnetwork() ||
181 netlbl_enabled() || selinux_xfrm_enabled());
182 }
183
184 static int selinux_netcache_avc_callback(u32 event)
185 {
186 if (event == AVC_CALLBACK_RESET) {
187 sel_netif_flush();
188 sel_netnode_flush();
189 sel_netport_flush();
190 synchronize_net();
191 }
192 return 0;
193 }
194
195 static int selinux_lsm_notifier_avc_callback(u32 event)
196 {
197 if (event == AVC_CALLBACK_RESET) {
198 sel_ib_pkey_flush();
199 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
200 }
201
202 return 0;
203 }
204
205 /*
206 * initialise the security for the init task
207 */
208 static void cred_init_security(void)
209 {
210 struct cred *cred = (struct cred *) current->real_cred;
211 struct task_security_struct *tsec;
212
213 tsec = selinux_cred(cred);
214 tsec->osid = tsec->sid = SECINITSID_KERNEL;
215 }
216
217 /*
218 * get the security ID of a set of credentials
219 */
220 static inline u32 cred_sid(const struct cred *cred)
221 {
222 const struct task_security_struct *tsec;
223
224 tsec = selinux_cred(cred);
225 return tsec->sid;
226 }
227
228 /*
229 * get the objective security ID of a task
230 */
231 static inline u32 task_sid(const struct task_struct *task)
232 {
233 u32 sid;
234
235 rcu_read_lock();
236 sid = cred_sid(__task_cred(task));
237 rcu_read_unlock();
238 return sid;
239 }
240
241 /* Allocate and free functions for each kind of security blob. */
242
243 static int inode_alloc_security(struct inode *inode)
244 {
245 struct inode_security_struct *isec = selinux_inode(inode);
246 u32 sid = current_sid();
247
248 spin_lock_init(&isec->lock);
249 INIT_LIST_HEAD(&isec->list);
250 isec->inode = inode;
251 isec->sid = SECINITSID_UNLABELED;
252 isec->sclass = SECCLASS_FILE;
253 isec->task_sid = sid;
254 isec->initialized = LABEL_INVALID;
255
256 return 0;
257 }
258
259 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
260
261 /*
262 * Try reloading inode security labels that have been marked as invalid. The
263 * @may_sleep parameter indicates when sleeping and thus reloading labels is
264 * allowed; when set to false, returns -ECHILD when the label is
265 * invalid. The @dentry parameter should be set to a dentry of the inode.
266 */
267 static int __inode_security_revalidate(struct inode *inode,
268 struct dentry *dentry,
269 bool may_sleep)
270 {
271 struct inode_security_struct *isec = selinux_inode(inode);
272
273 might_sleep_if(may_sleep);
274
275 if (selinux_state.initialized &&
276 isec->initialized != LABEL_INITIALIZED) {
277 if (!may_sleep)
278 return -ECHILD;
279
280 /*
281 * Try reloading the inode security label. This will fail if
282 * @opt_dentry is NULL and no dentry for this inode can be
283 * found; in that case, continue using the old label.
284 */
285 inode_doinit_with_dentry(inode, dentry);
286 }
287 return 0;
288 }
289
290 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
291 {
292 return selinux_inode(inode);
293 }
294
295 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
296 {
297 int error;
298
299 error = __inode_security_revalidate(inode, NULL, !rcu);
300 if (error)
301 return ERR_PTR(error);
302 return selinux_inode(inode);
303 }
304
305 /*
306 * Get the security label of an inode.
307 */
308 static struct inode_security_struct *inode_security(struct inode *inode)
309 {
310 __inode_security_revalidate(inode, NULL, true);
311 return selinux_inode(inode);
312 }
313
314 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
315 {
316 struct inode *inode = d_backing_inode(dentry);
317
318 return selinux_inode(inode);
319 }
320
321 /*
322 * Get the security label of a dentry's backing inode.
323 */
324 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
325 {
326 struct inode *inode = d_backing_inode(dentry);
327
328 __inode_security_revalidate(inode, dentry, true);
329 return selinux_inode(inode);
330 }
331
332 static void inode_free_security(struct inode *inode)
333 {
334 struct inode_security_struct *isec = selinux_inode(inode);
335 struct superblock_security_struct *sbsec;
336
337 if (!isec)
338 return;
339 sbsec = inode->i_sb->s_security;
340 /*
341 * As not all inode security structures are in a list, we check for
342 * empty list outside of the lock to make sure that we won't waste
343 * time taking a lock doing nothing.
344 *
345 * The list_del_init() function can be safely called more than once.
346 * It should not be possible for this function to be called with
347 * concurrent list_add(), but for better safety against future changes
348 * in the code, we use list_empty_careful() here.
349 */
350 if (!list_empty_careful(&isec->list)) {
351 spin_lock(&sbsec->isec_lock);
352 list_del_init(&isec->list);
353 spin_unlock(&sbsec->isec_lock);
354 }
355 }
356
357 static int file_alloc_security(struct file *file)
358 {
359 struct file_security_struct *fsec = selinux_file(file);
360 u32 sid = current_sid();
361
362 fsec->sid = sid;
363 fsec->fown_sid = sid;
364
365 return 0;
366 }
367
368 static int superblock_alloc_security(struct super_block *sb)
369 {
370 struct superblock_security_struct *sbsec;
371
372 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
373 if (!sbsec)
374 return -ENOMEM;
375
376 mutex_init(&sbsec->lock);
377 INIT_LIST_HEAD(&sbsec->isec_head);
378 spin_lock_init(&sbsec->isec_lock);
379 sbsec->sb = sb;
380 sbsec->sid = SECINITSID_UNLABELED;
381 sbsec->def_sid = SECINITSID_FILE;
382 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
383 sb->s_security = sbsec;
384
385 return 0;
386 }
387
388 static void superblock_free_security(struct super_block *sb)
389 {
390 struct superblock_security_struct *sbsec = sb->s_security;
391 sb->s_security = NULL;
392 kfree(sbsec);
393 }
394
395 struct selinux_mnt_opts {
396 const char *fscontext, *context, *rootcontext, *defcontext;
397 };
398
399 static void selinux_free_mnt_opts(void *mnt_opts)
400 {
401 struct selinux_mnt_opts *opts = mnt_opts;
402 kfree(opts->fscontext);
403 kfree(opts->context);
404 kfree(opts->rootcontext);
405 kfree(opts->defcontext);
406 kfree(opts);
407 }
408
409 static inline int inode_doinit(struct inode *inode)
410 {
411 return inode_doinit_with_dentry(inode, NULL);
412 }
413
414 enum {
415 Opt_error = -1,
416 Opt_context = 0,
417 Opt_defcontext = 1,
418 Opt_fscontext = 2,
419 Opt_rootcontext = 3,
420 Opt_seclabel = 4,
421 };
422
423 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
424 static struct {
425 const char *name;
426 int len;
427 int opt;
428 bool has_arg;
429 } tokens[] = {
430 A(context, true),
431 A(fscontext, true),
432 A(defcontext, true),
433 A(rootcontext, true),
434 A(seclabel, false),
435 };
436 #undef A
437
438 static int match_opt_prefix(char *s, int l, char **arg)
439 {
440 int i;
441
442 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
443 size_t len = tokens[i].len;
444 if (len > l || memcmp(s, tokens[i].name, len))
445 continue;
446 if (tokens[i].has_arg) {
447 if (len == l || s[len] != '=')
448 continue;
449 *arg = s + len + 1;
450 } else if (len != l)
451 continue;
452 return tokens[i].opt;
453 }
454 return Opt_error;
455 }
456
457 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
458
459 static int may_context_mount_sb_relabel(u32 sid,
460 struct superblock_security_struct *sbsec,
461 const struct cred *cred)
462 {
463 const struct task_security_struct *tsec = selinux_cred(cred);
464 int rc;
465
466 rc = avc_has_perm(&selinux_state,
467 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
468 FILESYSTEM__RELABELFROM, NULL);
469 if (rc)
470 return rc;
471
472 rc = avc_has_perm(&selinux_state,
473 tsec->sid, sid, SECCLASS_FILESYSTEM,
474 FILESYSTEM__RELABELTO, NULL);
475 return rc;
476 }
477
478 static int may_context_mount_inode_relabel(u32 sid,
479 struct superblock_security_struct *sbsec,
480 const struct cred *cred)
481 {
482 const struct task_security_struct *tsec = selinux_cred(cred);
483 int rc;
484 rc = avc_has_perm(&selinux_state,
485 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
486 FILESYSTEM__RELABELFROM, NULL);
487 if (rc)
488 return rc;
489
490 rc = avc_has_perm(&selinux_state,
491 sid, sbsec->sid, SECCLASS_FILESYSTEM,
492 FILESYSTEM__ASSOCIATE, NULL);
493 return rc;
494 }
495
496 static int selinux_is_genfs_special_handling(struct super_block *sb)
497 {
498 /* Special handling. Genfs but also in-core setxattr handler */
499 return !strcmp(sb->s_type->name, "sysfs") ||
500 !strcmp(sb->s_type->name, "pstore") ||
501 !strcmp(sb->s_type->name, "debugfs") ||
502 !strcmp(sb->s_type->name, "tracefs") ||
503 !strcmp(sb->s_type->name, "rootfs") ||
504 (selinux_policycap_cgroupseclabel() &&
505 (!strcmp(sb->s_type->name, "cgroup") ||
506 !strcmp(sb->s_type->name, "cgroup2")));
507 }
508
509 static int selinux_is_sblabel_mnt(struct super_block *sb)
510 {
511 struct superblock_security_struct *sbsec = sb->s_security;
512
513 /*
514 * IMPORTANT: Double-check logic in this function when adding a new
515 * SECURITY_FS_USE_* definition!
516 */
517 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
518
519 switch (sbsec->behavior) {
520 case SECURITY_FS_USE_XATTR:
521 case SECURITY_FS_USE_TRANS:
522 case SECURITY_FS_USE_TASK:
523 case SECURITY_FS_USE_NATIVE:
524 return 1;
525
526 case SECURITY_FS_USE_GENFS:
527 return selinux_is_genfs_special_handling(sb);
528
529 /* Never allow relabeling on context mounts */
530 case SECURITY_FS_USE_MNTPOINT:
531 case SECURITY_FS_USE_NONE:
532 default:
533 return 0;
534 }
535 }
536
537 static int sb_finish_set_opts(struct super_block *sb)
538 {
539 struct superblock_security_struct *sbsec = sb->s_security;
540 struct dentry *root = sb->s_root;
541 struct inode *root_inode = d_backing_inode(root);
542 int rc = 0;
543
544 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
545 /* Make sure that the xattr handler exists and that no
546 error other than -ENODATA is returned by getxattr on
547 the root directory. -ENODATA is ok, as this may be
548 the first boot of the SELinux kernel before we have
549 assigned xattr values to the filesystem. */
550 if (!(root_inode->i_opflags & IOP_XATTR)) {
551 pr_warn("SELinux: (dev %s, type %s) has no "
552 "xattr support\n", sb->s_id, sb->s_type->name);
553 rc = -EOPNOTSUPP;
554 goto out;
555 }
556
557 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
558 if (rc < 0 && rc != -ENODATA) {
559 if (rc == -EOPNOTSUPP)
560 pr_warn("SELinux: (dev %s, type "
561 "%s) has no security xattr handler\n",
562 sb->s_id, sb->s_type->name);
563 else
564 pr_warn("SELinux: (dev %s, type "
565 "%s) getxattr errno %d\n", sb->s_id,
566 sb->s_type->name, -rc);
567 goto out;
568 }
569 }
570
571 sbsec->flags |= SE_SBINITIALIZED;
572
573 /*
574 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
575 * leave the flag untouched because sb_clone_mnt_opts might be handing
576 * us a superblock that needs the flag to be cleared.
577 */
578 if (selinux_is_sblabel_mnt(sb))
579 sbsec->flags |= SBLABEL_MNT;
580 else
581 sbsec->flags &= ~SBLABEL_MNT;
582
583 /* Initialize the root inode. */
584 rc = inode_doinit_with_dentry(root_inode, root);
585
586 /* Initialize any other inodes associated with the superblock, e.g.
587 inodes created prior to initial policy load or inodes created
588 during get_sb by a pseudo filesystem that directly
589 populates itself. */
590 spin_lock(&sbsec->isec_lock);
591 while (!list_empty(&sbsec->isec_head)) {
592 struct inode_security_struct *isec =
593 list_first_entry(&sbsec->isec_head,
594 struct inode_security_struct, list);
595 struct inode *inode = isec->inode;
596 list_del_init(&isec->list);
597 spin_unlock(&sbsec->isec_lock);
598 inode = igrab(inode);
599 if (inode) {
600 if (!IS_PRIVATE(inode))
601 inode_doinit(inode);
602 iput(inode);
603 }
604 spin_lock(&sbsec->isec_lock);
605 }
606 spin_unlock(&sbsec->isec_lock);
607 out:
608 return rc;
609 }
610
611 static int bad_option(struct superblock_security_struct *sbsec, char flag,
612 u32 old_sid, u32 new_sid)
613 {
614 char mnt_flags = sbsec->flags & SE_MNTMASK;
615
616 /* check if the old mount command had the same options */
617 if (sbsec->flags & SE_SBINITIALIZED)
618 if (!(sbsec->flags & flag) ||
619 (old_sid != new_sid))
620 return 1;
621
622 /* check if we were passed the same options twice,
623 * aka someone passed context=a,context=b
624 */
625 if (!(sbsec->flags & SE_SBINITIALIZED))
626 if (mnt_flags & flag)
627 return 1;
628 return 0;
629 }
630
631 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
632 {
633 int rc = security_context_str_to_sid(&selinux_state, s,
634 sid, GFP_KERNEL);
635 if (rc)
636 pr_warn("SELinux: security_context_str_to_sid"
637 "(%s) failed for (dev %s, type %s) errno=%d\n",
638 s, sb->s_id, sb->s_type->name, rc);
639 return rc;
640 }
641
642 /*
643 * Allow filesystems with binary mount data to explicitly set mount point
644 * labeling information.
645 */
646 static int selinux_set_mnt_opts(struct super_block *sb,
647 void *mnt_opts,
648 unsigned long kern_flags,
649 unsigned long *set_kern_flags)
650 {
651 const struct cred *cred = current_cred();
652 struct superblock_security_struct *sbsec = sb->s_security;
653 struct dentry *root = sbsec->sb->s_root;
654 struct selinux_mnt_opts *opts = mnt_opts;
655 struct inode_security_struct *root_isec;
656 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
657 u32 defcontext_sid = 0;
658 int rc = 0;
659
660 mutex_lock(&sbsec->lock);
661
662 if (!selinux_state.initialized) {
663 if (!opts) {
664 /* Defer initialization until selinux_complete_init,
665 after the initial policy is loaded and the security
666 server is ready to handle calls. */
667 goto out;
668 }
669 rc = -EINVAL;
670 pr_warn("SELinux: Unable to set superblock options "
671 "before the security server is initialized\n");
672 goto out;
673 }
674 if (kern_flags && !set_kern_flags) {
675 /* Specifying internal flags without providing a place to
676 * place the results is not allowed */
677 rc = -EINVAL;
678 goto out;
679 }
680
681 /*
682 * Binary mount data FS will come through this function twice. Once
683 * from an explicit call and once from the generic calls from the vfs.
684 * Since the generic VFS calls will not contain any security mount data
685 * we need to skip the double mount verification.
686 *
687 * This does open a hole in which we will not notice if the first
688 * mount using this sb set explict options and a second mount using
689 * this sb does not set any security options. (The first options
690 * will be used for both mounts)
691 */
692 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
693 && !opts)
694 goto out;
695
696 root_isec = backing_inode_security_novalidate(root);
697
698 /*
699 * parse the mount options, check if they are valid sids.
700 * also check if someone is trying to mount the same sb more
701 * than once with different security options.
702 */
703 if (opts) {
704 if (opts->fscontext) {
705 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
706 if (rc)
707 goto out;
708 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
709 fscontext_sid))
710 goto out_double_mount;
711 sbsec->flags |= FSCONTEXT_MNT;
712 }
713 if (opts->context) {
714 rc = parse_sid(sb, opts->context, &context_sid);
715 if (rc)
716 goto out;
717 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
718 context_sid))
719 goto out_double_mount;
720 sbsec->flags |= CONTEXT_MNT;
721 }
722 if (opts->rootcontext) {
723 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
724 if (rc)
725 goto out;
726 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
727 rootcontext_sid))
728 goto out_double_mount;
729 sbsec->flags |= ROOTCONTEXT_MNT;
730 }
731 if (opts->defcontext) {
732 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
733 if (rc)
734 goto out;
735 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
736 defcontext_sid))
737 goto out_double_mount;
738 sbsec->flags |= DEFCONTEXT_MNT;
739 }
740 }
741
742 if (sbsec->flags & SE_SBINITIALIZED) {
743 /* previously mounted with options, but not on this attempt? */
744 if ((sbsec->flags & SE_MNTMASK) && !opts)
745 goto out_double_mount;
746 rc = 0;
747 goto out;
748 }
749
750 if (strcmp(sb->s_type->name, "proc") == 0)
751 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
752
753 if (!strcmp(sb->s_type->name, "debugfs") ||
754 !strcmp(sb->s_type->name, "tracefs") ||
755 !strcmp(sb->s_type->name, "pstore"))
756 sbsec->flags |= SE_SBGENFS;
757
758 if (!strcmp(sb->s_type->name, "sysfs") ||
759 !strcmp(sb->s_type->name, "cgroup") ||
760 !strcmp(sb->s_type->name, "cgroup2"))
761 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
762
763 if (!sbsec->behavior) {
764 /*
765 * Determine the labeling behavior to use for this
766 * filesystem type.
767 */
768 rc = security_fs_use(&selinux_state, sb);
769 if (rc) {
770 pr_warn("%s: security_fs_use(%s) returned %d\n",
771 __func__, sb->s_type->name, rc);
772 goto out;
773 }
774 }
775
776 /*
777 * If this is a user namespace mount and the filesystem type is not
778 * explicitly whitelisted, then no contexts are allowed on the command
779 * line and security labels must be ignored.
780 */
781 if (sb->s_user_ns != &init_user_ns &&
782 strcmp(sb->s_type->name, "tmpfs") &&
783 strcmp(sb->s_type->name, "ramfs") &&
784 strcmp(sb->s_type->name, "devpts")) {
785 if (context_sid || fscontext_sid || rootcontext_sid ||
786 defcontext_sid) {
787 rc = -EACCES;
788 goto out;
789 }
790 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
791 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
792 rc = security_transition_sid(&selinux_state,
793 current_sid(),
794 current_sid(),
795 SECCLASS_FILE, NULL,
796 &sbsec->mntpoint_sid);
797 if (rc)
798 goto out;
799 }
800 goto out_set_opts;
801 }
802
803 /* sets the context of the superblock for the fs being mounted. */
804 if (fscontext_sid) {
805 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
806 if (rc)
807 goto out;
808
809 sbsec->sid = fscontext_sid;
810 }
811
812 /*
813 * Switch to using mount point labeling behavior.
814 * sets the label used on all file below the mountpoint, and will set
815 * the superblock context if not already set.
816 */
817 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
818 sbsec->behavior = SECURITY_FS_USE_NATIVE;
819 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
820 }
821
822 if (context_sid) {
823 if (!fscontext_sid) {
824 rc = may_context_mount_sb_relabel(context_sid, sbsec,
825 cred);
826 if (rc)
827 goto out;
828 sbsec->sid = context_sid;
829 } else {
830 rc = may_context_mount_inode_relabel(context_sid, sbsec,
831 cred);
832 if (rc)
833 goto out;
834 }
835 if (!rootcontext_sid)
836 rootcontext_sid = context_sid;
837
838 sbsec->mntpoint_sid = context_sid;
839 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
840 }
841
842 if (rootcontext_sid) {
843 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
844 cred);
845 if (rc)
846 goto out;
847
848 root_isec->sid = rootcontext_sid;
849 root_isec->initialized = LABEL_INITIALIZED;
850 }
851
852 if (defcontext_sid) {
853 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
854 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
855 rc = -EINVAL;
856 pr_warn("SELinux: defcontext option is "
857 "invalid for this filesystem type\n");
858 goto out;
859 }
860
861 if (defcontext_sid != sbsec->def_sid) {
862 rc = may_context_mount_inode_relabel(defcontext_sid,
863 sbsec, cred);
864 if (rc)
865 goto out;
866 }
867
868 sbsec->def_sid = defcontext_sid;
869 }
870
871 out_set_opts:
872 rc = sb_finish_set_opts(sb);
873 out:
874 mutex_unlock(&sbsec->lock);
875 return rc;
876 out_double_mount:
877 rc = -EINVAL;
878 pr_warn("SELinux: mount invalid. Same superblock, different "
879 "security settings for (dev %s, type %s)\n", sb->s_id,
880 sb->s_type->name);
881 goto out;
882 }
883
884 static int selinux_cmp_sb_context(const struct super_block *oldsb,
885 const struct super_block *newsb)
886 {
887 struct superblock_security_struct *old = oldsb->s_security;
888 struct superblock_security_struct *new = newsb->s_security;
889 char oldflags = old->flags & SE_MNTMASK;
890 char newflags = new->flags & SE_MNTMASK;
891
892 if (oldflags != newflags)
893 goto mismatch;
894 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
895 goto mismatch;
896 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
897 goto mismatch;
898 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
899 goto mismatch;
900 if (oldflags & ROOTCONTEXT_MNT) {
901 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
902 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
903 if (oldroot->sid != newroot->sid)
904 goto mismatch;
905 }
906 return 0;
907 mismatch:
908 pr_warn("SELinux: mount invalid. Same superblock, "
909 "different security settings for (dev %s, "
910 "type %s)\n", newsb->s_id, newsb->s_type->name);
911 return -EBUSY;
912 }
913
914 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
915 struct super_block *newsb,
916 unsigned long kern_flags,
917 unsigned long *set_kern_flags)
918 {
919 int rc = 0;
920 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
921 struct superblock_security_struct *newsbsec = newsb->s_security;
922
923 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
924 int set_context = (oldsbsec->flags & CONTEXT_MNT);
925 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
926
927 /*
928 * if the parent was able to be mounted it clearly had no special lsm
929 * mount options. thus we can safely deal with this superblock later
930 */
931 if (!selinux_state.initialized)
932 return 0;
933
934 /*
935 * Specifying internal flags without providing a place to
936 * place the results is not allowed.
937 */
938 if (kern_flags && !set_kern_flags)
939 return -EINVAL;
940
941 /* how can we clone if the old one wasn't set up?? */
942 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
943
944 /* if fs is reusing a sb, make sure that the contexts match */
945 if (newsbsec->flags & SE_SBINITIALIZED) {
946 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
947 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
948 return selinux_cmp_sb_context(oldsb, newsb);
949 }
950
951 mutex_lock(&newsbsec->lock);
952
953 newsbsec->flags = oldsbsec->flags;
954
955 newsbsec->sid = oldsbsec->sid;
956 newsbsec->def_sid = oldsbsec->def_sid;
957 newsbsec->behavior = oldsbsec->behavior;
958
959 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
960 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
961 rc = security_fs_use(&selinux_state, newsb);
962 if (rc)
963 goto out;
964 }
965
966 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
967 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
968 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
969 }
970
971 if (set_context) {
972 u32 sid = oldsbsec->mntpoint_sid;
973
974 if (!set_fscontext)
975 newsbsec->sid = sid;
976 if (!set_rootcontext) {
977 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
978 newisec->sid = sid;
979 }
980 newsbsec->mntpoint_sid = sid;
981 }
982 if (set_rootcontext) {
983 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
984 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
985
986 newisec->sid = oldisec->sid;
987 }
988
989 sb_finish_set_opts(newsb);
990 out:
991 mutex_unlock(&newsbsec->lock);
992 return rc;
993 }
994
995 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
996 {
997 struct selinux_mnt_opts *opts = *mnt_opts;
998
999 if (token == Opt_seclabel) /* eaten and completely ignored */
1000 return 0;
1001
1002 if (!opts) {
1003 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1004 if (!opts)
1005 return -ENOMEM;
1006 *mnt_opts = opts;
1007 }
1008 if (!s)
1009 return -ENOMEM;
1010 switch (token) {
1011 case Opt_context:
1012 if (opts->context || opts->defcontext)
1013 goto Einval;
1014 opts->context = s;
1015 break;
1016 case Opt_fscontext:
1017 if (opts->fscontext)
1018 goto Einval;
1019 opts->fscontext = s;
1020 break;
1021 case Opt_rootcontext:
1022 if (opts->rootcontext)
1023 goto Einval;
1024 opts->rootcontext = s;
1025 break;
1026 case Opt_defcontext:
1027 if (opts->context || opts->defcontext)
1028 goto Einval;
1029 opts->defcontext = s;
1030 break;
1031 }
1032 return 0;
1033 Einval:
1034 pr_warn(SEL_MOUNT_FAIL_MSG);
1035 return -EINVAL;
1036 }
1037
1038 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1039 void **mnt_opts)
1040 {
1041 int token = Opt_error;
1042 int rc, i;
1043
1044 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1045 if (strcmp(option, tokens[i].name) == 0) {
1046 token = tokens[i].opt;
1047 break;
1048 }
1049 }
1050
1051 if (token == Opt_error)
1052 return -EINVAL;
1053
1054 if (token != Opt_seclabel) {
1055 val = kmemdup_nul(val, len, GFP_KERNEL);
1056 if (!val) {
1057 rc = -ENOMEM;
1058 goto free_opt;
1059 }
1060 }
1061 rc = selinux_add_opt(token, val, mnt_opts);
1062 if (unlikely(rc)) {
1063 kfree(val);
1064 goto free_opt;
1065 }
1066 return rc;
1067
1068 free_opt:
1069 if (*mnt_opts) {
1070 selinux_free_mnt_opts(*mnt_opts);
1071 *mnt_opts = NULL;
1072 }
1073 return rc;
1074 }
1075
1076 static int show_sid(struct seq_file *m, u32 sid)
1077 {
1078 char *context = NULL;
1079 u32 len;
1080 int rc;
1081
1082 rc = security_sid_to_context(&selinux_state, sid,
1083 &context, &len);
1084 if (!rc) {
1085 bool has_comma = context && strchr(context, ',');
1086
1087 seq_putc(m, '=');
1088 if (has_comma)
1089 seq_putc(m, '\"');
1090 seq_escape(m, context, "\"\n\\");
1091 if (has_comma)
1092 seq_putc(m, '\"');
1093 }
1094 kfree(context);
1095 return rc;
1096 }
1097
1098 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1099 {
1100 struct superblock_security_struct *sbsec = sb->s_security;
1101 int rc;
1102
1103 if (!(sbsec->flags & SE_SBINITIALIZED))
1104 return 0;
1105
1106 if (!selinux_state.initialized)
1107 return 0;
1108
1109 if (sbsec->flags & FSCONTEXT_MNT) {
1110 seq_putc(m, ',');
1111 seq_puts(m, FSCONTEXT_STR);
1112 rc = show_sid(m, sbsec->sid);
1113 if (rc)
1114 return rc;
1115 }
1116 if (sbsec->flags & CONTEXT_MNT) {
1117 seq_putc(m, ',');
1118 seq_puts(m, CONTEXT_STR);
1119 rc = show_sid(m, sbsec->mntpoint_sid);
1120 if (rc)
1121 return rc;
1122 }
1123 if (sbsec->flags & DEFCONTEXT_MNT) {
1124 seq_putc(m, ',');
1125 seq_puts(m, DEFCONTEXT_STR);
1126 rc = show_sid(m, sbsec->def_sid);
1127 if (rc)
1128 return rc;
1129 }
1130 if (sbsec->flags & ROOTCONTEXT_MNT) {
1131 struct dentry *root = sbsec->sb->s_root;
1132 struct inode_security_struct *isec = backing_inode_security(root);
1133 seq_putc(m, ',');
1134 seq_puts(m, ROOTCONTEXT_STR);
1135 rc = show_sid(m, isec->sid);
1136 if (rc)
1137 return rc;
1138 }
1139 if (sbsec->flags & SBLABEL_MNT) {
1140 seq_putc(m, ',');
1141 seq_puts(m, SECLABEL_STR);
1142 }
1143 return 0;
1144 }
1145
1146 static inline u16 inode_mode_to_security_class(umode_t mode)
1147 {
1148 switch (mode & S_IFMT) {
1149 case S_IFSOCK:
1150 return SECCLASS_SOCK_FILE;
1151 case S_IFLNK:
1152 return SECCLASS_LNK_FILE;
1153 case S_IFREG:
1154 return SECCLASS_FILE;
1155 case S_IFBLK:
1156 return SECCLASS_BLK_FILE;
1157 case S_IFDIR:
1158 return SECCLASS_DIR;
1159 case S_IFCHR:
1160 return SECCLASS_CHR_FILE;
1161 case S_IFIFO:
1162 return SECCLASS_FIFO_FILE;
1163
1164 }
1165
1166 return SECCLASS_FILE;
1167 }
1168
1169 static inline int default_protocol_stream(int protocol)
1170 {
1171 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1172 }
1173
1174 static inline int default_protocol_dgram(int protocol)
1175 {
1176 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1177 }
1178
1179 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1180 {
1181 int extsockclass = selinux_policycap_extsockclass();
1182
1183 switch (family) {
1184 case PF_UNIX:
1185 switch (type) {
1186 case SOCK_STREAM:
1187 case SOCK_SEQPACKET:
1188 return SECCLASS_UNIX_STREAM_SOCKET;
1189 case SOCK_DGRAM:
1190 case SOCK_RAW:
1191 return SECCLASS_UNIX_DGRAM_SOCKET;
1192 }
1193 break;
1194 case PF_INET:
1195 case PF_INET6:
1196 switch (type) {
1197 case SOCK_STREAM:
1198 case SOCK_SEQPACKET:
1199 if (default_protocol_stream(protocol))
1200 return SECCLASS_TCP_SOCKET;
1201 else if (extsockclass && protocol == IPPROTO_SCTP)
1202 return SECCLASS_SCTP_SOCKET;
1203 else
1204 return SECCLASS_RAWIP_SOCKET;
1205 case SOCK_DGRAM:
1206 if (default_protocol_dgram(protocol))
1207 return SECCLASS_UDP_SOCKET;
1208 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1209 protocol == IPPROTO_ICMPV6))
1210 return SECCLASS_ICMP_SOCKET;
1211 else
1212 return SECCLASS_RAWIP_SOCKET;
1213 case SOCK_DCCP:
1214 return SECCLASS_DCCP_SOCKET;
1215 default:
1216 return SECCLASS_RAWIP_SOCKET;
1217 }
1218 break;
1219 case PF_NETLINK:
1220 switch (protocol) {
1221 case NETLINK_ROUTE:
1222 return SECCLASS_NETLINK_ROUTE_SOCKET;
1223 case NETLINK_SOCK_DIAG:
1224 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1225 case NETLINK_NFLOG:
1226 return SECCLASS_NETLINK_NFLOG_SOCKET;
1227 case NETLINK_XFRM:
1228 return SECCLASS_NETLINK_XFRM_SOCKET;
1229 case NETLINK_SELINUX:
1230 return SECCLASS_NETLINK_SELINUX_SOCKET;
1231 case NETLINK_ISCSI:
1232 return SECCLASS_NETLINK_ISCSI_SOCKET;
1233 case NETLINK_AUDIT:
1234 return SECCLASS_NETLINK_AUDIT_SOCKET;
1235 case NETLINK_FIB_LOOKUP:
1236 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1237 case NETLINK_CONNECTOR:
1238 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1239 case NETLINK_NETFILTER:
1240 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1241 case NETLINK_DNRTMSG:
1242 return SECCLASS_NETLINK_DNRT_SOCKET;
1243 case NETLINK_KOBJECT_UEVENT:
1244 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1245 case NETLINK_GENERIC:
1246 return SECCLASS_NETLINK_GENERIC_SOCKET;
1247 case NETLINK_SCSITRANSPORT:
1248 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1249 case NETLINK_RDMA:
1250 return SECCLASS_NETLINK_RDMA_SOCKET;
1251 case NETLINK_CRYPTO:
1252 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1253 default:
1254 return SECCLASS_NETLINK_SOCKET;
1255 }
1256 case PF_PACKET:
1257 return SECCLASS_PACKET_SOCKET;
1258 case PF_KEY:
1259 return SECCLASS_KEY_SOCKET;
1260 case PF_APPLETALK:
1261 return SECCLASS_APPLETALK_SOCKET;
1262 }
1263
1264 if (extsockclass) {
1265 switch (family) {
1266 case PF_AX25:
1267 return SECCLASS_AX25_SOCKET;
1268 case PF_IPX:
1269 return SECCLASS_IPX_SOCKET;
1270 case PF_NETROM:
1271 return SECCLASS_NETROM_SOCKET;
1272 case PF_ATMPVC:
1273 return SECCLASS_ATMPVC_SOCKET;
1274 case PF_X25:
1275 return SECCLASS_X25_SOCKET;
1276 case PF_ROSE:
1277 return SECCLASS_ROSE_SOCKET;
1278 case PF_DECnet:
1279 return SECCLASS_DECNET_SOCKET;
1280 case PF_ATMSVC:
1281 return SECCLASS_ATMSVC_SOCKET;
1282 case PF_RDS:
1283 return SECCLASS_RDS_SOCKET;
1284 case PF_IRDA:
1285 return SECCLASS_IRDA_SOCKET;
1286 case PF_PPPOX:
1287 return SECCLASS_PPPOX_SOCKET;
1288 case PF_LLC:
1289 return SECCLASS_LLC_SOCKET;
1290 case PF_CAN:
1291 return SECCLASS_CAN_SOCKET;
1292 case PF_TIPC:
1293 return SECCLASS_TIPC_SOCKET;
1294 case PF_BLUETOOTH:
1295 return SECCLASS_BLUETOOTH_SOCKET;
1296 case PF_IUCV:
1297 return SECCLASS_IUCV_SOCKET;
1298 case PF_RXRPC:
1299 return SECCLASS_RXRPC_SOCKET;
1300 case PF_ISDN:
1301 return SECCLASS_ISDN_SOCKET;
1302 case PF_PHONET:
1303 return SECCLASS_PHONET_SOCKET;
1304 case PF_IEEE802154:
1305 return SECCLASS_IEEE802154_SOCKET;
1306 case PF_CAIF:
1307 return SECCLASS_CAIF_SOCKET;
1308 case PF_ALG:
1309 return SECCLASS_ALG_SOCKET;
1310 case PF_NFC:
1311 return SECCLASS_NFC_SOCKET;
1312 case PF_VSOCK:
1313 return SECCLASS_VSOCK_SOCKET;
1314 case PF_KCM:
1315 return SECCLASS_KCM_SOCKET;
1316 case PF_QIPCRTR:
1317 return SECCLASS_QIPCRTR_SOCKET;
1318 case PF_SMC:
1319 return SECCLASS_SMC_SOCKET;
1320 case PF_XDP:
1321 return SECCLASS_XDP_SOCKET;
1322 #if PF_MAX > 45
1323 #error New address family defined, please update this function.
1324 #endif
1325 }
1326 }
1327
1328 return SECCLASS_SOCKET;
1329 }
1330
1331 static int selinux_genfs_get_sid(struct dentry *dentry,
1332 u16 tclass,
1333 u16 flags,
1334 u32 *sid)
1335 {
1336 int rc;
1337 struct super_block *sb = dentry->d_sb;
1338 char *buffer, *path;
1339
1340 buffer = (char *)__get_free_page(GFP_KERNEL);
1341 if (!buffer)
1342 return -ENOMEM;
1343
1344 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1345 if (IS_ERR(path))
1346 rc = PTR_ERR(path);
1347 else {
1348 if (flags & SE_SBPROC) {
1349 /* each process gets a /proc/PID/ entry. Strip off the
1350 * PID part to get a valid selinux labeling.
1351 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1352 while (path[1] >= '0' && path[1] <= '9') {
1353 path[1] = '/';
1354 path++;
1355 }
1356 }
1357 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1358 path, tclass, sid);
1359 if (rc == -ENOENT) {
1360 /* No match in policy, mark as unlabeled. */
1361 *sid = SECINITSID_UNLABELED;
1362 rc = 0;
1363 }
1364 }
1365 free_page((unsigned long)buffer);
1366 return rc;
1367 }
1368
1369 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1370 u32 def_sid, u32 *sid)
1371 {
1372 #define INITCONTEXTLEN 255
1373 char *context;
1374 unsigned int len;
1375 int rc;
1376
1377 len = INITCONTEXTLEN;
1378 context = kmalloc(len + 1, GFP_NOFS);
1379 if (!context)
1380 return -ENOMEM;
1381
1382 context[len] = '\0';
1383 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1384 if (rc == -ERANGE) {
1385 kfree(context);
1386
1387 /* Need a larger buffer. Query for the right size. */
1388 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1389 if (rc < 0)
1390 return rc;
1391
1392 len = rc;
1393 context = kmalloc(len + 1, GFP_NOFS);
1394 if (!context)
1395 return -ENOMEM;
1396
1397 context[len] = '\0';
1398 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1399 context, len);
1400 }
1401 if (rc < 0) {
1402 kfree(context);
1403 if (rc != -ENODATA) {
1404 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1405 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1406 return rc;
1407 }
1408 *sid = def_sid;
1409 return 0;
1410 }
1411
1412 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1413 def_sid, GFP_NOFS);
1414 if (rc) {
1415 char *dev = inode->i_sb->s_id;
1416 unsigned long ino = inode->i_ino;
1417
1418 if (rc == -EINVAL) {
1419 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1420 ino, dev, context);
1421 } else {
1422 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1423 __func__, context, -rc, dev, ino);
1424 }
1425 }
1426 kfree(context);
1427 return 0;
1428 }
1429
1430 /* The inode's security attributes must be initialized before first use. */
1431 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1432 {
1433 struct superblock_security_struct *sbsec = NULL;
1434 struct inode_security_struct *isec = selinux_inode(inode);
1435 u32 task_sid, sid = 0;
1436 u16 sclass;
1437 struct dentry *dentry;
1438 int rc = 0;
1439
1440 if (isec->initialized == LABEL_INITIALIZED)
1441 return 0;
1442
1443 spin_lock(&isec->lock);
1444 if (isec->initialized == LABEL_INITIALIZED)
1445 goto out_unlock;
1446
1447 if (isec->sclass == SECCLASS_FILE)
1448 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1449
1450 sbsec = inode->i_sb->s_security;
1451 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1452 /* Defer initialization until selinux_complete_init,
1453 after the initial policy is loaded and the security
1454 server is ready to handle calls. */
1455 spin_lock(&sbsec->isec_lock);
1456 if (list_empty(&isec->list))
1457 list_add(&isec->list, &sbsec->isec_head);
1458 spin_unlock(&sbsec->isec_lock);
1459 goto out_unlock;
1460 }
1461
1462 sclass = isec->sclass;
1463 task_sid = isec->task_sid;
1464 sid = isec->sid;
1465 isec->initialized = LABEL_PENDING;
1466 spin_unlock(&isec->lock);
1467
1468 switch (sbsec->behavior) {
1469 case SECURITY_FS_USE_NATIVE:
1470 break;
1471 case SECURITY_FS_USE_XATTR:
1472 if (!(inode->i_opflags & IOP_XATTR)) {
1473 sid = sbsec->def_sid;
1474 break;
1475 }
1476 /* Need a dentry, since the xattr API requires one.
1477 Life would be simpler if we could just pass the inode. */
1478 if (opt_dentry) {
1479 /* Called from d_instantiate or d_splice_alias. */
1480 dentry = dget(opt_dentry);
1481 } else {
1482 /*
1483 * Called from selinux_complete_init, try to find a dentry.
1484 * Some filesystems really want a connected one, so try
1485 * that first. We could split SECURITY_FS_USE_XATTR in
1486 * two, depending upon that...
1487 */
1488 dentry = d_find_alias(inode);
1489 if (!dentry)
1490 dentry = d_find_any_alias(inode);
1491 }
1492 if (!dentry) {
1493 /*
1494 * this is can be hit on boot when a file is accessed
1495 * before the policy is loaded. When we load policy we
1496 * may find inodes that have no dentry on the
1497 * sbsec->isec_head list. No reason to complain as these
1498 * will get fixed up the next time we go through
1499 * inode_doinit with a dentry, before these inodes could
1500 * be used again by userspace.
1501 */
1502 goto out;
1503 }
1504
1505 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1506 &sid);
1507 dput(dentry);
1508 if (rc)
1509 goto out;
1510 break;
1511 case SECURITY_FS_USE_TASK:
1512 sid = task_sid;
1513 break;
1514 case SECURITY_FS_USE_TRANS:
1515 /* Default to the fs SID. */
1516 sid = sbsec->sid;
1517
1518 /* Try to obtain a transition SID. */
1519 rc = security_transition_sid(&selinux_state, task_sid, sid,
1520 sclass, NULL, &sid);
1521 if (rc)
1522 goto out;
1523 break;
1524 case SECURITY_FS_USE_MNTPOINT:
1525 sid = sbsec->mntpoint_sid;
1526 break;
1527 default:
1528 /* Default to the fs superblock SID. */
1529 sid = sbsec->sid;
1530
1531 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1532 /* We must have a dentry to determine the label on
1533 * procfs inodes */
1534 if (opt_dentry) {
1535 /* Called from d_instantiate or
1536 * d_splice_alias. */
1537 dentry = dget(opt_dentry);
1538 } else {
1539 /* Called from selinux_complete_init, try to
1540 * find a dentry. Some filesystems really want
1541 * a connected one, so try that first.
1542 */
1543 dentry = d_find_alias(inode);
1544 if (!dentry)
1545 dentry = d_find_any_alias(inode);
1546 }
1547 /*
1548 * This can be hit on boot when a file is accessed
1549 * before the policy is loaded. When we load policy we
1550 * may find inodes that have no dentry on the
1551 * sbsec->isec_head list. No reason to complain as
1552 * these will get fixed up the next time we go through
1553 * inode_doinit() with a dentry, before these inodes
1554 * could be used again by userspace.
1555 */
1556 if (!dentry)
1557 goto out;
1558 rc = selinux_genfs_get_sid(dentry, sclass,
1559 sbsec->flags, &sid);
1560 if (rc) {
1561 dput(dentry);
1562 goto out;
1563 }
1564
1565 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1566 (inode->i_opflags & IOP_XATTR)) {
1567 rc = inode_doinit_use_xattr(inode, dentry,
1568 sid, &sid);
1569 if (rc) {
1570 dput(dentry);
1571 goto out;
1572 }
1573 }
1574 dput(dentry);
1575 }
1576 break;
1577 }
1578
1579 out:
1580 spin_lock(&isec->lock);
1581 if (isec->initialized == LABEL_PENDING) {
1582 if (!sid || rc) {
1583 isec->initialized = LABEL_INVALID;
1584 goto out_unlock;
1585 }
1586
1587 isec->initialized = LABEL_INITIALIZED;
1588 isec->sid = sid;
1589 }
1590
1591 out_unlock:
1592 spin_unlock(&isec->lock);
1593 return rc;
1594 }
1595
1596 /* Convert a Linux signal to an access vector. */
1597 static inline u32 signal_to_av(int sig)
1598 {
1599 u32 perm = 0;
1600
1601 switch (sig) {
1602 case SIGCHLD:
1603 /* Commonly granted from child to parent. */
1604 perm = PROCESS__SIGCHLD;
1605 break;
1606 case SIGKILL:
1607 /* Cannot be caught or ignored */
1608 perm = PROCESS__SIGKILL;
1609 break;
1610 case SIGSTOP:
1611 /* Cannot be caught or ignored */
1612 perm = PROCESS__SIGSTOP;
1613 break;
1614 default:
1615 /* All other signals. */
1616 perm = PROCESS__SIGNAL;
1617 break;
1618 }
1619
1620 return perm;
1621 }
1622
1623 #if CAP_LAST_CAP > 63
1624 #error Fix SELinux to handle capabilities > 63.
1625 #endif
1626
1627 /* Check whether a task is allowed to use a capability. */
1628 static int cred_has_capability(const struct cred *cred,
1629 int cap, unsigned int opts, bool initns)
1630 {
1631 struct common_audit_data ad;
1632 struct av_decision avd;
1633 u16 sclass;
1634 u32 sid = cred_sid(cred);
1635 u32 av = CAP_TO_MASK(cap);
1636 int rc;
1637
1638 ad.type = LSM_AUDIT_DATA_CAP;
1639 ad.u.cap = cap;
1640
1641 switch (CAP_TO_INDEX(cap)) {
1642 case 0:
1643 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1644 break;
1645 case 1:
1646 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1647 break;
1648 default:
1649 pr_err("SELinux: out of range capability %d\n", cap);
1650 BUG();
1651 return -EINVAL;
1652 }
1653
1654 rc = avc_has_perm_noaudit(&selinux_state,
1655 sid, sid, sclass, av, 0, &avd);
1656 if (!(opts & CAP_OPT_NOAUDIT)) {
1657 int rc2 = avc_audit(&selinux_state,
1658 sid, sid, sclass, av, &avd, rc, &ad, 0);
1659 if (rc2)
1660 return rc2;
1661 }
1662 return rc;
1663 }
1664
1665 /* Check whether a task has a particular permission to an inode.
1666 The 'adp' parameter is optional and allows other audit
1667 data to be passed (e.g. the dentry). */
1668 static int inode_has_perm(const struct cred *cred,
1669 struct inode *inode,
1670 u32 perms,
1671 struct common_audit_data *adp)
1672 {
1673 struct inode_security_struct *isec;
1674 u32 sid;
1675
1676 validate_creds(cred);
1677
1678 if (unlikely(IS_PRIVATE(inode)))
1679 return 0;
1680
1681 sid = cred_sid(cred);
1682 isec = selinux_inode(inode);
1683
1684 return avc_has_perm(&selinux_state,
1685 sid, isec->sid, isec->sclass, perms, adp);
1686 }
1687
1688 /* Same as inode_has_perm, but pass explicit audit data containing
1689 the dentry to help the auditing code to more easily generate the
1690 pathname if needed. */
1691 static inline int dentry_has_perm(const struct cred *cred,
1692 struct dentry *dentry,
1693 u32 av)
1694 {
1695 struct inode *inode = d_backing_inode(dentry);
1696 struct common_audit_data ad;
1697
1698 ad.type = LSM_AUDIT_DATA_DENTRY;
1699 ad.u.dentry = dentry;
1700 __inode_security_revalidate(inode, dentry, true);
1701 return inode_has_perm(cred, inode, av, &ad);
1702 }
1703
1704 /* Same as inode_has_perm, but pass explicit audit data containing
1705 the path to help the auditing code to more easily generate the
1706 pathname if needed. */
1707 static inline int path_has_perm(const struct cred *cred,
1708 const struct path *path,
1709 u32 av)
1710 {
1711 struct inode *inode = d_backing_inode(path->dentry);
1712 struct common_audit_data ad;
1713
1714 ad.type = LSM_AUDIT_DATA_PATH;
1715 ad.u.path = *path;
1716 __inode_security_revalidate(inode, path->dentry, true);
1717 return inode_has_perm(cred, inode, av, &ad);
1718 }
1719
1720 /* Same as path_has_perm, but uses the inode from the file struct. */
1721 static inline int file_path_has_perm(const struct cred *cred,
1722 struct file *file,
1723 u32 av)
1724 {
1725 struct common_audit_data ad;
1726
1727 ad.type = LSM_AUDIT_DATA_FILE;
1728 ad.u.file = file;
1729 return inode_has_perm(cred, file_inode(file), av, &ad);
1730 }
1731
1732 #ifdef CONFIG_BPF_SYSCALL
1733 static int bpf_fd_pass(struct file *file, u32 sid);
1734 #endif
1735
1736 /* Check whether a task can use an open file descriptor to
1737 access an inode in a given way. Check access to the
1738 descriptor itself, and then use dentry_has_perm to
1739 check a particular permission to the file.
1740 Access to the descriptor is implicitly granted if it
1741 has the same SID as the process. If av is zero, then
1742 access to the file is not checked, e.g. for cases
1743 where only the descriptor is affected like seek. */
1744 static int file_has_perm(const struct cred *cred,
1745 struct file *file,
1746 u32 av)
1747 {
1748 struct file_security_struct *fsec = selinux_file(file);
1749 struct inode *inode = file_inode(file);
1750 struct common_audit_data ad;
1751 u32 sid = cred_sid(cred);
1752 int rc;
1753
1754 ad.type = LSM_AUDIT_DATA_FILE;
1755 ad.u.file = file;
1756
1757 if (sid != fsec->sid) {
1758 rc = avc_has_perm(&selinux_state,
1759 sid, fsec->sid,
1760 SECCLASS_FD,
1761 FD__USE,
1762 &ad);
1763 if (rc)
1764 goto out;
1765 }
1766
1767 #ifdef CONFIG_BPF_SYSCALL
1768 rc = bpf_fd_pass(file, cred_sid(cred));
1769 if (rc)
1770 return rc;
1771 #endif
1772
1773 /* av is zero if only checking access to the descriptor. */
1774 rc = 0;
1775 if (av)
1776 rc = inode_has_perm(cred, inode, av, &ad);
1777
1778 out:
1779 return rc;
1780 }
1781
1782 /*
1783 * Determine the label for an inode that might be unioned.
1784 */
1785 static int
1786 selinux_determine_inode_label(const struct task_security_struct *tsec,
1787 struct inode *dir,
1788 const struct qstr *name, u16 tclass,
1789 u32 *_new_isid)
1790 {
1791 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1792
1793 if ((sbsec->flags & SE_SBINITIALIZED) &&
1794 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1795 *_new_isid = sbsec->mntpoint_sid;
1796 } else if ((sbsec->flags & SBLABEL_MNT) &&
1797 tsec->create_sid) {
1798 *_new_isid = tsec->create_sid;
1799 } else {
1800 const struct inode_security_struct *dsec = inode_security(dir);
1801 return security_transition_sid(&selinux_state, tsec->sid,
1802 dsec->sid, tclass,
1803 name, _new_isid);
1804 }
1805
1806 return 0;
1807 }
1808
1809 /* Check whether a task can create a file. */
1810 static int may_create(struct inode *dir,
1811 struct dentry *dentry,
1812 u16 tclass)
1813 {
1814 const struct task_security_struct *tsec = selinux_cred(current_cred());
1815 struct inode_security_struct *dsec;
1816 struct superblock_security_struct *sbsec;
1817 u32 sid, newsid;
1818 struct common_audit_data ad;
1819 int rc;
1820
1821 dsec = inode_security(dir);
1822 sbsec = dir->i_sb->s_security;
1823
1824 sid = tsec->sid;
1825
1826 ad.type = LSM_AUDIT_DATA_DENTRY;
1827 ad.u.dentry = dentry;
1828
1829 rc = avc_has_perm(&selinux_state,
1830 sid, dsec->sid, SECCLASS_DIR,
1831 DIR__ADD_NAME | DIR__SEARCH,
1832 &ad);
1833 if (rc)
1834 return rc;
1835
1836 rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1837 &dentry->d_name, tclass, &newsid);
1838 if (rc)
1839 return rc;
1840
1841 rc = avc_has_perm(&selinux_state,
1842 sid, newsid, tclass, FILE__CREATE, &ad);
1843 if (rc)
1844 return rc;
1845
1846 return avc_has_perm(&selinux_state,
1847 newsid, sbsec->sid,
1848 SECCLASS_FILESYSTEM,
1849 FILESYSTEM__ASSOCIATE, &ad);
1850 }
1851
1852 #define MAY_LINK 0
1853 #define MAY_UNLINK 1
1854 #define MAY_RMDIR 2
1855
1856 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1857 static int may_link(struct inode *dir,
1858 struct dentry *dentry,
1859 int kind)
1860
1861 {
1862 struct inode_security_struct *dsec, *isec;
1863 struct common_audit_data ad;
1864 u32 sid = current_sid();
1865 u32 av;
1866 int rc;
1867
1868 dsec = inode_security(dir);
1869 isec = backing_inode_security(dentry);
1870
1871 ad.type = LSM_AUDIT_DATA_DENTRY;
1872 ad.u.dentry = dentry;
1873
1874 av = DIR__SEARCH;
1875 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1876 rc = avc_has_perm(&selinux_state,
1877 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1878 if (rc)
1879 return rc;
1880
1881 switch (kind) {
1882 case MAY_LINK:
1883 av = FILE__LINK;
1884 break;
1885 case MAY_UNLINK:
1886 av = FILE__UNLINK;
1887 break;
1888 case MAY_RMDIR:
1889 av = DIR__RMDIR;
1890 break;
1891 default:
1892 pr_warn("SELinux: %s: unrecognized kind %d\n",
1893 __func__, kind);
1894 return 0;
1895 }
1896
1897 rc = avc_has_perm(&selinux_state,
1898 sid, isec->sid, isec->sclass, av, &ad);
1899 return rc;
1900 }
1901
1902 static inline int may_rename(struct inode *old_dir,
1903 struct dentry *old_dentry,
1904 struct inode *new_dir,
1905 struct dentry *new_dentry)
1906 {
1907 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1908 struct common_audit_data ad;
1909 u32 sid = current_sid();
1910 u32 av;
1911 int old_is_dir, new_is_dir;
1912 int rc;
1913
1914 old_dsec = inode_security(old_dir);
1915 old_isec = backing_inode_security(old_dentry);
1916 old_is_dir = d_is_dir(old_dentry);
1917 new_dsec = inode_security(new_dir);
1918
1919 ad.type = LSM_AUDIT_DATA_DENTRY;
1920
1921 ad.u.dentry = old_dentry;
1922 rc = avc_has_perm(&selinux_state,
1923 sid, old_dsec->sid, SECCLASS_DIR,
1924 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1925 if (rc)
1926 return rc;
1927 rc = avc_has_perm(&selinux_state,
1928 sid, old_isec->sid,
1929 old_isec->sclass, FILE__RENAME, &ad);
1930 if (rc)
1931 return rc;
1932 if (old_is_dir && new_dir != old_dir) {
1933 rc = avc_has_perm(&selinux_state,
1934 sid, old_isec->sid,
1935 old_isec->sclass, DIR__REPARENT, &ad);
1936 if (rc)
1937 return rc;
1938 }
1939
1940 ad.u.dentry = new_dentry;
1941 av = DIR__ADD_NAME | DIR__SEARCH;
1942 if (d_is_positive(new_dentry))
1943 av |= DIR__REMOVE_NAME;
1944 rc = avc_has_perm(&selinux_state,
1945 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1946 if (rc)
1947 return rc;
1948 if (d_is_positive(new_dentry)) {
1949 new_isec = backing_inode_security(new_dentry);
1950 new_is_dir = d_is_dir(new_dentry);
1951 rc = avc_has_perm(&selinux_state,
1952 sid, new_isec->sid,
1953 new_isec->sclass,
1954 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1955 if (rc)
1956 return rc;
1957 }
1958
1959 return 0;
1960 }
1961
1962 /* Check whether a task can perform a filesystem operation. */
1963 static int superblock_has_perm(const struct cred *cred,
1964 struct super_block *sb,
1965 u32 perms,
1966 struct common_audit_data *ad)
1967 {
1968 struct superblock_security_struct *sbsec;
1969 u32 sid = cred_sid(cred);
1970
1971 sbsec = sb->s_security;
1972 return avc_has_perm(&selinux_state,
1973 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1974 }
1975
1976 /* Convert a Linux mode and permission mask to an access vector. */
1977 static inline u32 file_mask_to_av(int mode, int mask)
1978 {
1979 u32 av = 0;
1980
1981 if (!S_ISDIR(mode)) {
1982 if (mask & MAY_EXEC)
1983 av |= FILE__EXECUTE;
1984 if (mask & MAY_READ)
1985 av |= FILE__READ;
1986
1987 if (mask & MAY_APPEND)
1988 av |= FILE__APPEND;
1989 else if (mask & MAY_WRITE)
1990 av |= FILE__WRITE;
1991
1992 } else {
1993 if (mask & MAY_EXEC)
1994 av |= DIR__SEARCH;
1995 if (mask & MAY_WRITE)
1996 av |= DIR__WRITE;
1997 if (mask & MAY_READ)
1998 av |= DIR__READ;
1999 }
2000
2001 return av;
2002 }
2003
2004 /* Convert a Linux file to an access vector. */
2005 static inline u32 file_to_av(struct file *file)
2006 {
2007 u32 av = 0;
2008
2009 if (file->f_mode & FMODE_READ)
2010 av |= FILE__READ;
2011 if (file->f_mode & FMODE_WRITE) {
2012 if (file->f_flags & O_APPEND)
2013 av |= FILE__APPEND;
2014 else
2015 av |= FILE__WRITE;
2016 }
2017 if (!av) {
2018 /*
2019 * Special file opened with flags 3 for ioctl-only use.
2020 */
2021 av = FILE__IOCTL;
2022 }
2023
2024 return av;
2025 }
2026
2027 /*
2028 * Convert a file to an access vector and include the correct open
2029 * open permission.
2030 */
2031 static inline u32 open_file_to_av(struct file *file)
2032 {
2033 u32 av = file_to_av(file);
2034 struct inode *inode = file_inode(file);
2035
2036 if (selinux_policycap_openperm() &&
2037 inode->i_sb->s_magic != SOCKFS_MAGIC)
2038 av |= FILE__OPEN;
2039
2040 return av;
2041 }
2042
2043 /* Hook functions begin here. */
2044
2045 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2046 {
2047 u32 mysid = current_sid();
2048 u32 mgrsid = task_sid(mgr);
2049
2050 return avc_has_perm(&selinux_state,
2051 mysid, mgrsid, SECCLASS_BINDER,
2052 BINDER__SET_CONTEXT_MGR, NULL);
2053 }
2054
2055 static int selinux_binder_transaction(struct task_struct *from,
2056 struct task_struct *to)
2057 {
2058 u32 mysid = current_sid();
2059 u32 fromsid = task_sid(from);
2060 u32 tosid = task_sid(to);
2061 int rc;
2062
2063 if (mysid != fromsid) {
2064 rc = avc_has_perm(&selinux_state,
2065 mysid, fromsid, SECCLASS_BINDER,
2066 BINDER__IMPERSONATE, NULL);
2067 if (rc)
2068 return rc;
2069 }
2070
2071 return avc_has_perm(&selinux_state,
2072 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2073 NULL);
2074 }
2075
2076 static int selinux_binder_transfer_binder(struct task_struct *from,
2077 struct task_struct *to)
2078 {
2079 u32 fromsid = task_sid(from);
2080 u32 tosid = task_sid(to);
2081
2082 return avc_has_perm(&selinux_state,
2083 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2084 NULL);
2085 }
2086
2087 static int selinux_binder_transfer_file(struct task_struct *from,
2088 struct task_struct *to,
2089 struct file *file)
2090 {
2091 u32 sid = task_sid(to);
2092 struct file_security_struct *fsec = selinux_file(file);
2093 struct dentry *dentry = file->f_path.dentry;
2094 struct inode_security_struct *isec;
2095 struct common_audit_data ad;
2096 int rc;
2097
2098 ad.type = LSM_AUDIT_DATA_PATH;
2099 ad.u.path = file->f_path;
2100
2101 if (sid != fsec->sid) {
2102 rc = avc_has_perm(&selinux_state,
2103 sid, fsec->sid,
2104 SECCLASS_FD,
2105 FD__USE,
2106 &ad);
2107 if (rc)
2108 return rc;
2109 }
2110
2111 #ifdef CONFIG_BPF_SYSCALL
2112 rc = bpf_fd_pass(file, sid);
2113 if (rc)
2114 return rc;
2115 #endif
2116
2117 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2118 return 0;
2119
2120 isec = backing_inode_security(dentry);
2121 return avc_has_perm(&selinux_state,
2122 sid, isec->sid, isec->sclass, file_to_av(file),
2123 &ad);
2124 }
2125
2126 static int selinux_ptrace_access_check(struct task_struct *child,
2127 unsigned int mode)
2128 {
2129 u32 sid = current_sid();
2130 u32 csid = task_sid(child);
2131
2132 if (mode & PTRACE_MODE_READ)
2133 return avc_has_perm(&selinux_state,
2134 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2135
2136 return avc_has_perm(&selinux_state,
2137 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2138 }
2139
2140 static int selinux_ptrace_traceme(struct task_struct *parent)
2141 {
2142 return avc_has_perm(&selinux_state,
2143 task_sid(parent), current_sid(), SECCLASS_PROCESS,
2144 PROCESS__PTRACE, NULL);
2145 }
2146
2147 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2148 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2149 {
2150 return avc_has_perm(&selinux_state,
2151 current_sid(), task_sid(target), SECCLASS_PROCESS,
2152 PROCESS__GETCAP, NULL);
2153 }
2154
2155 static int selinux_capset(struct cred *new, const struct cred *old,
2156 const kernel_cap_t *effective,
2157 const kernel_cap_t *inheritable,
2158 const kernel_cap_t *permitted)
2159 {
2160 return avc_has_perm(&selinux_state,
2161 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2162 PROCESS__SETCAP, NULL);
2163 }
2164
2165 /*
2166 * (This comment used to live with the selinux_task_setuid hook,
2167 * which was removed).
2168 *
2169 * Since setuid only affects the current process, and since the SELinux
2170 * controls are not based on the Linux identity attributes, SELinux does not
2171 * need to control this operation. However, SELinux does control the use of
2172 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2173 */
2174
2175 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2176 int cap, unsigned int opts)
2177 {
2178 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2179 }
2180
2181 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2182 {
2183 const struct cred *cred = current_cred();
2184 int rc = 0;
2185
2186 if (!sb)
2187 return 0;
2188
2189 switch (cmds) {
2190 case Q_SYNC:
2191 case Q_QUOTAON:
2192 case Q_QUOTAOFF:
2193 case Q_SETINFO:
2194 case Q_SETQUOTA:
2195 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2196 break;
2197 case Q_GETFMT:
2198 case Q_GETINFO:
2199 case Q_GETQUOTA:
2200 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2201 break;
2202 default:
2203 rc = 0; /* let the kernel handle invalid cmds */
2204 break;
2205 }
2206 return rc;
2207 }
2208
2209 static int selinux_quota_on(struct dentry *dentry)
2210 {
2211 const struct cred *cred = current_cred();
2212
2213 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2214 }
2215
2216 static int selinux_syslog(int type)
2217 {
2218 switch (type) {
2219 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2220 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2221 return avc_has_perm(&selinux_state,
2222 current_sid(), SECINITSID_KERNEL,
2223 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2224 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2225 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2226 /* Set level of messages printed to console */
2227 case SYSLOG_ACTION_CONSOLE_LEVEL:
2228 return avc_has_perm(&selinux_state,
2229 current_sid(), SECINITSID_KERNEL,
2230 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2231 NULL);
2232 }
2233 /* All other syslog types */
2234 return avc_has_perm(&selinux_state,
2235 current_sid(), SECINITSID_KERNEL,
2236 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2237 }
2238
2239 /*
2240 * Check that a process has enough memory to allocate a new virtual
2241 * mapping. 0 means there is enough memory for the allocation to
2242 * succeed and -ENOMEM implies there is not.
2243 *
2244 * Do not audit the selinux permission check, as this is applied to all
2245 * processes that allocate mappings.
2246 */
2247 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2248 {
2249 int rc, cap_sys_admin = 0;
2250
2251 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2252 CAP_OPT_NOAUDIT, true);
2253 if (rc == 0)
2254 cap_sys_admin = 1;
2255
2256 return cap_sys_admin;
2257 }
2258
2259 /* binprm security operations */
2260
2261 static u32 ptrace_parent_sid(void)
2262 {
2263 u32 sid = 0;
2264 struct task_struct *tracer;
2265
2266 rcu_read_lock();
2267 tracer = ptrace_parent(current);
2268 if (tracer)
2269 sid = task_sid(tracer);
2270 rcu_read_unlock();
2271
2272 return sid;
2273 }
2274
2275 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2276 const struct task_security_struct *old_tsec,
2277 const struct task_security_struct *new_tsec)
2278 {
2279 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2280 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2281 int rc;
2282 u32 av;
2283
2284 if (!nnp && !nosuid)
2285 return 0; /* neither NNP nor nosuid */
2286
2287 if (new_tsec->sid == old_tsec->sid)
2288 return 0; /* No change in credentials */
2289
2290 /*
2291 * If the policy enables the nnp_nosuid_transition policy capability,
2292 * then we permit transitions under NNP or nosuid if the
2293 * policy allows the corresponding permission between
2294 * the old and new contexts.
2295 */
2296 if (selinux_policycap_nnp_nosuid_transition()) {
2297 av = 0;
2298 if (nnp)
2299 av |= PROCESS2__NNP_TRANSITION;
2300 if (nosuid)
2301 av |= PROCESS2__NOSUID_TRANSITION;
2302 rc = avc_has_perm(&selinux_state,
2303 old_tsec->sid, new_tsec->sid,
2304 SECCLASS_PROCESS2, av, NULL);
2305 if (!rc)
2306 return 0;
2307 }
2308
2309 /*
2310 * We also permit NNP or nosuid transitions to bounded SIDs,
2311 * i.e. SIDs that are guaranteed to only be allowed a subset
2312 * of the permissions of the current SID.
2313 */
2314 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2315 new_tsec->sid);
2316 if (!rc)
2317 return 0;
2318
2319 /*
2320 * On failure, preserve the errno values for NNP vs nosuid.
2321 * NNP: Operation not permitted for caller.
2322 * nosuid: Permission denied to file.
2323 */
2324 if (nnp)
2325 return -EPERM;
2326 return -EACCES;
2327 }
2328
2329 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2330 {
2331 const struct task_security_struct *old_tsec;
2332 struct task_security_struct *new_tsec;
2333 struct inode_security_struct *isec;
2334 struct common_audit_data ad;
2335 struct inode *inode = file_inode(bprm->file);
2336 int rc;
2337
2338 /* SELinux context only depends on initial program or script and not
2339 * the script interpreter */
2340 if (bprm->called_set_creds)
2341 return 0;
2342
2343 old_tsec = selinux_cred(current_cred());
2344 new_tsec = selinux_cred(bprm->cred);
2345 isec = inode_security(inode);
2346
2347 /* Default to the current task SID. */
2348 new_tsec->sid = old_tsec->sid;
2349 new_tsec->osid = old_tsec->sid;
2350
2351 /* Reset fs, key, and sock SIDs on execve. */
2352 new_tsec->create_sid = 0;
2353 new_tsec->keycreate_sid = 0;
2354 new_tsec->sockcreate_sid = 0;
2355
2356 if (old_tsec->exec_sid) {
2357 new_tsec->sid = old_tsec->exec_sid;
2358 /* Reset exec SID on execve. */
2359 new_tsec->exec_sid = 0;
2360
2361 /* Fail on NNP or nosuid if not an allowed transition. */
2362 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2363 if (rc)
2364 return rc;
2365 } else {
2366 /* Check for a default transition on this program. */
2367 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2368 isec->sid, SECCLASS_PROCESS, NULL,
2369 &new_tsec->sid);
2370 if (rc)
2371 return rc;
2372
2373 /*
2374 * Fallback to old SID on NNP or nosuid if not an allowed
2375 * transition.
2376 */
2377 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2378 if (rc)
2379 new_tsec->sid = old_tsec->sid;
2380 }
2381
2382 ad.type = LSM_AUDIT_DATA_FILE;
2383 ad.u.file = bprm->file;
2384
2385 if (new_tsec->sid == old_tsec->sid) {
2386 rc = avc_has_perm(&selinux_state,
2387 old_tsec->sid, isec->sid,
2388 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2389 if (rc)
2390 return rc;
2391 } else {
2392 /* Check permissions for the transition. */
2393 rc = avc_has_perm(&selinux_state,
2394 old_tsec->sid, new_tsec->sid,
2395 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2396 if (rc)
2397 return rc;
2398
2399 rc = avc_has_perm(&selinux_state,
2400 new_tsec->sid, isec->sid,
2401 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2402 if (rc)
2403 return rc;
2404
2405 /* Check for shared state */
2406 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2407 rc = avc_has_perm(&selinux_state,
2408 old_tsec->sid, new_tsec->sid,
2409 SECCLASS_PROCESS, PROCESS__SHARE,
2410 NULL);
2411 if (rc)
2412 return -EPERM;
2413 }
2414
2415 /* Make sure that anyone attempting to ptrace over a task that
2416 * changes its SID has the appropriate permit */
2417 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2418 u32 ptsid = ptrace_parent_sid();
2419 if (ptsid != 0) {
2420 rc = avc_has_perm(&selinux_state,
2421 ptsid, new_tsec->sid,
2422 SECCLASS_PROCESS,
2423 PROCESS__PTRACE, NULL);
2424 if (rc)
2425 return -EPERM;
2426 }
2427 }
2428
2429 /* Clear any possibly unsafe personality bits on exec: */
2430 bprm->per_clear |= PER_CLEAR_ON_SETID;
2431
2432 /* Enable secure mode for SIDs transitions unless
2433 the noatsecure permission is granted between
2434 the two SIDs, i.e. ahp returns 0. */
2435 rc = avc_has_perm(&selinux_state,
2436 old_tsec->sid, new_tsec->sid,
2437 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2438 NULL);
2439 bprm->secureexec |= !!rc;
2440 }
2441
2442 return 0;
2443 }
2444
2445 static int match_file(const void *p, struct file *file, unsigned fd)
2446 {
2447 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2448 }
2449
2450 /* Derived from fs/exec.c:flush_old_files. */
2451 static inline void flush_unauthorized_files(const struct cred *cred,
2452 struct files_struct *files)
2453 {
2454 struct file *file, *devnull = NULL;
2455 struct tty_struct *tty;
2456 int drop_tty = 0;
2457 unsigned n;
2458
2459 tty = get_current_tty();
2460 if (tty) {
2461 spin_lock(&tty->files_lock);
2462 if (!list_empty(&tty->tty_files)) {
2463 struct tty_file_private *file_priv;
2464
2465 /* Revalidate access to controlling tty.
2466 Use file_path_has_perm on the tty path directly
2467 rather than using file_has_perm, as this particular
2468 open file may belong to another process and we are
2469 only interested in the inode-based check here. */
2470 file_priv = list_first_entry(&tty->tty_files,
2471 struct tty_file_private, list);
2472 file = file_priv->file;
2473 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2474 drop_tty = 1;
2475 }
2476 spin_unlock(&tty->files_lock);
2477 tty_kref_put(tty);
2478 }
2479 /* Reset controlling tty. */
2480 if (drop_tty)
2481 no_tty();
2482
2483 /* Revalidate access to inherited open files. */
2484 n = iterate_fd(files, 0, match_file, cred);
2485 if (!n) /* none found? */
2486 return;
2487
2488 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2489 if (IS_ERR(devnull))
2490 devnull = NULL;
2491 /* replace all the matching ones with this */
2492 do {
2493 replace_fd(n - 1, devnull, 0);
2494 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2495 if (devnull)
2496 fput(devnull);
2497 }
2498
2499 /*
2500 * Prepare a process for imminent new credential changes due to exec
2501 */
2502 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2503 {
2504 struct task_security_struct *new_tsec;
2505 struct rlimit *rlim, *initrlim;
2506 int rc, i;
2507
2508 new_tsec = selinux_cred(bprm->cred);
2509 if (new_tsec->sid == new_tsec->osid)
2510 return;
2511
2512 /* Close files for which the new task SID is not authorized. */
2513 flush_unauthorized_files(bprm->cred, current->files);
2514
2515 /* Always clear parent death signal on SID transitions. */
2516 current->pdeath_signal = 0;
2517
2518 /* Check whether the new SID can inherit resource limits from the old
2519 * SID. If not, reset all soft limits to the lower of the current
2520 * task's hard limit and the init task's soft limit.
2521 *
2522 * Note that the setting of hard limits (even to lower them) can be
2523 * controlled by the setrlimit check. The inclusion of the init task's
2524 * soft limit into the computation is to avoid resetting soft limits
2525 * higher than the default soft limit for cases where the default is
2526 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2527 */
2528 rc = avc_has_perm(&selinux_state,
2529 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2530 PROCESS__RLIMITINH, NULL);
2531 if (rc) {
2532 /* protect against do_prlimit() */
2533 task_lock(current);
2534 for (i = 0; i < RLIM_NLIMITS; i++) {
2535 rlim = current->signal->rlim + i;
2536 initrlim = init_task.signal->rlim + i;
2537 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2538 }
2539 task_unlock(current);
2540 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2541 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2542 }
2543 }
2544
2545 /*
2546 * Clean up the process immediately after the installation of new credentials
2547 * due to exec
2548 */
2549 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2550 {
2551 const struct task_security_struct *tsec = selinux_cred(current_cred());
2552 u32 osid, sid;
2553 int rc;
2554
2555 osid = tsec->osid;
2556 sid = tsec->sid;
2557
2558 if (sid == osid)
2559 return;
2560
2561 /* Check whether the new SID can inherit signal state from the old SID.
2562 * If not, clear itimers to avoid subsequent signal generation and
2563 * flush and unblock signals.
2564 *
2565 * This must occur _after_ the task SID has been updated so that any
2566 * kill done after the flush will be checked against the new SID.
2567 */
2568 rc = avc_has_perm(&selinux_state,
2569 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2570 if (rc) {
2571 clear_itimer();
2572
2573 spin_lock_irq(&current->sighand->siglock);
2574 if (!fatal_signal_pending(current)) {
2575 flush_sigqueue(&current->pending);
2576 flush_sigqueue(&current->signal->shared_pending);
2577 flush_signal_handlers(current, 1);
2578 sigemptyset(&current->blocked);
2579 recalc_sigpending();
2580 }
2581 spin_unlock_irq(&current->sighand->siglock);
2582 }
2583
2584 /* Wake up the parent if it is waiting so that it can recheck
2585 * wait permission to the new task SID. */
2586 read_lock(&tasklist_lock);
2587 __wake_up_parent(current, current->real_parent);
2588 read_unlock(&tasklist_lock);
2589 }
2590
2591 /* superblock security operations */
2592
2593 static int selinux_sb_alloc_security(struct super_block *sb)
2594 {
2595 return superblock_alloc_security(sb);
2596 }
2597
2598 static void selinux_sb_free_security(struct super_block *sb)
2599 {
2600 superblock_free_security(sb);
2601 }
2602
2603 static inline int opt_len(const char *s)
2604 {
2605 bool open_quote = false;
2606 int len;
2607 char c;
2608
2609 for (len = 0; (c = s[len]) != '\0'; len++) {
2610 if (c == '"')
2611 open_quote = !open_quote;
2612 if (c == ',' && !open_quote)
2613 break;
2614 }
2615 return len;
2616 }
2617
2618 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2619 {
2620 char *from = options;
2621 char *to = options;
2622 bool first = true;
2623 int rc;
2624
2625 while (1) {
2626 int len = opt_len(from);
2627 int token;
2628 char *arg = NULL;
2629
2630 token = match_opt_prefix(from, len, &arg);
2631
2632 if (token != Opt_error) {
2633 char *p, *q;
2634
2635 /* strip quotes */
2636 if (arg) {
2637 for (p = q = arg; p < from + len; p++) {
2638 char c = *p;
2639 if (c != '"')
2640 *q++ = c;
2641 }
2642 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2643 if (!arg) {
2644 rc = -ENOMEM;
2645 goto free_opt;
2646 }
2647 }
2648 rc = selinux_add_opt(token, arg, mnt_opts);
2649 if (unlikely(rc)) {
2650 kfree(arg);
2651 goto free_opt;
2652 }
2653 } else {
2654 if (!first) { // copy with preceding comma
2655 from--;
2656 len++;
2657 }
2658 if (to != from)
2659 memmove(to, from, len);
2660 to += len;
2661 first = false;
2662 }
2663 if (!from[len])
2664 break;
2665 from += len + 1;
2666 }
2667 *to = '\0';
2668 return 0;
2669
2670 free_opt:
2671 if (*mnt_opts) {
2672 selinux_free_mnt_opts(*mnt_opts);
2673 *mnt_opts = NULL;
2674 }
2675 return rc;
2676 }
2677
2678 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2679 {
2680 struct selinux_mnt_opts *opts = mnt_opts;
2681 struct superblock_security_struct *sbsec = sb->s_security;
2682 u32 sid;
2683 int rc;
2684
2685 if (!(sbsec->flags & SE_SBINITIALIZED))
2686 return 0;
2687
2688 if (!opts)
2689 return 0;
2690
2691 if (opts->fscontext) {
2692 rc = parse_sid(sb, opts->fscontext, &sid);
2693 if (rc)
2694 return rc;
2695 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2696 goto out_bad_option;
2697 }
2698 if (opts->context) {
2699 rc = parse_sid(sb, opts->context, &sid);
2700 if (rc)
2701 return rc;
2702 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2703 goto out_bad_option;
2704 }
2705 if (opts->rootcontext) {
2706 struct inode_security_struct *root_isec;
2707 root_isec = backing_inode_security(sb->s_root);
2708 rc = parse_sid(sb, opts->rootcontext, &sid);
2709 if (rc)
2710 return rc;
2711 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2712 goto out_bad_option;
2713 }
2714 if (opts->defcontext) {
2715 rc = parse_sid(sb, opts->defcontext, &sid);
2716 if (rc)
2717 return rc;
2718 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2719 goto out_bad_option;
2720 }
2721 return 0;
2722
2723 out_bad_option:
2724 pr_warn("SELinux: unable to change security options "
2725 "during remount (dev %s, type=%s)\n", sb->s_id,
2726 sb->s_type->name);
2727 return -EINVAL;
2728 }
2729
2730 static int selinux_sb_kern_mount(struct super_block *sb)
2731 {
2732 const struct cred *cred = current_cred();
2733 struct common_audit_data ad;
2734
2735 ad.type = LSM_AUDIT_DATA_DENTRY;
2736 ad.u.dentry = sb->s_root;
2737 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2738 }
2739
2740 static int selinux_sb_statfs(struct dentry *dentry)
2741 {
2742 const struct cred *cred = current_cred();
2743 struct common_audit_data ad;
2744
2745 ad.type = LSM_AUDIT_DATA_DENTRY;
2746 ad.u.dentry = dentry->d_sb->s_root;
2747 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2748 }
2749
2750 static int selinux_mount(const char *dev_name,
2751 const struct path *path,
2752 const char *type,
2753 unsigned long flags,
2754 void *data)
2755 {
2756 const struct cred *cred = current_cred();
2757
2758 if (flags & MS_REMOUNT)
2759 return superblock_has_perm(cred, path->dentry->d_sb,
2760 FILESYSTEM__REMOUNT, NULL);
2761 else
2762 return path_has_perm(cred, path, FILE__MOUNTON);
2763 }
2764
2765 static int selinux_umount(struct vfsmount *mnt, int flags)
2766 {
2767 const struct cred *cred = current_cred();
2768
2769 return superblock_has_perm(cred, mnt->mnt_sb,
2770 FILESYSTEM__UNMOUNT, NULL);
2771 }
2772
2773 static int selinux_fs_context_dup(struct fs_context *fc,
2774 struct fs_context *src_fc)
2775 {
2776 const struct selinux_mnt_opts *src = src_fc->security;
2777 struct selinux_mnt_opts *opts;
2778
2779 if (!src)
2780 return 0;
2781
2782 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2783 if (!fc->security)
2784 return -ENOMEM;
2785
2786 opts = fc->security;
2787
2788 if (src->fscontext) {
2789 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2790 if (!opts->fscontext)
2791 return -ENOMEM;
2792 }
2793 if (src->context) {
2794 opts->context = kstrdup(src->context, GFP_KERNEL);
2795 if (!opts->context)
2796 return -ENOMEM;
2797 }
2798 if (src->rootcontext) {
2799 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2800 if (!opts->rootcontext)
2801 return -ENOMEM;
2802 }
2803 if (src->defcontext) {
2804 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2805 if (!opts->defcontext)
2806 return -ENOMEM;
2807 }
2808 return 0;
2809 }
2810
2811 static const struct fs_parameter_spec selinux_param_specs[] = {
2812 fsparam_string(CONTEXT_STR, Opt_context),
2813 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2814 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2815 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2816 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2817 {}
2818 };
2819
2820 static const struct fs_parameter_description selinux_fs_parameters = {
2821 .name = "SELinux",
2822 .specs = selinux_param_specs,
2823 };
2824
2825 static int selinux_fs_context_parse_param(struct fs_context *fc,
2826 struct fs_parameter *param)
2827 {
2828 struct fs_parse_result result;
2829 int opt, rc;
2830
2831 opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2832 if (opt < 0)
2833 return opt;
2834
2835 rc = selinux_add_opt(opt, param->string, &fc->security);
2836 if (!rc) {
2837 param->string = NULL;
2838 rc = 1;
2839 }
2840 return rc;
2841 }
2842
2843 /* inode security operations */
2844
2845 static int selinux_inode_alloc_security(struct inode *inode)
2846 {
2847 return inode_alloc_security(inode);
2848 }
2849
2850 static void selinux_inode_free_security(struct inode *inode)
2851 {
2852 inode_free_security(inode);
2853 }
2854
2855 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2856 const struct qstr *name, void **ctx,
2857 u32 *ctxlen)
2858 {
2859 u32 newsid;
2860 int rc;
2861
2862 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2863 d_inode(dentry->d_parent), name,
2864 inode_mode_to_security_class(mode),
2865 &newsid);
2866 if (rc)
2867 return rc;
2868
2869 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2870 ctxlen);
2871 }
2872
2873 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2874 struct qstr *name,
2875 const struct cred *old,
2876 struct cred *new)
2877 {
2878 u32 newsid;
2879 int rc;
2880 struct task_security_struct *tsec;
2881
2882 rc = selinux_determine_inode_label(selinux_cred(old),
2883 d_inode(dentry->d_parent), name,
2884 inode_mode_to_security_class(mode),
2885 &newsid);
2886 if (rc)
2887 return rc;
2888
2889 tsec = selinux_cred(new);
2890 tsec->create_sid = newsid;
2891 return 0;
2892 }
2893
2894 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2895 const struct qstr *qstr,
2896 const char **name,
2897 void **value, size_t *len)
2898 {
2899 const struct task_security_struct *tsec = selinux_cred(current_cred());
2900 struct superblock_security_struct *sbsec;
2901 u32 newsid, clen;
2902 int rc;
2903 char *context;
2904
2905 sbsec = dir->i_sb->s_security;
2906
2907 newsid = tsec->create_sid;
2908
2909 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2910 dir, qstr,
2911 inode_mode_to_security_class(inode->i_mode),
2912 &newsid);
2913 if (rc)
2914 return rc;
2915
2916 /* Possibly defer initialization to selinux_complete_init. */
2917 if (sbsec->flags & SE_SBINITIALIZED) {
2918 struct inode_security_struct *isec = selinux_inode(inode);
2919 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2920 isec->sid = newsid;
2921 isec->initialized = LABEL_INITIALIZED;
2922 }
2923
2924 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2925 return -EOPNOTSUPP;
2926
2927 if (name)
2928 *name = XATTR_SELINUX_SUFFIX;
2929
2930 if (value && len) {
2931 rc = security_sid_to_context_force(&selinux_state, newsid,
2932 &context, &clen);
2933 if (rc)
2934 return rc;
2935 *value = context;
2936 *len = clen;
2937 }
2938
2939 return 0;
2940 }
2941
2942 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2943 {
2944 return may_create(dir, dentry, SECCLASS_FILE);
2945 }
2946
2947 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2948 {
2949 return may_link(dir, old_dentry, MAY_LINK);
2950 }
2951
2952 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2953 {
2954 return may_link(dir, dentry, MAY_UNLINK);
2955 }
2956
2957 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2958 {
2959 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2960 }
2961
2962 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2963 {
2964 return may_create(dir, dentry, SECCLASS_DIR);
2965 }
2966
2967 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2968 {
2969 return may_link(dir, dentry, MAY_RMDIR);
2970 }
2971
2972 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2973 {
2974 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2975 }
2976
2977 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2978 struct inode *new_inode, struct dentry *new_dentry)
2979 {
2980 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2981 }
2982
2983 static int selinux_inode_readlink(struct dentry *dentry)
2984 {
2985 const struct cred *cred = current_cred();
2986
2987 return dentry_has_perm(cred, dentry, FILE__READ);
2988 }
2989
2990 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2991 bool rcu)
2992 {
2993 const struct cred *cred = current_cred();
2994 struct common_audit_data ad;
2995 struct inode_security_struct *isec;
2996 u32 sid;
2997
2998 validate_creds(cred);
2999
3000 ad.type = LSM_AUDIT_DATA_DENTRY;
3001 ad.u.dentry = dentry;
3002 sid = cred_sid(cred);
3003 isec = inode_security_rcu(inode, rcu);
3004 if (IS_ERR(isec))
3005 return PTR_ERR(isec);
3006
3007 return avc_has_perm(&selinux_state,
3008 sid, isec->sid, isec->sclass, FILE__READ, &ad);
3009 }
3010
3011 static noinline int audit_inode_permission(struct inode *inode,
3012 u32 perms, u32 audited, u32 denied,
3013 int result,
3014 unsigned flags)
3015 {
3016 struct common_audit_data ad;
3017 struct inode_security_struct *isec = selinux_inode(inode);
3018 int rc;
3019
3020 ad.type = LSM_AUDIT_DATA_INODE;
3021 ad.u.inode = inode;
3022
3023 rc = slow_avc_audit(&selinux_state,
3024 current_sid(), isec->sid, isec->sclass, perms,
3025 audited, denied, result, &ad, flags);
3026 if (rc)
3027 return rc;
3028 return 0;
3029 }
3030
3031 static int selinux_inode_permission(struct inode *inode, int mask)
3032 {
3033 const struct cred *cred = current_cred();
3034 u32 perms;
3035 bool from_access;
3036 unsigned flags = mask & MAY_NOT_BLOCK;
3037 struct inode_security_struct *isec;
3038 u32 sid;
3039 struct av_decision avd;
3040 int rc, rc2;
3041 u32 audited, denied;
3042
3043 from_access = mask & MAY_ACCESS;
3044 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3045
3046 /* No permission to check. Existence test. */
3047 if (!mask)
3048 return 0;
3049
3050 validate_creds(cred);
3051
3052 if (unlikely(IS_PRIVATE(inode)))
3053 return 0;
3054
3055 perms = file_mask_to_av(inode->i_mode, mask);
3056
3057 sid = cred_sid(cred);
3058 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3059 if (IS_ERR(isec))
3060 return PTR_ERR(isec);
3061
3062 rc = avc_has_perm_noaudit(&selinux_state,
3063 sid, isec->sid, isec->sclass, perms,
3064 (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3065 &avd);
3066 audited = avc_audit_required(perms, &avd, rc,
3067 from_access ? FILE__AUDIT_ACCESS : 0,
3068 &denied);
3069 if (likely(!audited))
3070 return rc;
3071
3072 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3073 if (rc2)
3074 return rc2;
3075 return rc;
3076 }
3077
3078 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3079 {
3080 const struct cred *cred = current_cred();
3081 struct inode *inode = d_backing_inode(dentry);
3082 unsigned int ia_valid = iattr->ia_valid;
3083 __u32 av = FILE__WRITE;
3084
3085 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3086 if (ia_valid & ATTR_FORCE) {
3087 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3088 ATTR_FORCE);
3089 if (!ia_valid)
3090 return 0;
3091 }
3092
3093 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3094 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3095 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3096
3097 if (selinux_policycap_openperm() &&
3098 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3099 (ia_valid & ATTR_SIZE) &&
3100 !(ia_valid & ATTR_FILE))
3101 av |= FILE__OPEN;
3102
3103 return dentry_has_perm(cred, dentry, av);
3104 }
3105
3106 static int selinux_inode_getattr(const struct path *path)
3107 {
3108 return path_has_perm(current_cred(), path, FILE__GETATTR);
3109 }
3110
3111 static bool has_cap_mac_admin(bool audit)
3112 {
3113 const struct cred *cred = current_cred();
3114 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3115
3116 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3117 return false;
3118 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3119 return false;
3120 return true;
3121 }
3122
3123 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3124 const void *value, size_t size, int flags)
3125 {
3126 struct inode *inode = d_backing_inode(dentry);
3127 struct inode_security_struct *isec;
3128 struct superblock_security_struct *sbsec;
3129 struct common_audit_data ad;
3130 u32 newsid, sid = current_sid();
3131 int rc = 0;
3132
3133 if (strcmp(name, XATTR_NAME_SELINUX)) {
3134 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3135 if (rc)
3136 return rc;
3137
3138 /* Not an attribute we recognize, so just check the
3139 ordinary setattr permission. */
3140 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3141 }
3142
3143 if (!selinux_state.initialized)
3144 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3145
3146 sbsec = inode->i_sb->s_security;
3147 if (!(sbsec->flags & SBLABEL_MNT))
3148 return -EOPNOTSUPP;
3149
3150 if (!inode_owner_or_capable(inode))
3151 return -EPERM;
3152
3153 ad.type = LSM_AUDIT_DATA_DENTRY;
3154 ad.u.dentry = dentry;
3155
3156 isec = backing_inode_security(dentry);
3157 rc = avc_has_perm(&selinux_state,
3158 sid, isec->sid, isec->sclass,
3159 FILE__RELABELFROM, &ad);
3160 if (rc)
3161 return rc;
3162
3163 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3164 GFP_KERNEL);
3165 if (rc == -EINVAL) {
3166 if (!has_cap_mac_admin(true)) {
3167 struct audit_buffer *ab;
3168 size_t audit_size;
3169
3170 /* We strip a nul only if it is at the end, otherwise the
3171 * context contains a nul and we should audit that */
3172 if (value) {
3173 const char *str = value;
3174
3175 if (str[size - 1] == '\0')
3176 audit_size = size - 1;
3177 else
3178 audit_size = size;
3179 } else {
3180 audit_size = 0;
3181 }
3182 ab = audit_log_start(audit_context(),
3183 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3184 audit_log_format(ab, "op=setxattr invalid_context=");
3185 audit_log_n_untrustedstring(ab, value, audit_size);
3186 audit_log_end(ab);
3187
3188 return rc;
3189 }
3190 rc = security_context_to_sid_force(&selinux_state, value,
3191 size, &newsid);
3192 }
3193 if (rc)
3194 return rc;
3195
3196 rc = avc_has_perm(&selinux_state,
3197 sid, newsid, isec->sclass,
3198 FILE__RELABELTO, &ad);
3199 if (rc)
3200 return rc;
3201
3202 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3203 sid, isec->sclass);
3204 if (rc)
3205 return rc;
3206
3207 return avc_has_perm(&selinux_state,
3208 newsid,
3209 sbsec->sid,
3210 SECCLASS_FILESYSTEM,
3211 FILESYSTEM__ASSOCIATE,
3212 &ad);
3213 }
3214
3215 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3216 const void *value, size_t size,
3217 int flags)
3218 {
3219 struct inode *inode = d_backing_inode(dentry);
3220 struct inode_security_struct *isec;
3221 u32 newsid;
3222 int rc;
3223
3224 if (strcmp(name, XATTR_NAME_SELINUX)) {
3225 /* Not an attribute we recognize, so nothing to do. */
3226 return;
3227 }
3228
3229 if (!selinux_state.initialized) {
3230 /* If we haven't even been initialized, then we can't validate
3231 * against a policy, so leave the label as invalid. It may
3232 * resolve to a valid label on the next revalidation try if
3233 * we've since initialized.
3234 */
3235 return;
3236 }
3237
3238 rc = security_context_to_sid_force(&selinux_state, value, size,
3239 &newsid);
3240 if (rc) {
3241 pr_err("SELinux: unable to map context to SID"
3242 "for (%s, %lu), rc=%d\n",
3243 inode->i_sb->s_id, inode->i_ino, -rc);
3244 return;
3245 }
3246
3247 isec = backing_inode_security(dentry);
3248 spin_lock(&isec->lock);
3249 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3250 isec->sid = newsid;
3251 isec->initialized = LABEL_INITIALIZED;
3252 spin_unlock(&isec->lock);
3253
3254 return;
3255 }
3256
3257 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3258 {
3259 const struct cred *cred = current_cred();
3260
3261 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3262 }
3263
3264 static int selinux_inode_listxattr(struct dentry *dentry)
3265 {
3266 const struct cred *cred = current_cred();
3267
3268 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3269 }
3270
3271 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3272 {
3273 if (strcmp(name, XATTR_NAME_SELINUX)) {
3274 int rc = cap_inode_removexattr(dentry, name);
3275 if (rc)
3276 return rc;
3277
3278 /* Not an attribute we recognize, so just check the
3279 ordinary setattr permission. */
3280 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3281 }
3282
3283 /* No one is allowed to remove a SELinux security label.
3284 You can change the label, but all data must be labeled. */
3285 return -EACCES;
3286 }
3287
3288 static int selinux_path_notify(const struct path *path, u64 mask,
3289 unsigned int obj_type)
3290 {
3291 int ret;
3292 u32 perm;
3293
3294 struct common_audit_data ad;
3295
3296 ad.type = LSM_AUDIT_DATA_PATH;
3297 ad.u.path = *path;
3298
3299 /*
3300 * Set permission needed based on the type of mark being set.
3301 * Performs an additional check for sb watches.
3302 */
3303 switch (obj_type) {
3304 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3305 perm = FILE__WATCH_MOUNT;
3306 break;
3307 case FSNOTIFY_OBJ_TYPE_SB:
3308 perm = FILE__WATCH_SB;
3309 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3310 FILESYSTEM__WATCH, &ad);
3311 if (ret)
3312 return ret;
3313 break;
3314 case FSNOTIFY_OBJ_TYPE_INODE:
3315 perm = FILE__WATCH;
3316 break;
3317 default:
3318 return -EINVAL;
3319 }
3320
3321 /* blocking watches require the file:watch_with_perm permission */
3322 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3323 perm |= FILE__WATCH_WITH_PERM;
3324
3325 /* watches on read-like events need the file:watch_reads permission */
3326 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3327 perm |= FILE__WATCH_READS;
3328
3329 return path_has_perm(current_cred(), path, perm);
3330 }
3331
3332 /*
3333 * Copy the inode security context value to the user.
3334 *
3335 * Permission check is handled by selinux_inode_getxattr hook.
3336 */
3337 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3338 {
3339 u32 size;
3340 int error;
3341 char *context = NULL;
3342 struct inode_security_struct *isec;
3343
3344 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3345 return -EOPNOTSUPP;
3346
3347 /*
3348 * If the caller has CAP_MAC_ADMIN, then get the raw context
3349 * value even if it is not defined by current policy; otherwise,
3350 * use the in-core value under current policy.
3351 * Use the non-auditing forms of the permission checks since
3352 * getxattr may be called by unprivileged processes commonly
3353 * and lack of permission just means that we fall back to the
3354 * in-core context value, not a denial.
3355 */
3356 isec = inode_security(inode);
3357 if (has_cap_mac_admin(false))
3358 error = security_sid_to_context_force(&selinux_state,
3359 isec->sid, &context,
3360 &size);
3361 else
3362 error = security_sid_to_context(&selinux_state, isec->sid,
3363 &context, &size);
3364 if (error)
3365 return error;
3366 error = size;
3367 if (alloc) {
3368 *buffer = context;
3369 goto out_nofree;
3370 }
3371 kfree(context);
3372 out_nofree:
3373 return error;
3374 }
3375
3376 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3377 const void *value, size_t size, int flags)
3378 {
3379 struct inode_security_struct *isec = inode_security_novalidate(inode);
3380 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3381 u32 newsid;
3382 int rc;
3383
3384 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3385 return -EOPNOTSUPP;
3386
3387 if (!(sbsec->flags & SBLABEL_MNT))
3388 return -EOPNOTSUPP;
3389
3390 if (!value || !size)
3391 return -EACCES;
3392
3393 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3394 GFP_KERNEL);
3395 if (rc)
3396 return rc;
3397
3398 spin_lock(&isec->lock);
3399 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3400 isec->sid = newsid;
3401 isec->initialized = LABEL_INITIALIZED;
3402 spin_unlock(&isec->lock);
3403 return 0;
3404 }
3405
3406 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3407 {
3408 const int len = sizeof(XATTR_NAME_SELINUX);
3409 if (buffer && len <= buffer_size)
3410 memcpy(buffer, XATTR_NAME_SELINUX, len);
3411 return len;
3412 }
3413
3414 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3415 {
3416 struct inode_security_struct *isec = inode_security_novalidate(inode);
3417 *secid = isec->sid;
3418 }
3419
3420 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3421 {
3422 u32 sid;
3423 struct task_security_struct *tsec;
3424 struct cred *new_creds = *new;
3425
3426 if (new_creds == NULL) {
3427 new_creds = prepare_creds();
3428 if (!new_creds)
3429 return -ENOMEM;
3430 }
3431
3432 tsec = selinux_cred(new_creds);
3433 /* Get label from overlay inode and set it in create_sid */
3434 selinux_inode_getsecid(d_inode(src), &sid);
3435 tsec->create_sid = sid;
3436 *new = new_creds;
3437 return 0;
3438 }
3439
3440 static int selinux_inode_copy_up_xattr(const char *name)
3441 {
3442 /* The copy_up hook above sets the initial context on an inode, but we
3443 * don't then want to overwrite it by blindly copying all the lower
3444 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3445 */
3446 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3447 return 1; /* Discard */
3448 /*
3449 * Any other attribute apart from SELINUX is not claimed, supported
3450 * by selinux.
3451 */
3452 return -EOPNOTSUPP;
3453 }
3454
3455 /* kernfs node operations */
3456
3457 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3458 struct kernfs_node *kn)
3459 {
3460 const struct task_security_struct *tsec = selinux_cred(current_cred());
3461 u32 parent_sid, newsid, clen;
3462 int rc;
3463 char *context;
3464
3465 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3466 if (rc == -ENODATA)
3467 return 0;
3468 else if (rc < 0)
3469 return rc;
3470
3471 clen = (u32)rc;
3472 context = kmalloc(clen, GFP_KERNEL);
3473 if (!context)
3474 return -ENOMEM;
3475
3476 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3477 if (rc < 0) {
3478 kfree(context);
3479 return rc;
3480 }
3481
3482 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3483 GFP_KERNEL);
3484 kfree(context);
3485 if (rc)
3486 return rc;
3487
3488 if (tsec->create_sid) {
3489 newsid = tsec->create_sid;
3490 } else {
3491 u16 secclass = inode_mode_to_security_class(kn->mode);
3492 struct qstr q;
3493
3494 q.name = kn->name;
3495 q.hash_len = hashlen_string(kn_dir, kn->name);
3496
3497 rc = security_transition_sid(&selinux_state, tsec->sid,
3498 parent_sid, secclass, &q,
3499 &newsid);
3500 if (rc)
3501 return rc;
3502 }
3503
3504 rc = security_sid_to_context_force(&selinux_state, newsid,
3505 &context, &clen);
3506 if (rc)
3507 return rc;
3508
3509 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3510 XATTR_CREATE);
3511 kfree(context);
3512 return rc;
3513 }
3514
3515
3516 /* file security operations */
3517
3518 static int selinux_revalidate_file_permission(struct file *file, int mask)
3519 {
3520 const struct cred *cred = current_cred();
3521 struct inode *inode = file_inode(file);
3522
3523 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3524 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3525 mask |= MAY_APPEND;
3526
3527 return file_has_perm(cred, file,
3528 file_mask_to_av(inode->i_mode, mask));
3529 }
3530
3531 static int selinux_file_permission(struct file *file, int mask)
3532 {
3533 struct inode *inode = file_inode(file);
3534 struct file_security_struct *fsec = selinux_file(file);
3535 struct inode_security_struct *isec;
3536 u32 sid = current_sid();
3537
3538 if (!mask)
3539 /* No permission to check. Existence test. */
3540 return 0;
3541
3542 isec = inode_security(inode);
3543 if (sid == fsec->sid && fsec->isid == isec->sid &&
3544 fsec->pseqno == avc_policy_seqno(&selinux_state))
3545 /* No change since file_open check. */
3546 return 0;
3547
3548 return selinux_revalidate_file_permission(file, mask);
3549 }
3550
3551 static int selinux_file_alloc_security(struct file *file)
3552 {
3553 return file_alloc_security(file);
3554 }
3555
3556 /*
3557 * Check whether a task has the ioctl permission and cmd
3558 * operation to an inode.
3559 */
3560 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3561 u32 requested, u16 cmd)
3562 {
3563 struct common_audit_data ad;
3564 struct file_security_struct *fsec = selinux_file(file);
3565 struct inode *inode = file_inode(file);
3566 struct inode_security_struct *isec;
3567 struct lsm_ioctlop_audit ioctl;
3568 u32 ssid = cred_sid(cred);
3569 int rc;
3570 u8 driver = cmd >> 8;
3571 u8 xperm = cmd & 0xff;
3572
3573 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3574 ad.u.op = &ioctl;
3575 ad.u.op->cmd = cmd;
3576 ad.u.op->path = file->f_path;
3577
3578 if (ssid != fsec->sid) {
3579 rc = avc_has_perm(&selinux_state,
3580 ssid, fsec->sid,
3581 SECCLASS_FD,
3582 FD__USE,
3583 &ad);
3584 if (rc)
3585 goto out;
3586 }
3587
3588 if (unlikely(IS_PRIVATE(inode)))
3589 return 0;
3590
3591 isec = inode_security(inode);
3592 rc = avc_has_extended_perms(&selinux_state,
3593 ssid, isec->sid, isec->sclass,
3594 requested, driver, xperm, &ad);
3595 out:
3596 return rc;
3597 }
3598
3599 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3600 unsigned long arg)
3601 {
3602 const struct cred *cred = current_cred();
3603 int error = 0;
3604
3605 switch (cmd) {
3606 case FIONREAD:
3607 /* fall through */
3608 case FIBMAP:
3609 /* fall through */
3610 case FIGETBSZ:
3611 /* fall through */
3612 case FS_IOC_GETFLAGS:
3613 /* fall through */
3614 case FS_IOC_GETVERSION:
3615 error = file_has_perm(cred, file, FILE__GETATTR);
3616 break;
3617
3618 case FS_IOC_SETFLAGS:
3619 /* fall through */
3620 case FS_IOC_SETVERSION:
3621 error = file_has_perm(cred, file, FILE__SETATTR);
3622 break;
3623
3624 /* sys_ioctl() checks */
3625 case FIONBIO:
3626 /* fall through */
3627 case FIOASYNC:
3628 error = file_has_perm(cred, file, 0);
3629 break;
3630
3631 case KDSKBENT:
3632 case KDSKBSENT:
3633 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3634 CAP_OPT_NONE, true);
3635 break;
3636
3637 /* default case assumes that the command will go
3638 * to the file's ioctl() function.
3639 */
3640 default:
3641 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3642 }
3643 return error;
3644 }
3645
3646 static int default_noexec;
3647
3648 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3649 {
3650 const struct cred *cred = current_cred();
3651 u32 sid = cred_sid(cred);
3652 int rc = 0;
3653
3654 if (default_noexec &&
3655 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3656 (!shared && (prot & PROT_WRITE)))) {
3657 /*
3658 * We are making executable an anonymous mapping or a
3659 * private file mapping that will also be writable.
3660 * This has an additional check.
3661 */
3662 rc = avc_has_perm(&selinux_state,
3663 sid, sid, SECCLASS_PROCESS,
3664 PROCESS__EXECMEM, NULL);
3665 if (rc)
3666 goto error;
3667 }
3668
3669 if (file) {
3670 /* read access is always possible with a mapping */
3671 u32 av = FILE__READ;
3672
3673 /* write access only matters if the mapping is shared */
3674 if (shared && (prot & PROT_WRITE))
3675 av |= FILE__WRITE;
3676
3677 if (prot & PROT_EXEC)
3678 av |= FILE__EXECUTE;
3679
3680 return file_has_perm(cred, file, av);
3681 }
3682
3683 error:
3684 return rc;
3685 }
3686
3687 static int selinux_mmap_addr(unsigned long addr)
3688 {
3689 int rc = 0;
3690
3691 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3692 u32 sid = current_sid();
3693 rc = avc_has_perm(&selinux_state,
3694 sid, sid, SECCLASS_MEMPROTECT,
3695 MEMPROTECT__MMAP_ZERO, NULL);
3696 }
3697
3698 return rc;
3699 }
3700
3701 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3702 unsigned long prot, unsigned long flags)
3703 {
3704 struct common_audit_data ad;
3705 int rc;
3706
3707 if (file) {
3708 ad.type = LSM_AUDIT_DATA_FILE;
3709 ad.u.file = file;
3710 rc = inode_has_perm(current_cred(), file_inode(file),
3711 FILE__MAP, &ad);
3712 if (rc)
3713 return rc;
3714 }
3715
3716 if (selinux_state.checkreqprot)
3717 prot = reqprot;
3718
3719 return file_map_prot_check(file, prot,
3720 (flags & MAP_TYPE) == MAP_SHARED);
3721 }
3722
3723 static int selinux_file_mprotect(struct vm_area_struct *vma,
3724 unsigned long reqprot,
3725 unsigned long prot)
3726 {
3727 const struct cred *cred = current_cred();
3728 u32 sid = cred_sid(cred);
3729
3730 if (selinux_state.checkreqprot)
3731 prot = reqprot;
3732
3733 if (default_noexec &&
3734 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3735 int rc = 0;
3736 if (vma->vm_start >= vma->vm_mm->start_brk &&
3737 vma->vm_end <= vma->vm_mm->brk) {
3738 rc = avc_has_perm(&selinux_state,
3739 sid, sid, SECCLASS_PROCESS,
3740 PROCESS__EXECHEAP, NULL);
3741 } else if (!vma->vm_file &&
3742 ((vma->vm_start <= vma->vm_mm->start_stack &&
3743 vma->vm_end >= vma->vm_mm->start_stack) ||
3744 vma_is_stack_for_current(vma))) {
3745 rc = avc_has_perm(&selinux_state,
3746 sid, sid, SECCLASS_PROCESS,
3747 PROCESS__EXECSTACK, NULL);
3748 } else if (vma->vm_file && vma->anon_vma) {
3749 /*
3750 * We are making executable a file mapping that has
3751 * had some COW done. Since pages might have been
3752 * written, check ability to execute the possibly
3753 * modified content. This typically should only
3754 * occur for text relocations.
3755 */
3756 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3757 }
3758 if (rc)
3759 return rc;
3760 }
3761
3762 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3763 }
3764
3765 static int selinux_file_lock(struct file *file, unsigned int cmd)
3766 {
3767 const struct cred *cred = current_cred();
3768
3769 return file_has_perm(cred, file, FILE__LOCK);
3770 }
3771
3772 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3773 unsigned long arg)
3774 {
3775 const struct cred *cred = current_cred();
3776 int err = 0;
3777
3778 switch (cmd) {
3779 case F_SETFL:
3780 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3781 err = file_has_perm(cred, file, FILE__WRITE);
3782 break;
3783 }
3784 /* fall through */
3785 case F_SETOWN:
3786 case F_SETSIG:
3787 case F_GETFL:
3788 case F_GETOWN:
3789 case F_GETSIG:
3790 case F_GETOWNER_UIDS:
3791 /* Just check FD__USE permission */
3792 err = file_has_perm(cred, file, 0);
3793 break;
3794 case F_GETLK:
3795 case F_SETLK:
3796 case F_SETLKW:
3797 case F_OFD_GETLK:
3798 case F_OFD_SETLK:
3799 case F_OFD_SETLKW:
3800 #if BITS_PER_LONG == 32
3801 case F_GETLK64:
3802 case F_SETLK64:
3803 case F_SETLKW64:
3804 #endif
3805 err = file_has_perm(cred, file, FILE__LOCK);
3806 break;
3807 }
3808
3809 return err;
3810 }
3811
3812 static void selinux_file_set_fowner(struct file *file)
3813 {
3814 struct file_security_struct *fsec;
3815
3816 fsec = selinux_file(file);
3817 fsec->fown_sid = current_sid();
3818 }
3819
3820 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3821 struct fown_struct *fown, int signum)
3822 {
3823 struct file *file;
3824 u32 sid = task_sid(tsk);
3825 u32 perm;
3826 struct file_security_struct *fsec;
3827
3828 /* struct fown_struct is never outside the context of a struct file */
3829 file = container_of(fown, struct file, f_owner);
3830
3831 fsec = selinux_file(file);
3832
3833 if (!signum)
3834 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3835 else
3836 perm = signal_to_av(signum);
3837
3838 return avc_has_perm(&selinux_state,
3839 fsec->fown_sid, sid,
3840 SECCLASS_PROCESS, perm, NULL);
3841 }
3842
3843 static int selinux_file_receive(struct file *file)
3844 {
3845 const struct cred *cred = current_cred();
3846
3847 return file_has_perm(cred, file, file_to_av(file));
3848 }
3849
3850 static int selinux_file_open(struct file *file)
3851 {
3852 struct file_security_struct *fsec;
3853 struct inode_security_struct *isec;
3854
3855 fsec = selinux_file(file);
3856 isec = inode_security(file_inode(file));
3857 /*
3858 * Save inode label and policy sequence number
3859 * at open-time so that selinux_file_permission
3860 * can determine whether revalidation is necessary.
3861 * Task label is already saved in the file security
3862 * struct as its SID.
3863 */
3864 fsec->isid = isec->sid;
3865 fsec->pseqno = avc_policy_seqno(&selinux_state);
3866 /*
3867 * Since the inode label or policy seqno may have changed
3868 * between the selinux_inode_permission check and the saving
3869 * of state above, recheck that access is still permitted.
3870 * Otherwise, access might never be revalidated against the
3871 * new inode label or new policy.
3872 * This check is not redundant - do not remove.
3873 */
3874 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3875 }
3876
3877 /* task security operations */
3878
3879 static int selinux_task_alloc(struct task_struct *task,
3880 unsigned long clone_flags)
3881 {
3882 u32 sid = current_sid();
3883
3884 return avc_has_perm(&selinux_state,
3885 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3886 }
3887
3888 /*
3889 * prepare a new set of credentials for modification
3890 */
3891 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3892 gfp_t gfp)
3893 {
3894 const struct task_security_struct *old_tsec = selinux_cred(old);
3895 struct task_security_struct *tsec = selinux_cred(new);
3896
3897 *tsec = *old_tsec;
3898 return 0;
3899 }
3900
3901 /*
3902 * transfer the SELinux data to a blank set of creds
3903 */
3904 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3905 {
3906 const struct task_security_struct *old_tsec = selinux_cred(old);
3907 struct task_security_struct *tsec = selinux_cred(new);
3908
3909 *tsec = *old_tsec;
3910 }
3911
3912 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3913 {
3914 *secid = cred_sid(c);
3915 }
3916
3917 /*
3918 * set the security data for a kernel service
3919 * - all the creation contexts are set to unlabelled
3920 */
3921 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3922 {
3923 struct task_security_struct *tsec = selinux_cred(new);
3924 u32 sid = current_sid();
3925 int ret;
3926
3927 ret = avc_has_perm(&selinux_state,
3928 sid, secid,
3929 SECCLASS_KERNEL_SERVICE,
3930 KERNEL_SERVICE__USE_AS_OVERRIDE,
3931 NULL);
3932 if (ret == 0) {
3933 tsec->sid = secid;
3934 tsec->create_sid = 0;
3935 tsec->keycreate_sid = 0;
3936 tsec->sockcreate_sid = 0;
3937 }
3938 return ret;
3939 }
3940
3941 /*
3942 * set the file creation context in a security record to the same as the
3943 * objective context of the specified inode
3944 */
3945 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3946 {
3947 struct inode_security_struct *isec = inode_security(inode);
3948 struct task_security_struct *tsec = selinux_cred(new);
3949 u32 sid = current_sid();
3950 int ret;
3951
3952 ret = avc_has_perm(&selinux_state,
3953 sid, isec->sid,
3954 SECCLASS_KERNEL_SERVICE,
3955 KERNEL_SERVICE__CREATE_FILES_AS,
3956 NULL);
3957
3958 if (ret == 0)
3959 tsec->create_sid = isec->sid;
3960 return ret;
3961 }
3962
3963 static int selinux_kernel_module_request(char *kmod_name)
3964 {
3965 struct common_audit_data ad;
3966
3967 ad.type = LSM_AUDIT_DATA_KMOD;
3968 ad.u.kmod_name = kmod_name;
3969
3970 return avc_has_perm(&selinux_state,
3971 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3972 SYSTEM__MODULE_REQUEST, &ad);
3973 }
3974
3975 static int selinux_kernel_module_from_file(struct file *file)
3976 {
3977 struct common_audit_data ad;
3978 struct inode_security_struct *isec;
3979 struct file_security_struct *fsec;
3980 u32 sid = current_sid();
3981 int rc;
3982
3983 /* init_module */
3984 if (file == NULL)
3985 return avc_has_perm(&selinux_state,
3986 sid, sid, SECCLASS_SYSTEM,
3987 SYSTEM__MODULE_LOAD, NULL);
3988
3989 /* finit_module */
3990
3991 ad.type = LSM_AUDIT_DATA_FILE;
3992 ad.u.file = file;
3993
3994 fsec = selinux_file(file);
3995 if (sid != fsec->sid) {
3996 rc = avc_has_perm(&selinux_state,
3997 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3998 if (rc)
3999 return rc;
4000 }
4001
4002 isec = inode_security(file_inode(file));
4003 return avc_has_perm(&selinux_state,
4004 sid, isec->sid, SECCLASS_SYSTEM,
4005 SYSTEM__MODULE_LOAD, &ad);
4006 }
4007
4008 static int selinux_kernel_read_file(struct file *file,
4009 enum kernel_read_file_id id)
4010 {
4011 int rc = 0;
4012
4013 switch (id) {
4014 case READING_MODULE:
4015 rc = selinux_kernel_module_from_file(file);
4016 break;
4017 default:
4018 break;
4019 }
4020
4021 return rc;
4022 }
4023
4024 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4025 {
4026 int rc = 0;
4027
4028 switch (id) {
4029 case LOADING_MODULE:
4030 rc = selinux_kernel_module_from_file(NULL);
4031 default:
4032 break;
4033 }
4034
4035 return rc;
4036 }
4037
4038 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4039 {
4040 return avc_has_perm(&selinux_state,
4041 current_sid(), task_sid(p), SECCLASS_PROCESS,
4042 PROCESS__SETPGID, NULL);
4043 }
4044
4045 static int selinux_task_getpgid(struct task_struct *p)
4046 {
4047 return avc_has_perm(&selinux_state,
4048 current_sid(), task_sid(p), SECCLASS_PROCESS,
4049 PROCESS__GETPGID, NULL);
4050 }
4051
4052 static int selinux_task_getsid(struct task_struct *p)
4053 {
4054 return avc_has_perm(&selinux_state,
4055 current_sid(), task_sid(p), SECCLASS_PROCESS,
4056 PROCESS__GETSESSION, NULL);
4057 }
4058
4059 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4060 {
4061 *secid = task_sid(p);
4062 }
4063
4064 static int selinux_task_setnice(struct task_struct *p, int nice)
4065 {
4066 return avc_has_perm(&selinux_state,
4067 current_sid(), task_sid(p), SECCLASS_PROCESS,
4068 PROCESS__SETSCHED, NULL);
4069 }
4070
4071 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4072 {
4073 return avc_has_perm(&selinux_state,
4074 current_sid(), task_sid(p), SECCLASS_PROCESS,
4075 PROCESS__SETSCHED, NULL);
4076 }
4077
4078 static int selinux_task_getioprio(struct task_struct *p)
4079 {
4080 return avc_has_perm(&selinux_state,
4081 current_sid(), task_sid(p), SECCLASS_PROCESS,
4082 PROCESS__GETSCHED, NULL);
4083 }
4084
4085 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4086 unsigned int flags)
4087 {
4088 u32 av = 0;
4089
4090 if (!flags)
4091 return 0;
4092 if (flags & LSM_PRLIMIT_WRITE)
4093 av |= PROCESS__SETRLIMIT;
4094 if (flags & LSM_PRLIMIT_READ)
4095 av |= PROCESS__GETRLIMIT;
4096 return avc_has_perm(&selinux_state,
4097 cred_sid(cred), cred_sid(tcred),
4098 SECCLASS_PROCESS, av, NULL);
4099 }
4100
4101 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4102 struct rlimit *new_rlim)
4103 {
4104 struct rlimit *old_rlim = p->signal->rlim + resource;
4105
4106 /* Control the ability to change the hard limit (whether
4107 lowering or raising it), so that the hard limit can
4108 later be used as a safe reset point for the soft limit
4109 upon context transitions. See selinux_bprm_committing_creds. */
4110 if (old_rlim->rlim_max != new_rlim->rlim_max)
4111 return avc_has_perm(&selinux_state,
4112 current_sid(), task_sid(p),
4113 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4114
4115 return 0;
4116 }
4117
4118 static int selinux_task_setscheduler(struct task_struct *p)
4119 {
4120 return avc_has_perm(&selinux_state,
4121 current_sid(), task_sid(p), SECCLASS_PROCESS,
4122 PROCESS__SETSCHED, NULL);
4123 }
4124
4125 static int selinux_task_getscheduler(struct task_struct *p)
4126 {
4127 return avc_has_perm(&selinux_state,
4128 current_sid(), task_sid(p), SECCLASS_PROCESS,
4129 PROCESS__GETSCHED, NULL);
4130 }
4131
4132 static int selinux_task_movememory(struct task_struct *p)
4133 {
4134 return avc_has_perm(&selinux_state,
4135 current_sid(), task_sid(p), SECCLASS_PROCESS,
4136 PROCESS__SETSCHED, NULL);
4137 }
4138
4139 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4140 int sig, const struct cred *cred)
4141 {
4142 u32 secid;
4143 u32 perm;
4144
4145 if (!sig)
4146 perm = PROCESS__SIGNULL; /* null signal; existence test */
4147 else
4148 perm = signal_to_av(sig);
4149 if (!cred)
4150 secid = current_sid();
4151 else
4152 secid = cred_sid(cred);
4153 return avc_has_perm(&selinux_state,
4154 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4155 }
4156
4157 static void selinux_task_to_inode(struct task_struct *p,
4158 struct inode *inode)
4159 {
4160 struct inode_security_struct *isec = selinux_inode(inode);
4161 u32 sid = task_sid(p);
4162
4163 spin_lock(&isec->lock);
4164 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4165 isec->sid = sid;
4166 isec->initialized = LABEL_INITIALIZED;
4167 spin_unlock(&isec->lock);
4168 }
4169
4170 /* Returns error only if unable to parse addresses */
4171 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4172 struct common_audit_data *ad, u8 *proto)
4173 {
4174 int offset, ihlen, ret = -EINVAL;
4175 struct iphdr _iph, *ih;
4176
4177 offset = skb_network_offset(skb);
4178 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4179 if (ih == NULL)
4180 goto out;
4181
4182 ihlen = ih->ihl * 4;
4183 if (ihlen < sizeof(_iph))
4184 goto out;
4185
4186 ad->u.net->v4info.saddr = ih->saddr;
4187 ad->u.net->v4info.daddr = ih->daddr;
4188 ret = 0;
4189
4190 if (proto)
4191 *proto = ih->protocol;
4192
4193 switch (ih->protocol) {
4194 case IPPROTO_TCP: {
4195 struct tcphdr _tcph, *th;
4196
4197 if (ntohs(ih->frag_off) & IP_OFFSET)
4198 break;
4199
4200 offset += ihlen;
4201 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4202 if (th == NULL)
4203 break;
4204
4205 ad->u.net->sport = th->source;
4206 ad->u.net->dport = th->dest;
4207 break;
4208 }
4209
4210 case IPPROTO_UDP: {
4211 struct udphdr _udph, *uh;
4212
4213 if (ntohs(ih->frag_off) & IP_OFFSET)
4214 break;
4215
4216 offset += ihlen;
4217 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4218 if (uh == NULL)
4219 break;
4220
4221 ad->u.net->sport = uh->source;
4222 ad->u.net->dport = uh->dest;
4223 break;
4224 }
4225
4226 case IPPROTO_DCCP: {
4227 struct dccp_hdr _dccph, *dh;
4228
4229 if (ntohs(ih->frag_off) & IP_OFFSET)
4230 break;
4231
4232 offset += ihlen;
4233 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4234 if (dh == NULL)
4235 break;
4236
4237 ad->u.net->sport = dh->dccph_sport;
4238 ad->u.net->dport = dh->dccph_dport;
4239 break;
4240 }
4241
4242 #if IS_ENABLED(CONFIG_IP_SCTP)
4243 case IPPROTO_SCTP: {
4244 struct sctphdr _sctph, *sh;
4245
4246 if (ntohs(ih->frag_off) & IP_OFFSET)
4247 break;
4248
4249 offset += ihlen;
4250 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4251 if (sh == NULL)
4252 break;
4253
4254 ad->u.net->sport = sh->source;
4255 ad->u.net->dport = sh->dest;
4256 break;
4257 }
4258 #endif
4259 default:
4260 break;
4261 }
4262 out:
4263 return ret;
4264 }
4265
4266 #if IS_ENABLED(CONFIG_IPV6)
4267
4268 /* Returns error only if unable to parse addresses */
4269 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4270 struct common_audit_data *ad, u8 *proto)
4271 {
4272 u8 nexthdr;
4273 int ret = -EINVAL, offset;
4274 struct ipv6hdr _ipv6h, *ip6;
4275 __be16 frag_off;
4276
4277 offset = skb_network_offset(skb);
4278 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4279 if (ip6 == NULL)
4280 goto out;
4281
4282 ad->u.net->v6info.saddr = ip6->saddr;
4283 ad->u.net->v6info.daddr = ip6->daddr;
4284 ret = 0;
4285
4286 nexthdr = ip6->nexthdr;
4287 offset += sizeof(_ipv6h);
4288 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4289 if (offset < 0)
4290 goto out;
4291
4292 if (proto)
4293 *proto = nexthdr;
4294
4295 switch (nexthdr) {
4296 case IPPROTO_TCP: {
4297 struct tcphdr _tcph, *th;
4298
4299 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4300 if (th == NULL)
4301 break;
4302
4303 ad->u.net->sport = th->source;
4304 ad->u.net->dport = th->dest;
4305 break;
4306 }
4307
4308 case IPPROTO_UDP: {
4309 struct udphdr _udph, *uh;
4310
4311 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4312 if (uh == NULL)
4313 break;
4314
4315 ad->u.net->sport = uh->source;
4316 ad->u.net->dport = uh->dest;
4317 break;
4318 }
4319
4320 case IPPROTO_DCCP: {
4321 struct dccp_hdr _dccph, *dh;
4322
4323 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4324 if (dh == NULL)
4325 break;
4326
4327 ad->u.net->sport = dh->dccph_sport;
4328 ad->u.net->dport = dh->dccph_dport;
4329 break;
4330 }
4331
4332 #if IS_ENABLED(CONFIG_IP_SCTP)
4333 case IPPROTO_SCTP: {
4334 struct sctphdr _sctph, *sh;
4335
4336 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4337 if (sh == NULL)
4338 break;
4339
4340 ad->u.net->sport = sh->source;
4341 ad->u.net->dport = sh->dest;
4342 break;
4343 }
4344 #endif
4345 /* includes fragments */
4346 default:
4347 break;
4348 }
4349 out:
4350 return ret;
4351 }
4352
4353 #endif /* IPV6 */
4354
4355 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4356 char **_addrp, int src, u8 *proto)
4357 {
4358 char *addrp;
4359 int ret;
4360
4361 switch (ad->u.net->family) {
4362 case PF_INET:
4363 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4364 if (ret)
4365 goto parse_error;
4366 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4367 &ad->u.net->v4info.daddr);
4368 goto okay;
4369
4370 #if IS_ENABLED(CONFIG_IPV6)
4371 case PF_INET6:
4372 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4373 if (ret)
4374 goto parse_error;
4375 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4376 &ad->u.net->v6info.daddr);
4377 goto okay;
4378 #endif /* IPV6 */
4379 default:
4380 addrp = NULL;
4381 goto okay;
4382 }
4383
4384 parse_error:
4385 pr_warn(
4386 "SELinux: failure in selinux_parse_skb(),"
4387 " unable to parse packet\n");
4388 return ret;
4389
4390 okay:
4391 if (_addrp)
4392 *_addrp = addrp;
4393 return 0;
4394 }
4395
4396 /**
4397 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4398 * @skb: the packet
4399 * @family: protocol family
4400 * @sid: the packet's peer label SID
4401 *
4402 * Description:
4403 * Check the various different forms of network peer labeling and determine
4404 * the peer label/SID for the packet; most of the magic actually occurs in
4405 * the security server function security_net_peersid_cmp(). The function
4406 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4407 * or -EACCES if @sid is invalid due to inconsistencies with the different
4408 * peer labels.
4409 *
4410 */
4411 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4412 {
4413 int err;
4414 u32 xfrm_sid;
4415 u32 nlbl_sid;
4416 u32 nlbl_type;
4417
4418 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4419 if (unlikely(err))
4420 return -EACCES;
4421 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4422 if (unlikely(err))
4423 return -EACCES;
4424
4425 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4426 nlbl_type, xfrm_sid, sid);
4427 if (unlikely(err)) {
4428 pr_warn(
4429 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4430 " unable to determine packet's peer label\n");
4431 return -EACCES;
4432 }
4433
4434 return 0;
4435 }
4436
4437 /**
4438 * selinux_conn_sid - Determine the child socket label for a connection
4439 * @sk_sid: the parent socket's SID
4440 * @skb_sid: the packet's SID
4441 * @conn_sid: the resulting connection SID
4442 *
4443 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4444 * combined with the MLS information from @skb_sid in order to create
4445 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4446 * of @sk_sid. Returns zero on success, negative values on failure.
4447 *
4448 */
4449 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4450 {
4451 int err = 0;
4452
4453 if (skb_sid != SECSID_NULL)
4454 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4455 conn_sid);
4456 else
4457 *conn_sid = sk_sid;
4458
4459 return err;
4460 }
4461
4462 /* socket security operations */
4463
4464 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4465 u16 secclass, u32 *socksid)
4466 {
4467 if (tsec->sockcreate_sid > SECSID_NULL) {
4468 *socksid = tsec->sockcreate_sid;
4469 return 0;
4470 }
4471
4472 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4473 secclass, NULL, socksid);
4474 }
4475
4476 static int sock_has_perm(struct sock *sk, u32 perms)
4477 {
4478 struct sk_security_struct *sksec = sk->sk_security;
4479 struct common_audit_data ad;
4480 struct lsm_network_audit net = {0,};
4481
4482 if (sksec->sid == SECINITSID_KERNEL)
4483 return 0;
4484
4485 ad.type = LSM_AUDIT_DATA_NET;
4486 ad.u.net = &net;
4487 ad.u.net->sk = sk;
4488
4489 return avc_has_perm(&selinux_state,
4490 current_sid(), sksec->sid, sksec->sclass, perms,
4491 &ad);
4492 }
4493
4494 static int selinux_socket_create(int family, int type,
4495 int protocol, int kern)
4496 {
4497 const struct task_security_struct *tsec = selinux_cred(current_cred());
4498 u32 newsid;
4499 u16 secclass;
4500 int rc;
4501
4502 if (kern)
4503 return 0;
4504
4505 secclass = socket_type_to_security_class(family, type, protocol);
4506 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4507 if (rc)
4508 return rc;
4509
4510 return avc_has_perm(&selinux_state,
4511 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4512 }
4513
4514 static int selinux_socket_post_create(struct socket *sock, int family,
4515 int type, int protocol, int kern)
4516 {
4517 const struct task_security_struct *tsec = selinux_cred(current_cred());
4518 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4519 struct sk_security_struct *sksec;
4520 u16 sclass = socket_type_to_security_class(family, type, protocol);
4521 u32 sid = SECINITSID_KERNEL;
4522 int err = 0;
4523
4524 if (!kern) {
4525 err = socket_sockcreate_sid(tsec, sclass, &sid);
4526 if (err)
4527 return err;
4528 }
4529
4530 isec->sclass = sclass;
4531 isec->sid = sid;
4532 isec->initialized = LABEL_INITIALIZED;
4533
4534 if (sock->sk) {
4535 sksec = sock->sk->sk_security;
4536 sksec->sclass = sclass;
4537 sksec->sid = sid;
4538 /* Allows detection of the first association on this socket */
4539 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4540 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4541
4542 err = selinux_netlbl_socket_post_create(sock->sk, family);
4543 }
4544
4545 return err;
4546 }
4547
4548 static int selinux_socket_socketpair(struct socket *socka,
4549 struct socket *sockb)
4550 {
4551 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4552 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4553
4554 sksec_a->peer_sid = sksec_b->sid;
4555 sksec_b->peer_sid = sksec_a->sid;
4556
4557 return 0;
4558 }
4559
4560 /* Range of port numbers used to automatically bind.
4561 Need to determine whether we should perform a name_bind
4562 permission check between the socket and the port number. */
4563
4564 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4565 {
4566 struct sock *sk = sock->sk;
4567 struct sk_security_struct *sksec = sk->sk_security;
4568 u16 family;
4569 int err;
4570
4571 err = sock_has_perm(sk, SOCKET__BIND);
4572 if (err)
4573 goto out;
4574
4575 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4576 family = sk->sk_family;
4577 if (family == PF_INET || family == PF_INET6) {
4578 char *addrp;
4579 struct common_audit_data ad;
4580 struct lsm_network_audit net = {0,};
4581 struct sockaddr_in *addr4 = NULL;
4582 struct sockaddr_in6 *addr6 = NULL;
4583 u16 family_sa;
4584 unsigned short snum;
4585 u32 sid, node_perm;
4586
4587 /*
4588 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4589 * that validates multiple binding addresses. Because of this
4590 * need to check address->sa_family as it is possible to have
4591 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4592 */
4593 if (addrlen < offsetofend(struct sockaddr, sa_family))
4594 return -EINVAL;
4595 family_sa = address->sa_family;
4596 switch (family_sa) {
4597 case AF_UNSPEC:
4598 case AF_INET:
4599 if (addrlen < sizeof(struct sockaddr_in))
4600 return -EINVAL;
4601 addr4 = (struct sockaddr_in *)address;
4602 if (family_sa == AF_UNSPEC) {
4603 /* see __inet_bind(), we only want to allow
4604 * AF_UNSPEC if the address is INADDR_ANY
4605 */
4606 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4607 goto err_af;
4608 family_sa = AF_INET;
4609 }
4610 snum = ntohs(addr4->sin_port);
4611 addrp = (char *)&addr4->sin_addr.s_addr;
4612 break;
4613 case AF_INET6:
4614 if (addrlen < SIN6_LEN_RFC2133)
4615 return -EINVAL;
4616 addr6 = (struct sockaddr_in6 *)address;
4617 snum = ntohs(addr6->sin6_port);
4618 addrp = (char *)&addr6->sin6_addr.s6_addr;
4619 break;
4620 default:
4621 goto err_af;
4622 }
4623
4624 ad.type = LSM_AUDIT_DATA_NET;
4625 ad.u.net = &net;
4626 ad.u.net->sport = htons(snum);
4627 ad.u.net->family = family_sa;
4628
4629 if (snum) {
4630 int low, high;
4631
4632 inet_get_local_port_range(sock_net(sk), &low, &high);
4633
4634 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4635 snum < low || snum > high) {
4636 err = sel_netport_sid(sk->sk_protocol,
4637 snum, &sid);
4638 if (err)
4639 goto out;
4640 err = avc_has_perm(&selinux_state,
4641 sksec->sid, sid,
4642 sksec->sclass,
4643 SOCKET__NAME_BIND, &ad);
4644 if (err)
4645 goto out;
4646 }
4647 }
4648
4649 switch (sksec->sclass) {
4650 case SECCLASS_TCP_SOCKET:
4651 node_perm = TCP_SOCKET__NODE_BIND;
4652 break;
4653
4654 case SECCLASS_UDP_SOCKET:
4655 node_perm = UDP_SOCKET__NODE_BIND;
4656 break;
4657
4658 case SECCLASS_DCCP_SOCKET:
4659 node_perm = DCCP_SOCKET__NODE_BIND;
4660 break;
4661
4662 case SECCLASS_SCTP_SOCKET:
4663 node_perm = SCTP_SOCKET__NODE_BIND;
4664 break;
4665
4666 default:
4667 node_perm = RAWIP_SOCKET__NODE_BIND;
4668 break;
4669 }
4670
4671 err = sel_netnode_sid(addrp, family_sa, &sid);
4672 if (err)
4673 goto out;
4674
4675 if (family_sa == AF_INET)
4676 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4677 else
4678 ad.u.net->v6info.saddr = addr6->sin6_addr;
4679
4680 err = avc_has_perm(&selinux_state,
4681 sksec->sid, sid,
4682 sksec->sclass, node_perm, &ad);
4683 if (err)
4684 goto out;
4685 }
4686 out:
4687 return err;
4688 err_af:
4689 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4690 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4691 return -EINVAL;
4692 return -EAFNOSUPPORT;
4693 }
4694
4695 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4696 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4697 */
4698 static int selinux_socket_connect_helper(struct socket *sock,
4699 struct sockaddr *address, int addrlen)
4700 {
4701 struct sock *sk = sock->sk;
4702 struct sk_security_struct *sksec = sk->sk_security;
4703 int err;
4704
4705 err = sock_has_perm(sk, SOCKET__CONNECT);
4706 if (err)
4707 return err;
4708 if (addrlen < offsetofend(struct sockaddr, sa_family))
4709 return -EINVAL;
4710
4711 /* connect(AF_UNSPEC) has special handling, as it is a documented
4712 * way to disconnect the socket
4713 */
4714 if (address->sa_family == AF_UNSPEC)
4715 return 0;
4716
4717 /*
4718 * If a TCP, DCCP or SCTP socket, check name_connect permission
4719 * for the port.
4720 */
4721 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4722 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4723 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4724 struct common_audit_data ad;
4725 struct lsm_network_audit net = {0,};
4726 struct sockaddr_in *addr4 = NULL;
4727 struct sockaddr_in6 *addr6 = NULL;
4728 unsigned short snum;
4729 u32 sid, perm;
4730
4731 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4732 * that validates multiple connect addresses. Because of this
4733 * need to check address->sa_family as it is possible to have
4734 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4735 */
4736 switch (address->sa_family) {
4737 case AF_INET:
4738 addr4 = (struct sockaddr_in *)address;
4739 if (addrlen < sizeof(struct sockaddr_in))
4740 return -EINVAL;
4741 snum = ntohs(addr4->sin_port);
4742 break;
4743 case AF_INET6:
4744 addr6 = (struct sockaddr_in6 *)address;
4745 if (addrlen < SIN6_LEN_RFC2133)
4746 return -EINVAL;
4747 snum = ntohs(addr6->sin6_port);
4748 break;
4749 default:
4750 /* Note that SCTP services expect -EINVAL, whereas
4751 * others expect -EAFNOSUPPORT.
4752 */
4753 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4754 return -EINVAL;
4755 else
4756 return -EAFNOSUPPORT;
4757 }
4758
4759 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4760 if (err)
4761 return err;
4762
4763 switch (sksec->sclass) {
4764 case SECCLASS_TCP_SOCKET:
4765 perm = TCP_SOCKET__NAME_CONNECT;
4766 break;
4767 case SECCLASS_DCCP_SOCKET:
4768 perm = DCCP_SOCKET__NAME_CONNECT;
4769 break;
4770 case SECCLASS_SCTP_SOCKET:
4771 perm = SCTP_SOCKET__NAME_CONNECT;
4772 break;
4773 }
4774
4775 ad.type = LSM_AUDIT_DATA_NET;
4776 ad.u.net = &net;
4777 ad.u.net->dport = htons(snum);
4778 ad.u.net->family = address->sa_family;
4779 err = avc_has_perm(&selinux_state,
4780 sksec->sid, sid, sksec->sclass, perm, &ad);
4781 if (err)
4782 return err;
4783 }
4784
4785 return 0;
4786 }
4787
4788 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4789 static int selinux_socket_connect(struct socket *sock,
4790 struct sockaddr *address, int addrlen)
4791 {
4792 int err;
4793 struct sock *sk = sock->sk;
4794
4795 err = selinux_socket_connect_helper(sock, address, addrlen);
4796 if (err)
4797 return err;
4798
4799 return selinux_netlbl_socket_connect(sk, address);
4800 }
4801
4802 static int selinux_socket_listen(struct socket *sock, int backlog)
4803 {
4804 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4805 }
4806
4807 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4808 {
4809 int err;
4810 struct inode_security_struct *isec;
4811 struct inode_security_struct *newisec;
4812 u16 sclass;
4813 u32 sid;
4814
4815 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4816 if (err)
4817 return err;
4818
4819 isec = inode_security_novalidate(SOCK_INODE(sock));
4820 spin_lock(&isec->lock);
4821 sclass = isec->sclass;
4822 sid = isec->sid;
4823 spin_unlock(&isec->lock);
4824
4825 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4826 newisec->sclass = sclass;
4827 newisec->sid = sid;
4828 newisec->initialized = LABEL_INITIALIZED;
4829
4830 return 0;
4831 }
4832
4833 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4834 int size)
4835 {
4836 return sock_has_perm(sock->sk, SOCKET__WRITE);
4837 }
4838
4839 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4840 int size, int flags)
4841 {
4842 return sock_has_perm(sock->sk, SOCKET__READ);
4843 }
4844
4845 static int selinux_socket_getsockname(struct socket *sock)
4846 {
4847 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4848 }
4849
4850 static int selinux_socket_getpeername(struct socket *sock)
4851 {
4852 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4853 }
4854
4855 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4856 {
4857 int err;
4858
4859 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4860 if (err)
4861 return err;
4862
4863 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4864 }
4865
4866 static int selinux_socket_getsockopt(struct socket *sock, int level,
4867 int optname)
4868 {
4869 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4870 }
4871
4872 static int selinux_socket_shutdown(struct socket *sock, int how)
4873 {
4874 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4875 }
4876
4877 static int selinux_socket_unix_stream_connect(struct sock *sock,
4878 struct sock *other,
4879 struct sock *newsk)
4880 {
4881 struct sk_security_struct *sksec_sock = sock->sk_security;
4882 struct sk_security_struct *sksec_other = other->sk_security;
4883 struct sk_security_struct *sksec_new = newsk->sk_security;
4884 struct common_audit_data ad;
4885 struct lsm_network_audit net = {0,};
4886 int err;
4887
4888 ad.type = LSM_AUDIT_DATA_NET;
4889 ad.u.net = &net;
4890 ad.u.net->sk = other;
4891
4892 err = avc_has_perm(&selinux_state,
4893 sksec_sock->sid, sksec_other->sid,
4894 sksec_other->sclass,
4895 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4896 if (err)
4897 return err;
4898
4899 /* server child socket */
4900 sksec_new->peer_sid = sksec_sock->sid;
4901 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4902 sksec_sock->sid, &sksec_new->sid);
4903 if (err)
4904 return err;
4905
4906 /* connecting socket */
4907 sksec_sock->peer_sid = sksec_new->sid;
4908
4909 return 0;
4910 }
4911
4912 static int selinux_socket_unix_may_send(struct socket *sock,
4913 struct socket *other)
4914 {
4915 struct sk_security_struct *ssec = sock->sk->sk_security;
4916 struct sk_security_struct *osec = other->sk->sk_security;
4917 struct common_audit_data ad;
4918 struct lsm_network_audit net = {0,};
4919
4920 ad.type = LSM_AUDIT_DATA_NET;
4921 ad.u.net = &net;
4922 ad.u.net->sk = other->sk;
4923
4924 return avc_has_perm(&selinux_state,
4925 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4926 &ad);
4927 }
4928
4929 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4930 char *addrp, u16 family, u32 peer_sid,
4931 struct common_audit_data *ad)
4932 {
4933 int err;
4934 u32 if_sid;
4935 u32 node_sid;
4936
4937 err = sel_netif_sid(ns, ifindex, &if_sid);
4938 if (err)
4939 return err;
4940 err = avc_has_perm(&selinux_state,
4941 peer_sid, if_sid,
4942 SECCLASS_NETIF, NETIF__INGRESS, ad);
4943 if (err)
4944 return err;
4945
4946 err = sel_netnode_sid(addrp, family, &node_sid);
4947 if (err)
4948 return err;
4949 return avc_has_perm(&selinux_state,
4950 peer_sid, node_sid,
4951 SECCLASS_NODE, NODE__RECVFROM, ad);
4952 }
4953
4954 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4955 u16 family)
4956 {
4957 int err = 0;
4958 struct sk_security_struct *sksec = sk->sk_security;
4959 u32 sk_sid = sksec->sid;
4960 struct common_audit_data ad;
4961 struct lsm_network_audit net = {0,};
4962 char *addrp;
4963
4964 ad.type = LSM_AUDIT_DATA_NET;
4965 ad.u.net = &net;
4966 ad.u.net->netif = skb->skb_iif;
4967 ad.u.net->family = family;
4968 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4969 if (err)
4970 return err;
4971
4972 if (selinux_secmark_enabled()) {
4973 err = avc_has_perm(&selinux_state,
4974 sk_sid, skb->secmark, SECCLASS_PACKET,
4975 PACKET__RECV, &ad);
4976 if (err)
4977 return err;
4978 }
4979
4980 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4981 if (err)
4982 return err;
4983 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4984
4985 return err;
4986 }
4987
4988 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4989 {
4990 int err;
4991 struct sk_security_struct *sksec = sk->sk_security;
4992 u16 family = sk->sk_family;
4993 u32 sk_sid = sksec->sid;
4994 struct common_audit_data ad;
4995 struct lsm_network_audit net = {0,};
4996 char *addrp;
4997 u8 secmark_active;
4998 u8 peerlbl_active;
4999
5000 if (family != PF_INET && family != PF_INET6)
5001 return 0;
5002
5003 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5004 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5005 family = PF_INET;
5006
5007 /* If any sort of compatibility mode is enabled then handoff processing
5008 * to the selinux_sock_rcv_skb_compat() function to deal with the
5009 * special handling. We do this in an attempt to keep this function
5010 * as fast and as clean as possible. */
5011 if (!selinux_policycap_netpeer())
5012 return selinux_sock_rcv_skb_compat(sk, skb, family);
5013
5014 secmark_active = selinux_secmark_enabled();
5015 peerlbl_active = selinux_peerlbl_enabled();
5016 if (!secmark_active && !peerlbl_active)
5017 return 0;
5018
5019 ad.type = LSM_AUDIT_DATA_NET;
5020 ad.u.net = &net;
5021 ad.u.net->netif = skb->skb_iif;
5022 ad.u.net->family = family;
5023 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5024 if (err)
5025 return err;
5026
5027 if (peerlbl_active) {
5028 u32 peer_sid;
5029
5030 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5031 if (err)
5032 return err;
5033 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5034 addrp, family, peer_sid, &ad);
5035 if (err) {
5036 selinux_netlbl_err(skb, family, err, 0);
5037 return err;
5038 }
5039 err = avc_has_perm(&selinux_state,
5040 sk_sid, peer_sid, SECCLASS_PEER,
5041 PEER__RECV, &ad);
5042 if (err) {
5043 selinux_netlbl_err(skb, family, err, 0);
5044 return err;
5045 }
5046 }
5047
5048 if (secmark_active) {
5049 err = avc_has_perm(&selinux_state,
5050 sk_sid, skb->secmark, SECCLASS_PACKET,
5051 PACKET__RECV, &ad);
5052 if (err)
5053 return err;
5054 }
5055
5056 return err;
5057 }
5058
5059 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5060 int __user *optlen, unsigned len)
5061 {
5062 int err = 0;
5063 char *scontext;
5064 u32 scontext_len;
5065 struct sk_security_struct *sksec = sock->sk->sk_security;
5066 u32 peer_sid = SECSID_NULL;
5067
5068 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5069 sksec->sclass == SECCLASS_TCP_SOCKET ||
5070 sksec->sclass == SECCLASS_SCTP_SOCKET)
5071 peer_sid = sksec->peer_sid;
5072 if (peer_sid == SECSID_NULL)
5073 return -ENOPROTOOPT;
5074
5075 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5076 &scontext_len);
5077 if (err)
5078 return err;
5079
5080 if (scontext_len > len) {
5081 err = -ERANGE;
5082 goto out_len;
5083 }
5084
5085 if (copy_to_user(optval, scontext, scontext_len))
5086 err = -EFAULT;
5087
5088 out_len:
5089 if (put_user(scontext_len, optlen))
5090 err = -EFAULT;
5091 kfree(scontext);
5092 return err;
5093 }
5094
5095 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5096 {
5097 u32 peer_secid = SECSID_NULL;
5098 u16 family;
5099 struct inode_security_struct *isec;
5100
5101 if (skb && skb->protocol == htons(ETH_P_IP))
5102 family = PF_INET;
5103 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5104 family = PF_INET6;
5105 else if (sock)
5106 family = sock->sk->sk_family;
5107 else
5108 goto out;
5109
5110 if (sock && family == PF_UNIX) {
5111 isec = inode_security_novalidate(SOCK_INODE(sock));
5112 peer_secid = isec->sid;
5113 } else if (skb)
5114 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5115
5116 out:
5117 *secid = peer_secid;
5118 if (peer_secid == SECSID_NULL)
5119 return -EINVAL;
5120 return 0;
5121 }
5122
5123 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5124 {
5125 struct sk_security_struct *sksec;
5126
5127 sksec = kzalloc(sizeof(*sksec), priority);
5128 if (!sksec)
5129 return -ENOMEM;
5130
5131 sksec->peer_sid = SECINITSID_UNLABELED;
5132 sksec->sid = SECINITSID_UNLABELED;
5133 sksec->sclass = SECCLASS_SOCKET;
5134 selinux_netlbl_sk_security_reset(sksec);
5135 sk->sk_security = sksec;
5136
5137 return 0;
5138 }
5139
5140 static void selinux_sk_free_security(struct sock *sk)
5141 {
5142 struct sk_security_struct *sksec = sk->sk_security;
5143
5144 sk->sk_security = NULL;
5145 selinux_netlbl_sk_security_free(sksec);
5146 kfree(sksec);
5147 }
5148
5149 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5150 {
5151 struct sk_security_struct *sksec = sk->sk_security;
5152 struct sk_security_struct *newsksec = newsk->sk_security;
5153
5154 newsksec->sid = sksec->sid;
5155 newsksec->peer_sid = sksec->peer_sid;
5156 newsksec->sclass = sksec->sclass;
5157
5158 selinux_netlbl_sk_security_reset(newsksec);
5159 }
5160
5161 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5162 {
5163 if (!sk)
5164 *secid = SECINITSID_ANY_SOCKET;
5165 else {
5166 struct sk_security_struct *sksec = sk->sk_security;
5167
5168 *secid = sksec->sid;
5169 }
5170 }
5171
5172 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5173 {
5174 struct inode_security_struct *isec =
5175 inode_security_novalidate(SOCK_INODE(parent));
5176 struct sk_security_struct *sksec = sk->sk_security;
5177
5178 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5179 sk->sk_family == PF_UNIX)
5180 isec->sid = sksec->sid;
5181 sksec->sclass = isec->sclass;
5182 }
5183
5184 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5185 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5186 * already present).
5187 */
5188 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5189 struct sk_buff *skb)
5190 {
5191 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5192 struct common_audit_data ad;
5193 struct lsm_network_audit net = {0,};
5194 u8 peerlbl_active;
5195 u32 peer_sid = SECINITSID_UNLABELED;
5196 u32 conn_sid;
5197 int err = 0;
5198
5199 if (!selinux_policycap_extsockclass())
5200 return 0;
5201
5202 peerlbl_active = selinux_peerlbl_enabled();
5203
5204 if (peerlbl_active) {
5205 /* This will return peer_sid = SECSID_NULL if there are
5206 * no peer labels, see security_net_peersid_resolve().
5207 */
5208 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5209 &peer_sid);
5210 if (err)
5211 return err;
5212
5213 if (peer_sid == SECSID_NULL)
5214 peer_sid = SECINITSID_UNLABELED;
5215 }
5216
5217 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5218 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5219
5220 /* Here as first association on socket. As the peer SID
5221 * was allowed by peer recv (and the netif/node checks),
5222 * then it is approved by policy and used as the primary
5223 * peer SID for getpeercon(3).
5224 */
5225 sksec->peer_sid = peer_sid;
5226 } else if (sksec->peer_sid != peer_sid) {
5227 /* Other association peer SIDs are checked to enforce
5228 * consistency among the peer SIDs.
5229 */
5230 ad.type = LSM_AUDIT_DATA_NET;
5231 ad.u.net = &net;
5232 ad.u.net->sk = ep->base.sk;
5233 err = avc_has_perm(&selinux_state,
5234 sksec->peer_sid, peer_sid, sksec->sclass,
5235 SCTP_SOCKET__ASSOCIATION, &ad);
5236 if (err)
5237 return err;
5238 }
5239
5240 /* Compute the MLS component for the connection and store
5241 * the information in ep. This will be used by SCTP TCP type
5242 * sockets and peeled off connections as they cause a new
5243 * socket to be generated. selinux_sctp_sk_clone() will then
5244 * plug this into the new socket.
5245 */
5246 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5247 if (err)
5248 return err;
5249
5250 ep->secid = conn_sid;
5251 ep->peer_secid = peer_sid;
5252
5253 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5254 return selinux_netlbl_sctp_assoc_request(ep, skb);
5255 }
5256
5257 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5258 * based on their @optname.
5259 */
5260 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5261 struct sockaddr *address,
5262 int addrlen)
5263 {
5264 int len, err = 0, walk_size = 0;
5265 void *addr_buf;
5266 struct sockaddr *addr;
5267 struct socket *sock;
5268
5269 if (!selinux_policycap_extsockclass())
5270 return 0;
5271
5272 /* Process one or more addresses that may be IPv4 or IPv6 */
5273 sock = sk->sk_socket;
5274 addr_buf = address;
5275
5276 while (walk_size < addrlen) {
5277 if (walk_size + sizeof(sa_family_t) > addrlen)
5278 return -EINVAL;
5279
5280 addr = addr_buf;
5281 switch (addr->sa_family) {
5282 case AF_UNSPEC:
5283 case AF_INET:
5284 len = sizeof(struct sockaddr_in);
5285 break;
5286 case AF_INET6:
5287 len = sizeof(struct sockaddr_in6);
5288 break;
5289 default:
5290 return -EINVAL;
5291 }
5292
5293 if (walk_size + len > addrlen)
5294 return -EINVAL;
5295
5296 err = -EINVAL;
5297 switch (optname) {
5298 /* Bind checks */
5299 case SCTP_PRIMARY_ADDR:
5300 case SCTP_SET_PEER_PRIMARY_ADDR:
5301 case SCTP_SOCKOPT_BINDX_ADD:
5302 err = selinux_socket_bind(sock, addr, len);
5303 break;
5304 /* Connect checks */
5305 case SCTP_SOCKOPT_CONNECTX:
5306 case SCTP_PARAM_SET_PRIMARY:
5307 case SCTP_PARAM_ADD_IP:
5308 case SCTP_SENDMSG_CONNECT:
5309 err = selinux_socket_connect_helper(sock, addr, len);
5310 if (err)
5311 return err;
5312
5313 /* As selinux_sctp_bind_connect() is called by the
5314 * SCTP protocol layer, the socket is already locked,
5315 * therefore selinux_netlbl_socket_connect_locked() is
5316 * is called here. The situations handled are:
5317 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5318 * whenever a new IP address is added or when a new
5319 * primary address is selected.
5320 * Note that an SCTP connect(2) call happens before
5321 * the SCTP protocol layer and is handled via
5322 * selinux_socket_connect().
5323 */
5324 err = selinux_netlbl_socket_connect_locked(sk, addr);
5325 break;
5326 }
5327
5328 if (err)
5329 return err;
5330
5331 addr_buf += len;
5332 walk_size += len;
5333 }
5334
5335 return 0;
5336 }
5337
5338 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5339 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5340 struct sock *newsk)
5341 {
5342 struct sk_security_struct *sksec = sk->sk_security;
5343 struct sk_security_struct *newsksec = newsk->sk_security;
5344
5345 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5346 * the non-sctp clone version.
5347 */
5348 if (!selinux_policycap_extsockclass())
5349 return selinux_sk_clone_security(sk, newsk);
5350
5351 newsksec->sid = ep->secid;
5352 newsksec->peer_sid = ep->peer_secid;
5353 newsksec->sclass = sksec->sclass;
5354 selinux_netlbl_sctp_sk_clone(sk, newsk);
5355 }
5356
5357 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5358 struct request_sock *req)
5359 {
5360 struct sk_security_struct *sksec = sk->sk_security;
5361 int err;
5362 u16 family = req->rsk_ops->family;
5363 u32 connsid;
5364 u32 peersid;
5365
5366 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5367 if (err)
5368 return err;
5369 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5370 if (err)
5371 return err;
5372 req->secid = connsid;
5373 req->peer_secid = peersid;
5374
5375 return selinux_netlbl_inet_conn_request(req, family);
5376 }
5377
5378 static void selinux_inet_csk_clone(struct sock *newsk,
5379 const struct request_sock *req)
5380 {
5381 struct sk_security_struct *newsksec = newsk->sk_security;
5382
5383 newsksec->sid = req->secid;
5384 newsksec->peer_sid = req->peer_secid;
5385 /* NOTE: Ideally, we should also get the isec->sid for the
5386 new socket in sync, but we don't have the isec available yet.
5387 So we will wait until sock_graft to do it, by which
5388 time it will have been created and available. */
5389
5390 /* We don't need to take any sort of lock here as we are the only
5391 * thread with access to newsksec */
5392 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5393 }
5394
5395 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5396 {
5397 u16 family = sk->sk_family;
5398 struct sk_security_struct *sksec = sk->sk_security;
5399
5400 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5401 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5402 family = PF_INET;
5403
5404 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5405 }
5406
5407 static int selinux_secmark_relabel_packet(u32 sid)
5408 {
5409 const struct task_security_struct *__tsec;
5410 u32 tsid;
5411
5412 __tsec = selinux_cred(current_cred());
5413 tsid = __tsec->sid;
5414
5415 return avc_has_perm(&selinux_state,
5416 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5417 NULL);
5418 }
5419
5420 static void selinux_secmark_refcount_inc(void)
5421 {
5422 atomic_inc(&selinux_secmark_refcount);
5423 }
5424
5425 static void selinux_secmark_refcount_dec(void)
5426 {
5427 atomic_dec(&selinux_secmark_refcount);
5428 }
5429
5430 static void selinux_req_classify_flow(const struct request_sock *req,
5431 struct flowi *fl)
5432 {
5433 fl->flowi_secid = req->secid;
5434 }
5435
5436 static int selinux_tun_dev_alloc_security(void **security)
5437 {
5438 struct tun_security_struct *tunsec;
5439
5440 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5441 if (!tunsec)
5442 return -ENOMEM;
5443 tunsec->sid = current_sid();
5444
5445 *security = tunsec;
5446 return 0;
5447 }
5448
5449 static void selinux_tun_dev_free_security(void *security)
5450 {
5451 kfree(security);
5452 }
5453
5454 static int selinux_tun_dev_create(void)
5455 {
5456 u32 sid = current_sid();
5457
5458 /* we aren't taking into account the "sockcreate" SID since the socket
5459 * that is being created here is not a socket in the traditional sense,
5460 * instead it is a private sock, accessible only to the kernel, and
5461 * representing a wide range of network traffic spanning multiple
5462 * connections unlike traditional sockets - check the TUN driver to
5463 * get a better understanding of why this socket is special */
5464
5465 return avc_has_perm(&selinux_state,
5466 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5467 NULL);
5468 }
5469
5470 static int selinux_tun_dev_attach_queue(void *security)
5471 {
5472 struct tun_security_struct *tunsec = security;
5473
5474 return avc_has_perm(&selinux_state,
5475 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5476 TUN_SOCKET__ATTACH_QUEUE, NULL);
5477 }
5478
5479 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5480 {
5481 struct tun_security_struct *tunsec = security;
5482 struct sk_security_struct *sksec = sk->sk_security;
5483
5484 /* we don't currently perform any NetLabel based labeling here and it
5485 * isn't clear that we would want to do so anyway; while we could apply
5486 * labeling without the support of the TUN user the resulting labeled
5487 * traffic from the other end of the connection would almost certainly
5488 * cause confusion to the TUN user that had no idea network labeling
5489 * protocols were being used */
5490
5491 sksec->sid = tunsec->sid;
5492 sksec->sclass = SECCLASS_TUN_SOCKET;
5493
5494 return 0;
5495 }
5496
5497 static int selinux_tun_dev_open(void *security)
5498 {
5499 struct tun_security_struct *tunsec = security;
5500 u32 sid = current_sid();
5501 int err;
5502
5503 err = avc_has_perm(&selinux_state,
5504 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5505 TUN_SOCKET__RELABELFROM, NULL);
5506 if (err)
5507 return err;
5508 err = avc_has_perm(&selinux_state,
5509 sid, sid, SECCLASS_TUN_SOCKET,
5510 TUN_SOCKET__RELABELTO, NULL);
5511 if (err)
5512 return err;
5513 tunsec->sid = sid;
5514
5515 return 0;
5516 }
5517
5518 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5519 {
5520 int err = 0;
5521 u32 perm;
5522 struct nlmsghdr *nlh;
5523 struct sk_security_struct *sksec = sk->sk_security;
5524
5525 if (skb->len < NLMSG_HDRLEN) {
5526 err = -EINVAL;
5527 goto out;
5528 }
5529 nlh = nlmsg_hdr(skb);
5530
5531 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5532 if (err) {
5533 if (err == -EINVAL) {
5534 pr_warn_ratelimited("SELinux: unrecognized netlink"
5535 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5536 " pig=%d comm=%s\n",
5537 sk->sk_protocol, nlh->nlmsg_type,
5538 secclass_map[sksec->sclass - 1].name,
5539 task_pid_nr(current), current->comm);
5540 if (!enforcing_enabled(&selinux_state) ||
5541 security_get_allow_unknown(&selinux_state))
5542 err = 0;
5543 }
5544
5545 /* Ignore */
5546 if (err == -ENOENT)
5547 err = 0;
5548 goto out;
5549 }
5550
5551 err = sock_has_perm(sk, perm);
5552 out:
5553 return err;
5554 }
5555
5556 #ifdef CONFIG_NETFILTER
5557
5558 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5559 const struct net_device *indev,
5560 u16 family)
5561 {
5562 int err;
5563 char *addrp;
5564 u32 peer_sid;
5565 struct common_audit_data ad;
5566 struct lsm_network_audit net = {0,};
5567 u8 secmark_active;
5568 u8 netlbl_active;
5569 u8 peerlbl_active;
5570
5571 if (!selinux_policycap_netpeer())
5572 return NF_ACCEPT;
5573
5574 secmark_active = selinux_secmark_enabled();
5575 netlbl_active = netlbl_enabled();
5576 peerlbl_active = selinux_peerlbl_enabled();
5577 if (!secmark_active && !peerlbl_active)
5578 return NF_ACCEPT;
5579
5580 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5581 return NF_DROP;
5582
5583 ad.type = LSM_AUDIT_DATA_NET;
5584 ad.u.net = &net;
5585 ad.u.net->netif = indev->ifindex;
5586 ad.u.net->family = family;
5587 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5588 return NF_DROP;
5589
5590 if (peerlbl_active) {
5591 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5592 addrp, family, peer_sid, &ad);
5593 if (err) {
5594 selinux_netlbl_err(skb, family, err, 1);
5595 return NF_DROP;
5596 }
5597 }
5598
5599 if (secmark_active)
5600 if (avc_has_perm(&selinux_state,
5601 peer_sid, skb->secmark,
5602 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5603 return NF_DROP;
5604
5605 if (netlbl_active)
5606 /* we do this in the FORWARD path and not the POST_ROUTING
5607 * path because we want to make sure we apply the necessary
5608 * labeling before IPsec is applied so we can leverage AH
5609 * protection */
5610 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5611 return NF_DROP;
5612
5613 return NF_ACCEPT;
5614 }
5615
5616 static unsigned int selinux_ipv4_forward(void *priv,
5617 struct sk_buff *skb,
5618 const struct nf_hook_state *state)
5619 {
5620 return selinux_ip_forward(skb, state->in, PF_INET);
5621 }
5622
5623 #if IS_ENABLED(CONFIG_IPV6)
5624 static unsigned int selinux_ipv6_forward(void *priv,
5625 struct sk_buff *skb,
5626 const struct nf_hook_state *state)
5627 {
5628 return selinux_ip_forward(skb, state->in, PF_INET6);
5629 }
5630 #endif /* IPV6 */
5631
5632 static unsigned int selinux_ip_output(struct sk_buff *skb,
5633 u16 family)
5634 {
5635 struct sock *sk;
5636 u32 sid;
5637
5638 if (!netlbl_enabled())
5639 return NF_ACCEPT;
5640
5641 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5642 * because we want to make sure we apply the necessary labeling
5643 * before IPsec is applied so we can leverage AH protection */
5644 sk = skb->sk;
5645 if (sk) {
5646 struct sk_security_struct *sksec;
5647
5648 if (sk_listener(sk))
5649 /* if the socket is the listening state then this
5650 * packet is a SYN-ACK packet which means it needs to
5651 * be labeled based on the connection/request_sock and
5652 * not the parent socket. unfortunately, we can't
5653 * lookup the request_sock yet as it isn't queued on
5654 * the parent socket until after the SYN-ACK is sent.
5655 * the "solution" is to simply pass the packet as-is
5656 * as any IP option based labeling should be copied
5657 * from the initial connection request (in the IP
5658 * layer). it is far from ideal, but until we get a
5659 * security label in the packet itself this is the
5660 * best we can do. */
5661 return NF_ACCEPT;
5662
5663 /* standard practice, label using the parent socket */
5664 sksec = sk->sk_security;
5665 sid = sksec->sid;
5666 } else
5667 sid = SECINITSID_KERNEL;
5668 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5669 return NF_DROP;
5670
5671 return NF_ACCEPT;
5672 }
5673
5674 static unsigned int selinux_ipv4_output(void *priv,
5675 struct sk_buff *skb,
5676 const struct nf_hook_state *state)
5677 {
5678 return selinux_ip_output(skb, PF_INET);
5679 }
5680
5681 #if IS_ENABLED(CONFIG_IPV6)
5682 static unsigned int selinux_ipv6_output(void *priv,
5683 struct sk_buff *skb,
5684 const struct nf_hook_state *state)
5685 {
5686 return selinux_ip_output(skb, PF_INET6);
5687 }
5688 #endif /* IPV6 */
5689
5690 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5691 int ifindex,
5692 u16 family)
5693 {
5694 struct sock *sk = skb_to_full_sk(skb);
5695 struct sk_security_struct *sksec;
5696 struct common_audit_data ad;
5697 struct lsm_network_audit net = {0,};
5698 char *addrp;
5699 u8 proto;
5700
5701 if (sk == NULL)
5702 return NF_ACCEPT;
5703 sksec = sk->sk_security;
5704
5705 ad.type = LSM_AUDIT_DATA_NET;
5706 ad.u.net = &net;
5707 ad.u.net->netif = ifindex;
5708 ad.u.net->family = family;
5709 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5710 return NF_DROP;
5711
5712 if (selinux_secmark_enabled())
5713 if (avc_has_perm(&selinux_state,
5714 sksec->sid, skb->secmark,
5715 SECCLASS_PACKET, PACKET__SEND, &ad))
5716 return NF_DROP_ERR(-ECONNREFUSED);
5717
5718 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5719 return NF_DROP_ERR(-ECONNREFUSED);
5720
5721 return NF_ACCEPT;
5722 }
5723
5724 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5725 const struct net_device *outdev,
5726 u16 family)
5727 {
5728 u32 secmark_perm;
5729 u32 peer_sid;
5730 int ifindex = outdev->ifindex;
5731 struct sock *sk;
5732 struct common_audit_data ad;
5733 struct lsm_network_audit net = {0,};
5734 char *addrp;
5735 u8 secmark_active;
5736 u8 peerlbl_active;
5737
5738 /* If any sort of compatibility mode is enabled then handoff processing
5739 * to the selinux_ip_postroute_compat() function to deal with the
5740 * special handling. We do this in an attempt to keep this function
5741 * as fast and as clean as possible. */
5742 if (!selinux_policycap_netpeer())
5743 return selinux_ip_postroute_compat(skb, ifindex, family);
5744
5745 secmark_active = selinux_secmark_enabled();
5746 peerlbl_active = selinux_peerlbl_enabled();
5747 if (!secmark_active && !peerlbl_active)
5748 return NF_ACCEPT;
5749
5750 sk = skb_to_full_sk(skb);
5751
5752 #ifdef CONFIG_XFRM
5753 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5754 * packet transformation so allow the packet to pass without any checks
5755 * since we'll have another chance to perform access control checks
5756 * when the packet is on it's final way out.
5757 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5758 * is NULL, in this case go ahead and apply access control.
5759 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5760 * TCP listening state we cannot wait until the XFRM processing
5761 * is done as we will miss out on the SA label if we do;
5762 * unfortunately, this means more work, but it is only once per
5763 * connection. */
5764 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5765 !(sk && sk_listener(sk)))
5766 return NF_ACCEPT;
5767 #endif
5768
5769 if (sk == NULL) {
5770 /* Without an associated socket the packet is either coming
5771 * from the kernel or it is being forwarded; check the packet
5772 * to determine which and if the packet is being forwarded
5773 * query the packet directly to determine the security label. */
5774 if (skb->skb_iif) {
5775 secmark_perm = PACKET__FORWARD_OUT;
5776 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5777 return NF_DROP;
5778 } else {
5779 secmark_perm = PACKET__SEND;
5780 peer_sid = SECINITSID_KERNEL;
5781 }
5782 } else if (sk_listener(sk)) {
5783 /* Locally generated packet but the associated socket is in the
5784 * listening state which means this is a SYN-ACK packet. In
5785 * this particular case the correct security label is assigned
5786 * to the connection/request_sock but unfortunately we can't
5787 * query the request_sock as it isn't queued on the parent
5788 * socket until after the SYN-ACK packet is sent; the only
5789 * viable choice is to regenerate the label like we do in
5790 * selinux_inet_conn_request(). See also selinux_ip_output()
5791 * for similar problems. */
5792 u32 skb_sid;
5793 struct sk_security_struct *sksec;
5794
5795 sksec = sk->sk_security;
5796 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5797 return NF_DROP;
5798 /* At this point, if the returned skb peerlbl is SECSID_NULL
5799 * and the packet has been through at least one XFRM
5800 * transformation then we must be dealing with the "final"
5801 * form of labeled IPsec packet; since we've already applied
5802 * all of our access controls on this packet we can safely
5803 * pass the packet. */
5804 if (skb_sid == SECSID_NULL) {
5805 switch (family) {
5806 case PF_INET:
5807 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5808 return NF_ACCEPT;
5809 break;
5810 case PF_INET6:
5811 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5812 return NF_ACCEPT;
5813 break;
5814 default:
5815 return NF_DROP_ERR(-ECONNREFUSED);
5816 }
5817 }
5818 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5819 return NF_DROP;
5820 secmark_perm = PACKET__SEND;
5821 } else {
5822 /* Locally generated packet, fetch the security label from the
5823 * associated socket. */
5824 struct sk_security_struct *sksec = sk->sk_security;
5825 peer_sid = sksec->sid;
5826 secmark_perm = PACKET__SEND;
5827 }
5828
5829 ad.type = LSM_AUDIT_DATA_NET;
5830 ad.u.net = &net;
5831 ad.u.net->netif = ifindex;
5832 ad.u.net->family = family;
5833 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5834 return NF_DROP;
5835
5836 if (secmark_active)
5837 if (avc_has_perm(&selinux_state,
5838 peer_sid, skb->secmark,
5839 SECCLASS_PACKET, secmark_perm, &ad))
5840 return NF_DROP_ERR(-ECONNREFUSED);
5841
5842 if (peerlbl_active) {
5843 u32 if_sid;
5844 u32 node_sid;
5845
5846 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5847 return NF_DROP;
5848 if (avc_has_perm(&selinux_state,
5849 peer_sid, if_sid,
5850 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5851 return NF_DROP_ERR(-ECONNREFUSED);
5852
5853 if (sel_netnode_sid(addrp, family, &node_sid))
5854 return NF_DROP;
5855 if (avc_has_perm(&selinux_state,
5856 peer_sid, node_sid,
5857 SECCLASS_NODE, NODE__SENDTO, &ad))
5858 return NF_DROP_ERR(-ECONNREFUSED);
5859 }
5860
5861 return NF_ACCEPT;
5862 }
5863
5864 static unsigned int selinux_ipv4_postroute(void *priv,
5865 struct sk_buff *skb,
5866 const struct nf_hook_state *state)
5867 {
5868 return selinux_ip_postroute(skb, state->out, PF_INET);
5869 }
5870
5871 #if IS_ENABLED(CONFIG_IPV6)
5872 static unsigned int selinux_ipv6_postroute(void *priv,
5873 struct sk_buff *skb,
5874 const struct nf_hook_state *state)
5875 {
5876 return selinux_ip_postroute(skb, state->out, PF_INET6);
5877 }
5878 #endif /* IPV6 */
5879
5880 #endif /* CONFIG_NETFILTER */
5881
5882 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5883 {
5884 return selinux_nlmsg_perm(sk, skb);
5885 }
5886
5887 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5888 {
5889 isec->sclass = sclass;
5890 isec->sid = current_sid();
5891 }
5892
5893 static int msg_msg_alloc_security(struct msg_msg *msg)
5894 {
5895 struct msg_security_struct *msec;
5896
5897 msec = selinux_msg_msg(msg);
5898 msec->sid = SECINITSID_UNLABELED;
5899
5900 return 0;
5901 }
5902
5903 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5904 u32 perms)
5905 {
5906 struct ipc_security_struct *isec;
5907 struct common_audit_data ad;
5908 u32 sid = current_sid();
5909
5910 isec = selinux_ipc(ipc_perms);
5911
5912 ad.type = LSM_AUDIT_DATA_IPC;
5913 ad.u.ipc_id = ipc_perms->key;
5914
5915 return avc_has_perm(&selinux_state,
5916 sid, isec->sid, isec->sclass, perms, &ad);
5917 }
5918
5919 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5920 {
5921 return msg_msg_alloc_security(msg);
5922 }
5923
5924 /* message queue security operations */
5925 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5926 {
5927 struct ipc_security_struct *isec;
5928 struct common_audit_data ad;
5929 u32 sid = current_sid();
5930 int rc;
5931
5932 isec = selinux_ipc(msq);
5933 ipc_init_security(isec, SECCLASS_MSGQ);
5934
5935 ad.type = LSM_AUDIT_DATA_IPC;
5936 ad.u.ipc_id = msq->key;
5937
5938 rc = avc_has_perm(&selinux_state,
5939 sid, isec->sid, SECCLASS_MSGQ,
5940 MSGQ__CREATE, &ad);
5941 return rc;
5942 }
5943
5944 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5945 {
5946 struct ipc_security_struct *isec;
5947 struct common_audit_data ad;
5948 u32 sid = current_sid();
5949
5950 isec = selinux_ipc(msq);
5951
5952 ad.type = LSM_AUDIT_DATA_IPC;
5953 ad.u.ipc_id = msq->key;
5954
5955 return avc_has_perm(&selinux_state,
5956 sid, isec->sid, SECCLASS_MSGQ,
5957 MSGQ__ASSOCIATE, &ad);
5958 }
5959
5960 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5961 {
5962 int err;
5963 int perms;
5964
5965 switch (cmd) {
5966 case IPC_INFO:
5967 case MSG_INFO:
5968 /* No specific object, just general system-wide information. */
5969 return avc_has_perm(&selinux_state,
5970 current_sid(), SECINITSID_KERNEL,
5971 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5972 case IPC_STAT:
5973 case MSG_STAT:
5974 case MSG_STAT_ANY:
5975 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5976 break;
5977 case IPC_SET:
5978 perms = MSGQ__SETATTR;
5979 break;
5980 case IPC_RMID:
5981 perms = MSGQ__DESTROY;
5982 break;
5983 default:
5984 return 0;
5985 }
5986
5987 err = ipc_has_perm(msq, perms);
5988 return err;
5989 }
5990
5991 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5992 {
5993 struct ipc_security_struct *isec;
5994 struct msg_security_struct *msec;
5995 struct common_audit_data ad;
5996 u32 sid = current_sid();
5997 int rc;
5998
5999 isec = selinux_ipc(msq);
6000 msec = selinux_msg_msg(msg);
6001
6002 /*
6003 * First time through, need to assign label to the message
6004 */
6005 if (msec->sid == SECINITSID_UNLABELED) {
6006 /*
6007 * Compute new sid based on current process and
6008 * message queue this message will be stored in
6009 */
6010 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6011 SECCLASS_MSG, NULL, &msec->sid);
6012 if (rc)
6013 return rc;
6014 }
6015
6016 ad.type = LSM_AUDIT_DATA_IPC;
6017 ad.u.ipc_id = msq->key;
6018
6019 /* Can this process write to the queue? */
6020 rc = avc_has_perm(&selinux_state,
6021 sid, isec->sid, SECCLASS_MSGQ,
6022 MSGQ__WRITE, &ad);
6023 if (!rc)
6024 /* Can this process send the message */
6025 rc = avc_has_perm(&selinux_state,
6026 sid, msec->sid, SECCLASS_MSG,
6027 MSG__SEND, &ad);
6028 if (!rc)
6029 /* Can the message be put in the queue? */
6030 rc = avc_has_perm(&selinux_state,
6031 msec->sid, isec->sid, SECCLASS_MSGQ,
6032 MSGQ__ENQUEUE, &ad);
6033
6034 return rc;
6035 }
6036
6037 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6038 struct task_struct *target,
6039 long type, int mode)
6040 {
6041 struct ipc_security_struct *isec;
6042 struct msg_security_struct *msec;
6043 struct common_audit_data ad;
6044 u32 sid = task_sid(target);
6045 int rc;
6046
6047 isec = selinux_ipc(msq);
6048 msec = selinux_msg_msg(msg);
6049
6050 ad.type = LSM_AUDIT_DATA_IPC;
6051 ad.u.ipc_id = msq->key;
6052
6053 rc = avc_has_perm(&selinux_state,
6054 sid, isec->sid,
6055 SECCLASS_MSGQ, MSGQ__READ, &ad);
6056 if (!rc)
6057 rc = avc_has_perm(&selinux_state,
6058 sid, msec->sid,
6059 SECCLASS_MSG, MSG__RECEIVE, &ad);
6060 return rc;
6061 }
6062
6063 /* Shared Memory security operations */
6064 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6065 {
6066 struct ipc_security_struct *isec;
6067 struct common_audit_data ad;
6068 u32 sid = current_sid();
6069 int rc;
6070
6071 isec = selinux_ipc(shp);
6072 ipc_init_security(isec, SECCLASS_SHM);
6073
6074 ad.type = LSM_AUDIT_DATA_IPC;
6075 ad.u.ipc_id = shp->key;
6076
6077 rc = avc_has_perm(&selinux_state,
6078 sid, isec->sid, SECCLASS_SHM,
6079 SHM__CREATE, &ad);
6080 return rc;
6081 }
6082
6083 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6084 {
6085 struct ipc_security_struct *isec;
6086 struct common_audit_data ad;
6087 u32 sid = current_sid();
6088
6089 isec = selinux_ipc(shp);
6090
6091 ad.type = LSM_AUDIT_DATA_IPC;
6092 ad.u.ipc_id = shp->key;
6093
6094 return avc_has_perm(&selinux_state,
6095 sid, isec->sid, SECCLASS_SHM,
6096 SHM__ASSOCIATE, &ad);
6097 }
6098
6099 /* Note, at this point, shp is locked down */
6100 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6101 {
6102 int perms;
6103 int err;
6104
6105 switch (cmd) {
6106 case IPC_INFO:
6107 case SHM_INFO:
6108 /* No specific object, just general system-wide information. */
6109 return avc_has_perm(&selinux_state,
6110 current_sid(), SECINITSID_KERNEL,
6111 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6112 case IPC_STAT:
6113 case SHM_STAT:
6114 case SHM_STAT_ANY:
6115 perms = SHM__GETATTR | SHM__ASSOCIATE;
6116 break;
6117 case IPC_SET:
6118 perms = SHM__SETATTR;
6119 break;
6120 case SHM_LOCK:
6121 case SHM_UNLOCK:
6122 perms = SHM__LOCK;
6123 break;
6124 case IPC_RMID:
6125 perms = SHM__DESTROY;
6126 break;
6127 default:
6128 return 0;
6129 }
6130
6131 err = ipc_has_perm(shp, perms);
6132 return err;
6133 }
6134
6135 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6136 char __user *shmaddr, int shmflg)
6137 {
6138 u32 perms;
6139
6140 if (shmflg & SHM_RDONLY)
6141 perms = SHM__READ;
6142 else
6143 perms = SHM__READ | SHM__WRITE;
6144
6145 return ipc_has_perm(shp, perms);
6146 }
6147
6148 /* Semaphore security operations */
6149 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6150 {
6151 struct ipc_security_struct *isec;
6152 struct common_audit_data ad;
6153 u32 sid = current_sid();
6154 int rc;
6155
6156 isec = selinux_ipc(sma);
6157 ipc_init_security(isec, SECCLASS_SEM);
6158
6159 ad.type = LSM_AUDIT_DATA_IPC;
6160 ad.u.ipc_id = sma->key;
6161
6162 rc = avc_has_perm(&selinux_state,
6163 sid, isec->sid, SECCLASS_SEM,
6164 SEM__CREATE, &ad);
6165 return rc;
6166 }
6167
6168 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6169 {
6170 struct ipc_security_struct *isec;
6171 struct common_audit_data ad;
6172 u32 sid = current_sid();
6173
6174 isec = selinux_ipc(sma);
6175
6176 ad.type = LSM_AUDIT_DATA_IPC;
6177 ad.u.ipc_id = sma->key;
6178
6179 return avc_has_perm(&selinux_state,
6180 sid, isec->sid, SECCLASS_SEM,
6181 SEM__ASSOCIATE, &ad);
6182 }
6183
6184 /* Note, at this point, sma is locked down */
6185 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6186 {
6187 int err;
6188 u32 perms;
6189
6190 switch (cmd) {
6191 case IPC_INFO:
6192 case SEM_INFO:
6193 /* No specific object, just general system-wide information. */
6194 return avc_has_perm(&selinux_state,
6195 current_sid(), SECINITSID_KERNEL,
6196 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6197 case GETPID:
6198 case GETNCNT:
6199 case GETZCNT:
6200 perms = SEM__GETATTR;
6201 break;
6202 case GETVAL:
6203 case GETALL:
6204 perms = SEM__READ;
6205 break;
6206 case SETVAL:
6207 case SETALL:
6208 perms = SEM__WRITE;
6209 break;
6210 case IPC_RMID:
6211 perms = SEM__DESTROY;
6212 break;
6213 case IPC_SET:
6214 perms = SEM__SETATTR;
6215 break;
6216 case IPC_STAT:
6217 case SEM_STAT:
6218 case SEM_STAT_ANY:
6219 perms = SEM__GETATTR | SEM__ASSOCIATE;
6220 break;
6221 default:
6222 return 0;
6223 }
6224
6225 err = ipc_has_perm(sma, perms);
6226 return err;
6227 }
6228
6229 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6230 struct sembuf *sops, unsigned nsops, int alter)
6231 {
6232 u32 perms;
6233
6234 if (alter)
6235 perms = SEM__READ | SEM__WRITE;
6236 else
6237 perms = SEM__READ;
6238
6239 return ipc_has_perm(sma, perms);
6240 }
6241
6242 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6243 {
6244 u32 av = 0;
6245
6246 av = 0;
6247 if (flag & S_IRUGO)
6248 av |= IPC__UNIX_READ;
6249 if (flag & S_IWUGO)
6250 av |= IPC__UNIX_WRITE;
6251
6252 if (av == 0)
6253 return 0;
6254
6255 return ipc_has_perm(ipcp, av);
6256 }
6257
6258 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6259 {
6260 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6261 *secid = isec->sid;
6262 }
6263
6264 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6265 {
6266 if (inode)
6267 inode_doinit_with_dentry(inode, dentry);
6268 }
6269
6270 static int selinux_getprocattr(struct task_struct *p,
6271 char *name, char **value)
6272 {
6273 const struct task_security_struct *__tsec;
6274 u32 sid;
6275 int error;
6276 unsigned len;
6277
6278 rcu_read_lock();
6279 __tsec = selinux_cred(__task_cred(p));
6280
6281 if (current != p) {
6282 error = avc_has_perm(&selinux_state,
6283 current_sid(), __tsec->sid,
6284 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6285 if (error)
6286 goto bad;
6287 }
6288
6289 if (!strcmp(name, "current"))
6290 sid = __tsec->sid;
6291 else if (!strcmp(name, "prev"))
6292 sid = __tsec->osid;
6293 else if (!strcmp(name, "exec"))
6294 sid = __tsec->exec_sid;
6295 else if (!strcmp(name, "fscreate"))
6296 sid = __tsec->create_sid;
6297 else if (!strcmp(name, "keycreate"))
6298 sid = __tsec->keycreate_sid;
6299 else if (!strcmp(name, "sockcreate"))
6300 sid = __tsec->sockcreate_sid;
6301 else {
6302 error = -EINVAL;
6303 goto bad;
6304 }
6305 rcu_read_unlock();
6306
6307 if (!sid)
6308 return 0;
6309
6310 error = security_sid_to_context(&selinux_state, sid, value, &len);
6311 if (error)
6312 return error;
6313 return len;
6314
6315 bad:
6316 rcu_read_unlock();
6317 return error;
6318 }
6319
6320 static int selinux_setprocattr(const char *name, void *value, size_t size)
6321 {
6322 struct task_security_struct *tsec;
6323 struct cred *new;
6324 u32 mysid = current_sid(), sid = 0, ptsid;
6325 int error;
6326 char *str = value;
6327
6328 /*
6329 * Basic control over ability to set these attributes at all.
6330 */
6331 if (!strcmp(name, "exec"))
6332 error = avc_has_perm(&selinux_state,
6333 mysid, mysid, SECCLASS_PROCESS,
6334 PROCESS__SETEXEC, NULL);
6335 else if (!strcmp(name, "fscreate"))
6336 error = avc_has_perm(&selinux_state,
6337 mysid, mysid, SECCLASS_PROCESS,
6338 PROCESS__SETFSCREATE, NULL);
6339 else if (!strcmp(name, "keycreate"))
6340 error = avc_has_perm(&selinux_state,
6341 mysid, mysid, SECCLASS_PROCESS,
6342 PROCESS__SETKEYCREATE, NULL);
6343 else if (!strcmp(name, "sockcreate"))
6344 error = avc_has_perm(&selinux_state,
6345 mysid, mysid, SECCLASS_PROCESS,
6346 PROCESS__SETSOCKCREATE, NULL);
6347 else if (!strcmp(name, "current"))
6348 error = avc_has_perm(&selinux_state,
6349 mysid, mysid, SECCLASS_PROCESS,
6350 PROCESS__SETCURRENT, NULL);
6351 else
6352 error = -EINVAL;
6353 if (error)
6354 return error;
6355
6356 /* Obtain a SID for the context, if one was specified. */
6357 if (size && str[0] && str[0] != '\n') {
6358 if (str[size-1] == '\n') {
6359 str[size-1] = 0;
6360 size--;
6361 }
6362 error = security_context_to_sid(&selinux_state, value, size,
6363 &sid, GFP_KERNEL);
6364 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6365 if (!has_cap_mac_admin(true)) {
6366 struct audit_buffer *ab;
6367 size_t audit_size;
6368
6369 /* We strip a nul only if it is at the end, otherwise the
6370 * context contains a nul and we should audit that */
6371 if (str[size - 1] == '\0')
6372 audit_size = size - 1;
6373 else
6374 audit_size = size;
6375 ab = audit_log_start(audit_context(),
6376 GFP_ATOMIC,
6377 AUDIT_SELINUX_ERR);
6378 audit_log_format(ab, "op=fscreate invalid_context=");
6379 audit_log_n_untrustedstring(ab, value, audit_size);
6380 audit_log_end(ab);
6381
6382 return error;
6383 }
6384 error = security_context_to_sid_force(
6385 &selinux_state,
6386 value, size, &sid);
6387 }
6388 if (error)
6389 return error;
6390 }
6391
6392 new = prepare_creds();
6393 if (!new)
6394 return -ENOMEM;
6395
6396 /* Permission checking based on the specified context is
6397 performed during the actual operation (execve,
6398 open/mkdir/...), when we know the full context of the
6399 operation. See selinux_bprm_set_creds for the execve
6400 checks and may_create for the file creation checks. The
6401 operation will then fail if the context is not permitted. */
6402 tsec = selinux_cred(new);
6403 if (!strcmp(name, "exec")) {
6404 tsec->exec_sid = sid;
6405 } else if (!strcmp(name, "fscreate")) {
6406 tsec->create_sid = sid;
6407 } else if (!strcmp(name, "keycreate")) {
6408 if (sid) {
6409 error = avc_has_perm(&selinux_state, mysid, sid,
6410 SECCLASS_KEY, KEY__CREATE, NULL);
6411 if (error)
6412 goto abort_change;
6413 }
6414 tsec->keycreate_sid = sid;
6415 } else if (!strcmp(name, "sockcreate")) {
6416 tsec->sockcreate_sid = sid;
6417 } else if (!strcmp(name, "current")) {
6418 error = -EINVAL;
6419 if (sid == 0)
6420 goto abort_change;
6421
6422 /* Only allow single threaded processes to change context */
6423 error = -EPERM;
6424 if (!current_is_single_threaded()) {
6425 error = security_bounded_transition(&selinux_state,
6426 tsec->sid, sid);
6427 if (error)
6428 goto abort_change;
6429 }
6430
6431 /* Check permissions for the transition. */
6432 error = avc_has_perm(&selinux_state,
6433 tsec->sid, sid, SECCLASS_PROCESS,
6434 PROCESS__DYNTRANSITION, NULL);
6435 if (error)
6436 goto abort_change;
6437
6438 /* Check for ptracing, and update the task SID if ok.
6439 Otherwise, leave SID unchanged and fail. */
6440 ptsid = ptrace_parent_sid();
6441 if (ptsid != 0) {
6442 error = avc_has_perm(&selinux_state,
6443 ptsid, sid, SECCLASS_PROCESS,
6444 PROCESS__PTRACE, NULL);
6445 if (error)
6446 goto abort_change;
6447 }
6448
6449 tsec->sid = sid;
6450 } else {
6451 error = -EINVAL;
6452 goto abort_change;
6453 }
6454
6455 commit_creds(new);
6456 return size;
6457
6458 abort_change:
6459 abort_creds(new);
6460 return error;
6461 }
6462
6463 static int selinux_ismaclabel(const char *name)
6464 {
6465 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6466 }
6467
6468 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6469 {
6470 return security_sid_to_context(&selinux_state, secid,
6471 secdata, seclen);
6472 }
6473
6474 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6475 {
6476 return security_context_to_sid(&selinux_state, secdata, seclen,
6477 secid, GFP_KERNEL);
6478 }
6479
6480 static void selinux_release_secctx(char *secdata, u32 seclen)
6481 {
6482 kfree(secdata);
6483 }
6484
6485 static void selinux_inode_invalidate_secctx(struct inode *inode)
6486 {
6487 struct inode_security_struct *isec = selinux_inode(inode);
6488
6489 spin_lock(&isec->lock);
6490 isec->initialized = LABEL_INVALID;
6491 spin_unlock(&isec->lock);
6492 }
6493
6494 /*
6495 * called with inode->i_mutex locked
6496 */
6497 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6498 {
6499 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6500 ctx, ctxlen, 0);
6501 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6502 return rc == -EOPNOTSUPP ? 0 : rc;
6503 }
6504
6505 /*
6506 * called with inode->i_mutex locked
6507 */
6508 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6509 {
6510 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6511 }
6512
6513 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6514 {
6515 int len = 0;
6516 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6517 ctx, true);
6518 if (len < 0)
6519 return len;
6520 *ctxlen = len;
6521 return 0;
6522 }
6523 #ifdef CONFIG_KEYS
6524
6525 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6526 unsigned long flags)
6527 {
6528 const struct task_security_struct *tsec;
6529 struct key_security_struct *ksec;
6530
6531 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6532 if (!ksec)
6533 return -ENOMEM;
6534
6535 tsec = selinux_cred(cred);
6536 if (tsec->keycreate_sid)
6537 ksec->sid = tsec->keycreate_sid;
6538 else
6539 ksec->sid = tsec->sid;
6540
6541 k->security = ksec;
6542 return 0;
6543 }
6544
6545 static void selinux_key_free(struct key *k)
6546 {
6547 struct key_security_struct *ksec = k->security;
6548
6549 k->security = NULL;
6550 kfree(ksec);
6551 }
6552
6553 static int selinux_key_permission(key_ref_t key_ref,
6554 const struct cred *cred,
6555 unsigned perm)
6556 {
6557 struct key *key;
6558 struct key_security_struct *ksec;
6559 u32 sid;
6560
6561 /* if no specific permissions are requested, we skip the
6562 permission check. No serious, additional covert channels
6563 appear to be created. */
6564 if (perm == 0)
6565 return 0;
6566
6567 sid = cred_sid(cred);
6568
6569 key = key_ref_to_ptr(key_ref);
6570 ksec = key->security;
6571
6572 return avc_has_perm(&selinux_state,
6573 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6574 }
6575
6576 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6577 {
6578 struct key_security_struct *ksec = key->security;
6579 char *context = NULL;
6580 unsigned len;
6581 int rc;
6582
6583 rc = security_sid_to_context(&selinux_state, ksec->sid,
6584 &context, &len);
6585 if (!rc)
6586 rc = len;
6587 *_buffer = context;
6588 return rc;
6589 }
6590 #endif
6591
6592 #ifdef CONFIG_SECURITY_INFINIBAND
6593 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6594 {
6595 struct common_audit_data ad;
6596 int err;
6597 u32 sid = 0;
6598 struct ib_security_struct *sec = ib_sec;
6599 struct lsm_ibpkey_audit ibpkey;
6600
6601 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6602 if (err)
6603 return err;
6604
6605 ad.type = LSM_AUDIT_DATA_IBPKEY;
6606 ibpkey.subnet_prefix = subnet_prefix;
6607 ibpkey.pkey = pkey_val;
6608 ad.u.ibpkey = &ibpkey;
6609 return avc_has_perm(&selinux_state,
6610 sec->sid, sid,
6611 SECCLASS_INFINIBAND_PKEY,
6612 INFINIBAND_PKEY__ACCESS, &ad);
6613 }
6614
6615 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6616 u8 port_num)
6617 {
6618 struct common_audit_data ad;
6619 int err;
6620 u32 sid = 0;
6621 struct ib_security_struct *sec = ib_sec;
6622 struct lsm_ibendport_audit ibendport;
6623
6624 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6625 &sid);
6626
6627 if (err)
6628 return err;
6629
6630 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6631 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6632 ibendport.port = port_num;
6633 ad.u.ibendport = &ibendport;
6634 return avc_has_perm(&selinux_state,
6635 sec->sid, sid,
6636 SECCLASS_INFINIBAND_ENDPORT,
6637 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6638 }
6639
6640 static int selinux_ib_alloc_security(void **ib_sec)
6641 {
6642 struct ib_security_struct *sec;
6643
6644 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6645 if (!sec)
6646 return -ENOMEM;
6647 sec->sid = current_sid();
6648
6649 *ib_sec = sec;
6650 return 0;
6651 }
6652
6653 static void selinux_ib_free_security(void *ib_sec)
6654 {
6655 kfree(ib_sec);
6656 }
6657 #endif
6658
6659 #ifdef CONFIG_BPF_SYSCALL
6660 static int selinux_bpf(int cmd, union bpf_attr *attr,
6661 unsigned int size)
6662 {
6663 u32 sid = current_sid();
6664 int ret;
6665
6666 switch (cmd) {
6667 case BPF_MAP_CREATE:
6668 ret = avc_has_perm(&selinux_state,
6669 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6670 NULL);
6671 break;
6672 case BPF_PROG_LOAD:
6673 ret = avc_has_perm(&selinux_state,
6674 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6675 NULL);
6676 break;
6677 default:
6678 ret = 0;
6679 break;
6680 }
6681
6682 return ret;
6683 }
6684
6685 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6686 {
6687 u32 av = 0;
6688
6689 if (fmode & FMODE_READ)
6690 av |= BPF__MAP_READ;
6691 if (fmode & FMODE_WRITE)
6692 av |= BPF__MAP_WRITE;
6693 return av;
6694 }
6695
6696 /* This function will check the file pass through unix socket or binder to see
6697 * if it is a bpf related object. And apply correspinding checks on the bpf
6698 * object based on the type. The bpf maps and programs, not like other files and
6699 * socket, are using a shared anonymous inode inside the kernel as their inode.
6700 * So checking that inode cannot identify if the process have privilege to
6701 * access the bpf object and that's why we have to add this additional check in
6702 * selinux_file_receive and selinux_binder_transfer_files.
6703 */
6704 static int bpf_fd_pass(struct file *file, u32 sid)
6705 {
6706 struct bpf_security_struct *bpfsec;
6707 struct bpf_prog *prog;
6708 struct bpf_map *map;
6709 int ret;
6710
6711 if (file->f_op == &bpf_map_fops) {
6712 map = file->private_data;
6713 bpfsec = map->security;
6714 ret = avc_has_perm(&selinux_state,
6715 sid, bpfsec->sid, SECCLASS_BPF,
6716 bpf_map_fmode_to_av(file->f_mode), NULL);
6717 if (ret)
6718 return ret;
6719 } else if (file->f_op == &bpf_prog_fops) {
6720 prog = file->private_data;
6721 bpfsec = prog->aux->security;
6722 ret = avc_has_perm(&selinux_state,
6723 sid, bpfsec->sid, SECCLASS_BPF,
6724 BPF__PROG_RUN, NULL);
6725 if (ret)
6726 return ret;
6727 }
6728 return 0;
6729 }
6730
6731 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6732 {
6733 u32 sid = current_sid();
6734 struct bpf_security_struct *bpfsec;
6735
6736 bpfsec = map->security;
6737 return avc_has_perm(&selinux_state,
6738 sid, bpfsec->sid, SECCLASS_BPF,
6739 bpf_map_fmode_to_av(fmode), NULL);
6740 }
6741
6742 static int selinux_bpf_prog(struct bpf_prog *prog)
6743 {
6744 u32 sid = current_sid();
6745 struct bpf_security_struct *bpfsec;
6746
6747 bpfsec = prog->aux->security;
6748 return avc_has_perm(&selinux_state,
6749 sid, bpfsec->sid, SECCLASS_BPF,
6750 BPF__PROG_RUN, NULL);
6751 }
6752
6753 static int selinux_bpf_map_alloc(struct bpf_map *map)
6754 {
6755 struct bpf_security_struct *bpfsec;
6756
6757 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6758 if (!bpfsec)
6759 return -ENOMEM;
6760
6761 bpfsec->sid = current_sid();
6762 map->security = bpfsec;
6763
6764 return 0;
6765 }
6766
6767 static void selinux_bpf_map_free(struct bpf_map *map)
6768 {
6769 struct bpf_security_struct *bpfsec = map->security;
6770
6771 map->security = NULL;
6772 kfree(bpfsec);
6773 }
6774
6775 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6776 {
6777 struct bpf_security_struct *bpfsec;
6778
6779 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6780 if (!bpfsec)
6781 return -ENOMEM;
6782
6783 bpfsec->sid = current_sid();
6784 aux->security = bpfsec;
6785
6786 return 0;
6787 }
6788
6789 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6790 {
6791 struct bpf_security_struct *bpfsec = aux->security;
6792
6793 aux->security = NULL;
6794 kfree(bpfsec);
6795 }
6796 #endif
6797
6798 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6799 .lbs_cred = sizeof(struct task_security_struct),
6800 .lbs_file = sizeof(struct file_security_struct),
6801 .lbs_inode = sizeof(struct inode_security_struct),
6802 .lbs_ipc = sizeof(struct ipc_security_struct),
6803 .lbs_msg_msg = sizeof(struct msg_security_struct),
6804 };
6805
6806 #ifdef CONFIG_PERF_EVENTS
6807 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6808 {
6809 u32 requested, sid = current_sid();
6810
6811 if (type == PERF_SECURITY_OPEN)
6812 requested = PERF_EVENT__OPEN;
6813 else if (type == PERF_SECURITY_CPU)
6814 requested = PERF_EVENT__CPU;
6815 else if (type == PERF_SECURITY_KERNEL)
6816 requested = PERF_EVENT__KERNEL;
6817 else if (type == PERF_SECURITY_TRACEPOINT)
6818 requested = PERF_EVENT__TRACEPOINT;
6819 else
6820 return -EINVAL;
6821
6822 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6823 requested, NULL);
6824 }
6825
6826 static int selinux_perf_event_alloc(struct perf_event *event)
6827 {
6828 struct perf_event_security_struct *perfsec;
6829
6830 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6831 if (!perfsec)
6832 return -ENOMEM;
6833
6834 perfsec->sid = current_sid();
6835 event->security = perfsec;
6836
6837 return 0;
6838 }
6839
6840 static void selinux_perf_event_free(struct perf_event *event)
6841 {
6842 struct perf_event_security_struct *perfsec = event->security;
6843
6844 event->security = NULL;
6845 kfree(perfsec);
6846 }
6847
6848 static int selinux_perf_event_read(struct perf_event *event)
6849 {
6850 struct perf_event_security_struct *perfsec = event->security;
6851 u32 sid = current_sid();
6852
6853 return avc_has_perm(&selinux_state, sid, perfsec->sid,
6854 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6855 }
6856
6857 static int selinux_perf_event_write(struct perf_event *event)
6858 {
6859 struct perf_event_security_struct *perfsec = event->security;
6860 u32 sid = current_sid();
6861
6862 return avc_has_perm(&selinux_state, sid, perfsec->sid,
6863 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6864 }
6865 #endif
6866
6867 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6868 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6869 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6870 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6871 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6872
6873 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6874 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6875 LSM_HOOK_INIT(capget, selinux_capget),
6876 LSM_HOOK_INIT(capset, selinux_capset),
6877 LSM_HOOK_INIT(capable, selinux_capable),
6878 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6879 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6880 LSM_HOOK_INIT(syslog, selinux_syslog),
6881 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6882
6883 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6884
6885 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6886 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6887 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6888
6889 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6890 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6891
6892 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6893 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6894 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6895 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6896 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6897 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6898 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6899 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6900 LSM_HOOK_INIT(sb_mount, selinux_mount),
6901 LSM_HOOK_INIT(sb_umount, selinux_umount),
6902 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6903 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6904 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6905
6906 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6907 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6908
6909 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6910 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6911 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6912 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6913 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6914 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6915 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6916 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6917 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6918 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6919 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6920 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6921 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6922 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6923 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6924 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6925 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6926 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6927 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6928 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6929 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6930 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6931 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6932 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6933 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6934 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6935 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6936 LSM_HOOK_INIT(path_notify, selinux_path_notify),
6937
6938 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6939
6940 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6941 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6942 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6943 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6944 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6945 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6946 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6947 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6948 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6949 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6950 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6951
6952 LSM_HOOK_INIT(file_open, selinux_file_open),
6953
6954 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6955 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6956 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6957 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6958 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6959 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6960 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6961 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6962 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6963 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6964 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6965 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6966 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6967 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6968 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6969 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6970 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6971 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6972 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6973 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6974 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6975 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6976 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6977
6978 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6979 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6980
6981 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6982
6983 LSM_HOOK_INIT(msg_queue_alloc_security,
6984 selinux_msg_queue_alloc_security),
6985 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6986 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6987 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6988 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6989
6990 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6991 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6992 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6993 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6994
6995 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6996 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6997 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6998 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6999
7000 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7001
7002 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7003 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7004
7005 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7006 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7007 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7008 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7009 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7010 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7011 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7012 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7013
7014 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7015 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7016
7017 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7018 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7019 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7020 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7021 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7022 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7023 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7024 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7025 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7026 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7027 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7028 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7029 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7030 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7031 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7032 LSM_HOOK_INIT(socket_getpeersec_stream,
7033 selinux_socket_getpeersec_stream),
7034 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7035 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7036 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7037 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7038 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7039 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7040 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7041 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7042 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7043 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7044 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7045 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7046 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7047 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7048 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7049 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7050 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7051 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7052 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7053 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7054 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7055 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7056 #ifdef CONFIG_SECURITY_INFINIBAND
7057 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7058 LSM_HOOK_INIT(ib_endport_manage_subnet,
7059 selinux_ib_endport_manage_subnet),
7060 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7061 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7062 #endif
7063 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7064 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7065 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7066 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7067 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7068 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7069 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7070 selinux_xfrm_state_alloc_acquire),
7071 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7072 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7073 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7074 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7075 selinux_xfrm_state_pol_flow_match),
7076 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7077 #endif
7078
7079 #ifdef CONFIG_KEYS
7080 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7081 LSM_HOOK_INIT(key_free, selinux_key_free),
7082 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7083 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7084 #endif
7085
7086 #ifdef CONFIG_AUDIT
7087 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7088 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7089 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7090 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7091 #endif
7092
7093 #ifdef CONFIG_BPF_SYSCALL
7094 LSM_HOOK_INIT(bpf, selinux_bpf),
7095 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7096 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7097 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7098 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7099 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7100 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7101 #endif
7102
7103 #ifdef CONFIG_PERF_EVENTS
7104 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7105 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7106 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7107 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7108 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7109 #endif
7110 };
7111
7112 static __init int selinux_init(void)
7113 {
7114 pr_info("SELinux: Initializing.\n");
7115
7116 memset(&selinux_state, 0, sizeof(selinux_state));
7117 enforcing_set(&selinux_state, selinux_enforcing_boot);
7118 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7119 selinux_ss_init(&selinux_state.ss);
7120 selinux_avc_init(&selinux_state.avc);
7121
7122 /* Set the security state for the initial task. */
7123 cred_init_security();
7124
7125 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7126
7127 avc_init();
7128
7129 avtab_cache_init();
7130
7131 ebitmap_cache_init();
7132
7133 hashtab_cache_init();
7134
7135 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7136
7137 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7138 panic("SELinux: Unable to register AVC netcache callback\n");
7139
7140 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7141 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7142
7143 if (selinux_enforcing_boot)
7144 pr_debug("SELinux: Starting in enforcing mode\n");
7145 else
7146 pr_debug("SELinux: Starting in permissive mode\n");
7147
7148 fs_validate_description(&selinux_fs_parameters);
7149
7150 return 0;
7151 }
7152
7153 static void delayed_superblock_init(struct super_block *sb, void *unused)
7154 {
7155 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7156 }
7157
7158 void selinux_complete_init(void)
7159 {
7160 pr_debug("SELinux: Completing initialization.\n");
7161
7162 /* Set up any superblocks initialized prior to the policy load. */
7163 pr_debug("SELinux: Setting up existing superblocks.\n");
7164 iterate_supers(delayed_superblock_init, NULL);
7165 }
7166
7167 /* SELinux requires early initialization in order to label
7168 all processes and objects when they are created. */
7169 DEFINE_LSM(selinux) = {
7170 .name = "selinux",
7171 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7172 .enabled = &selinux_enabled,
7173 .blobs = &selinux_blob_sizes,
7174 .init = selinux_init,
7175 };
7176
7177 #if defined(CONFIG_NETFILTER)
7178
7179 static const struct nf_hook_ops selinux_nf_ops[] = {
7180 {
7181 .hook = selinux_ipv4_postroute,
7182 .pf = NFPROTO_IPV4,
7183 .hooknum = NF_INET_POST_ROUTING,
7184 .priority = NF_IP_PRI_SELINUX_LAST,
7185 },
7186 {
7187 .hook = selinux_ipv4_forward,
7188 .pf = NFPROTO_IPV4,
7189 .hooknum = NF_INET_FORWARD,
7190 .priority = NF_IP_PRI_SELINUX_FIRST,
7191 },
7192 {
7193 .hook = selinux_ipv4_output,
7194 .pf = NFPROTO_IPV4,
7195 .hooknum = NF_INET_LOCAL_OUT,
7196 .priority = NF_IP_PRI_SELINUX_FIRST,
7197 },
7198 #if IS_ENABLED(CONFIG_IPV6)
7199 {
7200 .hook = selinux_ipv6_postroute,
7201 .pf = NFPROTO_IPV6,
7202 .hooknum = NF_INET_POST_ROUTING,
7203 .priority = NF_IP6_PRI_SELINUX_LAST,
7204 },
7205 {
7206 .hook = selinux_ipv6_forward,
7207 .pf = NFPROTO_IPV6,
7208 .hooknum = NF_INET_FORWARD,
7209 .priority = NF_IP6_PRI_SELINUX_FIRST,
7210 },
7211 {
7212 .hook = selinux_ipv6_output,
7213 .pf = NFPROTO_IPV6,
7214 .hooknum = NF_INET_LOCAL_OUT,
7215 .priority = NF_IP6_PRI_SELINUX_FIRST,
7216 },
7217 #endif /* IPV6 */
7218 };
7219
7220 static int __net_init selinux_nf_register(struct net *net)
7221 {
7222 return nf_register_net_hooks(net, selinux_nf_ops,
7223 ARRAY_SIZE(selinux_nf_ops));
7224 }
7225
7226 static void __net_exit selinux_nf_unregister(struct net *net)
7227 {
7228 nf_unregister_net_hooks(net, selinux_nf_ops,
7229 ARRAY_SIZE(selinux_nf_ops));
7230 }
7231
7232 static struct pernet_operations selinux_net_ops = {
7233 .init = selinux_nf_register,
7234 .exit = selinux_nf_unregister,
7235 };
7236
7237 static int __init selinux_nf_ip_init(void)
7238 {
7239 int err;
7240
7241 if (!selinux_enabled)
7242 return 0;
7243
7244 pr_debug("SELinux: Registering netfilter hooks\n");
7245
7246 err = register_pernet_subsys(&selinux_net_ops);
7247 if (err)
7248 panic("SELinux: register_pernet_subsys: error %d\n", err);
7249
7250 return 0;
7251 }
7252 __initcall(selinux_nf_ip_init);
7253
7254 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7255 static void selinux_nf_ip_exit(void)
7256 {
7257 pr_debug("SELinux: Unregistering netfilter hooks\n");
7258
7259 unregister_pernet_subsys(&selinux_net_ops);
7260 }
7261 #endif
7262
7263 #else /* CONFIG_NETFILTER */
7264
7265 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7266 #define selinux_nf_ip_exit()
7267 #endif
7268
7269 #endif /* CONFIG_NETFILTER */
7270
7271 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7272 int selinux_disable(struct selinux_state *state)
7273 {
7274 if (state->initialized) {
7275 /* Not permitted after initial policy load. */
7276 return -EINVAL;
7277 }
7278
7279 if (state->disabled) {
7280 /* Only do this once. */
7281 return -EINVAL;
7282 }
7283
7284 state->disabled = 1;
7285
7286 pr_info("SELinux: Disabled at runtime.\n");
7287
7288 selinux_enabled = 0;
7289
7290 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7291
7292 /* Try to destroy the avc node cache */
7293 avc_disable();
7294
7295 /* Unregister netfilter hooks. */
7296 selinux_nf_ip_exit();
7297
7298 /* Unregister selinuxfs. */
7299 exit_sel_fs();
7300
7301 return 0;
7302 }
7303 #endif
Linux with added FPC-III support