?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
[linux/fpc-iii.git] / security / selinux / hooks.c
blob4b34847208cc9690284e9e7c7b6f9a960cfbead3
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 extern struct security_operations *security_ops;
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!strict_strtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!strict_strtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132
133 /**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled. If the always_check_network
141 * policy capability is enabled, SECMARK is always considered enabled.
142 *
143 */
144 static int selinux_secmark_enabled(void)
145 {
146 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
147 }
148
149 /**
150 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 *
152 * Description:
153 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
154 * (1) if any are enabled or false (0) if neither are enabled. If the
155 * always_check_network policy capability is enabled, peer labeling
156 * is always considered enabled.
157 *
158 */
159 static int selinux_peerlbl_enabled(void)
160 {
161 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
162 }
163
164 /*
165 * initialise the security for the init task
166 */
167 static void cred_init_security(void)
168 {
169 struct cred *cred = (struct cred *) current->real_cred;
170 struct task_security_struct *tsec;
171
172 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
173 if (!tsec)
174 panic("SELinux: Failed to initialize initial task.\n");
175
176 tsec->osid = tsec->sid = SECINITSID_KERNEL;
177 cred->security = tsec;
178 }
179
180 /*
181 * get the security ID of a set of credentials
182 */
183 static inline u32 cred_sid(const struct cred *cred)
184 {
185 const struct task_security_struct *tsec;
186
187 tsec = cred->security;
188 return tsec->sid;
189 }
190
191 /*
192 * get the objective security ID of a task
193 */
194 static inline u32 task_sid(const struct task_struct *task)
195 {
196 u32 sid;
197
198 rcu_read_lock();
199 sid = cred_sid(__task_cred(task));
200 rcu_read_unlock();
201 return sid;
202 }
203
204 /*
205 * get the subjective security ID of the current task
206 */
207 static inline u32 current_sid(void)
208 {
209 const struct task_security_struct *tsec = current_security();
210
211 return tsec->sid;
212 }
213
214 /* Allocate and free functions for each kind of security blob. */
215
216 static int inode_alloc_security(struct inode *inode)
217 {
218 struct inode_security_struct *isec;
219 u32 sid = current_sid();
220
221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
222 if (!isec)
223 return -ENOMEM;
224
225 mutex_init(&isec->lock);
226 INIT_LIST_HEAD(&isec->list);
227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
230 isec->task_sid = sid;
231 inode->i_security = isec;
232
233 return 0;
234 }
235
236 static void inode_free_rcu(struct rcu_head *head)
237 {
238 struct inode_security_struct *isec;
239
240 isec = container_of(head, struct inode_security_struct, rcu);
241 kmem_cache_free(sel_inode_cache, isec);
242 }
243
244 static void inode_free_security(struct inode *inode)
245 {
246 struct inode_security_struct *isec = inode->i_security;
247 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
248
249 spin_lock(&sbsec->isec_lock);
250 if (!list_empty(&isec->list))
251 list_del_init(&isec->list);
252 spin_unlock(&sbsec->isec_lock);
253
254 /*
255 * The inode may still be referenced in a path walk and
256 * a call to selinux_inode_permission() can be made
257 * after inode_free_security() is called. Ideally, the VFS
258 * wouldn't do this, but fixing that is a much harder
259 * job. For now, simply free the i_security via RCU, and
260 * leave the current inode->i_security pointer intact.
261 * The inode will be freed after the RCU grace period too.
262 */
263 call_rcu(&isec->rcu, inode_free_rcu);
264 }
265
266 static int file_alloc_security(struct file *file)
267 {
268 struct file_security_struct *fsec;
269 u32 sid = current_sid();
270
271 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
272 if (!fsec)
273 return -ENOMEM;
274
275 fsec->sid = sid;
276 fsec->fown_sid = sid;
277 file->f_security = fsec;
278
279 return 0;
280 }
281
282 static void file_free_security(struct file *file)
283 {
284 struct file_security_struct *fsec = file->f_security;
285 file->f_security = NULL;
286 kfree(fsec);
287 }
288
289 static int superblock_alloc_security(struct super_block *sb)
290 {
291 struct superblock_security_struct *sbsec;
292
293 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
294 if (!sbsec)
295 return -ENOMEM;
296
297 mutex_init(&sbsec->lock);
298 INIT_LIST_HEAD(&sbsec->isec_head);
299 spin_lock_init(&sbsec->isec_lock);
300 sbsec->sb = sb;
301 sbsec->sid = SECINITSID_UNLABELED;
302 sbsec->def_sid = SECINITSID_FILE;
303 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
304 sb->s_security = sbsec;
305
306 return 0;
307 }
308
309 static void superblock_free_security(struct super_block *sb)
310 {
311 struct superblock_security_struct *sbsec = sb->s_security;
312 sb->s_security = NULL;
313 kfree(sbsec);
314 }
315
316 /* The file system's label must be initialized prior to use. */
317
318 static const char *labeling_behaviors[7] = {
319 "uses xattr",
320 "uses transition SIDs",
321 "uses task SIDs",
322 "uses genfs_contexts",
323 "not configured for labeling",
324 "uses mountpoint labeling",
325 "uses native labeling",
326 };
327
328 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
329
330 static inline int inode_doinit(struct inode *inode)
331 {
332 return inode_doinit_with_dentry(inode, NULL);
333 }
334
335 enum {
336 Opt_error = -1,
337 Opt_context = 1,
338 Opt_fscontext = 2,
339 Opt_defcontext = 3,
340 Opt_rootcontext = 4,
341 Opt_labelsupport = 5,
342 Opt_nextmntopt = 6,
343 };
344
345 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
346
347 static const match_table_t tokens = {
348 {Opt_context, CONTEXT_STR "%s"},
349 {Opt_fscontext, FSCONTEXT_STR "%s"},
350 {Opt_defcontext, DEFCONTEXT_STR "%s"},
351 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
352 {Opt_labelsupport, LABELSUPP_STR},
353 {Opt_error, NULL},
354 };
355
356 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
357
358 static int may_context_mount_sb_relabel(u32 sid,
359 struct superblock_security_struct *sbsec,
360 const struct cred *cred)
361 {
362 const struct task_security_struct *tsec = cred->security;
363 int rc;
364
365 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
366 FILESYSTEM__RELABELFROM, NULL);
367 if (rc)
368 return rc;
369
370 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
371 FILESYSTEM__RELABELTO, NULL);
372 return rc;
373 }
374
375 static int may_context_mount_inode_relabel(u32 sid,
376 struct superblock_security_struct *sbsec,
377 const struct cred *cred)
378 {
379 const struct task_security_struct *tsec = cred->security;
380 int rc;
381 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
382 FILESYSTEM__RELABELFROM, NULL);
383 if (rc)
384 return rc;
385
386 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
387 FILESYSTEM__ASSOCIATE, NULL);
388 return rc;
389 }
390
391 static int selinux_is_sblabel_mnt(struct super_block *sb)
392 {
393 struct superblock_security_struct *sbsec = sb->s_security;
394
395 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
396 sbsec->behavior == SECURITY_FS_USE_TRANS ||
397 sbsec->behavior == SECURITY_FS_USE_TASK)
398 return 1;
399
400 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
401 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
402 return 1;
403
404 /*
405 * Special handling for rootfs. Is genfs but supports
406 * setting SELinux context on in-core inodes.
407 */
408 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
409 return 1;
410
411 return 0;
412 }
413
414 static int sb_finish_set_opts(struct super_block *sb)
415 {
416 struct superblock_security_struct *sbsec = sb->s_security;
417 struct dentry *root = sb->s_root;
418 struct inode *root_inode = root->d_inode;
419 int rc = 0;
420
421 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
422 /* Make sure that the xattr handler exists and that no
423 error other than -ENODATA is returned by getxattr on
424 the root directory. -ENODATA is ok, as this may be
425 the first boot of the SELinux kernel before we have
426 assigned xattr values to the filesystem. */
427 if (!root_inode->i_op->getxattr) {
428 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
429 "xattr support\n", sb->s_id, sb->s_type->name);
430 rc = -EOPNOTSUPP;
431 goto out;
432 }
433 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
434 if (rc < 0 && rc != -ENODATA) {
435 if (rc == -EOPNOTSUPP)
436 printk(KERN_WARNING "SELinux: (dev %s, type "
437 "%s) has no security xattr handler\n",
438 sb->s_id, sb->s_type->name);
439 else
440 printk(KERN_WARNING "SELinux: (dev %s, type "
441 "%s) getxattr errno %d\n", sb->s_id,
442 sb->s_type->name, -rc);
443 goto out;
444 }
445 }
446
447 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
448 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
449 sb->s_id, sb->s_type->name);
450 else
451 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
452 sb->s_id, sb->s_type->name,
453 labeling_behaviors[sbsec->behavior-1]);
454
455 sbsec->flags |= SE_SBINITIALIZED;
456 if (selinux_is_sblabel_mnt(sb))
457 sbsec->flags |= SBLABEL_MNT;
458
459 /* Initialize the root inode. */
460 rc = inode_doinit_with_dentry(root_inode, root);
461
462 /* Initialize any other inodes associated with the superblock, e.g.
463 inodes created prior to initial policy load or inodes created
464 during get_sb by a pseudo filesystem that directly
465 populates itself. */
466 spin_lock(&sbsec->isec_lock);
467 next_inode:
468 if (!list_empty(&sbsec->isec_head)) {
469 struct inode_security_struct *isec =
470 list_entry(sbsec->isec_head.next,
471 struct inode_security_struct, list);
472 struct inode *inode = isec->inode;
473 spin_unlock(&sbsec->isec_lock);
474 inode = igrab(inode);
475 if (inode) {
476 if (!IS_PRIVATE(inode))
477 inode_doinit(inode);
478 iput(inode);
479 }
480 spin_lock(&sbsec->isec_lock);
481 list_del_init(&isec->list);
482 goto next_inode;
483 }
484 spin_unlock(&sbsec->isec_lock);
485 out:
486 return rc;
487 }
488
489 /*
490 * This function should allow an FS to ask what it's mount security
491 * options were so it can use those later for submounts, displaying
492 * mount options, or whatever.
493 */
494 static int selinux_get_mnt_opts(const struct super_block *sb,
495 struct security_mnt_opts *opts)
496 {
497 int rc = 0, i;
498 struct superblock_security_struct *sbsec = sb->s_security;
499 char *context = NULL;
500 u32 len;
501 char tmp;
502
503 security_init_mnt_opts(opts);
504
505 if (!(sbsec->flags & SE_SBINITIALIZED))
506 return -EINVAL;
507
508 if (!ss_initialized)
509 return -EINVAL;
510
511 /* make sure we always check enough bits to cover the mask */
512 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
513
514 tmp = sbsec->flags & SE_MNTMASK;
515 /* count the number of mount options for this sb */
516 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
517 if (tmp & 0x01)
518 opts->num_mnt_opts++;
519 tmp >>= 1;
520 }
521 /* Check if the Label support flag is set */
522 if (sbsec->flags & SBLABEL_MNT)
523 opts->num_mnt_opts++;
524
525 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
526 if (!opts->mnt_opts) {
527 rc = -ENOMEM;
528 goto out_free;
529 }
530
531 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
532 if (!opts->mnt_opts_flags) {
533 rc = -ENOMEM;
534 goto out_free;
535 }
536
537 i = 0;
538 if (sbsec->flags & FSCONTEXT_MNT) {
539 rc = security_sid_to_context(sbsec->sid, &context, &len);
540 if (rc)
541 goto out_free;
542 opts->mnt_opts[i] = context;
543 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
544 }
545 if (sbsec->flags & CONTEXT_MNT) {
546 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
547 if (rc)
548 goto out_free;
549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
551 }
552 if (sbsec->flags & DEFCONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
554 if (rc)
555 goto out_free;
556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
558 }
559 if (sbsec->flags & ROOTCONTEXT_MNT) {
560 struct inode *root = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *isec = root->i_security;
562
563 rc = security_sid_to_context(isec->sid, &context, &len);
564 if (rc)
565 goto out_free;
566 opts->mnt_opts[i] = context;
567 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
568 }
569 if (sbsec->flags & SBLABEL_MNT) {
570 opts->mnt_opts[i] = NULL;
571 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
572 }
573
574 BUG_ON(i != opts->num_mnt_opts);
575
576 return 0;
577
578 out_free:
579 security_free_mnt_opts(opts);
580 return rc;
581 }
582
583 static int bad_option(struct superblock_security_struct *sbsec, char flag,
584 u32 old_sid, u32 new_sid)
585 {
586 char mnt_flags = sbsec->flags & SE_MNTMASK;
587
588 /* check if the old mount command had the same options */
589 if (sbsec->flags & SE_SBINITIALIZED)
590 if (!(sbsec->flags & flag) ||
591 (old_sid != new_sid))
592 return 1;
593
594 /* check if we were passed the same options twice,
595 * aka someone passed context=a,context=b
596 */
597 if (!(sbsec->flags & SE_SBINITIALIZED))
598 if (mnt_flags & flag)
599 return 1;
600 return 0;
601 }
602
603 /*
604 * Allow filesystems with binary mount data to explicitly set mount point
605 * labeling information.
606 */
607 static int selinux_set_mnt_opts(struct super_block *sb,
608 struct security_mnt_opts *opts,
609 unsigned long kern_flags,
610 unsigned long *set_kern_flags)
611 {
612 const struct cred *cred = current_cred();
613 int rc = 0, i;
614 struct superblock_security_struct *sbsec = sb->s_security;
615 const char *name = sb->s_type->name;
616 struct inode *inode = sbsec->sb->s_root->d_inode;
617 struct inode_security_struct *root_isec = inode->i_security;
618 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
619 u32 defcontext_sid = 0;
620 char **mount_options = opts->mnt_opts;
621 int *flags = opts->mnt_opts_flags;
622 int num_opts = opts->num_mnt_opts;
623
624 mutex_lock(&sbsec->lock);
625
626 if (!ss_initialized) {
627 if (!num_opts) {
628 /* Defer initialization until selinux_complete_init,
629 after the initial policy is loaded and the security
630 server is ready to handle calls. */
631 goto out;
632 }
633 rc = -EINVAL;
634 printk(KERN_WARNING "SELinux: Unable to set superblock options "
635 "before the security server is initialized\n");
636 goto out;
637 }
638 if (kern_flags && !set_kern_flags) {
639 /* Specifying internal flags without providing a place to
640 * place the results is not allowed */
641 rc = -EINVAL;
642 goto out;
643 }
644
645 /*
646 * Binary mount data FS will come through this function twice. Once
647 * from an explicit call and once from the generic calls from the vfs.
648 * Since the generic VFS calls will not contain any security mount data
649 * we need to skip the double mount verification.
650 *
651 * This does open a hole in which we will not notice if the first
652 * mount using this sb set explict options and a second mount using
653 * this sb does not set any security options. (The first options
654 * will be used for both mounts)
655 */
656 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
657 && (num_opts == 0))
658 goto out;
659
660 /*
661 * parse the mount options, check if they are valid sids.
662 * also check if someone is trying to mount the same sb more
663 * than once with different security options.
664 */
665 for (i = 0; i < num_opts; i++) {
666 u32 sid;
667
668 if (flags[i] == SBLABEL_MNT)
669 continue;
670 rc = security_context_to_sid(mount_options[i],
671 strlen(mount_options[i]), &sid);
672 if (rc) {
673 printk(KERN_WARNING "SELinux: security_context_to_sid"
674 "(%s) failed for (dev %s, type %s) errno=%d\n",
675 mount_options[i], sb->s_id, name, rc);
676 goto out;
677 }
678 switch (flags[i]) {
679 case FSCONTEXT_MNT:
680 fscontext_sid = sid;
681
682 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
683 fscontext_sid))
684 goto out_double_mount;
685
686 sbsec->flags |= FSCONTEXT_MNT;
687 break;
688 case CONTEXT_MNT:
689 context_sid = sid;
690
691 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
692 context_sid))
693 goto out_double_mount;
694
695 sbsec->flags |= CONTEXT_MNT;
696 break;
697 case ROOTCONTEXT_MNT:
698 rootcontext_sid = sid;
699
700 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
701 rootcontext_sid))
702 goto out_double_mount;
703
704 sbsec->flags |= ROOTCONTEXT_MNT;
705
706 break;
707 case DEFCONTEXT_MNT:
708 defcontext_sid = sid;
709
710 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 defcontext_sid))
712 goto out_double_mount;
713
714 sbsec->flags |= DEFCONTEXT_MNT;
715
716 break;
717 default:
718 rc = -EINVAL;
719 goto out;
720 }
721 }
722
723 if (sbsec->flags & SE_SBINITIALIZED) {
724 /* previously mounted with options, but not on this attempt? */
725 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
726 goto out_double_mount;
727 rc = 0;
728 goto out;
729 }
730
731 if (strcmp(sb->s_type->name, "proc") == 0)
732 sbsec->flags |= SE_SBPROC;
733
734 if (!sbsec->behavior) {
735 /*
736 * Determine the labeling behavior to use for this
737 * filesystem type.
738 */
739 rc = security_fs_use(sb);
740 if (rc) {
741 printk(KERN_WARNING
742 "%s: security_fs_use(%s) returned %d\n",
743 __func__, sb->s_type->name, rc);
744 goto out;
745 }
746 }
747 /* sets the context of the superblock for the fs being mounted. */
748 if (fscontext_sid) {
749 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
750 if (rc)
751 goto out;
752
753 sbsec->sid = fscontext_sid;
754 }
755
756 /*
757 * Switch to using mount point labeling behavior.
758 * sets the label used on all file below the mountpoint, and will set
759 * the superblock context if not already set.
760 */
761 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
762 sbsec->behavior = SECURITY_FS_USE_NATIVE;
763 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
764 }
765
766 if (context_sid) {
767 if (!fscontext_sid) {
768 rc = may_context_mount_sb_relabel(context_sid, sbsec,
769 cred);
770 if (rc)
771 goto out;
772 sbsec->sid = context_sid;
773 } else {
774 rc = may_context_mount_inode_relabel(context_sid, sbsec,
775 cred);
776 if (rc)
777 goto out;
778 }
779 if (!rootcontext_sid)
780 rootcontext_sid = context_sid;
781
782 sbsec->mntpoint_sid = context_sid;
783 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
784 }
785
786 if (rootcontext_sid) {
787 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
788 cred);
789 if (rc)
790 goto out;
791
792 root_isec->sid = rootcontext_sid;
793 root_isec->initialized = 1;
794 }
795
796 if (defcontext_sid) {
797 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
798 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
799 rc = -EINVAL;
800 printk(KERN_WARNING "SELinux: defcontext option is "
801 "invalid for this filesystem type\n");
802 goto out;
803 }
804
805 if (defcontext_sid != sbsec->def_sid) {
806 rc = may_context_mount_inode_relabel(defcontext_sid,
807 sbsec, cred);
808 if (rc)
809 goto out;
810 }
811
812 sbsec->def_sid = defcontext_sid;
813 }
814
815 rc = sb_finish_set_opts(sb);
816 out:
817 mutex_unlock(&sbsec->lock);
818 return rc;
819 out_double_mount:
820 rc = -EINVAL;
821 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
822 "security settings for (dev %s, type %s)\n", sb->s_id, name);
823 goto out;
824 }
825
826 static int selinux_cmp_sb_context(const struct super_block *oldsb,
827 const struct super_block *newsb)
828 {
829 struct superblock_security_struct *old = oldsb->s_security;
830 struct superblock_security_struct *new = newsb->s_security;
831 char oldflags = old->flags & SE_MNTMASK;
832 char newflags = new->flags & SE_MNTMASK;
833
834 if (oldflags != newflags)
835 goto mismatch;
836 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
837 goto mismatch;
838 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
839 goto mismatch;
840 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
841 goto mismatch;
842 if (oldflags & ROOTCONTEXT_MNT) {
843 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
844 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
845 if (oldroot->sid != newroot->sid)
846 goto mismatch;
847 }
848 return 0;
849 mismatch:
850 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
851 "different security settings for (dev %s, "
852 "type %s)\n", newsb->s_id, newsb->s_type->name);
853 return -EBUSY;
854 }
855
856 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
857 struct super_block *newsb)
858 {
859 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
860 struct superblock_security_struct *newsbsec = newsb->s_security;
861
862 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
863 int set_context = (oldsbsec->flags & CONTEXT_MNT);
864 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
865
866 /*
867 * if the parent was able to be mounted it clearly had no special lsm
868 * mount options. thus we can safely deal with this superblock later
869 */
870 if (!ss_initialized)
871 return 0;
872
873 /* how can we clone if the old one wasn't set up?? */
874 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
875
876 /* if fs is reusing a sb, make sure that the contexts match */
877 if (newsbsec->flags & SE_SBINITIALIZED)
878 return selinux_cmp_sb_context(oldsb, newsb);
879
880 mutex_lock(&newsbsec->lock);
881
882 newsbsec->flags = oldsbsec->flags;
883
884 newsbsec->sid = oldsbsec->sid;
885 newsbsec->def_sid = oldsbsec->def_sid;
886 newsbsec->behavior = oldsbsec->behavior;
887
888 if (set_context) {
889 u32 sid = oldsbsec->mntpoint_sid;
890
891 if (!set_fscontext)
892 newsbsec->sid = sid;
893 if (!set_rootcontext) {
894 struct inode *newinode = newsb->s_root->d_inode;
895 struct inode_security_struct *newisec = newinode->i_security;
896 newisec->sid = sid;
897 }
898 newsbsec->mntpoint_sid = sid;
899 }
900 if (set_rootcontext) {
901 const struct inode *oldinode = oldsb->s_root->d_inode;
902 const struct inode_security_struct *oldisec = oldinode->i_security;
903 struct inode *newinode = newsb->s_root->d_inode;
904 struct inode_security_struct *newisec = newinode->i_security;
905
906 newisec->sid = oldisec->sid;
907 }
908
909 sb_finish_set_opts(newsb);
910 mutex_unlock(&newsbsec->lock);
911 return 0;
912 }
913
914 static int selinux_parse_opts_str(char *options,
915 struct security_mnt_opts *opts)
916 {
917 char *p;
918 char *context = NULL, *defcontext = NULL;
919 char *fscontext = NULL, *rootcontext = NULL;
920 int rc, num_mnt_opts = 0;
921
922 opts->num_mnt_opts = 0;
923
924 /* Standard string-based options. */
925 while ((p = strsep(&options, "|")) != NULL) {
926 int token;
927 substring_t args[MAX_OPT_ARGS];
928
929 if (!*p)
930 continue;
931
932 token = match_token(p, tokens, args);
933
934 switch (token) {
935 case Opt_context:
936 if (context || defcontext) {
937 rc = -EINVAL;
938 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
939 goto out_err;
940 }
941 context = match_strdup(&args[0]);
942 if (!context) {
943 rc = -ENOMEM;
944 goto out_err;
945 }
946 break;
947
948 case Opt_fscontext:
949 if (fscontext) {
950 rc = -EINVAL;
951 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
952 goto out_err;
953 }
954 fscontext = match_strdup(&args[0]);
955 if (!fscontext) {
956 rc = -ENOMEM;
957 goto out_err;
958 }
959 break;
960
961 case Opt_rootcontext:
962 if (rootcontext) {
963 rc = -EINVAL;
964 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
965 goto out_err;
966 }
967 rootcontext = match_strdup(&args[0]);
968 if (!rootcontext) {
969 rc = -ENOMEM;
970 goto out_err;
971 }
972 break;
973
974 case Opt_defcontext:
975 if (context || defcontext) {
976 rc = -EINVAL;
977 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
978 goto out_err;
979 }
980 defcontext = match_strdup(&args[0]);
981 if (!defcontext) {
982 rc = -ENOMEM;
983 goto out_err;
984 }
985 break;
986 case Opt_labelsupport:
987 break;
988 default:
989 rc = -EINVAL;
990 printk(KERN_WARNING "SELinux: unknown mount option\n");
991 goto out_err;
992
993 }
994 }
995
996 rc = -ENOMEM;
997 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
998 if (!opts->mnt_opts)
999 goto out_err;
1000
1001 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002 if (!opts->mnt_opts_flags) {
1003 kfree(opts->mnt_opts);
1004 goto out_err;
1005 }
1006
1007 if (fscontext) {
1008 opts->mnt_opts[num_mnt_opts] = fscontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1010 }
1011 if (context) {
1012 opts->mnt_opts[num_mnt_opts] = context;
1013 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1014 }
1015 if (rootcontext) {
1016 opts->mnt_opts[num_mnt_opts] = rootcontext;
1017 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1018 }
1019 if (defcontext) {
1020 opts->mnt_opts[num_mnt_opts] = defcontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1022 }
1023
1024 opts->num_mnt_opts = num_mnt_opts;
1025 return 0;
1026
1027 out_err:
1028 kfree(context);
1029 kfree(defcontext);
1030 kfree(fscontext);
1031 kfree(rootcontext);
1032 return rc;
1033 }
1034 /*
1035 * string mount options parsing and call set the sbsec
1036 */
1037 static int superblock_doinit(struct super_block *sb, void *data)
1038 {
1039 int rc = 0;
1040 char *options = data;
1041 struct security_mnt_opts opts;
1042
1043 security_init_mnt_opts(&opts);
1044
1045 if (!data)
1046 goto out;
1047
1048 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050 rc = selinux_parse_opts_str(options, &opts);
1051 if (rc)
1052 goto out_err;
1053
1054 out:
1055 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1056
1057 out_err:
1058 security_free_mnt_opts(&opts);
1059 return rc;
1060 }
1061
1062 static void selinux_write_opts(struct seq_file *m,
1063 struct security_mnt_opts *opts)
1064 {
1065 int i;
1066 char *prefix;
1067
1068 for (i = 0; i < opts->num_mnt_opts; i++) {
1069 char *has_comma;
1070
1071 if (opts->mnt_opts[i])
1072 has_comma = strchr(opts->mnt_opts[i], ',');
1073 else
1074 has_comma = NULL;
1075
1076 switch (opts->mnt_opts_flags[i]) {
1077 case CONTEXT_MNT:
1078 prefix = CONTEXT_STR;
1079 break;
1080 case FSCONTEXT_MNT:
1081 prefix = FSCONTEXT_STR;
1082 break;
1083 case ROOTCONTEXT_MNT:
1084 prefix = ROOTCONTEXT_STR;
1085 break;
1086 case DEFCONTEXT_MNT:
1087 prefix = DEFCONTEXT_STR;
1088 break;
1089 case SBLABEL_MNT:
1090 seq_putc(m, ',');
1091 seq_puts(m, LABELSUPP_STR);
1092 continue;
1093 default:
1094 BUG();
1095 return;
1096 };
1097 /* we need a comma before each option */
1098 seq_putc(m, ',');
1099 seq_puts(m, prefix);
1100 if (has_comma)
1101 seq_putc(m, '\"');
1102 seq_puts(m, opts->mnt_opts[i]);
1103 if (has_comma)
1104 seq_putc(m, '\"');
1105 }
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110 struct security_mnt_opts opts;
1111 int rc;
1112
1113 rc = selinux_get_mnt_opts(sb, &opts);
1114 if (rc) {
1115 /* before policy load we may get EINVAL, don't show anything */
1116 if (rc == -EINVAL)
1117 rc = 0;
1118 return rc;
1119 }
1120
1121 selinux_write_opts(m, &opts);
1122
1123 security_free_mnt_opts(&opts);
1124
1125 return rc;
1126 }
1127
1128 static inline u16 inode_mode_to_security_class(umode_t mode)
1129 {
1130 switch (mode & S_IFMT) {
1131 case S_IFSOCK:
1132 return SECCLASS_SOCK_FILE;
1133 case S_IFLNK:
1134 return SECCLASS_LNK_FILE;
1135 case S_IFREG:
1136 return SECCLASS_FILE;
1137 case S_IFBLK:
1138 return SECCLASS_BLK_FILE;
1139 case S_IFDIR:
1140 return SECCLASS_DIR;
1141 case S_IFCHR:
1142 return SECCLASS_CHR_FILE;
1143 case S_IFIFO:
1144 return SECCLASS_FIFO_FILE;
1145
1146 }
1147
1148 return SECCLASS_FILE;
1149 }
1150
1151 static inline int default_protocol_stream(int protocol)
1152 {
1153 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154 }
1155
1156 static inline int default_protocol_dgram(int protocol)
1157 {
1158 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159 }
1160
1161 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162 {
1163 switch (family) {
1164 case PF_UNIX:
1165 switch (type) {
1166 case SOCK_STREAM:
1167 case SOCK_SEQPACKET:
1168 return SECCLASS_UNIX_STREAM_SOCKET;
1169 case SOCK_DGRAM:
1170 return SECCLASS_UNIX_DGRAM_SOCKET;
1171 }
1172 break;
1173 case PF_INET:
1174 case PF_INET6:
1175 switch (type) {
1176 case SOCK_STREAM:
1177 if (default_protocol_stream(protocol))
1178 return SECCLASS_TCP_SOCKET;
1179 else
1180 return SECCLASS_RAWIP_SOCKET;
1181 case SOCK_DGRAM:
1182 if (default_protocol_dgram(protocol))
1183 return SECCLASS_UDP_SOCKET;
1184 else
1185 return SECCLASS_RAWIP_SOCKET;
1186 case SOCK_DCCP:
1187 return SECCLASS_DCCP_SOCKET;
1188 default:
1189 return SECCLASS_RAWIP_SOCKET;
1190 }
1191 break;
1192 case PF_NETLINK:
1193 switch (protocol) {
1194 case NETLINK_ROUTE:
1195 return SECCLASS_NETLINK_ROUTE_SOCKET;
1196 case NETLINK_FIREWALL:
1197 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1198 case NETLINK_SOCK_DIAG:
1199 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200 case NETLINK_NFLOG:
1201 return SECCLASS_NETLINK_NFLOG_SOCKET;
1202 case NETLINK_XFRM:
1203 return SECCLASS_NETLINK_XFRM_SOCKET;
1204 case NETLINK_SELINUX:
1205 return SECCLASS_NETLINK_SELINUX_SOCKET;
1206 case NETLINK_AUDIT:
1207 return SECCLASS_NETLINK_AUDIT_SOCKET;
1208 case NETLINK_IP6_FW:
1209 return SECCLASS_NETLINK_IP6FW_SOCKET;
1210 case NETLINK_DNRTMSG:
1211 return SECCLASS_NETLINK_DNRT_SOCKET;
1212 case NETLINK_KOBJECT_UEVENT:
1213 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1214 default:
1215 return SECCLASS_NETLINK_SOCKET;
1216 }
1217 case PF_PACKET:
1218 return SECCLASS_PACKET_SOCKET;
1219 case PF_KEY:
1220 return SECCLASS_KEY_SOCKET;
1221 case PF_APPLETALK:
1222 return SECCLASS_APPLETALK_SOCKET;
1223 }
1224
1225 return SECCLASS_SOCKET;
1226 }
1227
1228 #ifdef CONFIG_PROC_FS
1229 static int selinux_proc_get_sid(struct dentry *dentry,
1230 u16 tclass,
1231 u32 *sid)
1232 {
1233 int rc;
1234 char *buffer, *path;
1235
1236 buffer = (char *)__get_free_page(GFP_KERNEL);
1237 if (!buffer)
1238 return -ENOMEM;
1239
1240 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241 if (IS_ERR(path))
1242 rc = PTR_ERR(path);
1243 else {
1244 /* each process gets a /proc/PID/ entry. Strip off the
1245 * PID part to get a valid selinux labeling.
1246 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247 while (path[1] >= '0' && path[1] <= '9') {
1248 path[1] = '/';
1249 path++;
1250 }
1251 rc = security_genfs_sid("proc", path, tclass, sid);
1252 }
1253 free_page((unsigned long)buffer);
1254 return rc;
1255 }
1256 #else
1257 static int selinux_proc_get_sid(struct dentry *dentry,
1258 u16 tclass,
1259 u32 *sid)
1260 {
1261 return -EINVAL;
1262 }
1263 #endif
1264
1265 /* The inode's security attributes must be initialized before first use. */
1266 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267 {
1268 struct superblock_security_struct *sbsec = NULL;
1269 struct inode_security_struct *isec = inode->i_security;
1270 u32 sid;
1271 struct dentry *dentry;
1272 #define INITCONTEXTLEN 255
1273 char *context = NULL;
1274 unsigned len = 0;
1275 int rc = 0;
1276
1277 if (isec->initialized)
1278 goto out;
1279
1280 mutex_lock(&isec->lock);
1281 if (isec->initialized)
1282 goto out_unlock;
1283
1284 sbsec = inode->i_sb->s_security;
1285 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1286 /* Defer initialization until selinux_complete_init,
1287 after the initial policy is loaded and the security
1288 server is ready to handle calls. */
1289 spin_lock(&sbsec->isec_lock);
1290 if (list_empty(&isec->list))
1291 list_add(&isec->list, &sbsec->isec_head);
1292 spin_unlock(&sbsec->isec_lock);
1293 goto out_unlock;
1294 }
1295
1296 switch (sbsec->behavior) {
1297 case SECURITY_FS_USE_NATIVE:
1298 break;
1299 case SECURITY_FS_USE_XATTR:
1300 if (!inode->i_op->getxattr) {
1301 isec->sid = sbsec->def_sid;
1302 break;
1303 }
1304
1305 /* Need a dentry, since the xattr API requires one.
1306 Life would be simpler if we could just pass the inode. */
1307 if (opt_dentry) {
1308 /* Called from d_instantiate or d_splice_alias. */
1309 dentry = dget(opt_dentry);
1310 } else {
1311 /* Called from selinux_complete_init, try to find a dentry. */
1312 dentry = d_find_alias(inode);
1313 }
1314 if (!dentry) {
1315 /*
1316 * this is can be hit on boot when a file is accessed
1317 * before the policy is loaded. When we load policy we
1318 * may find inodes that have no dentry on the
1319 * sbsec->isec_head list. No reason to complain as these
1320 * will get fixed up the next time we go through
1321 * inode_doinit with a dentry, before these inodes could
1322 * be used again by userspace.
1323 */
1324 goto out_unlock;
1325 }
1326
1327 len = INITCONTEXTLEN;
1328 context = kmalloc(len+1, GFP_NOFS);
1329 if (!context) {
1330 rc = -ENOMEM;
1331 dput(dentry);
1332 goto out_unlock;
1333 }
1334 context[len] = '\0';
1335 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336 context, len);
1337 if (rc == -ERANGE) {
1338 kfree(context);
1339
1340 /* Need a larger buffer. Query for the right size. */
1341 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342 NULL, 0);
1343 if (rc < 0) {
1344 dput(dentry);
1345 goto out_unlock;
1346 }
1347 len = rc;
1348 context = kmalloc(len+1, GFP_NOFS);
1349 if (!context) {
1350 rc = -ENOMEM;
1351 dput(dentry);
1352 goto out_unlock;
1353 }
1354 context[len] = '\0';
1355 rc = inode->i_op->getxattr(dentry,
1356 XATTR_NAME_SELINUX,
1357 context, len);
1358 }
1359 dput(dentry);
1360 if (rc < 0) {
1361 if (rc != -ENODATA) {
1362 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1363 "%d for dev=%s ino=%ld\n", __func__,
1364 -rc, inode->i_sb->s_id, inode->i_ino);
1365 kfree(context);
1366 goto out_unlock;
1367 }
1368 /* Map ENODATA to the default file SID */
1369 sid = sbsec->def_sid;
1370 rc = 0;
1371 } else {
1372 rc = security_context_to_sid_default(context, rc, &sid,
1373 sbsec->def_sid,
1374 GFP_NOFS);
1375 if (rc) {
1376 char *dev = inode->i_sb->s_id;
1377 unsigned long ino = inode->i_ino;
1378
1379 if (rc == -EINVAL) {
1380 if (printk_ratelimit())
1381 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382 "context=%s. This indicates you may need to relabel the inode or the "
1383 "filesystem in question.\n", ino, dev, context);
1384 } else {
1385 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1386 "returned %d for dev=%s ino=%ld\n",
1387 __func__, context, -rc, dev, ino);
1388 }
1389 kfree(context);
1390 /* Leave with the unlabeled SID */
1391 rc = 0;
1392 break;
1393 }
1394 }
1395 kfree(context);
1396 isec->sid = sid;
1397 break;
1398 case SECURITY_FS_USE_TASK:
1399 isec->sid = isec->task_sid;
1400 break;
1401 case SECURITY_FS_USE_TRANS:
1402 /* Default to the fs SID. */
1403 isec->sid = sbsec->sid;
1404
1405 /* Try to obtain a transition SID. */
1406 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408 isec->sclass, NULL, &sid);
1409 if (rc)
1410 goto out_unlock;
1411 isec->sid = sid;
1412 break;
1413 case SECURITY_FS_USE_MNTPOINT:
1414 isec->sid = sbsec->mntpoint_sid;
1415 break;
1416 default:
1417 /* Default to the fs superblock SID. */
1418 isec->sid = sbsec->sid;
1419
1420 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1421 if (opt_dentry) {
1422 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1423 rc = selinux_proc_get_sid(opt_dentry,
1424 isec->sclass,
1425 &sid);
1426 if (rc)
1427 goto out_unlock;
1428 isec->sid = sid;
1429 }
1430 }
1431 break;
1432 }
1433
1434 isec->initialized = 1;
1435
1436 out_unlock:
1437 mutex_unlock(&isec->lock);
1438 out:
1439 if (isec->sclass == SECCLASS_FILE)
1440 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441 return rc;
1442 }
1443
1444 /* Convert a Linux signal to an access vector. */
1445 static inline u32 signal_to_av(int sig)
1446 {
1447 u32 perm = 0;
1448
1449 switch (sig) {
1450 case SIGCHLD:
1451 /* Commonly granted from child to parent. */
1452 perm = PROCESS__SIGCHLD;
1453 break;
1454 case SIGKILL:
1455 /* Cannot be caught or ignored */
1456 perm = PROCESS__SIGKILL;
1457 break;
1458 case SIGSTOP:
1459 /* Cannot be caught or ignored */
1460 perm = PROCESS__SIGSTOP;
1461 break;
1462 default:
1463 /* All other signals. */
1464 perm = PROCESS__SIGNAL;
1465 break;
1466 }
1467
1468 return perm;
1469 }
1470
1471 /*
1472 * Check permission between a pair of credentials
1473 * fork check, ptrace check, etc.
1474 */
1475 static int cred_has_perm(const struct cred *actor,
1476 const struct cred *target,
1477 u32 perms)
1478 {
1479 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1480
1481 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1482 }
1483
1484 /*
1485 * Check permission between a pair of tasks, e.g. signal checks,
1486 * fork check, ptrace check, etc.
1487 * tsk1 is the actor and tsk2 is the target
1488 * - this uses the default subjective creds of tsk1
1489 */
1490 static int task_has_perm(const struct task_struct *tsk1,
1491 const struct task_struct *tsk2,
1492 u32 perms)
1493 {
1494 const struct task_security_struct *__tsec1, *__tsec2;
1495 u32 sid1, sid2;
1496
1497 rcu_read_lock();
1498 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1499 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1500 rcu_read_unlock();
1501 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1502 }
1503
1504 /*
1505 * Check permission between current and another task, e.g. signal checks,
1506 * fork check, ptrace check, etc.
1507 * current is the actor and tsk2 is the target
1508 * - this uses current's subjective creds
1509 */
1510 static int current_has_perm(const struct task_struct *tsk,
1511 u32 perms)
1512 {
1513 u32 sid, tsid;
1514
1515 sid = current_sid();
1516 tsid = task_sid(tsk);
1517 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1518 }
1519
1520 #if CAP_LAST_CAP > 63
1521 #error Fix SELinux to handle capabilities > 63.
1522 #endif
1523
1524 /* Check whether a task is allowed to use a capability. */
1525 static int cred_has_capability(const struct cred *cred,
1526 int cap, int audit)
1527 {
1528 struct common_audit_data ad;
1529 struct av_decision avd;
1530 u16 sclass;
1531 u32 sid = cred_sid(cred);
1532 u32 av = CAP_TO_MASK(cap);
1533 int rc;
1534
1535 ad.type = LSM_AUDIT_DATA_CAP;
1536 ad.u.cap = cap;
1537
1538 switch (CAP_TO_INDEX(cap)) {
1539 case 0:
1540 sclass = SECCLASS_CAPABILITY;
1541 break;
1542 case 1:
1543 sclass = SECCLASS_CAPABILITY2;
1544 break;
1545 default:
1546 printk(KERN_ERR
1547 "SELinux: out of range capability %d\n", cap);
1548 BUG();
1549 return -EINVAL;
1550 }
1551
1552 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1553 if (audit == SECURITY_CAP_AUDIT) {
1554 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1555 if (rc2)
1556 return rc2;
1557 }
1558 return rc;
1559 }
1560
1561 /* Check whether a task is allowed to use a system operation. */
1562 static int task_has_system(struct task_struct *tsk,
1563 u32 perms)
1564 {
1565 u32 sid = task_sid(tsk);
1566
1567 return avc_has_perm(sid, SECINITSID_KERNEL,
1568 SECCLASS_SYSTEM, perms, NULL);
1569 }
1570
1571 /* Check whether a task has a particular permission to an inode.
1572 The 'adp' parameter is optional and allows other audit
1573 data to be passed (e.g. the dentry). */
1574 static int inode_has_perm(const struct cred *cred,
1575 struct inode *inode,
1576 u32 perms,
1577 struct common_audit_data *adp)
1578 {
1579 struct inode_security_struct *isec;
1580 u32 sid;
1581
1582 validate_creds(cred);
1583
1584 if (unlikely(IS_PRIVATE(inode)))
1585 return 0;
1586
1587 sid = cred_sid(cred);
1588 isec = inode->i_security;
1589
1590 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1591 }
1592
1593 /* Same as inode_has_perm, but pass explicit audit data containing
1594 the dentry to help the auditing code to more easily generate the
1595 pathname if needed. */
1596 static inline int dentry_has_perm(const struct cred *cred,
1597 struct dentry *dentry,
1598 u32 av)
1599 {
1600 struct inode *inode = dentry->d_inode;
1601 struct common_audit_data ad;
1602
1603 ad.type = LSM_AUDIT_DATA_DENTRY;
1604 ad.u.dentry = dentry;
1605 return inode_has_perm(cred, inode, av, &ad);
1606 }
1607
1608 /* Same as inode_has_perm, but pass explicit audit data containing
1609 the path to help the auditing code to more easily generate the
1610 pathname if needed. */
1611 static inline int path_has_perm(const struct cred *cred,
1612 struct path *path,
1613 u32 av)
1614 {
1615 struct inode *inode = path->dentry->d_inode;
1616 struct common_audit_data ad;
1617
1618 ad.type = LSM_AUDIT_DATA_PATH;
1619 ad.u.path = *path;
1620 return inode_has_perm(cred, inode, av, &ad);
1621 }
1622
1623 /* Same as path_has_perm, but uses the inode from the file struct. */
1624 static inline int file_path_has_perm(const struct cred *cred,
1625 struct file *file,
1626 u32 av)
1627 {
1628 struct common_audit_data ad;
1629
1630 ad.type = LSM_AUDIT_DATA_PATH;
1631 ad.u.path = file->f_path;
1632 return inode_has_perm(cred, file_inode(file), av, &ad);
1633 }
1634
1635 /* Check whether a task can use an open file descriptor to
1636 access an inode in a given way. Check access to the
1637 descriptor itself, and then use dentry_has_perm to
1638 check a particular permission to the file.
1639 Access to the descriptor is implicitly granted if it
1640 has the same SID as the process. If av is zero, then
1641 access to the file is not checked, e.g. for cases
1642 where only the descriptor is affected like seek. */
1643 static int file_has_perm(const struct cred *cred,
1644 struct file *file,
1645 u32 av)
1646 {
1647 struct file_security_struct *fsec = file->f_security;
1648 struct inode *inode = file_inode(file);
1649 struct common_audit_data ad;
1650 u32 sid = cred_sid(cred);
1651 int rc;
1652
1653 ad.type = LSM_AUDIT_DATA_PATH;
1654 ad.u.path = file->f_path;
1655
1656 if (sid != fsec->sid) {
1657 rc = avc_has_perm(sid, fsec->sid,
1658 SECCLASS_FD,
1659 FD__USE,
1660 &ad);
1661 if (rc)
1662 goto out;
1663 }
1664
1665 /* av is zero if only checking access to the descriptor. */
1666 rc = 0;
1667 if (av)
1668 rc = inode_has_perm(cred, inode, av, &ad);
1669
1670 out:
1671 return rc;
1672 }
1673
1674 /* Check whether a task can create a file. */
1675 static int may_create(struct inode *dir,
1676 struct dentry *dentry,
1677 u16 tclass)
1678 {
1679 const struct task_security_struct *tsec = current_security();
1680 struct inode_security_struct *dsec;
1681 struct superblock_security_struct *sbsec;
1682 u32 sid, newsid;
1683 struct common_audit_data ad;
1684 int rc;
1685
1686 dsec = dir->i_security;
1687 sbsec = dir->i_sb->s_security;
1688
1689 sid = tsec->sid;
1690 newsid = tsec->create_sid;
1691
1692 ad.type = LSM_AUDIT_DATA_DENTRY;
1693 ad.u.dentry = dentry;
1694
1695 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1696 DIR__ADD_NAME | DIR__SEARCH,
1697 &ad);
1698 if (rc)
1699 return rc;
1700
1701 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1702 rc = security_transition_sid(sid, dsec->sid, tclass,
1703 &dentry->d_name, &newsid);
1704 if (rc)
1705 return rc;
1706 }
1707
1708 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1709 if (rc)
1710 return rc;
1711
1712 return avc_has_perm(newsid, sbsec->sid,
1713 SECCLASS_FILESYSTEM,
1714 FILESYSTEM__ASSOCIATE, &ad);
1715 }
1716
1717 /* Check whether a task can create a key. */
1718 static int may_create_key(u32 ksid,
1719 struct task_struct *ctx)
1720 {
1721 u32 sid = task_sid(ctx);
1722
1723 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1724 }
1725
1726 #define MAY_LINK 0
1727 #define MAY_UNLINK 1
1728 #define MAY_RMDIR 2
1729
1730 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1731 static int may_link(struct inode *dir,
1732 struct dentry *dentry,
1733 int kind)
1734
1735 {
1736 struct inode_security_struct *dsec, *isec;
1737 struct common_audit_data ad;
1738 u32 sid = current_sid();
1739 u32 av;
1740 int rc;
1741
1742 dsec = dir->i_security;
1743 isec = dentry->d_inode->i_security;
1744
1745 ad.type = LSM_AUDIT_DATA_DENTRY;
1746 ad.u.dentry = dentry;
1747
1748 av = DIR__SEARCH;
1749 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1750 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1751 if (rc)
1752 return rc;
1753
1754 switch (kind) {
1755 case MAY_LINK:
1756 av = FILE__LINK;
1757 break;
1758 case MAY_UNLINK:
1759 av = FILE__UNLINK;
1760 break;
1761 case MAY_RMDIR:
1762 av = DIR__RMDIR;
1763 break;
1764 default:
1765 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1766 __func__, kind);
1767 return 0;
1768 }
1769
1770 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1771 return rc;
1772 }
1773
1774 static inline int may_rename(struct inode *old_dir,
1775 struct dentry *old_dentry,
1776 struct inode *new_dir,
1777 struct dentry *new_dentry)
1778 {
1779 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1780 struct common_audit_data ad;
1781 u32 sid = current_sid();
1782 u32 av;
1783 int old_is_dir, new_is_dir;
1784 int rc;
1785
1786 old_dsec = old_dir->i_security;
1787 old_isec = old_dentry->d_inode->i_security;
1788 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1789 new_dsec = new_dir->i_security;
1790
1791 ad.type = LSM_AUDIT_DATA_DENTRY;
1792
1793 ad.u.dentry = old_dentry;
1794 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1795 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1796 if (rc)
1797 return rc;
1798 rc = avc_has_perm(sid, old_isec->sid,
1799 old_isec->sclass, FILE__RENAME, &ad);
1800 if (rc)
1801 return rc;
1802 if (old_is_dir && new_dir != old_dir) {
1803 rc = avc_has_perm(sid, old_isec->sid,
1804 old_isec->sclass, DIR__REPARENT, &ad);
1805 if (rc)
1806 return rc;
1807 }
1808
1809 ad.u.dentry = new_dentry;
1810 av = DIR__ADD_NAME | DIR__SEARCH;
1811 if (new_dentry->d_inode)
1812 av |= DIR__REMOVE_NAME;
1813 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1814 if (rc)
1815 return rc;
1816 if (new_dentry->d_inode) {
1817 new_isec = new_dentry->d_inode->i_security;
1818 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1819 rc = avc_has_perm(sid, new_isec->sid,
1820 new_isec->sclass,
1821 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1822 if (rc)
1823 return rc;
1824 }
1825
1826 return 0;
1827 }
1828
1829 /* Check whether a task can perform a filesystem operation. */
1830 static int superblock_has_perm(const struct cred *cred,
1831 struct super_block *sb,
1832 u32 perms,
1833 struct common_audit_data *ad)
1834 {
1835 struct superblock_security_struct *sbsec;
1836 u32 sid = cred_sid(cred);
1837
1838 sbsec = sb->s_security;
1839 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1840 }
1841
1842 /* Convert a Linux mode and permission mask to an access vector. */
1843 static inline u32 file_mask_to_av(int mode, int mask)
1844 {
1845 u32 av = 0;
1846
1847 if (!S_ISDIR(mode)) {
1848 if (mask & MAY_EXEC)
1849 av |= FILE__EXECUTE;
1850 if (mask & MAY_READ)
1851 av |= FILE__READ;
1852
1853 if (mask & MAY_APPEND)
1854 av |= FILE__APPEND;
1855 else if (mask & MAY_WRITE)
1856 av |= FILE__WRITE;
1857
1858 } else {
1859 if (mask & MAY_EXEC)
1860 av |= DIR__SEARCH;
1861 if (mask & MAY_WRITE)
1862 av |= DIR__WRITE;
1863 if (mask & MAY_READ)
1864 av |= DIR__READ;
1865 }
1866
1867 return av;
1868 }
1869
1870 /* Convert a Linux file to an access vector. */
1871 static inline u32 file_to_av(struct file *file)
1872 {
1873 u32 av = 0;
1874
1875 if (file->f_mode & FMODE_READ)
1876 av |= FILE__READ;
1877 if (file->f_mode & FMODE_WRITE) {
1878 if (file->f_flags & O_APPEND)
1879 av |= FILE__APPEND;
1880 else
1881 av |= FILE__WRITE;
1882 }
1883 if (!av) {
1884 /*
1885 * Special file opened with flags 3 for ioctl-only use.
1886 */
1887 av = FILE__IOCTL;
1888 }
1889
1890 return av;
1891 }
1892
1893 /*
1894 * Convert a file to an access vector and include the correct open
1895 * open permission.
1896 */
1897 static inline u32 open_file_to_av(struct file *file)
1898 {
1899 u32 av = file_to_av(file);
1900
1901 if (selinux_policycap_openperm)
1902 av |= FILE__OPEN;
1903
1904 return av;
1905 }
1906
1907 /* Hook functions begin here. */
1908
1909 static int selinux_ptrace_access_check(struct task_struct *child,
1910 unsigned int mode)
1911 {
1912 int rc;
1913
1914 rc = cap_ptrace_access_check(child, mode);
1915 if (rc)
1916 return rc;
1917
1918 if (mode & PTRACE_MODE_READ) {
1919 u32 sid = current_sid();
1920 u32 csid = task_sid(child);
1921 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1922 }
1923
1924 return current_has_perm(child, PROCESS__PTRACE);
1925 }
1926
1927 static int selinux_ptrace_traceme(struct task_struct *parent)
1928 {
1929 int rc;
1930
1931 rc = cap_ptrace_traceme(parent);
1932 if (rc)
1933 return rc;
1934
1935 return task_has_perm(parent, current, PROCESS__PTRACE);
1936 }
1937
1938 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1939 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1940 {
1941 int error;
1942
1943 error = current_has_perm(target, PROCESS__GETCAP);
1944 if (error)
1945 return error;
1946
1947 return cap_capget(target, effective, inheritable, permitted);
1948 }
1949
1950 static int selinux_capset(struct cred *new, const struct cred *old,
1951 const kernel_cap_t *effective,
1952 const kernel_cap_t *inheritable,
1953 const kernel_cap_t *permitted)
1954 {
1955 int error;
1956
1957 error = cap_capset(new, old,
1958 effective, inheritable, permitted);
1959 if (error)
1960 return error;
1961
1962 return cred_has_perm(old, new, PROCESS__SETCAP);
1963 }
1964
1965 /*
1966 * (This comment used to live with the selinux_task_setuid hook,
1967 * which was removed).
1968 *
1969 * Since setuid only affects the current process, and since the SELinux
1970 * controls are not based on the Linux identity attributes, SELinux does not
1971 * need to control this operation. However, SELinux does control the use of
1972 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1973 */
1974
1975 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1976 int cap, int audit)
1977 {
1978 int rc;
1979
1980 rc = cap_capable(cred, ns, cap, audit);
1981 if (rc)
1982 return rc;
1983
1984 return cred_has_capability(cred, cap, audit);
1985 }
1986
1987 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1988 {
1989 const struct cred *cred = current_cred();
1990 int rc = 0;
1991
1992 if (!sb)
1993 return 0;
1994
1995 switch (cmds) {
1996 case Q_SYNC:
1997 case Q_QUOTAON:
1998 case Q_QUOTAOFF:
1999 case Q_SETINFO:
2000 case Q_SETQUOTA:
2001 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2002 break;
2003 case Q_GETFMT:
2004 case Q_GETINFO:
2005 case Q_GETQUOTA:
2006 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2007 break;
2008 default:
2009 rc = 0; /* let the kernel handle invalid cmds */
2010 break;
2011 }
2012 return rc;
2013 }
2014
2015 static int selinux_quota_on(struct dentry *dentry)
2016 {
2017 const struct cred *cred = current_cred();
2018
2019 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2020 }
2021
2022 static int selinux_syslog(int type)
2023 {
2024 int rc;
2025
2026 switch (type) {
2027 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2028 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2029 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2030 break;
2031 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2032 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2033 /* Set level of messages printed to console */
2034 case SYSLOG_ACTION_CONSOLE_LEVEL:
2035 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2036 break;
2037 case SYSLOG_ACTION_CLOSE: /* Close log */
2038 case SYSLOG_ACTION_OPEN: /* Open log */
2039 case SYSLOG_ACTION_READ: /* Read from log */
2040 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2041 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2042 default:
2043 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2044 break;
2045 }
2046 return rc;
2047 }
2048
2049 /*
2050 * Check that a process has enough memory to allocate a new virtual
2051 * mapping. 0 means there is enough memory for the allocation to
2052 * succeed and -ENOMEM implies there is not.
2053 *
2054 * Do not audit the selinux permission check, as this is applied to all
2055 * processes that allocate mappings.
2056 */
2057 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2058 {
2059 int rc, cap_sys_admin = 0;
2060
2061 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2062 SECURITY_CAP_NOAUDIT);
2063 if (rc == 0)
2064 cap_sys_admin = 1;
2065
2066 return __vm_enough_memory(mm, pages, cap_sys_admin);
2067 }
2068
2069 /* binprm security operations */
2070
2071 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2072 {
2073 const struct task_security_struct *old_tsec;
2074 struct task_security_struct *new_tsec;
2075 struct inode_security_struct *isec;
2076 struct common_audit_data ad;
2077 struct inode *inode = file_inode(bprm->file);
2078 int rc;
2079
2080 rc = cap_bprm_set_creds(bprm);
2081 if (rc)
2082 return rc;
2083
2084 /* SELinux context only depends on initial program or script and not
2085 * the script interpreter */
2086 if (bprm->cred_prepared)
2087 return 0;
2088
2089 old_tsec = current_security();
2090 new_tsec = bprm->cred->security;
2091 isec = inode->i_security;
2092
2093 /* Default to the current task SID. */
2094 new_tsec->sid = old_tsec->sid;
2095 new_tsec->osid = old_tsec->sid;
2096
2097 /* Reset fs, key, and sock SIDs on execve. */
2098 new_tsec->create_sid = 0;
2099 new_tsec->keycreate_sid = 0;
2100 new_tsec->sockcreate_sid = 0;
2101
2102 if (old_tsec->exec_sid) {
2103 new_tsec->sid = old_tsec->exec_sid;
2104 /* Reset exec SID on execve. */
2105 new_tsec->exec_sid = 0;
2106
2107 /*
2108 * Minimize confusion: if no_new_privs and a transition is
2109 * explicitly requested, then fail the exec.
2110 */
2111 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2112 return -EPERM;
2113 } else {
2114 /* Check for a default transition on this program. */
2115 rc = security_transition_sid(old_tsec->sid, isec->sid,
2116 SECCLASS_PROCESS, NULL,
2117 &new_tsec->sid);
2118 if (rc)
2119 return rc;
2120 }
2121
2122 ad.type = LSM_AUDIT_DATA_PATH;
2123 ad.u.path = bprm->file->f_path;
2124
2125 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2126 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2127 new_tsec->sid = old_tsec->sid;
2128
2129 if (new_tsec->sid == old_tsec->sid) {
2130 rc = avc_has_perm(old_tsec->sid, isec->sid,
2131 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2132 if (rc)
2133 return rc;
2134 } else {
2135 /* Check permissions for the transition. */
2136 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2137 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2138 if (rc)
2139 return rc;
2140
2141 rc = avc_has_perm(new_tsec->sid, isec->sid,
2142 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2143 if (rc)
2144 return rc;
2145
2146 /* Check for shared state */
2147 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2148 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2149 SECCLASS_PROCESS, PROCESS__SHARE,
2150 NULL);
2151 if (rc)
2152 return -EPERM;
2153 }
2154
2155 /* Make sure that anyone attempting to ptrace over a task that
2156 * changes its SID has the appropriate permit */
2157 if (bprm->unsafe &
2158 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2159 struct task_struct *tracer;
2160 struct task_security_struct *sec;
2161 u32 ptsid = 0;
2162
2163 rcu_read_lock();
2164 tracer = ptrace_parent(current);
2165 if (likely(tracer != NULL)) {
2166 sec = __task_cred(tracer)->security;
2167 ptsid = sec->sid;
2168 }
2169 rcu_read_unlock();
2170
2171 if (ptsid != 0) {
2172 rc = avc_has_perm(ptsid, new_tsec->sid,
2173 SECCLASS_PROCESS,
2174 PROCESS__PTRACE, NULL);
2175 if (rc)
2176 return -EPERM;
2177 }
2178 }
2179
2180 /* Clear any possibly unsafe personality bits on exec: */
2181 bprm->per_clear |= PER_CLEAR_ON_SETID;
2182 }
2183
2184 return 0;
2185 }
2186
2187 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2188 {
2189 const struct task_security_struct *tsec = current_security();
2190 u32 sid, osid;
2191 int atsecure = 0;
2192
2193 sid = tsec->sid;
2194 osid = tsec->osid;
2195
2196 if (osid != sid) {
2197 /* Enable secure mode for SIDs transitions unless
2198 the noatsecure permission is granted between
2199 the two SIDs, i.e. ahp returns 0. */
2200 atsecure = avc_has_perm(osid, sid,
2201 SECCLASS_PROCESS,
2202 PROCESS__NOATSECURE, NULL);
2203 }
2204
2205 return (atsecure || cap_bprm_secureexec(bprm));
2206 }
2207
2208 static int match_file(const void *p, struct file *file, unsigned fd)
2209 {
2210 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2211 }
2212
2213 /* Derived from fs/exec.c:flush_old_files. */
2214 static inline void flush_unauthorized_files(const struct cred *cred,
2215 struct files_struct *files)
2216 {
2217 struct file *file, *devnull = NULL;
2218 struct tty_struct *tty;
2219 int drop_tty = 0;
2220 unsigned n;
2221
2222 tty = get_current_tty();
2223 if (tty) {
2224 spin_lock(&tty_files_lock);
2225 if (!list_empty(&tty->tty_files)) {
2226 struct tty_file_private *file_priv;
2227
2228 /* Revalidate access to controlling tty.
2229 Use file_path_has_perm on the tty path directly
2230 rather than using file_has_perm, as this particular
2231 open file may belong to another process and we are
2232 only interested in the inode-based check here. */
2233 file_priv = list_first_entry(&tty->tty_files,
2234 struct tty_file_private, list);
2235 file = file_priv->file;
2236 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2237 drop_tty = 1;
2238 }
2239 spin_unlock(&tty_files_lock);
2240 tty_kref_put(tty);
2241 }
2242 /* Reset controlling tty. */
2243 if (drop_tty)
2244 no_tty();
2245
2246 /* Revalidate access to inherited open files. */
2247 n = iterate_fd(files, 0, match_file, cred);
2248 if (!n) /* none found? */
2249 return;
2250
2251 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2252 if (IS_ERR(devnull))
2253 devnull = NULL;
2254 /* replace all the matching ones with this */
2255 do {
2256 replace_fd(n - 1, devnull, 0);
2257 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2258 if (devnull)
2259 fput(devnull);
2260 }
2261
2262 /*
2263 * Prepare a process for imminent new credential changes due to exec
2264 */
2265 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2266 {
2267 struct task_security_struct *new_tsec;
2268 struct rlimit *rlim, *initrlim;
2269 int rc, i;
2270
2271 new_tsec = bprm->cred->security;
2272 if (new_tsec->sid == new_tsec->osid)
2273 return;
2274
2275 /* Close files for which the new task SID is not authorized. */
2276 flush_unauthorized_files(bprm->cred, current->files);
2277
2278 /* Always clear parent death signal on SID transitions. */
2279 current->pdeath_signal = 0;
2280
2281 /* Check whether the new SID can inherit resource limits from the old
2282 * SID. If not, reset all soft limits to the lower of the current
2283 * task's hard limit and the init task's soft limit.
2284 *
2285 * Note that the setting of hard limits (even to lower them) can be
2286 * controlled by the setrlimit check. The inclusion of the init task's
2287 * soft limit into the computation is to avoid resetting soft limits
2288 * higher than the default soft limit for cases where the default is
2289 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2290 */
2291 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2292 PROCESS__RLIMITINH, NULL);
2293 if (rc) {
2294 /* protect against do_prlimit() */
2295 task_lock(current);
2296 for (i = 0; i < RLIM_NLIMITS; i++) {
2297 rlim = current->signal->rlim + i;
2298 initrlim = init_task.signal->rlim + i;
2299 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2300 }
2301 task_unlock(current);
2302 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2303 }
2304 }
2305
2306 /*
2307 * Clean up the process immediately after the installation of new credentials
2308 * due to exec
2309 */
2310 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2311 {
2312 const struct task_security_struct *tsec = current_security();
2313 struct itimerval itimer;
2314 u32 osid, sid;
2315 int rc, i;
2316
2317 osid = tsec->osid;
2318 sid = tsec->sid;
2319
2320 if (sid == osid)
2321 return;
2322
2323 /* Check whether the new SID can inherit signal state from the old SID.
2324 * If not, clear itimers to avoid subsequent signal generation and
2325 * flush and unblock signals.
2326 *
2327 * This must occur _after_ the task SID has been updated so that any
2328 * kill done after the flush will be checked against the new SID.
2329 */
2330 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2331 if (rc) {
2332 memset(&itimer, 0, sizeof itimer);
2333 for (i = 0; i < 3; i++)
2334 do_setitimer(i, &itimer, NULL);
2335 spin_lock_irq(&current->sighand->siglock);
2336 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2337 __flush_signals(current);
2338 flush_signal_handlers(current, 1);
2339 sigemptyset(&current->blocked);
2340 }
2341 spin_unlock_irq(&current->sighand->siglock);
2342 }
2343
2344 /* Wake up the parent if it is waiting so that it can recheck
2345 * wait permission to the new task SID. */
2346 read_lock(&tasklist_lock);
2347 __wake_up_parent(current, current->real_parent);
2348 read_unlock(&tasklist_lock);
2349 }
2350
2351 /* superblock security operations */
2352
2353 static int selinux_sb_alloc_security(struct super_block *sb)
2354 {
2355 return superblock_alloc_security(sb);
2356 }
2357
2358 static void selinux_sb_free_security(struct super_block *sb)
2359 {
2360 superblock_free_security(sb);
2361 }
2362
2363 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2364 {
2365 if (plen > olen)
2366 return 0;
2367
2368 return !memcmp(prefix, option, plen);
2369 }
2370
2371 static inline int selinux_option(char *option, int len)
2372 {
2373 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2374 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2375 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2376 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2377 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2378 }
2379
2380 static inline void take_option(char **to, char *from, int *first, int len)
2381 {
2382 if (!*first) {
2383 **to = ',';
2384 *to += 1;
2385 } else
2386 *first = 0;
2387 memcpy(*to, from, len);
2388 *to += len;
2389 }
2390
2391 static inline void take_selinux_option(char **to, char *from, int *first,
2392 int len)
2393 {
2394 int current_size = 0;
2395
2396 if (!*first) {
2397 **to = '|';
2398 *to += 1;
2399 } else
2400 *first = 0;
2401
2402 while (current_size < len) {
2403 if (*from != '"') {
2404 **to = *from;
2405 *to += 1;
2406 }
2407 from += 1;
2408 current_size += 1;
2409 }
2410 }
2411
2412 static int selinux_sb_copy_data(char *orig, char *copy)
2413 {
2414 int fnosec, fsec, rc = 0;
2415 char *in_save, *in_curr, *in_end;
2416 char *sec_curr, *nosec_save, *nosec;
2417 int open_quote = 0;
2418
2419 in_curr = orig;
2420 sec_curr = copy;
2421
2422 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2423 if (!nosec) {
2424 rc = -ENOMEM;
2425 goto out;
2426 }
2427
2428 nosec_save = nosec;
2429 fnosec = fsec = 1;
2430 in_save = in_end = orig;
2431
2432 do {
2433 if (*in_end == '"')
2434 open_quote = !open_quote;
2435 if ((*in_end == ',' && open_quote == 0) ||
2436 *in_end == '\0') {
2437 int len = in_end - in_curr;
2438
2439 if (selinux_option(in_curr, len))
2440 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2441 else
2442 take_option(&nosec, in_curr, &fnosec, len);
2443
2444 in_curr = in_end + 1;
2445 }
2446 } while (*in_end++);
2447
2448 strcpy(in_save, nosec_save);
2449 free_page((unsigned long)nosec_save);
2450 out:
2451 return rc;
2452 }
2453
2454 static int selinux_sb_remount(struct super_block *sb, void *data)
2455 {
2456 int rc, i, *flags;
2457 struct security_mnt_opts opts;
2458 char *secdata, **mount_options;
2459 struct superblock_security_struct *sbsec = sb->s_security;
2460
2461 if (!(sbsec->flags & SE_SBINITIALIZED))
2462 return 0;
2463
2464 if (!data)
2465 return 0;
2466
2467 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2468 return 0;
2469
2470 security_init_mnt_opts(&opts);
2471 secdata = alloc_secdata();
2472 if (!secdata)
2473 return -ENOMEM;
2474 rc = selinux_sb_copy_data(data, secdata);
2475 if (rc)
2476 goto out_free_secdata;
2477
2478 rc = selinux_parse_opts_str(secdata, &opts);
2479 if (rc)
2480 goto out_free_secdata;
2481
2482 mount_options = opts.mnt_opts;
2483 flags = opts.mnt_opts_flags;
2484
2485 for (i = 0; i < opts.num_mnt_opts; i++) {
2486 u32 sid;
2487 size_t len;
2488
2489 if (flags[i] == SBLABEL_MNT)
2490 continue;
2491 len = strlen(mount_options[i]);
2492 rc = security_context_to_sid(mount_options[i], len, &sid);
2493 if (rc) {
2494 printk(KERN_WARNING "SELinux: security_context_to_sid"
2495 "(%s) failed for (dev %s, type %s) errno=%d\n",
2496 mount_options[i], sb->s_id, sb->s_type->name, rc);
2497 goto out_free_opts;
2498 }
2499 rc = -EINVAL;
2500 switch (flags[i]) {
2501 case FSCONTEXT_MNT:
2502 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2503 goto out_bad_option;
2504 break;
2505 case CONTEXT_MNT:
2506 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2507 goto out_bad_option;
2508 break;
2509 case ROOTCONTEXT_MNT: {
2510 struct inode_security_struct *root_isec;
2511 root_isec = sb->s_root->d_inode->i_security;
2512
2513 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2514 goto out_bad_option;
2515 break;
2516 }
2517 case DEFCONTEXT_MNT:
2518 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2519 goto out_bad_option;
2520 break;
2521 default:
2522 goto out_free_opts;
2523 }
2524 }
2525
2526 rc = 0;
2527 out_free_opts:
2528 security_free_mnt_opts(&opts);
2529 out_free_secdata:
2530 free_secdata(secdata);
2531 return rc;
2532 out_bad_option:
2533 printk(KERN_WARNING "SELinux: unable to change security options "
2534 "during remount (dev %s, type=%s)\n", sb->s_id,
2535 sb->s_type->name);
2536 goto out_free_opts;
2537 }
2538
2539 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2540 {
2541 const struct cred *cred = current_cred();
2542 struct common_audit_data ad;
2543 int rc;
2544
2545 rc = superblock_doinit(sb, data);
2546 if (rc)
2547 return rc;
2548
2549 /* Allow all mounts performed by the kernel */
2550 if (flags & MS_KERNMOUNT)
2551 return 0;
2552
2553 ad.type = LSM_AUDIT_DATA_DENTRY;
2554 ad.u.dentry = sb->s_root;
2555 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2556 }
2557
2558 static int selinux_sb_statfs(struct dentry *dentry)
2559 {
2560 const struct cred *cred = current_cred();
2561 struct common_audit_data ad;
2562
2563 ad.type = LSM_AUDIT_DATA_DENTRY;
2564 ad.u.dentry = dentry->d_sb->s_root;
2565 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2566 }
2567
2568 static int selinux_mount(const char *dev_name,
2569 struct path *path,
2570 const char *type,
2571 unsigned long flags,
2572 void *data)
2573 {
2574 const struct cred *cred = current_cred();
2575
2576 if (flags & MS_REMOUNT)
2577 return superblock_has_perm(cred, path->dentry->d_sb,
2578 FILESYSTEM__REMOUNT, NULL);
2579 else
2580 return path_has_perm(cred, path, FILE__MOUNTON);
2581 }
2582
2583 static int selinux_umount(struct vfsmount *mnt, int flags)
2584 {
2585 const struct cred *cred = current_cred();
2586
2587 return superblock_has_perm(cred, mnt->mnt_sb,
2588 FILESYSTEM__UNMOUNT, NULL);
2589 }
2590
2591 /* inode security operations */
2592
2593 static int selinux_inode_alloc_security(struct inode *inode)
2594 {
2595 return inode_alloc_security(inode);
2596 }
2597
2598 static void selinux_inode_free_security(struct inode *inode)
2599 {
2600 inode_free_security(inode);
2601 }
2602
2603 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2604 struct qstr *name, void **ctx,
2605 u32 *ctxlen)
2606 {
2607 const struct cred *cred = current_cred();
2608 struct task_security_struct *tsec;
2609 struct inode_security_struct *dsec;
2610 struct superblock_security_struct *sbsec;
2611 struct inode *dir = dentry->d_parent->d_inode;
2612 u32 newsid;
2613 int rc;
2614
2615 tsec = cred->security;
2616 dsec = dir->i_security;
2617 sbsec = dir->i_sb->s_security;
2618
2619 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2620 newsid = tsec->create_sid;
2621 } else {
2622 rc = security_transition_sid(tsec->sid, dsec->sid,
2623 inode_mode_to_security_class(mode),
2624 name,
2625 &newsid);
2626 if (rc) {
2627 printk(KERN_WARNING
2628 "%s: security_transition_sid failed, rc=%d\n",
2629 __func__, -rc);
2630 return rc;
2631 }
2632 }
2633
2634 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2635 }
2636
2637 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2638 const struct qstr *qstr,
2639 const char **name,
2640 void **value, size_t *len)
2641 {
2642 const struct task_security_struct *tsec = current_security();
2643 struct inode_security_struct *dsec;
2644 struct superblock_security_struct *sbsec;
2645 u32 sid, newsid, clen;
2646 int rc;
2647 char *context;
2648
2649 dsec = dir->i_security;
2650 sbsec = dir->i_sb->s_security;
2651
2652 sid = tsec->sid;
2653 newsid = tsec->create_sid;
2654
2655 if ((sbsec->flags & SE_SBINITIALIZED) &&
2656 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2657 newsid = sbsec->mntpoint_sid;
2658 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2659 rc = security_transition_sid(sid, dsec->sid,
2660 inode_mode_to_security_class(inode->i_mode),
2661 qstr, &newsid);
2662 if (rc) {
2663 printk(KERN_WARNING "%s: "
2664 "security_transition_sid failed, rc=%d (dev=%s "
2665 "ino=%ld)\n",
2666 __func__,
2667 -rc, inode->i_sb->s_id, inode->i_ino);
2668 return rc;
2669 }
2670 }
2671
2672 /* Possibly defer initialization to selinux_complete_init. */
2673 if (sbsec->flags & SE_SBINITIALIZED) {
2674 struct inode_security_struct *isec = inode->i_security;
2675 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2676 isec->sid = newsid;
2677 isec->initialized = 1;
2678 }
2679
2680 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2681 return -EOPNOTSUPP;
2682
2683 if (name)
2684 *name = XATTR_SELINUX_SUFFIX;
2685
2686 if (value && len) {
2687 rc = security_sid_to_context_force(newsid, &context, &clen);
2688 if (rc)
2689 return rc;
2690 *value = context;
2691 *len = clen;
2692 }
2693
2694 return 0;
2695 }
2696
2697 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2698 {
2699 return may_create(dir, dentry, SECCLASS_FILE);
2700 }
2701
2702 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2703 {
2704 return may_link(dir, old_dentry, MAY_LINK);
2705 }
2706
2707 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2708 {
2709 return may_link(dir, dentry, MAY_UNLINK);
2710 }
2711
2712 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2713 {
2714 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2715 }
2716
2717 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2718 {
2719 return may_create(dir, dentry, SECCLASS_DIR);
2720 }
2721
2722 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2723 {
2724 return may_link(dir, dentry, MAY_RMDIR);
2725 }
2726
2727 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2728 {
2729 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2730 }
2731
2732 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2733 struct inode *new_inode, struct dentry *new_dentry)
2734 {
2735 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2736 }
2737
2738 static int selinux_inode_readlink(struct dentry *dentry)
2739 {
2740 const struct cred *cred = current_cred();
2741
2742 return dentry_has_perm(cred, dentry, FILE__READ);
2743 }
2744
2745 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2746 {
2747 const struct cred *cred = current_cred();
2748
2749 return dentry_has_perm(cred, dentry, FILE__READ);
2750 }
2751
2752 static noinline int audit_inode_permission(struct inode *inode,
2753 u32 perms, u32 audited, u32 denied,
2754 unsigned flags)
2755 {
2756 struct common_audit_data ad;
2757 struct inode_security_struct *isec = inode->i_security;
2758 int rc;
2759
2760 ad.type = LSM_AUDIT_DATA_INODE;
2761 ad.u.inode = inode;
2762
2763 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2764 audited, denied, &ad, flags);
2765 if (rc)
2766 return rc;
2767 return 0;
2768 }
2769
2770 static int selinux_inode_permission(struct inode *inode, int mask)
2771 {
2772 const struct cred *cred = current_cred();
2773 u32 perms;
2774 bool from_access;
2775 unsigned flags = mask & MAY_NOT_BLOCK;
2776 struct inode_security_struct *isec;
2777 u32 sid;
2778 struct av_decision avd;
2779 int rc, rc2;
2780 u32 audited, denied;
2781
2782 from_access = mask & MAY_ACCESS;
2783 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2784
2785 /* No permission to check. Existence test. */
2786 if (!mask)
2787 return 0;
2788
2789 validate_creds(cred);
2790
2791 if (unlikely(IS_PRIVATE(inode)))
2792 return 0;
2793
2794 perms = file_mask_to_av(inode->i_mode, mask);
2795
2796 sid = cred_sid(cred);
2797 isec = inode->i_security;
2798
2799 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2800 audited = avc_audit_required(perms, &avd, rc,
2801 from_access ? FILE__AUDIT_ACCESS : 0,
2802 &denied);
2803 if (likely(!audited))
2804 return rc;
2805
2806 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2807 if (rc2)
2808 return rc2;
2809 return rc;
2810 }
2811
2812 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2813 {
2814 const struct cred *cred = current_cred();
2815 unsigned int ia_valid = iattr->ia_valid;
2816 __u32 av = FILE__WRITE;
2817
2818 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2819 if (ia_valid & ATTR_FORCE) {
2820 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2821 ATTR_FORCE);
2822 if (!ia_valid)
2823 return 0;
2824 }
2825
2826 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2827 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2828 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2829
2830 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2831 av |= FILE__OPEN;
2832
2833 return dentry_has_perm(cred, dentry, av);
2834 }
2835
2836 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2837 {
2838 const struct cred *cred = current_cred();
2839 struct path path;
2840
2841 path.dentry = dentry;
2842 path.mnt = mnt;
2843
2844 return path_has_perm(cred, &path, FILE__GETATTR);
2845 }
2846
2847 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2848 {
2849 const struct cred *cred = current_cred();
2850
2851 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2852 sizeof XATTR_SECURITY_PREFIX - 1)) {
2853 if (!strcmp(name, XATTR_NAME_CAPS)) {
2854 if (!capable(CAP_SETFCAP))
2855 return -EPERM;
2856 } else if (!capable(CAP_SYS_ADMIN)) {
2857 /* A different attribute in the security namespace.
2858 Restrict to administrator. */
2859 return -EPERM;
2860 }
2861 }
2862
2863 /* Not an attribute we recognize, so just check the
2864 ordinary setattr permission. */
2865 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2866 }
2867
2868 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2869 const void *value, size_t size, int flags)
2870 {
2871 struct inode *inode = dentry->d_inode;
2872 struct inode_security_struct *isec = inode->i_security;
2873 struct superblock_security_struct *sbsec;
2874 struct common_audit_data ad;
2875 u32 newsid, sid = current_sid();
2876 int rc = 0;
2877
2878 if (strcmp(name, XATTR_NAME_SELINUX))
2879 return selinux_inode_setotherxattr(dentry, name);
2880
2881 sbsec = inode->i_sb->s_security;
2882 if (!(sbsec->flags & SBLABEL_MNT))
2883 return -EOPNOTSUPP;
2884
2885 if (!inode_owner_or_capable(inode))
2886 return -EPERM;
2887
2888 ad.type = LSM_AUDIT_DATA_DENTRY;
2889 ad.u.dentry = dentry;
2890
2891 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2892 FILE__RELABELFROM, &ad);
2893 if (rc)
2894 return rc;
2895
2896 rc = security_context_to_sid(value, size, &newsid);
2897 if (rc == -EINVAL) {
2898 if (!capable(CAP_MAC_ADMIN)) {
2899 struct audit_buffer *ab;
2900 size_t audit_size;
2901 const char *str;
2902
2903 /* We strip a nul only if it is at the end, otherwise the
2904 * context contains a nul and we should audit that */
2905 if (value) {
2906 str = value;
2907 if (str[size - 1] == '\0')
2908 audit_size = size - 1;
2909 else
2910 audit_size = size;
2911 } else {
2912 str = "";
2913 audit_size = 0;
2914 }
2915 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2916 audit_log_format(ab, "op=setxattr invalid_context=");
2917 audit_log_n_untrustedstring(ab, value, audit_size);
2918 audit_log_end(ab);
2919
2920 return rc;
2921 }
2922 rc = security_context_to_sid_force(value, size, &newsid);
2923 }
2924 if (rc)
2925 return rc;
2926
2927 rc = avc_has_perm(sid, newsid, isec->sclass,
2928 FILE__RELABELTO, &ad);
2929 if (rc)
2930 return rc;
2931
2932 rc = security_validate_transition(isec->sid, newsid, sid,
2933 isec->sclass);
2934 if (rc)
2935 return rc;
2936
2937 return avc_has_perm(newsid,
2938 sbsec->sid,
2939 SECCLASS_FILESYSTEM,
2940 FILESYSTEM__ASSOCIATE,
2941 &ad);
2942 }
2943
2944 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2945 const void *value, size_t size,
2946 int flags)
2947 {
2948 struct inode *inode = dentry->d_inode;
2949 struct inode_security_struct *isec = inode->i_security;
2950 u32 newsid;
2951 int rc;
2952
2953 if (strcmp(name, XATTR_NAME_SELINUX)) {
2954 /* Not an attribute we recognize, so nothing to do. */
2955 return;
2956 }
2957
2958 rc = security_context_to_sid_force(value, size, &newsid);
2959 if (rc) {
2960 printk(KERN_ERR "SELinux: unable to map context to SID"
2961 "for (%s, %lu), rc=%d\n",
2962 inode->i_sb->s_id, inode->i_ino, -rc);
2963 return;
2964 }
2965
2966 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2967 isec->sid = newsid;
2968 isec->initialized = 1;
2969
2970 return;
2971 }
2972
2973 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2974 {
2975 const struct cred *cred = current_cred();
2976
2977 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2978 }
2979
2980 static int selinux_inode_listxattr(struct dentry *dentry)
2981 {
2982 const struct cred *cred = current_cred();
2983
2984 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2985 }
2986
2987 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2988 {
2989 if (strcmp(name, XATTR_NAME_SELINUX))
2990 return selinux_inode_setotherxattr(dentry, name);
2991
2992 /* No one is allowed to remove a SELinux security label.
2993 You can change the label, but all data must be labeled. */
2994 return -EACCES;
2995 }
2996
2997 /*
2998 * Copy the inode security context value to the user.
2999 *
3000 * Permission check is handled by selinux_inode_getxattr hook.
3001 */
3002 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3003 {
3004 u32 size;
3005 int error;
3006 char *context = NULL;
3007 struct inode_security_struct *isec = inode->i_security;
3008
3009 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3010 return -EOPNOTSUPP;
3011
3012 /*
3013 * If the caller has CAP_MAC_ADMIN, then get the raw context
3014 * value even if it is not defined by current policy; otherwise,
3015 * use the in-core value under current policy.
3016 * Use the non-auditing forms of the permission checks since
3017 * getxattr may be called by unprivileged processes commonly
3018 * and lack of permission just means that we fall back to the
3019 * in-core context value, not a denial.
3020 */
3021 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3022 SECURITY_CAP_NOAUDIT);
3023 if (!error)
3024 error = security_sid_to_context_force(isec->sid, &context,
3025 &size);
3026 else
3027 error = security_sid_to_context(isec->sid, &context, &size);
3028 if (error)
3029 return error;
3030 error = size;
3031 if (alloc) {
3032 *buffer = context;
3033 goto out_nofree;
3034 }
3035 kfree(context);
3036 out_nofree:
3037 return error;
3038 }
3039
3040 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3041 const void *value, size_t size, int flags)
3042 {
3043 struct inode_security_struct *isec = inode->i_security;
3044 u32 newsid;
3045 int rc;
3046
3047 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3048 return -EOPNOTSUPP;
3049
3050 if (!value || !size)
3051 return -EACCES;
3052
3053 rc = security_context_to_sid((void *)value, size, &newsid);
3054 if (rc)
3055 return rc;
3056
3057 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3058 isec->sid = newsid;
3059 isec->initialized = 1;
3060 return 0;
3061 }
3062
3063 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3064 {
3065 const int len = sizeof(XATTR_NAME_SELINUX);
3066 if (buffer && len <= buffer_size)
3067 memcpy(buffer, XATTR_NAME_SELINUX, len);
3068 return len;
3069 }
3070
3071 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3072 {
3073 struct inode_security_struct *isec = inode->i_security;
3074 *secid = isec->sid;
3075 }
3076
3077 /* file security operations */
3078
3079 static int selinux_revalidate_file_permission(struct file *file, int mask)
3080 {
3081 const struct cred *cred = current_cred();
3082 struct inode *inode = file_inode(file);
3083
3084 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3085 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3086 mask |= MAY_APPEND;
3087
3088 return file_has_perm(cred, file,
3089 file_mask_to_av(inode->i_mode, mask));
3090 }
3091
3092 static int selinux_file_permission(struct file *file, int mask)
3093 {
3094 struct inode *inode = file_inode(file);
3095 struct file_security_struct *fsec = file->f_security;
3096 struct inode_security_struct *isec = inode->i_security;
3097 u32 sid = current_sid();
3098
3099 if (!mask)
3100 /* No permission to check. Existence test. */
3101 return 0;
3102
3103 if (sid == fsec->sid && fsec->isid == isec->sid &&
3104 fsec->pseqno == avc_policy_seqno())
3105 /* No change since file_open check. */
3106 return 0;
3107
3108 return selinux_revalidate_file_permission(file, mask);
3109 }
3110
3111 static int selinux_file_alloc_security(struct file *file)
3112 {
3113 return file_alloc_security(file);
3114 }
3115
3116 static void selinux_file_free_security(struct file *file)
3117 {
3118 file_free_security(file);
3119 }
3120
3121 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3122 unsigned long arg)
3123 {
3124 const struct cred *cred = current_cred();
3125 int error = 0;
3126
3127 switch (cmd) {
3128 case FIONREAD:
3129 /* fall through */
3130 case FIBMAP:
3131 /* fall through */
3132 case FIGETBSZ:
3133 /* fall through */
3134 case FS_IOC_GETFLAGS:
3135 /* fall through */
3136 case FS_IOC_GETVERSION:
3137 error = file_has_perm(cred, file, FILE__GETATTR);
3138 break;
3139
3140 case FS_IOC_SETFLAGS:
3141 /* fall through */
3142 case FS_IOC_SETVERSION:
3143 error = file_has_perm(cred, file, FILE__SETATTR);
3144 break;
3145
3146 /* sys_ioctl() checks */
3147 case FIONBIO:
3148 /* fall through */
3149 case FIOASYNC:
3150 error = file_has_perm(cred, file, 0);
3151 break;
3152
3153 case KDSKBENT:
3154 case KDSKBSENT:
3155 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3156 SECURITY_CAP_AUDIT);
3157 break;
3158
3159 /* default case assumes that the command will go
3160 * to the file's ioctl() function.
3161 */
3162 default:
3163 error = file_has_perm(cred, file, FILE__IOCTL);
3164 }
3165 return error;
3166 }
3167
3168 static int default_noexec;
3169
3170 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3171 {
3172 const struct cred *cred = current_cred();
3173 int rc = 0;
3174
3175 if (default_noexec &&
3176 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3177 /*
3178 * We are making executable an anonymous mapping or a
3179 * private file mapping that will also be writable.
3180 * This has an additional check.
3181 */
3182 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3183 if (rc)
3184 goto error;
3185 }
3186
3187 if (file) {
3188 /* read access is always possible with a mapping */
3189 u32 av = FILE__READ;
3190
3191 /* write access only matters if the mapping is shared */
3192 if (shared && (prot & PROT_WRITE))
3193 av |= FILE__WRITE;
3194
3195 if (prot & PROT_EXEC)
3196 av |= FILE__EXECUTE;
3197
3198 return file_has_perm(cred, file, av);
3199 }
3200
3201 error:
3202 return rc;
3203 }
3204
3205 static int selinux_mmap_addr(unsigned long addr)
3206 {
3207 int rc = 0;
3208 u32 sid = current_sid();
3209
3210 /*
3211 * notice that we are intentionally putting the SELinux check before
3212 * the secondary cap_file_mmap check. This is such a likely attempt
3213 * at bad behaviour/exploit that we always want to get the AVC, even
3214 * if DAC would have also denied the operation.
3215 */
3216 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3217 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3218 MEMPROTECT__MMAP_ZERO, NULL);
3219 if (rc)
3220 return rc;
3221 }
3222
3223 /* do DAC check on address space usage */
3224 return cap_mmap_addr(addr);
3225 }
3226
3227 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3228 unsigned long prot, unsigned long flags)
3229 {
3230 if (selinux_checkreqprot)
3231 prot = reqprot;
3232
3233 return file_map_prot_check(file, prot,
3234 (flags & MAP_TYPE) == MAP_SHARED);
3235 }
3236
3237 static int selinux_file_mprotect(struct vm_area_struct *vma,
3238 unsigned long reqprot,
3239 unsigned long prot)
3240 {
3241 const struct cred *cred = current_cred();
3242
3243 if (selinux_checkreqprot)
3244 prot = reqprot;
3245
3246 if (default_noexec &&
3247 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3248 int rc = 0;
3249 if (vma->vm_start >= vma->vm_mm->start_brk &&
3250 vma->vm_end <= vma->vm_mm->brk) {
3251 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3252 } else if (!vma->vm_file &&
3253 vma->vm_start <= vma->vm_mm->start_stack &&
3254 vma->vm_end >= vma->vm_mm->start_stack) {
3255 rc = current_has_perm(current, PROCESS__EXECSTACK);
3256 } else if (vma->vm_file && vma->anon_vma) {
3257 /*
3258 * We are making executable a file mapping that has
3259 * had some COW done. Since pages might have been
3260 * written, check ability to execute the possibly
3261 * modified content. This typically should only
3262 * occur for text relocations.
3263 */
3264 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3265 }
3266 if (rc)
3267 return rc;
3268 }
3269
3270 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3271 }
3272
3273 static int selinux_file_lock(struct file *file, unsigned int cmd)
3274 {
3275 const struct cred *cred = current_cred();
3276
3277 return file_has_perm(cred, file, FILE__LOCK);
3278 }
3279
3280 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3281 unsigned long arg)
3282 {
3283 const struct cred *cred = current_cred();
3284 int err = 0;
3285
3286 switch (cmd) {
3287 case F_SETFL:
3288 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3289 err = file_has_perm(cred, file, FILE__WRITE);
3290 break;
3291 }
3292 /* fall through */
3293 case F_SETOWN:
3294 case F_SETSIG:
3295 case F_GETFL:
3296 case F_GETOWN:
3297 case F_GETSIG:
3298 case F_GETOWNER_UIDS:
3299 /* Just check FD__USE permission */
3300 err = file_has_perm(cred, file, 0);
3301 break;
3302 case F_GETLK:
3303 case F_SETLK:
3304 case F_SETLKW:
3305 #if BITS_PER_LONG == 32
3306 case F_GETLK64:
3307 case F_SETLK64:
3308 case F_SETLKW64:
3309 #endif
3310 err = file_has_perm(cred, file, FILE__LOCK);
3311 break;
3312 }
3313
3314 return err;
3315 }
3316
3317 static int selinux_file_set_fowner(struct file *file)
3318 {
3319 struct file_security_struct *fsec;
3320
3321 fsec = file->f_security;
3322 fsec->fown_sid = current_sid();
3323
3324 return 0;
3325 }
3326
3327 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3328 struct fown_struct *fown, int signum)
3329 {
3330 struct file *file;
3331 u32 sid = task_sid(tsk);
3332 u32 perm;
3333 struct file_security_struct *fsec;
3334
3335 /* struct fown_struct is never outside the context of a struct file */
3336 file = container_of(fown, struct file, f_owner);
3337
3338 fsec = file->f_security;
3339
3340 if (!signum)
3341 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3342 else
3343 perm = signal_to_av(signum);
3344
3345 return avc_has_perm(fsec->fown_sid, sid,
3346 SECCLASS_PROCESS, perm, NULL);
3347 }
3348
3349 static int selinux_file_receive(struct file *file)
3350 {
3351 const struct cred *cred = current_cred();
3352
3353 return file_has_perm(cred, file, file_to_av(file));
3354 }
3355
3356 static int selinux_file_open(struct file *file, const struct cred *cred)
3357 {
3358 struct file_security_struct *fsec;
3359 struct inode_security_struct *isec;
3360
3361 fsec = file->f_security;
3362 isec = file_inode(file)->i_security;
3363 /*
3364 * Save inode label and policy sequence number
3365 * at open-time so that selinux_file_permission
3366 * can determine whether revalidation is necessary.
3367 * Task label is already saved in the file security
3368 * struct as its SID.
3369 */
3370 fsec->isid = isec->sid;
3371 fsec->pseqno = avc_policy_seqno();
3372 /*
3373 * Since the inode label or policy seqno may have changed
3374 * between the selinux_inode_permission check and the saving
3375 * of state above, recheck that access is still permitted.
3376 * Otherwise, access might never be revalidated against the
3377 * new inode label or new policy.
3378 * This check is not redundant - do not remove.
3379 */
3380 return file_path_has_perm(cred, file, open_file_to_av(file));
3381 }
3382
3383 /* task security operations */
3384
3385 static int selinux_task_create(unsigned long clone_flags)
3386 {
3387 return current_has_perm(current, PROCESS__FORK);
3388 }
3389
3390 /*
3391 * allocate the SELinux part of blank credentials
3392 */
3393 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3394 {
3395 struct task_security_struct *tsec;
3396
3397 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3398 if (!tsec)
3399 return -ENOMEM;
3400
3401 cred->security = tsec;
3402 return 0;
3403 }
3404
3405 /*
3406 * detach and free the LSM part of a set of credentials
3407 */
3408 static void selinux_cred_free(struct cred *cred)
3409 {
3410 struct task_security_struct *tsec = cred->security;
3411
3412 /*
3413 * cred->security == NULL if security_cred_alloc_blank() or
3414 * security_prepare_creds() returned an error.
3415 */
3416 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3417 cred->security = (void *) 0x7UL;
3418 kfree(tsec);
3419 }
3420
3421 /*
3422 * prepare a new set of credentials for modification
3423 */
3424 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3425 gfp_t gfp)
3426 {
3427 const struct task_security_struct *old_tsec;
3428 struct task_security_struct *tsec;
3429
3430 old_tsec = old->security;
3431
3432 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3433 if (!tsec)
3434 return -ENOMEM;
3435
3436 new->security = tsec;
3437 return 0;
3438 }
3439
3440 /*
3441 * transfer the SELinux data to a blank set of creds
3442 */
3443 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3444 {
3445 const struct task_security_struct *old_tsec = old->security;
3446 struct task_security_struct *tsec = new->security;
3447
3448 *tsec = *old_tsec;
3449 }
3450
3451 /*
3452 * set the security data for a kernel service
3453 * - all the creation contexts are set to unlabelled
3454 */
3455 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3456 {
3457 struct task_security_struct *tsec = new->security;
3458 u32 sid = current_sid();
3459 int ret;
3460
3461 ret = avc_has_perm(sid, secid,
3462 SECCLASS_KERNEL_SERVICE,
3463 KERNEL_SERVICE__USE_AS_OVERRIDE,
3464 NULL);
3465 if (ret == 0) {
3466 tsec->sid = secid;
3467 tsec->create_sid = 0;
3468 tsec->keycreate_sid = 0;
3469 tsec->sockcreate_sid = 0;
3470 }
3471 return ret;
3472 }
3473
3474 /*
3475 * set the file creation context in a security record to the same as the
3476 * objective context of the specified inode
3477 */
3478 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3479 {
3480 struct inode_security_struct *isec = inode->i_security;
3481 struct task_security_struct *tsec = new->security;
3482 u32 sid = current_sid();
3483 int ret;
3484
3485 ret = avc_has_perm(sid, isec->sid,
3486 SECCLASS_KERNEL_SERVICE,
3487 KERNEL_SERVICE__CREATE_FILES_AS,
3488 NULL);
3489
3490 if (ret == 0)
3491 tsec->create_sid = isec->sid;
3492 return ret;
3493 }
3494
3495 static int selinux_kernel_module_request(char *kmod_name)
3496 {
3497 u32 sid;
3498 struct common_audit_data ad;
3499
3500 sid = task_sid(current);
3501
3502 ad.type = LSM_AUDIT_DATA_KMOD;
3503 ad.u.kmod_name = kmod_name;
3504
3505 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3506 SYSTEM__MODULE_REQUEST, &ad);
3507 }
3508
3509 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3510 {
3511 return current_has_perm(p, PROCESS__SETPGID);
3512 }
3513
3514 static int selinux_task_getpgid(struct task_struct *p)
3515 {
3516 return current_has_perm(p, PROCESS__GETPGID);
3517 }
3518
3519 static int selinux_task_getsid(struct task_struct *p)
3520 {
3521 return current_has_perm(p, PROCESS__GETSESSION);
3522 }
3523
3524 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3525 {
3526 *secid = task_sid(p);
3527 }
3528
3529 static int selinux_task_setnice(struct task_struct *p, int nice)
3530 {
3531 int rc;
3532
3533 rc = cap_task_setnice(p, nice);
3534 if (rc)
3535 return rc;
3536
3537 return current_has_perm(p, PROCESS__SETSCHED);
3538 }
3539
3540 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3541 {
3542 int rc;
3543
3544 rc = cap_task_setioprio(p, ioprio);
3545 if (rc)
3546 return rc;
3547
3548 return current_has_perm(p, PROCESS__SETSCHED);
3549 }
3550
3551 static int selinux_task_getioprio(struct task_struct *p)
3552 {
3553 return current_has_perm(p, PROCESS__GETSCHED);
3554 }
3555
3556 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3557 struct rlimit *new_rlim)
3558 {
3559 struct rlimit *old_rlim = p->signal->rlim + resource;
3560
3561 /* Control the ability to change the hard limit (whether
3562 lowering or raising it), so that the hard limit can
3563 later be used as a safe reset point for the soft limit
3564 upon context transitions. See selinux_bprm_committing_creds. */
3565 if (old_rlim->rlim_max != new_rlim->rlim_max)
3566 return current_has_perm(p, PROCESS__SETRLIMIT);
3567
3568 return 0;
3569 }
3570
3571 static int selinux_task_setscheduler(struct task_struct *p)
3572 {
3573 int rc;
3574
3575 rc = cap_task_setscheduler(p);
3576 if (rc)
3577 return rc;
3578
3579 return current_has_perm(p, PROCESS__SETSCHED);
3580 }
3581
3582 static int selinux_task_getscheduler(struct task_struct *p)
3583 {
3584 return current_has_perm(p, PROCESS__GETSCHED);
3585 }
3586
3587 static int selinux_task_movememory(struct task_struct *p)
3588 {
3589 return current_has_perm(p, PROCESS__SETSCHED);
3590 }
3591
3592 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3593 int sig, u32 secid)
3594 {
3595 u32 perm;
3596 int rc;
3597
3598 if (!sig)
3599 perm = PROCESS__SIGNULL; /* null signal; existence test */
3600 else
3601 perm = signal_to_av(sig);
3602 if (secid)
3603 rc = avc_has_perm(secid, task_sid(p),
3604 SECCLASS_PROCESS, perm, NULL);
3605 else
3606 rc = current_has_perm(p, perm);
3607 return rc;
3608 }
3609
3610 static int selinux_task_wait(struct task_struct *p)
3611 {
3612 return task_has_perm(p, current, PROCESS__SIGCHLD);
3613 }
3614
3615 static void selinux_task_to_inode(struct task_struct *p,
3616 struct inode *inode)
3617 {
3618 struct inode_security_struct *isec = inode->i_security;
3619 u32 sid = task_sid(p);
3620
3621 isec->sid = sid;
3622 isec->initialized = 1;
3623 }
3624
3625 /* Returns error only if unable to parse addresses */
3626 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3627 struct common_audit_data *ad, u8 *proto)
3628 {
3629 int offset, ihlen, ret = -EINVAL;
3630 struct iphdr _iph, *ih;
3631
3632 offset = skb_network_offset(skb);
3633 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3634 if (ih == NULL)
3635 goto out;
3636
3637 ihlen = ih->ihl * 4;
3638 if (ihlen < sizeof(_iph))
3639 goto out;
3640
3641 ad->u.net->v4info.saddr = ih->saddr;
3642 ad->u.net->v4info.daddr = ih->daddr;
3643 ret = 0;
3644
3645 if (proto)
3646 *proto = ih->protocol;
3647
3648 switch (ih->protocol) {
3649 case IPPROTO_TCP: {
3650 struct tcphdr _tcph, *th;
3651
3652 if (ntohs(ih->frag_off) & IP_OFFSET)
3653 break;
3654
3655 offset += ihlen;
3656 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3657 if (th == NULL)
3658 break;
3659
3660 ad->u.net->sport = th->source;
3661 ad->u.net->dport = th->dest;
3662 break;
3663 }
3664
3665 case IPPROTO_UDP: {
3666 struct udphdr _udph, *uh;
3667
3668 if (ntohs(ih->frag_off) & IP_OFFSET)
3669 break;
3670
3671 offset += ihlen;
3672 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3673 if (uh == NULL)
3674 break;
3675
3676 ad->u.net->sport = uh->source;
3677 ad->u.net->dport = uh->dest;
3678 break;
3679 }
3680
3681 case IPPROTO_DCCP: {
3682 struct dccp_hdr _dccph, *dh;
3683
3684 if (ntohs(ih->frag_off) & IP_OFFSET)
3685 break;
3686
3687 offset += ihlen;
3688 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3689 if (dh == NULL)
3690 break;
3691
3692 ad->u.net->sport = dh->dccph_sport;
3693 ad->u.net->dport = dh->dccph_dport;
3694 break;
3695 }
3696
3697 default:
3698 break;
3699 }
3700 out:
3701 return ret;
3702 }
3703
3704 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3705
3706 /* Returns error only if unable to parse addresses */
3707 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3708 struct common_audit_data *ad, u8 *proto)
3709 {
3710 u8 nexthdr;
3711 int ret = -EINVAL, offset;
3712 struct ipv6hdr _ipv6h, *ip6;
3713 __be16 frag_off;
3714
3715 offset = skb_network_offset(skb);
3716 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3717 if (ip6 == NULL)
3718 goto out;
3719
3720 ad->u.net->v6info.saddr = ip6->saddr;
3721 ad->u.net->v6info.daddr = ip6->daddr;
3722 ret = 0;
3723
3724 nexthdr = ip6->nexthdr;
3725 offset += sizeof(_ipv6h);
3726 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3727 if (offset < 0)
3728 goto out;
3729
3730 if (proto)
3731 *proto = nexthdr;
3732
3733 switch (nexthdr) {
3734 case IPPROTO_TCP: {
3735 struct tcphdr _tcph, *th;
3736
3737 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3738 if (th == NULL)
3739 break;
3740
3741 ad->u.net->sport = th->source;
3742 ad->u.net->dport = th->dest;
3743 break;
3744 }
3745
3746 case IPPROTO_UDP: {
3747 struct udphdr _udph, *uh;
3748
3749 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3750 if (uh == NULL)
3751 break;
3752
3753 ad->u.net->sport = uh->source;
3754 ad->u.net->dport = uh->dest;
3755 break;
3756 }
3757
3758 case IPPROTO_DCCP: {
3759 struct dccp_hdr _dccph, *dh;
3760
3761 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3762 if (dh == NULL)
3763 break;
3764
3765 ad->u.net->sport = dh->dccph_sport;
3766 ad->u.net->dport = dh->dccph_dport;
3767 break;
3768 }
3769
3770 /* includes fragments */
3771 default:
3772 break;
3773 }
3774 out:
3775 return ret;
3776 }
3777
3778 #endif /* IPV6 */
3779
3780 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3781 char **_addrp, int src, u8 *proto)
3782 {
3783 char *addrp;
3784 int ret;
3785
3786 switch (ad->u.net->family) {
3787 case PF_INET:
3788 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3789 if (ret)
3790 goto parse_error;
3791 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3792 &ad->u.net->v4info.daddr);
3793 goto okay;
3794
3795 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3796 case PF_INET6:
3797 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3798 if (ret)
3799 goto parse_error;
3800 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3801 &ad->u.net->v6info.daddr);
3802 goto okay;
3803 #endif /* IPV6 */
3804 default:
3805 addrp = NULL;
3806 goto okay;
3807 }
3808
3809 parse_error:
3810 printk(KERN_WARNING
3811 "SELinux: failure in selinux_parse_skb(),"
3812 " unable to parse packet\n");
3813 return ret;
3814
3815 okay:
3816 if (_addrp)
3817 *_addrp = addrp;
3818 return 0;
3819 }
3820
3821 /**
3822 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3823 * @skb: the packet
3824 * @family: protocol family
3825 * @sid: the packet's peer label SID
3826 *
3827 * Description:
3828 * Check the various different forms of network peer labeling and determine
3829 * the peer label/SID for the packet; most of the magic actually occurs in
3830 * the security server function security_net_peersid_cmp(). The function
3831 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3832 * or -EACCES if @sid is invalid due to inconsistencies with the different
3833 * peer labels.
3834 *
3835 */
3836 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3837 {
3838 int err;
3839 u32 xfrm_sid;
3840 u32 nlbl_sid;
3841 u32 nlbl_type;
3842
3843 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3844 if (unlikely(err))
3845 return -EACCES;
3846 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3847 if (unlikely(err))
3848 return -EACCES;
3849
3850 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3851 if (unlikely(err)) {
3852 printk(KERN_WARNING
3853 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3854 " unable to determine packet's peer label\n");
3855 return -EACCES;
3856 }
3857
3858 return 0;
3859 }
3860
3861 /**
3862 * selinux_conn_sid - Determine the child socket label for a connection
3863 * @sk_sid: the parent socket's SID
3864 * @skb_sid: the packet's SID
3865 * @conn_sid: the resulting connection SID
3866 *
3867 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3868 * combined with the MLS information from @skb_sid in order to create
3869 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3870 * of @sk_sid. Returns zero on success, negative values on failure.
3871 *
3872 */
3873 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3874 {
3875 int err = 0;
3876
3877 if (skb_sid != SECSID_NULL)
3878 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3879 else
3880 *conn_sid = sk_sid;
3881
3882 return err;
3883 }
3884
3885 /* socket security operations */
3886
3887 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3888 u16 secclass, u32 *socksid)
3889 {
3890 if (tsec->sockcreate_sid > SECSID_NULL) {
3891 *socksid = tsec->sockcreate_sid;
3892 return 0;
3893 }
3894
3895 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3896 socksid);
3897 }
3898
3899 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3900 {
3901 struct sk_security_struct *sksec = sk->sk_security;
3902 struct common_audit_data ad;
3903 struct lsm_network_audit net = {0,};
3904 u32 tsid = task_sid(task);
3905
3906 if (sksec->sid == SECINITSID_KERNEL)
3907 return 0;
3908
3909 ad.type = LSM_AUDIT_DATA_NET;
3910 ad.u.net = &net;
3911 ad.u.net->sk = sk;
3912
3913 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3914 }
3915
3916 static int selinux_socket_create(int family, int type,
3917 int protocol, int kern)
3918 {
3919 const struct task_security_struct *tsec = current_security();
3920 u32 newsid;
3921 u16 secclass;
3922 int rc;
3923
3924 if (kern)
3925 return 0;
3926
3927 secclass = socket_type_to_security_class(family, type, protocol);
3928 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3929 if (rc)
3930 return rc;
3931
3932 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3933 }
3934
3935 static int selinux_socket_post_create(struct socket *sock, int family,
3936 int type, int protocol, int kern)
3937 {
3938 const struct task_security_struct *tsec = current_security();
3939 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3940 struct sk_security_struct *sksec;
3941 int err = 0;
3942
3943 isec->sclass = socket_type_to_security_class(family, type, protocol);
3944
3945 if (kern)
3946 isec->sid = SECINITSID_KERNEL;
3947 else {
3948 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3949 if (err)
3950 return err;
3951 }
3952
3953 isec->initialized = 1;
3954
3955 if (sock->sk) {
3956 sksec = sock->sk->sk_security;
3957 sksec->sid = isec->sid;
3958 sksec->sclass = isec->sclass;
3959 err = selinux_netlbl_socket_post_create(sock->sk, family);
3960 }
3961
3962 return err;
3963 }
3964
3965 /* Range of port numbers used to automatically bind.
3966 Need to determine whether we should perform a name_bind
3967 permission check between the socket and the port number. */
3968
3969 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3970 {
3971 struct sock *sk = sock->sk;
3972 u16 family;
3973 int err;
3974
3975 err = sock_has_perm(current, sk, SOCKET__BIND);
3976 if (err)
3977 goto out;
3978
3979 /*
3980 * If PF_INET or PF_INET6, check name_bind permission for the port.
3981 * Multiple address binding for SCTP is not supported yet: we just
3982 * check the first address now.
3983 */
3984 family = sk->sk_family;
3985 if (family == PF_INET || family == PF_INET6) {
3986 char *addrp;
3987 struct sk_security_struct *sksec = sk->sk_security;
3988 struct common_audit_data ad;
3989 struct lsm_network_audit net = {0,};
3990 struct sockaddr_in *addr4 = NULL;
3991 struct sockaddr_in6 *addr6 = NULL;
3992 unsigned short snum;
3993 u32 sid, node_perm;
3994
3995 if (family == PF_INET) {
3996 addr4 = (struct sockaddr_in *)address;
3997 snum = ntohs(addr4->sin_port);
3998 addrp = (char *)&addr4->sin_addr.s_addr;
3999 } else {
4000 addr6 = (struct sockaddr_in6 *)address;
4001 snum = ntohs(addr6->sin6_port);
4002 addrp = (char *)&addr6->sin6_addr.s6_addr;
4003 }
4004
4005 if (snum) {
4006 int low, high;
4007
4008 inet_get_local_port_range(sock_net(sk), &low, &high);
4009
4010 if (snum < max(PROT_SOCK, low) || snum > high) {
4011 err = sel_netport_sid(sk->sk_protocol,
4012 snum, &sid);
4013 if (err)
4014 goto out;
4015 ad.type = LSM_AUDIT_DATA_NET;
4016 ad.u.net = &net;
4017 ad.u.net->sport = htons(snum);
4018 ad.u.net->family = family;
4019 err = avc_has_perm(sksec->sid, sid,
4020 sksec->sclass,
4021 SOCKET__NAME_BIND, &ad);
4022 if (err)
4023 goto out;
4024 }
4025 }
4026
4027 switch (sksec->sclass) {
4028 case SECCLASS_TCP_SOCKET:
4029 node_perm = TCP_SOCKET__NODE_BIND;
4030 break;
4031
4032 case SECCLASS_UDP_SOCKET:
4033 node_perm = UDP_SOCKET__NODE_BIND;
4034 break;
4035
4036 case SECCLASS_DCCP_SOCKET:
4037 node_perm = DCCP_SOCKET__NODE_BIND;
4038 break;
4039
4040 default:
4041 node_perm = RAWIP_SOCKET__NODE_BIND;
4042 break;
4043 }
4044
4045 err = sel_netnode_sid(addrp, family, &sid);
4046 if (err)
4047 goto out;
4048
4049 ad.type = LSM_AUDIT_DATA_NET;
4050 ad.u.net = &net;
4051 ad.u.net->sport = htons(snum);
4052 ad.u.net->family = family;
4053
4054 if (family == PF_INET)
4055 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4056 else
4057 ad.u.net->v6info.saddr = addr6->sin6_addr;
4058
4059 err = avc_has_perm(sksec->sid, sid,
4060 sksec->sclass, node_perm, &ad);
4061 if (err)
4062 goto out;
4063 }
4064 out:
4065 return err;
4066 }
4067
4068 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4069 {
4070 struct sock *sk = sock->sk;
4071 struct sk_security_struct *sksec = sk->sk_security;
4072 int err;
4073
4074 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4075 if (err)
4076 return err;
4077
4078 /*
4079 * If a TCP or DCCP socket, check name_connect permission for the port.
4080 */
4081 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4082 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4083 struct common_audit_data ad;
4084 struct lsm_network_audit net = {0,};
4085 struct sockaddr_in *addr4 = NULL;
4086 struct sockaddr_in6 *addr6 = NULL;
4087 unsigned short snum;
4088 u32 sid, perm;
4089
4090 if (sk->sk_family == PF_INET) {
4091 addr4 = (struct sockaddr_in *)address;
4092 if (addrlen < sizeof(struct sockaddr_in))
4093 return -EINVAL;
4094 snum = ntohs(addr4->sin_port);
4095 } else {
4096 addr6 = (struct sockaddr_in6 *)address;
4097 if (addrlen < SIN6_LEN_RFC2133)
4098 return -EINVAL;
4099 snum = ntohs(addr6->sin6_port);
4100 }
4101
4102 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4103 if (err)
4104 goto out;
4105
4106 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4107 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4108
4109 ad.type = LSM_AUDIT_DATA_NET;
4110 ad.u.net = &net;
4111 ad.u.net->dport = htons(snum);
4112 ad.u.net->family = sk->sk_family;
4113 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4114 if (err)
4115 goto out;
4116 }
4117
4118 err = selinux_netlbl_socket_connect(sk, address);
4119
4120 out:
4121 return err;
4122 }
4123
4124 static int selinux_socket_listen(struct socket *sock, int backlog)
4125 {
4126 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4127 }
4128
4129 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4130 {
4131 int err;
4132 struct inode_security_struct *isec;
4133 struct inode_security_struct *newisec;
4134
4135 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4136 if (err)
4137 return err;
4138
4139 newisec = SOCK_INODE(newsock)->i_security;
4140
4141 isec = SOCK_INODE(sock)->i_security;
4142 newisec->sclass = isec->sclass;
4143 newisec->sid = isec->sid;
4144 newisec->initialized = 1;
4145
4146 return 0;
4147 }
4148
4149 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4150 int size)
4151 {
4152 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4153 }
4154
4155 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4156 int size, int flags)
4157 {
4158 return sock_has_perm(current, sock->sk, SOCKET__READ);
4159 }
4160
4161 static int selinux_socket_getsockname(struct socket *sock)
4162 {
4163 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4164 }
4165
4166 static int selinux_socket_getpeername(struct socket *sock)
4167 {
4168 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4169 }
4170
4171 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4172 {
4173 int err;
4174
4175 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4176 if (err)
4177 return err;
4178
4179 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4180 }
4181
4182 static int selinux_socket_getsockopt(struct socket *sock, int level,
4183 int optname)
4184 {
4185 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4186 }
4187
4188 static int selinux_socket_shutdown(struct socket *sock, int how)
4189 {
4190 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4191 }
4192
4193 static int selinux_socket_unix_stream_connect(struct sock *sock,
4194 struct sock *other,
4195 struct sock *newsk)
4196 {
4197 struct sk_security_struct *sksec_sock = sock->sk_security;
4198 struct sk_security_struct *sksec_other = other->sk_security;
4199 struct sk_security_struct *sksec_new = newsk->sk_security;
4200 struct common_audit_data ad;
4201 struct lsm_network_audit net = {0,};
4202 int err;
4203
4204 ad.type = LSM_AUDIT_DATA_NET;
4205 ad.u.net = &net;
4206 ad.u.net->sk = other;
4207
4208 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4209 sksec_other->sclass,
4210 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4211 if (err)
4212 return err;
4213
4214 /* server child socket */
4215 sksec_new->peer_sid = sksec_sock->sid;
4216 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4217 &sksec_new->sid);
4218 if (err)
4219 return err;
4220
4221 /* connecting socket */
4222 sksec_sock->peer_sid = sksec_new->sid;
4223
4224 return 0;
4225 }
4226
4227 static int selinux_socket_unix_may_send(struct socket *sock,
4228 struct socket *other)
4229 {
4230 struct sk_security_struct *ssec = sock->sk->sk_security;
4231 struct sk_security_struct *osec = other->sk->sk_security;
4232 struct common_audit_data ad;
4233 struct lsm_network_audit net = {0,};
4234
4235 ad.type = LSM_AUDIT_DATA_NET;
4236 ad.u.net = &net;
4237 ad.u.net->sk = other->sk;
4238
4239 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4240 &ad);
4241 }
4242
4243 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4244 u32 peer_sid,
4245 struct common_audit_data *ad)
4246 {
4247 int err;
4248 u32 if_sid;
4249 u32 node_sid;
4250
4251 err = sel_netif_sid(ifindex, &if_sid);
4252 if (err)
4253 return err;
4254 err = avc_has_perm(peer_sid, if_sid,
4255 SECCLASS_NETIF, NETIF__INGRESS, ad);
4256 if (err)
4257 return err;
4258
4259 err = sel_netnode_sid(addrp, family, &node_sid);
4260 if (err)
4261 return err;
4262 return avc_has_perm(peer_sid, node_sid,
4263 SECCLASS_NODE, NODE__RECVFROM, ad);
4264 }
4265
4266 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4267 u16 family)
4268 {
4269 int err = 0;
4270 struct sk_security_struct *sksec = sk->sk_security;
4271 u32 sk_sid = sksec->sid;
4272 struct common_audit_data ad;
4273 struct lsm_network_audit net = {0,};
4274 char *addrp;
4275
4276 ad.type = LSM_AUDIT_DATA_NET;
4277 ad.u.net = &net;
4278 ad.u.net->netif = skb->skb_iif;
4279 ad.u.net->family = family;
4280 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4281 if (err)
4282 return err;
4283
4284 if (selinux_secmark_enabled()) {
4285 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4286 PACKET__RECV, &ad);
4287 if (err)
4288 return err;
4289 }
4290
4291 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4292 if (err)
4293 return err;
4294 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4295
4296 return err;
4297 }
4298
4299 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4300 {
4301 int err;
4302 struct sk_security_struct *sksec = sk->sk_security;
4303 u16 family = sk->sk_family;
4304 u32 sk_sid = sksec->sid;
4305 struct common_audit_data ad;
4306 struct lsm_network_audit net = {0,};
4307 char *addrp;
4308 u8 secmark_active;
4309 u8 peerlbl_active;
4310
4311 if (family != PF_INET && family != PF_INET6)
4312 return 0;
4313
4314 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4315 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4316 family = PF_INET;
4317
4318 /* If any sort of compatibility mode is enabled then handoff processing
4319 * to the selinux_sock_rcv_skb_compat() function to deal with the
4320 * special handling. We do this in an attempt to keep this function
4321 * as fast and as clean as possible. */
4322 if (!selinux_policycap_netpeer)
4323 return selinux_sock_rcv_skb_compat(sk, skb, family);
4324
4325 secmark_active = selinux_secmark_enabled();
4326 peerlbl_active = selinux_peerlbl_enabled();
4327 if (!secmark_active && !peerlbl_active)
4328 return 0;
4329
4330 ad.type = LSM_AUDIT_DATA_NET;
4331 ad.u.net = &net;
4332 ad.u.net->netif = skb->skb_iif;
4333 ad.u.net->family = family;
4334 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4335 if (err)
4336 return err;
4337
4338 if (peerlbl_active) {
4339 u32 peer_sid;
4340
4341 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4342 if (err)
4343 return err;
4344 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4345 peer_sid, &ad);
4346 if (err) {
4347 selinux_netlbl_err(skb, err, 0);
4348 return err;
4349 }
4350 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4351 PEER__RECV, &ad);
4352 if (err) {
4353 selinux_netlbl_err(skb, err, 0);
4354 return err;
4355 }
4356 }
4357
4358 if (secmark_active) {
4359 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4360 PACKET__RECV, &ad);
4361 if (err)
4362 return err;
4363 }
4364
4365 return err;
4366 }
4367
4368 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4369 int __user *optlen, unsigned len)
4370 {
4371 int err = 0;
4372 char *scontext;
4373 u32 scontext_len;
4374 struct sk_security_struct *sksec = sock->sk->sk_security;
4375 u32 peer_sid = SECSID_NULL;
4376
4377 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4378 sksec->sclass == SECCLASS_TCP_SOCKET)
4379 peer_sid = sksec->peer_sid;
4380 if (peer_sid == SECSID_NULL)
4381 return -ENOPROTOOPT;
4382
4383 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4384 if (err)
4385 return err;
4386
4387 if (scontext_len > len) {
4388 err = -ERANGE;
4389 goto out_len;
4390 }
4391
4392 if (copy_to_user(optval, scontext, scontext_len))
4393 err = -EFAULT;
4394
4395 out_len:
4396 if (put_user(scontext_len, optlen))
4397 err = -EFAULT;
4398 kfree(scontext);
4399 return err;
4400 }
4401
4402 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4403 {
4404 u32 peer_secid = SECSID_NULL;
4405 u16 family;
4406
4407 if (skb && skb->protocol == htons(ETH_P_IP))
4408 family = PF_INET;
4409 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4410 family = PF_INET6;
4411 else if (sock)
4412 family = sock->sk->sk_family;
4413 else
4414 goto out;
4415
4416 if (sock && family == PF_UNIX)
4417 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4418 else if (skb)
4419 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4420
4421 out:
4422 *secid = peer_secid;
4423 if (peer_secid == SECSID_NULL)
4424 return -EINVAL;
4425 return 0;
4426 }
4427
4428 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4429 {
4430 struct sk_security_struct *sksec;
4431
4432 sksec = kzalloc(sizeof(*sksec), priority);
4433 if (!sksec)
4434 return -ENOMEM;
4435
4436 sksec->peer_sid = SECINITSID_UNLABELED;
4437 sksec->sid = SECINITSID_UNLABELED;
4438 selinux_netlbl_sk_security_reset(sksec);
4439 sk->sk_security = sksec;
4440
4441 return 0;
4442 }
4443
4444 static void selinux_sk_free_security(struct sock *sk)
4445 {
4446 struct sk_security_struct *sksec = sk->sk_security;
4447
4448 sk->sk_security = NULL;
4449 selinux_netlbl_sk_security_free(sksec);
4450 kfree(sksec);
4451 }
4452
4453 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4454 {
4455 struct sk_security_struct *sksec = sk->sk_security;
4456 struct sk_security_struct *newsksec = newsk->sk_security;
4457
4458 newsksec->sid = sksec->sid;
4459 newsksec->peer_sid = sksec->peer_sid;
4460 newsksec->sclass = sksec->sclass;
4461
4462 selinux_netlbl_sk_security_reset(newsksec);
4463 }
4464
4465 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4466 {
4467 if (!sk)
4468 *secid = SECINITSID_ANY_SOCKET;
4469 else {
4470 struct sk_security_struct *sksec = sk->sk_security;
4471
4472 *secid = sksec->sid;
4473 }
4474 }
4475
4476 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4477 {
4478 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4479 struct sk_security_struct *sksec = sk->sk_security;
4480
4481 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4482 sk->sk_family == PF_UNIX)
4483 isec->sid = sksec->sid;
4484 sksec->sclass = isec->sclass;
4485 }
4486
4487 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4488 struct request_sock *req)
4489 {
4490 struct sk_security_struct *sksec = sk->sk_security;
4491 int err;
4492 u16 family = req->rsk_ops->family;
4493 u32 connsid;
4494 u32 peersid;
4495
4496 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4497 if (err)
4498 return err;
4499 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4500 if (err)
4501 return err;
4502 req->secid = connsid;
4503 req->peer_secid = peersid;
4504
4505 return selinux_netlbl_inet_conn_request(req, family);
4506 }
4507
4508 static void selinux_inet_csk_clone(struct sock *newsk,
4509 const struct request_sock *req)
4510 {
4511 struct sk_security_struct *newsksec = newsk->sk_security;
4512
4513 newsksec->sid = req->secid;
4514 newsksec->peer_sid = req->peer_secid;
4515 /* NOTE: Ideally, we should also get the isec->sid for the
4516 new socket in sync, but we don't have the isec available yet.
4517 So we will wait until sock_graft to do it, by which
4518 time it will have been created and available. */
4519
4520 /* We don't need to take any sort of lock here as we are the only
4521 * thread with access to newsksec */
4522 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4523 }
4524
4525 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4526 {
4527 u16 family = sk->sk_family;
4528 struct sk_security_struct *sksec = sk->sk_security;
4529
4530 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4531 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4532 family = PF_INET;
4533
4534 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4535 }
4536
4537 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4538 {
4539 skb_set_owner_w(skb, sk);
4540 }
4541
4542 static int selinux_secmark_relabel_packet(u32 sid)
4543 {
4544 const struct task_security_struct *__tsec;
4545 u32 tsid;
4546
4547 __tsec = current_security();
4548 tsid = __tsec->sid;
4549
4550 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4551 }
4552
4553 static void selinux_secmark_refcount_inc(void)
4554 {
4555 atomic_inc(&selinux_secmark_refcount);
4556 }
4557
4558 static void selinux_secmark_refcount_dec(void)
4559 {
4560 atomic_dec(&selinux_secmark_refcount);
4561 }
4562
4563 static void selinux_req_classify_flow(const struct request_sock *req,
4564 struct flowi *fl)
4565 {
4566 fl->flowi_secid = req->secid;
4567 }
4568
4569 static int selinux_tun_dev_alloc_security(void **security)
4570 {
4571 struct tun_security_struct *tunsec;
4572
4573 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4574 if (!tunsec)
4575 return -ENOMEM;
4576 tunsec->sid = current_sid();
4577
4578 *security = tunsec;
4579 return 0;
4580 }
4581
4582 static void selinux_tun_dev_free_security(void *security)
4583 {
4584 kfree(security);
4585 }
4586
4587 static int selinux_tun_dev_create(void)
4588 {
4589 u32 sid = current_sid();
4590
4591 /* we aren't taking into account the "sockcreate" SID since the socket
4592 * that is being created here is not a socket in the traditional sense,
4593 * instead it is a private sock, accessible only to the kernel, and
4594 * representing a wide range of network traffic spanning multiple
4595 * connections unlike traditional sockets - check the TUN driver to
4596 * get a better understanding of why this socket is special */
4597
4598 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4599 NULL);
4600 }
4601
4602 static int selinux_tun_dev_attach_queue(void *security)
4603 {
4604 struct tun_security_struct *tunsec = security;
4605
4606 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4607 TUN_SOCKET__ATTACH_QUEUE, NULL);
4608 }
4609
4610 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4611 {
4612 struct tun_security_struct *tunsec = security;
4613 struct sk_security_struct *sksec = sk->sk_security;
4614
4615 /* we don't currently perform any NetLabel based labeling here and it
4616 * isn't clear that we would want to do so anyway; while we could apply
4617 * labeling without the support of the TUN user the resulting labeled
4618 * traffic from the other end of the connection would almost certainly
4619 * cause confusion to the TUN user that had no idea network labeling
4620 * protocols were being used */
4621
4622 sksec->sid = tunsec->sid;
4623 sksec->sclass = SECCLASS_TUN_SOCKET;
4624
4625 return 0;
4626 }
4627
4628 static int selinux_tun_dev_open(void *security)
4629 {
4630 struct tun_security_struct *tunsec = security;
4631 u32 sid = current_sid();
4632 int err;
4633
4634 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4635 TUN_SOCKET__RELABELFROM, NULL);
4636 if (err)
4637 return err;
4638 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4639 TUN_SOCKET__RELABELTO, NULL);
4640 if (err)
4641 return err;
4642 tunsec->sid = sid;
4643
4644 return 0;
4645 }
4646
4647 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4648 {
4649 int err = 0;
4650 u32 perm;
4651 struct nlmsghdr *nlh;
4652 struct sk_security_struct *sksec = sk->sk_security;
4653
4654 if (skb->len < NLMSG_HDRLEN) {
4655 err = -EINVAL;
4656 goto out;
4657 }
4658 nlh = nlmsg_hdr(skb);
4659
4660 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4661 if (err) {
4662 if (err == -EINVAL) {
4663 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4664 "SELinux: unrecognized netlink message"
4665 " type=%hu for sclass=%hu\n",
4666 nlh->nlmsg_type, sksec->sclass);
4667 if (!selinux_enforcing || security_get_allow_unknown())
4668 err = 0;
4669 }
4670
4671 /* Ignore */
4672 if (err == -ENOENT)
4673 err = 0;
4674 goto out;
4675 }
4676
4677 err = sock_has_perm(current, sk, perm);
4678 out:
4679 return err;
4680 }
4681
4682 #ifdef CONFIG_NETFILTER
4683
4684 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4685 u16 family)
4686 {
4687 int err;
4688 char *addrp;
4689 u32 peer_sid;
4690 struct common_audit_data ad;
4691 struct lsm_network_audit net = {0,};
4692 u8 secmark_active;
4693 u8 netlbl_active;
4694 u8 peerlbl_active;
4695
4696 if (!selinux_policycap_netpeer)
4697 return NF_ACCEPT;
4698
4699 secmark_active = selinux_secmark_enabled();
4700 netlbl_active = netlbl_enabled();
4701 peerlbl_active = selinux_peerlbl_enabled();
4702 if (!secmark_active && !peerlbl_active)
4703 return NF_ACCEPT;
4704
4705 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4706 return NF_DROP;
4707
4708 ad.type = LSM_AUDIT_DATA_NET;
4709 ad.u.net = &net;
4710 ad.u.net->netif = ifindex;
4711 ad.u.net->family = family;
4712 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4713 return NF_DROP;
4714
4715 if (peerlbl_active) {
4716 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4717 peer_sid, &ad);
4718 if (err) {
4719 selinux_netlbl_err(skb, err, 1);
4720 return NF_DROP;
4721 }
4722 }
4723
4724 if (secmark_active)
4725 if (avc_has_perm(peer_sid, skb->secmark,
4726 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4727 return NF_DROP;
4728
4729 if (netlbl_active)
4730 /* we do this in the FORWARD path and not the POST_ROUTING
4731 * path because we want to make sure we apply the necessary
4732 * labeling before IPsec is applied so we can leverage AH
4733 * protection */
4734 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4735 return NF_DROP;
4736
4737 return NF_ACCEPT;
4738 }
4739
4740 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4741 struct sk_buff *skb,
4742 const struct net_device *in,
4743 const struct net_device *out,
4744 int (*okfn)(struct sk_buff *))
4745 {
4746 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4747 }
4748
4749 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4750 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4751 struct sk_buff *skb,
4752 const struct net_device *in,
4753 const struct net_device *out,
4754 int (*okfn)(struct sk_buff *))
4755 {
4756 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4757 }
4758 #endif /* IPV6 */
4759
4760 static unsigned int selinux_ip_output(struct sk_buff *skb,
4761 u16 family)
4762 {
4763 struct sock *sk;
4764 u32 sid;
4765
4766 if (!netlbl_enabled())
4767 return NF_ACCEPT;
4768
4769 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4770 * because we want to make sure we apply the necessary labeling
4771 * before IPsec is applied so we can leverage AH protection */
4772 sk = skb->sk;
4773 if (sk) {
4774 struct sk_security_struct *sksec;
4775
4776 if (sk->sk_state == TCP_LISTEN)
4777 /* if the socket is the listening state then this
4778 * packet is a SYN-ACK packet which means it needs to
4779 * be labeled based on the connection/request_sock and
4780 * not the parent socket. unfortunately, we can't
4781 * lookup the request_sock yet as it isn't queued on
4782 * the parent socket until after the SYN-ACK is sent.
4783 * the "solution" is to simply pass the packet as-is
4784 * as any IP option based labeling should be copied
4785 * from the initial connection request (in the IP
4786 * layer). it is far from ideal, but until we get a
4787 * security label in the packet itself this is the
4788 * best we can do. */
4789 return NF_ACCEPT;
4790
4791 /* standard practice, label using the parent socket */
4792 sksec = sk->sk_security;
4793 sid = sksec->sid;
4794 } else
4795 sid = SECINITSID_KERNEL;
4796 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4797 return NF_DROP;
4798
4799 return NF_ACCEPT;
4800 }
4801
4802 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4803 struct sk_buff *skb,
4804 const struct net_device *in,
4805 const struct net_device *out,
4806 int (*okfn)(struct sk_buff *))
4807 {
4808 return selinux_ip_output(skb, PF_INET);
4809 }
4810
4811 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4812 int ifindex,
4813 u16 family)
4814 {
4815 struct sock *sk = skb->sk;
4816 struct sk_security_struct *sksec;
4817 struct common_audit_data ad;
4818 struct lsm_network_audit net = {0,};
4819 char *addrp;
4820 u8 proto;
4821
4822 if (sk == NULL)
4823 return NF_ACCEPT;
4824 sksec = sk->sk_security;
4825
4826 ad.type = LSM_AUDIT_DATA_NET;
4827 ad.u.net = &net;
4828 ad.u.net->netif = ifindex;
4829 ad.u.net->family = family;
4830 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4831 return NF_DROP;
4832
4833 if (selinux_secmark_enabled())
4834 if (avc_has_perm(sksec->sid, skb->secmark,
4835 SECCLASS_PACKET, PACKET__SEND, &ad))
4836 return NF_DROP_ERR(-ECONNREFUSED);
4837
4838 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4839 return NF_DROP_ERR(-ECONNREFUSED);
4840
4841 return NF_ACCEPT;
4842 }
4843
4844 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4845 u16 family)
4846 {
4847 u32 secmark_perm;
4848 u32 peer_sid;
4849 struct sock *sk;
4850 struct common_audit_data ad;
4851 struct lsm_network_audit net = {0,};
4852 char *addrp;
4853 u8 secmark_active;
4854 u8 peerlbl_active;
4855
4856 /* If any sort of compatibility mode is enabled then handoff processing
4857 * to the selinux_ip_postroute_compat() function to deal with the
4858 * special handling. We do this in an attempt to keep this function
4859 * as fast and as clean as possible. */
4860 if (!selinux_policycap_netpeer)
4861 return selinux_ip_postroute_compat(skb, ifindex, family);
4862
4863 secmark_active = selinux_secmark_enabled();
4864 peerlbl_active = selinux_peerlbl_enabled();
4865 if (!secmark_active && !peerlbl_active)
4866 return NF_ACCEPT;
4867
4868 sk = skb->sk;
4869
4870 #ifdef CONFIG_XFRM
4871 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4872 * packet transformation so allow the packet to pass without any checks
4873 * since we'll have another chance to perform access control checks
4874 * when the packet is on it's final way out.
4875 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4876 * is NULL, in this case go ahead and apply access control.
4877 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4878 * TCP listening state we cannot wait until the XFRM processing
4879 * is done as we will miss out on the SA label if we do;
4880 * unfortunately, this means more work, but it is only once per
4881 * connection. */
4882 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4883 !(sk != NULL && sk->sk_state == TCP_LISTEN))
4884 return NF_ACCEPT;
4885 #endif
4886
4887 if (sk == NULL) {
4888 /* Without an associated socket the packet is either coming
4889 * from the kernel or it is being forwarded; check the packet
4890 * to determine which and if the packet is being forwarded
4891 * query the packet directly to determine the security label. */
4892 if (skb->skb_iif) {
4893 secmark_perm = PACKET__FORWARD_OUT;
4894 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4895 return NF_DROP;
4896 } else {
4897 secmark_perm = PACKET__SEND;
4898 peer_sid = SECINITSID_KERNEL;
4899 }
4900 } else if (sk->sk_state == TCP_LISTEN) {
4901 /* Locally generated packet but the associated socket is in the
4902 * listening state which means this is a SYN-ACK packet. In
4903 * this particular case the correct security label is assigned
4904 * to the connection/request_sock but unfortunately we can't
4905 * query the request_sock as it isn't queued on the parent
4906 * socket until after the SYN-ACK packet is sent; the only
4907 * viable choice is to regenerate the label like we do in
4908 * selinux_inet_conn_request(). See also selinux_ip_output()
4909 * for similar problems. */
4910 u32 skb_sid;
4911 struct sk_security_struct *sksec = sk->sk_security;
4912 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4913 return NF_DROP;
4914 /* At this point, if the returned skb peerlbl is SECSID_NULL
4915 * and the packet has been through at least one XFRM
4916 * transformation then we must be dealing with the "final"
4917 * form of labeled IPsec packet; since we've already applied
4918 * all of our access controls on this packet we can safely
4919 * pass the packet. */
4920 if (skb_sid == SECSID_NULL) {
4921 switch (family) {
4922 case PF_INET:
4923 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4924 return NF_ACCEPT;
4925 break;
4926 case PF_INET6:
4927 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4928 return NF_ACCEPT;
4929 default:
4930 return NF_DROP_ERR(-ECONNREFUSED);
4931 }
4932 }
4933 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4934 return NF_DROP;
4935 secmark_perm = PACKET__SEND;
4936 } else {
4937 /* Locally generated packet, fetch the security label from the
4938 * associated socket. */
4939 struct sk_security_struct *sksec = sk->sk_security;
4940 peer_sid = sksec->sid;
4941 secmark_perm = PACKET__SEND;
4942 }
4943
4944 ad.type = LSM_AUDIT_DATA_NET;
4945 ad.u.net = &net;
4946 ad.u.net->netif = ifindex;
4947 ad.u.net->family = family;
4948 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4949 return NF_DROP;
4950
4951 if (secmark_active)
4952 if (avc_has_perm(peer_sid, skb->secmark,
4953 SECCLASS_PACKET, secmark_perm, &ad))
4954 return NF_DROP_ERR(-ECONNREFUSED);
4955
4956 if (peerlbl_active) {
4957 u32 if_sid;
4958 u32 node_sid;
4959
4960 if (sel_netif_sid(ifindex, &if_sid))
4961 return NF_DROP;
4962 if (avc_has_perm(peer_sid, if_sid,
4963 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4964 return NF_DROP_ERR(-ECONNREFUSED);
4965
4966 if (sel_netnode_sid(addrp, family, &node_sid))
4967 return NF_DROP;
4968 if (avc_has_perm(peer_sid, node_sid,
4969 SECCLASS_NODE, NODE__SENDTO, &ad))
4970 return NF_DROP_ERR(-ECONNREFUSED);
4971 }
4972
4973 return NF_ACCEPT;
4974 }
4975
4976 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4977 struct sk_buff *skb,
4978 const struct net_device *in,
4979 const struct net_device *out,
4980 int (*okfn)(struct sk_buff *))
4981 {
4982 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4983 }
4984
4985 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4986 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
4987 struct sk_buff *skb,
4988 const struct net_device *in,
4989 const struct net_device *out,
4990 int (*okfn)(struct sk_buff *))
4991 {
4992 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4993 }
4994 #endif /* IPV6 */
4995
4996 #endif /* CONFIG_NETFILTER */
4997
4998 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4999 {
5000 int err;
5001
5002 err = cap_netlink_send(sk, skb);
5003 if (err)
5004 return err;
5005
5006 return selinux_nlmsg_perm(sk, skb);
5007 }
5008
5009 static int ipc_alloc_security(struct task_struct *task,
5010 struct kern_ipc_perm *perm,
5011 u16 sclass)
5012 {
5013 struct ipc_security_struct *isec;
5014 u32 sid;
5015
5016 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5017 if (!isec)
5018 return -ENOMEM;
5019
5020 sid = task_sid(task);
5021 isec->sclass = sclass;
5022 isec->sid = sid;
5023 perm->security = isec;
5024
5025 return 0;
5026 }
5027
5028 static void ipc_free_security(struct kern_ipc_perm *perm)
5029 {
5030 struct ipc_security_struct *isec = perm->security;
5031 perm->security = NULL;
5032 kfree(isec);
5033 }
5034
5035 static int msg_msg_alloc_security(struct msg_msg *msg)
5036 {
5037 struct msg_security_struct *msec;
5038
5039 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5040 if (!msec)
5041 return -ENOMEM;
5042
5043 msec->sid = SECINITSID_UNLABELED;
5044 msg->security = msec;
5045
5046 return 0;
5047 }
5048
5049 static void msg_msg_free_security(struct msg_msg *msg)
5050 {
5051 struct msg_security_struct *msec = msg->security;
5052
5053 msg->security = NULL;
5054 kfree(msec);
5055 }
5056
5057 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5058 u32 perms)
5059 {
5060 struct ipc_security_struct *isec;
5061 struct common_audit_data ad;
5062 u32 sid = current_sid();
5063
5064 isec = ipc_perms->security;
5065
5066 ad.type = LSM_AUDIT_DATA_IPC;
5067 ad.u.ipc_id = ipc_perms->key;
5068
5069 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5070 }
5071
5072 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5073 {
5074 return msg_msg_alloc_security(msg);
5075 }
5076
5077 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5078 {
5079 msg_msg_free_security(msg);
5080 }
5081
5082 /* message queue security operations */
5083 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5084 {
5085 struct ipc_security_struct *isec;
5086 struct common_audit_data ad;
5087 u32 sid = current_sid();
5088 int rc;
5089
5090 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5091 if (rc)
5092 return rc;
5093
5094 isec = msq->q_perm.security;
5095
5096 ad.type = LSM_AUDIT_DATA_IPC;
5097 ad.u.ipc_id = msq->q_perm.key;
5098
5099 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5100 MSGQ__CREATE, &ad);
5101 if (rc) {
5102 ipc_free_security(&msq->q_perm);
5103 return rc;
5104 }
5105 return 0;
5106 }
5107
5108 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5109 {
5110 ipc_free_security(&msq->q_perm);
5111 }
5112
5113 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5114 {
5115 struct ipc_security_struct *isec;
5116 struct common_audit_data ad;
5117 u32 sid = current_sid();
5118
5119 isec = msq->q_perm.security;
5120
5121 ad.type = LSM_AUDIT_DATA_IPC;
5122 ad.u.ipc_id = msq->q_perm.key;
5123
5124 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5125 MSGQ__ASSOCIATE, &ad);
5126 }
5127
5128 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5129 {
5130 int err;
5131 int perms;
5132
5133 switch (cmd) {
5134 case IPC_INFO:
5135 case MSG_INFO:
5136 /* No specific object, just general system-wide information. */
5137 return task_has_system(current, SYSTEM__IPC_INFO);
5138 case IPC_STAT:
5139 case MSG_STAT:
5140 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5141 break;
5142 case IPC_SET:
5143 perms = MSGQ__SETATTR;
5144 break;
5145 case IPC_RMID:
5146 perms = MSGQ__DESTROY;
5147 break;
5148 default:
5149 return 0;
5150 }
5151
5152 err = ipc_has_perm(&msq->q_perm, perms);
5153 return err;
5154 }
5155
5156 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5157 {
5158 struct ipc_security_struct *isec;
5159 struct msg_security_struct *msec;
5160 struct common_audit_data ad;
5161 u32 sid = current_sid();
5162 int rc;
5163
5164 isec = msq->q_perm.security;
5165 msec = msg->security;
5166
5167 /*
5168 * First time through, need to assign label to the message
5169 */
5170 if (msec->sid == SECINITSID_UNLABELED) {
5171 /*
5172 * Compute new sid based on current process and
5173 * message queue this message will be stored in
5174 */
5175 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5176 NULL, &msec->sid);
5177 if (rc)
5178 return rc;
5179 }
5180
5181 ad.type = LSM_AUDIT_DATA_IPC;
5182 ad.u.ipc_id = msq->q_perm.key;
5183
5184 /* Can this process write to the queue? */
5185 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5186 MSGQ__WRITE, &ad);
5187 if (!rc)
5188 /* Can this process send the message */
5189 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5190 MSG__SEND, &ad);
5191 if (!rc)
5192 /* Can the message be put in the queue? */
5193 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5194 MSGQ__ENQUEUE, &ad);
5195
5196 return rc;
5197 }
5198
5199 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5200 struct task_struct *target,
5201 long type, int mode)
5202 {
5203 struct ipc_security_struct *isec;
5204 struct msg_security_struct *msec;
5205 struct common_audit_data ad;
5206 u32 sid = task_sid(target);
5207 int rc;
5208
5209 isec = msq->q_perm.security;
5210 msec = msg->security;
5211
5212 ad.type = LSM_AUDIT_DATA_IPC;
5213 ad.u.ipc_id = msq->q_perm.key;
5214
5215 rc = avc_has_perm(sid, isec->sid,
5216 SECCLASS_MSGQ, MSGQ__READ, &ad);
5217 if (!rc)
5218 rc = avc_has_perm(sid, msec->sid,
5219 SECCLASS_MSG, MSG__RECEIVE, &ad);
5220 return rc;
5221 }
5222
5223 /* Shared Memory security operations */
5224 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5225 {
5226 struct ipc_security_struct *isec;
5227 struct common_audit_data ad;
5228 u32 sid = current_sid();
5229 int rc;
5230
5231 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5232 if (rc)
5233 return rc;
5234
5235 isec = shp->shm_perm.security;
5236
5237 ad.type = LSM_AUDIT_DATA_IPC;
5238 ad.u.ipc_id = shp->shm_perm.key;
5239
5240 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5241 SHM__CREATE, &ad);
5242 if (rc) {
5243 ipc_free_security(&shp->shm_perm);
5244 return rc;
5245 }
5246 return 0;
5247 }
5248
5249 static void selinux_shm_free_security(struct shmid_kernel *shp)
5250 {
5251 ipc_free_security(&shp->shm_perm);
5252 }
5253
5254 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5255 {
5256 struct ipc_security_struct *isec;
5257 struct common_audit_data ad;
5258 u32 sid = current_sid();
5259
5260 isec = shp->shm_perm.security;
5261
5262 ad.type = LSM_AUDIT_DATA_IPC;
5263 ad.u.ipc_id = shp->shm_perm.key;
5264
5265 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5266 SHM__ASSOCIATE, &ad);
5267 }
5268
5269 /* Note, at this point, shp is locked down */
5270 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5271 {
5272 int perms;
5273 int err;
5274
5275 switch (cmd) {
5276 case IPC_INFO:
5277 case SHM_INFO:
5278 /* No specific object, just general system-wide information. */
5279 return task_has_system(current, SYSTEM__IPC_INFO);
5280 case IPC_STAT:
5281 case SHM_STAT:
5282 perms = SHM__GETATTR | SHM__ASSOCIATE;
5283 break;
5284 case IPC_SET:
5285 perms = SHM__SETATTR;
5286 break;
5287 case SHM_LOCK:
5288 case SHM_UNLOCK:
5289 perms = SHM__LOCK;
5290 break;
5291 case IPC_RMID:
5292 perms = SHM__DESTROY;
5293 break;
5294 default:
5295 return 0;
5296 }
5297
5298 err = ipc_has_perm(&shp->shm_perm, perms);
5299 return err;
5300 }
5301
5302 static int selinux_shm_shmat(struct shmid_kernel *shp,
5303 char __user *shmaddr, int shmflg)
5304 {
5305 u32 perms;
5306
5307 if (shmflg & SHM_RDONLY)
5308 perms = SHM__READ;
5309 else
5310 perms = SHM__READ | SHM__WRITE;
5311
5312 return ipc_has_perm(&shp->shm_perm, perms);
5313 }
5314
5315 /* Semaphore security operations */
5316 static int selinux_sem_alloc_security(struct sem_array *sma)
5317 {
5318 struct ipc_security_struct *isec;
5319 struct common_audit_data ad;
5320 u32 sid = current_sid();
5321 int rc;
5322
5323 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5324 if (rc)
5325 return rc;
5326
5327 isec = sma->sem_perm.security;
5328
5329 ad.type = LSM_AUDIT_DATA_IPC;
5330 ad.u.ipc_id = sma->sem_perm.key;
5331
5332 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5333 SEM__CREATE, &ad);
5334 if (rc) {
5335 ipc_free_security(&sma->sem_perm);
5336 return rc;
5337 }
5338 return 0;
5339 }
5340
5341 static void selinux_sem_free_security(struct sem_array *sma)
5342 {
5343 ipc_free_security(&sma->sem_perm);
5344 }
5345
5346 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5347 {
5348 struct ipc_security_struct *isec;
5349 struct common_audit_data ad;
5350 u32 sid = current_sid();
5351
5352 isec = sma->sem_perm.security;
5353
5354 ad.type = LSM_AUDIT_DATA_IPC;
5355 ad.u.ipc_id = sma->sem_perm.key;
5356
5357 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5358 SEM__ASSOCIATE, &ad);
5359 }
5360
5361 /* Note, at this point, sma is locked down */
5362 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5363 {
5364 int err;
5365 u32 perms;
5366
5367 switch (cmd) {
5368 case IPC_INFO:
5369 case SEM_INFO:
5370 /* No specific object, just general system-wide information. */
5371 return task_has_system(current, SYSTEM__IPC_INFO);
5372 case GETPID:
5373 case GETNCNT:
5374 case GETZCNT:
5375 perms = SEM__GETATTR;
5376 break;
5377 case GETVAL:
5378 case GETALL:
5379 perms = SEM__READ;
5380 break;
5381 case SETVAL:
5382 case SETALL:
5383 perms = SEM__WRITE;
5384 break;
5385 case IPC_RMID:
5386 perms = SEM__DESTROY;
5387 break;
5388 case IPC_SET:
5389 perms = SEM__SETATTR;
5390 break;
5391 case IPC_STAT:
5392 case SEM_STAT:
5393 perms = SEM__GETATTR | SEM__ASSOCIATE;
5394 break;
5395 default:
5396 return 0;
5397 }
5398
5399 err = ipc_has_perm(&sma->sem_perm, perms);
5400 return err;
5401 }
5402
5403 static int selinux_sem_semop(struct sem_array *sma,
5404 struct sembuf *sops, unsigned nsops, int alter)
5405 {
5406 u32 perms;
5407
5408 if (alter)
5409 perms = SEM__READ | SEM__WRITE;
5410 else
5411 perms = SEM__READ;
5412
5413 return ipc_has_perm(&sma->sem_perm, perms);
5414 }
5415
5416 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5417 {
5418 u32 av = 0;
5419
5420 av = 0;
5421 if (flag & S_IRUGO)
5422 av |= IPC__UNIX_READ;
5423 if (flag & S_IWUGO)
5424 av |= IPC__UNIX_WRITE;
5425
5426 if (av == 0)
5427 return 0;
5428
5429 return ipc_has_perm(ipcp, av);
5430 }
5431
5432 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5433 {
5434 struct ipc_security_struct *isec = ipcp->security;
5435 *secid = isec->sid;
5436 }
5437
5438 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5439 {
5440 if (inode)
5441 inode_doinit_with_dentry(inode, dentry);
5442 }
5443
5444 static int selinux_getprocattr(struct task_struct *p,
5445 char *name, char **value)
5446 {
5447 const struct task_security_struct *__tsec;
5448 u32 sid;
5449 int error;
5450 unsigned len;
5451
5452 if (current != p) {
5453 error = current_has_perm(p, PROCESS__GETATTR);
5454 if (error)
5455 return error;
5456 }
5457
5458 rcu_read_lock();
5459 __tsec = __task_cred(p)->security;
5460
5461 if (!strcmp(name, "current"))
5462 sid = __tsec->sid;
5463 else if (!strcmp(name, "prev"))
5464 sid = __tsec->osid;
5465 else if (!strcmp(name, "exec"))
5466 sid = __tsec->exec_sid;
5467 else if (!strcmp(name, "fscreate"))
5468 sid = __tsec->create_sid;
5469 else if (!strcmp(name, "keycreate"))
5470 sid = __tsec->keycreate_sid;
5471 else if (!strcmp(name, "sockcreate"))
5472 sid = __tsec->sockcreate_sid;
5473 else
5474 goto invalid;
5475 rcu_read_unlock();
5476
5477 if (!sid)
5478 return 0;
5479
5480 error = security_sid_to_context(sid, value, &len);
5481 if (error)
5482 return error;
5483 return len;
5484
5485 invalid:
5486 rcu_read_unlock();
5487 return -EINVAL;
5488 }
5489
5490 static int selinux_setprocattr(struct task_struct *p,
5491 char *name, void *value, size_t size)
5492 {
5493 struct task_security_struct *tsec;
5494 struct task_struct *tracer;
5495 struct cred *new;
5496 u32 sid = 0, ptsid;
5497 int error;
5498 char *str = value;
5499
5500 if (current != p) {
5501 /* SELinux only allows a process to change its own
5502 security attributes. */
5503 return -EACCES;
5504 }
5505
5506 /*
5507 * Basic control over ability to set these attributes at all.
5508 * current == p, but we'll pass them separately in case the
5509 * above restriction is ever removed.
5510 */
5511 if (!strcmp(name, "exec"))
5512 error = current_has_perm(p, PROCESS__SETEXEC);
5513 else if (!strcmp(name, "fscreate"))
5514 error = current_has_perm(p, PROCESS__SETFSCREATE);
5515 else if (!strcmp(name, "keycreate"))
5516 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5517 else if (!strcmp(name, "sockcreate"))
5518 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5519 else if (!strcmp(name, "current"))
5520 error = current_has_perm(p, PROCESS__SETCURRENT);
5521 else
5522 error = -EINVAL;
5523 if (error)
5524 return error;
5525
5526 /* Obtain a SID for the context, if one was specified. */
5527 if (size && str[1] && str[1] != '\n') {
5528 if (str[size-1] == '\n') {
5529 str[size-1] = 0;
5530 size--;
5531 }
5532 error = security_context_to_sid(value, size, &sid);
5533 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5534 if (!capable(CAP_MAC_ADMIN)) {
5535 struct audit_buffer *ab;
5536 size_t audit_size;
5537
5538 /* We strip a nul only if it is at the end, otherwise the
5539 * context contains a nul and we should audit that */
5540 if (str[size - 1] == '\0')
5541 audit_size = size - 1;
5542 else
5543 audit_size = size;
5544 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5545 audit_log_format(ab, "op=fscreate invalid_context=");
5546 audit_log_n_untrustedstring(ab, value, audit_size);
5547 audit_log_end(ab);
5548
5549 return error;
5550 }
5551 error = security_context_to_sid_force(value, size,
5552 &sid);
5553 }
5554 if (error)
5555 return error;
5556 }
5557
5558 new = prepare_creds();
5559 if (!new)
5560 return -ENOMEM;
5561
5562 /* Permission checking based on the specified context is
5563 performed during the actual operation (execve,
5564 open/mkdir/...), when we know the full context of the
5565 operation. See selinux_bprm_set_creds for the execve
5566 checks and may_create for the file creation checks. The
5567 operation will then fail if the context is not permitted. */
5568 tsec = new->security;
5569 if (!strcmp(name, "exec")) {
5570 tsec->exec_sid = sid;
5571 } else if (!strcmp(name, "fscreate")) {
5572 tsec->create_sid = sid;
5573 } else if (!strcmp(name, "keycreate")) {
5574 error = may_create_key(sid, p);
5575 if (error)
5576 goto abort_change;
5577 tsec->keycreate_sid = sid;
5578 } else if (!strcmp(name, "sockcreate")) {
5579 tsec->sockcreate_sid = sid;
5580 } else if (!strcmp(name, "current")) {
5581 error = -EINVAL;
5582 if (sid == 0)
5583 goto abort_change;
5584
5585 /* Only allow single threaded processes to change context */
5586 error = -EPERM;
5587 if (!current_is_single_threaded()) {
5588 error = security_bounded_transition(tsec->sid, sid);
5589 if (error)
5590 goto abort_change;
5591 }
5592
5593 /* Check permissions for the transition. */
5594 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5595 PROCESS__DYNTRANSITION, NULL);
5596 if (error)
5597 goto abort_change;
5598
5599 /* Check for ptracing, and update the task SID if ok.
5600 Otherwise, leave SID unchanged and fail. */
5601 ptsid = 0;
5602 rcu_read_lock();
5603 tracer = ptrace_parent(p);
5604 if (tracer)
5605 ptsid = task_sid(tracer);
5606 rcu_read_unlock();
5607
5608 if (tracer) {
5609 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5610 PROCESS__PTRACE, NULL);
5611 if (error)
5612 goto abort_change;
5613 }
5614
5615 tsec->sid = sid;
5616 } else {
5617 error = -EINVAL;
5618 goto abort_change;
5619 }
5620
5621 commit_creds(new);
5622 return size;
5623
5624 abort_change:
5625 abort_creds(new);
5626 return error;
5627 }
5628
5629 static int selinux_ismaclabel(const char *name)
5630 {
5631 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5632 }
5633
5634 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5635 {
5636 return security_sid_to_context(secid, secdata, seclen);
5637 }
5638
5639 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5640 {
5641 return security_context_to_sid(secdata, seclen, secid);
5642 }
5643
5644 static void selinux_release_secctx(char *secdata, u32 seclen)
5645 {
5646 kfree(secdata);
5647 }
5648
5649 /*
5650 * called with inode->i_mutex locked
5651 */
5652 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5653 {
5654 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5655 }
5656
5657 /*
5658 * called with inode->i_mutex locked
5659 */
5660 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5661 {
5662 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5663 }
5664
5665 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5666 {
5667 int len = 0;
5668 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5669 ctx, true);
5670 if (len < 0)
5671 return len;
5672 *ctxlen = len;
5673 return 0;
5674 }
5675 #ifdef CONFIG_KEYS
5676
5677 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5678 unsigned long flags)
5679 {
5680 const struct task_security_struct *tsec;
5681 struct key_security_struct *ksec;
5682
5683 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5684 if (!ksec)
5685 return -ENOMEM;
5686
5687 tsec = cred->security;
5688 if (tsec->keycreate_sid)
5689 ksec->sid = tsec->keycreate_sid;
5690 else
5691 ksec->sid = tsec->sid;
5692
5693 k->security = ksec;
5694 return 0;
5695 }
5696
5697 static void selinux_key_free(struct key *k)
5698 {
5699 struct key_security_struct *ksec = k->security;
5700
5701 k->security = NULL;
5702 kfree(ksec);
5703 }
5704
5705 static int selinux_key_permission(key_ref_t key_ref,
5706 const struct cred *cred,
5707 key_perm_t perm)
5708 {
5709 struct key *key;
5710 struct key_security_struct *ksec;
5711 u32 sid;
5712
5713 /* if no specific permissions are requested, we skip the
5714 permission check. No serious, additional covert channels
5715 appear to be created. */
5716 if (perm == 0)
5717 return 0;
5718
5719 sid = cred_sid(cred);
5720
5721 key = key_ref_to_ptr(key_ref);
5722 ksec = key->security;
5723
5724 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5725 }
5726
5727 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5728 {
5729 struct key_security_struct *ksec = key->security;
5730 char *context = NULL;
5731 unsigned len;
5732 int rc;
5733
5734 rc = security_sid_to_context(ksec->sid, &context, &len);
5735 if (!rc)
5736 rc = len;
5737 *_buffer = context;
5738 return rc;
5739 }
5740
5741 #endif
5742
5743 static struct security_operations selinux_ops = {
5744 .name = "selinux",
5745
5746 .ptrace_access_check = selinux_ptrace_access_check,
5747 .ptrace_traceme = selinux_ptrace_traceme,
5748 .capget = selinux_capget,
5749 .capset = selinux_capset,
5750 .capable = selinux_capable,
5751 .quotactl = selinux_quotactl,
5752 .quota_on = selinux_quota_on,
5753 .syslog = selinux_syslog,
5754 .vm_enough_memory = selinux_vm_enough_memory,
5755
5756 .netlink_send = selinux_netlink_send,
5757
5758 .bprm_set_creds = selinux_bprm_set_creds,
5759 .bprm_committing_creds = selinux_bprm_committing_creds,
5760 .bprm_committed_creds = selinux_bprm_committed_creds,
5761 .bprm_secureexec = selinux_bprm_secureexec,
5762
5763 .sb_alloc_security = selinux_sb_alloc_security,
5764 .sb_free_security = selinux_sb_free_security,
5765 .sb_copy_data = selinux_sb_copy_data,
5766 .sb_remount = selinux_sb_remount,
5767 .sb_kern_mount = selinux_sb_kern_mount,
5768 .sb_show_options = selinux_sb_show_options,
5769 .sb_statfs = selinux_sb_statfs,
5770 .sb_mount = selinux_mount,
5771 .sb_umount = selinux_umount,
5772 .sb_set_mnt_opts = selinux_set_mnt_opts,
5773 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5774 .sb_parse_opts_str = selinux_parse_opts_str,
5775
5776 .dentry_init_security = selinux_dentry_init_security,
5777
5778 .inode_alloc_security = selinux_inode_alloc_security,
5779 .inode_free_security = selinux_inode_free_security,
5780 .inode_init_security = selinux_inode_init_security,
5781 .inode_create = selinux_inode_create,
5782 .inode_link = selinux_inode_link,
5783 .inode_unlink = selinux_inode_unlink,
5784 .inode_symlink = selinux_inode_symlink,
5785 .inode_mkdir = selinux_inode_mkdir,
5786 .inode_rmdir = selinux_inode_rmdir,
5787 .inode_mknod = selinux_inode_mknod,
5788 .inode_rename = selinux_inode_rename,
5789 .inode_readlink = selinux_inode_readlink,
5790 .inode_follow_link = selinux_inode_follow_link,
5791 .inode_permission = selinux_inode_permission,
5792 .inode_setattr = selinux_inode_setattr,
5793 .inode_getattr = selinux_inode_getattr,
5794 .inode_setxattr = selinux_inode_setxattr,
5795 .inode_post_setxattr = selinux_inode_post_setxattr,
5796 .inode_getxattr = selinux_inode_getxattr,
5797 .inode_listxattr = selinux_inode_listxattr,
5798 .inode_removexattr = selinux_inode_removexattr,
5799 .inode_getsecurity = selinux_inode_getsecurity,
5800 .inode_setsecurity = selinux_inode_setsecurity,
5801 .inode_listsecurity = selinux_inode_listsecurity,
5802 .inode_getsecid = selinux_inode_getsecid,
5803
5804 .file_permission = selinux_file_permission,
5805 .file_alloc_security = selinux_file_alloc_security,
5806 .file_free_security = selinux_file_free_security,
5807 .file_ioctl = selinux_file_ioctl,
5808 .mmap_file = selinux_mmap_file,
5809 .mmap_addr = selinux_mmap_addr,
5810 .file_mprotect = selinux_file_mprotect,
5811 .file_lock = selinux_file_lock,
5812 .file_fcntl = selinux_file_fcntl,
5813 .file_set_fowner = selinux_file_set_fowner,
5814 .file_send_sigiotask = selinux_file_send_sigiotask,
5815 .file_receive = selinux_file_receive,
5816
5817 .file_open = selinux_file_open,
5818
5819 .task_create = selinux_task_create,
5820 .cred_alloc_blank = selinux_cred_alloc_blank,
5821 .cred_free = selinux_cred_free,
5822 .cred_prepare = selinux_cred_prepare,
5823 .cred_transfer = selinux_cred_transfer,
5824 .kernel_act_as = selinux_kernel_act_as,
5825 .kernel_create_files_as = selinux_kernel_create_files_as,
5826 .kernel_module_request = selinux_kernel_module_request,
5827 .task_setpgid = selinux_task_setpgid,
5828 .task_getpgid = selinux_task_getpgid,
5829 .task_getsid = selinux_task_getsid,
5830 .task_getsecid = selinux_task_getsecid,
5831 .task_setnice = selinux_task_setnice,
5832 .task_setioprio = selinux_task_setioprio,
5833 .task_getioprio = selinux_task_getioprio,
5834 .task_setrlimit = selinux_task_setrlimit,
5835 .task_setscheduler = selinux_task_setscheduler,
5836 .task_getscheduler = selinux_task_getscheduler,
5837 .task_movememory = selinux_task_movememory,
5838 .task_kill = selinux_task_kill,
5839 .task_wait = selinux_task_wait,
5840 .task_to_inode = selinux_task_to_inode,
5841
5842 .ipc_permission = selinux_ipc_permission,
5843 .ipc_getsecid = selinux_ipc_getsecid,
5844
5845 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5846 .msg_msg_free_security = selinux_msg_msg_free_security,
5847
5848 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5849 .msg_queue_free_security = selinux_msg_queue_free_security,
5850 .msg_queue_associate = selinux_msg_queue_associate,
5851 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5852 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5853 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5854
5855 .shm_alloc_security = selinux_shm_alloc_security,
5856 .shm_free_security = selinux_shm_free_security,
5857 .shm_associate = selinux_shm_associate,
5858 .shm_shmctl = selinux_shm_shmctl,
5859 .shm_shmat = selinux_shm_shmat,
5860
5861 .sem_alloc_security = selinux_sem_alloc_security,
5862 .sem_free_security = selinux_sem_free_security,
5863 .sem_associate = selinux_sem_associate,
5864 .sem_semctl = selinux_sem_semctl,
5865 .sem_semop = selinux_sem_semop,
5866
5867 .d_instantiate = selinux_d_instantiate,
5868
5869 .getprocattr = selinux_getprocattr,
5870 .setprocattr = selinux_setprocattr,
5871
5872 .ismaclabel = selinux_ismaclabel,
5873 .secid_to_secctx = selinux_secid_to_secctx,
5874 .secctx_to_secid = selinux_secctx_to_secid,
5875 .release_secctx = selinux_release_secctx,
5876 .inode_notifysecctx = selinux_inode_notifysecctx,
5877 .inode_setsecctx = selinux_inode_setsecctx,
5878 .inode_getsecctx = selinux_inode_getsecctx,
5879
5880 .unix_stream_connect = selinux_socket_unix_stream_connect,
5881 .unix_may_send = selinux_socket_unix_may_send,
5882
5883 .socket_create = selinux_socket_create,
5884 .socket_post_create = selinux_socket_post_create,
5885 .socket_bind = selinux_socket_bind,
5886 .socket_connect = selinux_socket_connect,
5887 .socket_listen = selinux_socket_listen,
5888 .socket_accept = selinux_socket_accept,
5889 .socket_sendmsg = selinux_socket_sendmsg,
5890 .socket_recvmsg = selinux_socket_recvmsg,
5891 .socket_getsockname = selinux_socket_getsockname,
5892 .socket_getpeername = selinux_socket_getpeername,
5893 .socket_getsockopt = selinux_socket_getsockopt,
5894 .socket_setsockopt = selinux_socket_setsockopt,
5895 .socket_shutdown = selinux_socket_shutdown,
5896 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5897 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5898 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5899 .sk_alloc_security = selinux_sk_alloc_security,
5900 .sk_free_security = selinux_sk_free_security,
5901 .sk_clone_security = selinux_sk_clone_security,
5902 .sk_getsecid = selinux_sk_getsecid,
5903 .sock_graft = selinux_sock_graft,
5904 .inet_conn_request = selinux_inet_conn_request,
5905 .inet_csk_clone = selinux_inet_csk_clone,
5906 .inet_conn_established = selinux_inet_conn_established,
5907 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5908 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5909 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5910 .req_classify_flow = selinux_req_classify_flow,
5911 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5912 .tun_dev_free_security = selinux_tun_dev_free_security,
5913 .tun_dev_create = selinux_tun_dev_create,
5914 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5915 .tun_dev_attach = selinux_tun_dev_attach,
5916 .tun_dev_open = selinux_tun_dev_open,
5917 .skb_owned_by = selinux_skb_owned_by,
5918
5919 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5920 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5921 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5922 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5923 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5924 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5925 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
5926 .xfrm_state_free_security = selinux_xfrm_state_free,
5927 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5928 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5929 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5930 .xfrm_decode_session = selinux_xfrm_decode_session,
5931 #endif
5932
5933 #ifdef CONFIG_KEYS
5934 .key_alloc = selinux_key_alloc,
5935 .key_free = selinux_key_free,
5936 .key_permission = selinux_key_permission,
5937 .key_getsecurity = selinux_key_getsecurity,
5938 #endif
5939
5940 #ifdef CONFIG_AUDIT
5941 .audit_rule_init = selinux_audit_rule_init,
5942 .audit_rule_known = selinux_audit_rule_known,
5943 .audit_rule_match = selinux_audit_rule_match,
5944 .audit_rule_free = selinux_audit_rule_free,
5945 #endif
5946 };
5947
5948 static __init int selinux_init(void)
5949 {
5950 if (!security_module_enable(&selinux_ops)) {
5951 selinux_enabled = 0;
5952 return 0;
5953 }
5954
5955 if (!selinux_enabled) {
5956 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5957 return 0;
5958 }
5959
5960 printk(KERN_INFO "SELinux: Initializing.\n");
5961
5962 /* Set the security state for the initial task. */
5963 cred_init_security();
5964
5965 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5966
5967 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5968 sizeof(struct inode_security_struct),
5969 0, SLAB_PANIC, NULL);
5970 avc_init();
5971
5972 if (register_security(&selinux_ops))
5973 panic("SELinux: Unable to register with kernel.\n");
5974
5975 if (selinux_enforcing)
5976 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5977 else
5978 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5979
5980 return 0;
5981 }
5982
5983 static void delayed_superblock_init(struct super_block *sb, void *unused)
5984 {
5985 superblock_doinit(sb, NULL);
5986 }
5987
5988 void selinux_complete_init(void)
5989 {
5990 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5991
5992 /* Set up any superblocks initialized prior to the policy load. */
5993 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5994 iterate_supers(delayed_superblock_init, NULL);
5995 }
5996
5997 /* SELinux requires early initialization in order to label
5998 all processes and objects when they are created. */
5999 security_initcall(selinux_init);
6000
6001 #if defined(CONFIG_NETFILTER)
6002
6003 static struct nf_hook_ops selinux_ipv4_ops[] = {
6004 {
6005 .hook = selinux_ipv4_postroute,
6006 .owner = THIS_MODULE,
6007 .pf = NFPROTO_IPV4,
6008 .hooknum = NF_INET_POST_ROUTING,
6009 .priority = NF_IP_PRI_SELINUX_LAST,
6010 },
6011 {
6012 .hook = selinux_ipv4_forward,
6013 .owner = THIS_MODULE,
6014 .pf = NFPROTO_IPV4,
6015 .hooknum = NF_INET_FORWARD,
6016 .priority = NF_IP_PRI_SELINUX_FIRST,
6017 },
6018 {
6019 .hook = selinux_ipv4_output,
6020 .owner = THIS_MODULE,
6021 .pf = NFPROTO_IPV4,
6022 .hooknum = NF_INET_LOCAL_OUT,
6023 .priority = NF_IP_PRI_SELINUX_FIRST,
6024 }
6025 };
6026
6027 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6028
6029 static struct nf_hook_ops selinux_ipv6_ops[] = {
6030 {
6031 .hook = selinux_ipv6_postroute,
6032 .owner = THIS_MODULE,
6033 .pf = NFPROTO_IPV6,
6034 .hooknum = NF_INET_POST_ROUTING,
6035 .priority = NF_IP6_PRI_SELINUX_LAST,
6036 },
6037 {
6038 .hook = selinux_ipv6_forward,
6039 .owner = THIS_MODULE,
6040 .pf = NFPROTO_IPV6,
6041 .hooknum = NF_INET_FORWARD,
6042 .priority = NF_IP6_PRI_SELINUX_FIRST,
6043 }
6044 };
6045
6046 #endif /* IPV6 */
6047
6048 static int __init selinux_nf_ip_init(void)
6049 {
6050 int err = 0;
6051
6052 if (!selinux_enabled)
6053 goto out;
6054
6055 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6056
6057 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6058 if (err)
6059 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6060
6061 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6062 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6063 if (err)
6064 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6065 #endif /* IPV6 */
6066
6067 out:
6068 return err;
6069 }
6070
6071 __initcall(selinux_nf_ip_init);
6072
6073 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6074 static void selinux_nf_ip_exit(void)
6075 {
6076 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6077
6078 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6079 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6080 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6081 #endif /* IPV6 */
6082 }
6083 #endif
6084
6085 #else /* CONFIG_NETFILTER */
6086
6087 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6088 #define selinux_nf_ip_exit()
6089 #endif
6090
6091 #endif /* CONFIG_NETFILTER */
6092
6093 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6094 static int selinux_disabled;
6095
6096 int selinux_disable(void)
6097 {
6098 if (ss_initialized) {
6099 /* Not permitted after initial policy load. */
6100 return -EINVAL;
6101 }
6102
6103 if (selinux_disabled) {
6104 /* Only do this once. */
6105 return -EINVAL;
6106 }
6107
6108 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6109
6110 selinux_disabled = 1;
6111 selinux_enabled = 0;
6112
6113 reset_security_ops();
6114
6115 /* Try to destroy the avc node cache */
6116 avc_disable();
6117
6118 /* Unregister netfilter hooks. */
6119 selinux_nf_ip_exit();
6120
6121 /* Unregister selinuxfs. */
6122 exit_sel_fs();
6123
6124 return 0;
6125 }
6126 #endif
Linux with added FPC-III support