?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
usb: gadget: composite: Fix possible double free memory bug
[linux/fpc-iii.git] / security / selinux / hooks.c
blobab2759d88bc65baff61933abe2db2c3c400beb14
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
86
87 #include "avc.h"
88 #include "objsec.h"
89 #include "netif.h"
90 #include "netnode.h"
91 #include "netport.h"
92 #include "xfrm.h"
93 #include "netlabel.h"
94 #include "audit.h"
95 #include "avc_ss.h"
96
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102
103 static int __init enforcing_setup(char *str)
104 {
105 unsigned long enforcing;
106 if (!kstrtoul(str, 0, &enforcing))
107 selinux_enforcing = enforcing ? 1 : 0;
108 return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116 static int __init selinux_enabled_setup(char *str)
117 {
118 unsigned long enabled;
119 if (!kstrtoul(str, 0, &enabled))
120 selinux_enabled = enabled ? 1 : 0;
121 return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127
128 static struct kmem_cache *sel_inode_cache;
129 static struct kmem_cache *file_security_cache;
130
131 /**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
140 *
141 */
142 static int selinux_secmark_enabled(void)
143 {
144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
145 }
146
147 /**
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
149 *
150 * Description:
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
155 *
156 */
157 static int selinux_peerlbl_enabled(void)
158 {
159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
160 }
161
162 static int selinux_netcache_avc_callback(u32 event)
163 {
164 if (event == AVC_CALLBACK_RESET) {
165 sel_netif_flush();
166 sel_netnode_flush();
167 sel_netport_flush();
168 synchronize_net();
169 }
170 return 0;
171 }
172
173 /*
174 * initialise the security for the init task
175 */
176 static void cred_init_security(void)
177 {
178 struct cred *cred = (struct cred *) current->real_cred;
179 struct task_security_struct *tsec;
180
181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
182 if (!tsec)
183 panic("SELinux: Failed to initialize initial task.\n");
184
185 tsec->osid = tsec->sid = SECINITSID_KERNEL;
186 cred->security = tsec;
187 }
188
189 /*
190 * get the security ID of a set of credentials
191 */
192 static inline u32 cred_sid(const struct cred *cred)
193 {
194 const struct task_security_struct *tsec;
195
196 tsec = cred->security;
197 return tsec->sid;
198 }
199
200 /*
201 * get the objective security ID of a task
202 */
203 static inline u32 task_sid(const struct task_struct *task)
204 {
205 u32 sid;
206
207 rcu_read_lock();
208 sid = cred_sid(__task_cred(task));
209 rcu_read_unlock();
210 return sid;
211 }
212
213 /*
214 * get the subjective security ID of the current task
215 */
216 static inline u32 current_sid(void)
217 {
218 const struct task_security_struct *tsec = current_security();
219
220 return tsec->sid;
221 }
222
223 /* Allocate and free functions for each kind of security blob. */
224
225 static int inode_alloc_security(struct inode *inode)
226 {
227 struct inode_security_struct *isec;
228 u32 sid = current_sid();
229
230 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
231 if (!isec)
232 return -ENOMEM;
233
234 mutex_init(&isec->lock);
235 INIT_LIST_HEAD(&isec->list);
236 isec->inode = inode;
237 isec->sid = SECINITSID_UNLABELED;
238 isec->sclass = SECCLASS_FILE;
239 isec->task_sid = sid;
240 inode->i_security = isec;
241
242 return 0;
243 }
244
245 static void inode_free_rcu(struct rcu_head *head)
246 {
247 struct inode_security_struct *isec;
248
249 isec = container_of(head, struct inode_security_struct, rcu);
250 kmem_cache_free(sel_inode_cache, isec);
251 }
252
253 static void inode_free_security(struct inode *inode)
254 {
255 struct inode_security_struct *isec = inode->i_security;
256 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
257
258 /*
259 * As not all inode security structures are in a list, we check for
260 * empty list outside of the lock to make sure that we won't waste
261 * time taking a lock doing nothing.
262 *
263 * The list_del_init() function can be safely called more than once.
264 * It should not be possible for this function to be called with
265 * concurrent list_add(), but for better safety against future changes
266 * in the code, we use list_empty_careful() here.
267 */
268 if (!list_empty_careful(&isec->list)) {
269 spin_lock(&sbsec->isec_lock);
270 list_del_init(&isec->list);
271 spin_unlock(&sbsec->isec_lock);
272 }
273
274 /*
275 * The inode may still be referenced in a path walk and
276 * a call to selinux_inode_permission() can be made
277 * after inode_free_security() is called. Ideally, the VFS
278 * wouldn't do this, but fixing that is a much harder
279 * job. For now, simply free the i_security via RCU, and
280 * leave the current inode->i_security pointer intact.
281 * The inode will be freed after the RCU grace period too.
282 */
283 call_rcu(&isec->rcu, inode_free_rcu);
284 }
285
286 static int file_alloc_security(struct file *file)
287 {
288 struct file_security_struct *fsec;
289 u32 sid = current_sid();
290
291 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
292 if (!fsec)
293 return -ENOMEM;
294
295 fsec->sid = sid;
296 fsec->fown_sid = sid;
297 file->f_security = fsec;
298
299 return 0;
300 }
301
302 static void file_free_security(struct file *file)
303 {
304 struct file_security_struct *fsec = file->f_security;
305 file->f_security = NULL;
306 kmem_cache_free(file_security_cache, fsec);
307 }
308
309 static int superblock_alloc_security(struct super_block *sb)
310 {
311 struct superblock_security_struct *sbsec;
312
313 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
314 if (!sbsec)
315 return -ENOMEM;
316
317 mutex_init(&sbsec->lock);
318 INIT_LIST_HEAD(&sbsec->isec_head);
319 spin_lock_init(&sbsec->isec_lock);
320 sbsec->sb = sb;
321 sbsec->sid = SECINITSID_UNLABELED;
322 sbsec->def_sid = SECINITSID_FILE;
323 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
324 sb->s_security = sbsec;
325
326 return 0;
327 }
328
329 static void superblock_free_security(struct super_block *sb)
330 {
331 struct superblock_security_struct *sbsec = sb->s_security;
332 sb->s_security = NULL;
333 kfree(sbsec);
334 }
335
336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
337
338 static inline int inode_doinit(struct inode *inode)
339 {
340 return inode_doinit_with_dentry(inode, NULL);
341 }
342
343 enum {
344 Opt_error = -1,
345 Opt_context = 1,
346 Opt_fscontext = 2,
347 Opt_defcontext = 3,
348 Opt_rootcontext = 4,
349 Opt_labelsupport = 5,
350 Opt_nextmntopt = 6,
351 };
352
353 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
354
355 static const match_table_t tokens = {
356 {Opt_context, CONTEXT_STR "%s"},
357 {Opt_fscontext, FSCONTEXT_STR "%s"},
358 {Opt_defcontext, DEFCONTEXT_STR "%s"},
359 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
360 {Opt_labelsupport, LABELSUPP_STR},
361 {Opt_error, NULL},
362 };
363
364 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
365
366 static int may_context_mount_sb_relabel(u32 sid,
367 struct superblock_security_struct *sbsec,
368 const struct cred *cred)
369 {
370 const struct task_security_struct *tsec = cred->security;
371 int rc;
372
373 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
374 FILESYSTEM__RELABELFROM, NULL);
375 if (rc)
376 return rc;
377
378 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
379 FILESYSTEM__RELABELTO, NULL);
380 return rc;
381 }
382
383 static int may_context_mount_inode_relabel(u32 sid,
384 struct superblock_security_struct *sbsec,
385 const struct cred *cred)
386 {
387 const struct task_security_struct *tsec = cred->security;
388 int rc;
389 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
390 FILESYSTEM__RELABELFROM, NULL);
391 if (rc)
392 return rc;
393
394 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
395 FILESYSTEM__ASSOCIATE, NULL);
396 return rc;
397 }
398
399 static int selinux_is_genfs_special_handling(struct super_block *sb)
400 {
401 /* Special handling. Genfs but also in-core setxattr handler */
402 return !strcmp(sb->s_type->name, "sysfs") ||
403 !strcmp(sb->s_type->name, "pstore") ||
404 !strcmp(sb->s_type->name, "debugfs") ||
405 !strcmp(sb->s_type->name, "rootfs");
406 }
407
408 static int selinux_is_sblabel_mnt(struct super_block *sb)
409 {
410 struct superblock_security_struct *sbsec = sb->s_security;
411
412 /*
413 * IMPORTANT: Double-check logic in this function when adding a new
414 * SECURITY_FS_USE_* definition!
415 */
416 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
417
418 switch (sbsec->behavior) {
419 case SECURITY_FS_USE_XATTR:
420 case SECURITY_FS_USE_TRANS:
421 case SECURITY_FS_USE_TASK:
422 case SECURITY_FS_USE_NATIVE:
423 return 1;
424
425 case SECURITY_FS_USE_GENFS:
426 return selinux_is_genfs_special_handling(sb);
427
428 /* Never allow relabeling on context mounts */
429 case SECURITY_FS_USE_MNTPOINT:
430 case SECURITY_FS_USE_NONE:
431 default:
432 return 0;
433 }
434 }
435
436 static int sb_finish_set_opts(struct super_block *sb)
437 {
438 struct superblock_security_struct *sbsec = sb->s_security;
439 struct dentry *root = sb->s_root;
440 struct inode *root_inode = d_backing_inode(root);
441 int rc = 0;
442
443 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
444 /* Make sure that the xattr handler exists and that no
445 error other than -ENODATA is returned by getxattr on
446 the root directory. -ENODATA is ok, as this may be
447 the first boot of the SELinux kernel before we have
448 assigned xattr values to the filesystem. */
449 if (!root_inode->i_op->getxattr) {
450 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
451 "xattr support\n", sb->s_id, sb->s_type->name);
452 rc = -EOPNOTSUPP;
453 goto out;
454 }
455 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
456 if (rc < 0 && rc != -ENODATA) {
457 if (rc == -EOPNOTSUPP)
458 printk(KERN_WARNING "SELinux: (dev %s, type "
459 "%s) has no security xattr handler\n",
460 sb->s_id, sb->s_type->name);
461 else
462 printk(KERN_WARNING "SELinux: (dev %s, type "
463 "%s) getxattr errno %d\n", sb->s_id,
464 sb->s_type->name, -rc);
465 goto out;
466 }
467 }
468
469 sbsec->flags |= SE_SBINITIALIZED;
470 if (selinux_is_sblabel_mnt(sb))
471 sbsec->flags |= SBLABEL_MNT;
472
473 /* Initialize the root inode. */
474 rc = inode_doinit_with_dentry(root_inode, root);
475
476 /* Initialize any other inodes associated with the superblock, e.g.
477 inodes created prior to initial policy load or inodes created
478 during get_sb by a pseudo filesystem that directly
479 populates itself. */
480 spin_lock(&sbsec->isec_lock);
481 next_inode:
482 if (!list_empty(&sbsec->isec_head)) {
483 struct inode_security_struct *isec =
484 list_entry(sbsec->isec_head.next,
485 struct inode_security_struct, list);
486 struct inode *inode = isec->inode;
487 list_del_init(&isec->list);
488 spin_unlock(&sbsec->isec_lock);
489 inode = igrab(inode);
490 if (inode) {
491 if (!IS_PRIVATE(inode))
492 inode_doinit(inode);
493 iput(inode);
494 }
495 spin_lock(&sbsec->isec_lock);
496 goto next_inode;
497 }
498 spin_unlock(&sbsec->isec_lock);
499 out:
500 return rc;
501 }
502
503 /*
504 * This function should allow an FS to ask what it's mount security
505 * options were so it can use those later for submounts, displaying
506 * mount options, or whatever.
507 */
508 static int selinux_get_mnt_opts(const struct super_block *sb,
509 struct security_mnt_opts *opts)
510 {
511 int rc = 0, i;
512 struct superblock_security_struct *sbsec = sb->s_security;
513 char *context = NULL;
514 u32 len;
515 char tmp;
516
517 security_init_mnt_opts(opts);
518
519 if (!(sbsec->flags & SE_SBINITIALIZED))
520 return -EINVAL;
521
522 if (!ss_initialized)
523 return -EINVAL;
524
525 /* make sure we always check enough bits to cover the mask */
526 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
527
528 tmp = sbsec->flags & SE_MNTMASK;
529 /* count the number of mount options for this sb */
530 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
531 if (tmp & 0x01)
532 opts->num_mnt_opts++;
533 tmp >>= 1;
534 }
535 /* Check if the Label support flag is set */
536 if (sbsec->flags & SBLABEL_MNT)
537 opts->num_mnt_opts++;
538
539 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
540 if (!opts->mnt_opts) {
541 rc = -ENOMEM;
542 goto out_free;
543 }
544
545 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
546 if (!opts->mnt_opts_flags) {
547 rc = -ENOMEM;
548 goto out_free;
549 }
550
551 i = 0;
552 if (sbsec->flags & FSCONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->sid, &context, &len);
554 if (rc)
555 goto out_free;
556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
558 }
559 if (sbsec->flags & CONTEXT_MNT) {
560 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
561 if (rc)
562 goto out_free;
563 opts->mnt_opts[i] = context;
564 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
565 }
566 if (sbsec->flags & DEFCONTEXT_MNT) {
567 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
568 if (rc)
569 goto out_free;
570 opts->mnt_opts[i] = context;
571 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
572 }
573 if (sbsec->flags & ROOTCONTEXT_MNT) {
574 struct inode *root = d_backing_inode(sbsec->sb->s_root);
575 struct inode_security_struct *isec = root->i_security;
576
577 rc = security_sid_to_context(isec->sid, &context, &len);
578 if (rc)
579 goto out_free;
580 opts->mnt_opts[i] = context;
581 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
582 }
583 if (sbsec->flags & SBLABEL_MNT) {
584 opts->mnt_opts[i] = NULL;
585 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
586 }
587
588 BUG_ON(i != opts->num_mnt_opts);
589
590 return 0;
591
592 out_free:
593 security_free_mnt_opts(opts);
594 return rc;
595 }
596
597 static int bad_option(struct superblock_security_struct *sbsec, char flag,
598 u32 old_sid, u32 new_sid)
599 {
600 char mnt_flags = sbsec->flags & SE_MNTMASK;
601
602 /* check if the old mount command had the same options */
603 if (sbsec->flags & SE_SBINITIALIZED)
604 if (!(sbsec->flags & flag) ||
605 (old_sid != new_sid))
606 return 1;
607
608 /* check if we were passed the same options twice,
609 * aka someone passed context=a,context=b
610 */
611 if (!(sbsec->flags & SE_SBINITIALIZED))
612 if (mnt_flags & flag)
613 return 1;
614 return 0;
615 }
616
617 /*
618 * Allow filesystems with binary mount data to explicitly set mount point
619 * labeling information.
620 */
621 static int selinux_set_mnt_opts(struct super_block *sb,
622 struct security_mnt_opts *opts,
623 unsigned long kern_flags,
624 unsigned long *set_kern_flags)
625 {
626 const struct cred *cred = current_cred();
627 int rc = 0, i;
628 struct superblock_security_struct *sbsec = sb->s_security;
629 const char *name = sb->s_type->name;
630 struct inode *inode = d_backing_inode(sbsec->sb->s_root);
631 struct inode_security_struct *root_isec = inode->i_security;
632 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
633 u32 defcontext_sid = 0;
634 char **mount_options = opts->mnt_opts;
635 int *flags = opts->mnt_opts_flags;
636 int num_opts = opts->num_mnt_opts;
637
638 mutex_lock(&sbsec->lock);
639
640 if (!ss_initialized) {
641 if (!num_opts) {
642 /* Defer initialization until selinux_complete_init,
643 after the initial policy is loaded and the security
644 server is ready to handle calls. */
645 goto out;
646 }
647 rc = -EINVAL;
648 printk(KERN_WARNING "SELinux: Unable to set superblock options "
649 "before the security server is initialized\n");
650 goto out;
651 }
652 if (kern_flags && !set_kern_flags) {
653 /* Specifying internal flags without providing a place to
654 * place the results is not allowed */
655 rc = -EINVAL;
656 goto out;
657 }
658
659 /*
660 * Binary mount data FS will come through this function twice. Once
661 * from an explicit call and once from the generic calls from the vfs.
662 * Since the generic VFS calls will not contain any security mount data
663 * we need to skip the double mount verification.
664 *
665 * This does open a hole in which we will not notice if the first
666 * mount using this sb set explict options and a second mount using
667 * this sb does not set any security options. (The first options
668 * will be used for both mounts)
669 */
670 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
671 && (num_opts == 0))
672 goto out;
673
674 /*
675 * parse the mount options, check if they are valid sids.
676 * also check if someone is trying to mount the same sb more
677 * than once with different security options.
678 */
679 for (i = 0; i < num_opts; i++) {
680 u32 sid;
681
682 if (flags[i] == SBLABEL_MNT)
683 continue;
684 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
685 if (rc) {
686 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
687 "(%s) failed for (dev %s, type %s) errno=%d\n",
688 mount_options[i], sb->s_id, name, rc);
689 goto out;
690 }
691 switch (flags[i]) {
692 case FSCONTEXT_MNT:
693 fscontext_sid = sid;
694
695 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
696 fscontext_sid))
697 goto out_double_mount;
698
699 sbsec->flags |= FSCONTEXT_MNT;
700 break;
701 case CONTEXT_MNT:
702 context_sid = sid;
703
704 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
705 context_sid))
706 goto out_double_mount;
707
708 sbsec->flags |= CONTEXT_MNT;
709 break;
710 case ROOTCONTEXT_MNT:
711 rootcontext_sid = sid;
712
713 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
714 rootcontext_sid))
715 goto out_double_mount;
716
717 sbsec->flags |= ROOTCONTEXT_MNT;
718
719 break;
720 case DEFCONTEXT_MNT:
721 defcontext_sid = sid;
722
723 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
724 defcontext_sid))
725 goto out_double_mount;
726
727 sbsec->flags |= DEFCONTEXT_MNT;
728
729 break;
730 default:
731 rc = -EINVAL;
732 goto out;
733 }
734 }
735
736 if (sbsec->flags & SE_SBINITIALIZED) {
737 /* previously mounted with options, but not on this attempt? */
738 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
739 goto out_double_mount;
740 rc = 0;
741 goto out;
742 }
743
744 if (strcmp(sb->s_type->name, "proc") == 0)
745 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
746
747 if (!strcmp(sb->s_type->name, "debugfs") ||
748 !strcmp(sb->s_type->name, "sysfs") ||
749 !strcmp(sb->s_type->name, "pstore"))
750 sbsec->flags |= SE_SBGENFS;
751
752 if (!sbsec->behavior) {
753 /*
754 * Determine the labeling behavior to use for this
755 * filesystem type.
756 */
757 rc = security_fs_use(sb);
758 if (rc) {
759 printk(KERN_WARNING
760 "%s: security_fs_use(%s) returned %d\n",
761 __func__, sb->s_type->name, rc);
762 goto out;
763 }
764 }
765 /* sets the context of the superblock for the fs being mounted. */
766 if (fscontext_sid) {
767 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
768 if (rc)
769 goto out;
770
771 sbsec->sid = fscontext_sid;
772 }
773
774 /*
775 * Switch to using mount point labeling behavior.
776 * sets the label used on all file below the mountpoint, and will set
777 * the superblock context if not already set.
778 */
779 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
780 sbsec->behavior = SECURITY_FS_USE_NATIVE;
781 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
782 }
783
784 if (context_sid) {
785 if (!fscontext_sid) {
786 rc = may_context_mount_sb_relabel(context_sid, sbsec,
787 cred);
788 if (rc)
789 goto out;
790 sbsec->sid = context_sid;
791 } else {
792 rc = may_context_mount_inode_relabel(context_sid, sbsec,
793 cred);
794 if (rc)
795 goto out;
796 }
797 if (!rootcontext_sid)
798 rootcontext_sid = context_sid;
799
800 sbsec->mntpoint_sid = context_sid;
801 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
802 }
803
804 if (rootcontext_sid) {
805 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
806 cred);
807 if (rc)
808 goto out;
809
810 root_isec->sid = rootcontext_sid;
811 root_isec->initialized = 1;
812 }
813
814 if (defcontext_sid) {
815 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
816 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
817 rc = -EINVAL;
818 printk(KERN_WARNING "SELinux: defcontext option is "
819 "invalid for this filesystem type\n");
820 goto out;
821 }
822
823 if (defcontext_sid != sbsec->def_sid) {
824 rc = may_context_mount_inode_relabel(defcontext_sid,
825 sbsec, cred);
826 if (rc)
827 goto out;
828 }
829
830 sbsec->def_sid = defcontext_sid;
831 }
832
833 rc = sb_finish_set_opts(sb);
834 out:
835 mutex_unlock(&sbsec->lock);
836 return rc;
837 out_double_mount:
838 rc = -EINVAL;
839 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
840 "security settings for (dev %s, type %s)\n", sb->s_id, name);
841 goto out;
842 }
843
844 static int selinux_cmp_sb_context(const struct super_block *oldsb,
845 const struct super_block *newsb)
846 {
847 struct superblock_security_struct *old = oldsb->s_security;
848 struct superblock_security_struct *new = newsb->s_security;
849 char oldflags = old->flags & SE_MNTMASK;
850 char newflags = new->flags & SE_MNTMASK;
851
852 if (oldflags != newflags)
853 goto mismatch;
854 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
855 goto mismatch;
856 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
857 goto mismatch;
858 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
859 goto mismatch;
860 if (oldflags & ROOTCONTEXT_MNT) {
861 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
862 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
863 if (oldroot->sid != newroot->sid)
864 goto mismatch;
865 }
866 return 0;
867 mismatch:
868 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
869 "different security settings for (dev %s, "
870 "type %s)\n", newsb->s_id, newsb->s_type->name);
871 return -EBUSY;
872 }
873
874 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
875 struct super_block *newsb)
876 {
877 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
878 struct superblock_security_struct *newsbsec = newsb->s_security;
879
880 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
881 int set_context = (oldsbsec->flags & CONTEXT_MNT);
882 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
883
884 /*
885 * if the parent was able to be mounted it clearly had no special lsm
886 * mount options. thus we can safely deal with this superblock later
887 */
888 if (!ss_initialized)
889 return 0;
890
891 /* how can we clone if the old one wasn't set up?? */
892 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
893
894 /* if fs is reusing a sb, make sure that the contexts match */
895 if (newsbsec->flags & SE_SBINITIALIZED)
896 return selinux_cmp_sb_context(oldsb, newsb);
897
898 mutex_lock(&newsbsec->lock);
899
900 newsbsec->flags = oldsbsec->flags;
901
902 newsbsec->sid = oldsbsec->sid;
903 newsbsec->def_sid = oldsbsec->def_sid;
904 newsbsec->behavior = oldsbsec->behavior;
905
906 if (set_context) {
907 u32 sid = oldsbsec->mntpoint_sid;
908
909 if (!set_fscontext)
910 newsbsec->sid = sid;
911 if (!set_rootcontext) {
912 struct inode *newinode = d_backing_inode(newsb->s_root);
913 struct inode_security_struct *newisec = newinode->i_security;
914 newisec->sid = sid;
915 }
916 newsbsec->mntpoint_sid = sid;
917 }
918 if (set_rootcontext) {
919 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
920 const struct inode_security_struct *oldisec = oldinode->i_security;
921 struct inode *newinode = d_backing_inode(newsb->s_root);
922 struct inode_security_struct *newisec = newinode->i_security;
923
924 newisec->sid = oldisec->sid;
925 }
926
927 sb_finish_set_opts(newsb);
928 mutex_unlock(&newsbsec->lock);
929 return 0;
930 }
931
932 static int selinux_parse_opts_str(char *options,
933 struct security_mnt_opts *opts)
934 {
935 char *p;
936 char *context = NULL, *defcontext = NULL;
937 char *fscontext = NULL, *rootcontext = NULL;
938 int rc, num_mnt_opts = 0;
939
940 opts->num_mnt_opts = 0;
941
942 /* Standard string-based options. */
943 while ((p = strsep(&options, "|")) != NULL) {
944 int token;
945 substring_t args[MAX_OPT_ARGS];
946
947 if (!*p)
948 continue;
949
950 token = match_token(p, tokens, args);
951
952 switch (token) {
953 case Opt_context:
954 if (context || defcontext) {
955 rc = -EINVAL;
956 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
957 goto out_err;
958 }
959 context = match_strdup(&args[0]);
960 if (!context) {
961 rc = -ENOMEM;
962 goto out_err;
963 }
964 break;
965
966 case Opt_fscontext:
967 if (fscontext) {
968 rc = -EINVAL;
969 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
970 goto out_err;
971 }
972 fscontext = match_strdup(&args[0]);
973 if (!fscontext) {
974 rc = -ENOMEM;
975 goto out_err;
976 }
977 break;
978
979 case Opt_rootcontext:
980 if (rootcontext) {
981 rc = -EINVAL;
982 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
983 goto out_err;
984 }
985 rootcontext = match_strdup(&args[0]);
986 if (!rootcontext) {
987 rc = -ENOMEM;
988 goto out_err;
989 }
990 break;
991
992 case Opt_defcontext:
993 if (context || defcontext) {
994 rc = -EINVAL;
995 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
996 goto out_err;
997 }
998 defcontext = match_strdup(&args[0]);
999 if (!defcontext) {
1000 rc = -ENOMEM;
1001 goto out_err;
1002 }
1003 break;
1004 case Opt_labelsupport:
1005 break;
1006 default:
1007 rc = -EINVAL;
1008 printk(KERN_WARNING "SELinux: unknown mount option\n");
1009 goto out_err;
1010
1011 }
1012 }
1013
1014 rc = -ENOMEM;
1015 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1016 if (!opts->mnt_opts)
1017 goto out_err;
1018
1019 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1020 if (!opts->mnt_opts_flags) {
1021 kfree(opts->mnt_opts);
1022 goto out_err;
1023 }
1024
1025 if (fscontext) {
1026 opts->mnt_opts[num_mnt_opts] = fscontext;
1027 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1028 }
1029 if (context) {
1030 opts->mnt_opts[num_mnt_opts] = context;
1031 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1032 }
1033 if (rootcontext) {
1034 opts->mnt_opts[num_mnt_opts] = rootcontext;
1035 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1036 }
1037 if (defcontext) {
1038 opts->mnt_opts[num_mnt_opts] = defcontext;
1039 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1040 }
1041
1042 opts->num_mnt_opts = num_mnt_opts;
1043 return 0;
1044
1045 out_err:
1046 kfree(context);
1047 kfree(defcontext);
1048 kfree(fscontext);
1049 kfree(rootcontext);
1050 return rc;
1051 }
1052 /*
1053 * string mount options parsing and call set the sbsec
1054 */
1055 static int superblock_doinit(struct super_block *sb, void *data)
1056 {
1057 int rc = 0;
1058 char *options = data;
1059 struct security_mnt_opts opts;
1060
1061 security_init_mnt_opts(&opts);
1062
1063 if (!data)
1064 goto out;
1065
1066 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1067
1068 rc = selinux_parse_opts_str(options, &opts);
1069 if (rc)
1070 goto out_err;
1071
1072 out:
1073 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1074
1075 out_err:
1076 security_free_mnt_opts(&opts);
1077 return rc;
1078 }
1079
1080 static void selinux_write_opts(struct seq_file *m,
1081 struct security_mnt_opts *opts)
1082 {
1083 int i;
1084 char *prefix;
1085
1086 for (i = 0; i < opts->num_mnt_opts; i++) {
1087 char *has_comma;
1088
1089 if (opts->mnt_opts[i])
1090 has_comma = strchr(opts->mnt_opts[i], ',');
1091 else
1092 has_comma = NULL;
1093
1094 switch (opts->mnt_opts_flags[i]) {
1095 case CONTEXT_MNT:
1096 prefix = CONTEXT_STR;
1097 break;
1098 case FSCONTEXT_MNT:
1099 prefix = FSCONTEXT_STR;
1100 break;
1101 case ROOTCONTEXT_MNT:
1102 prefix = ROOTCONTEXT_STR;
1103 break;
1104 case DEFCONTEXT_MNT:
1105 prefix = DEFCONTEXT_STR;
1106 break;
1107 case SBLABEL_MNT:
1108 seq_putc(m, ',');
1109 seq_puts(m, LABELSUPP_STR);
1110 continue;
1111 default:
1112 BUG();
1113 return;
1114 };
1115 /* we need a comma before each option */
1116 seq_putc(m, ',');
1117 seq_puts(m, prefix);
1118 if (has_comma)
1119 seq_putc(m, '\"');
1120 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1121 if (has_comma)
1122 seq_putc(m, '\"');
1123 }
1124 }
1125
1126 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1127 {
1128 struct security_mnt_opts opts;
1129 int rc;
1130
1131 rc = selinux_get_mnt_opts(sb, &opts);
1132 if (rc) {
1133 /* before policy load we may get EINVAL, don't show anything */
1134 if (rc == -EINVAL)
1135 rc = 0;
1136 return rc;
1137 }
1138
1139 selinux_write_opts(m, &opts);
1140
1141 security_free_mnt_opts(&opts);
1142
1143 return rc;
1144 }
1145
1146 static inline u16 inode_mode_to_security_class(umode_t mode)
1147 {
1148 switch (mode & S_IFMT) {
1149 case S_IFSOCK:
1150 return SECCLASS_SOCK_FILE;
1151 case S_IFLNK:
1152 return SECCLASS_LNK_FILE;
1153 case S_IFREG:
1154 return SECCLASS_FILE;
1155 case S_IFBLK:
1156 return SECCLASS_BLK_FILE;
1157 case S_IFDIR:
1158 return SECCLASS_DIR;
1159 case S_IFCHR:
1160 return SECCLASS_CHR_FILE;
1161 case S_IFIFO:
1162 return SECCLASS_FIFO_FILE;
1163
1164 }
1165
1166 return SECCLASS_FILE;
1167 }
1168
1169 static inline int default_protocol_stream(int protocol)
1170 {
1171 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1172 }
1173
1174 static inline int default_protocol_dgram(int protocol)
1175 {
1176 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1177 }
1178
1179 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1180 {
1181 switch (family) {
1182 case PF_UNIX:
1183 switch (type) {
1184 case SOCK_STREAM:
1185 case SOCK_SEQPACKET:
1186 return SECCLASS_UNIX_STREAM_SOCKET;
1187 case SOCK_DGRAM:
1188 return SECCLASS_UNIX_DGRAM_SOCKET;
1189 }
1190 break;
1191 case PF_INET:
1192 case PF_INET6:
1193 switch (type) {
1194 case SOCK_STREAM:
1195 if (default_protocol_stream(protocol))
1196 return SECCLASS_TCP_SOCKET;
1197 else
1198 return SECCLASS_RAWIP_SOCKET;
1199 case SOCK_DGRAM:
1200 if (default_protocol_dgram(protocol))
1201 return SECCLASS_UDP_SOCKET;
1202 else
1203 return SECCLASS_RAWIP_SOCKET;
1204 case SOCK_DCCP:
1205 return SECCLASS_DCCP_SOCKET;
1206 default:
1207 return SECCLASS_RAWIP_SOCKET;
1208 }
1209 break;
1210 case PF_NETLINK:
1211 switch (protocol) {
1212 case NETLINK_ROUTE:
1213 return SECCLASS_NETLINK_ROUTE_SOCKET;
1214 case NETLINK_SOCK_DIAG:
1215 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1216 case NETLINK_NFLOG:
1217 return SECCLASS_NETLINK_NFLOG_SOCKET;
1218 case NETLINK_XFRM:
1219 return SECCLASS_NETLINK_XFRM_SOCKET;
1220 case NETLINK_SELINUX:
1221 return SECCLASS_NETLINK_SELINUX_SOCKET;
1222 case NETLINK_ISCSI:
1223 return SECCLASS_NETLINK_ISCSI_SOCKET;
1224 case NETLINK_AUDIT:
1225 return SECCLASS_NETLINK_AUDIT_SOCKET;
1226 case NETLINK_FIB_LOOKUP:
1227 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1228 case NETLINK_CONNECTOR:
1229 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1230 case NETLINK_NETFILTER:
1231 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1232 case NETLINK_DNRTMSG:
1233 return SECCLASS_NETLINK_DNRT_SOCKET;
1234 case NETLINK_KOBJECT_UEVENT:
1235 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1236 case NETLINK_GENERIC:
1237 return SECCLASS_NETLINK_GENERIC_SOCKET;
1238 case NETLINK_SCSITRANSPORT:
1239 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1240 case NETLINK_RDMA:
1241 return SECCLASS_NETLINK_RDMA_SOCKET;
1242 case NETLINK_CRYPTO:
1243 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1244 default:
1245 return SECCLASS_NETLINK_SOCKET;
1246 }
1247 case PF_PACKET:
1248 return SECCLASS_PACKET_SOCKET;
1249 case PF_KEY:
1250 return SECCLASS_KEY_SOCKET;
1251 case PF_APPLETALK:
1252 return SECCLASS_APPLETALK_SOCKET;
1253 }
1254
1255 return SECCLASS_SOCKET;
1256 }
1257
1258 static int selinux_genfs_get_sid(struct dentry *dentry,
1259 u16 tclass,
1260 u16 flags,
1261 u32 *sid)
1262 {
1263 int rc;
1264 struct super_block *sb = dentry->d_inode->i_sb;
1265 char *buffer, *path;
1266
1267 buffer = (char *)__get_free_page(GFP_KERNEL);
1268 if (!buffer)
1269 return -ENOMEM;
1270
1271 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1272 if (IS_ERR(path))
1273 rc = PTR_ERR(path);
1274 else {
1275 if (flags & SE_SBPROC) {
1276 /* each process gets a /proc/PID/ entry. Strip off the
1277 * PID part to get a valid selinux labeling.
1278 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1279 while (path[1] >= '0' && path[1] <= '9') {
1280 path[1] = '/';
1281 path++;
1282 }
1283 }
1284 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1285 }
1286 free_page((unsigned long)buffer);
1287 return rc;
1288 }
1289
1290 /* The inode's security attributes must be initialized before first use. */
1291 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1292 {
1293 struct superblock_security_struct *sbsec = NULL;
1294 struct inode_security_struct *isec = inode->i_security;
1295 u32 sid;
1296 struct dentry *dentry;
1297 #define INITCONTEXTLEN 255
1298 char *context = NULL;
1299 unsigned len = 0;
1300 int rc = 0;
1301
1302 if (isec->initialized)
1303 goto out;
1304
1305 mutex_lock(&isec->lock);
1306 if (isec->initialized)
1307 goto out_unlock;
1308
1309 sbsec = inode->i_sb->s_security;
1310 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1311 /* Defer initialization until selinux_complete_init,
1312 after the initial policy is loaded and the security
1313 server is ready to handle calls. */
1314 spin_lock(&sbsec->isec_lock);
1315 if (list_empty(&isec->list))
1316 list_add(&isec->list, &sbsec->isec_head);
1317 spin_unlock(&sbsec->isec_lock);
1318 goto out_unlock;
1319 }
1320
1321 switch (sbsec->behavior) {
1322 case SECURITY_FS_USE_NATIVE:
1323 break;
1324 case SECURITY_FS_USE_XATTR:
1325 if (!inode->i_op->getxattr) {
1326 isec->sid = sbsec->def_sid;
1327 break;
1328 }
1329
1330 /* Need a dentry, since the xattr API requires one.
1331 Life would be simpler if we could just pass the inode. */
1332 if (opt_dentry) {
1333 /* Called from d_instantiate or d_splice_alias. */
1334 dentry = dget(opt_dentry);
1335 } else {
1336 /* Called from selinux_complete_init, try to find a dentry. */
1337 dentry = d_find_alias(inode);
1338 }
1339 if (!dentry) {
1340 /*
1341 * this is can be hit on boot when a file is accessed
1342 * before the policy is loaded. When we load policy we
1343 * may find inodes that have no dentry on the
1344 * sbsec->isec_head list. No reason to complain as these
1345 * will get fixed up the next time we go through
1346 * inode_doinit with a dentry, before these inodes could
1347 * be used again by userspace.
1348 */
1349 goto out_unlock;
1350 }
1351
1352 len = INITCONTEXTLEN;
1353 context = kmalloc(len+1, GFP_NOFS);
1354 if (!context) {
1355 rc = -ENOMEM;
1356 dput(dentry);
1357 goto out_unlock;
1358 }
1359 context[len] = '\0';
1360 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361 context, len);
1362 if (rc == -ERANGE) {
1363 kfree(context);
1364
1365 /* Need a larger buffer. Query for the right size. */
1366 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1367 NULL, 0);
1368 if (rc < 0) {
1369 dput(dentry);
1370 goto out_unlock;
1371 }
1372 len = rc;
1373 context = kmalloc(len+1, GFP_NOFS);
1374 if (!context) {
1375 rc = -ENOMEM;
1376 dput(dentry);
1377 goto out_unlock;
1378 }
1379 context[len] = '\0';
1380 rc = inode->i_op->getxattr(dentry,
1381 XATTR_NAME_SELINUX,
1382 context, len);
1383 }
1384 dput(dentry);
1385 if (rc < 0) {
1386 if (rc != -ENODATA) {
1387 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1388 "%d for dev=%s ino=%ld\n", __func__,
1389 -rc, inode->i_sb->s_id, inode->i_ino);
1390 kfree(context);
1391 goto out_unlock;
1392 }
1393 /* Map ENODATA to the default file SID */
1394 sid = sbsec->def_sid;
1395 rc = 0;
1396 } else {
1397 rc = security_context_to_sid_default(context, rc, &sid,
1398 sbsec->def_sid,
1399 GFP_NOFS);
1400 if (rc) {
1401 char *dev = inode->i_sb->s_id;
1402 unsigned long ino = inode->i_ino;
1403
1404 if (rc == -EINVAL) {
1405 if (printk_ratelimit())
1406 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1407 "context=%s. This indicates you may need to relabel the inode or the "
1408 "filesystem in question.\n", ino, dev, context);
1409 } else {
1410 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1411 "returned %d for dev=%s ino=%ld\n",
1412 __func__, context, -rc, dev, ino);
1413 }
1414 kfree(context);
1415 /* Leave with the unlabeled SID */
1416 rc = 0;
1417 break;
1418 }
1419 }
1420 kfree(context);
1421 isec->sid = sid;
1422 break;
1423 case SECURITY_FS_USE_TASK:
1424 isec->sid = isec->task_sid;
1425 break;
1426 case SECURITY_FS_USE_TRANS:
1427 /* Default to the fs SID. */
1428 isec->sid = sbsec->sid;
1429
1430 /* Try to obtain a transition SID. */
1431 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1432 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1433 isec->sclass, NULL, &sid);
1434 if (rc)
1435 goto out_unlock;
1436 isec->sid = sid;
1437 break;
1438 case SECURITY_FS_USE_MNTPOINT:
1439 isec->sid = sbsec->mntpoint_sid;
1440 break;
1441 default:
1442 /* Default to the fs superblock SID. */
1443 isec->sid = sbsec->sid;
1444
1445 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1446 /* We must have a dentry to determine the label on
1447 * procfs inodes */
1448 if (opt_dentry)
1449 /* Called from d_instantiate or
1450 * d_splice_alias. */
1451 dentry = dget(opt_dentry);
1452 else
1453 /* Called from selinux_complete_init, try to
1454 * find a dentry. */
1455 dentry = d_find_alias(inode);
1456 /*
1457 * This can be hit on boot when a file is accessed
1458 * before the policy is loaded. When we load policy we
1459 * may find inodes that have no dentry on the
1460 * sbsec->isec_head list. No reason to complain as
1461 * these will get fixed up the next time we go through
1462 * inode_doinit() with a dentry, before these inodes
1463 * could be used again by userspace.
1464 */
1465 if (!dentry)
1466 goto out_unlock;
1467 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1468 rc = selinux_genfs_get_sid(dentry, isec->sclass,
1469 sbsec->flags, &sid);
1470 dput(dentry);
1471 if (rc)
1472 goto out_unlock;
1473 isec->sid = sid;
1474 }
1475 break;
1476 }
1477
1478 isec->initialized = 1;
1479
1480 out_unlock:
1481 mutex_unlock(&isec->lock);
1482 out:
1483 if (isec->sclass == SECCLASS_FILE)
1484 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1485 return rc;
1486 }
1487
1488 /* Convert a Linux signal to an access vector. */
1489 static inline u32 signal_to_av(int sig)
1490 {
1491 u32 perm = 0;
1492
1493 switch (sig) {
1494 case SIGCHLD:
1495 /* Commonly granted from child to parent. */
1496 perm = PROCESS__SIGCHLD;
1497 break;
1498 case SIGKILL:
1499 /* Cannot be caught or ignored */
1500 perm = PROCESS__SIGKILL;
1501 break;
1502 case SIGSTOP:
1503 /* Cannot be caught or ignored */
1504 perm = PROCESS__SIGSTOP;
1505 break;
1506 default:
1507 /* All other signals. */
1508 perm = PROCESS__SIGNAL;
1509 break;
1510 }
1511
1512 return perm;
1513 }
1514
1515 /*
1516 * Check permission between a pair of credentials
1517 * fork check, ptrace check, etc.
1518 */
1519 static int cred_has_perm(const struct cred *actor,
1520 const struct cred *target,
1521 u32 perms)
1522 {
1523 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1524
1525 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1526 }
1527
1528 /*
1529 * Check permission between a pair of tasks, e.g. signal checks,
1530 * fork check, ptrace check, etc.
1531 * tsk1 is the actor and tsk2 is the target
1532 * - this uses the default subjective creds of tsk1
1533 */
1534 static int task_has_perm(const struct task_struct *tsk1,
1535 const struct task_struct *tsk2,
1536 u32 perms)
1537 {
1538 const struct task_security_struct *__tsec1, *__tsec2;
1539 u32 sid1, sid2;
1540
1541 rcu_read_lock();
1542 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1543 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1544 rcu_read_unlock();
1545 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1546 }
1547
1548 /*
1549 * Check permission between current and another task, e.g. signal checks,
1550 * fork check, ptrace check, etc.
1551 * current is the actor and tsk2 is the target
1552 * - this uses current's subjective creds
1553 */
1554 static int current_has_perm(const struct task_struct *tsk,
1555 u32 perms)
1556 {
1557 u32 sid, tsid;
1558
1559 sid = current_sid();
1560 tsid = task_sid(tsk);
1561 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1562 }
1563
1564 #if CAP_LAST_CAP > 63
1565 #error Fix SELinux to handle capabilities > 63.
1566 #endif
1567
1568 /* Check whether a task is allowed to use a capability. */
1569 static int cred_has_capability(const struct cred *cred,
1570 int cap, int audit)
1571 {
1572 struct common_audit_data ad;
1573 struct av_decision avd;
1574 u16 sclass;
1575 u32 sid = cred_sid(cred);
1576 u32 av = CAP_TO_MASK(cap);
1577 int rc;
1578
1579 ad.type = LSM_AUDIT_DATA_CAP;
1580 ad.u.cap = cap;
1581
1582 switch (CAP_TO_INDEX(cap)) {
1583 case 0:
1584 sclass = SECCLASS_CAPABILITY;
1585 break;
1586 case 1:
1587 sclass = SECCLASS_CAPABILITY2;
1588 break;
1589 default:
1590 printk(KERN_ERR
1591 "SELinux: out of range capability %d\n", cap);
1592 BUG();
1593 return -EINVAL;
1594 }
1595
1596 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1597 if (audit == SECURITY_CAP_AUDIT) {
1598 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1599 if (rc2)
1600 return rc2;
1601 }
1602 return rc;
1603 }
1604
1605 /* Check whether a task is allowed to use a system operation. */
1606 static int task_has_system(struct task_struct *tsk,
1607 u32 perms)
1608 {
1609 u32 sid = task_sid(tsk);
1610
1611 return avc_has_perm(sid, SECINITSID_KERNEL,
1612 SECCLASS_SYSTEM, perms, NULL);
1613 }
1614
1615 /* Check whether a task has a particular permission to an inode.
1616 The 'adp' parameter is optional and allows other audit
1617 data to be passed (e.g. the dentry). */
1618 static int inode_has_perm(const struct cred *cred,
1619 struct inode *inode,
1620 u32 perms,
1621 struct common_audit_data *adp)
1622 {
1623 struct inode_security_struct *isec;
1624 u32 sid;
1625
1626 validate_creds(cred);
1627
1628 if (unlikely(IS_PRIVATE(inode)))
1629 return 0;
1630
1631 sid = cred_sid(cred);
1632 isec = inode->i_security;
1633
1634 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1635 }
1636
1637 /* Same as inode_has_perm, but pass explicit audit data containing
1638 the dentry to help the auditing code to more easily generate the
1639 pathname if needed. */
1640 static inline int dentry_has_perm(const struct cred *cred,
1641 struct dentry *dentry,
1642 u32 av)
1643 {
1644 struct inode *inode = d_backing_inode(dentry);
1645 struct common_audit_data ad;
1646
1647 ad.type = LSM_AUDIT_DATA_DENTRY;
1648 ad.u.dentry = dentry;
1649 return inode_has_perm(cred, inode, av, &ad);
1650 }
1651
1652 /* Same as inode_has_perm, but pass explicit audit data containing
1653 the path to help the auditing code to more easily generate the
1654 pathname if needed. */
1655 static inline int path_has_perm(const struct cred *cred,
1656 const struct path *path,
1657 u32 av)
1658 {
1659 struct inode *inode = d_backing_inode(path->dentry);
1660 struct common_audit_data ad;
1661
1662 ad.type = LSM_AUDIT_DATA_PATH;
1663 ad.u.path = *path;
1664 return inode_has_perm(cred, inode, av, &ad);
1665 }
1666
1667 /* Same as path_has_perm, but uses the inode from the file struct. */
1668 static inline int file_path_has_perm(const struct cred *cred,
1669 struct file *file,
1670 u32 av)
1671 {
1672 struct common_audit_data ad;
1673
1674 ad.type = LSM_AUDIT_DATA_PATH;
1675 ad.u.path = file->f_path;
1676 return inode_has_perm(cred, file_inode(file), av, &ad);
1677 }
1678
1679 /* Check whether a task can use an open file descriptor to
1680 access an inode in a given way. Check access to the
1681 descriptor itself, and then use dentry_has_perm to
1682 check a particular permission to the file.
1683 Access to the descriptor is implicitly granted if it
1684 has the same SID as the process. If av is zero, then
1685 access to the file is not checked, e.g. for cases
1686 where only the descriptor is affected like seek. */
1687 static int file_has_perm(const struct cred *cred,
1688 struct file *file,
1689 u32 av)
1690 {
1691 struct file_security_struct *fsec = file->f_security;
1692 struct inode *inode = file_inode(file);
1693 struct common_audit_data ad;
1694 u32 sid = cred_sid(cred);
1695 int rc;
1696
1697 ad.type = LSM_AUDIT_DATA_PATH;
1698 ad.u.path = file->f_path;
1699
1700 if (sid != fsec->sid) {
1701 rc = avc_has_perm(sid, fsec->sid,
1702 SECCLASS_FD,
1703 FD__USE,
1704 &ad);
1705 if (rc)
1706 goto out;
1707 }
1708
1709 /* av is zero if only checking access to the descriptor. */
1710 rc = 0;
1711 if (av)
1712 rc = inode_has_perm(cred, inode, av, &ad);
1713
1714 out:
1715 return rc;
1716 }
1717
1718 /*
1719 * Determine the label for an inode that might be unioned.
1720 */
1721 static int selinux_determine_inode_label(const struct inode *dir,
1722 const struct qstr *name,
1723 u16 tclass,
1724 u32 *_new_isid)
1725 {
1726 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1727 const struct inode_security_struct *dsec = dir->i_security;
1728 const struct task_security_struct *tsec = current_security();
1729
1730 if ((sbsec->flags & SE_SBINITIALIZED) &&
1731 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1732 *_new_isid = sbsec->mntpoint_sid;
1733 } else if ((sbsec->flags & SBLABEL_MNT) &&
1734 tsec->create_sid) {
1735 *_new_isid = tsec->create_sid;
1736 } else {
1737 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1738 name, _new_isid);
1739 }
1740
1741 return 0;
1742 }
1743
1744 /* Check whether a task can create a file. */
1745 static int may_create(struct inode *dir,
1746 struct dentry *dentry,
1747 u16 tclass)
1748 {
1749 const struct task_security_struct *tsec = current_security();
1750 struct inode_security_struct *dsec;
1751 struct superblock_security_struct *sbsec;
1752 u32 sid, newsid;
1753 struct common_audit_data ad;
1754 int rc;
1755
1756 dsec = dir->i_security;
1757 sbsec = dir->i_sb->s_security;
1758
1759 sid = tsec->sid;
1760
1761 ad.type = LSM_AUDIT_DATA_DENTRY;
1762 ad.u.dentry = dentry;
1763
1764 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1765 DIR__ADD_NAME | DIR__SEARCH,
1766 &ad);
1767 if (rc)
1768 return rc;
1769
1770 rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1771 &newsid);
1772 if (rc)
1773 return rc;
1774
1775 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1776 if (rc)
1777 return rc;
1778
1779 return avc_has_perm(newsid, sbsec->sid,
1780 SECCLASS_FILESYSTEM,
1781 FILESYSTEM__ASSOCIATE, &ad);
1782 }
1783
1784 /* Check whether a task can create a key. */
1785 static int may_create_key(u32 ksid,
1786 struct task_struct *ctx)
1787 {
1788 u32 sid = task_sid(ctx);
1789
1790 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1791 }
1792
1793 #define MAY_LINK 0
1794 #define MAY_UNLINK 1
1795 #define MAY_RMDIR 2
1796
1797 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1798 static int may_link(struct inode *dir,
1799 struct dentry *dentry,
1800 int kind)
1801
1802 {
1803 struct inode_security_struct *dsec, *isec;
1804 struct common_audit_data ad;
1805 u32 sid = current_sid();
1806 u32 av;
1807 int rc;
1808
1809 dsec = dir->i_security;
1810 isec = d_backing_inode(dentry)->i_security;
1811
1812 ad.type = LSM_AUDIT_DATA_DENTRY;
1813 ad.u.dentry = dentry;
1814
1815 av = DIR__SEARCH;
1816 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1817 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1818 if (rc)
1819 return rc;
1820
1821 switch (kind) {
1822 case MAY_LINK:
1823 av = FILE__LINK;
1824 break;
1825 case MAY_UNLINK:
1826 av = FILE__UNLINK;
1827 break;
1828 case MAY_RMDIR:
1829 av = DIR__RMDIR;
1830 break;
1831 default:
1832 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1833 __func__, kind);
1834 return 0;
1835 }
1836
1837 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1838 return rc;
1839 }
1840
1841 static inline int may_rename(struct inode *old_dir,
1842 struct dentry *old_dentry,
1843 struct inode *new_dir,
1844 struct dentry *new_dentry)
1845 {
1846 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1847 struct common_audit_data ad;
1848 u32 sid = current_sid();
1849 u32 av;
1850 int old_is_dir, new_is_dir;
1851 int rc;
1852
1853 old_dsec = old_dir->i_security;
1854 old_isec = d_backing_inode(old_dentry)->i_security;
1855 old_is_dir = d_is_dir(old_dentry);
1856 new_dsec = new_dir->i_security;
1857
1858 ad.type = LSM_AUDIT_DATA_DENTRY;
1859
1860 ad.u.dentry = old_dentry;
1861 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1862 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1863 if (rc)
1864 return rc;
1865 rc = avc_has_perm(sid, old_isec->sid,
1866 old_isec->sclass, FILE__RENAME, &ad);
1867 if (rc)
1868 return rc;
1869 if (old_is_dir && new_dir != old_dir) {
1870 rc = avc_has_perm(sid, old_isec->sid,
1871 old_isec->sclass, DIR__REPARENT, &ad);
1872 if (rc)
1873 return rc;
1874 }
1875
1876 ad.u.dentry = new_dentry;
1877 av = DIR__ADD_NAME | DIR__SEARCH;
1878 if (d_is_positive(new_dentry))
1879 av |= DIR__REMOVE_NAME;
1880 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1881 if (rc)
1882 return rc;
1883 if (d_is_positive(new_dentry)) {
1884 new_isec = d_backing_inode(new_dentry)->i_security;
1885 new_is_dir = d_is_dir(new_dentry);
1886 rc = avc_has_perm(sid, new_isec->sid,
1887 new_isec->sclass,
1888 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1889 if (rc)
1890 return rc;
1891 }
1892
1893 return 0;
1894 }
1895
1896 /* Check whether a task can perform a filesystem operation. */
1897 static int superblock_has_perm(const struct cred *cred,
1898 struct super_block *sb,
1899 u32 perms,
1900 struct common_audit_data *ad)
1901 {
1902 struct superblock_security_struct *sbsec;
1903 u32 sid = cred_sid(cred);
1904
1905 sbsec = sb->s_security;
1906 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1907 }
1908
1909 /* Convert a Linux mode and permission mask to an access vector. */
1910 static inline u32 file_mask_to_av(int mode, int mask)
1911 {
1912 u32 av = 0;
1913
1914 if (!S_ISDIR(mode)) {
1915 if (mask & MAY_EXEC)
1916 av |= FILE__EXECUTE;
1917 if (mask & MAY_READ)
1918 av |= FILE__READ;
1919
1920 if (mask & MAY_APPEND)
1921 av |= FILE__APPEND;
1922 else if (mask & MAY_WRITE)
1923 av |= FILE__WRITE;
1924
1925 } else {
1926 if (mask & MAY_EXEC)
1927 av |= DIR__SEARCH;
1928 if (mask & MAY_WRITE)
1929 av |= DIR__WRITE;
1930 if (mask & MAY_READ)
1931 av |= DIR__READ;
1932 }
1933
1934 return av;
1935 }
1936
1937 /* Convert a Linux file to an access vector. */
1938 static inline u32 file_to_av(struct file *file)
1939 {
1940 u32 av = 0;
1941
1942 if (file->f_mode & FMODE_READ)
1943 av |= FILE__READ;
1944 if (file->f_mode & FMODE_WRITE) {
1945 if (file->f_flags & O_APPEND)
1946 av |= FILE__APPEND;
1947 else
1948 av |= FILE__WRITE;
1949 }
1950 if (!av) {
1951 /*
1952 * Special file opened with flags 3 for ioctl-only use.
1953 */
1954 av = FILE__IOCTL;
1955 }
1956
1957 return av;
1958 }
1959
1960 /*
1961 * Convert a file to an access vector and include the correct open
1962 * open permission.
1963 */
1964 static inline u32 open_file_to_av(struct file *file)
1965 {
1966 u32 av = file_to_av(file);
1967 struct inode *inode = file_inode(file);
1968
1969 if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
1970 av |= FILE__OPEN;
1971
1972 return av;
1973 }
1974
1975 /* Hook functions begin here. */
1976
1977 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1978 {
1979 u32 mysid = current_sid();
1980 u32 mgrsid = task_sid(mgr);
1981
1982 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1983 BINDER__SET_CONTEXT_MGR, NULL);
1984 }
1985
1986 static int selinux_binder_transaction(struct task_struct *from,
1987 struct task_struct *to)
1988 {
1989 u32 mysid = current_sid();
1990 u32 fromsid = task_sid(from);
1991 u32 tosid = task_sid(to);
1992 int rc;
1993
1994 if (mysid != fromsid) {
1995 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1996 BINDER__IMPERSONATE, NULL);
1997 if (rc)
1998 return rc;
1999 }
2000
2001 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2002 NULL);
2003 }
2004
2005 static int selinux_binder_transfer_binder(struct task_struct *from,
2006 struct task_struct *to)
2007 {
2008 u32 fromsid = task_sid(from);
2009 u32 tosid = task_sid(to);
2010
2011 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2012 NULL);
2013 }
2014
2015 static int selinux_binder_transfer_file(struct task_struct *from,
2016 struct task_struct *to,
2017 struct file *file)
2018 {
2019 u32 sid = task_sid(to);
2020 struct file_security_struct *fsec = file->f_security;
2021 struct inode *inode = d_backing_inode(file->f_path.dentry);
2022 struct inode_security_struct *isec = inode->i_security;
2023 struct common_audit_data ad;
2024 int rc;
2025
2026 ad.type = LSM_AUDIT_DATA_PATH;
2027 ad.u.path = file->f_path;
2028
2029 if (sid != fsec->sid) {
2030 rc = avc_has_perm(sid, fsec->sid,
2031 SECCLASS_FD,
2032 FD__USE,
2033 &ad);
2034 if (rc)
2035 return rc;
2036 }
2037
2038 if (unlikely(IS_PRIVATE(inode)))
2039 return 0;
2040
2041 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2042 &ad);
2043 }
2044
2045 static int selinux_ptrace_access_check(struct task_struct *child,
2046 unsigned int mode)
2047 {
2048 if (mode & PTRACE_MODE_READ) {
2049 u32 sid = current_sid();
2050 u32 csid = task_sid(child);
2051 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2052 }
2053
2054 return current_has_perm(child, PROCESS__PTRACE);
2055 }
2056
2057 static int selinux_ptrace_traceme(struct task_struct *parent)
2058 {
2059 return task_has_perm(parent, current, PROCESS__PTRACE);
2060 }
2061
2062 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2063 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2064 {
2065 return current_has_perm(target, PROCESS__GETCAP);
2066 }
2067
2068 static int selinux_capset(struct cred *new, const struct cred *old,
2069 const kernel_cap_t *effective,
2070 const kernel_cap_t *inheritable,
2071 const kernel_cap_t *permitted)
2072 {
2073 return cred_has_perm(old, new, PROCESS__SETCAP);
2074 }
2075
2076 /*
2077 * (This comment used to live with the selinux_task_setuid hook,
2078 * which was removed).
2079 *
2080 * Since setuid only affects the current process, and since the SELinux
2081 * controls are not based on the Linux identity attributes, SELinux does not
2082 * need to control this operation. However, SELinux does control the use of
2083 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2084 */
2085
2086 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2087 int cap, int audit)
2088 {
2089 return cred_has_capability(cred, cap, audit);
2090 }
2091
2092 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2093 {
2094 const struct cred *cred = current_cred();
2095 int rc = 0;
2096
2097 if (!sb)
2098 return 0;
2099
2100 switch (cmds) {
2101 case Q_SYNC:
2102 case Q_QUOTAON:
2103 case Q_QUOTAOFF:
2104 case Q_SETINFO:
2105 case Q_SETQUOTA:
2106 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2107 break;
2108 case Q_GETFMT:
2109 case Q_GETINFO:
2110 case Q_GETQUOTA:
2111 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2112 break;
2113 default:
2114 rc = 0; /* let the kernel handle invalid cmds */
2115 break;
2116 }
2117 return rc;
2118 }
2119
2120 static int selinux_quota_on(struct dentry *dentry)
2121 {
2122 const struct cred *cred = current_cred();
2123
2124 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2125 }
2126
2127 static int selinux_syslog(int type)
2128 {
2129 int rc;
2130
2131 switch (type) {
2132 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2133 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2134 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2135 break;
2136 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2137 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2138 /* Set level of messages printed to console */
2139 case SYSLOG_ACTION_CONSOLE_LEVEL:
2140 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2141 break;
2142 case SYSLOG_ACTION_CLOSE: /* Close log */
2143 case SYSLOG_ACTION_OPEN: /* Open log */
2144 case SYSLOG_ACTION_READ: /* Read from log */
2145 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2146 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2147 default:
2148 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2149 break;
2150 }
2151 return rc;
2152 }
2153
2154 /*
2155 * Check that a process has enough memory to allocate a new virtual
2156 * mapping. 0 means there is enough memory for the allocation to
2157 * succeed and -ENOMEM implies there is not.
2158 *
2159 * Do not audit the selinux permission check, as this is applied to all
2160 * processes that allocate mappings.
2161 */
2162 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2163 {
2164 int rc, cap_sys_admin = 0;
2165
2166 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2167 SECURITY_CAP_NOAUDIT);
2168 if (rc == 0)
2169 cap_sys_admin = 1;
2170
2171 return cap_sys_admin;
2172 }
2173
2174 /* binprm security operations */
2175
2176 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2177 const struct task_security_struct *old_tsec,
2178 const struct task_security_struct *new_tsec)
2179 {
2180 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2181 int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2182 int rc;
2183
2184 if (!nnp && !nosuid)
2185 return 0; /* neither NNP nor nosuid */
2186
2187 if (new_tsec->sid == old_tsec->sid)
2188 return 0; /* No change in credentials */
2189
2190 /*
2191 * The only transitions we permit under NNP or nosuid
2192 * are transitions to bounded SIDs, i.e. SIDs that are
2193 * guaranteed to only be allowed a subset of the permissions
2194 * of the current SID.
2195 */
2196 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2197 if (rc) {
2198 /*
2199 * On failure, preserve the errno values for NNP vs nosuid.
2200 * NNP: Operation not permitted for caller.
2201 * nosuid: Permission denied to file.
2202 */
2203 if (nnp)
2204 return -EPERM;
2205 else
2206 return -EACCES;
2207 }
2208 return 0;
2209 }
2210
2211 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2212 {
2213 const struct task_security_struct *old_tsec;
2214 struct task_security_struct *new_tsec;
2215 struct inode_security_struct *isec;
2216 struct common_audit_data ad;
2217 struct inode *inode = file_inode(bprm->file);
2218 int rc;
2219
2220 /* SELinux context only depends on initial program or script and not
2221 * the script interpreter */
2222 if (bprm->cred_prepared)
2223 return 0;
2224
2225 old_tsec = current_security();
2226 new_tsec = bprm->cred->security;
2227 isec = inode->i_security;
2228
2229 /* Default to the current task SID. */
2230 new_tsec->sid = old_tsec->sid;
2231 new_tsec->osid = old_tsec->sid;
2232
2233 /* Reset fs, key, and sock SIDs on execve. */
2234 new_tsec->create_sid = 0;
2235 new_tsec->keycreate_sid = 0;
2236 new_tsec->sockcreate_sid = 0;
2237
2238 if (old_tsec->exec_sid) {
2239 new_tsec->sid = old_tsec->exec_sid;
2240 /* Reset exec SID on execve. */
2241 new_tsec->exec_sid = 0;
2242
2243 /* Fail on NNP or nosuid if not an allowed transition. */
2244 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2245 if (rc)
2246 return rc;
2247 } else {
2248 /* Check for a default transition on this program. */
2249 rc = security_transition_sid(old_tsec->sid, isec->sid,
2250 SECCLASS_PROCESS, NULL,
2251 &new_tsec->sid);
2252 if (rc)
2253 return rc;
2254
2255 /*
2256 * Fallback to old SID on NNP or nosuid if not an allowed
2257 * transition.
2258 */
2259 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2260 if (rc)
2261 new_tsec->sid = old_tsec->sid;
2262 }
2263
2264 ad.type = LSM_AUDIT_DATA_PATH;
2265 ad.u.path = bprm->file->f_path;
2266
2267 if (new_tsec->sid == old_tsec->sid) {
2268 rc = avc_has_perm(old_tsec->sid, isec->sid,
2269 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2270 if (rc)
2271 return rc;
2272 } else {
2273 /* Check permissions for the transition. */
2274 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2275 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2276 if (rc)
2277 return rc;
2278
2279 rc = avc_has_perm(new_tsec->sid, isec->sid,
2280 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2281 if (rc)
2282 return rc;
2283
2284 /* Check for shared state */
2285 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2286 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2287 SECCLASS_PROCESS, PROCESS__SHARE,
2288 NULL);
2289 if (rc)
2290 return -EPERM;
2291 }
2292
2293 /* Make sure that anyone attempting to ptrace over a task that
2294 * changes its SID has the appropriate permit */
2295 if (bprm->unsafe &
2296 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2297 struct task_struct *tracer;
2298 struct task_security_struct *sec;
2299 u32 ptsid = 0;
2300
2301 rcu_read_lock();
2302 tracer = ptrace_parent(current);
2303 if (likely(tracer != NULL)) {
2304 sec = __task_cred(tracer)->security;
2305 ptsid = sec->sid;
2306 }
2307 rcu_read_unlock();
2308
2309 if (ptsid != 0) {
2310 rc = avc_has_perm(ptsid, new_tsec->sid,
2311 SECCLASS_PROCESS,
2312 PROCESS__PTRACE, NULL);
2313 if (rc)
2314 return -EPERM;
2315 }
2316 }
2317
2318 /* Clear any possibly unsafe personality bits on exec: */
2319 bprm->per_clear |= PER_CLEAR_ON_SETID;
2320 }
2321
2322 return 0;
2323 }
2324
2325 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2326 {
2327 const struct task_security_struct *tsec = current_security();
2328 u32 sid, osid;
2329 int atsecure = 0;
2330
2331 sid = tsec->sid;
2332 osid = tsec->osid;
2333
2334 if (osid != sid) {
2335 /* Enable secure mode for SIDs transitions unless
2336 the noatsecure permission is granted between
2337 the two SIDs, i.e. ahp returns 0. */
2338 atsecure = avc_has_perm(osid, sid,
2339 SECCLASS_PROCESS,
2340 PROCESS__NOATSECURE, NULL);
2341 }
2342
2343 return !!atsecure;
2344 }
2345
2346 static int match_file(const void *p, struct file *file, unsigned fd)
2347 {
2348 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2349 }
2350
2351 /* Derived from fs/exec.c:flush_old_files. */
2352 static inline void flush_unauthorized_files(const struct cred *cred,
2353 struct files_struct *files)
2354 {
2355 struct file *file, *devnull = NULL;
2356 struct tty_struct *tty;
2357 int drop_tty = 0;
2358 unsigned n;
2359
2360 tty = get_current_tty();
2361 if (tty) {
2362 spin_lock(&tty_files_lock);
2363 if (!list_empty(&tty->tty_files)) {
2364 struct tty_file_private *file_priv;
2365
2366 /* Revalidate access to controlling tty.
2367 Use file_path_has_perm on the tty path directly
2368 rather than using file_has_perm, as this particular
2369 open file may belong to another process and we are
2370 only interested in the inode-based check here. */
2371 file_priv = list_first_entry(&tty->tty_files,
2372 struct tty_file_private, list);
2373 file = file_priv->file;
2374 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2375 drop_tty = 1;
2376 }
2377 spin_unlock(&tty_files_lock);
2378 tty_kref_put(tty);
2379 }
2380 /* Reset controlling tty. */
2381 if (drop_tty)
2382 no_tty();
2383
2384 /* Revalidate access to inherited open files. */
2385 n = iterate_fd(files, 0, match_file, cred);
2386 if (!n) /* none found? */
2387 return;
2388
2389 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2390 if (IS_ERR(devnull))
2391 devnull = NULL;
2392 /* replace all the matching ones with this */
2393 do {
2394 replace_fd(n - 1, devnull, 0);
2395 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2396 if (devnull)
2397 fput(devnull);
2398 }
2399
2400 /*
2401 * Prepare a process for imminent new credential changes due to exec
2402 */
2403 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2404 {
2405 struct task_security_struct *new_tsec;
2406 struct rlimit *rlim, *initrlim;
2407 int rc, i;
2408
2409 new_tsec = bprm->cred->security;
2410 if (new_tsec->sid == new_tsec->osid)
2411 return;
2412
2413 /* Close files for which the new task SID is not authorized. */
2414 flush_unauthorized_files(bprm->cred, current->files);
2415
2416 /* Always clear parent death signal on SID transitions. */
2417 current->pdeath_signal = 0;
2418
2419 /* Check whether the new SID can inherit resource limits from the old
2420 * SID. If not, reset all soft limits to the lower of the current
2421 * task's hard limit and the init task's soft limit.
2422 *
2423 * Note that the setting of hard limits (even to lower them) can be
2424 * controlled by the setrlimit check. The inclusion of the init task's
2425 * soft limit into the computation is to avoid resetting soft limits
2426 * higher than the default soft limit for cases where the default is
2427 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2428 */
2429 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2430 PROCESS__RLIMITINH, NULL);
2431 if (rc) {
2432 /* protect against do_prlimit() */
2433 task_lock(current);
2434 for (i = 0; i < RLIM_NLIMITS; i++) {
2435 rlim = current->signal->rlim + i;
2436 initrlim = init_task.signal->rlim + i;
2437 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2438 }
2439 task_unlock(current);
2440 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2441 }
2442 }
2443
2444 /*
2445 * Clean up the process immediately after the installation of new credentials
2446 * due to exec
2447 */
2448 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2449 {
2450 const struct task_security_struct *tsec = current_security();
2451 struct itimerval itimer;
2452 u32 osid, sid;
2453 int rc, i;
2454
2455 osid = tsec->osid;
2456 sid = tsec->sid;
2457
2458 if (sid == osid)
2459 return;
2460
2461 /* Check whether the new SID can inherit signal state from the old SID.
2462 * If not, clear itimers to avoid subsequent signal generation and
2463 * flush and unblock signals.
2464 *
2465 * This must occur _after_ the task SID has been updated so that any
2466 * kill done after the flush will be checked against the new SID.
2467 */
2468 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2469 if (rc) {
2470 memset(&itimer, 0, sizeof itimer);
2471 for (i = 0; i < 3; i++)
2472 do_setitimer(i, &itimer, NULL);
2473 spin_lock_irq(&current->sighand->siglock);
2474 if (!fatal_signal_pending(current)) {
2475 flush_sigqueue(&current->pending);
2476 flush_sigqueue(&current->signal->shared_pending);
2477 flush_signal_handlers(current, 1);
2478 sigemptyset(&current->blocked);
2479 recalc_sigpending();
2480 }
2481 spin_unlock_irq(&current->sighand->siglock);
2482 }
2483
2484 /* Wake up the parent if it is waiting so that it can recheck
2485 * wait permission to the new task SID. */
2486 read_lock(&tasklist_lock);
2487 __wake_up_parent(current, current->real_parent);
2488 read_unlock(&tasklist_lock);
2489 }
2490
2491 /* superblock security operations */
2492
2493 static int selinux_sb_alloc_security(struct super_block *sb)
2494 {
2495 return superblock_alloc_security(sb);
2496 }
2497
2498 static void selinux_sb_free_security(struct super_block *sb)
2499 {
2500 superblock_free_security(sb);
2501 }
2502
2503 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2504 {
2505 if (plen > olen)
2506 return 0;
2507
2508 return !memcmp(prefix, option, plen);
2509 }
2510
2511 static inline int selinux_option(char *option, int len)
2512 {
2513 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2514 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2515 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2516 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2517 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2518 }
2519
2520 static inline void take_option(char **to, char *from, int *first, int len)
2521 {
2522 if (!*first) {
2523 **to = ',';
2524 *to += 1;
2525 } else
2526 *first = 0;
2527 memcpy(*to, from, len);
2528 *to += len;
2529 }
2530
2531 static inline void take_selinux_option(char **to, char *from, int *first,
2532 int len)
2533 {
2534 int current_size = 0;
2535
2536 if (!*first) {
2537 **to = '|';
2538 *to += 1;
2539 } else
2540 *first = 0;
2541
2542 while (current_size < len) {
2543 if (*from != '"') {
2544 **to = *from;
2545 *to += 1;
2546 }
2547 from += 1;
2548 current_size += 1;
2549 }
2550 }
2551
2552 static int selinux_sb_copy_data(char *orig, char *copy)
2553 {
2554 int fnosec, fsec, rc = 0;
2555 char *in_save, *in_curr, *in_end;
2556 char *sec_curr, *nosec_save, *nosec;
2557 int open_quote = 0;
2558
2559 in_curr = orig;
2560 sec_curr = copy;
2561
2562 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2563 if (!nosec) {
2564 rc = -ENOMEM;
2565 goto out;
2566 }
2567
2568 nosec_save = nosec;
2569 fnosec = fsec = 1;
2570 in_save = in_end = orig;
2571
2572 do {
2573 if (*in_end == '"')
2574 open_quote = !open_quote;
2575 if ((*in_end == ',' && open_quote == 0) ||
2576 *in_end == '\0') {
2577 int len = in_end - in_curr;
2578
2579 if (selinux_option(in_curr, len))
2580 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2581 else
2582 take_option(&nosec, in_curr, &fnosec, len);
2583
2584 in_curr = in_end + 1;
2585 }
2586 } while (*in_end++);
2587
2588 strcpy(in_save, nosec_save);
2589 free_page((unsigned long)nosec_save);
2590 out:
2591 return rc;
2592 }
2593
2594 static int selinux_sb_remount(struct super_block *sb, void *data)
2595 {
2596 int rc, i, *flags;
2597 struct security_mnt_opts opts;
2598 char *secdata, **mount_options;
2599 struct superblock_security_struct *sbsec = sb->s_security;
2600
2601 if (!(sbsec->flags & SE_SBINITIALIZED))
2602 return 0;
2603
2604 if (!data)
2605 return 0;
2606
2607 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2608 return 0;
2609
2610 security_init_mnt_opts(&opts);
2611 secdata = alloc_secdata();
2612 if (!secdata)
2613 return -ENOMEM;
2614 rc = selinux_sb_copy_data(data, secdata);
2615 if (rc)
2616 goto out_free_secdata;
2617
2618 rc = selinux_parse_opts_str(secdata, &opts);
2619 if (rc)
2620 goto out_free_secdata;
2621
2622 mount_options = opts.mnt_opts;
2623 flags = opts.mnt_opts_flags;
2624
2625 for (i = 0; i < opts.num_mnt_opts; i++) {
2626 u32 sid;
2627
2628 if (flags[i] == SBLABEL_MNT)
2629 continue;
2630 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2631 if (rc) {
2632 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2633 "(%s) failed for (dev %s, type %s) errno=%d\n",
2634 mount_options[i], sb->s_id, sb->s_type->name, rc);
2635 goto out_free_opts;
2636 }
2637 rc = -EINVAL;
2638 switch (flags[i]) {
2639 case FSCONTEXT_MNT:
2640 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2641 goto out_bad_option;
2642 break;
2643 case CONTEXT_MNT:
2644 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2645 goto out_bad_option;
2646 break;
2647 case ROOTCONTEXT_MNT: {
2648 struct inode_security_struct *root_isec;
2649 root_isec = d_backing_inode(sb->s_root)->i_security;
2650
2651 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2652 goto out_bad_option;
2653 break;
2654 }
2655 case DEFCONTEXT_MNT:
2656 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2657 goto out_bad_option;
2658 break;
2659 default:
2660 goto out_free_opts;
2661 }
2662 }
2663
2664 rc = 0;
2665 out_free_opts:
2666 security_free_mnt_opts(&opts);
2667 out_free_secdata:
2668 free_secdata(secdata);
2669 return rc;
2670 out_bad_option:
2671 printk(KERN_WARNING "SELinux: unable to change security options "
2672 "during remount (dev %s, type=%s)\n", sb->s_id,
2673 sb->s_type->name);
2674 goto out_free_opts;
2675 }
2676
2677 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2678 {
2679 const struct cred *cred = current_cred();
2680 struct common_audit_data ad;
2681 int rc;
2682
2683 rc = superblock_doinit(sb, data);
2684 if (rc)
2685 return rc;
2686
2687 /* Allow all mounts performed by the kernel */
2688 if (flags & MS_KERNMOUNT)
2689 return 0;
2690
2691 ad.type = LSM_AUDIT_DATA_DENTRY;
2692 ad.u.dentry = sb->s_root;
2693 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2694 }
2695
2696 static int selinux_sb_statfs(struct dentry *dentry)
2697 {
2698 const struct cred *cred = current_cred();
2699 struct common_audit_data ad;
2700
2701 ad.type = LSM_AUDIT_DATA_DENTRY;
2702 ad.u.dentry = dentry->d_sb->s_root;
2703 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2704 }
2705
2706 static int selinux_mount(const char *dev_name,
2707 struct path *path,
2708 const char *type,
2709 unsigned long flags,
2710 void *data)
2711 {
2712 const struct cred *cred = current_cred();
2713
2714 if (flags & MS_REMOUNT)
2715 return superblock_has_perm(cred, path->dentry->d_sb,
2716 FILESYSTEM__REMOUNT, NULL);
2717 else
2718 return path_has_perm(cred, path, FILE__MOUNTON);
2719 }
2720
2721 static int selinux_umount(struct vfsmount *mnt, int flags)
2722 {
2723 const struct cred *cred = current_cred();
2724
2725 return superblock_has_perm(cred, mnt->mnt_sb,
2726 FILESYSTEM__UNMOUNT, NULL);
2727 }
2728
2729 /* inode security operations */
2730
2731 static int selinux_inode_alloc_security(struct inode *inode)
2732 {
2733 return inode_alloc_security(inode);
2734 }
2735
2736 static void selinux_inode_free_security(struct inode *inode)
2737 {
2738 inode_free_security(inode);
2739 }
2740
2741 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2742 struct qstr *name, void **ctx,
2743 u32 *ctxlen)
2744 {
2745 u32 newsid;
2746 int rc;
2747
2748 rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2749 inode_mode_to_security_class(mode),
2750 &newsid);
2751 if (rc)
2752 return rc;
2753
2754 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2755 }
2756
2757 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2758 const struct qstr *qstr,
2759 const char **name,
2760 void **value, size_t *len)
2761 {
2762 const struct task_security_struct *tsec = current_security();
2763 struct inode_security_struct *dsec;
2764 struct superblock_security_struct *sbsec;
2765 u32 sid, newsid, clen;
2766 int rc;
2767 char *context;
2768
2769 dsec = dir->i_security;
2770 sbsec = dir->i_sb->s_security;
2771
2772 sid = tsec->sid;
2773 newsid = tsec->create_sid;
2774
2775 rc = selinux_determine_inode_label(
2776 dir, qstr,
2777 inode_mode_to_security_class(inode->i_mode),
2778 &newsid);
2779 if (rc)
2780 return rc;
2781
2782 /* Possibly defer initialization to selinux_complete_init. */
2783 if (sbsec->flags & SE_SBINITIALIZED) {
2784 struct inode_security_struct *isec = inode->i_security;
2785 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2786 isec->sid = newsid;
2787 isec->initialized = 1;
2788 }
2789
2790 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2791 return -EOPNOTSUPP;
2792
2793 if (name)
2794 *name = XATTR_SELINUX_SUFFIX;
2795
2796 if (value && len) {
2797 rc = security_sid_to_context_force(newsid, &context, &clen);
2798 if (rc)
2799 return rc;
2800 *value = context;
2801 *len = clen;
2802 }
2803
2804 return 0;
2805 }
2806
2807 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2808 {
2809 return may_create(dir, dentry, SECCLASS_FILE);
2810 }
2811
2812 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2813 {
2814 return may_link(dir, old_dentry, MAY_LINK);
2815 }
2816
2817 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2818 {
2819 return may_link(dir, dentry, MAY_UNLINK);
2820 }
2821
2822 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2823 {
2824 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2825 }
2826
2827 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2828 {
2829 return may_create(dir, dentry, SECCLASS_DIR);
2830 }
2831
2832 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2833 {
2834 return may_link(dir, dentry, MAY_RMDIR);
2835 }
2836
2837 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2838 {
2839 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2840 }
2841
2842 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2843 struct inode *new_inode, struct dentry *new_dentry)
2844 {
2845 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2846 }
2847
2848 static int selinux_inode_readlink(struct dentry *dentry)
2849 {
2850 const struct cred *cred = current_cred();
2851
2852 return dentry_has_perm(cred, dentry, FILE__READ);
2853 }
2854
2855 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2856 bool rcu)
2857 {
2858 const struct cred *cred = current_cred();
2859 struct common_audit_data ad;
2860 struct inode_security_struct *isec;
2861 u32 sid;
2862
2863 validate_creds(cred);
2864
2865 ad.type = LSM_AUDIT_DATA_DENTRY;
2866 ad.u.dentry = dentry;
2867 sid = cred_sid(cred);
2868 isec = inode->i_security;
2869
2870 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2871 rcu ? MAY_NOT_BLOCK : 0);
2872 }
2873
2874 static noinline int audit_inode_permission(struct inode *inode,
2875 u32 perms, u32 audited, u32 denied,
2876 int result,
2877 unsigned flags)
2878 {
2879 struct common_audit_data ad;
2880 struct inode_security_struct *isec = inode->i_security;
2881 int rc;
2882
2883 ad.type = LSM_AUDIT_DATA_INODE;
2884 ad.u.inode = inode;
2885
2886 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2887 audited, denied, result, &ad, flags);
2888 if (rc)
2889 return rc;
2890 return 0;
2891 }
2892
2893 static int selinux_inode_permission(struct inode *inode, int mask)
2894 {
2895 const struct cred *cred = current_cred();
2896 u32 perms;
2897 bool from_access;
2898 unsigned flags = mask & MAY_NOT_BLOCK;
2899 struct inode_security_struct *isec;
2900 u32 sid;
2901 struct av_decision avd;
2902 int rc, rc2;
2903 u32 audited, denied;
2904
2905 from_access = mask & MAY_ACCESS;
2906 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2907
2908 /* No permission to check. Existence test. */
2909 if (!mask)
2910 return 0;
2911
2912 validate_creds(cred);
2913
2914 if (unlikely(IS_PRIVATE(inode)))
2915 return 0;
2916
2917 perms = file_mask_to_av(inode->i_mode, mask);
2918
2919 sid = cred_sid(cred);
2920 isec = inode->i_security;
2921
2922 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2923 audited = avc_audit_required(perms, &avd, rc,
2924 from_access ? FILE__AUDIT_ACCESS : 0,
2925 &denied);
2926 if (likely(!audited))
2927 return rc;
2928
2929 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2930 if (rc2)
2931 return rc2;
2932 return rc;
2933 }
2934
2935 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2936 {
2937 const struct cred *cred = current_cred();
2938 struct inode *inode = d_backing_inode(dentry);
2939 unsigned int ia_valid = iattr->ia_valid;
2940 __u32 av = FILE__WRITE;
2941
2942 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2943 if (ia_valid & ATTR_FORCE) {
2944 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2945 ATTR_FORCE);
2946 if (!ia_valid)
2947 return 0;
2948 }
2949
2950 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2951 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2952 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2953
2954 if (selinux_policycap_openperm &&
2955 inode->i_sb->s_magic != SOCKFS_MAGIC &&
2956 (ia_valid & ATTR_SIZE) &&
2957 !(ia_valid & ATTR_FILE))
2958 av |= FILE__OPEN;
2959
2960 return dentry_has_perm(cred, dentry, av);
2961 }
2962
2963 static int selinux_inode_getattr(const struct path *path)
2964 {
2965 return path_has_perm(current_cred(), path, FILE__GETATTR);
2966 }
2967
2968 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2969 {
2970 const struct cred *cred = current_cred();
2971
2972 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2973 sizeof XATTR_SECURITY_PREFIX - 1)) {
2974 if (!strcmp(name, XATTR_NAME_CAPS)) {
2975 if (!capable(CAP_SETFCAP))
2976 return -EPERM;
2977 } else if (!capable(CAP_SYS_ADMIN)) {
2978 /* A different attribute in the security namespace.
2979 Restrict to administrator. */
2980 return -EPERM;
2981 }
2982 }
2983
2984 /* Not an attribute we recognize, so just check the
2985 ordinary setattr permission. */
2986 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2987 }
2988
2989 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2990 const void *value, size_t size, int flags)
2991 {
2992 struct inode *inode = d_backing_inode(dentry);
2993 struct inode_security_struct *isec = inode->i_security;
2994 struct superblock_security_struct *sbsec;
2995 struct common_audit_data ad;
2996 u32 newsid, sid = current_sid();
2997 int rc = 0;
2998
2999 if (strcmp(name, XATTR_NAME_SELINUX))
3000 return selinux_inode_setotherxattr(dentry, name);
3001
3002 sbsec = inode->i_sb->s_security;
3003 if (!(sbsec->flags & SBLABEL_MNT))
3004 return -EOPNOTSUPP;
3005
3006 if (!inode_owner_or_capable(inode))
3007 return -EPERM;
3008
3009 ad.type = LSM_AUDIT_DATA_DENTRY;
3010 ad.u.dentry = dentry;
3011
3012 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3013 FILE__RELABELFROM, &ad);
3014 if (rc)
3015 return rc;
3016
3017 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3018 if (rc == -EINVAL) {
3019 if (!capable(CAP_MAC_ADMIN)) {
3020 struct audit_buffer *ab;
3021 size_t audit_size;
3022 const char *str;
3023
3024 /* We strip a nul only if it is at the end, otherwise the
3025 * context contains a nul and we should audit that */
3026 if (value) {
3027 str = value;
3028 if (str[size - 1] == '\0')
3029 audit_size = size - 1;
3030 else
3031 audit_size = size;
3032 } else {
3033 str = "";
3034 audit_size = 0;
3035 }
3036 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3037 audit_log_format(ab, "op=setxattr invalid_context=");
3038 audit_log_n_untrustedstring(ab, value, audit_size);
3039 audit_log_end(ab);
3040
3041 return rc;
3042 }
3043 rc = security_context_to_sid_force(value, size, &newsid);
3044 }
3045 if (rc)
3046 return rc;
3047
3048 rc = avc_has_perm(sid, newsid, isec->sclass,
3049 FILE__RELABELTO, &ad);
3050 if (rc)
3051 return rc;
3052
3053 rc = security_validate_transition(isec->sid, newsid, sid,
3054 isec->sclass);
3055 if (rc)
3056 return rc;
3057
3058 return avc_has_perm(newsid,
3059 sbsec->sid,
3060 SECCLASS_FILESYSTEM,
3061 FILESYSTEM__ASSOCIATE,
3062 &ad);
3063 }
3064
3065 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3066 const void *value, size_t size,
3067 int flags)
3068 {
3069 struct inode *inode = d_backing_inode(dentry);
3070 struct inode_security_struct *isec = inode->i_security;
3071 u32 newsid;
3072 int rc;
3073
3074 if (strcmp(name, XATTR_NAME_SELINUX)) {
3075 /* Not an attribute we recognize, so nothing to do. */
3076 return;
3077 }
3078
3079 rc = security_context_to_sid_force(value, size, &newsid);
3080 if (rc) {
3081 printk(KERN_ERR "SELinux: unable to map context to SID"
3082 "for (%s, %lu), rc=%d\n",
3083 inode->i_sb->s_id, inode->i_ino, -rc);
3084 return;
3085 }
3086
3087 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3088 isec->sid = newsid;
3089 isec->initialized = 1;
3090
3091 return;
3092 }
3093
3094 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3095 {
3096 const struct cred *cred = current_cred();
3097
3098 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3099 }
3100
3101 static int selinux_inode_listxattr(struct dentry *dentry)
3102 {
3103 const struct cred *cred = current_cred();
3104
3105 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3106 }
3107
3108 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3109 {
3110 if (strcmp(name, XATTR_NAME_SELINUX))
3111 return selinux_inode_setotherxattr(dentry, name);
3112
3113 /* No one is allowed to remove a SELinux security label.
3114 You can change the label, but all data must be labeled. */
3115 return -EACCES;
3116 }
3117
3118 /*
3119 * Copy the inode security context value to the user.
3120 *
3121 * Permission check is handled by selinux_inode_getxattr hook.
3122 */
3123 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3124 {
3125 u32 size;
3126 int error;
3127 char *context = NULL;
3128 struct inode_security_struct *isec = inode->i_security;
3129
3130 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3131 return -EOPNOTSUPP;
3132
3133 /*
3134 * If the caller has CAP_MAC_ADMIN, then get the raw context
3135 * value even if it is not defined by current policy; otherwise,
3136 * use the in-core value under current policy.
3137 * Use the non-auditing forms of the permission checks since
3138 * getxattr may be called by unprivileged processes commonly
3139 * and lack of permission just means that we fall back to the
3140 * in-core context value, not a denial.
3141 */
3142 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3143 SECURITY_CAP_NOAUDIT);
3144 if (!error)
3145 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3146 SECURITY_CAP_NOAUDIT);
3147 if (!error)
3148 error = security_sid_to_context_force(isec->sid, &context,
3149 &size);
3150 else
3151 error = security_sid_to_context(isec->sid, &context, &size);
3152 if (error)
3153 return error;
3154 error = size;
3155 if (alloc) {
3156 *buffer = context;
3157 goto out_nofree;
3158 }
3159 kfree(context);
3160 out_nofree:
3161 return error;
3162 }
3163
3164 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3165 const void *value, size_t size, int flags)
3166 {
3167 struct inode_security_struct *isec = inode->i_security;
3168 u32 newsid;
3169 int rc;
3170
3171 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3172 return -EOPNOTSUPP;
3173
3174 if (!value || !size)
3175 return -EACCES;
3176
3177 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3178 if (rc)
3179 return rc;
3180
3181 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3182 isec->sid = newsid;
3183 isec->initialized = 1;
3184 return 0;
3185 }
3186
3187 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3188 {
3189 const int len = sizeof(XATTR_NAME_SELINUX);
3190 if (buffer && len <= buffer_size)
3191 memcpy(buffer, XATTR_NAME_SELINUX, len);
3192 return len;
3193 }
3194
3195 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3196 {
3197 struct inode_security_struct *isec = inode->i_security;
3198 *secid = isec->sid;
3199 }
3200
3201 /* file security operations */
3202
3203 static int selinux_revalidate_file_permission(struct file *file, int mask)
3204 {
3205 const struct cred *cred = current_cred();
3206 struct inode *inode = file_inode(file);
3207
3208 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3209 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3210 mask |= MAY_APPEND;
3211
3212 return file_has_perm(cred, file,
3213 file_mask_to_av(inode->i_mode, mask));
3214 }
3215
3216 static int selinux_file_permission(struct file *file, int mask)
3217 {
3218 struct inode *inode = file_inode(file);
3219 struct file_security_struct *fsec = file->f_security;
3220 struct inode_security_struct *isec = inode->i_security;
3221 u32 sid = current_sid();
3222
3223 if (!mask)
3224 /* No permission to check. Existence test. */
3225 return 0;
3226
3227 if (sid == fsec->sid && fsec->isid == isec->sid &&
3228 fsec->pseqno == avc_policy_seqno())
3229 /* No change since file_open check. */
3230 return 0;
3231
3232 return selinux_revalidate_file_permission(file, mask);
3233 }
3234
3235 static int selinux_file_alloc_security(struct file *file)
3236 {
3237 return file_alloc_security(file);
3238 }
3239
3240 static void selinux_file_free_security(struct file *file)
3241 {
3242 file_free_security(file);
3243 }
3244
3245 /*
3246 * Check whether a task has the ioctl permission and cmd
3247 * operation to an inode.
3248 */
3249 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3250 u32 requested, u16 cmd)
3251 {
3252 struct common_audit_data ad;
3253 struct file_security_struct *fsec = file->f_security;
3254 struct inode *inode = file_inode(file);
3255 struct inode_security_struct *isec = inode->i_security;
3256 struct lsm_ioctlop_audit ioctl;
3257 u32 ssid = cred_sid(cred);
3258 int rc;
3259 u8 driver = cmd >> 8;
3260 u8 xperm = cmd & 0xff;
3261
3262 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3263 ad.u.op = &ioctl;
3264 ad.u.op->cmd = cmd;
3265 ad.u.op->path = file->f_path;
3266
3267 if (ssid != fsec->sid) {
3268 rc = avc_has_perm(ssid, fsec->sid,
3269 SECCLASS_FD,
3270 FD__USE,
3271 &ad);
3272 if (rc)
3273 goto out;
3274 }
3275
3276 if (unlikely(IS_PRIVATE(inode)))
3277 return 0;
3278
3279 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3280 requested, driver, xperm, &ad);
3281 out:
3282 return rc;
3283 }
3284
3285 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3286 unsigned long arg)
3287 {
3288 const struct cred *cred = current_cred();
3289 int error = 0;
3290
3291 switch (cmd) {
3292 case FIONREAD:
3293 /* fall through */
3294 case FIBMAP:
3295 /* fall through */
3296 case FIGETBSZ:
3297 /* fall through */
3298 case FS_IOC_GETFLAGS:
3299 /* fall through */
3300 case FS_IOC_GETVERSION:
3301 error = file_has_perm(cred, file, FILE__GETATTR);
3302 break;
3303
3304 case FS_IOC_SETFLAGS:
3305 /* fall through */
3306 case FS_IOC_SETVERSION:
3307 error = file_has_perm(cred, file, FILE__SETATTR);
3308 break;
3309
3310 /* sys_ioctl() checks */
3311 case FIONBIO:
3312 /* fall through */
3313 case FIOASYNC:
3314 error = file_has_perm(cred, file, 0);
3315 break;
3316
3317 case KDSKBENT:
3318 case KDSKBSENT:
3319 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3320 SECURITY_CAP_AUDIT);
3321 break;
3322
3323 /* default case assumes that the command will go
3324 * to the file's ioctl() function.
3325 */
3326 default:
3327 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3328 }
3329 return error;
3330 }
3331
3332 static int default_noexec;
3333
3334 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3335 {
3336 const struct cred *cred = current_cred();
3337 int rc = 0;
3338
3339 if (default_noexec &&
3340 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3341 (!shared && (prot & PROT_WRITE)))) {
3342 /*
3343 * We are making executable an anonymous mapping or a
3344 * private file mapping that will also be writable.
3345 * This has an additional check.
3346 */
3347 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3348 if (rc)
3349 goto error;
3350 }
3351
3352 if (file) {
3353 /* read access is always possible with a mapping */
3354 u32 av = FILE__READ;
3355
3356 /* write access only matters if the mapping is shared */
3357 if (shared && (prot & PROT_WRITE))
3358 av |= FILE__WRITE;
3359
3360 if (prot & PROT_EXEC)
3361 av |= FILE__EXECUTE;
3362
3363 return file_has_perm(cred, file, av);
3364 }
3365
3366 error:
3367 return rc;
3368 }
3369
3370 static int selinux_mmap_addr(unsigned long addr)
3371 {
3372 int rc = 0;
3373
3374 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3375 u32 sid = current_sid();
3376 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3377 MEMPROTECT__MMAP_ZERO, NULL);
3378 }
3379
3380 return rc;
3381 }
3382
3383 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3384 unsigned long prot, unsigned long flags)
3385 {
3386 if (selinux_checkreqprot)
3387 prot = reqprot;
3388
3389 return file_map_prot_check(file, prot,
3390 (flags & MAP_TYPE) == MAP_SHARED);
3391 }
3392
3393 static int selinux_file_mprotect(struct vm_area_struct *vma,
3394 unsigned long reqprot,
3395 unsigned long prot)
3396 {
3397 const struct cred *cred = current_cred();
3398
3399 if (selinux_checkreqprot)
3400 prot = reqprot;
3401
3402 if (default_noexec &&
3403 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3404 int rc = 0;
3405 if (vma->vm_start >= vma->vm_mm->start_brk &&
3406 vma->vm_end <= vma->vm_mm->brk) {
3407 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3408 } else if (!vma->vm_file &&
3409 vma->vm_start <= vma->vm_mm->start_stack &&
3410 vma->vm_end >= vma->vm_mm->start_stack) {
3411 rc = current_has_perm(current, PROCESS__EXECSTACK);
3412 } else if (vma->vm_file && vma->anon_vma) {
3413 /*
3414 * We are making executable a file mapping that has
3415 * had some COW done. Since pages might have been
3416 * written, check ability to execute the possibly
3417 * modified content. This typically should only
3418 * occur for text relocations.
3419 */
3420 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3421 }
3422 if (rc)
3423 return rc;
3424 }
3425
3426 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3427 }
3428
3429 static int selinux_file_lock(struct file *file, unsigned int cmd)
3430 {
3431 const struct cred *cred = current_cred();
3432
3433 return file_has_perm(cred, file, FILE__LOCK);
3434 }
3435
3436 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3437 unsigned long arg)
3438 {
3439 const struct cred *cred = current_cred();
3440 int err = 0;
3441
3442 switch (cmd) {
3443 case F_SETFL:
3444 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3445 err = file_has_perm(cred, file, FILE__WRITE);
3446 break;
3447 }
3448 /* fall through */
3449 case F_SETOWN:
3450 case F_SETSIG:
3451 case F_GETFL:
3452 case F_GETOWN:
3453 case F_GETSIG:
3454 case F_GETOWNER_UIDS:
3455 /* Just check FD__USE permission */
3456 err = file_has_perm(cred, file, 0);
3457 break;
3458 case F_GETLK:
3459 case F_SETLK:
3460 case F_SETLKW:
3461 case F_OFD_GETLK:
3462 case F_OFD_SETLK:
3463 case F_OFD_SETLKW:
3464 #if BITS_PER_LONG == 32
3465 case F_GETLK64:
3466 case F_SETLK64:
3467 case F_SETLKW64:
3468 #endif
3469 err = file_has_perm(cred, file, FILE__LOCK);
3470 break;
3471 }
3472
3473 return err;
3474 }
3475
3476 static void selinux_file_set_fowner(struct file *file)
3477 {
3478 struct file_security_struct *fsec;
3479
3480 fsec = file->f_security;
3481 fsec->fown_sid = current_sid();
3482 }
3483
3484 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3485 struct fown_struct *fown, int signum)
3486 {
3487 struct file *file;
3488 u32 sid = task_sid(tsk);
3489 u32 perm;
3490 struct file_security_struct *fsec;
3491
3492 /* struct fown_struct is never outside the context of a struct file */
3493 file = container_of(fown, struct file, f_owner);
3494
3495 fsec = file->f_security;
3496
3497 if (!signum)
3498 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3499 else
3500 perm = signal_to_av(signum);
3501
3502 return avc_has_perm(fsec->fown_sid, sid,
3503 SECCLASS_PROCESS, perm, NULL);
3504 }
3505
3506 static int selinux_file_receive(struct file *file)
3507 {
3508 const struct cred *cred = current_cred();
3509
3510 return file_has_perm(cred, file, file_to_av(file));
3511 }
3512
3513 static int selinux_file_open(struct file *file, const struct cred *cred)
3514 {
3515 struct file_security_struct *fsec;
3516 struct inode_security_struct *isec;
3517
3518 fsec = file->f_security;
3519 isec = file_inode(file)->i_security;
3520 /*
3521 * Save inode label and policy sequence number
3522 * at open-time so that selinux_file_permission
3523 * can determine whether revalidation is necessary.
3524 * Task label is already saved in the file security
3525 * struct as its SID.
3526 */
3527 fsec->isid = isec->sid;
3528 fsec->pseqno = avc_policy_seqno();
3529 /*
3530 * Since the inode label or policy seqno may have changed
3531 * between the selinux_inode_permission check and the saving
3532 * of state above, recheck that access is still permitted.
3533 * Otherwise, access might never be revalidated against the
3534 * new inode label or new policy.
3535 * This check is not redundant - do not remove.
3536 */
3537 return file_path_has_perm(cred, file, open_file_to_av(file));
3538 }
3539
3540 /* task security operations */
3541
3542 static int selinux_task_create(unsigned long clone_flags)
3543 {
3544 return current_has_perm(current, PROCESS__FORK);
3545 }
3546
3547 /*
3548 * allocate the SELinux part of blank credentials
3549 */
3550 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3551 {
3552 struct task_security_struct *tsec;
3553
3554 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3555 if (!tsec)
3556 return -ENOMEM;
3557
3558 cred->security = tsec;
3559 return 0;
3560 }
3561
3562 /*
3563 * detach and free the LSM part of a set of credentials
3564 */
3565 static void selinux_cred_free(struct cred *cred)
3566 {
3567 struct task_security_struct *tsec = cred->security;
3568
3569 /*
3570 * cred->security == NULL if security_cred_alloc_blank() or
3571 * security_prepare_creds() returned an error.
3572 */
3573 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3574 cred->security = (void *) 0x7UL;
3575 kfree(tsec);
3576 }
3577
3578 /*
3579 * prepare a new set of credentials for modification
3580 */
3581 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3582 gfp_t gfp)
3583 {
3584 const struct task_security_struct *old_tsec;
3585 struct task_security_struct *tsec;
3586
3587 old_tsec = old->security;
3588
3589 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3590 if (!tsec)
3591 return -ENOMEM;
3592
3593 new->security = tsec;
3594 return 0;
3595 }
3596
3597 /*
3598 * transfer the SELinux data to a blank set of creds
3599 */
3600 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3601 {
3602 const struct task_security_struct *old_tsec = old->security;
3603 struct task_security_struct *tsec = new->security;
3604
3605 *tsec = *old_tsec;
3606 }
3607
3608 /*
3609 * set the security data for a kernel service
3610 * - all the creation contexts are set to unlabelled
3611 */
3612 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3613 {
3614 struct task_security_struct *tsec = new->security;
3615 u32 sid = current_sid();
3616 int ret;
3617
3618 ret = avc_has_perm(sid, secid,
3619 SECCLASS_KERNEL_SERVICE,
3620 KERNEL_SERVICE__USE_AS_OVERRIDE,
3621 NULL);
3622 if (ret == 0) {
3623 tsec->sid = secid;
3624 tsec->create_sid = 0;
3625 tsec->keycreate_sid = 0;
3626 tsec->sockcreate_sid = 0;
3627 }
3628 return ret;
3629 }
3630
3631 /*
3632 * set the file creation context in a security record to the same as the
3633 * objective context of the specified inode
3634 */
3635 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3636 {
3637 struct inode_security_struct *isec = inode->i_security;
3638 struct task_security_struct *tsec = new->security;
3639 u32 sid = current_sid();
3640 int ret;
3641
3642 ret = avc_has_perm(sid, isec->sid,
3643 SECCLASS_KERNEL_SERVICE,
3644 KERNEL_SERVICE__CREATE_FILES_AS,
3645 NULL);
3646
3647 if (ret == 0)
3648 tsec->create_sid = isec->sid;
3649 return ret;
3650 }
3651
3652 static int selinux_kernel_module_request(char *kmod_name)
3653 {
3654 u32 sid;
3655 struct common_audit_data ad;
3656
3657 sid = task_sid(current);
3658
3659 ad.type = LSM_AUDIT_DATA_KMOD;
3660 ad.u.kmod_name = kmod_name;
3661
3662 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3663 SYSTEM__MODULE_REQUEST, &ad);
3664 }
3665
3666 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3667 {
3668 return current_has_perm(p, PROCESS__SETPGID);
3669 }
3670
3671 static int selinux_task_getpgid(struct task_struct *p)
3672 {
3673 return current_has_perm(p, PROCESS__GETPGID);
3674 }
3675
3676 static int selinux_task_getsid(struct task_struct *p)
3677 {
3678 return current_has_perm(p, PROCESS__GETSESSION);
3679 }
3680
3681 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3682 {
3683 *secid = task_sid(p);
3684 }
3685
3686 static int selinux_task_setnice(struct task_struct *p, int nice)
3687 {
3688 return current_has_perm(p, PROCESS__SETSCHED);
3689 }
3690
3691 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3692 {
3693 return current_has_perm(p, PROCESS__SETSCHED);
3694 }
3695
3696 static int selinux_task_getioprio(struct task_struct *p)
3697 {
3698 return current_has_perm(p, PROCESS__GETSCHED);
3699 }
3700
3701 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3702 struct rlimit *new_rlim)
3703 {
3704 struct rlimit *old_rlim = p->signal->rlim + resource;
3705
3706 /* Control the ability to change the hard limit (whether
3707 lowering or raising it), so that the hard limit can
3708 later be used as a safe reset point for the soft limit
3709 upon context transitions. See selinux_bprm_committing_creds. */
3710 if (old_rlim->rlim_max != new_rlim->rlim_max)
3711 return current_has_perm(p, PROCESS__SETRLIMIT);
3712
3713 return 0;
3714 }
3715
3716 static int selinux_task_setscheduler(struct task_struct *p)
3717 {
3718 return current_has_perm(p, PROCESS__SETSCHED);
3719 }
3720
3721 static int selinux_task_getscheduler(struct task_struct *p)
3722 {
3723 return current_has_perm(p, PROCESS__GETSCHED);
3724 }
3725
3726 static int selinux_task_movememory(struct task_struct *p)
3727 {
3728 return current_has_perm(p, PROCESS__SETSCHED);
3729 }
3730
3731 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3732 int sig, u32 secid)
3733 {
3734 u32 perm;
3735 int rc;
3736
3737 if (!sig)
3738 perm = PROCESS__SIGNULL; /* null signal; existence test */
3739 else
3740 perm = signal_to_av(sig);
3741 if (secid)
3742 rc = avc_has_perm(secid, task_sid(p),
3743 SECCLASS_PROCESS, perm, NULL);
3744 else
3745 rc = current_has_perm(p, perm);
3746 return rc;
3747 }
3748
3749 static int selinux_task_wait(struct task_struct *p)
3750 {
3751 return task_has_perm(p, current, PROCESS__SIGCHLD);
3752 }
3753
3754 static void selinux_task_to_inode(struct task_struct *p,
3755 struct inode *inode)
3756 {
3757 struct inode_security_struct *isec = inode->i_security;
3758 u32 sid = task_sid(p);
3759
3760 isec->sid = sid;
3761 isec->initialized = 1;
3762 }
3763
3764 /* Returns error only if unable to parse addresses */
3765 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3766 struct common_audit_data *ad, u8 *proto)
3767 {
3768 int offset, ihlen, ret = -EINVAL;
3769 struct iphdr _iph, *ih;
3770
3771 offset = skb_network_offset(skb);
3772 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3773 if (ih == NULL)
3774 goto out;
3775
3776 ihlen = ih->ihl * 4;
3777 if (ihlen < sizeof(_iph))
3778 goto out;
3779
3780 ad->u.net->v4info.saddr = ih->saddr;
3781 ad->u.net->v4info.daddr = ih->daddr;
3782 ret = 0;
3783
3784 if (proto)
3785 *proto = ih->protocol;
3786
3787 switch (ih->protocol) {
3788 case IPPROTO_TCP: {
3789 struct tcphdr _tcph, *th;
3790
3791 if (ntohs(ih->frag_off) & IP_OFFSET)
3792 break;
3793
3794 offset += ihlen;
3795 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3796 if (th == NULL)
3797 break;
3798
3799 ad->u.net->sport = th->source;
3800 ad->u.net->dport = th->dest;
3801 break;
3802 }
3803
3804 case IPPROTO_UDP: {
3805 struct udphdr _udph, *uh;
3806
3807 if (ntohs(ih->frag_off) & IP_OFFSET)
3808 break;
3809
3810 offset += ihlen;
3811 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3812 if (uh == NULL)
3813 break;
3814
3815 ad->u.net->sport = uh->source;
3816 ad->u.net->dport = uh->dest;
3817 break;
3818 }
3819
3820 case IPPROTO_DCCP: {
3821 struct dccp_hdr _dccph, *dh;
3822
3823 if (ntohs(ih->frag_off) & IP_OFFSET)
3824 break;
3825
3826 offset += ihlen;
3827 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3828 if (dh == NULL)
3829 break;
3830
3831 ad->u.net->sport = dh->dccph_sport;
3832 ad->u.net->dport = dh->dccph_dport;
3833 break;
3834 }
3835
3836 default:
3837 break;
3838 }
3839 out:
3840 return ret;
3841 }
3842
3843 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3844
3845 /* Returns error only if unable to parse addresses */
3846 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3847 struct common_audit_data *ad, u8 *proto)
3848 {
3849 u8 nexthdr;
3850 int ret = -EINVAL, offset;
3851 struct ipv6hdr _ipv6h, *ip6;
3852 __be16 frag_off;
3853
3854 offset = skb_network_offset(skb);
3855 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3856 if (ip6 == NULL)
3857 goto out;
3858
3859 ad->u.net->v6info.saddr = ip6->saddr;
3860 ad->u.net->v6info.daddr = ip6->daddr;
3861 ret = 0;
3862
3863 nexthdr = ip6->nexthdr;
3864 offset += sizeof(_ipv6h);
3865 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3866 if (offset < 0)
3867 goto out;
3868
3869 if (proto)
3870 *proto = nexthdr;
3871
3872 switch (nexthdr) {
3873 case IPPROTO_TCP: {
3874 struct tcphdr _tcph, *th;
3875
3876 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3877 if (th == NULL)
3878 break;
3879
3880 ad->u.net->sport = th->source;
3881 ad->u.net->dport = th->dest;
3882 break;
3883 }
3884
3885 case IPPROTO_UDP: {
3886 struct udphdr _udph, *uh;
3887
3888 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3889 if (uh == NULL)
3890 break;
3891
3892 ad->u.net->sport = uh->source;
3893 ad->u.net->dport = uh->dest;
3894 break;
3895 }
3896
3897 case IPPROTO_DCCP: {
3898 struct dccp_hdr _dccph, *dh;
3899
3900 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3901 if (dh == NULL)
3902 break;
3903
3904 ad->u.net->sport = dh->dccph_sport;
3905 ad->u.net->dport = dh->dccph_dport;
3906 break;
3907 }
3908
3909 /* includes fragments */
3910 default:
3911 break;
3912 }
3913 out:
3914 return ret;
3915 }
3916
3917 #endif /* IPV6 */
3918
3919 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3920 char **_addrp, int src, u8 *proto)
3921 {
3922 char *addrp;
3923 int ret;
3924
3925 switch (ad->u.net->family) {
3926 case PF_INET:
3927 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3928 if (ret)
3929 goto parse_error;
3930 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3931 &ad->u.net->v4info.daddr);
3932 goto okay;
3933
3934 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3935 case PF_INET6:
3936 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3937 if (ret)
3938 goto parse_error;
3939 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3940 &ad->u.net->v6info.daddr);
3941 goto okay;
3942 #endif /* IPV6 */
3943 default:
3944 addrp = NULL;
3945 goto okay;
3946 }
3947
3948 parse_error:
3949 printk(KERN_WARNING
3950 "SELinux: failure in selinux_parse_skb(),"
3951 " unable to parse packet\n");
3952 return ret;
3953
3954 okay:
3955 if (_addrp)
3956 *_addrp = addrp;
3957 return 0;
3958 }
3959
3960 /**
3961 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3962 * @skb: the packet
3963 * @family: protocol family
3964 * @sid: the packet's peer label SID
3965 *
3966 * Description:
3967 * Check the various different forms of network peer labeling and determine
3968 * the peer label/SID for the packet; most of the magic actually occurs in
3969 * the security server function security_net_peersid_cmp(). The function
3970 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3971 * or -EACCES if @sid is invalid due to inconsistencies with the different
3972 * peer labels.
3973 *
3974 */
3975 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3976 {
3977 int err;
3978 u32 xfrm_sid;
3979 u32 nlbl_sid;
3980 u32 nlbl_type;
3981
3982 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3983 if (unlikely(err))
3984 return -EACCES;
3985 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3986 if (unlikely(err))
3987 return -EACCES;
3988
3989 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3990 if (unlikely(err)) {
3991 printk(KERN_WARNING
3992 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3993 " unable to determine packet's peer label\n");
3994 return -EACCES;
3995 }
3996
3997 return 0;
3998 }
3999
4000 /**
4001 * selinux_conn_sid - Determine the child socket label for a connection
4002 * @sk_sid: the parent socket's SID
4003 * @skb_sid: the packet's SID
4004 * @conn_sid: the resulting connection SID
4005 *
4006 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4007 * combined with the MLS information from @skb_sid in order to create
4008 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4009 * of @sk_sid. Returns zero on success, negative values on failure.
4010 *
4011 */
4012 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4013 {
4014 int err = 0;
4015
4016 if (skb_sid != SECSID_NULL)
4017 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4018 else
4019 *conn_sid = sk_sid;
4020
4021 return err;
4022 }
4023
4024 /* socket security operations */
4025
4026 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4027 u16 secclass, u32 *socksid)
4028 {
4029 if (tsec->sockcreate_sid > SECSID_NULL) {
4030 *socksid = tsec->sockcreate_sid;
4031 return 0;
4032 }
4033
4034 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4035 socksid);
4036 }
4037
4038 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4039 {
4040 struct sk_security_struct *sksec = sk->sk_security;
4041 struct common_audit_data ad;
4042 struct lsm_network_audit net = {0,};
4043 u32 tsid = task_sid(task);
4044
4045 if (!sksec)
4046 return -EFAULT;
4047 if (sksec->sid == SECINITSID_KERNEL)
4048 return 0;
4049
4050 ad.type = LSM_AUDIT_DATA_NET;
4051 ad.u.net = &net;
4052 ad.u.net->sk = sk;
4053
4054 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4055 }
4056
4057 static int selinux_socket_create(int family, int type,
4058 int protocol, int kern)
4059 {
4060 const struct task_security_struct *tsec = current_security();
4061 u32 newsid;
4062 u16 secclass;
4063 int rc;
4064
4065 if (kern)
4066 return 0;
4067
4068 secclass = socket_type_to_security_class(family, type, protocol);
4069 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4070 if (rc)
4071 return rc;
4072
4073 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4074 }
4075
4076 static int selinux_socket_post_create(struct socket *sock, int family,
4077 int type, int protocol, int kern)
4078 {
4079 const struct task_security_struct *tsec = current_security();
4080 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4081 struct sk_security_struct *sksec;
4082 int err = 0;
4083
4084 isec->sclass = socket_type_to_security_class(family, type, protocol);
4085
4086 if (kern)
4087 isec->sid = SECINITSID_KERNEL;
4088 else {
4089 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4090 if (err)
4091 return err;
4092 }
4093
4094 isec->initialized = 1;
4095
4096 if (sock->sk) {
4097 sksec = sock->sk->sk_security;
4098 sksec->sid = isec->sid;
4099 sksec->sclass = isec->sclass;
4100 err = selinux_netlbl_socket_post_create(sock->sk, family);
4101 }
4102
4103 return err;
4104 }
4105
4106 /* Range of port numbers used to automatically bind.
4107 Need to determine whether we should perform a name_bind
4108 permission check between the socket and the port number. */
4109
4110 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4111 {
4112 struct sock *sk = sock->sk;
4113 u16 family;
4114 int err;
4115
4116 err = sock_has_perm(current, sk, SOCKET__BIND);
4117 if (err)
4118 goto out;
4119
4120 /*
4121 * If PF_INET or PF_INET6, check name_bind permission for the port.
4122 * Multiple address binding for SCTP is not supported yet: we just
4123 * check the first address now.
4124 */
4125 family = sk->sk_family;
4126 if (family == PF_INET || family == PF_INET6) {
4127 char *addrp;
4128 struct sk_security_struct *sksec = sk->sk_security;
4129 struct common_audit_data ad;
4130 struct lsm_network_audit net = {0,};
4131 struct sockaddr_in *addr4 = NULL;
4132 struct sockaddr_in6 *addr6 = NULL;
4133 unsigned short snum;
4134 u32 sid, node_perm;
4135
4136 if (family == PF_INET) {
4137 if (addrlen < sizeof(struct sockaddr_in)) {
4138 err = -EINVAL;
4139 goto out;
4140 }
4141 addr4 = (struct sockaddr_in *)address;
4142 snum = ntohs(addr4->sin_port);
4143 addrp = (char *)&addr4->sin_addr.s_addr;
4144 } else {
4145 if (addrlen < SIN6_LEN_RFC2133) {
4146 err = -EINVAL;
4147 goto out;
4148 }
4149 addr6 = (struct sockaddr_in6 *)address;
4150 snum = ntohs(addr6->sin6_port);
4151 addrp = (char *)&addr6->sin6_addr.s6_addr;
4152 }
4153
4154 if (snum) {
4155 int low, high;
4156
4157 inet_get_local_port_range(sock_net(sk), &low, &high);
4158
4159 if (snum < max(PROT_SOCK, low) || snum > high) {
4160 err = sel_netport_sid(sk->sk_protocol,
4161 snum, &sid);
4162 if (err)
4163 goto out;
4164 ad.type = LSM_AUDIT_DATA_NET;
4165 ad.u.net = &net;
4166 ad.u.net->sport = htons(snum);
4167 ad.u.net->family = family;
4168 err = avc_has_perm(sksec->sid, sid,
4169 sksec->sclass,
4170 SOCKET__NAME_BIND, &ad);
4171 if (err)
4172 goto out;
4173 }
4174 }
4175
4176 switch (sksec->sclass) {
4177 case SECCLASS_TCP_SOCKET:
4178 node_perm = TCP_SOCKET__NODE_BIND;
4179 break;
4180
4181 case SECCLASS_UDP_SOCKET:
4182 node_perm = UDP_SOCKET__NODE_BIND;
4183 break;
4184
4185 case SECCLASS_DCCP_SOCKET:
4186 node_perm = DCCP_SOCKET__NODE_BIND;
4187 break;
4188
4189 default:
4190 node_perm = RAWIP_SOCKET__NODE_BIND;
4191 break;
4192 }
4193
4194 err = sel_netnode_sid(addrp, family, &sid);
4195 if (err)
4196 goto out;
4197
4198 ad.type = LSM_AUDIT_DATA_NET;
4199 ad.u.net = &net;
4200 ad.u.net->sport = htons(snum);
4201 ad.u.net->family = family;
4202
4203 if (family == PF_INET)
4204 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4205 else
4206 ad.u.net->v6info.saddr = addr6->sin6_addr;
4207
4208 err = avc_has_perm(sksec->sid, sid,
4209 sksec->sclass, node_perm, &ad);
4210 if (err)
4211 goto out;
4212 }
4213 out:
4214 return err;
4215 }
4216
4217 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4218 {
4219 struct sock *sk = sock->sk;
4220 struct sk_security_struct *sksec = sk->sk_security;
4221 int err;
4222
4223 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4224 if (err)
4225 return err;
4226
4227 /*
4228 * If a TCP or DCCP socket, check name_connect permission for the port.
4229 */
4230 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4231 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4232 struct common_audit_data ad;
4233 struct lsm_network_audit net = {0,};
4234 struct sockaddr_in *addr4 = NULL;
4235 struct sockaddr_in6 *addr6 = NULL;
4236 unsigned short snum;
4237 u32 sid, perm;
4238
4239 if (sk->sk_family == PF_INET) {
4240 addr4 = (struct sockaddr_in *)address;
4241 if (addrlen < sizeof(struct sockaddr_in))
4242 return -EINVAL;
4243 snum = ntohs(addr4->sin_port);
4244 } else {
4245 addr6 = (struct sockaddr_in6 *)address;
4246 if (addrlen < SIN6_LEN_RFC2133)
4247 return -EINVAL;
4248 snum = ntohs(addr6->sin6_port);
4249 }
4250
4251 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4252 if (err)
4253 goto out;
4254
4255 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4256 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4257
4258 ad.type = LSM_AUDIT_DATA_NET;
4259 ad.u.net = &net;
4260 ad.u.net->dport = htons(snum);
4261 ad.u.net->family = sk->sk_family;
4262 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4263 if (err)
4264 goto out;
4265 }
4266
4267 err = selinux_netlbl_socket_connect(sk, address);
4268
4269 out:
4270 return err;
4271 }
4272
4273 static int selinux_socket_listen(struct socket *sock, int backlog)
4274 {
4275 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4276 }
4277
4278 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4279 {
4280 int err;
4281 struct inode_security_struct *isec;
4282 struct inode_security_struct *newisec;
4283
4284 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4285 if (err)
4286 return err;
4287
4288 newisec = SOCK_INODE(newsock)->i_security;
4289
4290 isec = SOCK_INODE(sock)->i_security;
4291 newisec->sclass = isec->sclass;
4292 newisec->sid = isec->sid;
4293 newisec->initialized = 1;
4294
4295 return 0;
4296 }
4297
4298 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4299 int size)
4300 {
4301 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4302 }
4303
4304 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4305 int size, int flags)
4306 {
4307 return sock_has_perm(current, sock->sk, SOCKET__READ);
4308 }
4309
4310 static int selinux_socket_getsockname(struct socket *sock)
4311 {
4312 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4313 }
4314
4315 static int selinux_socket_getpeername(struct socket *sock)
4316 {
4317 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4318 }
4319
4320 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4321 {
4322 int err;
4323
4324 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4325 if (err)
4326 return err;
4327
4328 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4329 }
4330
4331 static int selinux_socket_getsockopt(struct socket *sock, int level,
4332 int optname)
4333 {
4334 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4335 }
4336
4337 static int selinux_socket_shutdown(struct socket *sock, int how)
4338 {
4339 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4340 }
4341
4342 static int selinux_socket_unix_stream_connect(struct sock *sock,
4343 struct sock *other,
4344 struct sock *newsk)
4345 {
4346 struct sk_security_struct *sksec_sock = sock->sk_security;
4347 struct sk_security_struct *sksec_other = other->sk_security;
4348 struct sk_security_struct *sksec_new = newsk->sk_security;
4349 struct common_audit_data ad;
4350 struct lsm_network_audit net = {0,};
4351 int err;
4352
4353 ad.type = LSM_AUDIT_DATA_NET;
4354 ad.u.net = &net;
4355 ad.u.net->sk = other;
4356
4357 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4358 sksec_other->sclass,
4359 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4360 if (err)
4361 return err;
4362
4363 /* server child socket */
4364 sksec_new->peer_sid = sksec_sock->sid;
4365 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4366 &sksec_new->sid);
4367 if (err)
4368 return err;
4369
4370 /* connecting socket */
4371 sksec_sock->peer_sid = sksec_new->sid;
4372
4373 return 0;
4374 }
4375
4376 static int selinux_socket_unix_may_send(struct socket *sock,
4377 struct socket *other)
4378 {
4379 struct sk_security_struct *ssec = sock->sk->sk_security;
4380 struct sk_security_struct *osec = other->sk->sk_security;
4381 struct common_audit_data ad;
4382 struct lsm_network_audit net = {0,};
4383
4384 ad.type = LSM_AUDIT_DATA_NET;
4385 ad.u.net = &net;
4386 ad.u.net->sk = other->sk;
4387
4388 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4389 &ad);
4390 }
4391
4392 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4393 char *addrp, u16 family, u32 peer_sid,
4394 struct common_audit_data *ad)
4395 {
4396 int err;
4397 u32 if_sid;
4398 u32 node_sid;
4399
4400 err = sel_netif_sid(ns, ifindex, &if_sid);
4401 if (err)
4402 return err;
4403 err = avc_has_perm(peer_sid, if_sid,
4404 SECCLASS_NETIF, NETIF__INGRESS, ad);
4405 if (err)
4406 return err;
4407
4408 err = sel_netnode_sid(addrp, family, &node_sid);
4409 if (err)
4410 return err;
4411 return avc_has_perm(peer_sid, node_sid,
4412 SECCLASS_NODE, NODE__RECVFROM, ad);
4413 }
4414
4415 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4416 u16 family)
4417 {
4418 int err = 0;
4419 struct sk_security_struct *sksec = sk->sk_security;
4420 u32 sk_sid = sksec->sid;
4421 struct common_audit_data ad;
4422 struct lsm_network_audit net = {0,};
4423 char *addrp;
4424
4425 ad.type = LSM_AUDIT_DATA_NET;
4426 ad.u.net = &net;
4427 ad.u.net->netif = skb->skb_iif;
4428 ad.u.net->family = family;
4429 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4430 if (err)
4431 return err;
4432
4433 if (selinux_secmark_enabled()) {
4434 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4435 PACKET__RECV, &ad);
4436 if (err)
4437 return err;
4438 }
4439
4440 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4441 if (err)
4442 return err;
4443 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4444
4445 return err;
4446 }
4447
4448 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4449 {
4450 int err;
4451 struct sk_security_struct *sksec = sk->sk_security;
4452 u16 family = sk->sk_family;
4453 u32 sk_sid = sksec->sid;
4454 struct common_audit_data ad;
4455 struct lsm_network_audit net = {0,};
4456 char *addrp;
4457 u8 secmark_active;
4458 u8 peerlbl_active;
4459
4460 if (family != PF_INET && family != PF_INET6)
4461 return 0;
4462
4463 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4464 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4465 family = PF_INET;
4466
4467 /* If any sort of compatibility mode is enabled then handoff processing
4468 * to the selinux_sock_rcv_skb_compat() function to deal with the
4469 * special handling. We do this in an attempt to keep this function
4470 * as fast and as clean as possible. */
4471 if (!selinux_policycap_netpeer)
4472 return selinux_sock_rcv_skb_compat(sk, skb, family);
4473
4474 secmark_active = selinux_secmark_enabled();
4475 peerlbl_active = selinux_peerlbl_enabled();
4476 if (!secmark_active && !peerlbl_active)
4477 return 0;
4478
4479 ad.type = LSM_AUDIT_DATA_NET;
4480 ad.u.net = &net;
4481 ad.u.net->netif = skb->skb_iif;
4482 ad.u.net->family = family;
4483 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4484 if (err)
4485 return err;
4486
4487 if (peerlbl_active) {
4488 u32 peer_sid;
4489
4490 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4491 if (err)
4492 return err;
4493 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4494 addrp, family, peer_sid, &ad);
4495 if (err) {
4496 selinux_netlbl_err(skb, err, 0);
4497 return err;
4498 }
4499 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4500 PEER__RECV, &ad);
4501 if (err) {
4502 selinux_netlbl_err(skb, err, 0);
4503 return err;
4504 }
4505 }
4506
4507 if (secmark_active) {
4508 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4509 PACKET__RECV, &ad);
4510 if (err)
4511 return err;
4512 }
4513
4514 return err;
4515 }
4516
4517 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4518 int __user *optlen, unsigned len)
4519 {
4520 int err = 0;
4521 char *scontext;
4522 u32 scontext_len;
4523 struct sk_security_struct *sksec = sock->sk->sk_security;
4524 u32 peer_sid = SECSID_NULL;
4525
4526 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4527 sksec->sclass == SECCLASS_TCP_SOCKET)
4528 peer_sid = sksec->peer_sid;
4529 if (peer_sid == SECSID_NULL)
4530 return -ENOPROTOOPT;
4531
4532 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4533 if (err)
4534 return err;
4535
4536 if (scontext_len > len) {
4537 err = -ERANGE;
4538 goto out_len;
4539 }
4540
4541 if (copy_to_user(optval, scontext, scontext_len))
4542 err = -EFAULT;
4543
4544 out_len:
4545 if (put_user(scontext_len, optlen))
4546 err = -EFAULT;
4547 kfree(scontext);
4548 return err;
4549 }
4550
4551 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4552 {
4553 u32 peer_secid = SECSID_NULL;
4554 u16 family;
4555
4556 if (skb && skb->protocol == htons(ETH_P_IP))
4557 family = PF_INET;
4558 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4559 family = PF_INET6;
4560 else if (sock)
4561 family = sock->sk->sk_family;
4562 else
4563 goto out;
4564
4565 if (sock && family == PF_UNIX)
4566 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4567 else if (skb)
4568 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4569
4570 out:
4571 *secid = peer_secid;
4572 if (peer_secid == SECSID_NULL)
4573 return -EINVAL;
4574 return 0;
4575 }
4576
4577 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4578 {
4579 struct sk_security_struct *sksec;
4580
4581 sksec = kzalloc(sizeof(*sksec), priority);
4582 if (!sksec)
4583 return -ENOMEM;
4584
4585 sksec->peer_sid = SECINITSID_UNLABELED;
4586 sksec->sid = SECINITSID_UNLABELED;
4587 sksec->sclass = SECCLASS_SOCKET;
4588 selinux_netlbl_sk_security_reset(sksec);
4589 sk->sk_security = sksec;
4590
4591 return 0;
4592 }
4593
4594 static void selinux_sk_free_security(struct sock *sk)
4595 {
4596 struct sk_security_struct *sksec = sk->sk_security;
4597
4598 sk->sk_security = NULL;
4599 selinux_netlbl_sk_security_free(sksec);
4600 kfree(sksec);
4601 }
4602
4603 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4604 {
4605 struct sk_security_struct *sksec = sk->sk_security;
4606 struct sk_security_struct *newsksec = newsk->sk_security;
4607
4608 newsksec->sid = sksec->sid;
4609 newsksec->peer_sid = sksec->peer_sid;
4610 newsksec->sclass = sksec->sclass;
4611
4612 selinux_netlbl_sk_security_reset(newsksec);
4613 }
4614
4615 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4616 {
4617 if (!sk)
4618 *secid = SECINITSID_ANY_SOCKET;
4619 else {
4620 struct sk_security_struct *sksec = sk->sk_security;
4621
4622 *secid = sksec->sid;
4623 }
4624 }
4625
4626 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4627 {
4628 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4629 struct sk_security_struct *sksec = sk->sk_security;
4630
4631 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4632 sk->sk_family == PF_UNIX)
4633 isec->sid = sksec->sid;
4634 sksec->sclass = isec->sclass;
4635 }
4636
4637 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4638 struct request_sock *req)
4639 {
4640 struct sk_security_struct *sksec = sk->sk_security;
4641 int err;
4642 u16 family = req->rsk_ops->family;
4643 u32 connsid;
4644 u32 peersid;
4645
4646 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4647 if (err)
4648 return err;
4649 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4650 if (err)
4651 return err;
4652 req->secid = connsid;
4653 req->peer_secid = peersid;
4654
4655 return selinux_netlbl_inet_conn_request(req, family);
4656 }
4657
4658 static void selinux_inet_csk_clone(struct sock *newsk,
4659 const struct request_sock *req)
4660 {
4661 struct sk_security_struct *newsksec = newsk->sk_security;
4662
4663 newsksec->sid = req->secid;
4664 newsksec->peer_sid = req->peer_secid;
4665 /* NOTE: Ideally, we should also get the isec->sid for the
4666 new socket in sync, but we don't have the isec available yet.
4667 So we will wait until sock_graft to do it, by which
4668 time it will have been created and available. */
4669
4670 /* We don't need to take any sort of lock here as we are the only
4671 * thread with access to newsksec */
4672 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4673 }
4674
4675 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4676 {
4677 u16 family = sk->sk_family;
4678 struct sk_security_struct *sksec = sk->sk_security;
4679
4680 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4681 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4682 family = PF_INET;
4683
4684 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4685 }
4686
4687 static int selinux_secmark_relabel_packet(u32 sid)
4688 {
4689 const struct task_security_struct *__tsec;
4690 u32 tsid;
4691
4692 __tsec = current_security();
4693 tsid = __tsec->sid;
4694
4695 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4696 }
4697
4698 static void selinux_secmark_refcount_inc(void)
4699 {
4700 atomic_inc(&selinux_secmark_refcount);
4701 }
4702
4703 static void selinux_secmark_refcount_dec(void)
4704 {
4705 atomic_dec(&selinux_secmark_refcount);
4706 }
4707
4708 static void selinux_req_classify_flow(const struct request_sock *req,
4709 struct flowi *fl)
4710 {
4711 fl->flowi_secid = req->secid;
4712 }
4713
4714 static int selinux_tun_dev_alloc_security(void **security)
4715 {
4716 struct tun_security_struct *tunsec;
4717
4718 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4719 if (!tunsec)
4720 return -ENOMEM;
4721 tunsec->sid = current_sid();
4722
4723 *security = tunsec;
4724 return 0;
4725 }
4726
4727 static void selinux_tun_dev_free_security(void *security)
4728 {
4729 kfree(security);
4730 }
4731
4732 static int selinux_tun_dev_create(void)
4733 {
4734 u32 sid = current_sid();
4735
4736 /* we aren't taking into account the "sockcreate" SID since the socket
4737 * that is being created here is not a socket in the traditional sense,
4738 * instead it is a private sock, accessible only to the kernel, and
4739 * representing a wide range of network traffic spanning multiple
4740 * connections unlike traditional sockets - check the TUN driver to
4741 * get a better understanding of why this socket is special */
4742
4743 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4744 NULL);
4745 }
4746
4747 static int selinux_tun_dev_attach_queue(void *security)
4748 {
4749 struct tun_security_struct *tunsec = security;
4750
4751 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4752 TUN_SOCKET__ATTACH_QUEUE, NULL);
4753 }
4754
4755 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4756 {
4757 struct tun_security_struct *tunsec = security;
4758 struct sk_security_struct *sksec = sk->sk_security;
4759
4760 /* we don't currently perform any NetLabel based labeling here and it
4761 * isn't clear that we would want to do so anyway; while we could apply
4762 * labeling without the support of the TUN user the resulting labeled
4763 * traffic from the other end of the connection would almost certainly
4764 * cause confusion to the TUN user that had no idea network labeling
4765 * protocols were being used */
4766
4767 sksec->sid = tunsec->sid;
4768 sksec->sclass = SECCLASS_TUN_SOCKET;
4769
4770 return 0;
4771 }
4772
4773 static int selinux_tun_dev_open(void *security)
4774 {
4775 struct tun_security_struct *tunsec = security;
4776 u32 sid = current_sid();
4777 int err;
4778
4779 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4780 TUN_SOCKET__RELABELFROM, NULL);
4781 if (err)
4782 return err;
4783 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4784 TUN_SOCKET__RELABELTO, NULL);
4785 if (err)
4786 return err;
4787 tunsec->sid = sid;
4788
4789 return 0;
4790 }
4791
4792 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4793 {
4794 int err = 0;
4795 u32 perm;
4796 struct nlmsghdr *nlh;
4797 struct sk_security_struct *sksec = sk->sk_security;
4798
4799 if (skb->len < NLMSG_HDRLEN) {
4800 err = -EINVAL;
4801 goto out;
4802 }
4803 nlh = nlmsg_hdr(skb);
4804
4805 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4806 if (err) {
4807 if (err == -EINVAL) {
4808 printk(KERN_WARNING
4809 "SELinux: unrecognized netlink message:"
4810 " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4811 sk->sk_protocol, nlh->nlmsg_type,
4812 secclass_map[sksec->sclass - 1].name);
4813 if (!selinux_enforcing || security_get_allow_unknown())
4814 err = 0;
4815 }
4816
4817 /* Ignore */
4818 if (err == -ENOENT)
4819 err = 0;
4820 goto out;
4821 }
4822
4823 err = sock_has_perm(current, sk, perm);
4824 out:
4825 return err;
4826 }
4827
4828 #ifdef CONFIG_NETFILTER
4829
4830 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4831 const struct net_device *indev,
4832 u16 family)
4833 {
4834 int err;
4835 char *addrp;
4836 u32 peer_sid;
4837 struct common_audit_data ad;
4838 struct lsm_network_audit net = {0,};
4839 u8 secmark_active;
4840 u8 netlbl_active;
4841 u8 peerlbl_active;
4842
4843 if (!selinux_policycap_netpeer)
4844 return NF_ACCEPT;
4845
4846 secmark_active = selinux_secmark_enabled();
4847 netlbl_active = netlbl_enabled();
4848 peerlbl_active = selinux_peerlbl_enabled();
4849 if (!secmark_active && !peerlbl_active)
4850 return NF_ACCEPT;
4851
4852 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4853 return NF_DROP;
4854
4855 ad.type = LSM_AUDIT_DATA_NET;
4856 ad.u.net = &net;
4857 ad.u.net->netif = indev->ifindex;
4858 ad.u.net->family = family;
4859 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4860 return NF_DROP;
4861
4862 if (peerlbl_active) {
4863 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4864 addrp, family, peer_sid, &ad);
4865 if (err) {
4866 selinux_netlbl_err(skb, err, 1);
4867 return NF_DROP;
4868 }
4869 }
4870
4871 if (secmark_active)
4872 if (avc_has_perm(peer_sid, skb->secmark,
4873 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4874 return NF_DROP;
4875
4876 if (netlbl_active)
4877 /* we do this in the FORWARD path and not the POST_ROUTING
4878 * path because we want to make sure we apply the necessary
4879 * labeling before IPsec is applied so we can leverage AH
4880 * protection */
4881 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4882 return NF_DROP;
4883
4884 return NF_ACCEPT;
4885 }
4886
4887 static unsigned int selinux_ipv4_forward(void *priv,
4888 struct sk_buff *skb,
4889 const struct nf_hook_state *state)
4890 {
4891 return selinux_ip_forward(skb, state->in, PF_INET);
4892 }
4893
4894 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4895 static unsigned int selinux_ipv6_forward(void *priv,
4896 struct sk_buff *skb,
4897 const struct nf_hook_state *state)
4898 {
4899 return selinux_ip_forward(skb, state->in, PF_INET6);
4900 }
4901 #endif /* IPV6 */
4902
4903 static unsigned int selinux_ip_output(struct sk_buff *skb,
4904 u16 family)
4905 {
4906 struct sock *sk;
4907 u32 sid;
4908
4909 if (!netlbl_enabled())
4910 return NF_ACCEPT;
4911
4912 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4913 * because we want to make sure we apply the necessary labeling
4914 * before IPsec is applied so we can leverage AH protection */
4915 sk = skb->sk;
4916 if (sk) {
4917 struct sk_security_struct *sksec;
4918
4919 if (sk_listener(sk))
4920 /* if the socket is the listening state then this
4921 * packet is a SYN-ACK packet which means it needs to
4922 * be labeled based on the connection/request_sock and
4923 * not the parent socket. unfortunately, we can't
4924 * lookup the request_sock yet as it isn't queued on
4925 * the parent socket until after the SYN-ACK is sent.
4926 * the "solution" is to simply pass the packet as-is
4927 * as any IP option based labeling should be copied
4928 * from the initial connection request (in the IP
4929 * layer). it is far from ideal, but until we get a
4930 * security label in the packet itself this is the
4931 * best we can do. */
4932 return NF_ACCEPT;
4933
4934 /* standard practice, label using the parent socket */
4935 sksec = sk->sk_security;
4936 sid = sksec->sid;
4937 } else
4938 sid = SECINITSID_KERNEL;
4939 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4940 return NF_DROP;
4941
4942 return NF_ACCEPT;
4943 }
4944
4945 static unsigned int selinux_ipv4_output(void *priv,
4946 struct sk_buff *skb,
4947 const struct nf_hook_state *state)
4948 {
4949 return selinux_ip_output(skb, PF_INET);
4950 }
4951
4952 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4953 int ifindex,
4954 u16 family)
4955 {
4956 struct sock *sk = skb_to_full_sk(skb);
4957 struct sk_security_struct *sksec;
4958 struct common_audit_data ad;
4959 struct lsm_network_audit net = {0,};
4960 char *addrp;
4961 u8 proto;
4962
4963 if (sk == NULL)
4964 return NF_ACCEPT;
4965 sksec = sk->sk_security;
4966
4967 ad.type = LSM_AUDIT_DATA_NET;
4968 ad.u.net = &net;
4969 ad.u.net->netif = ifindex;
4970 ad.u.net->family = family;
4971 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4972 return NF_DROP;
4973
4974 if (selinux_secmark_enabled())
4975 if (avc_has_perm(sksec->sid, skb->secmark,
4976 SECCLASS_PACKET, PACKET__SEND, &ad))
4977 return NF_DROP_ERR(-ECONNREFUSED);
4978
4979 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4980 return NF_DROP_ERR(-ECONNREFUSED);
4981
4982 return NF_ACCEPT;
4983 }
4984
4985 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4986 const struct net_device *outdev,
4987 u16 family)
4988 {
4989 u32 secmark_perm;
4990 u32 peer_sid;
4991 int ifindex = outdev->ifindex;
4992 struct sock *sk;
4993 struct common_audit_data ad;
4994 struct lsm_network_audit net = {0,};
4995 char *addrp;
4996 u8 secmark_active;
4997 u8 peerlbl_active;
4998
4999 /* If any sort of compatibility mode is enabled then handoff processing
5000 * to the selinux_ip_postroute_compat() function to deal with the
5001 * special handling. We do this in an attempt to keep this function
5002 * as fast and as clean as possible. */
5003 if (!selinux_policycap_netpeer)
5004 return selinux_ip_postroute_compat(skb, ifindex, family);
5005
5006 secmark_active = selinux_secmark_enabled();
5007 peerlbl_active = selinux_peerlbl_enabled();
5008 if (!secmark_active && !peerlbl_active)
5009 return NF_ACCEPT;
5010
5011 sk = skb_to_full_sk(skb);
5012
5013 #ifdef CONFIG_XFRM
5014 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5015 * packet transformation so allow the packet to pass without any checks
5016 * since we'll have another chance to perform access control checks
5017 * when the packet is on it's final way out.
5018 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5019 * is NULL, in this case go ahead and apply access control.
5020 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5021 * TCP listening state we cannot wait until the XFRM processing
5022 * is done as we will miss out on the SA label if we do;
5023 * unfortunately, this means more work, but it is only once per
5024 * connection. */
5025 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5026 !(sk && sk_listener(sk)))
5027 return NF_ACCEPT;
5028 #endif
5029
5030 if (sk == NULL) {
5031 /* Without an associated socket the packet is either coming
5032 * from the kernel or it is being forwarded; check the packet
5033 * to determine which and if the packet is being forwarded
5034 * query the packet directly to determine the security label. */
5035 if (skb->skb_iif) {
5036 secmark_perm = PACKET__FORWARD_OUT;
5037 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5038 return NF_DROP;
5039 } else {
5040 secmark_perm = PACKET__SEND;
5041 peer_sid = SECINITSID_KERNEL;
5042 }
5043 } else if (sk_listener(sk)) {
5044 /* Locally generated packet but the associated socket is in the
5045 * listening state which means this is a SYN-ACK packet. In
5046 * this particular case the correct security label is assigned
5047 * to the connection/request_sock but unfortunately we can't
5048 * query the request_sock as it isn't queued on the parent
5049 * socket until after the SYN-ACK packet is sent; the only
5050 * viable choice is to regenerate the label like we do in
5051 * selinux_inet_conn_request(). See also selinux_ip_output()
5052 * for similar problems. */
5053 u32 skb_sid;
5054 struct sk_security_struct *sksec;
5055
5056 sksec = sk->sk_security;
5057 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5058 return NF_DROP;
5059 /* At this point, if the returned skb peerlbl is SECSID_NULL
5060 * and the packet has been through at least one XFRM
5061 * transformation then we must be dealing with the "final"
5062 * form of labeled IPsec packet; since we've already applied
5063 * all of our access controls on this packet we can safely
5064 * pass the packet. */
5065 if (skb_sid == SECSID_NULL) {
5066 switch (family) {
5067 case PF_INET:
5068 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5069 return NF_ACCEPT;
5070 break;
5071 case PF_INET6:
5072 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5073 return NF_ACCEPT;
5074 break;
5075 default:
5076 return NF_DROP_ERR(-ECONNREFUSED);
5077 }
5078 }
5079 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5080 return NF_DROP;
5081 secmark_perm = PACKET__SEND;
5082 } else {
5083 /* Locally generated packet, fetch the security label from the
5084 * associated socket. */
5085 struct sk_security_struct *sksec = sk->sk_security;
5086 peer_sid = sksec->sid;
5087 secmark_perm = PACKET__SEND;
5088 }
5089
5090 ad.type = LSM_AUDIT_DATA_NET;
5091 ad.u.net = &net;
5092 ad.u.net->netif = ifindex;
5093 ad.u.net->family = family;
5094 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5095 return NF_DROP;
5096
5097 if (secmark_active)
5098 if (avc_has_perm(peer_sid, skb->secmark,
5099 SECCLASS_PACKET, secmark_perm, &ad))
5100 return NF_DROP_ERR(-ECONNREFUSED);
5101
5102 if (peerlbl_active) {
5103 u32 if_sid;
5104 u32 node_sid;
5105
5106 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5107 return NF_DROP;
5108 if (avc_has_perm(peer_sid, if_sid,
5109 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5110 return NF_DROP_ERR(-ECONNREFUSED);
5111
5112 if (sel_netnode_sid(addrp, family, &node_sid))
5113 return NF_DROP;
5114 if (avc_has_perm(peer_sid, node_sid,
5115 SECCLASS_NODE, NODE__SENDTO, &ad))
5116 return NF_DROP_ERR(-ECONNREFUSED);
5117 }
5118
5119 return NF_ACCEPT;
5120 }
5121
5122 static unsigned int selinux_ipv4_postroute(void *priv,
5123 struct sk_buff *skb,
5124 const struct nf_hook_state *state)
5125 {
5126 return selinux_ip_postroute(skb, state->out, PF_INET);
5127 }
5128
5129 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5130 static unsigned int selinux_ipv6_postroute(void *priv,
5131 struct sk_buff *skb,
5132 const struct nf_hook_state *state)
5133 {
5134 return selinux_ip_postroute(skb, state->out, PF_INET6);
5135 }
5136 #endif /* IPV6 */
5137
5138 #endif /* CONFIG_NETFILTER */
5139
5140 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5141 {
5142 return selinux_nlmsg_perm(sk, skb);
5143 }
5144
5145 static int ipc_alloc_security(struct task_struct *task,
5146 struct kern_ipc_perm *perm,
5147 u16 sclass)
5148 {
5149 struct ipc_security_struct *isec;
5150 u32 sid;
5151
5152 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5153 if (!isec)
5154 return -ENOMEM;
5155
5156 sid = task_sid(task);
5157 isec->sclass = sclass;
5158 isec->sid = sid;
5159 perm->security = isec;
5160
5161 return 0;
5162 }
5163
5164 static void ipc_free_security(struct kern_ipc_perm *perm)
5165 {
5166 struct ipc_security_struct *isec = perm->security;
5167 perm->security = NULL;
5168 kfree(isec);
5169 }
5170
5171 static int msg_msg_alloc_security(struct msg_msg *msg)
5172 {
5173 struct msg_security_struct *msec;
5174
5175 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5176 if (!msec)
5177 return -ENOMEM;
5178
5179 msec->sid = SECINITSID_UNLABELED;
5180 msg->security = msec;
5181
5182 return 0;
5183 }
5184
5185 static void msg_msg_free_security(struct msg_msg *msg)
5186 {
5187 struct msg_security_struct *msec = msg->security;
5188
5189 msg->security = NULL;
5190 kfree(msec);
5191 }
5192
5193 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5194 u32 perms)
5195 {
5196 struct ipc_security_struct *isec;
5197 struct common_audit_data ad;
5198 u32 sid = current_sid();
5199
5200 isec = ipc_perms->security;
5201
5202 ad.type = LSM_AUDIT_DATA_IPC;
5203 ad.u.ipc_id = ipc_perms->key;
5204
5205 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5206 }
5207
5208 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5209 {
5210 return msg_msg_alloc_security(msg);
5211 }
5212
5213 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5214 {
5215 msg_msg_free_security(msg);
5216 }
5217
5218 /* message queue security operations */
5219 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5220 {
5221 struct ipc_security_struct *isec;
5222 struct common_audit_data ad;
5223 u32 sid = current_sid();
5224 int rc;
5225
5226 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5227 if (rc)
5228 return rc;
5229
5230 isec = msq->q_perm.security;
5231
5232 ad.type = LSM_AUDIT_DATA_IPC;
5233 ad.u.ipc_id = msq->q_perm.key;
5234
5235 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5236 MSGQ__CREATE, &ad);
5237 if (rc) {
5238 ipc_free_security(&msq->q_perm);
5239 return rc;
5240 }
5241 return 0;
5242 }
5243
5244 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5245 {
5246 ipc_free_security(&msq->q_perm);
5247 }
5248
5249 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5250 {
5251 struct ipc_security_struct *isec;
5252 struct common_audit_data ad;
5253 u32 sid = current_sid();
5254
5255 isec = msq->q_perm.security;
5256
5257 ad.type = LSM_AUDIT_DATA_IPC;
5258 ad.u.ipc_id = msq->q_perm.key;
5259
5260 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5261 MSGQ__ASSOCIATE, &ad);
5262 }
5263
5264 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5265 {
5266 int err;
5267 int perms;
5268
5269 switch (cmd) {
5270 case IPC_INFO:
5271 case MSG_INFO:
5272 /* No specific object, just general system-wide information. */
5273 return task_has_system(current, SYSTEM__IPC_INFO);
5274 case IPC_STAT:
5275 case MSG_STAT:
5276 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5277 break;
5278 case IPC_SET:
5279 perms = MSGQ__SETATTR;
5280 break;
5281 case IPC_RMID:
5282 perms = MSGQ__DESTROY;
5283 break;
5284 default:
5285 return 0;
5286 }
5287
5288 err = ipc_has_perm(&msq->q_perm, perms);
5289 return err;
5290 }
5291
5292 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5293 {
5294 struct ipc_security_struct *isec;
5295 struct msg_security_struct *msec;
5296 struct common_audit_data ad;
5297 u32 sid = current_sid();
5298 int rc;
5299
5300 isec = msq->q_perm.security;
5301 msec = msg->security;
5302
5303 /*
5304 * First time through, need to assign label to the message
5305 */
5306 if (msec->sid == SECINITSID_UNLABELED) {
5307 /*
5308 * Compute new sid based on current process and
5309 * message queue this message will be stored in
5310 */
5311 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5312 NULL, &msec->sid);
5313 if (rc)
5314 return rc;
5315 }
5316
5317 ad.type = LSM_AUDIT_DATA_IPC;
5318 ad.u.ipc_id = msq->q_perm.key;
5319
5320 /* Can this process write to the queue? */
5321 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5322 MSGQ__WRITE, &ad);
5323 if (!rc)
5324 /* Can this process send the message */
5325 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5326 MSG__SEND, &ad);
5327 if (!rc)
5328 /* Can the message be put in the queue? */
5329 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5330 MSGQ__ENQUEUE, &ad);
5331
5332 return rc;
5333 }
5334
5335 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5336 struct task_struct *target,
5337 long type, int mode)
5338 {
5339 struct ipc_security_struct *isec;
5340 struct msg_security_struct *msec;
5341 struct common_audit_data ad;
5342 u32 sid = task_sid(target);
5343 int rc;
5344
5345 isec = msq->q_perm.security;
5346 msec = msg->security;
5347
5348 ad.type = LSM_AUDIT_DATA_IPC;
5349 ad.u.ipc_id = msq->q_perm.key;
5350
5351 rc = avc_has_perm(sid, isec->sid,
5352 SECCLASS_MSGQ, MSGQ__READ, &ad);
5353 if (!rc)
5354 rc = avc_has_perm(sid, msec->sid,
5355 SECCLASS_MSG, MSG__RECEIVE, &ad);
5356 return rc;
5357 }
5358
5359 /* Shared Memory security operations */
5360 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5361 {
5362 struct ipc_security_struct *isec;
5363 struct common_audit_data ad;
5364 u32 sid = current_sid();
5365 int rc;
5366
5367 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5368 if (rc)
5369 return rc;
5370
5371 isec = shp->shm_perm.security;
5372
5373 ad.type = LSM_AUDIT_DATA_IPC;
5374 ad.u.ipc_id = shp->shm_perm.key;
5375
5376 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5377 SHM__CREATE, &ad);
5378 if (rc) {
5379 ipc_free_security(&shp->shm_perm);
5380 return rc;
5381 }
5382 return 0;
5383 }
5384
5385 static void selinux_shm_free_security(struct shmid_kernel *shp)
5386 {
5387 ipc_free_security(&shp->shm_perm);
5388 }
5389
5390 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5391 {
5392 struct ipc_security_struct *isec;
5393 struct common_audit_data ad;
5394 u32 sid = current_sid();
5395
5396 isec = shp->shm_perm.security;
5397
5398 ad.type = LSM_AUDIT_DATA_IPC;
5399 ad.u.ipc_id = shp->shm_perm.key;
5400
5401 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5402 SHM__ASSOCIATE, &ad);
5403 }
5404
5405 /* Note, at this point, shp is locked down */
5406 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5407 {
5408 int perms;
5409 int err;
5410
5411 switch (cmd) {
5412 case IPC_INFO:
5413 case SHM_INFO:
5414 /* No specific object, just general system-wide information. */
5415 return task_has_system(current, SYSTEM__IPC_INFO);
5416 case IPC_STAT:
5417 case SHM_STAT:
5418 perms = SHM__GETATTR | SHM__ASSOCIATE;
5419 break;
5420 case IPC_SET:
5421 perms = SHM__SETATTR;
5422 break;
5423 case SHM_LOCK:
5424 case SHM_UNLOCK:
5425 perms = SHM__LOCK;
5426 break;
5427 case IPC_RMID:
5428 perms = SHM__DESTROY;
5429 break;
5430 default:
5431 return 0;
5432 }
5433
5434 err = ipc_has_perm(&shp->shm_perm, perms);
5435 return err;
5436 }
5437
5438 static int selinux_shm_shmat(struct shmid_kernel *shp,
5439 char __user *shmaddr, int shmflg)
5440 {
5441 u32 perms;
5442
5443 if (shmflg & SHM_RDONLY)
5444 perms = SHM__READ;
5445 else
5446 perms = SHM__READ | SHM__WRITE;
5447
5448 return ipc_has_perm(&shp->shm_perm, perms);
5449 }
5450
5451 /* Semaphore security operations */
5452 static int selinux_sem_alloc_security(struct sem_array *sma)
5453 {
5454 struct ipc_security_struct *isec;
5455 struct common_audit_data ad;
5456 u32 sid = current_sid();
5457 int rc;
5458
5459 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5460 if (rc)
5461 return rc;
5462
5463 isec = sma->sem_perm.security;
5464
5465 ad.type = LSM_AUDIT_DATA_IPC;
5466 ad.u.ipc_id = sma->sem_perm.key;
5467
5468 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5469 SEM__CREATE, &ad);
5470 if (rc) {
5471 ipc_free_security(&sma->sem_perm);
5472 return rc;
5473 }
5474 return 0;
5475 }
5476
5477 static void selinux_sem_free_security(struct sem_array *sma)
5478 {
5479 ipc_free_security(&sma->sem_perm);
5480 }
5481
5482 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5483 {
5484 struct ipc_security_struct *isec;
5485 struct common_audit_data ad;
5486 u32 sid = current_sid();
5487
5488 isec = sma->sem_perm.security;
5489
5490 ad.type = LSM_AUDIT_DATA_IPC;
5491 ad.u.ipc_id = sma->sem_perm.key;
5492
5493 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5494 SEM__ASSOCIATE, &ad);
5495 }
5496
5497 /* Note, at this point, sma is locked down */
5498 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5499 {
5500 int err;
5501 u32 perms;
5502
5503 switch (cmd) {
5504 case IPC_INFO:
5505 case SEM_INFO:
5506 /* No specific object, just general system-wide information. */
5507 return task_has_system(current, SYSTEM__IPC_INFO);
5508 case GETPID:
5509 case GETNCNT:
5510 case GETZCNT:
5511 perms = SEM__GETATTR;
5512 break;
5513 case GETVAL:
5514 case GETALL:
5515 perms = SEM__READ;
5516 break;
5517 case SETVAL:
5518 case SETALL:
5519 perms = SEM__WRITE;
5520 break;
5521 case IPC_RMID:
5522 perms = SEM__DESTROY;
5523 break;
5524 case IPC_SET:
5525 perms = SEM__SETATTR;
5526 break;
5527 case IPC_STAT:
5528 case SEM_STAT:
5529 perms = SEM__GETATTR | SEM__ASSOCIATE;
5530 break;
5531 default:
5532 return 0;
5533 }
5534
5535 err = ipc_has_perm(&sma->sem_perm, perms);
5536 return err;
5537 }
5538
5539 static int selinux_sem_semop(struct sem_array *sma,
5540 struct sembuf *sops, unsigned nsops, int alter)
5541 {
5542 u32 perms;
5543
5544 if (alter)
5545 perms = SEM__READ | SEM__WRITE;
5546 else
5547 perms = SEM__READ;
5548
5549 return ipc_has_perm(&sma->sem_perm, perms);
5550 }
5551
5552 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5553 {
5554 u32 av = 0;
5555
5556 av = 0;
5557 if (flag & S_IRUGO)
5558 av |= IPC__UNIX_READ;
5559 if (flag & S_IWUGO)
5560 av |= IPC__UNIX_WRITE;
5561
5562 if (av == 0)
5563 return 0;
5564
5565 return ipc_has_perm(ipcp, av);
5566 }
5567
5568 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5569 {
5570 struct ipc_security_struct *isec = ipcp->security;
5571 *secid = isec->sid;
5572 }
5573
5574 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5575 {
5576 if (inode)
5577 inode_doinit_with_dentry(inode, dentry);
5578 }
5579
5580 static int selinux_getprocattr(struct task_struct *p,
5581 char *name, char **value)
5582 {
5583 const struct task_security_struct *__tsec;
5584 u32 sid;
5585 int error;
5586 unsigned len;
5587
5588 if (current != p) {
5589 error = current_has_perm(p, PROCESS__GETATTR);
5590 if (error)
5591 return error;
5592 }
5593
5594 rcu_read_lock();
5595 __tsec = __task_cred(p)->security;
5596
5597 if (!strcmp(name, "current"))
5598 sid = __tsec->sid;
5599 else if (!strcmp(name, "prev"))
5600 sid = __tsec->osid;
5601 else if (!strcmp(name, "exec"))
5602 sid = __tsec->exec_sid;
5603 else if (!strcmp(name, "fscreate"))
5604 sid = __tsec->create_sid;
5605 else if (!strcmp(name, "keycreate"))
5606 sid = __tsec->keycreate_sid;
5607 else if (!strcmp(name, "sockcreate"))
5608 sid = __tsec->sockcreate_sid;
5609 else
5610 goto invalid;
5611 rcu_read_unlock();
5612
5613 if (!sid)
5614 return 0;
5615
5616 error = security_sid_to_context(sid, value, &len);
5617 if (error)
5618 return error;
5619 return len;
5620
5621 invalid:
5622 rcu_read_unlock();
5623 return -EINVAL;
5624 }
5625
5626 static int selinux_setprocattr(struct task_struct *p,
5627 char *name, void *value, size_t size)
5628 {
5629 struct task_security_struct *tsec;
5630 struct task_struct *tracer;
5631 struct cred *new;
5632 u32 sid = 0, ptsid;
5633 int error;
5634 char *str = value;
5635
5636 if (current != p) {
5637 /* SELinux only allows a process to change its own
5638 security attributes. */
5639 return -EACCES;
5640 }
5641
5642 /*
5643 * Basic control over ability to set these attributes at all.
5644 * current == p, but we'll pass them separately in case the
5645 * above restriction is ever removed.
5646 */
5647 if (!strcmp(name, "exec"))
5648 error = current_has_perm(p, PROCESS__SETEXEC);
5649 else if (!strcmp(name, "fscreate"))
5650 error = current_has_perm(p, PROCESS__SETFSCREATE);
5651 else if (!strcmp(name, "keycreate"))
5652 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5653 else if (!strcmp(name, "sockcreate"))
5654 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5655 else if (!strcmp(name, "current"))
5656 error = current_has_perm(p, PROCESS__SETCURRENT);
5657 else
5658 error = -EINVAL;
5659 if (error)
5660 return error;
5661
5662 /* Obtain a SID for the context, if one was specified. */
5663 if (size && str[0] && str[0] != '\n') {
5664 if (str[size-1] == '\n') {
5665 str[size-1] = 0;
5666 size--;
5667 }
5668 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5669 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5670 if (!capable(CAP_MAC_ADMIN)) {
5671 struct audit_buffer *ab;
5672 size_t audit_size;
5673
5674 /* We strip a nul only if it is at the end, otherwise the
5675 * context contains a nul and we should audit that */
5676 if (str[size - 1] == '\0')
5677 audit_size = size - 1;
5678 else
5679 audit_size = size;
5680 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5681 audit_log_format(ab, "op=fscreate invalid_context=");
5682 audit_log_n_untrustedstring(ab, value, audit_size);
5683 audit_log_end(ab);
5684
5685 return error;
5686 }
5687 error = security_context_to_sid_force(value, size,
5688 &sid);
5689 }
5690 if (error)
5691 return error;
5692 }
5693
5694 new = prepare_creds();
5695 if (!new)
5696 return -ENOMEM;
5697
5698 /* Permission checking based on the specified context is
5699 performed during the actual operation (execve,
5700 open/mkdir/...), when we know the full context of the
5701 operation. See selinux_bprm_set_creds for the execve
5702 checks and may_create for the file creation checks. The
5703 operation will then fail if the context is not permitted. */
5704 tsec = new->security;
5705 if (!strcmp(name, "exec")) {
5706 tsec->exec_sid = sid;
5707 } else if (!strcmp(name, "fscreate")) {
5708 tsec->create_sid = sid;
5709 } else if (!strcmp(name, "keycreate")) {
5710 error = may_create_key(sid, p);
5711 if (error)
5712 goto abort_change;
5713 tsec->keycreate_sid = sid;
5714 } else if (!strcmp(name, "sockcreate")) {
5715 tsec->sockcreate_sid = sid;
5716 } else if (!strcmp(name, "current")) {
5717 error = -EINVAL;
5718 if (sid == 0)
5719 goto abort_change;
5720
5721 /* Only allow single threaded processes to change context */
5722 error = -EPERM;
5723 if (!current_is_single_threaded()) {
5724 error = security_bounded_transition(tsec->sid, sid);
5725 if (error)
5726 goto abort_change;
5727 }
5728
5729 /* Check permissions for the transition. */
5730 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5731 PROCESS__DYNTRANSITION, NULL);
5732 if (error)
5733 goto abort_change;
5734
5735 /* Check for ptracing, and update the task SID if ok.
5736 Otherwise, leave SID unchanged and fail. */
5737 ptsid = 0;
5738 rcu_read_lock();
5739 tracer = ptrace_parent(p);
5740 if (tracer)
5741 ptsid = task_sid(tracer);
5742 rcu_read_unlock();
5743
5744 if (tracer) {
5745 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5746 PROCESS__PTRACE, NULL);
5747 if (error)
5748 goto abort_change;
5749 }
5750
5751 tsec->sid = sid;
5752 } else {
5753 error = -EINVAL;
5754 goto abort_change;
5755 }
5756
5757 commit_creds(new);
5758 return size;
5759
5760 abort_change:
5761 abort_creds(new);
5762 return error;
5763 }
5764
5765 static int selinux_ismaclabel(const char *name)
5766 {
5767 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5768 }
5769
5770 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5771 {
5772 return security_sid_to_context(secid, secdata, seclen);
5773 }
5774
5775 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5776 {
5777 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5778 }
5779
5780 static void selinux_release_secctx(char *secdata, u32 seclen)
5781 {
5782 kfree(secdata);
5783 }
5784
5785 /*
5786 * called with inode->i_mutex locked
5787 */
5788 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5789 {
5790 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5791 }
5792
5793 /*
5794 * called with inode->i_mutex locked
5795 */
5796 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5797 {
5798 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5799 }
5800
5801 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5802 {
5803 int len = 0;
5804 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5805 ctx, true);
5806 if (len < 0)
5807 return len;
5808 *ctxlen = len;
5809 return 0;
5810 }
5811 #ifdef CONFIG_KEYS
5812
5813 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5814 unsigned long flags)
5815 {
5816 const struct task_security_struct *tsec;
5817 struct key_security_struct *ksec;
5818
5819 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5820 if (!ksec)
5821 return -ENOMEM;
5822
5823 tsec = cred->security;
5824 if (tsec->keycreate_sid)
5825 ksec->sid = tsec->keycreate_sid;
5826 else
5827 ksec->sid = tsec->sid;
5828
5829 k->security = ksec;
5830 return 0;
5831 }
5832
5833 static void selinux_key_free(struct key *k)
5834 {
5835 struct key_security_struct *ksec = k->security;
5836
5837 k->security = NULL;
5838 kfree(ksec);
5839 }
5840
5841 static int selinux_key_permission(key_ref_t key_ref,
5842 const struct cred *cred,
5843 unsigned perm)
5844 {
5845 struct key *key;
5846 struct key_security_struct *ksec;
5847 u32 sid;
5848
5849 /* if no specific permissions are requested, we skip the
5850 permission check. No serious, additional covert channels
5851 appear to be created. */
5852 if (perm == 0)
5853 return 0;
5854
5855 sid = cred_sid(cred);
5856
5857 key = key_ref_to_ptr(key_ref);
5858 ksec = key->security;
5859
5860 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5861 }
5862
5863 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5864 {
5865 struct key_security_struct *ksec = key->security;
5866 char *context = NULL;
5867 unsigned len;
5868 int rc;
5869
5870 rc = security_sid_to_context(ksec->sid, &context, &len);
5871 if (!rc)
5872 rc = len;
5873 *_buffer = context;
5874 return rc;
5875 }
5876
5877 #endif
5878
5879 static struct security_hook_list selinux_hooks[] = {
5880 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5881 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5882 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5883 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5884
5885 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5886 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5887 LSM_HOOK_INIT(capget, selinux_capget),
5888 LSM_HOOK_INIT(capset, selinux_capset),
5889 LSM_HOOK_INIT(capable, selinux_capable),
5890 LSM_HOOK_INIT(quotactl, selinux_quotactl),
5891 LSM_HOOK_INIT(quota_on, selinux_quota_on),
5892 LSM_HOOK_INIT(syslog, selinux_syslog),
5893 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5894
5895 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5896
5897 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5898 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5899 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5900 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5901
5902 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5903 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5904 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5905 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5906 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5907 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5908 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5909 LSM_HOOK_INIT(sb_mount, selinux_mount),
5910 LSM_HOOK_INIT(sb_umount, selinux_umount),
5911 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5912 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5913 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5914
5915 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5916
5917 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5918 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5919 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5920 LSM_HOOK_INIT(inode_create, selinux_inode_create),
5921 LSM_HOOK_INIT(inode_link, selinux_inode_link),
5922 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5923 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5924 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5925 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5926 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5927 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5928 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5929 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5930 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5931 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5932 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5933 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5934 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5935 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5936 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5937 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5938 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5939 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5940 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5941 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5942
5943 LSM_HOOK_INIT(file_permission, selinux_file_permission),
5944 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5945 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5946 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5947 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5948 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5949 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5950 LSM_HOOK_INIT(file_lock, selinux_file_lock),
5951 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5952 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5953 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5954 LSM_HOOK_INIT(file_receive, selinux_file_receive),
5955
5956 LSM_HOOK_INIT(file_open, selinux_file_open),
5957
5958 LSM_HOOK_INIT(task_create, selinux_task_create),
5959 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5960 LSM_HOOK_INIT(cred_free, selinux_cred_free),
5961 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5962 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5963 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5964 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5965 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5966 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5967 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5968 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5969 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5970 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5971 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5972 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5973 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5974 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5975 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5976 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5977 LSM_HOOK_INIT(task_kill, selinux_task_kill),
5978 LSM_HOOK_INIT(task_wait, selinux_task_wait),
5979 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5980
5981 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5982 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5983
5984 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5985 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5986
5987 LSM_HOOK_INIT(msg_queue_alloc_security,
5988 selinux_msg_queue_alloc_security),
5989 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5990 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5991 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5992 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5993 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5994
5995 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5996 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5997 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5998 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5999 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6000
6001 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6002 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6003 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6004 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6005 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6006
6007 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6008
6009 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6010 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6011
6012 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6013 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6014 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6015 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6016 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6017 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6018 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6019
6020 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6021 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6022
6023 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6024 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6025 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6026 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6027 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6028 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6029 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6030 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6031 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6032 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6033 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6034 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6035 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6036 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6037 LSM_HOOK_INIT(socket_getpeersec_stream,
6038 selinux_socket_getpeersec_stream),
6039 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6040 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6041 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6042 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6043 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6044 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6045 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6046 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6047 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6048 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6049 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6050 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6051 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6052 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6053 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6054 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6055 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6056 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6057 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6058
6059 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6060 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6061 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6062 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6063 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6064 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6065 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6066 selinux_xfrm_state_alloc_acquire),
6067 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6068 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6069 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6070 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6071 selinux_xfrm_state_pol_flow_match),
6072 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6073 #endif
6074
6075 #ifdef CONFIG_KEYS
6076 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6077 LSM_HOOK_INIT(key_free, selinux_key_free),
6078 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6079 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6080 #endif
6081
6082 #ifdef CONFIG_AUDIT
6083 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6084 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6085 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6086 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6087 #endif
6088 };
6089
6090 static __init int selinux_init(void)
6091 {
6092 if (!security_module_enable("selinux")) {
6093 selinux_enabled = 0;
6094 return 0;
6095 }
6096
6097 if (!selinux_enabled) {
6098 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6099 return 0;
6100 }
6101
6102 printk(KERN_INFO "SELinux: Initializing.\n");
6103
6104 /* Set the security state for the initial task. */
6105 cred_init_security();
6106
6107 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6108
6109 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6110 sizeof(struct inode_security_struct),
6111 0, SLAB_PANIC, NULL);
6112 file_security_cache = kmem_cache_create("selinux_file_security",
6113 sizeof(struct file_security_struct),
6114 0, SLAB_PANIC, NULL);
6115 avc_init();
6116
6117 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6118
6119 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6120 panic("SELinux: Unable to register AVC netcache callback\n");
6121
6122 if (selinux_enforcing)
6123 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6124 else
6125 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6126
6127 return 0;
6128 }
6129
6130 static void delayed_superblock_init(struct super_block *sb, void *unused)
6131 {
6132 superblock_doinit(sb, NULL);
6133 }
6134
6135 void selinux_complete_init(void)
6136 {
6137 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6138
6139 /* Set up any superblocks initialized prior to the policy load. */
6140 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6141 iterate_supers(delayed_superblock_init, NULL);
6142 }
6143
6144 /* SELinux requires early initialization in order to label
6145 all processes and objects when they are created. */
6146 security_initcall(selinux_init);
6147
6148 #if defined(CONFIG_NETFILTER)
6149
6150 static struct nf_hook_ops selinux_nf_ops[] = {
6151 {
6152 .hook = selinux_ipv4_postroute,
6153 .pf = NFPROTO_IPV4,
6154 .hooknum = NF_INET_POST_ROUTING,
6155 .priority = NF_IP_PRI_SELINUX_LAST,
6156 },
6157 {
6158 .hook = selinux_ipv4_forward,
6159 .pf = NFPROTO_IPV4,
6160 .hooknum = NF_INET_FORWARD,
6161 .priority = NF_IP_PRI_SELINUX_FIRST,
6162 },
6163 {
6164 .hook = selinux_ipv4_output,
6165 .pf = NFPROTO_IPV4,
6166 .hooknum = NF_INET_LOCAL_OUT,
6167 .priority = NF_IP_PRI_SELINUX_FIRST,
6168 },
6169 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6170 {
6171 .hook = selinux_ipv6_postroute,
6172 .pf = NFPROTO_IPV6,
6173 .hooknum = NF_INET_POST_ROUTING,
6174 .priority = NF_IP6_PRI_SELINUX_LAST,
6175 },
6176 {
6177 .hook = selinux_ipv6_forward,
6178 .pf = NFPROTO_IPV6,
6179 .hooknum = NF_INET_FORWARD,
6180 .priority = NF_IP6_PRI_SELINUX_FIRST,
6181 },
6182 #endif /* IPV6 */
6183 };
6184
6185 static int __init selinux_nf_ip_init(void)
6186 {
6187 int err;
6188
6189 if (!selinux_enabled)
6190 return 0;
6191
6192 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6193
6194 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6195 if (err)
6196 panic("SELinux: nf_register_hooks: error %d\n", err);
6197
6198 return 0;
6199 }
6200
6201 __initcall(selinux_nf_ip_init);
6202
6203 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6204 static void selinux_nf_ip_exit(void)
6205 {
6206 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6207
6208 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6209 }
6210 #endif
6211
6212 #else /* CONFIG_NETFILTER */
6213
6214 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6215 #define selinux_nf_ip_exit()
6216 #endif
6217
6218 #endif /* CONFIG_NETFILTER */
6219
6220 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6221 static int selinux_disabled;
6222
6223 int selinux_disable(void)
6224 {
6225 if (ss_initialized) {
6226 /* Not permitted after initial policy load. */
6227 return -EINVAL;
6228 }
6229
6230 if (selinux_disabled) {
6231 /* Only do this once. */
6232 return -EINVAL;
6233 }
6234
6235 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6236
6237 selinux_disabled = 1;
6238 selinux_enabled = 0;
6239
6240 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6241
6242 /* Try to destroy the avc node cache */
6243 avc_disable();
6244
6245 /* Unregister netfilter hooks. */
6246 selinux_nf_ip_exit();
6247
6248 /* Unregister selinuxfs. */
6249 exit_sel_fs();
6250
6251 return 0;
6252 }
6253 #endif
Linux with added FPC-III support