?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "tty: hvc: Fix data abort due to race in hvc_open"
[linux/fpc-iii.git] / security / selinux / hooks.c
blob4c037c2545c1613b2b517d583f8d696ae00452bf
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * NSA Security-Enhanced Linux (SELinux) security module
4 *
5 * This file contains the SELinux hook function implementations.
6 *
7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
11 *
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
22 */
23
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/tracehook.h>
28 #include <linux/errno.h>
29 #include <linux/sched/signal.h>
30 #include <linux/sched/task.h>
31 #include <linux/lsm_hooks.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/proc_fs.h>
40 #include <linux/swap.h>
41 #include <linux/spinlock.h>
42 #include <linux/syscalls.h>
43 #include <linux/dcache.h>
44 #include <linux/file.h>
45 #include <linux/fdtable.h>
46 #include <linux/namei.h>
47 #include <linux/mount.h>
48 #include <linux/fs_context.h>
49 #include <linux/fs_parser.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
53 #include <net/icmp.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/sctp.h>
70 #include <net/sctp/structs.h>
71 #include <linux/quota.h>
72 #include <linux/un.h> /* for Unix socket types */
73 #include <net/af_unix.h> /* for Unix socket types */
74 #include <linux/parser.h>
75 #include <linux/nfs_mount.h>
76 #include <net/ipv6.h>
77 #include <linux/hugetlb.h>
78 #include <linux/personality.h>
79 #include <linux/audit.h>
80 #include <linux/string.h>
81 #include <linux/mutex.h>
82 #include <linux/posix-timers.h>
83 #include <linux/syslog.h>
84 #include <linux/user_namespace.h>
85 #include <linux/export.h>
86 #include <linux/msg.h>
87 #include <linux/shm.h>
88 #include <linux/bpf.h>
89 #include <linux/kernfs.h>
90 #include <linux/stringhash.h> /* for hashlen_string() */
91 #include <uapi/linux/mount.h>
92 #include <linux/fsnotify.h>
93 #include <linux/fanotify.h>
94
95 #include "avc.h"
96 #include "objsec.h"
97 #include "netif.h"
98 #include "netnode.h"
99 #include "netport.h"
100 #include "ibpkey.h"
101 #include "xfrm.h"
102 #include "netlabel.h"
103 #include "audit.h"
104 #include "avc_ss.h"
105
106 struct selinux_state selinux_state;
107
108 /* SECMARK reference count */
109 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
110
111 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
112 static int selinux_enforcing_boot __initdata;
113
114 static int __init enforcing_setup(char *str)
115 {
116 unsigned long enforcing;
117 if (!kstrtoul(str, 0, &enforcing))
118 selinux_enforcing_boot = enforcing ? 1 : 0;
119 return 1;
120 }
121 __setup("enforcing=", enforcing_setup);
122 #else
123 #define selinux_enforcing_boot 1
124 #endif
125
126 int selinux_enabled_boot __initdata = 1;
127 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
128 static int __init selinux_enabled_setup(char *str)
129 {
130 unsigned long enabled;
131 if (!kstrtoul(str, 0, &enabled))
132 selinux_enabled_boot = enabled ? 1 : 0;
133 return 1;
134 }
135 __setup("selinux=", selinux_enabled_setup);
136 #endif
137
138 static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141 static int __init checkreqprot_setup(char *str)
142 {
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot)) {
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 if (checkreqprot)
148 pr_warn("SELinux: checkreqprot set to 1 via kernel parameter. This is deprecated and will be rejected in a future kernel release.\n");
149 }
150 return 1;
151 }
152 __setup("checkreqprot=", checkreqprot_setup);
153
154 /**
155 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
156 *
157 * Description:
158 * This function checks the SECMARK reference counter to see if any SECMARK
159 * targets are currently configured, if the reference counter is greater than
160 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
161 * enabled, false (0) if SECMARK is disabled. If the always_check_network
162 * policy capability is enabled, SECMARK is always considered enabled.
163 *
164 */
165 static int selinux_secmark_enabled(void)
166 {
167 return (selinux_policycap_alwaysnetwork() ||
168 atomic_read(&selinux_secmark_refcount));
169 }
170
171 /**
172 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
173 *
174 * Description:
175 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
176 * (1) if any are enabled or false (0) if neither are enabled. If the
177 * always_check_network policy capability is enabled, peer labeling
178 * is always considered enabled.
179 *
180 */
181 static int selinux_peerlbl_enabled(void)
182 {
183 return (selinux_policycap_alwaysnetwork() ||
184 netlbl_enabled() || selinux_xfrm_enabled());
185 }
186
187 static int selinux_netcache_avc_callback(u32 event)
188 {
189 if (event == AVC_CALLBACK_RESET) {
190 sel_netif_flush();
191 sel_netnode_flush();
192 sel_netport_flush();
193 synchronize_net();
194 }
195 return 0;
196 }
197
198 static int selinux_lsm_notifier_avc_callback(u32 event)
199 {
200 if (event == AVC_CALLBACK_RESET) {
201 sel_ib_pkey_flush();
202 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
203 }
204
205 return 0;
206 }
207
208 /*
209 * initialise the security for the init task
210 */
211 static void cred_init_security(void)
212 {
213 struct cred *cred = (struct cred *) current->real_cred;
214 struct task_security_struct *tsec;
215
216 tsec = selinux_cred(cred);
217 tsec->osid = tsec->sid = SECINITSID_KERNEL;
218 }
219
220 /*
221 * get the security ID of a set of credentials
222 */
223 static inline u32 cred_sid(const struct cred *cred)
224 {
225 const struct task_security_struct *tsec;
226
227 tsec = selinux_cred(cred);
228 return tsec->sid;
229 }
230
231 /*
232 * get the objective security ID of a task
233 */
234 static inline u32 task_sid(const struct task_struct *task)
235 {
236 u32 sid;
237
238 rcu_read_lock();
239 sid = cred_sid(__task_cred(task));
240 rcu_read_unlock();
241 return sid;
242 }
243
244 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
245
246 /*
247 * Try reloading inode security labels that have been marked as invalid. The
248 * @may_sleep parameter indicates when sleeping and thus reloading labels is
249 * allowed; when set to false, returns -ECHILD when the label is
250 * invalid. The @dentry parameter should be set to a dentry of the inode.
251 */
252 static int __inode_security_revalidate(struct inode *inode,
253 struct dentry *dentry,
254 bool may_sleep)
255 {
256 struct inode_security_struct *isec = selinux_inode(inode);
257
258 might_sleep_if(may_sleep);
259
260 if (selinux_initialized(&selinux_state) &&
261 isec->initialized != LABEL_INITIALIZED) {
262 if (!may_sleep)
263 return -ECHILD;
264
265 /*
266 * Try reloading the inode security label. This will fail if
267 * @opt_dentry is NULL and no dentry for this inode can be
268 * found; in that case, continue using the old label.
269 */
270 inode_doinit_with_dentry(inode, dentry);
271 }
272 return 0;
273 }
274
275 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
276 {
277 return selinux_inode(inode);
278 }
279
280 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
281 {
282 int error;
283
284 error = __inode_security_revalidate(inode, NULL, !rcu);
285 if (error)
286 return ERR_PTR(error);
287 return selinux_inode(inode);
288 }
289
290 /*
291 * Get the security label of an inode.
292 */
293 static struct inode_security_struct *inode_security(struct inode *inode)
294 {
295 __inode_security_revalidate(inode, NULL, true);
296 return selinux_inode(inode);
297 }
298
299 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
300 {
301 struct inode *inode = d_backing_inode(dentry);
302
303 return selinux_inode(inode);
304 }
305
306 /*
307 * Get the security label of a dentry's backing inode.
308 */
309 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
310 {
311 struct inode *inode = d_backing_inode(dentry);
312
313 __inode_security_revalidate(inode, dentry, true);
314 return selinux_inode(inode);
315 }
316
317 static void inode_free_security(struct inode *inode)
318 {
319 struct inode_security_struct *isec = selinux_inode(inode);
320 struct superblock_security_struct *sbsec;
321
322 if (!isec)
323 return;
324 sbsec = inode->i_sb->s_security;
325 /*
326 * As not all inode security structures are in a list, we check for
327 * empty list outside of the lock to make sure that we won't waste
328 * time taking a lock doing nothing.
329 *
330 * The list_del_init() function can be safely called more than once.
331 * It should not be possible for this function to be called with
332 * concurrent list_add(), but for better safety against future changes
333 * in the code, we use list_empty_careful() here.
334 */
335 if (!list_empty_careful(&isec->list)) {
336 spin_lock(&sbsec->isec_lock);
337 list_del_init(&isec->list);
338 spin_unlock(&sbsec->isec_lock);
339 }
340 }
341
342 static void superblock_free_security(struct super_block *sb)
343 {
344 struct superblock_security_struct *sbsec = sb->s_security;
345 sb->s_security = NULL;
346 kfree(sbsec);
347 }
348
349 struct selinux_mnt_opts {
350 const char *fscontext, *context, *rootcontext, *defcontext;
351 };
352
353 static void selinux_free_mnt_opts(void *mnt_opts)
354 {
355 struct selinux_mnt_opts *opts = mnt_opts;
356 kfree(opts->fscontext);
357 kfree(opts->context);
358 kfree(opts->rootcontext);
359 kfree(opts->defcontext);
360 kfree(opts);
361 }
362
363 enum {
364 Opt_error = -1,
365 Opt_context = 0,
366 Opt_defcontext = 1,
367 Opt_fscontext = 2,
368 Opt_rootcontext = 3,
369 Opt_seclabel = 4,
370 };
371
372 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
373 static struct {
374 const char *name;
375 int len;
376 int opt;
377 bool has_arg;
378 } tokens[] = {
379 A(context, true),
380 A(fscontext, true),
381 A(defcontext, true),
382 A(rootcontext, true),
383 A(seclabel, false),
384 };
385 #undef A
386
387 static int match_opt_prefix(char *s, int l, char **arg)
388 {
389 int i;
390
391 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
392 size_t len = tokens[i].len;
393 if (len > l || memcmp(s, tokens[i].name, len))
394 continue;
395 if (tokens[i].has_arg) {
396 if (len == l || s[len] != '=')
397 continue;
398 *arg = s + len + 1;
399 } else if (len != l)
400 continue;
401 return tokens[i].opt;
402 }
403 return Opt_error;
404 }
405
406 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
407
408 static int may_context_mount_sb_relabel(u32 sid,
409 struct superblock_security_struct *sbsec,
410 const struct cred *cred)
411 {
412 const struct task_security_struct *tsec = selinux_cred(cred);
413 int rc;
414
415 rc = avc_has_perm(&selinux_state,
416 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
417 FILESYSTEM__RELABELFROM, NULL);
418 if (rc)
419 return rc;
420
421 rc = avc_has_perm(&selinux_state,
422 tsec->sid, sid, SECCLASS_FILESYSTEM,
423 FILESYSTEM__RELABELTO, NULL);
424 return rc;
425 }
426
427 static int may_context_mount_inode_relabel(u32 sid,
428 struct superblock_security_struct *sbsec,
429 const struct cred *cred)
430 {
431 const struct task_security_struct *tsec = selinux_cred(cred);
432 int rc;
433 rc = avc_has_perm(&selinux_state,
434 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
435 FILESYSTEM__RELABELFROM, NULL);
436 if (rc)
437 return rc;
438
439 rc = avc_has_perm(&selinux_state,
440 sid, sbsec->sid, SECCLASS_FILESYSTEM,
441 FILESYSTEM__ASSOCIATE, NULL);
442 return rc;
443 }
444
445 static int selinux_is_genfs_special_handling(struct super_block *sb)
446 {
447 /* Special handling. Genfs but also in-core setxattr handler */
448 return !strcmp(sb->s_type->name, "sysfs") ||
449 !strcmp(sb->s_type->name, "pstore") ||
450 !strcmp(sb->s_type->name, "debugfs") ||
451 !strcmp(sb->s_type->name, "tracefs") ||
452 !strcmp(sb->s_type->name, "rootfs") ||
453 (selinux_policycap_cgroupseclabel() &&
454 (!strcmp(sb->s_type->name, "cgroup") ||
455 !strcmp(sb->s_type->name, "cgroup2")));
456 }
457
458 static int selinux_is_sblabel_mnt(struct super_block *sb)
459 {
460 struct superblock_security_struct *sbsec = sb->s_security;
461
462 /*
463 * IMPORTANT: Double-check logic in this function when adding a new
464 * SECURITY_FS_USE_* definition!
465 */
466 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
467
468 switch (sbsec->behavior) {
469 case SECURITY_FS_USE_XATTR:
470 case SECURITY_FS_USE_TRANS:
471 case SECURITY_FS_USE_TASK:
472 case SECURITY_FS_USE_NATIVE:
473 return 1;
474
475 case SECURITY_FS_USE_GENFS:
476 return selinux_is_genfs_special_handling(sb);
477
478 /* Never allow relabeling on context mounts */
479 case SECURITY_FS_USE_MNTPOINT:
480 case SECURITY_FS_USE_NONE:
481 default:
482 return 0;
483 }
484 }
485
486 static int sb_finish_set_opts(struct super_block *sb)
487 {
488 struct superblock_security_struct *sbsec = sb->s_security;
489 struct dentry *root = sb->s_root;
490 struct inode *root_inode = d_backing_inode(root);
491 int rc = 0;
492
493 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
494 /* Make sure that the xattr handler exists and that no
495 error other than -ENODATA is returned by getxattr on
496 the root directory. -ENODATA is ok, as this may be
497 the first boot of the SELinux kernel before we have
498 assigned xattr values to the filesystem. */
499 if (!(root_inode->i_opflags & IOP_XATTR)) {
500 pr_warn("SELinux: (dev %s, type %s) has no "
501 "xattr support\n", sb->s_id, sb->s_type->name);
502 rc = -EOPNOTSUPP;
503 goto out;
504 }
505
506 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
507 if (rc < 0 && rc != -ENODATA) {
508 if (rc == -EOPNOTSUPP)
509 pr_warn("SELinux: (dev %s, type "
510 "%s) has no security xattr handler\n",
511 sb->s_id, sb->s_type->name);
512 else
513 pr_warn("SELinux: (dev %s, type "
514 "%s) getxattr errno %d\n", sb->s_id,
515 sb->s_type->name, -rc);
516 goto out;
517 }
518 }
519
520 sbsec->flags |= SE_SBINITIALIZED;
521
522 /*
523 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
524 * leave the flag untouched because sb_clone_mnt_opts might be handing
525 * us a superblock that needs the flag to be cleared.
526 */
527 if (selinux_is_sblabel_mnt(sb))
528 sbsec->flags |= SBLABEL_MNT;
529 else
530 sbsec->flags &= ~SBLABEL_MNT;
531
532 /* Initialize the root inode. */
533 rc = inode_doinit_with_dentry(root_inode, root);
534
535 /* Initialize any other inodes associated with the superblock, e.g.
536 inodes created prior to initial policy load or inodes created
537 during get_sb by a pseudo filesystem that directly
538 populates itself. */
539 spin_lock(&sbsec->isec_lock);
540 while (!list_empty(&sbsec->isec_head)) {
541 struct inode_security_struct *isec =
542 list_first_entry(&sbsec->isec_head,
543 struct inode_security_struct, list);
544 struct inode *inode = isec->inode;
545 list_del_init(&isec->list);
546 spin_unlock(&sbsec->isec_lock);
547 inode = igrab(inode);
548 if (inode) {
549 if (!IS_PRIVATE(inode))
550 inode_doinit_with_dentry(inode, NULL);
551 iput(inode);
552 }
553 spin_lock(&sbsec->isec_lock);
554 }
555 spin_unlock(&sbsec->isec_lock);
556 out:
557 return rc;
558 }
559
560 static int bad_option(struct superblock_security_struct *sbsec, char flag,
561 u32 old_sid, u32 new_sid)
562 {
563 char mnt_flags = sbsec->flags & SE_MNTMASK;
564
565 /* check if the old mount command had the same options */
566 if (sbsec->flags & SE_SBINITIALIZED)
567 if (!(sbsec->flags & flag) ||
568 (old_sid != new_sid))
569 return 1;
570
571 /* check if we were passed the same options twice,
572 * aka someone passed context=a,context=b
573 */
574 if (!(sbsec->flags & SE_SBINITIALIZED))
575 if (mnt_flags & flag)
576 return 1;
577 return 0;
578 }
579
580 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
581 {
582 int rc = security_context_str_to_sid(&selinux_state, s,
583 sid, GFP_KERNEL);
584 if (rc)
585 pr_warn("SELinux: security_context_str_to_sid"
586 "(%s) failed for (dev %s, type %s) errno=%d\n",
587 s, sb->s_id, sb->s_type->name, rc);
588 return rc;
589 }
590
591 /*
592 * Allow filesystems with binary mount data to explicitly set mount point
593 * labeling information.
594 */
595 static int selinux_set_mnt_opts(struct super_block *sb,
596 void *mnt_opts,
597 unsigned long kern_flags,
598 unsigned long *set_kern_flags)
599 {
600 const struct cred *cred = current_cred();
601 struct superblock_security_struct *sbsec = sb->s_security;
602 struct dentry *root = sbsec->sb->s_root;
603 struct selinux_mnt_opts *opts = mnt_opts;
604 struct inode_security_struct *root_isec;
605 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
606 u32 defcontext_sid = 0;
607 int rc = 0;
608
609 mutex_lock(&sbsec->lock);
610
611 if (!selinux_initialized(&selinux_state)) {
612 if (!opts) {
613 /* Defer initialization until selinux_complete_init,
614 after the initial policy is loaded and the security
615 server is ready to handle calls. */
616 goto out;
617 }
618 rc = -EINVAL;
619 pr_warn("SELinux: Unable to set superblock options "
620 "before the security server is initialized\n");
621 goto out;
622 }
623 if (kern_flags && !set_kern_flags) {
624 /* Specifying internal flags without providing a place to
625 * place the results is not allowed */
626 rc = -EINVAL;
627 goto out;
628 }
629
630 /*
631 * Binary mount data FS will come through this function twice. Once
632 * from an explicit call and once from the generic calls from the vfs.
633 * Since the generic VFS calls will not contain any security mount data
634 * we need to skip the double mount verification.
635 *
636 * This does open a hole in which we will not notice if the first
637 * mount using this sb set explict options and a second mount using
638 * this sb does not set any security options. (The first options
639 * will be used for both mounts)
640 */
641 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
642 && !opts)
643 goto out;
644
645 root_isec = backing_inode_security_novalidate(root);
646
647 /*
648 * parse the mount options, check if they are valid sids.
649 * also check if someone is trying to mount the same sb more
650 * than once with different security options.
651 */
652 if (opts) {
653 if (opts->fscontext) {
654 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
655 if (rc)
656 goto out;
657 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
658 fscontext_sid))
659 goto out_double_mount;
660 sbsec->flags |= FSCONTEXT_MNT;
661 }
662 if (opts->context) {
663 rc = parse_sid(sb, opts->context, &context_sid);
664 if (rc)
665 goto out;
666 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
667 context_sid))
668 goto out_double_mount;
669 sbsec->flags |= CONTEXT_MNT;
670 }
671 if (opts->rootcontext) {
672 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
673 if (rc)
674 goto out;
675 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
676 rootcontext_sid))
677 goto out_double_mount;
678 sbsec->flags |= ROOTCONTEXT_MNT;
679 }
680 if (opts->defcontext) {
681 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
682 if (rc)
683 goto out;
684 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
685 defcontext_sid))
686 goto out_double_mount;
687 sbsec->flags |= DEFCONTEXT_MNT;
688 }
689 }
690
691 if (sbsec->flags & SE_SBINITIALIZED) {
692 /* previously mounted with options, but not on this attempt? */
693 if ((sbsec->flags & SE_MNTMASK) && !opts)
694 goto out_double_mount;
695 rc = 0;
696 goto out;
697 }
698
699 if (strcmp(sb->s_type->name, "proc") == 0)
700 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
701
702 if (!strcmp(sb->s_type->name, "debugfs") ||
703 !strcmp(sb->s_type->name, "tracefs") ||
704 !strcmp(sb->s_type->name, "binder") ||
705 !strcmp(sb->s_type->name, "bpf") ||
706 !strcmp(sb->s_type->name, "pstore"))
707 sbsec->flags |= SE_SBGENFS;
708
709 if (!strcmp(sb->s_type->name, "sysfs") ||
710 !strcmp(sb->s_type->name, "cgroup") ||
711 !strcmp(sb->s_type->name, "cgroup2"))
712 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
713
714 if (!sbsec->behavior) {
715 /*
716 * Determine the labeling behavior to use for this
717 * filesystem type.
718 */
719 rc = security_fs_use(&selinux_state, sb);
720 if (rc) {
721 pr_warn("%s: security_fs_use(%s) returned %d\n",
722 __func__, sb->s_type->name, rc);
723 goto out;
724 }
725 }
726
727 /*
728 * If this is a user namespace mount and the filesystem type is not
729 * explicitly whitelisted, then no contexts are allowed on the command
730 * line and security labels must be ignored.
731 */
732 if (sb->s_user_ns != &init_user_ns &&
733 strcmp(sb->s_type->name, "tmpfs") &&
734 strcmp(sb->s_type->name, "ramfs") &&
735 strcmp(sb->s_type->name, "devpts")) {
736 if (context_sid || fscontext_sid || rootcontext_sid ||
737 defcontext_sid) {
738 rc = -EACCES;
739 goto out;
740 }
741 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
742 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
743 rc = security_transition_sid(&selinux_state,
744 current_sid(),
745 current_sid(),
746 SECCLASS_FILE, NULL,
747 &sbsec->mntpoint_sid);
748 if (rc)
749 goto out;
750 }
751 goto out_set_opts;
752 }
753
754 /* sets the context of the superblock for the fs being mounted. */
755 if (fscontext_sid) {
756 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
757 if (rc)
758 goto out;
759
760 sbsec->sid = fscontext_sid;
761 }
762
763 /*
764 * Switch to using mount point labeling behavior.
765 * sets the label used on all file below the mountpoint, and will set
766 * the superblock context if not already set.
767 */
768 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
769 sbsec->behavior = SECURITY_FS_USE_NATIVE;
770 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
771 }
772
773 if (context_sid) {
774 if (!fscontext_sid) {
775 rc = may_context_mount_sb_relabel(context_sid, sbsec,
776 cred);
777 if (rc)
778 goto out;
779 sbsec->sid = context_sid;
780 } else {
781 rc = may_context_mount_inode_relabel(context_sid, sbsec,
782 cred);
783 if (rc)
784 goto out;
785 }
786 if (!rootcontext_sid)
787 rootcontext_sid = context_sid;
788
789 sbsec->mntpoint_sid = context_sid;
790 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
791 }
792
793 if (rootcontext_sid) {
794 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
795 cred);
796 if (rc)
797 goto out;
798
799 root_isec->sid = rootcontext_sid;
800 root_isec->initialized = LABEL_INITIALIZED;
801 }
802
803 if (defcontext_sid) {
804 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
805 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
806 rc = -EINVAL;
807 pr_warn("SELinux: defcontext option is "
808 "invalid for this filesystem type\n");
809 goto out;
810 }
811
812 if (defcontext_sid != sbsec->def_sid) {
813 rc = may_context_mount_inode_relabel(defcontext_sid,
814 sbsec, cred);
815 if (rc)
816 goto out;
817 }
818
819 sbsec->def_sid = defcontext_sid;
820 }
821
822 out_set_opts:
823 rc = sb_finish_set_opts(sb);
824 out:
825 mutex_unlock(&sbsec->lock);
826 return rc;
827 out_double_mount:
828 rc = -EINVAL;
829 pr_warn("SELinux: mount invalid. Same superblock, different "
830 "security settings for (dev %s, type %s)\n", sb->s_id,
831 sb->s_type->name);
832 goto out;
833 }
834
835 static int selinux_cmp_sb_context(const struct super_block *oldsb,
836 const struct super_block *newsb)
837 {
838 struct superblock_security_struct *old = oldsb->s_security;
839 struct superblock_security_struct *new = newsb->s_security;
840 char oldflags = old->flags & SE_MNTMASK;
841 char newflags = new->flags & SE_MNTMASK;
842
843 if (oldflags != newflags)
844 goto mismatch;
845 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
846 goto mismatch;
847 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
848 goto mismatch;
849 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
850 goto mismatch;
851 if (oldflags & ROOTCONTEXT_MNT) {
852 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
853 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
854 if (oldroot->sid != newroot->sid)
855 goto mismatch;
856 }
857 return 0;
858 mismatch:
859 pr_warn("SELinux: mount invalid. Same superblock, "
860 "different security settings for (dev %s, "
861 "type %s)\n", newsb->s_id, newsb->s_type->name);
862 return -EBUSY;
863 }
864
865 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
866 struct super_block *newsb,
867 unsigned long kern_flags,
868 unsigned long *set_kern_flags)
869 {
870 int rc = 0;
871 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
872 struct superblock_security_struct *newsbsec = newsb->s_security;
873
874 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
875 int set_context = (oldsbsec->flags & CONTEXT_MNT);
876 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
877
878 /*
879 * if the parent was able to be mounted it clearly had no special lsm
880 * mount options. thus we can safely deal with this superblock later
881 */
882 if (!selinux_initialized(&selinux_state))
883 return 0;
884
885 /*
886 * Specifying internal flags without providing a place to
887 * place the results is not allowed.
888 */
889 if (kern_flags && !set_kern_flags)
890 return -EINVAL;
891
892 /* how can we clone if the old one wasn't set up?? */
893 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
894
895 /* if fs is reusing a sb, make sure that the contexts match */
896 if (newsbsec->flags & SE_SBINITIALIZED) {
897 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
898 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
899 return selinux_cmp_sb_context(oldsb, newsb);
900 }
901
902 mutex_lock(&newsbsec->lock);
903
904 newsbsec->flags = oldsbsec->flags;
905
906 newsbsec->sid = oldsbsec->sid;
907 newsbsec->def_sid = oldsbsec->def_sid;
908 newsbsec->behavior = oldsbsec->behavior;
909
910 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
911 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
912 rc = security_fs_use(&selinux_state, newsb);
913 if (rc)
914 goto out;
915 }
916
917 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
918 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
919 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
920 }
921
922 if (set_context) {
923 u32 sid = oldsbsec->mntpoint_sid;
924
925 if (!set_fscontext)
926 newsbsec->sid = sid;
927 if (!set_rootcontext) {
928 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
929 newisec->sid = sid;
930 }
931 newsbsec->mntpoint_sid = sid;
932 }
933 if (set_rootcontext) {
934 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
935 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
936
937 newisec->sid = oldisec->sid;
938 }
939
940 sb_finish_set_opts(newsb);
941 out:
942 mutex_unlock(&newsbsec->lock);
943 return rc;
944 }
945
946 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
947 {
948 struct selinux_mnt_opts *opts = *mnt_opts;
949
950 if (token == Opt_seclabel) /* eaten and completely ignored */
951 return 0;
952
953 if (!opts) {
954 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
955 if (!opts)
956 return -ENOMEM;
957 *mnt_opts = opts;
958 }
959 if (!s)
960 return -ENOMEM;
961 switch (token) {
962 case Opt_context:
963 if (opts->context || opts->defcontext)
964 goto Einval;
965 opts->context = s;
966 break;
967 case Opt_fscontext:
968 if (opts->fscontext)
969 goto Einval;
970 opts->fscontext = s;
971 break;
972 case Opt_rootcontext:
973 if (opts->rootcontext)
974 goto Einval;
975 opts->rootcontext = s;
976 break;
977 case Opt_defcontext:
978 if (opts->context || opts->defcontext)
979 goto Einval;
980 opts->defcontext = s;
981 break;
982 }
983 return 0;
984 Einval:
985 pr_warn(SEL_MOUNT_FAIL_MSG);
986 return -EINVAL;
987 }
988
989 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
990 void **mnt_opts)
991 {
992 int token = Opt_error;
993 int rc, i;
994
995 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
996 if (strcmp(option, tokens[i].name) == 0) {
997 token = tokens[i].opt;
998 break;
999 }
1000 }
1001
1002 if (token == Opt_error)
1003 return -EINVAL;
1004
1005 if (token != Opt_seclabel) {
1006 val = kmemdup_nul(val, len, GFP_KERNEL);
1007 if (!val) {
1008 rc = -ENOMEM;
1009 goto free_opt;
1010 }
1011 }
1012 rc = selinux_add_opt(token, val, mnt_opts);
1013 if (unlikely(rc)) {
1014 kfree(val);
1015 goto free_opt;
1016 }
1017 return rc;
1018
1019 free_opt:
1020 if (*mnt_opts) {
1021 selinux_free_mnt_opts(*mnt_opts);
1022 *mnt_opts = NULL;
1023 }
1024 return rc;
1025 }
1026
1027 static int show_sid(struct seq_file *m, u32 sid)
1028 {
1029 char *context = NULL;
1030 u32 len;
1031 int rc;
1032
1033 rc = security_sid_to_context(&selinux_state, sid,
1034 &context, &len);
1035 if (!rc) {
1036 bool has_comma = context && strchr(context, ',');
1037
1038 seq_putc(m, '=');
1039 if (has_comma)
1040 seq_putc(m, '\"');
1041 seq_escape(m, context, "\"\n\\");
1042 if (has_comma)
1043 seq_putc(m, '\"');
1044 }
1045 kfree(context);
1046 return rc;
1047 }
1048
1049 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1050 {
1051 struct superblock_security_struct *sbsec = sb->s_security;
1052 int rc;
1053
1054 if (!(sbsec->flags & SE_SBINITIALIZED))
1055 return 0;
1056
1057 if (!selinux_initialized(&selinux_state))
1058 return 0;
1059
1060 if (sbsec->flags & FSCONTEXT_MNT) {
1061 seq_putc(m, ',');
1062 seq_puts(m, FSCONTEXT_STR);
1063 rc = show_sid(m, sbsec->sid);
1064 if (rc)
1065 return rc;
1066 }
1067 if (sbsec->flags & CONTEXT_MNT) {
1068 seq_putc(m, ',');
1069 seq_puts(m, CONTEXT_STR);
1070 rc = show_sid(m, sbsec->mntpoint_sid);
1071 if (rc)
1072 return rc;
1073 }
1074 if (sbsec->flags & DEFCONTEXT_MNT) {
1075 seq_putc(m, ',');
1076 seq_puts(m, DEFCONTEXT_STR);
1077 rc = show_sid(m, sbsec->def_sid);
1078 if (rc)
1079 return rc;
1080 }
1081 if (sbsec->flags & ROOTCONTEXT_MNT) {
1082 struct dentry *root = sbsec->sb->s_root;
1083 struct inode_security_struct *isec = backing_inode_security(root);
1084 seq_putc(m, ',');
1085 seq_puts(m, ROOTCONTEXT_STR);
1086 rc = show_sid(m, isec->sid);
1087 if (rc)
1088 return rc;
1089 }
1090 if (sbsec->flags & SBLABEL_MNT) {
1091 seq_putc(m, ',');
1092 seq_puts(m, SECLABEL_STR);
1093 }
1094 return 0;
1095 }
1096
1097 static inline u16 inode_mode_to_security_class(umode_t mode)
1098 {
1099 switch (mode & S_IFMT) {
1100 case S_IFSOCK:
1101 return SECCLASS_SOCK_FILE;
1102 case S_IFLNK:
1103 return SECCLASS_LNK_FILE;
1104 case S_IFREG:
1105 return SECCLASS_FILE;
1106 case S_IFBLK:
1107 return SECCLASS_BLK_FILE;
1108 case S_IFDIR:
1109 return SECCLASS_DIR;
1110 case S_IFCHR:
1111 return SECCLASS_CHR_FILE;
1112 case S_IFIFO:
1113 return SECCLASS_FIFO_FILE;
1114
1115 }
1116
1117 return SECCLASS_FILE;
1118 }
1119
1120 static inline int default_protocol_stream(int protocol)
1121 {
1122 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1123 }
1124
1125 static inline int default_protocol_dgram(int protocol)
1126 {
1127 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1128 }
1129
1130 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1131 {
1132 int extsockclass = selinux_policycap_extsockclass();
1133
1134 switch (family) {
1135 case PF_UNIX:
1136 switch (type) {
1137 case SOCK_STREAM:
1138 case SOCK_SEQPACKET:
1139 return SECCLASS_UNIX_STREAM_SOCKET;
1140 case SOCK_DGRAM:
1141 case SOCK_RAW:
1142 return SECCLASS_UNIX_DGRAM_SOCKET;
1143 }
1144 break;
1145 case PF_INET:
1146 case PF_INET6:
1147 switch (type) {
1148 case SOCK_STREAM:
1149 case SOCK_SEQPACKET:
1150 if (default_protocol_stream(protocol))
1151 return SECCLASS_TCP_SOCKET;
1152 else if (extsockclass && protocol == IPPROTO_SCTP)
1153 return SECCLASS_SCTP_SOCKET;
1154 else
1155 return SECCLASS_RAWIP_SOCKET;
1156 case SOCK_DGRAM:
1157 if (default_protocol_dgram(protocol))
1158 return SECCLASS_UDP_SOCKET;
1159 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1160 protocol == IPPROTO_ICMPV6))
1161 return SECCLASS_ICMP_SOCKET;
1162 else
1163 return SECCLASS_RAWIP_SOCKET;
1164 case SOCK_DCCP:
1165 return SECCLASS_DCCP_SOCKET;
1166 default:
1167 return SECCLASS_RAWIP_SOCKET;
1168 }
1169 break;
1170 case PF_NETLINK:
1171 switch (protocol) {
1172 case NETLINK_ROUTE:
1173 return SECCLASS_NETLINK_ROUTE_SOCKET;
1174 case NETLINK_SOCK_DIAG:
1175 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1176 case NETLINK_NFLOG:
1177 return SECCLASS_NETLINK_NFLOG_SOCKET;
1178 case NETLINK_XFRM:
1179 return SECCLASS_NETLINK_XFRM_SOCKET;
1180 case NETLINK_SELINUX:
1181 return SECCLASS_NETLINK_SELINUX_SOCKET;
1182 case NETLINK_ISCSI:
1183 return SECCLASS_NETLINK_ISCSI_SOCKET;
1184 case NETLINK_AUDIT:
1185 return SECCLASS_NETLINK_AUDIT_SOCKET;
1186 case NETLINK_FIB_LOOKUP:
1187 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1188 case NETLINK_CONNECTOR:
1189 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1190 case NETLINK_NETFILTER:
1191 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1192 case NETLINK_DNRTMSG:
1193 return SECCLASS_NETLINK_DNRT_SOCKET;
1194 case NETLINK_KOBJECT_UEVENT:
1195 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1196 case NETLINK_GENERIC:
1197 return SECCLASS_NETLINK_GENERIC_SOCKET;
1198 case NETLINK_SCSITRANSPORT:
1199 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1200 case NETLINK_RDMA:
1201 return SECCLASS_NETLINK_RDMA_SOCKET;
1202 case NETLINK_CRYPTO:
1203 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1204 default:
1205 return SECCLASS_NETLINK_SOCKET;
1206 }
1207 case PF_PACKET:
1208 return SECCLASS_PACKET_SOCKET;
1209 case PF_KEY:
1210 return SECCLASS_KEY_SOCKET;
1211 case PF_APPLETALK:
1212 return SECCLASS_APPLETALK_SOCKET;
1213 }
1214
1215 if (extsockclass) {
1216 switch (family) {
1217 case PF_AX25:
1218 return SECCLASS_AX25_SOCKET;
1219 case PF_IPX:
1220 return SECCLASS_IPX_SOCKET;
1221 case PF_NETROM:
1222 return SECCLASS_NETROM_SOCKET;
1223 case PF_ATMPVC:
1224 return SECCLASS_ATMPVC_SOCKET;
1225 case PF_X25:
1226 return SECCLASS_X25_SOCKET;
1227 case PF_ROSE:
1228 return SECCLASS_ROSE_SOCKET;
1229 case PF_DECnet:
1230 return SECCLASS_DECNET_SOCKET;
1231 case PF_ATMSVC:
1232 return SECCLASS_ATMSVC_SOCKET;
1233 case PF_RDS:
1234 return SECCLASS_RDS_SOCKET;
1235 case PF_IRDA:
1236 return SECCLASS_IRDA_SOCKET;
1237 case PF_PPPOX:
1238 return SECCLASS_PPPOX_SOCKET;
1239 case PF_LLC:
1240 return SECCLASS_LLC_SOCKET;
1241 case PF_CAN:
1242 return SECCLASS_CAN_SOCKET;
1243 case PF_TIPC:
1244 return SECCLASS_TIPC_SOCKET;
1245 case PF_BLUETOOTH:
1246 return SECCLASS_BLUETOOTH_SOCKET;
1247 case PF_IUCV:
1248 return SECCLASS_IUCV_SOCKET;
1249 case PF_RXRPC:
1250 return SECCLASS_RXRPC_SOCKET;
1251 case PF_ISDN:
1252 return SECCLASS_ISDN_SOCKET;
1253 case PF_PHONET:
1254 return SECCLASS_PHONET_SOCKET;
1255 case PF_IEEE802154:
1256 return SECCLASS_IEEE802154_SOCKET;
1257 case PF_CAIF:
1258 return SECCLASS_CAIF_SOCKET;
1259 case PF_ALG:
1260 return SECCLASS_ALG_SOCKET;
1261 case PF_NFC:
1262 return SECCLASS_NFC_SOCKET;
1263 case PF_VSOCK:
1264 return SECCLASS_VSOCK_SOCKET;
1265 case PF_KCM:
1266 return SECCLASS_KCM_SOCKET;
1267 case PF_QIPCRTR:
1268 return SECCLASS_QIPCRTR_SOCKET;
1269 case PF_SMC:
1270 return SECCLASS_SMC_SOCKET;
1271 case PF_XDP:
1272 return SECCLASS_XDP_SOCKET;
1273 #if PF_MAX > 45
1274 #error New address family defined, please update this function.
1275 #endif
1276 }
1277 }
1278
1279 return SECCLASS_SOCKET;
1280 }
1281
1282 static int selinux_genfs_get_sid(struct dentry *dentry,
1283 u16 tclass,
1284 u16 flags,
1285 u32 *sid)
1286 {
1287 int rc;
1288 struct super_block *sb = dentry->d_sb;
1289 char *buffer, *path;
1290
1291 buffer = (char *)__get_free_page(GFP_KERNEL);
1292 if (!buffer)
1293 return -ENOMEM;
1294
1295 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1296 if (IS_ERR(path))
1297 rc = PTR_ERR(path);
1298 else {
1299 if (flags & SE_SBPROC) {
1300 /* each process gets a /proc/PID/ entry. Strip off the
1301 * PID part to get a valid selinux labeling.
1302 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1303 while (path[1] >= '0' && path[1] <= '9') {
1304 path[1] = '/';
1305 path++;
1306 }
1307 }
1308 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1309 path, tclass, sid);
1310 if (rc == -ENOENT) {
1311 /* No match in policy, mark as unlabeled. */
1312 *sid = SECINITSID_UNLABELED;
1313 rc = 0;
1314 }
1315 }
1316 free_page((unsigned long)buffer);
1317 return rc;
1318 }
1319
1320 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1321 u32 def_sid, u32 *sid)
1322 {
1323 #define INITCONTEXTLEN 255
1324 char *context;
1325 unsigned int len;
1326 int rc;
1327
1328 len = INITCONTEXTLEN;
1329 context = kmalloc(len + 1, GFP_NOFS);
1330 if (!context)
1331 return -ENOMEM;
1332
1333 context[len] = '\0';
1334 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1335 if (rc == -ERANGE) {
1336 kfree(context);
1337
1338 /* Need a larger buffer. Query for the right size. */
1339 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1340 if (rc < 0)
1341 return rc;
1342
1343 len = rc;
1344 context = kmalloc(len + 1, GFP_NOFS);
1345 if (!context)
1346 return -ENOMEM;
1347
1348 context[len] = '\0';
1349 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1350 context, len);
1351 }
1352 if (rc < 0) {
1353 kfree(context);
1354 if (rc != -ENODATA) {
1355 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1356 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1357 return rc;
1358 }
1359 *sid = def_sid;
1360 return 0;
1361 }
1362
1363 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1364 def_sid, GFP_NOFS);
1365 if (rc) {
1366 char *dev = inode->i_sb->s_id;
1367 unsigned long ino = inode->i_ino;
1368
1369 if (rc == -EINVAL) {
1370 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1371 ino, dev, context);
1372 } else {
1373 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1374 __func__, context, -rc, dev, ino);
1375 }
1376 }
1377 kfree(context);
1378 return 0;
1379 }
1380
1381 /* The inode's security attributes must be initialized before first use. */
1382 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1383 {
1384 struct superblock_security_struct *sbsec = NULL;
1385 struct inode_security_struct *isec = selinux_inode(inode);
1386 u32 task_sid, sid = 0;
1387 u16 sclass;
1388 struct dentry *dentry;
1389 int rc = 0;
1390
1391 if (isec->initialized == LABEL_INITIALIZED)
1392 return 0;
1393
1394 spin_lock(&isec->lock);
1395 if (isec->initialized == LABEL_INITIALIZED)
1396 goto out_unlock;
1397
1398 if (isec->sclass == SECCLASS_FILE)
1399 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1400
1401 sbsec = inode->i_sb->s_security;
1402 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1403 /* Defer initialization until selinux_complete_init,
1404 after the initial policy is loaded and the security
1405 server is ready to handle calls. */
1406 spin_lock(&sbsec->isec_lock);
1407 if (list_empty(&isec->list))
1408 list_add(&isec->list, &sbsec->isec_head);
1409 spin_unlock(&sbsec->isec_lock);
1410 goto out_unlock;
1411 }
1412
1413 sclass = isec->sclass;
1414 task_sid = isec->task_sid;
1415 sid = isec->sid;
1416 isec->initialized = LABEL_PENDING;
1417 spin_unlock(&isec->lock);
1418
1419 switch (sbsec->behavior) {
1420 case SECURITY_FS_USE_NATIVE:
1421 break;
1422 case SECURITY_FS_USE_XATTR:
1423 if (!(inode->i_opflags & IOP_XATTR)) {
1424 sid = sbsec->def_sid;
1425 break;
1426 }
1427 /* Need a dentry, since the xattr API requires one.
1428 Life would be simpler if we could just pass the inode. */
1429 if (opt_dentry) {
1430 /* Called from d_instantiate or d_splice_alias. */
1431 dentry = dget(opt_dentry);
1432 } else {
1433 /*
1434 * Called from selinux_complete_init, try to find a dentry.
1435 * Some filesystems really want a connected one, so try
1436 * that first. We could split SECURITY_FS_USE_XATTR in
1437 * two, depending upon that...
1438 */
1439 dentry = d_find_alias(inode);
1440 if (!dentry)
1441 dentry = d_find_any_alias(inode);
1442 }
1443 if (!dentry) {
1444 /*
1445 * this is can be hit on boot when a file is accessed
1446 * before the policy is loaded. When we load policy we
1447 * may find inodes that have no dentry on the
1448 * sbsec->isec_head list. No reason to complain as these
1449 * will get fixed up the next time we go through
1450 * inode_doinit with a dentry, before these inodes could
1451 * be used again by userspace.
1452 */
1453 goto out;
1454 }
1455
1456 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1457 &sid);
1458 dput(dentry);
1459 if (rc)
1460 goto out;
1461 break;
1462 case SECURITY_FS_USE_TASK:
1463 sid = task_sid;
1464 break;
1465 case SECURITY_FS_USE_TRANS:
1466 /* Default to the fs SID. */
1467 sid = sbsec->sid;
1468
1469 /* Try to obtain a transition SID. */
1470 rc = security_transition_sid(&selinux_state, task_sid, sid,
1471 sclass, NULL, &sid);
1472 if (rc)
1473 goto out;
1474 break;
1475 case SECURITY_FS_USE_MNTPOINT:
1476 sid = sbsec->mntpoint_sid;
1477 break;
1478 default:
1479 /* Default to the fs superblock SID. */
1480 sid = sbsec->sid;
1481
1482 if ((sbsec->flags & SE_SBGENFS) &&
1483 (!S_ISLNK(inode->i_mode) ||
1484 selinux_policycap_genfs_seclabel_symlinks())) {
1485 /* We must have a dentry to determine the label on
1486 * procfs inodes */
1487 if (opt_dentry) {
1488 /* Called from d_instantiate or
1489 * d_splice_alias. */
1490 dentry = dget(opt_dentry);
1491 } else {
1492 /* Called from selinux_complete_init, try to
1493 * find a dentry. Some filesystems really want
1494 * a connected one, so try that first.
1495 */
1496 dentry = d_find_alias(inode);
1497 if (!dentry)
1498 dentry = d_find_any_alias(inode);
1499 }
1500 /*
1501 * This can be hit on boot when a file is accessed
1502 * before the policy is loaded. When we load policy we
1503 * may find inodes that have no dentry on the
1504 * sbsec->isec_head list. No reason to complain as
1505 * these will get fixed up the next time we go through
1506 * inode_doinit() with a dentry, before these inodes
1507 * could be used again by userspace.
1508 */
1509 if (!dentry)
1510 goto out;
1511 rc = selinux_genfs_get_sid(dentry, sclass,
1512 sbsec->flags, &sid);
1513 if (rc) {
1514 dput(dentry);
1515 goto out;
1516 }
1517
1518 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1519 (inode->i_opflags & IOP_XATTR)) {
1520 rc = inode_doinit_use_xattr(inode, dentry,
1521 sid, &sid);
1522 if (rc) {
1523 dput(dentry);
1524 goto out;
1525 }
1526 }
1527 dput(dentry);
1528 }
1529 break;
1530 }
1531
1532 out:
1533 spin_lock(&isec->lock);
1534 if (isec->initialized == LABEL_PENDING) {
1535 if (!sid || rc) {
1536 isec->initialized = LABEL_INVALID;
1537 goto out_unlock;
1538 }
1539
1540 isec->initialized = LABEL_INITIALIZED;
1541 isec->sid = sid;
1542 }
1543
1544 out_unlock:
1545 spin_unlock(&isec->lock);
1546 return rc;
1547 }
1548
1549 /* Convert a Linux signal to an access vector. */
1550 static inline u32 signal_to_av(int sig)
1551 {
1552 u32 perm = 0;
1553
1554 switch (sig) {
1555 case SIGCHLD:
1556 /* Commonly granted from child to parent. */
1557 perm = PROCESS__SIGCHLD;
1558 break;
1559 case SIGKILL:
1560 /* Cannot be caught or ignored */
1561 perm = PROCESS__SIGKILL;
1562 break;
1563 case SIGSTOP:
1564 /* Cannot be caught or ignored */
1565 perm = PROCESS__SIGSTOP;
1566 break;
1567 default:
1568 /* All other signals. */
1569 perm = PROCESS__SIGNAL;
1570 break;
1571 }
1572
1573 return perm;
1574 }
1575
1576 #if CAP_LAST_CAP > 63
1577 #error Fix SELinux to handle capabilities > 63.
1578 #endif
1579
1580 /* Check whether a task is allowed to use a capability. */
1581 static int cred_has_capability(const struct cred *cred,
1582 int cap, unsigned int opts, bool initns)
1583 {
1584 struct common_audit_data ad;
1585 struct av_decision avd;
1586 u16 sclass;
1587 u32 sid = cred_sid(cred);
1588 u32 av = CAP_TO_MASK(cap);
1589 int rc;
1590
1591 ad.type = LSM_AUDIT_DATA_CAP;
1592 ad.u.cap = cap;
1593
1594 switch (CAP_TO_INDEX(cap)) {
1595 case 0:
1596 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1597 break;
1598 case 1:
1599 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1600 break;
1601 default:
1602 pr_err("SELinux: out of range capability %d\n", cap);
1603 BUG();
1604 return -EINVAL;
1605 }
1606
1607 rc = avc_has_perm_noaudit(&selinux_state,
1608 sid, sid, sclass, av, 0, &avd);
1609 if (!(opts & CAP_OPT_NOAUDIT)) {
1610 int rc2 = avc_audit(&selinux_state,
1611 sid, sid, sclass, av, &avd, rc, &ad, 0);
1612 if (rc2)
1613 return rc2;
1614 }
1615 return rc;
1616 }
1617
1618 /* Check whether a task has a particular permission to an inode.
1619 The 'adp' parameter is optional and allows other audit
1620 data to be passed (e.g. the dentry). */
1621 static int inode_has_perm(const struct cred *cred,
1622 struct inode *inode,
1623 u32 perms,
1624 struct common_audit_data *adp)
1625 {
1626 struct inode_security_struct *isec;
1627 u32 sid;
1628
1629 validate_creds(cred);
1630
1631 if (unlikely(IS_PRIVATE(inode)))
1632 return 0;
1633
1634 sid = cred_sid(cred);
1635 isec = selinux_inode(inode);
1636
1637 return avc_has_perm(&selinux_state,
1638 sid, isec->sid, isec->sclass, perms, adp);
1639 }
1640
1641 /* Same as inode_has_perm, but pass explicit audit data containing
1642 the dentry to help the auditing code to more easily generate the
1643 pathname if needed. */
1644 static inline int dentry_has_perm(const struct cred *cred,
1645 struct dentry *dentry,
1646 u32 av)
1647 {
1648 struct inode *inode = d_backing_inode(dentry);
1649 struct common_audit_data ad;
1650
1651 ad.type = LSM_AUDIT_DATA_DENTRY;
1652 ad.u.dentry = dentry;
1653 __inode_security_revalidate(inode, dentry, true);
1654 return inode_has_perm(cred, inode, av, &ad);
1655 }
1656
1657 /* Same as inode_has_perm, but pass explicit audit data containing
1658 the path to help the auditing code to more easily generate the
1659 pathname if needed. */
1660 static inline int path_has_perm(const struct cred *cred,
1661 const struct path *path,
1662 u32 av)
1663 {
1664 struct inode *inode = d_backing_inode(path->dentry);
1665 struct common_audit_data ad;
1666
1667 ad.type = LSM_AUDIT_DATA_PATH;
1668 ad.u.path = *path;
1669 __inode_security_revalidate(inode, path->dentry, true);
1670 return inode_has_perm(cred, inode, av, &ad);
1671 }
1672
1673 /* Same as path_has_perm, but uses the inode from the file struct. */
1674 static inline int file_path_has_perm(const struct cred *cred,
1675 struct file *file,
1676 u32 av)
1677 {
1678 struct common_audit_data ad;
1679
1680 ad.type = LSM_AUDIT_DATA_FILE;
1681 ad.u.file = file;
1682 return inode_has_perm(cred, file_inode(file), av, &ad);
1683 }
1684
1685 #ifdef CONFIG_BPF_SYSCALL
1686 static int bpf_fd_pass(struct file *file, u32 sid);
1687 #endif
1688
1689 /* Check whether a task can use an open file descriptor to
1690 access an inode in a given way. Check access to the
1691 descriptor itself, and then use dentry_has_perm to
1692 check a particular permission to the file.
1693 Access to the descriptor is implicitly granted if it
1694 has the same SID as the process. If av is zero, then
1695 access to the file is not checked, e.g. for cases
1696 where only the descriptor is affected like seek. */
1697 static int file_has_perm(const struct cred *cred,
1698 struct file *file,
1699 u32 av)
1700 {
1701 struct file_security_struct *fsec = selinux_file(file);
1702 struct inode *inode = file_inode(file);
1703 struct common_audit_data ad;
1704 u32 sid = cred_sid(cred);
1705 int rc;
1706
1707 ad.type = LSM_AUDIT_DATA_FILE;
1708 ad.u.file = file;
1709
1710 if (sid != fsec->sid) {
1711 rc = avc_has_perm(&selinux_state,
1712 sid, fsec->sid,
1713 SECCLASS_FD,
1714 FD__USE,
1715 &ad);
1716 if (rc)
1717 goto out;
1718 }
1719
1720 #ifdef CONFIG_BPF_SYSCALL
1721 rc = bpf_fd_pass(file, cred_sid(cred));
1722 if (rc)
1723 return rc;
1724 #endif
1725
1726 /* av is zero if only checking access to the descriptor. */
1727 rc = 0;
1728 if (av)
1729 rc = inode_has_perm(cred, inode, av, &ad);
1730
1731 out:
1732 return rc;
1733 }
1734
1735 /*
1736 * Determine the label for an inode that might be unioned.
1737 */
1738 static int
1739 selinux_determine_inode_label(const struct task_security_struct *tsec,
1740 struct inode *dir,
1741 const struct qstr *name, u16 tclass,
1742 u32 *_new_isid)
1743 {
1744 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1745
1746 if ((sbsec->flags & SE_SBINITIALIZED) &&
1747 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1748 *_new_isid = sbsec->mntpoint_sid;
1749 } else if ((sbsec->flags & SBLABEL_MNT) &&
1750 tsec->create_sid) {
1751 *_new_isid = tsec->create_sid;
1752 } else {
1753 const struct inode_security_struct *dsec = inode_security(dir);
1754 return security_transition_sid(&selinux_state, tsec->sid,
1755 dsec->sid, tclass,
1756 name, _new_isid);
1757 }
1758
1759 return 0;
1760 }
1761
1762 /* Check whether a task can create a file. */
1763 static int may_create(struct inode *dir,
1764 struct dentry *dentry,
1765 u16 tclass)
1766 {
1767 const struct task_security_struct *tsec = selinux_cred(current_cred());
1768 struct inode_security_struct *dsec;
1769 struct superblock_security_struct *sbsec;
1770 u32 sid, newsid;
1771 struct common_audit_data ad;
1772 int rc;
1773
1774 dsec = inode_security(dir);
1775 sbsec = dir->i_sb->s_security;
1776
1777 sid = tsec->sid;
1778
1779 ad.type = LSM_AUDIT_DATA_DENTRY;
1780 ad.u.dentry = dentry;
1781
1782 rc = avc_has_perm(&selinux_state,
1783 sid, dsec->sid, SECCLASS_DIR,
1784 DIR__ADD_NAME | DIR__SEARCH,
1785 &ad);
1786 if (rc)
1787 return rc;
1788
1789 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1790 &newsid);
1791 if (rc)
1792 return rc;
1793
1794 rc = avc_has_perm(&selinux_state,
1795 sid, newsid, tclass, FILE__CREATE, &ad);
1796 if (rc)
1797 return rc;
1798
1799 return avc_has_perm(&selinux_state,
1800 newsid, sbsec->sid,
1801 SECCLASS_FILESYSTEM,
1802 FILESYSTEM__ASSOCIATE, &ad);
1803 }
1804
1805 #define MAY_LINK 0
1806 #define MAY_UNLINK 1
1807 #define MAY_RMDIR 2
1808
1809 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1810 static int may_link(struct inode *dir,
1811 struct dentry *dentry,
1812 int kind)
1813
1814 {
1815 struct inode_security_struct *dsec, *isec;
1816 struct common_audit_data ad;
1817 u32 sid = current_sid();
1818 u32 av;
1819 int rc;
1820
1821 dsec = inode_security(dir);
1822 isec = backing_inode_security(dentry);
1823
1824 ad.type = LSM_AUDIT_DATA_DENTRY;
1825 ad.u.dentry = dentry;
1826
1827 av = DIR__SEARCH;
1828 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1829 rc = avc_has_perm(&selinux_state,
1830 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1831 if (rc)
1832 return rc;
1833
1834 switch (kind) {
1835 case MAY_LINK:
1836 av = FILE__LINK;
1837 break;
1838 case MAY_UNLINK:
1839 av = FILE__UNLINK;
1840 break;
1841 case MAY_RMDIR:
1842 av = DIR__RMDIR;
1843 break;
1844 default:
1845 pr_warn("SELinux: %s: unrecognized kind %d\n",
1846 __func__, kind);
1847 return 0;
1848 }
1849
1850 rc = avc_has_perm(&selinux_state,
1851 sid, isec->sid, isec->sclass, av, &ad);
1852 return rc;
1853 }
1854
1855 static inline int may_rename(struct inode *old_dir,
1856 struct dentry *old_dentry,
1857 struct inode *new_dir,
1858 struct dentry *new_dentry)
1859 {
1860 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1861 struct common_audit_data ad;
1862 u32 sid = current_sid();
1863 u32 av;
1864 int old_is_dir, new_is_dir;
1865 int rc;
1866
1867 old_dsec = inode_security(old_dir);
1868 old_isec = backing_inode_security(old_dentry);
1869 old_is_dir = d_is_dir(old_dentry);
1870 new_dsec = inode_security(new_dir);
1871
1872 ad.type = LSM_AUDIT_DATA_DENTRY;
1873
1874 ad.u.dentry = old_dentry;
1875 rc = avc_has_perm(&selinux_state,
1876 sid, old_dsec->sid, SECCLASS_DIR,
1877 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1878 if (rc)
1879 return rc;
1880 rc = avc_has_perm(&selinux_state,
1881 sid, old_isec->sid,
1882 old_isec->sclass, FILE__RENAME, &ad);
1883 if (rc)
1884 return rc;
1885 if (old_is_dir && new_dir != old_dir) {
1886 rc = avc_has_perm(&selinux_state,
1887 sid, old_isec->sid,
1888 old_isec->sclass, DIR__REPARENT, &ad);
1889 if (rc)
1890 return rc;
1891 }
1892
1893 ad.u.dentry = new_dentry;
1894 av = DIR__ADD_NAME | DIR__SEARCH;
1895 if (d_is_positive(new_dentry))
1896 av |= DIR__REMOVE_NAME;
1897 rc = avc_has_perm(&selinux_state,
1898 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1899 if (rc)
1900 return rc;
1901 if (d_is_positive(new_dentry)) {
1902 new_isec = backing_inode_security(new_dentry);
1903 new_is_dir = d_is_dir(new_dentry);
1904 rc = avc_has_perm(&selinux_state,
1905 sid, new_isec->sid,
1906 new_isec->sclass,
1907 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1908 if (rc)
1909 return rc;
1910 }
1911
1912 return 0;
1913 }
1914
1915 /* Check whether a task can perform a filesystem operation. */
1916 static int superblock_has_perm(const struct cred *cred,
1917 struct super_block *sb,
1918 u32 perms,
1919 struct common_audit_data *ad)
1920 {
1921 struct superblock_security_struct *sbsec;
1922 u32 sid = cred_sid(cred);
1923
1924 sbsec = sb->s_security;
1925 return avc_has_perm(&selinux_state,
1926 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1927 }
1928
1929 /* Convert a Linux mode and permission mask to an access vector. */
1930 static inline u32 file_mask_to_av(int mode, int mask)
1931 {
1932 u32 av = 0;
1933
1934 if (!S_ISDIR(mode)) {
1935 if (mask & MAY_EXEC)
1936 av |= FILE__EXECUTE;
1937 if (mask & MAY_READ)
1938 av |= FILE__READ;
1939
1940 if (mask & MAY_APPEND)
1941 av |= FILE__APPEND;
1942 else if (mask & MAY_WRITE)
1943 av |= FILE__WRITE;
1944
1945 } else {
1946 if (mask & MAY_EXEC)
1947 av |= DIR__SEARCH;
1948 if (mask & MAY_WRITE)
1949 av |= DIR__WRITE;
1950 if (mask & MAY_READ)
1951 av |= DIR__READ;
1952 }
1953
1954 return av;
1955 }
1956
1957 /* Convert a Linux file to an access vector. */
1958 static inline u32 file_to_av(struct file *file)
1959 {
1960 u32 av = 0;
1961
1962 if (file->f_mode & FMODE_READ)
1963 av |= FILE__READ;
1964 if (file->f_mode & FMODE_WRITE) {
1965 if (file->f_flags & O_APPEND)
1966 av |= FILE__APPEND;
1967 else
1968 av |= FILE__WRITE;
1969 }
1970 if (!av) {
1971 /*
1972 * Special file opened with flags 3 for ioctl-only use.
1973 */
1974 av = FILE__IOCTL;
1975 }
1976
1977 return av;
1978 }
1979
1980 /*
1981 * Convert a file to an access vector and include the correct open
1982 * open permission.
1983 */
1984 static inline u32 open_file_to_av(struct file *file)
1985 {
1986 u32 av = file_to_av(file);
1987 struct inode *inode = file_inode(file);
1988
1989 if (selinux_policycap_openperm() &&
1990 inode->i_sb->s_magic != SOCKFS_MAGIC)
1991 av |= FILE__OPEN;
1992
1993 return av;
1994 }
1995
1996 /* Hook functions begin here. */
1997
1998 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1999 {
2000 u32 mysid = current_sid();
2001 u32 mgrsid = task_sid(mgr);
2002
2003 return avc_has_perm(&selinux_state,
2004 mysid, mgrsid, SECCLASS_BINDER,
2005 BINDER__SET_CONTEXT_MGR, NULL);
2006 }
2007
2008 static int selinux_binder_transaction(struct task_struct *from,
2009 struct task_struct *to)
2010 {
2011 u32 mysid = current_sid();
2012 u32 fromsid = task_sid(from);
2013 u32 tosid = task_sid(to);
2014 int rc;
2015
2016 if (mysid != fromsid) {
2017 rc = avc_has_perm(&selinux_state,
2018 mysid, fromsid, SECCLASS_BINDER,
2019 BINDER__IMPERSONATE, NULL);
2020 if (rc)
2021 return rc;
2022 }
2023
2024 return avc_has_perm(&selinux_state,
2025 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2026 NULL);
2027 }
2028
2029 static int selinux_binder_transfer_binder(struct task_struct *from,
2030 struct task_struct *to)
2031 {
2032 u32 fromsid = task_sid(from);
2033 u32 tosid = task_sid(to);
2034
2035 return avc_has_perm(&selinux_state,
2036 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2037 NULL);
2038 }
2039
2040 static int selinux_binder_transfer_file(struct task_struct *from,
2041 struct task_struct *to,
2042 struct file *file)
2043 {
2044 u32 sid = task_sid(to);
2045 struct file_security_struct *fsec = selinux_file(file);
2046 struct dentry *dentry = file->f_path.dentry;
2047 struct inode_security_struct *isec;
2048 struct common_audit_data ad;
2049 int rc;
2050
2051 ad.type = LSM_AUDIT_DATA_PATH;
2052 ad.u.path = file->f_path;
2053
2054 if (sid != fsec->sid) {
2055 rc = avc_has_perm(&selinux_state,
2056 sid, fsec->sid,
2057 SECCLASS_FD,
2058 FD__USE,
2059 &ad);
2060 if (rc)
2061 return rc;
2062 }
2063
2064 #ifdef CONFIG_BPF_SYSCALL
2065 rc = bpf_fd_pass(file, sid);
2066 if (rc)
2067 return rc;
2068 #endif
2069
2070 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2071 return 0;
2072
2073 isec = backing_inode_security(dentry);
2074 return avc_has_perm(&selinux_state,
2075 sid, isec->sid, isec->sclass, file_to_av(file),
2076 &ad);
2077 }
2078
2079 static int selinux_ptrace_access_check(struct task_struct *child,
2080 unsigned int mode)
2081 {
2082 u32 sid = current_sid();
2083 u32 csid = task_sid(child);
2084
2085 if (mode & PTRACE_MODE_READ)
2086 return avc_has_perm(&selinux_state,
2087 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2088
2089 return avc_has_perm(&selinux_state,
2090 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2091 }
2092
2093 static int selinux_ptrace_traceme(struct task_struct *parent)
2094 {
2095 return avc_has_perm(&selinux_state,
2096 task_sid(parent), current_sid(), SECCLASS_PROCESS,
2097 PROCESS__PTRACE, NULL);
2098 }
2099
2100 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2101 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2102 {
2103 return avc_has_perm(&selinux_state,
2104 current_sid(), task_sid(target), SECCLASS_PROCESS,
2105 PROCESS__GETCAP, NULL);
2106 }
2107
2108 static int selinux_capset(struct cred *new, const struct cred *old,
2109 const kernel_cap_t *effective,
2110 const kernel_cap_t *inheritable,
2111 const kernel_cap_t *permitted)
2112 {
2113 return avc_has_perm(&selinux_state,
2114 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2115 PROCESS__SETCAP, NULL);
2116 }
2117
2118 /*
2119 * (This comment used to live with the selinux_task_setuid hook,
2120 * which was removed).
2121 *
2122 * Since setuid only affects the current process, and since the SELinux
2123 * controls are not based on the Linux identity attributes, SELinux does not
2124 * need to control this operation. However, SELinux does control the use of
2125 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2126 */
2127
2128 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2129 int cap, unsigned int opts)
2130 {
2131 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2132 }
2133
2134 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2135 {
2136 const struct cred *cred = current_cred();
2137 int rc = 0;
2138
2139 if (!sb)
2140 return 0;
2141
2142 switch (cmds) {
2143 case Q_SYNC:
2144 case Q_QUOTAON:
2145 case Q_QUOTAOFF:
2146 case Q_SETINFO:
2147 case Q_SETQUOTA:
2148 case Q_XQUOTAOFF:
2149 case Q_XQUOTAON:
2150 case Q_XSETQLIM:
2151 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2152 break;
2153 case Q_GETFMT:
2154 case Q_GETINFO:
2155 case Q_GETQUOTA:
2156 case Q_XGETQUOTA:
2157 case Q_XGETQSTAT:
2158 case Q_XGETQSTATV:
2159 case Q_XGETNEXTQUOTA:
2160 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2161 break;
2162 default:
2163 rc = 0; /* let the kernel handle invalid cmds */
2164 break;
2165 }
2166 return rc;
2167 }
2168
2169 static int selinux_quota_on(struct dentry *dentry)
2170 {
2171 const struct cred *cred = current_cred();
2172
2173 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2174 }
2175
2176 static int selinux_syslog(int type)
2177 {
2178 switch (type) {
2179 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2180 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2181 return avc_has_perm(&selinux_state,
2182 current_sid(), SECINITSID_KERNEL,
2183 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2184 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2185 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2186 /* Set level of messages printed to console */
2187 case SYSLOG_ACTION_CONSOLE_LEVEL:
2188 return avc_has_perm(&selinux_state,
2189 current_sid(), SECINITSID_KERNEL,
2190 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2191 NULL);
2192 }
2193 /* All other syslog types */
2194 return avc_has_perm(&selinux_state,
2195 current_sid(), SECINITSID_KERNEL,
2196 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2197 }
2198
2199 /*
2200 * Check that a process has enough memory to allocate a new virtual
2201 * mapping. 0 means there is enough memory for the allocation to
2202 * succeed and -ENOMEM implies there is not.
2203 *
2204 * Do not audit the selinux permission check, as this is applied to all
2205 * processes that allocate mappings.
2206 */
2207 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2208 {
2209 int rc, cap_sys_admin = 0;
2210
2211 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2212 CAP_OPT_NOAUDIT, true);
2213 if (rc == 0)
2214 cap_sys_admin = 1;
2215
2216 return cap_sys_admin;
2217 }
2218
2219 /* binprm security operations */
2220
2221 static u32 ptrace_parent_sid(void)
2222 {
2223 u32 sid = 0;
2224 struct task_struct *tracer;
2225
2226 rcu_read_lock();
2227 tracer = ptrace_parent(current);
2228 if (tracer)
2229 sid = task_sid(tracer);
2230 rcu_read_unlock();
2231
2232 return sid;
2233 }
2234
2235 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2236 const struct task_security_struct *old_tsec,
2237 const struct task_security_struct *new_tsec)
2238 {
2239 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2240 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2241 int rc;
2242 u32 av;
2243
2244 if (!nnp && !nosuid)
2245 return 0; /* neither NNP nor nosuid */
2246
2247 if (new_tsec->sid == old_tsec->sid)
2248 return 0; /* No change in credentials */
2249
2250 /*
2251 * If the policy enables the nnp_nosuid_transition policy capability,
2252 * then we permit transitions under NNP or nosuid if the
2253 * policy allows the corresponding permission between
2254 * the old and new contexts.
2255 */
2256 if (selinux_policycap_nnp_nosuid_transition()) {
2257 av = 0;
2258 if (nnp)
2259 av |= PROCESS2__NNP_TRANSITION;
2260 if (nosuid)
2261 av |= PROCESS2__NOSUID_TRANSITION;
2262 rc = avc_has_perm(&selinux_state,
2263 old_tsec->sid, new_tsec->sid,
2264 SECCLASS_PROCESS2, av, NULL);
2265 if (!rc)
2266 return 0;
2267 }
2268
2269 /*
2270 * We also permit NNP or nosuid transitions to bounded SIDs,
2271 * i.e. SIDs that are guaranteed to only be allowed a subset
2272 * of the permissions of the current SID.
2273 */
2274 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2275 new_tsec->sid);
2276 if (!rc)
2277 return 0;
2278
2279 /*
2280 * On failure, preserve the errno values for NNP vs nosuid.
2281 * NNP: Operation not permitted for caller.
2282 * nosuid: Permission denied to file.
2283 */
2284 if (nnp)
2285 return -EPERM;
2286 return -EACCES;
2287 }
2288
2289 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2290 {
2291 const struct task_security_struct *old_tsec;
2292 struct task_security_struct *new_tsec;
2293 struct inode_security_struct *isec;
2294 struct common_audit_data ad;
2295 struct inode *inode = file_inode(bprm->file);
2296 int rc;
2297
2298 /* SELinux context only depends on initial program or script and not
2299 * the script interpreter */
2300 if (bprm->called_set_creds)
2301 return 0;
2302
2303 old_tsec = selinux_cred(current_cred());
2304 new_tsec = selinux_cred(bprm->cred);
2305 isec = inode_security(inode);
2306
2307 /* Default to the current task SID. */
2308 new_tsec->sid = old_tsec->sid;
2309 new_tsec->osid = old_tsec->sid;
2310
2311 /* Reset fs, key, and sock SIDs on execve. */
2312 new_tsec->create_sid = 0;
2313 new_tsec->keycreate_sid = 0;
2314 new_tsec->sockcreate_sid = 0;
2315
2316 if (old_tsec->exec_sid) {
2317 new_tsec->sid = old_tsec->exec_sid;
2318 /* Reset exec SID on execve. */
2319 new_tsec->exec_sid = 0;
2320
2321 /* Fail on NNP or nosuid if not an allowed transition. */
2322 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2323 if (rc)
2324 return rc;
2325 } else {
2326 /* Check for a default transition on this program. */
2327 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2328 isec->sid, SECCLASS_PROCESS, NULL,
2329 &new_tsec->sid);
2330 if (rc)
2331 return rc;
2332
2333 /*
2334 * Fallback to old SID on NNP or nosuid if not an allowed
2335 * transition.
2336 */
2337 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2338 if (rc)
2339 new_tsec->sid = old_tsec->sid;
2340 }
2341
2342 ad.type = LSM_AUDIT_DATA_FILE;
2343 ad.u.file = bprm->file;
2344
2345 if (new_tsec->sid == old_tsec->sid) {
2346 rc = avc_has_perm(&selinux_state,
2347 old_tsec->sid, isec->sid,
2348 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2349 if (rc)
2350 return rc;
2351 } else {
2352 /* Check permissions for the transition. */
2353 rc = avc_has_perm(&selinux_state,
2354 old_tsec->sid, new_tsec->sid,
2355 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2356 if (rc)
2357 return rc;
2358
2359 rc = avc_has_perm(&selinux_state,
2360 new_tsec->sid, isec->sid,
2361 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2362 if (rc)
2363 return rc;
2364
2365 /* Check for shared state */
2366 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2367 rc = avc_has_perm(&selinux_state,
2368 old_tsec->sid, new_tsec->sid,
2369 SECCLASS_PROCESS, PROCESS__SHARE,
2370 NULL);
2371 if (rc)
2372 return -EPERM;
2373 }
2374
2375 /* Make sure that anyone attempting to ptrace over a task that
2376 * changes its SID has the appropriate permit */
2377 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2378 u32 ptsid = ptrace_parent_sid();
2379 if (ptsid != 0) {
2380 rc = avc_has_perm(&selinux_state,
2381 ptsid, new_tsec->sid,
2382 SECCLASS_PROCESS,
2383 PROCESS__PTRACE, NULL);
2384 if (rc)
2385 return -EPERM;
2386 }
2387 }
2388
2389 /* Clear any possibly unsafe personality bits on exec: */
2390 bprm->per_clear |= PER_CLEAR_ON_SETID;
2391
2392 /* Enable secure mode for SIDs transitions unless
2393 the noatsecure permission is granted between
2394 the two SIDs, i.e. ahp returns 0. */
2395 rc = avc_has_perm(&selinux_state,
2396 old_tsec->sid, new_tsec->sid,
2397 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2398 NULL);
2399 bprm->secureexec |= !!rc;
2400 }
2401
2402 return 0;
2403 }
2404
2405 static int match_file(const void *p, struct file *file, unsigned fd)
2406 {
2407 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2408 }
2409
2410 /* Derived from fs/exec.c:flush_old_files. */
2411 static inline void flush_unauthorized_files(const struct cred *cred,
2412 struct files_struct *files)
2413 {
2414 struct file *file, *devnull = NULL;
2415 struct tty_struct *tty;
2416 int drop_tty = 0;
2417 unsigned n;
2418
2419 tty = get_current_tty();
2420 if (tty) {
2421 spin_lock(&tty->files_lock);
2422 if (!list_empty(&tty->tty_files)) {
2423 struct tty_file_private *file_priv;
2424
2425 /* Revalidate access to controlling tty.
2426 Use file_path_has_perm on the tty path directly
2427 rather than using file_has_perm, as this particular
2428 open file may belong to another process and we are
2429 only interested in the inode-based check here. */
2430 file_priv = list_first_entry(&tty->tty_files,
2431 struct tty_file_private, list);
2432 file = file_priv->file;
2433 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2434 drop_tty = 1;
2435 }
2436 spin_unlock(&tty->files_lock);
2437 tty_kref_put(tty);
2438 }
2439 /* Reset controlling tty. */
2440 if (drop_tty)
2441 no_tty();
2442
2443 /* Revalidate access to inherited open files. */
2444 n = iterate_fd(files, 0, match_file, cred);
2445 if (!n) /* none found? */
2446 return;
2447
2448 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2449 if (IS_ERR(devnull))
2450 devnull = NULL;
2451 /* replace all the matching ones with this */
2452 do {
2453 replace_fd(n - 1, devnull, 0);
2454 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2455 if (devnull)
2456 fput(devnull);
2457 }
2458
2459 /*
2460 * Prepare a process for imminent new credential changes due to exec
2461 */
2462 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2463 {
2464 struct task_security_struct *new_tsec;
2465 struct rlimit *rlim, *initrlim;
2466 int rc, i;
2467
2468 new_tsec = selinux_cred(bprm->cred);
2469 if (new_tsec->sid == new_tsec->osid)
2470 return;
2471
2472 /* Close files for which the new task SID is not authorized. */
2473 flush_unauthorized_files(bprm->cred, current->files);
2474
2475 /* Always clear parent death signal on SID transitions. */
2476 current->pdeath_signal = 0;
2477
2478 /* Check whether the new SID can inherit resource limits from the old
2479 * SID. If not, reset all soft limits to the lower of the current
2480 * task's hard limit and the init task's soft limit.
2481 *
2482 * Note that the setting of hard limits (even to lower them) can be
2483 * controlled by the setrlimit check. The inclusion of the init task's
2484 * soft limit into the computation is to avoid resetting soft limits
2485 * higher than the default soft limit for cases where the default is
2486 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2487 */
2488 rc = avc_has_perm(&selinux_state,
2489 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2490 PROCESS__RLIMITINH, NULL);
2491 if (rc) {
2492 /* protect against do_prlimit() */
2493 task_lock(current);
2494 for (i = 0; i < RLIM_NLIMITS; i++) {
2495 rlim = current->signal->rlim + i;
2496 initrlim = init_task.signal->rlim + i;
2497 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2498 }
2499 task_unlock(current);
2500 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2501 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2502 }
2503 }
2504
2505 /*
2506 * Clean up the process immediately after the installation of new credentials
2507 * due to exec
2508 */
2509 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2510 {
2511 const struct task_security_struct *tsec = selinux_cred(current_cred());
2512 u32 osid, sid;
2513 int rc;
2514
2515 osid = tsec->osid;
2516 sid = tsec->sid;
2517
2518 if (sid == osid)
2519 return;
2520
2521 /* Check whether the new SID can inherit signal state from the old SID.
2522 * If not, clear itimers to avoid subsequent signal generation and
2523 * flush and unblock signals.
2524 *
2525 * This must occur _after_ the task SID has been updated so that any
2526 * kill done after the flush will be checked against the new SID.
2527 */
2528 rc = avc_has_perm(&selinux_state,
2529 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2530 if (rc) {
2531 clear_itimer();
2532
2533 spin_lock_irq(&current->sighand->siglock);
2534 if (!fatal_signal_pending(current)) {
2535 flush_sigqueue(&current->pending);
2536 flush_sigqueue(&current->signal->shared_pending);
2537 flush_signal_handlers(current, 1);
2538 sigemptyset(&current->blocked);
2539 recalc_sigpending();
2540 }
2541 spin_unlock_irq(&current->sighand->siglock);
2542 }
2543
2544 /* Wake up the parent if it is waiting so that it can recheck
2545 * wait permission to the new task SID. */
2546 read_lock(&tasklist_lock);
2547 __wake_up_parent(current, current->real_parent);
2548 read_unlock(&tasklist_lock);
2549 }
2550
2551 /* superblock security operations */
2552
2553 static int selinux_sb_alloc_security(struct super_block *sb)
2554 {
2555 struct superblock_security_struct *sbsec;
2556
2557 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
2558 if (!sbsec)
2559 return -ENOMEM;
2560
2561 mutex_init(&sbsec->lock);
2562 INIT_LIST_HEAD(&sbsec->isec_head);
2563 spin_lock_init(&sbsec->isec_lock);
2564 sbsec->sb = sb;
2565 sbsec->sid = SECINITSID_UNLABELED;
2566 sbsec->def_sid = SECINITSID_FILE;
2567 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2568 sb->s_security = sbsec;
2569
2570 return 0;
2571 }
2572
2573 static void selinux_sb_free_security(struct super_block *sb)
2574 {
2575 superblock_free_security(sb);
2576 }
2577
2578 static inline int opt_len(const char *s)
2579 {
2580 bool open_quote = false;
2581 int len;
2582 char c;
2583
2584 for (len = 0; (c = s[len]) != '\0'; len++) {
2585 if (c == '"')
2586 open_quote = !open_quote;
2587 if (c == ',' && !open_quote)
2588 break;
2589 }
2590 return len;
2591 }
2592
2593 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2594 {
2595 char *from = options;
2596 char *to = options;
2597 bool first = true;
2598 int rc;
2599
2600 while (1) {
2601 int len = opt_len(from);
2602 int token;
2603 char *arg = NULL;
2604
2605 token = match_opt_prefix(from, len, &arg);
2606
2607 if (token != Opt_error) {
2608 char *p, *q;
2609
2610 /* strip quotes */
2611 if (arg) {
2612 for (p = q = arg; p < from + len; p++) {
2613 char c = *p;
2614 if (c != '"')
2615 *q++ = c;
2616 }
2617 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2618 if (!arg) {
2619 rc = -ENOMEM;
2620 goto free_opt;
2621 }
2622 }
2623 rc = selinux_add_opt(token, arg, mnt_opts);
2624 if (unlikely(rc)) {
2625 kfree(arg);
2626 goto free_opt;
2627 }
2628 } else {
2629 if (!first) { // copy with preceding comma
2630 from--;
2631 len++;
2632 }
2633 if (to != from)
2634 memmove(to, from, len);
2635 to += len;
2636 first = false;
2637 }
2638 if (!from[len])
2639 break;
2640 from += len + 1;
2641 }
2642 *to = '\0';
2643 return 0;
2644
2645 free_opt:
2646 if (*mnt_opts) {
2647 selinux_free_mnt_opts(*mnt_opts);
2648 *mnt_opts = NULL;
2649 }
2650 return rc;
2651 }
2652
2653 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2654 {
2655 struct selinux_mnt_opts *opts = mnt_opts;
2656 struct superblock_security_struct *sbsec = sb->s_security;
2657 u32 sid;
2658 int rc;
2659
2660 if (!(sbsec->flags & SE_SBINITIALIZED))
2661 return 0;
2662
2663 if (!opts)
2664 return 0;
2665
2666 if (opts->fscontext) {
2667 rc = parse_sid(sb, opts->fscontext, &sid);
2668 if (rc)
2669 return rc;
2670 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2671 goto out_bad_option;
2672 }
2673 if (opts->context) {
2674 rc = parse_sid(sb, opts->context, &sid);
2675 if (rc)
2676 return rc;
2677 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2678 goto out_bad_option;
2679 }
2680 if (opts->rootcontext) {
2681 struct inode_security_struct *root_isec;
2682 root_isec = backing_inode_security(sb->s_root);
2683 rc = parse_sid(sb, opts->rootcontext, &sid);
2684 if (rc)
2685 return rc;
2686 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2687 goto out_bad_option;
2688 }
2689 if (opts->defcontext) {
2690 rc = parse_sid(sb, opts->defcontext, &sid);
2691 if (rc)
2692 return rc;
2693 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2694 goto out_bad_option;
2695 }
2696 return 0;
2697
2698 out_bad_option:
2699 pr_warn("SELinux: unable to change security options "
2700 "during remount (dev %s, type=%s)\n", sb->s_id,
2701 sb->s_type->name);
2702 return -EINVAL;
2703 }
2704
2705 static int selinux_sb_kern_mount(struct super_block *sb)
2706 {
2707 const struct cred *cred = current_cred();
2708 struct common_audit_data ad;
2709
2710 ad.type = LSM_AUDIT_DATA_DENTRY;
2711 ad.u.dentry = sb->s_root;
2712 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2713 }
2714
2715 static int selinux_sb_statfs(struct dentry *dentry)
2716 {
2717 const struct cred *cred = current_cred();
2718 struct common_audit_data ad;
2719
2720 ad.type = LSM_AUDIT_DATA_DENTRY;
2721 ad.u.dentry = dentry->d_sb->s_root;
2722 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2723 }
2724
2725 static int selinux_mount(const char *dev_name,
2726 const struct path *path,
2727 const char *type,
2728 unsigned long flags,
2729 void *data)
2730 {
2731 const struct cred *cred = current_cred();
2732
2733 if (flags & MS_REMOUNT)
2734 return superblock_has_perm(cred, path->dentry->d_sb,
2735 FILESYSTEM__REMOUNT, NULL);
2736 else
2737 return path_has_perm(cred, path, FILE__MOUNTON);
2738 }
2739
2740 static int selinux_move_mount(const struct path *from_path,
2741 const struct path *to_path)
2742 {
2743 const struct cred *cred = current_cred();
2744
2745 return path_has_perm(cred, to_path, FILE__MOUNTON);
2746 }
2747
2748 static int selinux_umount(struct vfsmount *mnt, int flags)
2749 {
2750 const struct cred *cred = current_cred();
2751
2752 return superblock_has_perm(cred, mnt->mnt_sb,
2753 FILESYSTEM__UNMOUNT, NULL);
2754 }
2755
2756 static int selinux_fs_context_dup(struct fs_context *fc,
2757 struct fs_context *src_fc)
2758 {
2759 const struct selinux_mnt_opts *src = src_fc->security;
2760 struct selinux_mnt_opts *opts;
2761
2762 if (!src)
2763 return 0;
2764
2765 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2766 if (!fc->security)
2767 return -ENOMEM;
2768
2769 opts = fc->security;
2770
2771 if (src->fscontext) {
2772 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2773 if (!opts->fscontext)
2774 return -ENOMEM;
2775 }
2776 if (src->context) {
2777 opts->context = kstrdup(src->context, GFP_KERNEL);
2778 if (!opts->context)
2779 return -ENOMEM;
2780 }
2781 if (src->rootcontext) {
2782 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2783 if (!opts->rootcontext)
2784 return -ENOMEM;
2785 }
2786 if (src->defcontext) {
2787 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2788 if (!opts->defcontext)
2789 return -ENOMEM;
2790 }
2791 return 0;
2792 }
2793
2794 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2795 fsparam_string(CONTEXT_STR, Opt_context),
2796 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2797 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2798 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2799 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2800 {}
2801 };
2802
2803 static int selinux_fs_context_parse_param(struct fs_context *fc,
2804 struct fs_parameter *param)
2805 {
2806 struct fs_parse_result result;
2807 int opt, rc;
2808
2809 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2810 if (opt < 0)
2811 return opt;
2812
2813 rc = selinux_add_opt(opt, param->string, &fc->security);
2814 if (!rc) {
2815 param->string = NULL;
2816 rc = 1;
2817 }
2818 return rc;
2819 }
2820
2821 /* inode security operations */
2822
2823 static int selinux_inode_alloc_security(struct inode *inode)
2824 {
2825 struct inode_security_struct *isec = selinux_inode(inode);
2826 u32 sid = current_sid();
2827
2828 spin_lock_init(&isec->lock);
2829 INIT_LIST_HEAD(&isec->list);
2830 isec->inode = inode;
2831 isec->sid = SECINITSID_UNLABELED;
2832 isec->sclass = SECCLASS_FILE;
2833 isec->task_sid = sid;
2834 isec->initialized = LABEL_INVALID;
2835
2836 return 0;
2837 }
2838
2839 static void selinux_inode_free_security(struct inode *inode)
2840 {
2841 inode_free_security(inode);
2842 }
2843
2844 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2845 const struct qstr *name, void **ctx,
2846 u32 *ctxlen)
2847 {
2848 u32 newsid;
2849 int rc;
2850
2851 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2852 d_inode(dentry->d_parent), name,
2853 inode_mode_to_security_class(mode),
2854 &newsid);
2855 if (rc)
2856 return rc;
2857
2858 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2859 ctxlen);
2860 }
2861
2862 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2863 struct qstr *name,
2864 const struct cred *old,
2865 struct cred *new)
2866 {
2867 u32 newsid;
2868 int rc;
2869 struct task_security_struct *tsec;
2870
2871 rc = selinux_determine_inode_label(selinux_cred(old),
2872 d_inode(dentry->d_parent), name,
2873 inode_mode_to_security_class(mode),
2874 &newsid);
2875 if (rc)
2876 return rc;
2877
2878 tsec = selinux_cred(new);
2879 tsec->create_sid = newsid;
2880 return 0;
2881 }
2882
2883 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2884 const struct qstr *qstr,
2885 const char **name,
2886 void **value, size_t *len)
2887 {
2888 const struct task_security_struct *tsec = selinux_cred(current_cred());
2889 struct superblock_security_struct *sbsec;
2890 u32 newsid, clen;
2891 int rc;
2892 char *context;
2893
2894 sbsec = dir->i_sb->s_security;
2895
2896 newsid = tsec->create_sid;
2897
2898 rc = selinux_determine_inode_label(tsec, dir, qstr,
2899 inode_mode_to_security_class(inode->i_mode),
2900 &newsid);
2901 if (rc)
2902 return rc;
2903
2904 /* Possibly defer initialization to selinux_complete_init. */
2905 if (sbsec->flags & SE_SBINITIALIZED) {
2906 struct inode_security_struct *isec = selinux_inode(inode);
2907 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2908 isec->sid = newsid;
2909 isec->initialized = LABEL_INITIALIZED;
2910 }
2911
2912 if (!selinux_initialized(&selinux_state) ||
2913 !(sbsec->flags & SBLABEL_MNT))
2914 return -EOPNOTSUPP;
2915
2916 if (name)
2917 *name = XATTR_SELINUX_SUFFIX;
2918
2919 if (value && len) {
2920 rc = security_sid_to_context_force(&selinux_state, newsid,
2921 &context, &clen);
2922 if (rc)
2923 return rc;
2924 *value = context;
2925 *len = clen;
2926 }
2927
2928 return 0;
2929 }
2930
2931 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2932 {
2933 return may_create(dir, dentry, SECCLASS_FILE);
2934 }
2935
2936 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2937 {
2938 return may_link(dir, old_dentry, MAY_LINK);
2939 }
2940
2941 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2942 {
2943 return may_link(dir, dentry, MAY_UNLINK);
2944 }
2945
2946 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2947 {
2948 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2949 }
2950
2951 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2952 {
2953 return may_create(dir, dentry, SECCLASS_DIR);
2954 }
2955
2956 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2957 {
2958 return may_link(dir, dentry, MAY_RMDIR);
2959 }
2960
2961 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2962 {
2963 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2964 }
2965
2966 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2967 struct inode *new_inode, struct dentry *new_dentry)
2968 {
2969 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2970 }
2971
2972 static int selinux_inode_readlink(struct dentry *dentry)
2973 {
2974 const struct cred *cred = current_cred();
2975
2976 return dentry_has_perm(cred, dentry, FILE__READ);
2977 }
2978
2979 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2980 bool rcu)
2981 {
2982 const struct cred *cred = current_cred();
2983 struct common_audit_data ad;
2984 struct inode_security_struct *isec;
2985 u32 sid;
2986
2987 validate_creds(cred);
2988
2989 ad.type = LSM_AUDIT_DATA_DENTRY;
2990 ad.u.dentry = dentry;
2991 sid = cred_sid(cred);
2992 isec = inode_security_rcu(inode, rcu);
2993 if (IS_ERR(isec))
2994 return PTR_ERR(isec);
2995
2996 return avc_has_perm_flags(&selinux_state,
2997 sid, isec->sid, isec->sclass, FILE__READ, &ad,
2998 rcu ? MAY_NOT_BLOCK : 0);
2999 }
3000
3001 static noinline int audit_inode_permission(struct inode *inode,
3002 u32 perms, u32 audited, u32 denied,
3003 int result)
3004 {
3005 struct common_audit_data ad;
3006 struct inode_security_struct *isec = selinux_inode(inode);
3007 int rc;
3008
3009 ad.type = LSM_AUDIT_DATA_INODE;
3010 ad.u.inode = inode;
3011
3012 rc = slow_avc_audit(&selinux_state,
3013 current_sid(), isec->sid, isec->sclass, perms,
3014 audited, denied, result, &ad);
3015 if (rc)
3016 return rc;
3017 return 0;
3018 }
3019
3020 static int selinux_inode_permission(struct inode *inode, int mask)
3021 {
3022 const struct cred *cred = current_cred();
3023 u32 perms;
3024 bool from_access;
3025 bool no_block = mask & MAY_NOT_BLOCK;
3026 struct inode_security_struct *isec;
3027 u32 sid;
3028 struct av_decision avd;
3029 int rc, rc2;
3030 u32 audited, denied;
3031
3032 from_access = mask & MAY_ACCESS;
3033 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3034
3035 /* No permission to check. Existence test. */
3036 if (!mask)
3037 return 0;
3038
3039 validate_creds(cred);
3040
3041 if (unlikely(IS_PRIVATE(inode)))
3042 return 0;
3043
3044 perms = file_mask_to_av(inode->i_mode, mask);
3045
3046 sid = cred_sid(cred);
3047 isec = inode_security_rcu(inode, no_block);
3048 if (IS_ERR(isec))
3049 return PTR_ERR(isec);
3050
3051 rc = avc_has_perm_noaudit(&selinux_state,
3052 sid, isec->sid, isec->sclass, perms,
3053 no_block ? AVC_NONBLOCKING : 0,
3054 &avd);
3055 audited = avc_audit_required(perms, &avd, rc,
3056 from_access ? FILE__AUDIT_ACCESS : 0,
3057 &denied);
3058 if (likely(!audited))
3059 return rc;
3060
3061 /* fall back to ref-walk if we have to generate audit */
3062 if (no_block)
3063 return -ECHILD;
3064
3065 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3066 if (rc2)
3067 return rc2;
3068 return rc;
3069 }
3070
3071 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3072 {
3073 const struct cred *cred = current_cred();
3074 struct inode *inode = d_backing_inode(dentry);
3075 unsigned int ia_valid = iattr->ia_valid;
3076 __u32 av = FILE__WRITE;
3077
3078 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3079 if (ia_valid & ATTR_FORCE) {
3080 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3081 ATTR_FORCE);
3082 if (!ia_valid)
3083 return 0;
3084 }
3085
3086 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3087 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3088 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3089
3090 if (selinux_policycap_openperm() &&
3091 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3092 (ia_valid & ATTR_SIZE) &&
3093 !(ia_valid & ATTR_FILE))
3094 av |= FILE__OPEN;
3095
3096 return dentry_has_perm(cred, dentry, av);
3097 }
3098
3099 static int selinux_inode_getattr(const struct path *path)
3100 {
3101 return path_has_perm(current_cred(), path, FILE__GETATTR);
3102 }
3103
3104 static bool has_cap_mac_admin(bool audit)
3105 {
3106 const struct cred *cred = current_cred();
3107 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3108
3109 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3110 return false;
3111 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3112 return false;
3113 return true;
3114 }
3115
3116 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3117 const void *value, size_t size, int flags)
3118 {
3119 struct inode *inode = d_backing_inode(dentry);
3120 struct inode_security_struct *isec;
3121 struct superblock_security_struct *sbsec;
3122 struct common_audit_data ad;
3123 u32 newsid, sid = current_sid();
3124 int rc = 0;
3125
3126 if (strcmp(name, XATTR_NAME_SELINUX)) {
3127 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3128 if (rc)
3129 return rc;
3130
3131 /* Not an attribute we recognize, so just check the
3132 ordinary setattr permission. */
3133 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3134 }
3135
3136 if (!selinux_initialized(&selinux_state))
3137 return (inode_owner_or_capable(inode) ? 0 : -EPERM);
3138
3139 sbsec = inode->i_sb->s_security;
3140 if (!(sbsec->flags & SBLABEL_MNT))
3141 return -EOPNOTSUPP;
3142
3143 if (!inode_owner_or_capable(inode))
3144 return -EPERM;
3145
3146 ad.type = LSM_AUDIT_DATA_DENTRY;
3147 ad.u.dentry = dentry;
3148
3149 isec = backing_inode_security(dentry);
3150 rc = avc_has_perm(&selinux_state,
3151 sid, isec->sid, isec->sclass,
3152 FILE__RELABELFROM, &ad);
3153 if (rc)
3154 return rc;
3155
3156 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3157 GFP_KERNEL);
3158 if (rc == -EINVAL) {
3159 if (!has_cap_mac_admin(true)) {
3160 struct audit_buffer *ab;
3161 size_t audit_size;
3162
3163 /* We strip a nul only if it is at the end, otherwise the
3164 * context contains a nul and we should audit that */
3165 if (value) {
3166 const char *str = value;
3167
3168 if (str[size - 1] == '\0')
3169 audit_size = size - 1;
3170 else
3171 audit_size = size;
3172 } else {
3173 audit_size = 0;
3174 }
3175 ab = audit_log_start(audit_context(),
3176 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3177 audit_log_format(ab, "op=setxattr invalid_context=");
3178 audit_log_n_untrustedstring(ab, value, audit_size);
3179 audit_log_end(ab);
3180
3181 return rc;
3182 }
3183 rc = security_context_to_sid_force(&selinux_state, value,
3184 size, &newsid);
3185 }
3186 if (rc)
3187 return rc;
3188
3189 rc = avc_has_perm(&selinux_state,
3190 sid, newsid, isec->sclass,
3191 FILE__RELABELTO, &ad);
3192 if (rc)
3193 return rc;
3194
3195 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3196 sid, isec->sclass);
3197 if (rc)
3198 return rc;
3199
3200 return avc_has_perm(&selinux_state,
3201 newsid,
3202 sbsec->sid,
3203 SECCLASS_FILESYSTEM,
3204 FILESYSTEM__ASSOCIATE,
3205 &ad);
3206 }
3207
3208 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3209 const void *value, size_t size,
3210 int flags)
3211 {
3212 struct inode *inode = d_backing_inode(dentry);
3213 struct inode_security_struct *isec;
3214 u32 newsid;
3215 int rc;
3216
3217 if (strcmp(name, XATTR_NAME_SELINUX)) {
3218 /* Not an attribute we recognize, so nothing to do. */
3219 return;
3220 }
3221
3222 if (!selinux_initialized(&selinux_state)) {
3223 /* If we haven't even been initialized, then we can't validate
3224 * against a policy, so leave the label as invalid. It may
3225 * resolve to a valid label on the next revalidation try if
3226 * we've since initialized.
3227 */
3228 return;
3229 }
3230
3231 rc = security_context_to_sid_force(&selinux_state, value, size,
3232 &newsid);
3233 if (rc) {
3234 pr_err("SELinux: unable to map context to SID"
3235 "for (%s, %lu), rc=%d\n",
3236 inode->i_sb->s_id, inode->i_ino, -rc);
3237 return;
3238 }
3239
3240 isec = backing_inode_security(dentry);
3241 spin_lock(&isec->lock);
3242 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3243 isec->sid = newsid;
3244 isec->initialized = LABEL_INITIALIZED;
3245 spin_unlock(&isec->lock);
3246
3247 return;
3248 }
3249
3250 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3251 {
3252 const struct cred *cred = current_cred();
3253
3254 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3255 }
3256
3257 static int selinux_inode_listxattr(struct dentry *dentry)
3258 {
3259 const struct cred *cred = current_cred();
3260
3261 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3262 }
3263
3264 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3265 {
3266 if (strcmp(name, XATTR_NAME_SELINUX)) {
3267 int rc = cap_inode_removexattr(dentry, name);
3268 if (rc)
3269 return rc;
3270
3271 /* Not an attribute we recognize, so just check the
3272 ordinary setattr permission. */
3273 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3274 }
3275
3276 /* No one is allowed to remove a SELinux security label.
3277 You can change the label, but all data must be labeled. */
3278 return -EACCES;
3279 }
3280
3281 static int selinux_path_notify(const struct path *path, u64 mask,
3282 unsigned int obj_type)
3283 {
3284 int ret;
3285 u32 perm;
3286
3287 struct common_audit_data ad;
3288
3289 ad.type = LSM_AUDIT_DATA_PATH;
3290 ad.u.path = *path;
3291
3292 /*
3293 * Set permission needed based on the type of mark being set.
3294 * Performs an additional check for sb watches.
3295 */
3296 switch (obj_type) {
3297 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3298 perm = FILE__WATCH_MOUNT;
3299 break;
3300 case FSNOTIFY_OBJ_TYPE_SB:
3301 perm = FILE__WATCH_SB;
3302 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3303 FILESYSTEM__WATCH, &ad);
3304 if (ret)
3305 return ret;
3306 break;
3307 case FSNOTIFY_OBJ_TYPE_INODE:
3308 perm = FILE__WATCH;
3309 break;
3310 default:
3311 return -EINVAL;
3312 }
3313
3314 /* blocking watches require the file:watch_with_perm permission */
3315 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3316 perm |= FILE__WATCH_WITH_PERM;
3317
3318 /* watches on read-like events need the file:watch_reads permission */
3319 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3320 perm |= FILE__WATCH_READS;
3321
3322 return path_has_perm(current_cred(), path, perm);
3323 }
3324
3325 /*
3326 * Copy the inode security context value to the user.
3327 *
3328 * Permission check is handled by selinux_inode_getxattr hook.
3329 */
3330 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3331 {
3332 u32 size;
3333 int error;
3334 char *context = NULL;
3335 struct inode_security_struct *isec;
3336
3337 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3338 return -EOPNOTSUPP;
3339
3340 /*
3341 * If the caller has CAP_MAC_ADMIN, then get the raw context
3342 * value even if it is not defined by current policy; otherwise,
3343 * use the in-core value under current policy.
3344 * Use the non-auditing forms of the permission checks since
3345 * getxattr may be called by unprivileged processes commonly
3346 * and lack of permission just means that we fall back to the
3347 * in-core context value, not a denial.
3348 */
3349 isec = inode_security(inode);
3350 if (has_cap_mac_admin(false))
3351 error = security_sid_to_context_force(&selinux_state,
3352 isec->sid, &context,
3353 &size);
3354 else
3355 error = security_sid_to_context(&selinux_state, isec->sid,
3356 &context, &size);
3357 if (error)
3358 return error;
3359 error = size;
3360 if (alloc) {
3361 *buffer = context;
3362 goto out_nofree;
3363 }
3364 kfree(context);
3365 out_nofree:
3366 return error;
3367 }
3368
3369 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3370 const void *value, size_t size, int flags)
3371 {
3372 struct inode_security_struct *isec = inode_security_novalidate(inode);
3373 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3374 u32 newsid;
3375 int rc;
3376
3377 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3378 return -EOPNOTSUPP;
3379
3380 if (!(sbsec->flags & SBLABEL_MNT))
3381 return -EOPNOTSUPP;
3382
3383 if (!value || !size)
3384 return -EACCES;
3385
3386 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3387 GFP_KERNEL);
3388 if (rc)
3389 return rc;
3390
3391 spin_lock(&isec->lock);
3392 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3393 isec->sid = newsid;
3394 isec->initialized = LABEL_INITIALIZED;
3395 spin_unlock(&isec->lock);
3396 return 0;
3397 }
3398
3399 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3400 {
3401 const int len = sizeof(XATTR_NAME_SELINUX);
3402 if (buffer && len <= buffer_size)
3403 memcpy(buffer, XATTR_NAME_SELINUX, len);
3404 return len;
3405 }
3406
3407 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3408 {
3409 struct inode_security_struct *isec = inode_security_novalidate(inode);
3410 *secid = isec->sid;
3411 }
3412
3413 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3414 {
3415 u32 sid;
3416 struct task_security_struct *tsec;
3417 struct cred *new_creds = *new;
3418
3419 if (new_creds == NULL) {
3420 new_creds = prepare_creds();
3421 if (!new_creds)
3422 return -ENOMEM;
3423 }
3424
3425 tsec = selinux_cred(new_creds);
3426 /* Get label from overlay inode and set it in create_sid */
3427 selinux_inode_getsecid(d_inode(src), &sid);
3428 tsec->create_sid = sid;
3429 *new = new_creds;
3430 return 0;
3431 }
3432
3433 static int selinux_inode_copy_up_xattr(const char *name)
3434 {
3435 /* The copy_up hook above sets the initial context on an inode, but we
3436 * don't then want to overwrite it by blindly copying all the lower
3437 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3438 */
3439 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3440 return 1; /* Discard */
3441 /*
3442 * Any other attribute apart from SELINUX is not claimed, supported
3443 * by selinux.
3444 */
3445 return -EOPNOTSUPP;
3446 }
3447
3448 /* kernfs node operations */
3449
3450 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3451 struct kernfs_node *kn)
3452 {
3453 const struct task_security_struct *tsec = selinux_cred(current_cred());
3454 u32 parent_sid, newsid, clen;
3455 int rc;
3456 char *context;
3457
3458 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3459 if (rc == -ENODATA)
3460 return 0;
3461 else if (rc < 0)
3462 return rc;
3463
3464 clen = (u32)rc;
3465 context = kmalloc(clen, GFP_KERNEL);
3466 if (!context)
3467 return -ENOMEM;
3468
3469 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3470 if (rc < 0) {
3471 kfree(context);
3472 return rc;
3473 }
3474
3475 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3476 GFP_KERNEL);
3477 kfree(context);
3478 if (rc)
3479 return rc;
3480
3481 if (tsec->create_sid) {
3482 newsid = tsec->create_sid;
3483 } else {
3484 u16 secclass = inode_mode_to_security_class(kn->mode);
3485 struct qstr q;
3486
3487 q.name = kn->name;
3488 q.hash_len = hashlen_string(kn_dir, kn->name);
3489
3490 rc = security_transition_sid(&selinux_state, tsec->sid,
3491 parent_sid, secclass, &q,
3492 &newsid);
3493 if (rc)
3494 return rc;
3495 }
3496
3497 rc = security_sid_to_context_force(&selinux_state, newsid,
3498 &context, &clen);
3499 if (rc)
3500 return rc;
3501
3502 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3503 XATTR_CREATE);
3504 kfree(context);
3505 return rc;
3506 }
3507
3508
3509 /* file security operations */
3510
3511 static int selinux_revalidate_file_permission(struct file *file, int mask)
3512 {
3513 const struct cred *cred = current_cred();
3514 struct inode *inode = file_inode(file);
3515
3516 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3517 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3518 mask |= MAY_APPEND;
3519
3520 return file_has_perm(cred, file,
3521 file_mask_to_av(inode->i_mode, mask));
3522 }
3523
3524 static int selinux_file_permission(struct file *file, int mask)
3525 {
3526 struct inode *inode = file_inode(file);
3527 struct file_security_struct *fsec = selinux_file(file);
3528 struct inode_security_struct *isec;
3529 u32 sid = current_sid();
3530
3531 if (!mask)
3532 /* No permission to check. Existence test. */
3533 return 0;
3534
3535 isec = inode_security(inode);
3536 if (sid == fsec->sid && fsec->isid == isec->sid &&
3537 fsec->pseqno == avc_policy_seqno(&selinux_state))
3538 /* No change since file_open check. */
3539 return 0;
3540
3541 return selinux_revalidate_file_permission(file, mask);
3542 }
3543
3544 static int selinux_file_alloc_security(struct file *file)
3545 {
3546 struct file_security_struct *fsec = selinux_file(file);
3547 u32 sid = current_sid();
3548
3549 fsec->sid = sid;
3550 fsec->fown_sid = sid;
3551
3552 return 0;
3553 }
3554
3555 /*
3556 * Check whether a task has the ioctl permission and cmd
3557 * operation to an inode.
3558 */
3559 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3560 u32 requested, u16 cmd)
3561 {
3562 struct common_audit_data ad;
3563 struct file_security_struct *fsec = selinux_file(file);
3564 struct inode *inode = file_inode(file);
3565 struct inode_security_struct *isec;
3566 struct lsm_ioctlop_audit ioctl;
3567 u32 ssid = cred_sid(cred);
3568 int rc;
3569 u8 driver = cmd >> 8;
3570 u8 xperm = cmd & 0xff;
3571
3572 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3573 ad.u.op = &ioctl;
3574 ad.u.op->cmd = cmd;
3575 ad.u.op->path = file->f_path;
3576
3577 if (ssid != fsec->sid) {
3578 rc = avc_has_perm(&selinux_state,
3579 ssid, fsec->sid,
3580 SECCLASS_FD,
3581 FD__USE,
3582 &ad);
3583 if (rc)
3584 goto out;
3585 }
3586
3587 if (unlikely(IS_PRIVATE(inode)))
3588 return 0;
3589
3590 isec = inode_security(inode);
3591 rc = avc_has_extended_perms(&selinux_state,
3592 ssid, isec->sid, isec->sclass,
3593 requested, driver, xperm, &ad);
3594 out:
3595 return rc;
3596 }
3597
3598 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3599 unsigned long arg)
3600 {
3601 const struct cred *cred = current_cred();
3602 int error = 0;
3603
3604 switch (cmd) {
3605 case FIONREAD:
3606 /* fall through */
3607 case FIBMAP:
3608 /* fall through */
3609 case FIGETBSZ:
3610 /* fall through */
3611 case FS_IOC_GETFLAGS:
3612 /* fall through */
3613 case FS_IOC_GETVERSION:
3614 error = file_has_perm(cred, file, FILE__GETATTR);
3615 break;
3616
3617 case FS_IOC_SETFLAGS:
3618 /* fall through */
3619 case FS_IOC_SETVERSION:
3620 error = file_has_perm(cred, file, FILE__SETATTR);
3621 break;
3622
3623 /* sys_ioctl() checks */
3624 case FIONBIO:
3625 /* fall through */
3626 case FIOASYNC:
3627 error = file_has_perm(cred, file, 0);
3628 break;
3629
3630 case KDSKBENT:
3631 case KDSKBSENT:
3632 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3633 CAP_OPT_NONE, true);
3634 break;
3635
3636 /* default case assumes that the command will go
3637 * to the file's ioctl() function.
3638 */
3639 default:
3640 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3641 }
3642 return error;
3643 }
3644
3645 static int default_noexec __ro_after_init;
3646
3647 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3648 {
3649 const struct cred *cred = current_cred();
3650 u32 sid = cred_sid(cred);
3651 int rc = 0;
3652
3653 if (default_noexec &&
3654 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3655 (!shared && (prot & PROT_WRITE)))) {
3656 /*
3657 * We are making executable an anonymous mapping or a
3658 * private file mapping that will also be writable.
3659 * This has an additional check.
3660 */
3661 rc = avc_has_perm(&selinux_state,
3662 sid, sid, SECCLASS_PROCESS,
3663 PROCESS__EXECMEM, NULL);
3664 if (rc)
3665 goto error;
3666 }
3667
3668 if (file) {
3669 /* read access is always possible with a mapping */
3670 u32 av = FILE__READ;
3671
3672 /* write access only matters if the mapping is shared */
3673 if (shared && (prot & PROT_WRITE))
3674 av |= FILE__WRITE;
3675
3676 if (prot & PROT_EXEC)
3677 av |= FILE__EXECUTE;
3678
3679 return file_has_perm(cred, file, av);
3680 }
3681
3682 error:
3683 return rc;
3684 }
3685
3686 static int selinux_mmap_addr(unsigned long addr)
3687 {
3688 int rc = 0;
3689
3690 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3691 u32 sid = current_sid();
3692 rc = avc_has_perm(&selinux_state,
3693 sid, sid, SECCLASS_MEMPROTECT,
3694 MEMPROTECT__MMAP_ZERO, NULL);
3695 }
3696
3697 return rc;
3698 }
3699
3700 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3701 unsigned long prot, unsigned long flags)
3702 {
3703 struct common_audit_data ad;
3704 int rc;
3705
3706 if (file) {
3707 ad.type = LSM_AUDIT_DATA_FILE;
3708 ad.u.file = file;
3709 rc = inode_has_perm(current_cred(), file_inode(file),
3710 FILE__MAP, &ad);
3711 if (rc)
3712 return rc;
3713 }
3714
3715 if (selinux_state.checkreqprot)
3716 prot = reqprot;
3717
3718 return file_map_prot_check(file, prot,
3719 (flags & MAP_TYPE) == MAP_SHARED);
3720 }
3721
3722 static int selinux_file_mprotect(struct vm_area_struct *vma,
3723 unsigned long reqprot,
3724 unsigned long prot)
3725 {
3726 const struct cred *cred = current_cred();
3727 u32 sid = cred_sid(cred);
3728
3729 if (selinux_state.checkreqprot)
3730 prot = reqprot;
3731
3732 if (default_noexec &&
3733 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3734 int rc = 0;
3735 if (vma->vm_start >= vma->vm_mm->start_brk &&
3736 vma->vm_end <= vma->vm_mm->brk) {
3737 rc = avc_has_perm(&selinux_state,
3738 sid, sid, SECCLASS_PROCESS,
3739 PROCESS__EXECHEAP, NULL);
3740 } else if (!vma->vm_file &&
3741 ((vma->vm_start <= vma->vm_mm->start_stack &&
3742 vma->vm_end >= vma->vm_mm->start_stack) ||
3743 vma_is_stack_for_current(vma))) {
3744 rc = avc_has_perm(&selinux_state,
3745 sid, sid, SECCLASS_PROCESS,
3746 PROCESS__EXECSTACK, NULL);
3747 } else if (vma->vm_file && vma->anon_vma) {
3748 /*
3749 * We are making executable a file mapping that has
3750 * had some COW done. Since pages might have been
3751 * written, check ability to execute the possibly
3752 * modified content. This typically should only
3753 * occur for text relocations.
3754 */
3755 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3756 }
3757 if (rc)
3758 return rc;
3759 }
3760
3761 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3762 }
3763
3764 static int selinux_file_lock(struct file *file, unsigned int cmd)
3765 {
3766 const struct cred *cred = current_cred();
3767
3768 return file_has_perm(cred, file, FILE__LOCK);
3769 }
3770
3771 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3772 unsigned long arg)
3773 {
3774 const struct cred *cred = current_cred();
3775 int err = 0;
3776
3777 switch (cmd) {
3778 case F_SETFL:
3779 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3780 err = file_has_perm(cred, file, FILE__WRITE);
3781 break;
3782 }
3783 /* fall through */
3784 case F_SETOWN:
3785 case F_SETSIG:
3786 case F_GETFL:
3787 case F_GETOWN:
3788 case F_GETSIG:
3789 case F_GETOWNER_UIDS:
3790 /* Just check FD__USE permission */
3791 err = file_has_perm(cred, file, 0);
3792 break;
3793 case F_GETLK:
3794 case F_SETLK:
3795 case F_SETLKW:
3796 case F_OFD_GETLK:
3797 case F_OFD_SETLK:
3798 case F_OFD_SETLKW:
3799 #if BITS_PER_LONG == 32
3800 case F_GETLK64:
3801 case F_SETLK64:
3802 case F_SETLKW64:
3803 #endif
3804 err = file_has_perm(cred, file, FILE__LOCK);
3805 break;
3806 }
3807
3808 return err;
3809 }
3810
3811 static void selinux_file_set_fowner(struct file *file)
3812 {
3813 struct file_security_struct *fsec;
3814
3815 fsec = selinux_file(file);
3816 fsec->fown_sid = current_sid();
3817 }
3818
3819 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3820 struct fown_struct *fown, int signum)
3821 {
3822 struct file *file;
3823 u32 sid = task_sid(tsk);
3824 u32 perm;
3825 struct file_security_struct *fsec;
3826
3827 /* struct fown_struct is never outside the context of a struct file */
3828 file = container_of(fown, struct file, f_owner);
3829
3830 fsec = selinux_file(file);
3831
3832 if (!signum)
3833 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3834 else
3835 perm = signal_to_av(signum);
3836
3837 return avc_has_perm(&selinux_state,
3838 fsec->fown_sid, sid,
3839 SECCLASS_PROCESS, perm, NULL);
3840 }
3841
3842 static int selinux_file_receive(struct file *file)
3843 {
3844 const struct cred *cred = current_cred();
3845
3846 return file_has_perm(cred, file, file_to_av(file));
3847 }
3848
3849 static int selinux_file_open(struct file *file)
3850 {
3851 struct file_security_struct *fsec;
3852 struct inode_security_struct *isec;
3853
3854 fsec = selinux_file(file);
3855 isec = inode_security(file_inode(file));
3856 /*
3857 * Save inode label and policy sequence number
3858 * at open-time so that selinux_file_permission
3859 * can determine whether revalidation is necessary.
3860 * Task label is already saved in the file security
3861 * struct as its SID.
3862 */
3863 fsec->isid = isec->sid;
3864 fsec->pseqno = avc_policy_seqno(&selinux_state);
3865 /*
3866 * Since the inode label or policy seqno may have changed
3867 * between the selinux_inode_permission check and the saving
3868 * of state above, recheck that access is still permitted.
3869 * Otherwise, access might never be revalidated against the
3870 * new inode label or new policy.
3871 * This check is not redundant - do not remove.
3872 */
3873 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3874 }
3875
3876 /* task security operations */
3877
3878 static int selinux_task_alloc(struct task_struct *task,
3879 unsigned long clone_flags)
3880 {
3881 u32 sid = current_sid();
3882
3883 return avc_has_perm(&selinux_state,
3884 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3885 }
3886
3887 /*
3888 * prepare a new set of credentials for modification
3889 */
3890 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3891 gfp_t gfp)
3892 {
3893 const struct task_security_struct *old_tsec = selinux_cred(old);
3894 struct task_security_struct *tsec = selinux_cred(new);
3895
3896 *tsec = *old_tsec;
3897 return 0;
3898 }
3899
3900 /*
3901 * transfer the SELinux data to a blank set of creds
3902 */
3903 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3904 {
3905 const struct task_security_struct *old_tsec = selinux_cred(old);
3906 struct task_security_struct *tsec = selinux_cred(new);
3907
3908 *tsec = *old_tsec;
3909 }
3910
3911 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3912 {
3913 *secid = cred_sid(c);
3914 }
3915
3916 /*
3917 * set the security data for a kernel service
3918 * - all the creation contexts are set to unlabelled
3919 */
3920 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3921 {
3922 struct task_security_struct *tsec = selinux_cred(new);
3923 u32 sid = current_sid();
3924 int ret;
3925
3926 ret = avc_has_perm(&selinux_state,
3927 sid, secid,
3928 SECCLASS_KERNEL_SERVICE,
3929 KERNEL_SERVICE__USE_AS_OVERRIDE,
3930 NULL);
3931 if (ret == 0) {
3932 tsec->sid = secid;
3933 tsec->create_sid = 0;
3934 tsec->keycreate_sid = 0;
3935 tsec->sockcreate_sid = 0;
3936 }
3937 return ret;
3938 }
3939
3940 /*
3941 * set the file creation context in a security record to the same as the
3942 * objective context of the specified inode
3943 */
3944 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3945 {
3946 struct inode_security_struct *isec = inode_security(inode);
3947 struct task_security_struct *tsec = selinux_cred(new);
3948 u32 sid = current_sid();
3949 int ret;
3950
3951 ret = avc_has_perm(&selinux_state,
3952 sid, isec->sid,
3953 SECCLASS_KERNEL_SERVICE,
3954 KERNEL_SERVICE__CREATE_FILES_AS,
3955 NULL);
3956
3957 if (ret == 0)
3958 tsec->create_sid = isec->sid;
3959 return ret;
3960 }
3961
3962 static int selinux_kernel_module_request(char *kmod_name)
3963 {
3964 struct common_audit_data ad;
3965
3966 ad.type = LSM_AUDIT_DATA_KMOD;
3967 ad.u.kmod_name = kmod_name;
3968
3969 return avc_has_perm(&selinux_state,
3970 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3971 SYSTEM__MODULE_REQUEST, &ad);
3972 }
3973
3974 static int selinux_kernel_module_from_file(struct file *file)
3975 {
3976 struct common_audit_data ad;
3977 struct inode_security_struct *isec;
3978 struct file_security_struct *fsec;
3979 u32 sid = current_sid();
3980 int rc;
3981
3982 /* init_module */
3983 if (file == NULL)
3984 return avc_has_perm(&selinux_state,
3985 sid, sid, SECCLASS_SYSTEM,
3986 SYSTEM__MODULE_LOAD, NULL);
3987
3988 /* finit_module */
3989
3990 ad.type = LSM_AUDIT_DATA_FILE;
3991 ad.u.file = file;
3992
3993 fsec = selinux_file(file);
3994 if (sid != fsec->sid) {
3995 rc = avc_has_perm(&selinux_state,
3996 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3997 if (rc)
3998 return rc;
3999 }
4000
4001 isec = inode_security(file_inode(file));
4002 return avc_has_perm(&selinux_state,
4003 sid, isec->sid, SECCLASS_SYSTEM,
4004 SYSTEM__MODULE_LOAD, &ad);
4005 }
4006
4007 static int selinux_kernel_read_file(struct file *file,
4008 enum kernel_read_file_id id)
4009 {
4010 int rc = 0;
4011
4012 switch (id) {
4013 case READING_MODULE:
4014 rc = selinux_kernel_module_from_file(file);
4015 break;
4016 default:
4017 break;
4018 }
4019
4020 return rc;
4021 }
4022
4023 static int selinux_kernel_load_data(enum kernel_load_data_id id)
4024 {
4025 int rc = 0;
4026
4027 switch (id) {
4028 case LOADING_MODULE:
4029 rc = selinux_kernel_module_from_file(NULL);
4030 default:
4031 break;
4032 }
4033
4034 return rc;
4035 }
4036
4037 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4038 {
4039 return avc_has_perm(&selinux_state,
4040 current_sid(), task_sid(p), SECCLASS_PROCESS,
4041 PROCESS__SETPGID, NULL);
4042 }
4043
4044 static int selinux_task_getpgid(struct task_struct *p)
4045 {
4046 return avc_has_perm(&selinux_state,
4047 current_sid(), task_sid(p), SECCLASS_PROCESS,
4048 PROCESS__GETPGID, NULL);
4049 }
4050
4051 static int selinux_task_getsid(struct task_struct *p)
4052 {
4053 return avc_has_perm(&selinux_state,
4054 current_sid(), task_sid(p), SECCLASS_PROCESS,
4055 PROCESS__GETSESSION, NULL);
4056 }
4057
4058 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4059 {
4060 *secid = task_sid(p);
4061 }
4062
4063 static int selinux_task_setnice(struct task_struct *p, int nice)
4064 {
4065 return avc_has_perm(&selinux_state,
4066 current_sid(), task_sid(p), SECCLASS_PROCESS,
4067 PROCESS__SETSCHED, NULL);
4068 }
4069
4070 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4071 {
4072 return avc_has_perm(&selinux_state,
4073 current_sid(), task_sid(p), SECCLASS_PROCESS,
4074 PROCESS__SETSCHED, NULL);
4075 }
4076
4077 static int selinux_task_getioprio(struct task_struct *p)
4078 {
4079 return avc_has_perm(&selinux_state,
4080 current_sid(), task_sid(p), SECCLASS_PROCESS,
4081 PROCESS__GETSCHED, NULL);
4082 }
4083
4084 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4085 unsigned int flags)
4086 {
4087 u32 av = 0;
4088
4089 if (!flags)
4090 return 0;
4091 if (flags & LSM_PRLIMIT_WRITE)
4092 av |= PROCESS__SETRLIMIT;
4093 if (flags & LSM_PRLIMIT_READ)
4094 av |= PROCESS__GETRLIMIT;
4095 return avc_has_perm(&selinux_state,
4096 cred_sid(cred), cred_sid(tcred),
4097 SECCLASS_PROCESS, av, NULL);
4098 }
4099
4100 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4101 struct rlimit *new_rlim)
4102 {
4103 struct rlimit *old_rlim = p->signal->rlim + resource;
4104
4105 /* Control the ability to change the hard limit (whether
4106 lowering or raising it), so that the hard limit can
4107 later be used as a safe reset point for the soft limit
4108 upon context transitions. See selinux_bprm_committing_creds. */
4109 if (old_rlim->rlim_max != new_rlim->rlim_max)
4110 return avc_has_perm(&selinux_state,
4111 current_sid(), task_sid(p),
4112 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4113
4114 return 0;
4115 }
4116
4117 static int selinux_task_setscheduler(struct task_struct *p)
4118 {
4119 return avc_has_perm(&selinux_state,
4120 current_sid(), task_sid(p), SECCLASS_PROCESS,
4121 PROCESS__SETSCHED, NULL);
4122 }
4123
4124 static int selinux_task_getscheduler(struct task_struct *p)
4125 {
4126 return avc_has_perm(&selinux_state,
4127 current_sid(), task_sid(p), SECCLASS_PROCESS,
4128 PROCESS__GETSCHED, NULL);
4129 }
4130
4131 static int selinux_task_movememory(struct task_struct *p)
4132 {
4133 return avc_has_perm(&selinux_state,
4134 current_sid(), task_sid(p), SECCLASS_PROCESS,
4135 PROCESS__SETSCHED, NULL);
4136 }
4137
4138 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4139 int sig, const struct cred *cred)
4140 {
4141 u32 secid;
4142 u32 perm;
4143
4144 if (!sig)
4145 perm = PROCESS__SIGNULL; /* null signal; existence test */
4146 else
4147 perm = signal_to_av(sig);
4148 if (!cred)
4149 secid = current_sid();
4150 else
4151 secid = cred_sid(cred);
4152 return avc_has_perm(&selinux_state,
4153 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4154 }
4155
4156 static void selinux_task_to_inode(struct task_struct *p,
4157 struct inode *inode)
4158 {
4159 struct inode_security_struct *isec = selinux_inode(inode);
4160 u32 sid = task_sid(p);
4161
4162 spin_lock(&isec->lock);
4163 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4164 isec->sid = sid;
4165 isec->initialized = LABEL_INITIALIZED;
4166 spin_unlock(&isec->lock);
4167 }
4168
4169 /* Returns error only if unable to parse addresses */
4170 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4171 struct common_audit_data *ad, u8 *proto)
4172 {
4173 int offset, ihlen, ret = -EINVAL;
4174 struct iphdr _iph, *ih;
4175
4176 offset = skb_network_offset(skb);
4177 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4178 if (ih == NULL)
4179 goto out;
4180
4181 ihlen = ih->ihl * 4;
4182 if (ihlen < sizeof(_iph))
4183 goto out;
4184
4185 ad->u.net->v4info.saddr = ih->saddr;
4186 ad->u.net->v4info.daddr = ih->daddr;
4187 ret = 0;
4188
4189 if (proto)
4190 *proto = ih->protocol;
4191
4192 switch (ih->protocol) {
4193 case IPPROTO_TCP: {
4194 struct tcphdr _tcph, *th;
4195
4196 if (ntohs(ih->frag_off) & IP_OFFSET)
4197 break;
4198
4199 offset += ihlen;
4200 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4201 if (th == NULL)
4202 break;
4203
4204 ad->u.net->sport = th->source;
4205 ad->u.net->dport = th->dest;
4206 break;
4207 }
4208
4209 case IPPROTO_UDP: {
4210 struct udphdr _udph, *uh;
4211
4212 if (ntohs(ih->frag_off) & IP_OFFSET)
4213 break;
4214
4215 offset += ihlen;
4216 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4217 if (uh == NULL)
4218 break;
4219
4220 ad->u.net->sport = uh->source;
4221 ad->u.net->dport = uh->dest;
4222 break;
4223 }
4224
4225 case IPPROTO_DCCP: {
4226 struct dccp_hdr _dccph, *dh;
4227
4228 if (ntohs(ih->frag_off) & IP_OFFSET)
4229 break;
4230
4231 offset += ihlen;
4232 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4233 if (dh == NULL)
4234 break;
4235
4236 ad->u.net->sport = dh->dccph_sport;
4237 ad->u.net->dport = dh->dccph_dport;
4238 break;
4239 }
4240
4241 #if IS_ENABLED(CONFIG_IP_SCTP)
4242 case IPPROTO_SCTP: {
4243 struct sctphdr _sctph, *sh;
4244
4245 if (ntohs(ih->frag_off) & IP_OFFSET)
4246 break;
4247
4248 offset += ihlen;
4249 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4250 if (sh == NULL)
4251 break;
4252
4253 ad->u.net->sport = sh->source;
4254 ad->u.net->dport = sh->dest;
4255 break;
4256 }
4257 #endif
4258 default:
4259 break;
4260 }
4261 out:
4262 return ret;
4263 }
4264
4265 #if IS_ENABLED(CONFIG_IPV6)
4266
4267 /* Returns error only if unable to parse addresses */
4268 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4269 struct common_audit_data *ad, u8 *proto)
4270 {
4271 u8 nexthdr;
4272 int ret = -EINVAL, offset;
4273 struct ipv6hdr _ipv6h, *ip6;
4274 __be16 frag_off;
4275
4276 offset = skb_network_offset(skb);
4277 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4278 if (ip6 == NULL)
4279 goto out;
4280
4281 ad->u.net->v6info.saddr = ip6->saddr;
4282 ad->u.net->v6info.daddr = ip6->daddr;
4283 ret = 0;
4284
4285 nexthdr = ip6->nexthdr;
4286 offset += sizeof(_ipv6h);
4287 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4288 if (offset < 0)
4289 goto out;
4290
4291 if (proto)
4292 *proto = nexthdr;
4293
4294 switch (nexthdr) {
4295 case IPPROTO_TCP: {
4296 struct tcphdr _tcph, *th;
4297
4298 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4299 if (th == NULL)
4300 break;
4301
4302 ad->u.net->sport = th->source;
4303 ad->u.net->dport = th->dest;
4304 break;
4305 }
4306
4307 case IPPROTO_UDP: {
4308 struct udphdr _udph, *uh;
4309
4310 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4311 if (uh == NULL)
4312 break;
4313
4314 ad->u.net->sport = uh->source;
4315 ad->u.net->dport = uh->dest;
4316 break;
4317 }
4318
4319 case IPPROTO_DCCP: {
4320 struct dccp_hdr _dccph, *dh;
4321
4322 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4323 if (dh == NULL)
4324 break;
4325
4326 ad->u.net->sport = dh->dccph_sport;
4327 ad->u.net->dport = dh->dccph_dport;
4328 break;
4329 }
4330
4331 #if IS_ENABLED(CONFIG_IP_SCTP)
4332 case IPPROTO_SCTP: {
4333 struct sctphdr _sctph, *sh;
4334
4335 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4336 if (sh == NULL)
4337 break;
4338
4339 ad->u.net->sport = sh->source;
4340 ad->u.net->dport = sh->dest;
4341 break;
4342 }
4343 #endif
4344 /* includes fragments */
4345 default:
4346 break;
4347 }
4348 out:
4349 return ret;
4350 }
4351
4352 #endif /* IPV6 */
4353
4354 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4355 char **_addrp, int src, u8 *proto)
4356 {
4357 char *addrp;
4358 int ret;
4359
4360 switch (ad->u.net->family) {
4361 case PF_INET:
4362 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4363 if (ret)
4364 goto parse_error;
4365 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4366 &ad->u.net->v4info.daddr);
4367 goto okay;
4368
4369 #if IS_ENABLED(CONFIG_IPV6)
4370 case PF_INET6:
4371 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4372 if (ret)
4373 goto parse_error;
4374 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4375 &ad->u.net->v6info.daddr);
4376 goto okay;
4377 #endif /* IPV6 */
4378 default:
4379 addrp = NULL;
4380 goto okay;
4381 }
4382
4383 parse_error:
4384 pr_warn(
4385 "SELinux: failure in selinux_parse_skb(),"
4386 " unable to parse packet\n");
4387 return ret;
4388
4389 okay:
4390 if (_addrp)
4391 *_addrp = addrp;
4392 return 0;
4393 }
4394
4395 /**
4396 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4397 * @skb: the packet
4398 * @family: protocol family
4399 * @sid: the packet's peer label SID
4400 *
4401 * Description:
4402 * Check the various different forms of network peer labeling and determine
4403 * the peer label/SID for the packet; most of the magic actually occurs in
4404 * the security server function security_net_peersid_cmp(). The function
4405 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4406 * or -EACCES if @sid is invalid due to inconsistencies with the different
4407 * peer labels.
4408 *
4409 */
4410 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4411 {
4412 int err;
4413 u32 xfrm_sid;
4414 u32 nlbl_sid;
4415 u32 nlbl_type;
4416
4417 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4418 if (unlikely(err))
4419 return -EACCES;
4420 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4421 if (unlikely(err))
4422 return -EACCES;
4423
4424 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4425 nlbl_type, xfrm_sid, sid);
4426 if (unlikely(err)) {
4427 pr_warn(
4428 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4429 " unable to determine packet's peer label\n");
4430 return -EACCES;
4431 }
4432
4433 return 0;
4434 }
4435
4436 /**
4437 * selinux_conn_sid - Determine the child socket label for a connection
4438 * @sk_sid: the parent socket's SID
4439 * @skb_sid: the packet's SID
4440 * @conn_sid: the resulting connection SID
4441 *
4442 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4443 * combined with the MLS information from @skb_sid in order to create
4444 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4445 * of @sk_sid. Returns zero on success, negative values on failure.
4446 *
4447 */
4448 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4449 {
4450 int err = 0;
4451
4452 if (skb_sid != SECSID_NULL)
4453 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4454 conn_sid);
4455 else
4456 *conn_sid = sk_sid;
4457
4458 return err;
4459 }
4460
4461 /* socket security operations */
4462
4463 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4464 u16 secclass, u32 *socksid)
4465 {
4466 if (tsec->sockcreate_sid > SECSID_NULL) {
4467 *socksid = tsec->sockcreate_sid;
4468 return 0;
4469 }
4470
4471 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4472 secclass, NULL, socksid);
4473 }
4474
4475 static int sock_has_perm(struct sock *sk, u32 perms)
4476 {
4477 struct sk_security_struct *sksec = sk->sk_security;
4478 struct common_audit_data ad;
4479 struct lsm_network_audit net = {0,};
4480
4481 if (sksec->sid == SECINITSID_KERNEL)
4482 return 0;
4483
4484 ad.type = LSM_AUDIT_DATA_NET;
4485 ad.u.net = &net;
4486 ad.u.net->sk = sk;
4487
4488 return avc_has_perm(&selinux_state,
4489 current_sid(), sksec->sid, sksec->sclass, perms,
4490 &ad);
4491 }
4492
4493 static int selinux_socket_create(int family, int type,
4494 int protocol, int kern)
4495 {
4496 const struct task_security_struct *tsec = selinux_cred(current_cred());
4497 u32 newsid;
4498 u16 secclass;
4499 int rc;
4500
4501 if (kern)
4502 return 0;
4503
4504 secclass = socket_type_to_security_class(family, type, protocol);
4505 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4506 if (rc)
4507 return rc;
4508
4509 return avc_has_perm(&selinux_state,
4510 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4511 }
4512
4513 static int selinux_socket_post_create(struct socket *sock, int family,
4514 int type, int protocol, int kern)
4515 {
4516 const struct task_security_struct *tsec = selinux_cred(current_cred());
4517 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4518 struct sk_security_struct *sksec;
4519 u16 sclass = socket_type_to_security_class(family, type, protocol);
4520 u32 sid = SECINITSID_KERNEL;
4521 int err = 0;
4522
4523 if (!kern) {
4524 err = socket_sockcreate_sid(tsec, sclass, &sid);
4525 if (err)
4526 return err;
4527 }
4528
4529 isec->sclass = sclass;
4530 isec->sid = sid;
4531 isec->initialized = LABEL_INITIALIZED;
4532
4533 if (sock->sk) {
4534 sksec = sock->sk->sk_security;
4535 sksec->sclass = sclass;
4536 sksec->sid = sid;
4537 /* Allows detection of the first association on this socket */
4538 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4539 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4540
4541 err = selinux_netlbl_socket_post_create(sock->sk, family);
4542 }
4543
4544 return err;
4545 }
4546
4547 static int selinux_socket_socketpair(struct socket *socka,
4548 struct socket *sockb)
4549 {
4550 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4551 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4552
4553 sksec_a->peer_sid = sksec_b->sid;
4554 sksec_b->peer_sid = sksec_a->sid;
4555
4556 return 0;
4557 }
4558
4559 /* Range of port numbers used to automatically bind.
4560 Need to determine whether we should perform a name_bind
4561 permission check between the socket and the port number. */
4562
4563 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4564 {
4565 struct sock *sk = sock->sk;
4566 struct sk_security_struct *sksec = sk->sk_security;
4567 u16 family;
4568 int err;
4569
4570 err = sock_has_perm(sk, SOCKET__BIND);
4571 if (err)
4572 goto out;
4573
4574 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4575 family = sk->sk_family;
4576 if (family == PF_INET || family == PF_INET6) {
4577 char *addrp;
4578 struct common_audit_data ad;
4579 struct lsm_network_audit net = {0,};
4580 struct sockaddr_in *addr4 = NULL;
4581 struct sockaddr_in6 *addr6 = NULL;
4582 u16 family_sa;
4583 unsigned short snum;
4584 u32 sid, node_perm;
4585
4586 /*
4587 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4588 * that validates multiple binding addresses. Because of this
4589 * need to check address->sa_family as it is possible to have
4590 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4591 */
4592 if (addrlen < offsetofend(struct sockaddr, sa_family))
4593 return -EINVAL;
4594 family_sa = address->sa_family;
4595 switch (family_sa) {
4596 case AF_UNSPEC:
4597 case AF_INET:
4598 if (addrlen < sizeof(struct sockaddr_in))
4599 return -EINVAL;
4600 addr4 = (struct sockaddr_in *)address;
4601 if (family_sa == AF_UNSPEC) {
4602 /* see __inet_bind(), we only want to allow
4603 * AF_UNSPEC if the address is INADDR_ANY
4604 */
4605 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4606 goto err_af;
4607 family_sa = AF_INET;
4608 }
4609 snum = ntohs(addr4->sin_port);
4610 addrp = (char *)&addr4->sin_addr.s_addr;
4611 break;
4612 case AF_INET6:
4613 if (addrlen < SIN6_LEN_RFC2133)
4614 return -EINVAL;
4615 addr6 = (struct sockaddr_in6 *)address;
4616 snum = ntohs(addr6->sin6_port);
4617 addrp = (char *)&addr6->sin6_addr.s6_addr;
4618 break;
4619 default:
4620 goto err_af;
4621 }
4622
4623 ad.type = LSM_AUDIT_DATA_NET;
4624 ad.u.net = &net;
4625 ad.u.net->sport = htons(snum);
4626 ad.u.net->family = family_sa;
4627
4628 if (snum) {
4629 int low, high;
4630
4631 inet_get_local_port_range(sock_net(sk), &low, &high);
4632
4633 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4634 snum < low || snum > high) {
4635 err = sel_netport_sid(sk->sk_protocol,
4636 snum, &sid);
4637 if (err)
4638 goto out;
4639 err = avc_has_perm(&selinux_state,
4640 sksec->sid, sid,
4641 sksec->sclass,
4642 SOCKET__NAME_BIND, &ad);
4643 if (err)
4644 goto out;
4645 }
4646 }
4647
4648 switch (sksec->sclass) {
4649 case SECCLASS_TCP_SOCKET:
4650 node_perm = TCP_SOCKET__NODE_BIND;
4651 break;
4652
4653 case SECCLASS_UDP_SOCKET:
4654 node_perm = UDP_SOCKET__NODE_BIND;
4655 break;
4656
4657 case SECCLASS_DCCP_SOCKET:
4658 node_perm = DCCP_SOCKET__NODE_BIND;
4659 break;
4660
4661 case SECCLASS_SCTP_SOCKET:
4662 node_perm = SCTP_SOCKET__NODE_BIND;
4663 break;
4664
4665 default:
4666 node_perm = RAWIP_SOCKET__NODE_BIND;
4667 break;
4668 }
4669
4670 err = sel_netnode_sid(addrp, family_sa, &sid);
4671 if (err)
4672 goto out;
4673
4674 if (family_sa == AF_INET)
4675 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4676 else
4677 ad.u.net->v6info.saddr = addr6->sin6_addr;
4678
4679 err = avc_has_perm(&selinux_state,
4680 sksec->sid, sid,
4681 sksec->sclass, node_perm, &ad);
4682 if (err)
4683 goto out;
4684 }
4685 out:
4686 return err;
4687 err_af:
4688 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4689 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4690 return -EINVAL;
4691 return -EAFNOSUPPORT;
4692 }
4693
4694 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4695 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4696 */
4697 static int selinux_socket_connect_helper(struct socket *sock,
4698 struct sockaddr *address, int addrlen)
4699 {
4700 struct sock *sk = sock->sk;
4701 struct sk_security_struct *sksec = sk->sk_security;
4702 int err;
4703
4704 err = sock_has_perm(sk, SOCKET__CONNECT);
4705 if (err)
4706 return err;
4707 if (addrlen < offsetofend(struct sockaddr, sa_family))
4708 return -EINVAL;
4709
4710 /* connect(AF_UNSPEC) has special handling, as it is a documented
4711 * way to disconnect the socket
4712 */
4713 if (address->sa_family == AF_UNSPEC)
4714 return 0;
4715
4716 /*
4717 * If a TCP, DCCP or SCTP socket, check name_connect permission
4718 * for the port.
4719 */
4720 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4721 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4722 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4723 struct common_audit_data ad;
4724 struct lsm_network_audit net = {0,};
4725 struct sockaddr_in *addr4 = NULL;
4726 struct sockaddr_in6 *addr6 = NULL;
4727 unsigned short snum;
4728 u32 sid, perm;
4729
4730 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4731 * that validates multiple connect addresses. Because of this
4732 * need to check address->sa_family as it is possible to have
4733 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4734 */
4735 switch (address->sa_family) {
4736 case AF_INET:
4737 addr4 = (struct sockaddr_in *)address;
4738 if (addrlen < sizeof(struct sockaddr_in))
4739 return -EINVAL;
4740 snum = ntohs(addr4->sin_port);
4741 break;
4742 case AF_INET6:
4743 addr6 = (struct sockaddr_in6 *)address;
4744 if (addrlen < SIN6_LEN_RFC2133)
4745 return -EINVAL;
4746 snum = ntohs(addr6->sin6_port);
4747 break;
4748 default:
4749 /* Note that SCTP services expect -EINVAL, whereas
4750 * others expect -EAFNOSUPPORT.
4751 */
4752 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4753 return -EINVAL;
4754 else
4755 return -EAFNOSUPPORT;
4756 }
4757
4758 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4759 if (err)
4760 return err;
4761
4762 switch (sksec->sclass) {
4763 case SECCLASS_TCP_SOCKET:
4764 perm = TCP_SOCKET__NAME_CONNECT;
4765 break;
4766 case SECCLASS_DCCP_SOCKET:
4767 perm = DCCP_SOCKET__NAME_CONNECT;
4768 break;
4769 case SECCLASS_SCTP_SOCKET:
4770 perm = SCTP_SOCKET__NAME_CONNECT;
4771 break;
4772 }
4773
4774 ad.type = LSM_AUDIT_DATA_NET;
4775 ad.u.net = &net;
4776 ad.u.net->dport = htons(snum);
4777 ad.u.net->family = address->sa_family;
4778 err = avc_has_perm(&selinux_state,
4779 sksec->sid, sid, sksec->sclass, perm, &ad);
4780 if (err)
4781 return err;
4782 }
4783
4784 return 0;
4785 }
4786
4787 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4788 static int selinux_socket_connect(struct socket *sock,
4789 struct sockaddr *address, int addrlen)
4790 {
4791 int err;
4792 struct sock *sk = sock->sk;
4793
4794 err = selinux_socket_connect_helper(sock, address, addrlen);
4795 if (err)
4796 return err;
4797
4798 return selinux_netlbl_socket_connect(sk, address);
4799 }
4800
4801 static int selinux_socket_listen(struct socket *sock, int backlog)
4802 {
4803 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4804 }
4805
4806 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4807 {
4808 int err;
4809 struct inode_security_struct *isec;
4810 struct inode_security_struct *newisec;
4811 u16 sclass;
4812 u32 sid;
4813
4814 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4815 if (err)
4816 return err;
4817
4818 isec = inode_security_novalidate(SOCK_INODE(sock));
4819 spin_lock(&isec->lock);
4820 sclass = isec->sclass;
4821 sid = isec->sid;
4822 spin_unlock(&isec->lock);
4823
4824 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4825 newisec->sclass = sclass;
4826 newisec->sid = sid;
4827 newisec->initialized = LABEL_INITIALIZED;
4828
4829 return 0;
4830 }
4831
4832 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4833 int size)
4834 {
4835 return sock_has_perm(sock->sk, SOCKET__WRITE);
4836 }
4837
4838 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4839 int size, int flags)
4840 {
4841 return sock_has_perm(sock->sk, SOCKET__READ);
4842 }
4843
4844 static int selinux_socket_getsockname(struct socket *sock)
4845 {
4846 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4847 }
4848
4849 static int selinux_socket_getpeername(struct socket *sock)
4850 {
4851 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4852 }
4853
4854 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4855 {
4856 int err;
4857
4858 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4859 if (err)
4860 return err;
4861
4862 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4863 }
4864
4865 static int selinux_socket_getsockopt(struct socket *sock, int level,
4866 int optname)
4867 {
4868 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4869 }
4870
4871 static int selinux_socket_shutdown(struct socket *sock, int how)
4872 {
4873 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4874 }
4875
4876 static int selinux_socket_unix_stream_connect(struct sock *sock,
4877 struct sock *other,
4878 struct sock *newsk)
4879 {
4880 struct sk_security_struct *sksec_sock = sock->sk_security;
4881 struct sk_security_struct *sksec_other = other->sk_security;
4882 struct sk_security_struct *sksec_new = newsk->sk_security;
4883 struct common_audit_data ad;
4884 struct lsm_network_audit net = {0,};
4885 int err;
4886
4887 ad.type = LSM_AUDIT_DATA_NET;
4888 ad.u.net = &net;
4889 ad.u.net->sk = other;
4890
4891 err = avc_has_perm(&selinux_state,
4892 sksec_sock->sid, sksec_other->sid,
4893 sksec_other->sclass,
4894 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4895 if (err)
4896 return err;
4897
4898 /* server child socket */
4899 sksec_new->peer_sid = sksec_sock->sid;
4900 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4901 sksec_sock->sid, &sksec_new->sid);
4902 if (err)
4903 return err;
4904
4905 /* connecting socket */
4906 sksec_sock->peer_sid = sksec_new->sid;
4907
4908 return 0;
4909 }
4910
4911 static int selinux_socket_unix_may_send(struct socket *sock,
4912 struct socket *other)
4913 {
4914 struct sk_security_struct *ssec = sock->sk->sk_security;
4915 struct sk_security_struct *osec = other->sk->sk_security;
4916 struct common_audit_data ad;
4917 struct lsm_network_audit net = {0,};
4918
4919 ad.type = LSM_AUDIT_DATA_NET;
4920 ad.u.net = &net;
4921 ad.u.net->sk = other->sk;
4922
4923 return avc_has_perm(&selinux_state,
4924 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4925 &ad);
4926 }
4927
4928 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4929 char *addrp, u16 family, u32 peer_sid,
4930 struct common_audit_data *ad)
4931 {
4932 int err;
4933 u32 if_sid;
4934 u32 node_sid;
4935
4936 err = sel_netif_sid(ns, ifindex, &if_sid);
4937 if (err)
4938 return err;
4939 err = avc_has_perm(&selinux_state,
4940 peer_sid, if_sid,
4941 SECCLASS_NETIF, NETIF__INGRESS, ad);
4942 if (err)
4943 return err;
4944
4945 err = sel_netnode_sid(addrp, family, &node_sid);
4946 if (err)
4947 return err;
4948 return avc_has_perm(&selinux_state,
4949 peer_sid, node_sid,
4950 SECCLASS_NODE, NODE__RECVFROM, ad);
4951 }
4952
4953 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4954 u16 family)
4955 {
4956 int err = 0;
4957 struct sk_security_struct *sksec = sk->sk_security;
4958 u32 sk_sid = sksec->sid;
4959 struct common_audit_data ad;
4960 struct lsm_network_audit net = {0,};
4961 char *addrp;
4962
4963 ad.type = LSM_AUDIT_DATA_NET;
4964 ad.u.net = &net;
4965 ad.u.net->netif = skb->skb_iif;
4966 ad.u.net->family = family;
4967 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4968 if (err)
4969 return err;
4970
4971 if (selinux_secmark_enabled()) {
4972 err = avc_has_perm(&selinux_state,
4973 sk_sid, skb->secmark, SECCLASS_PACKET,
4974 PACKET__RECV, &ad);
4975 if (err)
4976 return err;
4977 }
4978
4979 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4980 if (err)
4981 return err;
4982 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4983
4984 return err;
4985 }
4986
4987 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4988 {
4989 int err;
4990 struct sk_security_struct *sksec = sk->sk_security;
4991 u16 family = sk->sk_family;
4992 u32 sk_sid = sksec->sid;
4993 struct common_audit_data ad;
4994 struct lsm_network_audit net = {0,};
4995 char *addrp;
4996 u8 secmark_active;
4997 u8 peerlbl_active;
4998
4999 if (family != PF_INET && family != PF_INET6)
5000 return 0;
5001
5002 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5003 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5004 family = PF_INET;
5005
5006 /* If any sort of compatibility mode is enabled then handoff processing
5007 * to the selinux_sock_rcv_skb_compat() function to deal with the
5008 * special handling. We do this in an attempt to keep this function
5009 * as fast and as clean as possible. */
5010 if (!selinux_policycap_netpeer())
5011 return selinux_sock_rcv_skb_compat(sk, skb, family);
5012
5013 secmark_active = selinux_secmark_enabled();
5014 peerlbl_active = selinux_peerlbl_enabled();
5015 if (!secmark_active && !peerlbl_active)
5016 return 0;
5017
5018 ad.type = LSM_AUDIT_DATA_NET;
5019 ad.u.net = &net;
5020 ad.u.net->netif = skb->skb_iif;
5021 ad.u.net->family = family;
5022 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5023 if (err)
5024 return err;
5025
5026 if (peerlbl_active) {
5027 u32 peer_sid;
5028
5029 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5030 if (err)
5031 return err;
5032 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5033 addrp, family, peer_sid, &ad);
5034 if (err) {
5035 selinux_netlbl_err(skb, family, err, 0);
5036 return err;
5037 }
5038 err = avc_has_perm(&selinux_state,
5039 sk_sid, peer_sid, SECCLASS_PEER,
5040 PEER__RECV, &ad);
5041 if (err) {
5042 selinux_netlbl_err(skb, family, err, 0);
5043 return err;
5044 }
5045 }
5046
5047 if (secmark_active) {
5048 err = avc_has_perm(&selinux_state,
5049 sk_sid, skb->secmark, SECCLASS_PACKET,
5050 PACKET__RECV, &ad);
5051 if (err)
5052 return err;
5053 }
5054
5055 return err;
5056 }
5057
5058 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5059 int __user *optlen, unsigned len)
5060 {
5061 int err = 0;
5062 char *scontext;
5063 u32 scontext_len;
5064 struct sk_security_struct *sksec = sock->sk->sk_security;
5065 u32 peer_sid = SECSID_NULL;
5066
5067 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5068 sksec->sclass == SECCLASS_TCP_SOCKET ||
5069 sksec->sclass == SECCLASS_SCTP_SOCKET)
5070 peer_sid = sksec->peer_sid;
5071 if (peer_sid == SECSID_NULL)
5072 return -ENOPROTOOPT;
5073
5074 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5075 &scontext_len);
5076 if (err)
5077 return err;
5078
5079 if (scontext_len > len) {
5080 err = -ERANGE;
5081 goto out_len;
5082 }
5083
5084 if (copy_to_user(optval, scontext, scontext_len))
5085 err = -EFAULT;
5086
5087 out_len:
5088 if (put_user(scontext_len, optlen))
5089 err = -EFAULT;
5090 kfree(scontext);
5091 return err;
5092 }
5093
5094 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5095 {
5096 u32 peer_secid = SECSID_NULL;
5097 u16 family;
5098 struct inode_security_struct *isec;
5099
5100 if (skb && skb->protocol == htons(ETH_P_IP))
5101 family = PF_INET;
5102 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5103 family = PF_INET6;
5104 else if (sock)
5105 family = sock->sk->sk_family;
5106 else
5107 goto out;
5108
5109 if (sock && family == PF_UNIX) {
5110 isec = inode_security_novalidate(SOCK_INODE(sock));
5111 peer_secid = isec->sid;
5112 } else if (skb)
5113 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5114
5115 out:
5116 *secid = peer_secid;
5117 if (peer_secid == SECSID_NULL)
5118 return -EINVAL;
5119 return 0;
5120 }
5121
5122 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5123 {
5124 struct sk_security_struct *sksec;
5125
5126 sksec = kzalloc(sizeof(*sksec), priority);
5127 if (!sksec)
5128 return -ENOMEM;
5129
5130 sksec->peer_sid = SECINITSID_UNLABELED;
5131 sksec->sid = SECINITSID_UNLABELED;
5132 sksec->sclass = SECCLASS_SOCKET;
5133 selinux_netlbl_sk_security_reset(sksec);
5134 sk->sk_security = sksec;
5135
5136 return 0;
5137 }
5138
5139 static void selinux_sk_free_security(struct sock *sk)
5140 {
5141 struct sk_security_struct *sksec = sk->sk_security;
5142
5143 sk->sk_security = NULL;
5144 selinux_netlbl_sk_security_free(sksec);
5145 kfree(sksec);
5146 }
5147
5148 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5149 {
5150 struct sk_security_struct *sksec = sk->sk_security;
5151 struct sk_security_struct *newsksec = newsk->sk_security;
5152
5153 newsksec->sid = sksec->sid;
5154 newsksec->peer_sid = sksec->peer_sid;
5155 newsksec->sclass = sksec->sclass;
5156
5157 selinux_netlbl_sk_security_reset(newsksec);
5158 }
5159
5160 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5161 {
5162 if (!sk)
5163 *secid = SECINITSID_ANY_SOCKET;
5164 else {
5165 struct sk_security_struct *sksec = sk->sk_security;
5166
5167 *secid = sksec->sid;
5168 }
5169 }
5170
5171 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5172 {
5173 struct inode_security_struct *isec =
5174 inode_security_novalidate(SOCK_INODE(parent));
5175 struct sk_security_struct *sksec = sk->sk_security;
5176
5177 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5178 sk->sk_family == PF_UNIX)
5179 isec->sid = sksec->sid;
5180 sksec->sclass = isec->sclass;
5181 }
5182
5183 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5184 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5185 * already present).
5186 */
5187 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5188 struct sk_buff *skb)
5189 {
5190 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5191 struct common_audit_data ad;
5192 struct lsm_network_audit net = {0,};
5193 u8 peerlbl_active;
5194 u32 peer_sid = SECINITSID_UNLABELED;
5195 u32 conn_sid;
5196 int err = 0;
5197
5198 if (!selinux_policycap_extsockclass())
5199 return 0;
5200
5201 peerlbl_active = selinux_peerlbl_enabled();
5202
5203 if (peerlbl_active) {
5204 /* This will return peer_sid = SECSID_NULL if there are
5205 * no peer labels, see security_net_peersid_resolve().
5206 */
5207 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5208 &peer_sid);
5209 if (err)
5210 return err;
5211
5212 if (peer_sid == SECSID_NULL)
5213 peer_sid = SECINITSID_UNLABELED;
5214 }
5215
5216 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5217 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5218
5219 /* Here as first association on socket. As the peer SID
5220 * was allowed by peer recv (and the netif/node checks),
5221 * then it is approved by policy and used as the primary
5222 * peer SID for getpeercon(3).
5223 */
5224 sksec->peer_sid = peer_sid;
5225 } else if (sksec->peer_sid != peer_sid) {
5226 /* Other association peer SIDs are checked to enforce
5227 * consistency among the peer SIDs.
5228 */
5229 ad.type = LSM_AUDIT_DATA_NET;
5230 ad.u.net = &net;
5231 ad.u.net->sk = ep->base.sk;
5232 err = avc_has_perm(&selinux_state,
5233 sksec->peer_sid, peer_sid, sksec->sclass,
5234 SCTP_SOCKET__ASSOCIATION, &ad);
5235 if (err)
5236 return err;
5237 }
5238
5239 /* Compute the MLS component for the connection and store
5240 * the information in ep. This will be used by SCTP TCP type
5241 * sockets and peeled off connections as they cause a new
5242 * socket to be generated. selinux_sctp_sk_clone() will then
5243 * plug this into the new socket.
5244 */
5245 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5246 if (err)
5247 return err;
5248
5249 ep->secid = conn_sid;
5250 ep->peer_secid = peer_sid;
5251
5252 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5253 return selinux_netlbl_sctp_assoc_request(ep, skb);
5254 }
5255
5256 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5257 * based on their @optname.
5258 */
5259 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5260 struct sockaddr *address,
5261 int addrlen)
5262 {
5263 int len, err = 0, walk_size = 0;
5264 void *addr_buf;
5265 struct sockaddr *addr;
5266 struct socket *sock;
5267
5268 if (!selinux_policycap_extsockclass())
5269 return 0;
5270
5271 /* Process one or more addresses that may be IPv4 or IPv6 */
5272 sock = sk->sk_socket;
5273 addr_buf = address;
5274
5275 while (walk_size < addrlen) {
5276 if (walk_size + sizeof(sa_family_t) > addrlen)
5277 return -EINVAL;
5278
5279 addr = addr_buf;
5280 switch (addr->sa_family) {
5281 case AF_UNSPEC:
5282 case AF_INET:
5283 len = sizeof(struct sockaddr_in);
5284 break;
5285 case AF_INET6:
5286 len = sizeof(struct sockaddr_in6);
5287 break;
5288 default:
5289 return -EINVAL;
5290 }
5291
5292 if (walk_size + len > addrlen)
5293 return -EINVAL;
5294
5295 err = -EINVAL;
5296 switch (optname) {
5297 /* Bind checks */
5298 case SCTP_PRIMARY_ADDR:
5299 case SCTP_SET_PEER_PRIMARY_ADDR:
5300 case SCTP_SOCKOPT_BINDX_ADD:
5301 err = selinux_socket_bind(sock, addr, len);
5302 break;
5303 /* Connect checks */
5304 case SCTP_SOCKOPT_CONNECTX:
5305 case SCTP_PARAM_SET_PRIMARY:
5306 case SCTP_PARAM_ADD_IP:
5307 case SCTP_SENDMSG_CONNECT:
5308 err = selinux_socket_connect_helper(sock, addr, len);
5309 if (err)
5310 return err;
5311
5312 /* As selinux_sctp_bind_connect() is called by the
5313 * SCTP protocol layer, the socket is already locked,
5314 * therefore selinux_netlbl_socket_connect_locked() is
5315 * is called here. The situations handled are:
5316 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5317 * whenever a new IP address is added or when a new
5318 * primary address is selected.
5319 * Note that an SCTP connect(2) call happens before
5320 * the SCTP protocol layer and is handled via
5321 * selinux_socket_connect().
5322 */
5323 err = selinux_netlbl_socket_connect_locked(sk, addr);
5324 break;
5325 }
5326
5327 if (err)
5328 return err;
5329
5330 addr_buf += len;
5331 walk_size += len;
5332 }
5333
5334 return 0;
5335 }
5336
5337 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5338 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5339 struct sock *newsk)
5340 {
5341 struct sk_security_struct *sksec = sk->sk_security;
5342 struct sk_security_struct *newsksec = newsk->sk_security;
5343
5344 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5345 * the non-sctp clone version.
5346 */
5347 if (!selinux_policycap_extsockclass())
5348 return selinux_sk_clone_security(sk, newsk);
5349
5350 newsksec->sid = ep->secid;
5351 newsksec->peer_sid = ep->peer_secid;
5352 newsksec->sclass = sksec->sclass;
5353 selinux_netlbl_sctp_sk_clone(sk, newsk);
5354 }
5355
5356 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5357 struct request_sock *req)
5358 {
5359 struct sk_security_struct *sksec = sk->sk_security;
5360 int err;
5361 u16 family = req->rsk_ops->family;
5362 u32 connsid;
5363 u32 peersid;
5364
5365 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5366 if (err)
5367 return err;
5368 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5369 if (err)
5370 return err;
5371 req->secid = connsid;
5372 req->peer_secid = peersid;
5373
5374 return selinux_netlbl_inet_conn_request(req, family);
5375 }
5376
5377 static void selinux_inet_csk_clone(struct sock *newsk,
5378 const struct request_sock *req)
5379 {
5380 struct sk_security_struct *newsksec = newsk->sk_security;
5381
5382 newsksec->sid = req->secid;
5383 newsksec->peer_sid = req->peer_secid;
5384 /* NOTE: Ideally, we should also get the isec->sid for the
5385 new socket in sync, but we don't have the isec available yet.
5386 So we will wait until sock_graft to do it, by which
5387 time it will have been created and available. */
5388
5389 /* We don't need to take any sort of lock here as we are the only
5390 * thread with access to newsksec */
5391 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5392 }
5393
5394 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5395 {
5396 u16 family = sk->sk_family;
5397 struct sk_security_struct *sksec = sk->sk_security;
5398
5399 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5400 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5401 family = PF_INET;
5402
5403 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5404 }
5405
5406 static int selinux_secmark_relabel_packet(u32 sid)
5407 {
5408 const struct task_security_struct *__tsec;
5409 u32 tsid;
5410
5411 __tsec = selinux_cred(current_cred());
5412 tsid = __tsec->sid;
5413
5414 return avc_has_perm(&selinux_state,
5415 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5416 NULL);
5417 }
5418
5419 static void selinux_secmark_refcount_inc(void)
5420 {
5421 atomic_inc(&selinux_secmark_refcount);
5422 }
5423
5424 static void selinux_secmark_refcount_dec(void)
5425 {
5426 atomic_dec(&selinux_secmark_refcount);
5427 }
5428
5429 static void selinux_req_classify_flow(const struct request_sock *req,
5430 struct flowi *fl)
5431 {
5432 fl->flowi_secid = req->secid;
5433 }
5434
5435 static int selinux_tun_dev_alloc_security(void **security)
5436 {
5437 struct tun_security_struct *tunsec;
5438
5439 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5440 if (!tunsec)
5441 return -ENOMEM;
5442 tunsec->sid = current_sid();
5443
5444 *security = tunsec;
5445 return 0;
5446 }
5447
5448 static void selinux_tun_dev_free_security(void *security)
5449 {
5450 kfree(security);
5451 }
5452
5453 static int selinux_tun_dev_create(void)
5454 {
5455 u32 sid = current_sid();
5456
5457 /* we aren't taking into account the "sockcreate" SID since the socket
5458 * that is being created here is not a socket in the traditional sense,
5459 * instead it is a private sock, accessible only to the kernel, and
5460 * representing a wide range of network traffic spanning multiple
5461 * connections unlike traditional sockets - check the TUN driver to
5462 * get a better understanding of why this socket is special */
5463
5464 return avc_has_perm(&selinux_state,
5465 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5466 NULL);
5467 }
5468
5469 static int selinux_tun_dev_attach_queue(void *security)
5470 {
5471 struct tun_security_struct *tunsec = security;
5472
5473 return avc_has_perm(&selinux_state,
5474 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5475 TUN_SOCKET__ATTACH_QUEUE, NULL);
5476 }
5477
5478 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5479 {
5480 struct tun_security_struct *tunsec = security;
5481 struct sk_security_struct *sksec = sk->sk_security;
5482
5483 /* we don't currently perform any NetLabel based labeling here and it
5484 * isn't clear that we would want to do so anyway; while we could apply
5485 * labeling without the support of the TUN user the resulting labeled
5486 * traffic from the other end of the connection would almost certainly
5487 * cause confusion to the TUN user that had no idea network labeling
5488 * protocols were being used */
5489
5490 sksec->sid = tunsec->sid;
5491 sksec->sclass = SECCLASS_TUN_SOCKET;
5492
5493 return 0;
5494 }
5495
5496 static int selinux_tun_dev_open(void *security)
5497 {
5498 struct tun_security_struct *tunsec = security;
5499 u32 sid = current_sid();
5500 int err;
5501
5502 err = avc_has_perm(&selinux_state,
5503 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5504 TUN_SOCKET__RELABELFROM, NULL);
5505 if (err)
5506 return err;
5507 err = avc_has_perm(&selinux_state,
5508 sid, sid, SECCLASS_TUN_SOCKET,
5509 TUN_SOCKET__RELABELTO, NULL);
5510 if (err)
5511 return err;
5512 tunsec->sid = sid;
5513
5514 return 0;
5515 }
5516
5517 #ifdef CONFIG_NETFILTER
5518
5519 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5520 const struct net_device *indev,
5521 u16 family)
5522 {
5523 int err;
5524 char *addrp;
5525 u32 peer_sid;
5526 struct common_audit_data ad;
5527 struct lsm_network_audit net = {0,};
5528 u8 secmark_active;
5529 u8 netlbl_active;
5530 u8 peerlbl_active;
5531
5532 if (!selinux_policycap_netpeer())
5533 return NF_ACCEPT;
5534
5535 secmark_active = selinux_secmark_enabled();
5536 netlbl_active = netlbl_enabled();
5537 peerlbl_active = selinux_peerlbl_enabled();
5538 if (!secmark_active && !peerlbl_active)
5539 return NF_ACCEPT;
5540
5541 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5542 return NF_DROP;
5543
5544 ad.type = LSM_AUDIT_DATA_NET;
5545 ad.u.net = &net;
5546 ad.u.net->netif = indev->ifindex;
5547 ad.u.net->family = family;
5548 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5549 return NF_DROP;
5550
5551 if (peerlbl_active) {
5552 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5553 addrp, family, peer_sid, &ad);
5554 if (err) {
5555 selinux_netlbl_err(skb, family, err, 1);
5556 return NF_DROP;
5557 }
5558 }
5559
5560 if (secmark_active)
5561 if (avc_has_perm(&selinux_state,
5562 peer_sid, skb->secmark,
5563 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5564 return NF_DROP;
5565
5566 if (netlbl_active)
5567 /* we do this in the FORWARD path and not the POST_ROUTING
5568 * path because we want to make sure we apply the necessary
5569 * labeling before IPsec is applied so we can leverage AH
5570 * protection */
5571 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5572 return NF_DROP;
5573
5574 return NF_ACCEPT;
5575 }
5576
5577 static unsigned int selinux_ipv4_forward(void *priv,
5578 struct sk_buff *skb,
5579 const struct nf_hook_state *state)
5580 {
5581 return selinux_ip_forward(skb, state->in, PF_INET);
5582 }
5583
5584 #if IS_ENABLED(CONFIG_IPV6)
5585 static unsigned int selinux_ipv6_forward(void *priv,
5586 struct sk_buff *skb,
5587 const struct nf_hook_state *state)
5588 {
5589 return selinux_ip_forward(skb, state->in, PF_INET6);
5590 }
5591 #endif /* IPV6 */
5592
5593 static unsigned int selinux_ip_output(struct sk_buff *skb,
5594 u16 family)
5595 {
5596 struct sock *sk;
5597 u32 sid;
5598
5599 if (!netlbl_enabled())
5600 return NF_ACCEPT;
5601
5602 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5603 * because we want to make sure we apply the necessary labeling
5604 * before IPsec is applied so we can leverage AH protection */
5605 sk = skb->sk;
5606 if (sk) {
5607 struct sk_security_struct *sksec;
5608
5609 if (sk_listener(sk))
5610 /* if the socket is the listening state then this
5611 * packet is a SYN-ACK packet which means it needs to
5612 * be labeled based on the connection/request_sock and
5613 * not the parent socket. unfortunately, we can't
5614 * lookup the request_sock yet as it isn't queued on
5615 * the parent socket until after the SYN-ACK is sent.
5616 * the "solution" is to simply pass the packet as-is
5617 * as any IP option based labeling should be copied
5618 * from the initial connection request (in the IP
5619 * layer). it is far from ideal, but until we get a
5620 * security label in the packet itself this is the
5621 * best we can do. */
5622 return NF_ACCEPT;
5623
5624 /* standard practice, label using the parent socket */
5625 sksec = sk->sk_security;
5626 sid = sksec->sid;
5627 } else
5628 sid = SECINITSID_KERNEL;
5629 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5630 return NF_DROP;
5631
5632 return NF_ACCEPT;
5633 }
5634
5635 static unsigned int selinux_ipv4_output(void *priv,
5636 struct sk_buff *skb,
5637 const struct nf_hook_state *state)
5638 {
5639 return selinux_ip_output(skb, PF_INET);
5640 }
5641
5642 #if IS_ENABLED(CONFIG_IPV6)
5643 static unsigned int selinux_ipv6_output(void *priv,
5644 struct sk_buff *skb,
5645 const struct nf_hook_state *state)
5646 {
5647 return selinux_ip_output(skb, PF_INET6);
5648 }
5649 #endif /* IPV6 */
5650
5651 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5652 int ifindex,
5653 u16 family)
5654 {
5655 struct sock *sk = skb_to_full_sk(skb);
5656 struct sk_security_struct *sksec;
5657 struct common_audit_data ad;
5658 struct lsm_network_audit net = {0,};
5659 char *addrp;
5660 u8 proto;
5661
5662 if (sk == NULL)
5663 return NF_ACCEPT;
5664 sksec = sk->sk_security;
5665
5666 ad.type = LSM_AUDIT_DATA_NET;
5667 ad.u.net = &net;
5668 ad.u.net->netif = ifindex;
5669 ad.u.net->family = family;
5670 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5671 return NF_DROP;
5672
5673 if (selinux_secmark_enabled())
5674 if (avc_has_perm(&selinux_state,
5675 sksec->sid, skb->secmark,
5676 SECCLASS_PACKET, PACKET__SEND, &ad))
5677 return NF_DROP_ERR(-ECONNREFUSED);
5678
5679 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5680 return NF_DROP_ERR(-ECONNREFUSED);
5681
5682 return NF_ACCEPT;
5683 }
5684
5685 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5686 const struct net_device *outdev,
5687 u16 family)
5688 {
5689 u32 secmark_perm;
5690 u32 peer_sid;
5691 int ifindex = outdev->ifindex;
5692 struct sock *sk;
5693 struct common_audit_data ad;
5694 struct lsm_network_audit net = {0,};
5695 char *addrp;
5696 u8 secmark_active;
5697 u8 peerlbl_active;
5698
5699 /* If any sort of compatibility mode is enabled then handoff processing
5700 * to the selinux_ip_postroute_compat() function to deal with the
5701 * special handling. We do this in an attempt to keep this function
5702 * as fast and as clean as possible. */
5703 if (!selinux_policycap_netpeer())
5704 return selinux_ip_postroute_compat(skb, ifindex, family);
5705
5706 secmark_active = selinux_secmark_enabled();
5707 peerlbl_active = selinux_peerlbl_enabled();
5708 if (!secmark_active && !peerlbl_active)
5709 return NF_ACCEPT;
5710
5711 sk = skb_to_full_sk(skb);
5712
5713 #ifdef CONFIG_XFRM
5714 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5715 * packet transformation so allow the packet to pass without any checks
5716 * since we'll have another chance to perform access control checks
5717 * when the packet is on it's final way out.
5718 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5719 * is NULL, in this case go ahead and apply access control.
5720 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5721 * TCP listening state we cannot wait until the XFRM processing
5722 * is done as we will miss out on the SA label if we do;
5723 * unfortunately, this means more work, but it is only once per
5724 * connection. */
5725 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5726 !(sk && sk_listener(sk)))
5727 return NF_ACCEPT;
5728 #endif
5729
5730 if (sk == NULL) {
5731 /* Without an associated socket the packet is either coming
5732 * from the kernel or it is being forwarded; check the packet
5733 * to determine which and if the packet is being forwarded
5734 * query the packet directly to determine the security label. */
5735 if (skb->skb_iif) {
5736 secmark_perm = PACKET__FORWARD_OUT;
5737 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5738 return NF_DROP;
5739 } else {
5740 secmark_perm = PACKET__SEND;
5741 peer_sid = SECINITSID_KERNEL;
5742 }
5743 } else if (sk_listener(sk)) {
5744 /* Locally generated packet but the associated socket is in the
5745 * listening state which means this is a SYN-ACK packet. In
5746 * this particular case the correct security label is assigned
5747 * to the connection/request_sock but unfortunately we can't
5748 * query the request_sock as it isn't queued on the parent
5749 * socket until after the SYN-ACK packet is sent; the only
5750 * viable choice is to regenerate the label like we do in
5751 * selinux_inet_conn_request(). See also selinux_ip_output()
5752 * for similar problems. */
5753 u32 skb_sid;
5754 struct sk_security_struct *sksec;
5755
5756 sksec = sk->sk_security;
5757 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5758 return NF_DROP;
5759 /* At this point, if the returned skb peerlbl is SECSID_NULL
5760 * and the packet has been through at least one XFRM
5761 * transformation then we must be dealing with the "final"
5762 * form of labeled IPsec packet; since we've already applied
5763 * all of our access controls on this packet we can safely
5764 * pass the packet. */
5765 if (skb_sid == SECSID_NULL) {
5766 switch (family) {
5767 case PF_INET:
5768 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5769 return NF_ACCEPT;
5770 break;
5771 case PF_INET6:
5772 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5773 return NF_ACCEPT;
5774 break;
5775 default:
5776 return NF_DROP_ERR(-ECONNREFUSED);
5777 }
5778 }
5779 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5780 return NF_DROP;
5781 secmark_perm = PACKET__SEND;
5782 } else {
5783 /* Locally generated packet, fetch the security label from the
5784 * associated socket. */
5785 struct sk_security_struct *sksec = sk->sk_security;
5786 peer_sid = sksec->sid;
5787 secmark_perm = PACKET__SEND;
5788 }
5789
5790 ad.type = LSM_AUDIT_DATA_NET;
5791 ad.u.net = &net;
5792 ad.u.net->netif = ifindex;
5793 ad.u.net->family = family;
5794 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5795 return NF_DROP;
5796
5797 if (secmark_active)
5798 if (avc_has_perm(&selinux_state,
5799 peer_sid, skb->secmark,
5800 SECCLASS_PACKET, secmark_perm, &ad))
5801 return NF_DROP_ERR(-ECONNREFUSED);
5802
5803 if (peerlbl_active) {
5804 u32 if_sid;
5805 u32 node_sid;
5806
5807 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5808 return NF_DROP;
5809 if (avc_has_perm(&selinux_state,
5810 peer_sid, if_sid,
5811 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5812 return NF_DROP_ERR(-ECONNREFUSED);
5813
5814 if (sel_netnode_sid(addrp, family, &node_sid))
5815 return NF_DROP;
5816 if (avc_has_perm(&selinux_state,
5817 peer_sid, node_sid,
5818 SECCLASS_NODE, NODE__SENDTO, &ad))
5819 return NF_DROP_ERR(-ECONNREFUSED);
5820 }
5821
5822 return NF_ACCEPT;
5823 }
5824
5825 static unsigned int selinux_ipv4_postroute(void *priv,
5826 struct sk_buff *skb,
5827 const struct nf_hook_state *state)
5828 {
5829 return selinux_ip_postroute(skb, state->out, PF_INET);
5830 }
5831
5832 #if IS_ENABLED(CONFIG_IPV6)
5833 static unsigned int selinux_ipv6_postroute(void *priv,
5834 struct sk_buff *skb,
5835 const struct nf_hook_state *state)
5836 {
5837 return selinux_ip_postroute(skb, state->out, PF_INET6);
5838 }
5839 #endif /* IPV6 */
5840
5841 #endif /* CONFIG_NETFILTER */
5842
5843 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5844 {
5845 int rc = 0;
5846 unsigned int msg_len;
5847 unsigned int data_len = skb->len;
5848 unsigned char *data = skb->data;
5849 struct nlmsghdr *nlh;
5850 struct sk_security_struct *sksec = sk->sk_security;
5851 u16 sclass = sksec->sclass;
5852 u32 perm;
5853
5854 while (data_len >= nlmsg_total_size(0)) {
5855 nlh = (struct nlmsghdr *)data;
5856
5857 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5858 * users which means we can't reject skb's with bogus
5859 * length fields; our solution is to follow what
5860 * netlink_rcv_skb() does and simply skip processing at
5861 * messages with length fields that are clearly junk
5862 */
5863 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5864 return 0;
5865
5866 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5867 if (rc == 0) {
5868 rc = sock_has_perm(sk, perm);
5869 if (rc)
5870 return rc;
5871 } else if (rc == -EINVAL) {
5872 /* -EINVAL is a missing msg/perm mapping */
5873 pr_warn_ratelimited("SELinux: unrecognized netlink"
5874 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5875 " pid=%d comm=%s\n",
5876 sk->sk_protocol, nlh->nlmsg_type,
5877 secclass_map[sclass - 1].name,
5878 task_pid_nr(current), current->comm);
5879 if (enforcing_enabled(&selinux_state) &&
5880 !security_get_allow_unknown(&selinux_state))
5881 return rc;
5882 rc = 0;
5883 } else if (rc == -ENOENT) {
5884 /* -ENOENT is a missing socket/class mapping, ignore */
5885 rc = 0;
5886 } else {
5887 return rc;
5888 }
5889
5890 /* move to the next message after applying netlink padding */
5891 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5892 if (msg_len >= data_len)
5893 return 0;
5894 data_len -= msg_len;
5895 data += msg_len;
5896 }
5897
5898 return rc;
5899 }
5900
5901 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5902 {
5903 isec->sclass = sclass;
5904 isec->sid = current_sid();
5905 }
5906
5907 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5908 u32 perms)
5909 {
5910 struct ipc_security_struct *isec;
5911 struct common_audit_data ad;
5912 u32 sid = current_sid();
5913
5914 isec = selinux_ipc(ipc_perms);
5915
5916 ad.type = LSM_AUDIT_DATA_IPC;
5917 ad.u.ipc_id = ipc_perms->key;
5918
5919 return avc_has_perm(&selinux_state,
5920 sid, isec->sid, isec->sclass, perms, &ad);
5921 }
5922
5923 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5924 {
5925 struct msg_security_struct *msec;
5926
5927 msec = selinux_msg_msg(msg);
5928 msec->sid = SECINITSID_UNLABELED;
5929
5930 return 0;
5931 }
5932
5933 /* message queue security operations */
5934 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5935 {
5936 struct ipc_security_struct *isec;
5937 struct common_audit_data ad;
5938 u32 sid = current_sid();
5939 int rc;
5940
5941 isec = selinux_ipc(msq);
5942 ipc_init_security(isec, SECCLASS_MSGQ);
5943
5944 ad.type = LSM_AUDIT_DATA_IPC;
5945 ad.u.ipc_id = msq->key;
5946
5947 rc = avc_has_perm(&selinux_state,
5948 sid, isec->sid, SECCLASS_MSGQ,
5949 MSGQ__CREATE, &ad);
5950 return rc;
5951 }
5952
5953 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5954 {
5955 struct ipc_security_struct *isec;
5956 struct common_audit_data ad;
5957 u32 sid = current_sid();
5958
5959 isec = selinux_ipc(msq);
5960
5961 ad.type = LSM_AUDIT_DATA_IPC;
5962 ad.u.ipc_id = msq->key;
5963
5964 return avc_has_perm(&selinux_state,
5965 sid, isec->sid, SECCLASS_MSGQ,
5966 MSGQ__ASSOCIATE, &ad);
5967 }
5968
5969 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5970 {
5971 int err;
5972 int perms;
5973
5974 switch (cmd) {
5975 case IPC_INFO:
5976 case MSG_INFO:
5977 /* No specific object, just general system-wide information. */
5978 return avc_has_perm(&selinux_state,
5979 current_sid(), SECINITSID_KERNEL,
5980 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5981 case IPC_STAT:
5982 case MSG_STAT:
5983 case MSG_STAT_ANY:
5984 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5985 break;
5986 case IPC_SET:
5987 perms = MSGQ__SETATTR;
5988 break;
5989 case IPC_RMID:
5990 perms = MSGQ__DESTROY;
5991 break;
5992 default:
5993 return 0;
5994 }
5995
5996 err = ipc_has_perm(msq, perms);
5997 return err;
5998 }
5999
6000 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6001 {
6002 struct ipc_security_struct *isec;
6003 struct msg_security_struct *msec;
6004 struct common_audit_data ad;
6005 u32 sid = current_sid();
6006 int rc;
6007
6008 isec = selinux_ipc(msq);
6009 msec = selinux_msg_msg(msg);
6010
6011 /*
6012 * First time through, need to assign label to the message
6013 */
6014 if (msec->sid == SECINITSID_UNLABELED) {
6015 /*
6016 * Compute new sid based on current process and
6017 * message queue this message will be stored in
6018 */
6019 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6020 SECCLASS_MSG, NULL, &msec->sid);
6021 if (rc)
6022 return rc;
6023 }
6024
6025 ad.type = LSM_AUDIT_DATA_IPC;
6026 ad.u.ipc_id = msq->key;
6027
6028 /* Can this process write to the queue? */
6029 rc = avc_has_perm(&selinux_state,
6030 sid, isec->sid, SECCLASS_MSGQ,
6031 MSGQ__WRITE, &ad);
6032 if (!rc)
6033 /* Can this process send the message */
6034 rc = avc_has_perm(&selinux_state,
6035 sid, msec->sid, SECCLASS_MSG,
6036 MSG__SEND, &ad);
6037 if (!rc)
6038 /* Can the message be put in the queue? */
6039 rc = avc_has_perm(&selinux_state,
6040 msec->sid, isec->sid, SECCLASS_MSGQ,
6041 MSGQ__ENQUEUE, &ad);
6042
6043 return rc;
6044 }
6045
6046 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6047 struct task_struct *target,
6048 long type, int mode)
6049 {
6050 struct ipc_security_struct *isec;
6051 struct msg_security_struct *msec;
6052 struct common_audit_data ad;
6053 u32 sid = task_sid(target);
6054 int rc;
6055
6056 isec = selinux_ipc(msq);
6057 msec = selinux_msg_msg(msg);
6058
6059 ad.type = LSM_AUDIT_DATA_IPC;
6060 ad.u.ipc_id = msq->key;
6061
6062 rc = avc_has_perm(&selinux_state,
6063 sid, isec->sid,
6064 SECCLASS_MSGQ, MSGQ__READ, &ad);
6065 if (!rc)
6066 rc = avc_has_perm(&selinux_state,
6067 sid, msec->sid,
6068 SECCLASS_MSG, MSG__RECEIVE, &ad);
6069 return rc;
6070 }
6071
6072 /* Shared Memory security operations */
6073 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6074 {
6075 struct ipc_security_struct *isec;
6076 struct common_audit_data ad;
6077 u32 sid = current_sid();
6078 int rc;
6079
6080 isec = selinux_ipc(shp);
6081 ipc_init_security(isec, SECCLASS_SHM);
6082
6083 ad.type = LSM_AUDIT_DATA_IPC;
6084 ad.u.ipc_id = shp->key;
6085
6086 rc = avc_has_perm(&selinux_state,
6087 sid, isec->sid, SECCLASS_SHM,
6088 SHM__CREATE, &ad);
6089 return rc;
6090 }
6091
6092 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6093 {
6094 struct ipc_security_struct *isec;
6095 struct common_audit_data ad;
6096 u32 sid = current_sid();
6097
6098 isec = selinux_ipc(shp);
6099
6100 ad.type = LSM_AUDIT_DATA_IPC;
6101 ad.u.ipc_id = shp->key;
6102
6103 return avc_has_perm(&selinux_state,
6104 sid, isec->sid, SECCLASS_SHM,
6105 SHM__ASSOCIATE, &ad);
6106 }
6107
6108 /* Note, at this point, shp is locked down */
6109 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6110 {
6111 int perms;
6112 int err;
6113
6114 switch (cmd) {
6115 case IPC_INFO:
6116 case SHM_INFO:
6117 /* No specific object, just general system-wide information. */
6118 return avc_has_perm(&selinux_state,
6119 current_sid(), SECINITSID_KERNEL,
6120 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6121 case IPC_STAT:
6122 case SHM_STAT:
6123 case SHM_STAT_ANY:
6124 perms = SHM__GETATTR | SHM__ASSOCIATE;
6125 break;
6126 case IPC_SET:
6127 perms = SHM__SETATTR;
6128 break;
6129 case SHM_LOCK:
6130 case SHM_UNLOCK:
6131 perms = SHM__LOCK;
6132 break;
6133 case IPC_RMID:
6134 perms = SHM__DESTROY;
6135 break;
6136 default:
6137 return 0;
6138 }
6139
6140 err = ipc_has_perm(shp, perms);
6141 return err;
6142 }
6143
6144 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6145 char __user *shmaddr, int shmflg)
6146 {
6147 u32 perms;
6148
6149 if (shmflg & SHM_RDONLY)
6150 perms = SHM__READ;
6151 else
6152 perms = SHM__READ | SHM__WRITE;
6153
6154 return ipc_has_perm(shp, perms);
6155 }
6156
6157 /* Semaphore security operations */
6158 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6159 {
6160 struct ipc_security_struct *isec;
6161 struct common_audit_data ad;
6162 u32 sid = current_sid();
6163 int rc;
6164
6165 isec = selinux_ipc(sma);
6166 ipc_init_security(isec, SECCLASS_SEM);
6167
6168 ad.type = LSM_AUDIT_DATA_IPC;
6169 ad.u.ipc_id = sma->key;
6170
6171 rc = avc_has_perm(&selinux_state,
6172 sid, isec->sid, SECCLASS_SEM,
6173 SEM__CREATE, &ad);
6174 return rc;
6175 }
6176
6177 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6178 {
6179 struct ipc_security_struct *isec;
6180 struct common_audit_data ad;
6181 u32 sid = current_sid();
6182
6183 isec = selinux_ipc(sma);
6184
6185 ad.type = LSM_AUDIT_DATA_IPC;
6186 ad.u.ipc_id = sma->key;
6187
6188 return avc_has_perm(&selinux_state,
6189 sid, isec->sid, SECCLASS_SEM,
6190 SEM__ASSOCIATE, &ad);
6191 }
6192
6193 /* Note, at this point, sma is locked down */
6194 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6195 {
6196 int err;
6197 u32 perms;
6198
6199 switch (cmd) {
6200 case IPC_INFO:
6201 case SEM_INFO:
6202 /* No specific object, just general system-wide information. */
6203 return avc_has_perm(&selinux_state,
6204 current_sid(), SECINITSID_KERNEL,
6205 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6206 case GETPID:
6207 case GETNCNT:
6208 case GETZCNT:
6209 perms = SEM__GETATTR;
6210 break;
6211 case GETVAL:
6212 case GETALL:
6213 perms = SEM__READ;
6214 break;
6215 case SETVAL:
6216 case SETALL:
6217 perms = SEM__WRITE;
6218 break;
6219 case IPC_RMID:
6220 perms = SEM__DESTROY;
6221 break;
6222 case IPC_SET:
6223 perms = SEM__SETATTR;
6224 break;
6225 case IPC_STAT:
6226 case SEM_STAT:
6227 case SEM_STAT_ANY:
6228 perms = SEM__GETATTR | SEM__ASSOCIATE;
6229 break;
6230 default:
6231 return 0;
6232 }
6233
6234 err = ipc_has_perm(sma, perms);
6235 return err;
6236 }
6237
6238 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6239 struct sembuf *sops, unsigned nsops, int alter)
6240 {
6241 u32 perms;
6242
6243 if (alter)
6244 perms = SEM__READ | SEM__WRITE;
6245 else
6246 perms = SEM__READ;
6247
6248 return ipc_has_perm(sma, perms);
6249 }
6250
6251 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6252 {
6253 u32 av = 0;
6254
6255 av = 0;
6256 if (flag & S_IRUGO)
6257 av |= IPC__UNIX_READ;
6258 if (flag & S_IWUGO)
6259 av |= IPC__UNIX_WRITE;
6260
6261 if (av == 0)
6262 return 0;
6263
6264 return ipc_has_perm(ipcp, av);
6265 }
6266
6267 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6268 {
6269 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6270 *secid = isec->sid;
6271 }
6272
6273 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6274 {
6275 if (inode)
6276 inode_doinit_with_dentry(inode, dentry);
6277 }
6278
6279 static int selinux_getprocattr(struct task_struct *p,
6280 char *name, char **value)
6281 {
6282 const struct task_security_struct *__tsec;
6283 u32 sid;
6284 int error;
6285 unsigned len;
6286
6287 rcu_read_lock();
6288 __tsec = selinux_cred(__task_cred(p));
6289
6290 if (current != p) {
6291 error = avc_has_perm(&selinux_state,
6292 current_sid(), __tsec->sid,
6293 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6294 if (error)
6295 goto bad;
6296 }
6297
6298 if (!strcmp(name, "current"))
6299 sid = __tsec->sid;
6300 else if (!strcmp(name, "prev"))
6301 sid = __tsec->osid;
6302 else if (!strcmp(name, "exec"))
6303 sid = __tsec->exec_sid;
6304 else if (!strcmp(name, "fscreate"))
6305 sid = __tsec->create_sid;
6306 else if (!strcmp(name, "keycreate"))
6307 sid = __tsec->keycreate_sid;
6308 else if (!strcmp(name, "sockcreate"))
6309 sid = __tsec->sockcreate_sid;
6310 else {
6311 error = -EINVAL;
6312 goto bad;
6313 }
6314 rcu_read_unlock();
6315
6316 if (!sid)
6317 return 0;
6318
6319 error = security_sid_to_context(&selinux_state, sid, value, &len);
6320 if (error)
6321 return error;
6322 return len;
6323
6324 bad:
6325 rcu_read_unlock();
6326 return error;
6327 }
6328
6329 static int selinux_setprocattr(const char *name, void *value, size_t size)
6330 {
6331 struct task_security_struct *tsec;
6332 struct cred *new;
6333 u32 mysid = current_sid(), sid = 0, ptsid;
6334 int error;
6335 char *str = value;
6336
6337 /*
6338 * Basic control over ability to set these attributes at all.
6339 */
6340 if (!strcmp(name, "exec"))
6341 error = avc_has_perm(&selinux_state,
6342 mysid, mysid, SECCLASS_PROCESS,
6343 PROCESS__SETEXEC, NULL);
6344 else if (!strcmp(name, "fscreate"))
6345 error = avc_has_perm(&selinux_state,
6346 mysid, mysid, SECCLASS_PROCESS,
6347 PROCESS__SETFSCREATE, NULL);
6348 else if (!strcmp(name, "keycreate"))
6349 error = avc_has_perm(&selinux_state,
6350 mysid, mysid, SECCLASS_PROCESS,
6351 PROCESS__SETKEYCREATE, NULL);
6352 else if (!strcmp(name, "sockcreate"))
6353 error = avc_has_perm(&selinux_state,
6354 mysid, mysid, SECCLASS_PROCESS,
6355 PROCESS__SETSOCKCREATE, NULL);
6356 else if (!strcmp(name, "current"))
6357 error = avc_has_perm(&selinux_state,
6358 mysid, mysid, SECCLASS_PROCESS,
6359 PROCESS__SETCURRENT, NULL);
6360 else
6361 error = -EINVAL;
6362 if (error)
6363 return error;
6364
6365 /* Obtain a SID for the context, if one was specified. */
6366 if (size && str[0] && str[0] != '\n') {
6367 if (str[size-1] == '\n') {
6368 str[size-1] = 0;
6369 size--;
6370 }
6371 error = security_context_to_sid(&selinux_state, value, size,
6372 &sid, GFP_KERNEL);
6373 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6374 if (!has_cap_mac_admin(true)) {
6375 struct audit_buffer *ab;
6376 size_t audit_size;
6377
6378 /* We strip a nul only if it is at the end, otherwise the
6379 * context contains a nul and we should audit that */
6380 if (str[size - 1] == '\0')
6381 audit_size = size - 1;
6382 else
6383 audit_size = size;
6384 ab = audit_log_start(audit_context(),
6385 GFP_ATOMIC,
6386 AUDIT_SELINUX_ERR);
6387 audit_log_format(ab, "op=fscreate invalid_context=");
6388 audit_log_n_untrustedstring(ab, value, audit_size);
6389 audit_log_end(ab);
6390
6391 return error;
6392 }
6393 error = security_context_to_sid_force(
6394 &selinux_state,
6395 value, size, &sid);
6396 }
6397 if (error)
6398 return error;
6399 }
6400
6401 new = prepare_creds();
6402 if (!new)
6403 return -ENOMEM;
6404
6405 /* Permission checking based on the specified context is
6406 performed during the actual operation (execve,
6407 open/mkdir/...), when we know the full context of the
6408 operation. See selinux_bprm_set_creds for the execve
6409 checks and may_create for the file creation checks. The
6410 operation will then fail if the context is not permitted. */
6411 tsec = selinux_cred(new);
6412 if (!strcmp(name, "exec")) {
6413 tsec->exec_sid = sid;
6414 } else if (!strcmp(name, "fscreate")) {
6415 tsec->create_sid = sid;
6416 } else if (!strcmp(name, "keycreate")) {
6417 if (sid) {
6418 error = avc_has_perm(&selinux_state, mysid, sid,
6419 SECCLASS_KEY, KEY__CREATE, NULL);
6420 if (error)
6421 goto abort_change;
6422 }
6423 tsec->keycreate_sid = sid;
6424 } else if (!strcmp(name, "sockcreate")) {
6425 tsec->sockcreate_sid = sid;
6426 } else if (!strcmp(name, "current")) {
6427 error = -EINVAL;
6428 if (sid == 0)
6429 goto abort_change;
6430
6431 /* Only allow single threaded processes to change context */
6432 error = -EPERM;
6433 if (!current_is_single_threaded()) {
6434 error = security_bounded_transition(&selinux_state,
6435 tsec->sid, sid);
6436 if (error)
6437 goto abort_change;
6438 }
6439
6440 /* Check permissions for the transition. */
6441 error = avc_has_perm(&selinux_state,
6442 tsec->sid, sid, SECCLASS_PROCESS,
6443 PROCESS__DYNTRANSITION, NULL);
6444 if (error)
6445 goto abort_change;
6446
6447 /* Check for ptracing, and update the task SID if ok.
6448 Otherwise, leave SID unchanged and fail. */
6449 ptsid = ptrace_parent_sid();
6450 if (ptsid != 0) {
6451 error = avc_has_perm(&selinux_state,
6452 ptsid, sid, SECCLASS_PROCESS,
6453 PROCESS__PTRACE, NULL);
6454 if (error)
6455 goto abort_change;
6456 }
6457
6458 tsec->sid = sid;
6459 } else {
6460 error = -EINVAL;
6461 goto abort_change;
6462 }
6463
6464 commit_creds(new);
6465 return size;
6466
6467 abort_change:
6468 abort_creds(new);
6469 return error;
6470 }
6471
6472 static int selinux_ismaclabel(const char *name)
6473 {
6474 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6475 }
6476
6477 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6478 {
6479 return security_sid_to_context(&selinux_state, secid,
6480 secdata, seclen);
6481 }
6482
6483 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6484 {
6485 return security_context_to_sid(&selinux_state, secdata, seclen,
6486 secid, GFP_KERNEL);
6487 }
6488
6489 static void selinux_release_secctx(char *secdata, u32 seclen)
6490 {
6491 kfree(secdata);
6492 }
6493
6494 static void selinux_inode_invalidate_secctx(struct inode *inode)
6495 {
6496 struct inode_security_struct *isec = selinux_inode(inode);
6497
6498 spin_lock(&isec->lock);
6499 isec->initialized = LABEL_INVALID;
6500 spin_unlock(&isec->lock);
6501 }
6502
6503 /*
6504 * called with inode->i_mutex locked
6505 */
6506 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6507 {
6508 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6509 ctx, ctxlen, 0);
6510 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6511 return rc == -EOPNOTSUPP ? 0 : rc;
6512 }
6513
6514 /*
6515 * called with inode->i_mutex locked
6516 */
6517 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6518 {
6519 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6520 }
6521
6522 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6523 {
6524 int len = 0;
6525 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6526 ctx, true);
6527 if (len < 0)
6528 return len;
6529 *ctxlen = len;
6530 return 0;
6531 }
6532 #ifdef CONFIG_KEYS
6533
6534 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6535 unsigned long flags)
6536 {
6537 const struct task_security_struct *tsec;
6538 struct key_security_struct *ksec;
6539
6540 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6541 if (!ksec)
6542 return -ENOMEM;
6543
6544 tsec = selinux_cred(cred);
6545 if (tsec->keycreate_sid)
6546 ksec->sid = tsec->keycreate_sid;
6547 else
6548 ksec->sid = tsec->sid;
6549
6550 k->security = ksec;
6551 return 0;
6552 }
6553
6554 static void selinux_key_free(struct key *k)
6555 {
6556 struct key_security_struct *ksec = k->security;
6557
6558 k->security = NULL;
6559 kfree(ksec);
6560 }
6561
6562 static int selinux_key_permission(key_ref_t key_ref,
6563 const struct cred *cred,
6564 unsigned perm)
6565 {
6566 struct key *key;
6567 struct key_security_struct *ksec;
6568 u32 sid;
6569
6570 /* if no specific permissions are requested, we skip the
6571 permission check. No serious, additional covert channels
6572 appear to be created. */
6573 if (perm == 0)
6574 return 0;
6575
6576 sid = cred_sid(cred);
6577
6578 key = key_ref_to_ptr(key_ref);
6579 ksec = key->security;
6580
6581 return avc_has_perm(&selinux_state,
6582 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6583 }
6584
6585 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6586 {
6587 struct key_security_struct *ksec = key->security;
6588 char *context = NULL;
6589 unsigned len;
6590 int rc;
6591
6592 rc = security_sid_to_context(&selinux_state, ksec->sid,
6593 &context, &len);
6594 if (!rc)
6595 rc = len;
6596 *_buffer = context;
6597 return rc;
6598 }
6599 #endif
6600
6601 #ifdef CONFIG_SECURITY_INFINIBAND
6602 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6603 {
6604 struct common_audit_data ad;
6605 int err;
6606 u32 sid = 0;
6607 struct ib_security_struct *sec = ib_sec;
6608 struct lsm_ibpkey_audit ibpkey;
6609
6610 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6611 if (err)
6612 return err;
6613
6614 ad.type = LSM_AUDIT_DATA_IBPKEY;
6615 ibpkey.subnet_prefix = subnet_prefix;
6616 ibpkey.pkey = pkey_val;
6617 ad.u.ibpkey = &ibpkey;
6618 return avc_has_perm(&selinux_state,
6619 sec->sid, sid,
6620 SECCLASS_INFINIBAND_PKEY,
6621 INFINIBAND_PKEY__ACCESS, &ad);
6622 }
6623
6624 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6625 u8 port_num)
6626 {
6627 struct common_audit_data ad;
6628 int err;
6629 u32 sid = 0;
6630 struct ib_security_struct *sec = ib_sec;
6631 struct lsm_ibendport_audit ibendport;
6632
6633 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6634 &sid);
6635
6636 if (err)
6637 return err;
6638
6639 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6640 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6641 ibendport.port = port_num;
6642 ad.u.ibendport = &ibendport;
6643 return avc_has_perm(&selinux_state,
6644 sec->sid, sid,
6645 SECCLASS_INFINIBAND_ENDPORT,
6646 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6647 }
6648
6649 static int selinux_ib_alloc_security(void **ib_sec)
6650 {
6651 struct ib_security_struct *sec;
6652
6653 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6654 if (!sec)
6655 return -ENOMEM;
6656 sec->sid = current_sid();
6657
6658 *ib_sec = sec;
6659 return 0;
6660 }
6661
6662 static void selinux_ib_free_security(void *ib_sec)
6663 {
6664 kfree(ib_sec);
6665 }
6666 #endif
6667
6668 #ifdef CONFIG_BPF_SYSCALL
6669 static int selinux_bpf(int cmd, union bpf_attr *attr,
6670 unsigned int size)
6671 {
6672 u32 sid = current_sid();
6673 int ret;
6674
6675 switch (cmd) {
6676 case BPF_MAP_CREATE:
6677 ret = avc_has_perm(&selinux_state,
6678 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6679 NULL);
6680 break;
6681 case BPF_PROG_LOAD:
6682 ret = avc_has_perm(&selinux_state,
6683 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6684 NULL);
6685 break;
6686 default:
6687 ret = 0;
6688 break;
6689 }
6690
6691 return ret;
6692 }
6693
6694 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6695 {
6696 u32 av = 0;
6697
6698 if (fmode & FMODE_READ)
6699 av |= BPF__MAP_READ;
6700 if (fmode & FMODE_WRITE)
6701 av |= BPF__MAP_WRITE;
6702 return av;
6703 }
6704
6705 /* This function will check the file pass through unix socket or binder to see
6706 * if it is a bpf related object. And apply correspinding checks on the bpf
6707 * object based on the type. The bpf maps and programs, not like other files and
6708 * socket, are using a shared anonymous inode inside the kernel as their inode.
6709 * So checking that inode cannot identify if the process have privilege to
6710 * access the bpf object and that's why we have to add this additional check in
6711 * selinux_file_receive and selinux_binder_transfer_files.
6712 */
6713 static int bpf_fd_pass(struct file *file, u32 sid)
6714 {
6715 struct bpf_security_struct *bpfsec;
6716 struct bpf_prog *prog;
6717 struct bpf_map *map;
6718 int ret;
6719
6720 if (file->f_op == &bpf_map_fops) {
6721 map = file->private_data;
6722 bpfsec = map->security;
6723 ret = avc_has_perm(&selinux_state,
6724 sid, bpfsec->sid, SECCLASS_BPF,
6725 bpf_map_fmode_to_av(file->f_mode), NULL);
6726 if (ret)
6727 return ret;
6728 } else if (file->f_op == &bpf_prog_fops) {
6729 prog = file->private_data;
6730 bpfsec = prog->aux->security;
6731 ret = avc_has_perm(&selinux_state,
6732 sid, bpfsec->sid, SECCLASS_BPF,
6733 BPF__PROG_RUN, NULL);
6734 if (ret)
6735 return ret;
6736 }
6737 return 0;
6738 }
6739
6740 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6741 {
6742 u32 sid = current_sid();
6743 struct bpf_security_struct *bpfsec;
6744
6745 bpfsec = map->security;
6746 return avc_has_perm(&selinux_state,
6747 sid, bpfsec->sid, SECCLASS_BPF,
6748 bpf_map_fmode_to_av(fmode), NULL);
6749 }
6750
6751 static int selinux_bpf_prog(struct bpf_prog *prog)
6752 {
6753 u32 sid = current_sid();
6754 struct bpf_security_struct *bpfsec;
6755
6756 bpfsec = prog->aux->security;
6757 return avc_has_perm(&selinux_state,
6758 sid, bpfsec->sid, SECCLASS_BPF,
6759 BPF__PROG_RUN, NULL);
6760 }
6761
6762 static int selinux_bpf_map_alloc(struct bpf_map *map)
6763 {
6764 struct bpf_security_struct *bpfsec;
6765
6766 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6767 if (!bpfsec)
6768 return -ENOMEM;
6769
6770 bpfsec->sid = current_sid();
6771 map->security = bpfsec;
6772
6773 return 0;
6774 }
6775
6776 static void selinux_bpf_map_free(struct bpf_map *map)
6777 {
6778 struct bpf_security_struct *bpfsec = map->security;
6779
6780 map->security = NULL;
6781 kfree(bpfsec);
6782 }
6783
6784 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6785 {
6786 struct bpf_security_struct *bpfsec;
6787
6788 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6789 if (!bpfsec)
6790 return -ENOMEM;
6791
6792 bpfsec->sid = current_sid();
6793 aux->security = bpfsec;
6794
6795 return 0;
6796 }
6797
6798 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6799 {
6800 struct bpf_security_struct *bpfsec = aux->security;
6801
6802 aux->security = NULL;
6803 kfree(bpfsec);
6804 }
6805 #endif
6806
6807 static int selinux_lockdown(enum lockdown_reason what)
6808 {
6809 struct common_audit_data ad;
6810 u32 sid = current_sid();
6811 int invalid_reason = (what <= LOCKDOWN_NONE) ||
6812 (what == LOCKDOWN_INTEGRITY_MAX) ||
6813 (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
6814
6815 if (WARN(invalid_reason, "Invalid lockdown reason")) {
6816 audit_log(audit_context(),
6817 GFP_ATOMIC, AUDIT_SELINUX_ERR,
6818 "lockdown_reason=invalid");
6819 return -EINVAL;
6820 }
6821
6822 ad.type = LSM_AUDIT_DATA_LOCKDOWN;
6823 ad.u.reason = what;
6824
6825 if (what <= LOCKDOWN_INTEGRITY_MAX)
6826 return avc_has_perm(&selinux_state,
6827 sid, sid, SECCLASS_LOCKDOWN,
6828 LOCKDOWN__INTEGRITY, &ad);
6829 else
6830 return avc_has_perm(&selinux_state,
6831 sid, sid, SECCLASS_LOCKDOWN,
6832 LOCKDOWN__CONFIDENTIALITY, &ad);
6833 }
6834
6835 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6836 .lbs_cred = sizeof(struct task_security_struct),
6837 .lbs_file = sizeof(struct file_security_struct),
6838 .lbs_inode = sizeof(struct inode_security_struct),
6839 .lbs_ipc = sizeof(struct ipc_security_struct),
6840 .lbs_msg_msg = sizeof(struct msg_security_struct),
6841 };
6842
6843 #ifdef CONFIG_PERF_EVENTS
6844 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6845 {
6846 u32 requested, sid = current_sid();
6847
6848 if (type == PERF_SECURITY_OPEN)
6849 requested = PERF_EVENT__OPEN;
6850 else if (type == PERF_SECURITY_CPU)
6851 requested = PERF_EVENT__CPU;
6852 else if (type == PERF_SECURITY_KERNEL)
6853 requested = PERF_EVENT__KERNEL;
6854 else if (type == PERF_SECURITY_TRACEPOINT)
6855 requested = PERF_EVENT__TRACEPOINT;
6856 else
6857 return -EINVAL;
6858
6859 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
6860 requested, NULL);
6861 }
6862
6863 static int selinux_perf_event_alloc(struct perf_event *event)
6864 {
6865 struct perf_event_security_struct *perfsec;
6866
6867 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
6868 if (!perfsec)
6869 return -ENOMEM;
6870
6871 perfsec->sid = current_sid();
6872 event->security = perfsec;
6873
6874 return 0;
6875 }
6876
6877 static void selinux_perf_event_free(struct perf_event *event)
6878 {
6879 struct perf_event_security_struct *perfsec = event->security;
6880
6881 event->security = NULL;
6882 kfree(perfsec);
6883 }
6884
6885 static int selinux_perf_event_read(struct perf_event *event)
6886 {
6887 struct perf_event_security_struct *perfsec = event->security;
6888 u32 sid = current_sid();
6889
6890 return avc_has_perm(&selinux_state, sid, perfsec->sid,
6891 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
6892 }
6893
6894 static int selinux_perf_event_write(struct perf_event *event)
6895 {
6896 struct perf_event_security_struct *perfsec = event->security;
6897 u32 sid = current_sid();
6898
6899 return avc_has_perm(&selinux_state, sid, perfsec->sid,
6900 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
6901 }
6902 #endif
6903
6904 /*
6905 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
6906 * 1. any hooks that don't belong to (2.) or (3.) below,
6907 * 2. hooks that both access structures allocated by other hooks, and allocate
6908 * structures that can be later accessed by other hooks (mostly "cloning"
6909 * hooks),
6910 * 3. hooks that only allocate structures that can be later accessed by other
6911 * hooks ("allocating" hooks).
6912 *
6913 * Please follow block comment delimiters in the list to keep this order.
6914 *
6915 * This ordering is needed for SELinux runtime disable to work at least somewhat
6916 * safely. Breaking the ordering rules above might lead to NULL pointer derefs
6917 * when disabling SELinux at runtime.
6918 */
6919 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6920 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6921 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6922 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6923 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6924
6925 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6926 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6927 LSM_HOOK_INIT(capget, selinux_capget),
6928 LSM_HOOK_INIT(capset, selinux_capset),
6929 LSM_HOOK_INIT(capable, selinux_capable),
6930 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6931 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6932 LSM_HOOK_INIT(syslog, selinux_syslog),
6933 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6934
6935 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6936
6937 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6938 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6939 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6940
6941 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6942 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6943 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6944 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6945 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6946 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6947 LSM_HOOK_INIT(sb_mount, selinux_mount),
6948 LSM_HOOK_INIT(sb_umount, selinux_umount),
6949 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6950 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6951
6952 LSM_HOOK_INIT(move_mount, selinux_move_mount),
6953
6954 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6955 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6956
6957 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6958 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6959 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6960 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6961 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6962 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6963 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6964 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6965 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6966 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6967 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6968 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6969 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6970 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6971 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6972 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6973 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6974 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6975 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6976 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6977 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6978 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6979 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6980 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6981 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6982 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6983 LSM_HOOK_INIT(path_notify, selinux_path_notify),
6984
6985 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6986
6987 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6988 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6989 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6990 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6991 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6992 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6993 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6994 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6995 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6996 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6997 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6998
6999 LSM_HOOK_INIT(file_open, selinux_file_open),
7000
7001 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7002 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7003 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7004 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7005 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7006 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7007 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7008 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7009 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7010 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7011 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7012 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7013 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
7014 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7015 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7016 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7017 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7018 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7019 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7020 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7021 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7022 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7023 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7024
7025 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7026 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7027
7028 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7029 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7030 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7031 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7032
7033 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7034 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7035 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7036
7037 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7038 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7039 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7040
7041 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7042
7043 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7044 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7045
7046 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7047 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7048 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7049 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7050 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7051 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7052
7053 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7054 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7055
7056 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7057 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7058 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7059 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7060 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7061 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7062 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7063 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7064 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7065 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7066 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7067 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7068 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7069 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7070 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7071 LSM_HOOK_INIT(socket_getpeersec_stream,
7072 selinux_socket_getpeersec_stream),
7073 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7074 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7075 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7076 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7077 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7078 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7079 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7080 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7081 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7082 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7083 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7084 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7085 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7086 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7087 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7088 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7089 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7090 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7091 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7092 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7093 #ifdef CONFIG_SECURITY_INFINIBAND
7094 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7095 LSM_HOOK_INIT(ib_endport_manage_subnet,
7096 selinux_ib_endport_manage_subnet),
7097 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7098 #endif
7099 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7100 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7101 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7102 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7103 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7104 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7105 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7106 selinux_xfrm_state_pol_flow_match),
7107 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7108 #endif
7109
7110 #ifdef CONFIG_KEYS
7111 LSM_HOOK_INIT(key_free, selinux_key_free),
7112 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7113 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7114 #endif
7115
7116 #ifdef CONFIG_AUDIT
7117 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7118 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7119 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7120 #endif
7121
7122 #ifdef CONFIG_BPF_SYSCALL
7123 LSM_HOOK_INIT(bpf, selinux_bpf),
7124 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7125 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7126 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7127 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7128 #endif
7129
7130 #ifdef CONFIG_PERF_EVENTS
7131 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7132 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7133 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7134 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7135 #endif
7136
7137 LSM_HOOK_INIT(locked_down, selinux_lockdown),
7138
7139 /*
7140 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7141 */
7142 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7143 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7144 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7145 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7146 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7147 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7148 #endif
7149
7150 /*
7151 * PUT "ALLOCATING" HOOKS HERE
7152 */
7153 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7154 LSM_HOOK_INIT(msg_queue_alloc_security,
7155 selinux_msg_queue_alloc_security),
7156 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7157 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7158 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7159 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7160 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7161 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7162 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7163 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7164 #ifdef CONFIG_SECURITY_INFINIBAND
7165 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7166 #endif
7167 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7168 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7169 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7170 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7171 selinux_xfrm_state_alloc_acquire),
7172 #endif
7173 #ifdef CONFIG_KEYS
7174 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7175 #endif
7176 #ifdef CONFIG_AUDIT
7177 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7178 #endif
7179 #ifdef CONFIG_BPF_SYSCALL
7180 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7181 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7182 #endif
7183 #ifdef CONFIG_PERF_EVENTS
7184 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7185 #endif
7186 };
7187
7188 static __init int selinux_init(void)
7189 {
7190 pr_info("SELinux: Initializing.\n");
7191
7192 memset(&selinux_state, 0, sizeof(selinux_state));
7193 enforcing_set(&selinux_state, selinux_enforcing_boot);
7194 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7195 selinux_ss_init(&selinux_state.ss);
7196 selinux_avc_init(&selinux_state.avc);
7197 mutex_init(&selinux_state.status_lock);
7198
7199 /* Set the security state for the initial task. */
7200 cred_init_security();
7201
7202 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7203
7204 avc_init();
7205
7206 avtab_cache_init();
7207
7208 ebitmap_cache_init();
7209
7210 hashtab_cache_init();
7211
7212 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7213
7214 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7215 panic("SELinux: Unable to register AVC netcache callback\n");
7216
7217 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7218 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7219
7220 if (selinux_enforcing_boot)
7221 pr_debug("SELinux: Starting in enforcing mode\n");
7222 else
7223 pr_debug("SELinux: Starting in permissive mode\n");
7224
7225 fs_validate_description("selinux", selinux_fs_parameters);
7226
7227 return 0;
7228 }
7229
7230 static void delayed_superblock_init(struct super_block *sb, void *unused)
7231 {
7232 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7233 }
7234
7235 void selinux_complete_init(void)
7236 {
7237 pr_debug("SELinux: Completing initialization.\n");
7238
7239 /* Set up any superblocks initialized prior to the policy load. */
7240 pr_debug("SELinux: Setting up existing superblocks.\n");
7241 iterate_supers(delayed_superblock_init, NULL);
7242 }
7243
7244 /* SELinux requires early initialization in order to label
7245 all processes and objects when they are created. */
7246 DEFINE_LSM(selinux) = {
7247 .name = "selinux",
7248 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7249 .enabled = &selinux_enabled_boot,
7250 .blobs = &selinux_blob_sizes,
7251 .init = selinux_init,
7252 };
7253
7254 #if defined(CONFIG_NETFILTER)
7255
7256 static const struct nf_hook_ops selinux_nf_ops[] = {
7257 {
7258 .hook = selinux_ipv4_postroute,
7259 .pf = NFPROTO_IPV4,
7260 .hooknum = NF_INET_POST_ROUTING,
7261 .priority = NF_IP_PRI_SELINUX_LAST,
7262 },
7263 {
7264 .hook = selinux_ipv4_forward,
7265 .pf = NFPROTO_IPV4,
7266 .hooknum = NF_INET_FORWARD,
7267 .priority = NF_IP_PRI_SELINUX_FIRST,
7268 },
7269 {
7270 .hook = selinux_ipv4_output,
7271 .pf = NFPROTO_IPV4,
7272 .hooknum = NF_INET_LOCAL_OUT,
7273 .priority = NF_IP_PRI_SELINUX_FIRST,
7274 },
7275 #if IS_ENABLED(CONFIG_IPV6)
7276 {
7277 .hook = selinux_ipv6_postroute,
7278 .pf = NFPROTO_IPV6,
7279 .hooknum = NF_INET_POST_ROUTING,
7280 .priority = NF_IP6_PRI_SELINUX_LAST,
7281 },
7282 {
7283 .hook = selinux_ipv6_forward,
7284 .pf = NFPROTO_IPV6,
7285 .hooknum = NF_INET_FORWARD,
7286 .priority = NF_IP6_PRI_SELINUX_FIRST,
7287 },
7288 {
7289 .hook = selinux_ipv6_output,
7290 .pf = NFPROTO_IPV6,
7291 .hooknum = NF_INET_LOCAL_OUT,
7292 .priority = NF_IP6_PRI_SELINUX_FIRST,
7293 },
7294 #endif /* IPV6 */
7295 };
7296
7297 static int __net_init selinux_nf_register(struct net *net)
7298 {
7299 return nf_register_net_hooks(net, selinux_nf_ops,
7300 ARRAY_SIZE(selinux_nf_ops));
7301 }
7302
7303 static void __net_exit selinux_nf_unregister(struct net *net)
7304 {
7305 nf_unregister_net_hooks(net, selinux_nf_ops,
7306 ARRAY_SIZE(selinux_nf_ops));
7307 }
7308
7309 static struct pernet_operations selinux_net_ops = {
7310 .init = selinux_nf_register,
7311 .exit = selinux_nf_unregister,
7312 };
7313
7314 static int __init selinux_nf_ip_init(void)
7315 {
7316 int err;
7317
7318 if (!selinux_enabled_boot)
7319 return 0;
7320
7321 pr_debug("SELinux: Registering netfilter hooks\n");
7322
7323 err = register_pernet_subsys(&selinux_net_ops);
7324 if (err)
7325 panic("SELinux: register_pernet_subsys: error %d\n", err);
7326
7327 return 0;
7328 }
7329 __initcall(selinux_nf_ip_init);
7330
7331 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7332 static void selinux_nf_ip_exit(void)
7333 {
7334 pr_debug("SELinux: Unregistering netfilter hooks\n");
7335
7336 unregister_pernet_subsys(&selinux_net_ops);
7337 }
7338 #endif
7339
7340 #else /* CONFIG_NETFILTER */
7341
7342 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7343 #define selinux_nf_ip_exit()
7344 #endif
7345
7346 #endif /* CONFIG_NETFILTER */
7347
7348 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7349 int selinux_disable(struct selinux_state *state)
7350 {
7351 if (selinux_initialized(state)) {
7352 /* Not permitted after initial policy load. */
7353 return -EINVAL;
7354 }
7355
7356 if (selinux_disabled(state)) {
7357 /* Only do this once. */
7358 return -EINVAL;
7359 }
7360
7361 selinux_mark_disabled(state);
7362
7363 pr_info("SELinux: Disabled at runtime.\n");
7364
7365 /*
7366 * Unregister netfilter hooks.
7367 * Must be done before security_delete_hooks() to avoid breaking
7368 * runtime disable.
7369 */
7370 selinux_nf_ip_exit();
7371
7372 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7373
7374 /* Try to destroy the avc node cache */
7375 avc_disable();
7376
7377 /* Unregister selinuxfs. */
7378 exit_sel_fs();
7379
7380 return 0;
7381 }
7382 #endif
Linux with added FPC-III support