projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
locks: rename file-private locks to "open file description locks"
[deliverable/linux.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP		 7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT		 10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
2069f457
EP		 12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
1da177e4 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 15 * <dgoeddel@trustedcs.com>
ed6d76e4 16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
82c21bfa 17 * Paul Moore <paul@paul-moore.com>
788e7dd4 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT		 20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
828dfe1d 23 * as published by the Free Software Foundation.
1da177e4
LT		 24 */
25
1da177e4 26#include <linux/init.h>
0b24dcb7 27#include <linux/kd.h>
1da177e4 28#include <linux/kernel.h>
0d094efe 29#include <linux/tracehook.h>
1da177e4
LT		 30#include <linux/errno.h>
31#include <linux/sched.h>
32#include <linux/security.h>
33#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
0b24dcb7 40#include <linux/proc_fs.h>
1da177e4 41#include <linux/swap.h>
1da177e4
LT		 42#include <linux/spinlock.h>
43#include <linux/syscalls.h>
2a7dba39 44#include <linux/dcache.h>
1da177e4 45#include <linux/file.h>
9f3acc31 46#include <linux/fdtable.h>
1da177e4
LT		 47#include <linux/namei.h>
48#include <linux/mount.h>
1da177e4
LT		 49#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
227b60f5 53#include <net/ip.h> /* for local_port_range[] */
ca10b9e9 54#include <net/sock.h>
1da177e4 55#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
47180068 56#include <net/inet_connection_sock.h>
220deb96 57#include <net/net_namespace.h>
d621d35e 58#include <net/netlabel.h>
f5269710 59#include <linux/uaccess.h>
1da177e4 60#include <asm/ioctls.h>
60063497 61#include <linux/atomic.h>
1da177e4
LT		 62#include <linux/bitops.h>
63#include <linux/interrupt.h>
64#include <linux/netdevice.h> /* for network interface checks */
77954983 65#include <net/netlink.h>
1da177e4
LT		 66#include <linux/tcp.h>
67#include <linux/udp.h>
2ee92d46 68#include <linux/dccp.h>
1da177e4
LT		 69#include <linux/quota.h>
70#include <linux/un.h> /* for Unix socket types */
71#include <net/af_unix.h> /* for Unix socket types */
72#include <linux/parser.h>
73#include <linux/nfs_mount.h>
74#include <net/ipv6.h>
75#include <linux/hugetlb.h>
76#include <linux/personality.h>
1da177e4 77#include <linux/audit.h>
6931dfc9 78#include <linux/string.h>
877ce7c1 79#include <linux/selinux.h>
23970741 80#include <linux/mutex.h>
f06febc9 81#include <linux/posix-timers.h>
00234592 82#include <linux/syslog.h>
3486740a 83#include <linux/user_namespace.h>
44fc7ea0 84#include <linux/export.h>
40401530
AV		 85#include <linux/msg.h>
86#include <linux/shm.h>
1da177e4
LT		 87
88#include "avc.h"
89#include "objsec.h"
90#include "netif.h"
224dfbd8 91#include "netnode.h"
3e112172 92#include "netport.h"
d28d1e08 93#include "xfrm.h"
c60475bf 94#include "netlabel.h"
9d57a7f9 95#include "audit.h"
7b98a585 96#include "avc_ss.h"
1da177e4 97
20510f2f 98extern struct security_operations *security_ops;
1da177e4 99
d621d35e 100/* SECMARK reference count */
56a4ca99 101static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
d621d35e 102
1da177e4 103#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 104int selinux_enforcing;
1da177e4
LT		 105
106static int __init enforcing_setup(char *str)
107{
f5269710 108 unsigned long enforcing;
29707b20 109 if (!kstrtoul(str, 0, &enforcing))
f5269710 110 selinux_enforcing = enforcing ? 1 : 0;
1da177e4
LT		 111 return 1;
112}
113__setup("enforcing=", enforcing_setup);
114#endif
115
116#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119static int __init selinux_enabled_setup(char *str)
120{
f5269710 121 unsigned long enabled;
29707b20 122 if (!kstrtoul(str, 0, &enabled))
f5269710 123 selinux_enabled = enabled ? 1 : 0;
1da177e4
LT		 124 return 1;
125}
126__setup("selinux=", selinux_enabled_setup);
30d55280
SS		 127#else
128int selinux_enabled = 1;
1da177e4
LT		 129#endif
130
e18b890b 131static struct kmem_cache *sel_inode_cache;
7cae7e26 132
d621d35e
PM		 133/**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
2be4d74f
CP		 140 * enabled, false (0) if SECMARK is disabled. If the always_check_network
141 * policy capability is enabled, SECMARK is always considered enabled.
d621d35e
PM		 142 *
143 */
144static int selinux_secmark_enabled(void)
145{
2be4d74f
CP		 146 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
147}
148
149/**
150 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 *
152 * Description:
153 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
154 * (1) if any are enabled or false (0) if neither are enabled. If the
155 * always_check_network policy capability is enabled, peer labeling
156 * is always considered enabled.
157 *
158 */
159static int selinux_peerlbl_enabled(void)
160{
161 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
d621d35e
PM		 162}
163
d84f4f99
DH		 164/*
165 * initialise the security for the init task
166 */
167static void cred_init_security(void)
1da177e4 168{
3b11a1de 169 struct cred *cred = (struct cred *) current->real_cred;
1da177e4
LT		 170 struct task_security_struct *tsec;
171
89d155ef 172 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4 173 if (!tsec)
d84f4f99 174 panic("SELinux: Failed to initialize initial task.\n");
1da177e4 175
d84f4f99 176 tsec->osid = tsec->sid = SECINITSID_KERNEL;
f1752eec 177 cred->security = tsec;
1da177e4
LT		 178}
179
88e67f3b
DH		 180/*
181 * get the security ID of a set of credentials
182 */
183static inline u32 cred_sid(const struct cred *cred)
184{
185 const struct task_security_struct *tsec;
186
187 tsec = cred->security;
188 return tsec->sid;
189}
190
275bb41e 191/*
3b11a1de 192 * get the objective security ID of a task
275bb41e
DH		 193 */
194static inline u32 task_sid(const struct task_struct *task)
195{
275bb41e
DH		 196 u32 sid;
197
198 rcu_read_lock();
88e67f3b 199 sid = cred_sid(__task_cred(task));
275bb41e
DH		 200 rcu_read_unlock();
201 return sid;
202}
203
204/*
3b11a1de 205 * get the subjective security ID of the current task
275bb41e
DH		 206 */
207static inline u32 current_sid(void)
208{
5fb49870 209 const struct task_security_struct *tsec = current_security();
275bb41e
DH		 210
211 return tsec->sid;
212}
213
88e67f3b
DH		 214/* Allocate and free functions for each kind of security blob. */
215
1da177e4
LT		 216static int inode_alloc_security(struct inode *inode)
217{
1da177e4 218 struct inode_security_struct *isec;
275bb41e 219 u32 sid = current_sid();
1da177e4 220
a02fe132 221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT		 222 if (!isec)
223 return -ENOMEM;
224
23970741 225 mutex_init(&isec->lock);
1da177e4 226 INIT_LIST_HEAD(&isec->list);
1da177e4
LT		 227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
275bb41e 230 isec->task_sid = sid;
1da177e4
LT		 231 inode->i_security = isec;
232
233 return 0;
234}
235
3dc91d43
SR		 236static void inode_free_rcu(struct rcu_head *head)
237{
238 struct inode_security_struct *isec;
239
240 isec = container_of(head, struct inode_security_struct, rcu);
241 kmem_cache_free(sel_inode_cache, isec);
242}
243
1da177e4
LT		 244static void inode_free_security(struct inode *inode)
245{
246 struct inode_security_struct *isec = inode->i_security;
247 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
248
1da177e4
LT		 249 spin_lock(&sbsec->isec_lock);
250 if (!list_empty(&isec->list))
251 list_del_init(&isec->list);
252 spin_unlock(&sbsec->isec_lock);
253
3dc91d43
SR		 254 /*
255 * The inode may still be referenced in a path walk and
256 * a call to selinux_inode_permission() can be made
257 * after inode_free_security() is called. Ideally, the VFS
258 * wouldn't do this, but fixing that is a much harder
259 * job. For now, simply free the i_security via RCU, and
260 * leave the current inode->i_security pointer intact.
261 * The inode will be freed after the RCU grace period too.
262 */
263 call_rcu(&isec->rcu, inode_free_rcu);
1da177e4
LT		 264}
265
266static int file_alloc_security(struct file *file)
267{
1da177e4 268 struct file_security_struct *fsec;
275bb41e 269 u32 sid = current_sid();
1da177e4 270
26d2a4be 271 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT		 272 if (!fsec)
273 return -ENOMEM;
274
275bb41e
DH		 275 fsec->sid = sid;
276 fsec->fown_sid = sid;
1da177e4
LT		 277 file->f_security = fsec;
278
279 return 0;
280}
281
282static void file_free_security(struct file *file)
283{
284 struct file_security_struct *fsec = file->f_security;
1da177e4
LT		 285 file->f_security = NULL;
286 kfree(fsec);
287}
288
289static int superblock_alloc_security(struct super_block *sb)
290{
291 struct superblock_security_struct *sbsec;
292
89d155ef 293 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT		 294 if (!sbsec)
295 return -ENOMEM;
296
bc7e982b 297 mutex_init(&sbsec->lock);
1da177e4
LT		 298 INIT_LIST_HEAD(&sbsec->isec_head);
299 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT		 300 sbsec->sb = sb;
301 sbsec->sid = SECINITSID_UNLABELED;
302 sbsec->def_sid = SECINITSID_FILE;
c312feb2 303 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT		 304 sb->s_security = sbsec;
305
306 return 0;
307}
308
309static void superblock_free_security(struct super_block *sb)
310{
311 struct superblock_security_struct *sbsec = sb->s_security;
1da177e4
LT		 312 sb->s_security = NULL;
313 kfree(sbsec);
314}
315
1da177e4
LT		 316/* The file system's label must be initialized prior to use. */
317
eb9ae686 318static const char *labeling_behaviors[7] = {
1da177e4
LT		 319 "uses xattr",
320 "uses transition SIDs",
321 "uses task SIDs",
322 "uses genfs_contexts",
323 "not configured for labeling",
324 "uses mountpoint labeling",
eb9ae686 325 "uses native labeling",
1da177e4
LT		 326};
327
328static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
329
330static inline int inode_doinit(struct inode *inode)
331{
332 return inode_doinit_with_dentry(inode, NULL);
333}
334
335enum {
31e87930 336 Opt_error = -1,
1da177e4
LT		 337 Opt_context = 1,
338 Opt_fscontext = 2,
c9180a57
EP		 339 Opt_defcontext = 3,
340 Opt_rootcontext = 4,
11689d47 341 Opt_labelsupport = 5,
d355987f 342 Opt_nextmntopt = 6,
1da177e4
LT		 343};
344
d355987f
EP		 345#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
346
a447c093 347static const match_table_t tokens = {
832cbd9a
EP		 348 {Opt_context, CONTEXT_STR "%s"},
349 {Opt_fscontext, FSCONTEXT_STR "%s"},
350 {Opt_defcontext, DEFCONTEXT_STR "%s"},
351 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
11689d47 352 {Opt_labelsupport, LABELSUPP_STR},
31e87930 353 {Opt_error, NULL},
1da177e4
LT		 354};
355
356#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
357
c312feb2
EP		 358static int may_context_mount_sb_relabel(u32 sid,
359 struct superblock_security_struct *sbsec,
275bb41e 360 const struct cred *cred)
c312feb2 361{
275bb41e 362 const struct task_security_struct *tsec = cred->security;
c312feb2
EP		 363 int rc;
364
365 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
366 FILESYSTEM__RELABELFROM, NULL);
367 if (rc)
368 return rc;
369
370 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
371 FILESYSTEM__RELABELTO, NULL);
372 return rc;
373}
374
0808925e
EP		 375static int may_context_mount_inode_relabel(u32 sid,
376 struct superblock_security_struct *sbsec,
275bb41e 377 const struct cred *cred)
0808925e 378{
275bb41e 379 const struct task_security_struct *tsec = cred->security;
0808925e
EP		 380 int rc;
381 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
382 FILESYSTEM__RELABELFROM, NULL);
383 if (rc)
384 return rc;
385
386 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
387 FILESYSTEM__ASSOCIATE, NULL);
388 return rc;
389}
390
b43e725d
EP		 391static int selinux_is_sblabel_mnt(struct super_block *sb)
392{
393 struct superblock_security_struct *sbsec = sb->s_security;
394
395 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
396 sbsec->behavior == SECURITY_FS_USE_TRANS ||
397 sbsec->behavior == SECURITY_FS_USE_TASK)
398 return 1;
399
400 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
401 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
402 return 1;
403
404 /*
405 * Special handling for rootfs. Is genfs but supports
406 * setting SELinux context on in-core inodes.
407 */
408 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
409 return 1;
410
411 return 0;
412}
413
c9180a57 414static int sb_finish_set_opts(struct super_block *sb)
1da177e4 415{
1da177e4 416 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57
EP		 417 struct dentry *root = sb->s_root;
418 struct inode *root_inode = root->d_inode;
419 int rc = 0;
1da177e4 420
c9180a57
EP		 421 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
422 /* Make sure that the xattr handler exists and that no
423 error other than -ENODATA is returned by getxattr on
424 the root directory. -ENODATA is ok, as this may be
425 the first boot of the SELinux kernel before we have
426 assigned xattr values to the filesystem. */
427 if (!root_inode->i_op->getxattr) {
29b1deb2
LT		 428 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
429 "xattr support\n", sb->s_id, sb->s_type->name);
c9180a57
EP		 430 rc = -EOPNOTSUPP;
431 goto out;
432 }
433 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
434 if (rc < 0 && rc != -ENODATA) {
435 if (rc == -EOPNOTSUPP)
436 printk(KERN_WARNING "SELinux: (dev %s, type "
29b1deb2
LT		 437 "%s) has no security xattr handler\n",
438 sb->s_id, sb->s_type->name);
c9180a57
EP		 439 else
440 printk(KERN_WARNING "SELinux: (dev %s, type "
29b1deb2
LT		 441 "%s) getxattr errno %d\n", sb->s_id,
442 sb->s_type->name, -rc);
c9180a57
EP		 443 goto out;
444 }
445 }
1da177e4 446
c9180a57 447 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
29b1deb2
LT		 448 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
449 sb->s_id, sb->s_type->name);
c9180a57 450 else
29b1deb2
LT		 451 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
452 sb->s_id, sb->s_type->name,
c9180a57 453 labeling_behaviors[sbsec->behavior-1]);
1da177e4 454
eadcabc6 455 sbsec->flags |= SE_SBINITIALIZED;
b43e725d 456 if (selinux_is_sblabel_mnt(sb))
12f348b9 457 sbsec->flags |= SBLABEL_MNT;
ddd29ec6 458
c9180a57
EP		 459 /* Initialize the root inode. */
460 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 461
c9180a57
EP		 462 /* Initialize any other inodes associated with the superblock, e.g.
463 inodes created prior to initial policy load or inodes created
464 during get_sb by a pseudo filesystem that directly
465 populates itself. */
466 spin_lock(&sbsec->isec_lock);
467next_inode:
468 if (!list_empty(&sbsec->isec_head)) {
469 struct inode_security_struct *isec =
470 list_entry(sbsec->isec_head.next,
471 struct inode_security_struct, list);
472 struct inode *inode = isec->inode;
473 spin_unlock(&sbsec->isec_lock);
474 inode = igrab(inode);
475 if (inode) {
476 if (!IS_PRIVATE(inode))
477 inode_doinit(inode);
478 iput(inode);
479 }
480 spin_lock(&sbsec->isec_lock);
481 list_del_init(&isec->list);
482 goto next_inode;
483 }
484 spin_unlock(&sbsec->isec_lock);
485out:
486 return rc;
487}
1da177e4 488
c9180a57
EP		 489/*
490 * This function should allow an FS to ask what it's mount security
491 * options were so it can use those later for submounts, displaying
492 * mount options, or whatever.
493 */
494static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 495 struct security_mnt_opts *opts)
c9180a57
EP		 496{
497 int rc = 0, i;
498 struct superblock_security_struct *sbsec = sb->s_security;
499 char *context = NULL;
500 u32 len;
501 char tmp;
1da177e4 502
e0007529 503 security_init_mnt_opts(opts);
1da177e4 504
0d90a7ec 505 if (!(sbsec->flags & SE_SBINITIALIZED))
c9180a57 506 return -EINVAL;
1da177e4 507
c9180a57
EP		 508 if (!ss_initialized)
509 return -EINVAL;
1da177e4 510
af8e50cc
EP		 511 /* make sure we always check enough bits to cover the mask */
512 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
513
0d90a7ec 514 tmp = sbsec->flags & SE_MNTMASK;
c9180a57 515 /* count the number of mount options for this sb */
af8e50cc 516 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
c9180a57 517 if (tmp & 0x01)
e0007529 518 opts->num_mnt_opts++;
c9180a57
EP		 519 tmp >>= 1;
520 }
11689d47 521 /* Check if the Label support flag is set */
0b4bdb35 522 if (sbsec->flags & SBLABEL_MNT)
11689d47 523 opts->num_mnt_opts++;
1da177e4 524
e0007529
EP		 525 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
526 if (!opts->mnt_opts) {
c9180a57
EP		 527 rc = -ENOMEM;
528 goto out_free;
529 }
1da177e4 530
e0007529
EP		 531 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
532 if (!opts->mnt_opts_flags) {
c9180a57
EP		 533 rc = -ENOMEM;
534 goto out_free;
535 }
1da177e4 536
c9180a57
EP		 537 i = 0;
538 if (sbsec->flags & FSCONTEXT_MNT) {
539 rc = security_sid_to_context(sbsec->sid, &context, &len);
540 if (rc)
541 goto out_free;
e0007529
EP		 542 opts->mnt_opts[i] = context;
543 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP		 544 }
545 if (sbsec->flags & CONTEXT_MNT) {
546 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
547 if (rc)
548 goto out_free;
e0007529
EP		 549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP		 551 }
552 if (sbsec->flags & DEFCONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
554 if (rc)
555 goto out_free;
e0007529
EP		 556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP		 558 }
559 if (sbsec->flags & ROOTCONTEXT_MNT) {
560 struct inode *root = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *isec = root->i_security;
0808925e 562
c9180a57
EP		 563 rc = security_sid_to_context(isec->sid, &context, &len);
564 if (rc)
565 goto out_free;
e0007529
EP		 566 opts->mnt_opts[i] = context;
567 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 568 }
12f348b9 569 if (sbsec->flags & SBLABEL_MNT) {
11689d47 570 opts->mnt_opts[i] = NULL;
12f348b9 571 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
11689d47 572 }
1da177e4 573
e0007529 574 BUG_ON(i != opts->num_mnt_opts);
1da177e4 575
c9180a57
EP		 576 return 0;
577
578out_free:
e0007529 579 security_free_mnt_opts(opts);
c9180a57
EP		 580 return rc;
581}
1da177e4 582
c9180a57
EP		 583static int bad_option(struct superblock_security_struct *sbsec, char flag,
584 u32 old_sid, u32 new_sid)
585{
0d90a7ec
DQ		 586 char mnt_flags = sbsec->flags & SE_MNTMASK;
587
c9180a57 588 /* check if the old mount command had the same options */
0d90a7ec 589 if (sbsec->flags & SE_SBINITIALIZED)
c9180a57
EP		 590 if (!(sbsec->flags & flag) ||
591 (old_sid != new_sid))
592 return 1;
593
594 /* check if we were passed the same options twice,
595 * aka someone passed context=a,context=b
596 */
0d90a7ec
DQ		 597 if (!(sbsec->flags & SE_SBINITIALIZED))
598 if (mnt_flags & flag)
c9180a57
EP		 599 return 1;
600 return 0;
601}
e0007529 602
c9180a57
EP		 603/*
604 * Allow filesystems with binary mount data to explicitly set mount point
605 * labeling information.
606 */
e0007529 607static int selinux_set_mnt_opts(struct super_block *sb,
649f6e77
DQ		 608 struct security_mnt_opts *opts,
609 unsigned long kern_flags,
610 unsigned long *set_kern_flags)
c9180a57 611{
275bb41e 612 const struct cred *cred = current_cred();
c9180a57 613 int rc = 0, i;
c9180a57 614 struct superblock_security_struct *sbsec = sb->s_security;
29b1deb2 615 const char *name = sb->s_type->name;
089be43e
JM		 616 struct inode *inode = sbsec->sb->s_root->d_inode;
617 struct inode_security_struct *root_isec = inode->i_security;
c9180a57
EP		 618 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
619 u32 defcontext_sid = 0;
e0007529
EP		 620 char **mount_options = opts->mnt_opts;
621 int *flags = opts->mnt_opts_flags;
622 int num_opts = opts->num_mnt_opts;
c9180a57
EP		 623
624 mutex_lock(&sbsec->lock);
625
626 if (!ss_initialized) {
627 if (!num_opts) {
628 /* Defer initialization until selinux_complete_init,
629 after the initial policy is loaded and the security
630 server is ready to handle calls. */
c9180a57
EP		 631 goto out;
632 }
633 rc = -EINVAL;
744ba35e
EP		 634 printk(KERN_WARNING "SELinux: Unable to set superblock options "
635 "before the security server is initialized\n");
1da177e4 636 goto out;
c9180a57 637 }
649f6e77
DQ		 638 if (kern_flags && !set_kern_flags) {
639 /* Specifying internal flags without providing a place to
640 * place the results is not allowed */
641 rc = -EINVAL;
642 goto out;
643 }
1da177e4 644
e0007529
EP		 645 /*
646 * Binary mount data FS will come through this function twice. Once
647 * from an explicit call and once from the generic calls from the vfs.
648 * Since the generic VFS calls will not contain any security mount data
649 * we need to skip the double mount verification.
650 *
651 * This does open a hole in which we will not notice if the first
652 * mount using this sb set explict options and a second mount using
653 * this sb does not set any security options. (The first options
654 * will be used for both mounts)
655 */
0d90a7ec 656 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
e0007529 657 && (num_opts == 0))
f5269710 658 goto out;
e0007529 659
c9180a57
EP		 660 /*
661 * parse the mount options, check if they are valid sids.
662 * also check if someone is trying to mount the same sb more
663 * than once with different security options.
664 */
665 for (i = 0; i < num_opts; i++) {
666 u32 sid;
11689d47 667
12f348b9 668 if (flags[i] == SBLABEL_MNT)
11689d47 669 continue;
c9180a57 670 rc = security_context_to_sid(mount_options[i],
52a4c640 671 strlen(mount_options[i]), &sid, GFP_KERNEL);
1da177e4
LT		 672 if (rc) {
673 printk(KERN_WARNING "SELinux: security_context_to_sid"
29b1deb2
LT		 674 "(%s) failed for (dev %s, type %s) errno=%d\n",
675 mount_options[i], sb->s_id, name, rc);
c9180a57
EP		 676 goto out;
677 }
678 switch (flags[i]) {
679 case FSCONTEXT_MNT:
680 fscontext_sid = sid;
681
682 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
683 fscontext_sid))
684 goto out_double_mount;
685
686 sbsec->flags |= FSCONTEXT_MNT;
687 break;
688 case CONTEXT_MNT:
689 context_sid = sid;
690
691 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
692 context_sid))
693 goto out_double_mount;
694
695 sbsec->flags |= CONTEXT_MNT;
696 break;
697 case ROOTCONTEXT_MNT:
698 rootcontext_sid = sid;
699
700 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
701 rootcontext_sid))
702 goto out_double_mount;
703
704 sbsec->flags |= ROOTCONTEXT_MNT;
705
706 break;
707 case DEFCONTEXT_MNT:
708 defcontext_sid = sid;
709
710 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 defcontext_sid))
712 goto out_double_mount;
713
714 sbsec->flags |= DEFCONTEXT_MNT;
715
716 break;
717 default:
718 rc = -EINVAL;
719 goto out;
1da177e4 720 }
c9180a57
EP		 721 }
722
0d90a7ec 723 if (sbsec->flags & SE_SBINITIALIZED) {
c9180a57 724 /* previously mounted with options, but not on this attempt? */
0d90a7ec 725 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
c9180a57
EP		 726 goto out_double_mount;
727 rc = 0;
728 goto out;
729 }
730
089be43e 731 if (strcmp(sb->s_type->name, "proc") == 0)
0d90a7ec 732 sbsec->flags |= SE_SBPROC;
c9180a57 733
eb9ae686
DQ		 734 if (!sbsec->behavior) {
735 /*
736 * Determine the labeling behavior to use for this
737 * filesystem type.
738 */
98f700f3 739 rc = security_fs_use(sb);
eb9ae686
DQ		 740 if (rc) {
741 printk(KERN_WARNING
742 "%s: security_fs_use(%s) returned %d\n",
743 __func__, sb->s_type->name, rc);
744 goto out;
745 }
c9180a57 746 }
c9180a57
EP		 747 /* sets the context of the superblock for the fs being mounted. */
748 if (fscontext_sid) {
275bb41e 749 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
1da177e4 750 if (rc)
c9180a57 751 goto out;
1da177e4 752
c9180a57 753 sbsec->sid = fscontext_sid;
c312feb2
EP		 754 }
755
756 /*
757 * Switch to using mount point labeling behavior.
758 * sets the label used on all file below the mountpoint, and will set
759 * the superblock context if not already set.
760 */
eb9ae686
DQ		 761 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
762 sbsec->behavior = SECURITY_FS_USE_NATIVE;
763 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
764 }
765
c9180a57
EP		 766 if (context_sid) {
767 if (!fscontext_sid) {
275bb41e
DH		 768 rc = may_context_mount_sb_relabel(context_sid, sbsec,
769 cred);
b04ea3ce 770 if (rc)
c9180a57
EP		 771 goto out;
772 sbsec->sid = context_sid;
b04ea3ce 773 } else {
275bb41e
DH		 774 rc = may_context_mount_inode_relabel(context_sid, sbsec,
775 cred);
b04ea3ce 776 if (rc)
c9180a57 777 goto out;
b04ea3ce 778 }
c9180a57
EP		 779 if (!rootcontext_sid)
780 rootcontext_sid = context_sid;
1da177e4 781
c9180a57 782 sbsec->mntpoint_sid = context_sid;
c312feb2 783 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT		 784 }
785
c9180a57 786 if (rootcontext_sid) {
275bb41e
DH		 787 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
788 cred);
0808925e 789 if (rc)
c9180a57 790 goto out;
0808925e 791
c9180a57
EP		 792 root_isec->sid = rootcontext_sid;
793 root_isec->initialized = 1;
0808925e
EP		 794 }
795
c9180a57 796 if (defcontext_sid) {
eb9ae686
DQ		 797 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
798 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
c9180a57
EP		 799 rc = -EINVAL;
800 printk(KERN_WARNING "SELinux: defcontext option is "
801 "invalid for this filesystem type\n");
802 goto out;
1da177e4
LT		 803 }
804
c9180a57
EP		 805 if (defcontext_sid != sbsec->def_sid) {
806 rc = may_context_mount_inode_relabel(defcontext_sid,
275bb41e 807 sbsec, cred);
c9180a57
EP		 808 if (rc)
809 goto out;
810 }
1da177e4 811
c9180a57 812 sbsec->def_sid = defcontext_sid;
1da177e4
LT		 813 }
814
c9180a57 815 rc = sb_finish_set_opts(sb);
1da177e4 816out:
c9180a57 817 mutex_unlock(&sbsec->lock);
1da177e4 818 return rc;
c9180a57
EP		 819out_double_mount:
820 rc = -EINVAL;
821 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
29b1deb2 822 "security settings for (dev %s, type %s)\n", sb->s_id, name);
c9180a57 823 goto out;
1da177e4
LT		 824}
825
094f7b69
JL		 826static int selinux_cmp_sb_context(const struct super_block *oldsb,
827 const struct super_block *newsb)
828{
829 struct superblock_security_struct *old = oldsb->s_security;
830 struct superblock_security_struct *new = newsb->s_security;
831 char oldflags = old->flags & SE_MNTMASK;
832 char newflags = new->flags & SE_MNTMASK;
833
834 if (oldflags != newflags)
835 goto mismatch;
836 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
837 goto mismatch;
838 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
839 goto mismatch;
840 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
841 goto mismatch;
842 if (oldflags & ROOTCONTEXT_MNT) {
843 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
844 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
845 if (oldroot->sid != newroot->sid)
846 goto mismatch;
847 }
848 return 0;
849mismatch:
850 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
851 "different security settings for (dev %s, "
852 "type %s)\n", newsb->s_id, newsb->s_type->name);
853 return -EBUSY;
854}
855
856static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
c9180a57 857 struct super_block *newsb)
1da177e4 858{
c9180a57
EP		 859 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
860 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 861
c9180a57
EP		 862 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
863 int set_context = (oldsbsec->flags & CONTEXT_MNT);
864 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 865
0f5e6420
EP		 866 /*
867 * if the parent was able to be mounted it clearly had no special lsm
e8c26255 868 * mount options. thus we can safely deal with this superblock later
0f5e6420 869 */
e8c26255 870 if (!ss_initialized)
094f7b69 871 return 0;
c9180a57 872
c9180a57 873 /* how can we clone if the old one wasn't set up?? */
0d90a7ec 874 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
c9180a57 875
094f7b69 876 /* if fs is reusing a sb, make sure that the contexts match */
0d90a7ec 877 if (newsbsec->flags & SE_SBINITIALIZED)
094f7b69 878 return selinux_cmp_sb_context(oldsb, newsb);
5a552617 879
c9180a57
EP		 880 mutex_lock(&newsbsec->lock);
881
882 newsbsec->flags = oldsbsec->flags;
883
884 newsbsec->sid = oldsbsec->sid;
885 newsbsec->def_sid = oldsbsec->def_sid;
886 newsbsec->behavior = oldsbsec->behavior;
887
888 if (set_context) {
889 u32 sid = oldsbsec->mntpoint_sid;
890
891 if (!set_fscontext)
892 newsbsec->sid = sid;
893 if (!set_rootcontext) {
894 struct inode *newinode = newsb->s_root->d_inode;
895 struct inode_security_struct *newisec = newinode->i_security;
896 newisec->sid = sid;
897 }
898 newsbsec->mntpoint_sid = sid;
1da177e4 899 }
c9180a57
EP		 900 if (set_rootcontext) {
901 const struct inode *oldinode = oldsb->s_root->d_inode;
902 const struct inode_security_struct *oldisec = oldinode->i_security;
903 struct inode *newinode = newsb->s_root->d_inode;
904 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 905
c9180a57 906 newisec->sid = oldisec->sid;
1da177e4
LT		 907 }
908
c9180a57
EP		 909 sb_finish_set_opts(newsb);
910 mutex_unlock(&newsbsec->lock);
094f7b69 911 return 0;
c9180a57
EP		 912}
913
2e1479d9
AB		 914static int selinux_parse_opts_str(char *options,
915 struct security_mnt_opts *opts)
c9180a57 916{
e0007529 917 char *p;
c9180a57
EP		 918 char *context = NULL, *defcontext = NULL;
919 char *fscontext = NULL, *rootcontext = NULL;
e0007529 920 int rc, num_mnt_opts = 0;
1da177e4 921
e0007529 922 opts->num_mnt_opts = 0;
1da177e4 923
c9180a57
EP		 924 /* Standard string-based options. */
925 while ((p = strsep(&options, "|")) != NULL) {
926 int token;
927 substring_t args[MAX_OPT_ARGS];
1da177e4 928
c9180a57
EP		 929 if (!*p)
930 continue;
1da177e4 931
c9180a57 932 token = match_token(p, tokens, args);
1da177e4 933
c9180a57
EP		 934 switch (token) {
935 case Opt_context:
936 if (context || defcontext) {
937 rc = -EINVAL;
938 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
939 goto out_err;
940 }
941 context = match_strdup(&args[0]);
942 if (!context) {
943 rc = -ENOMEM;
944 goto out_err;
945 }
946 break;
947
948 case Opt_fscontext:
949 if (fscontext) {
950 rc = -EINVAL;
951 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
952 goto out_err;
953 }
954 fscontext = match_strdup(&args[0]);
955 if (!fscontext) {
956 rc = -ENOMEM;
957 goto out_err;
958 }
959 break;
960
961 case Opt_rootcontext:
962 if (rootcontext) {
963 rc = -EINVAL;
964 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
965 goto out_err;
966 }
967 rootcontext = match_strdup(&args[0]);
968 if (!rootcontext) {
969 rc = -ENOMEM;
970 goto out_err;
971 }
972 break;
973
974 case Opt_defcontext:
975 if (context || defcontext) {
976 rc = -EINVAL;
977 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
978 goto out_err;
979 }
980 defcontext = match_strdup(&args[0]);
981 if (!defcontext) {
982 rc = -ENOMEM;
983 goto out_err;
984 }
985 break;
11689d47
DQ		 986 case Opt_labelsupport:
987 break;
c9180a57
EP		 988 default:
989 rc = -EINVAL;
990 printk(KERN_WARNING "SELinux: unknown mount option\n");
991 goto out_err;
1da177e4 992
1da177e4 993 }
1da177e4 994 }
c9180a57 995
e0007529
EP		 996 rc = -ENOMEM;
997 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
998 if (!opts->mnt_opts)
999 goto out_err;
1000
1001 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002 if (!opts->mnt_opts_flags) {
1003 kfree(opts->mnt_opts);
1004 goto out_err;
1005 }
1006
c9180a57 1007 if (fscontext) {
e0007529
EP		 1008 opts->mnt_opts[num_mnt_opts] = fscontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP		 1010 }
1011 if (context) {
e0007529
EP		 1012 opts->mnt_opts[num_mnt_opts] = context;
1013 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP		 1014 }
1015 if (rootcontext) {
e0007529
EP		 1016 opts->mnt_opts[num_mnt_opts] = rootcontext;
1017 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP		 1018 }
1019 if (defcontext) {
e0007529
EP		 1020 opts->mnt_opts[num_mnt_opts] = defcontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP		 1022 }
1023
e0007529
EP		 1024 opts->num_mnt_opts = num_mnt_opts;
1025 return 0;
1026
c9180a57
EP		 1027out_err:
1028 kfree(context);
1029 kfree(defcontext);
1030 kfree(fscontext);
1031 kfree(rootcontext);
1da177e4
LT		 1032 return rc;
1033}
e0007529
EP		 1034/*
1035 * string mount options parsing and call set the sbsec
1036 */
1037static int superblock_doinit(struct super_block *sb, void *data)
1038{
1039 int rc = 0;
1040 char *options = data;
1041 struct security_mnt_opts opts;
1042
1043 security_init_mnt_opts(&opts);
1044
1045 if (!data)
1046 goto out;
1047
1048 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050 rc = selinux_parse_opts_str(options, &opts);
1051 if (rc)
1052 goto out_err;
1053
1054out:
649f6e77 1055 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
e0007529
EP		 1056
1057out_err:
1058 security_free_mnt_opts(&opts);
1059 return rc;
1060}
1da177e4 1061
3583a711
AB		 1062static void selinux_write_opts(struct seq_file *m,
1063 struct security_mnt_opts *opts)
2069f457
EP		 1064{
1065 int i;
1066 char *prefix;
1067
1068 for (i = 0; i < opts->num_mnt_opts; i++) {
11689d47
DQ		 1069 char *has_comma;
1070
1071 if (opts->mnt_opts[i])
1072 has_comma = strchr(opts->mnt_opts[i], ',');
1073 else
1074 has_comma = NULL;
2069f457
EP		 1075
1076 switch (opts->mnt_opts_flags[i]) {
1077 case CONTEXT_MNT:
1078 prefix = CONTEXT_STR;
1079 break;
1080 case FSCONTEXT_MNT:
1081 prefix = FSCONTEXT_STR;
1082 break;
1083 case ROOTCONTEXT_MNT:
1084 prefix = ROOTCONTEXT_STR;
1085 break;
1086 case DEFCONTEXT_MNT:
1087 prefix = DEFCONTEXT_STR;
1088 break;
12f348b9 1089 case SBLABEL_MNT:
11689d47
DQ		 1090 seq_putc(m, ',');
1091 seq_puts(m, LABELSUPP_STR);
1092 continue;
2069f457
EP		 1093 default:
1094 BUG();
a35c6c83 1095 return;
2069f457
EP		 1096 };
1097 /* we need a comma before each option */
1098 seq_putc(m, ',');
1099 seq_puts(m, prefix);
1100 if (has_comma)
1101 seq_putc(m, '\"');
1102 seq_puts(m, opts->mnt_opts[i]);
1103 if (has_comma)
1104 seq_putc(m, '\"');
1105 }
1106}
1107
1108static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109{
1110 struct security_mnt_opts opts;
1111 int rc;
1112
1113 rc = selinux_get_mnt_opts(sb, &opts);
383795c2
EP		 1114 if (rc) {
1115 /* before policy load we may get EINVAL, don't show anything */
1116 if (rc == -EINVAL)
1117 rc = 0;
2069f457 1118 return rc;
383795c2 1119 }
2069f457
EP		 1120
1121 selinux_write_opts(m, &opts);
1122
1123 security_free_mnt_opts(&opts);
1124
1125 return rc;
1126}
1127
1da177e4
LT		 1128static inline u16 inode_mode_to_security_class(umode_t mode)
1129{
1130 switch (mode & S_IFMT) {
1131 case S_IFSOCK:
1132 return SECCLASS_SOCK_FILE;
1133 case S_IFLNK:
1134 return SECCLASS_LNK_FILE;
1135 case S_IFREG:
1136 return SECCLASS_FILE;
1137 case S_IFBLK:
1138 return SECCLASS_BLK_FILE;
1139 case S_IFDIR:
1140 return SECCLASS_DIR;
1141 case S_IFCHR:
1142 return SECCLASS_CHR_FILE;
1143 case S_IFIFO:
1144 return SECCLASS_FIFO_FILE;
1145
1146 }
1147
1148 return SECCLASS_FILE;
1149}
1150
13402580
JM		 1151static inline int default_protocol_stream(int protocol)
1152{
1153 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154}
1155
1156static inline int default_protocol_dgram(int protocol)
1157{
1158 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159}
1160
1da177e4
LT		 1161static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162{
1163 switch (family) {
1164 case PF_UNIX:
1165 switch (type) {
1166 case SOCK_STREAM:
1167 case SOCK_SEQPACKET:
1168 return SECCLASS_UNIX_STREAM_SOCKET;
1169 case SOCK_DGRAM:
1170 return SECCLASS_UNIX_DGRAM_SOCKET;
1171 }
1172 break;
1173 case PF_INET:
1174 case PF_INET6:
1175 switch (type) {
1176 case SOCK_STREAM:
13402580
JM		 1177 if (default_protocol_stream(protocol))
1178 return SECCLASS_TCP_SOCKET;
1179 else
1180 return SECCLASS_RAWIP_SOCKET;
1da177e4 1181 case SOCK_DGRAM:
13402580
JM		 1182 if (default_protocol_dgram(protocol))
1183 return SECCLASS_UDP_SOCKET;
1184 else
1185 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM		 1186 case SOCK_DCCP:
1187 return SECCLASS_DCCP_SOCKET;
13402580 1188 default:
1da177e4
LT		 1189 return SECCLASS_RAWIP_SOCKET;
1190 }
1191 break;
1192 case PF_NETLINK:
1193 switch (protocol) {
1194 case NETLINK_ROUTE:
1195 return SECCLASS_NETLINK_ROUTE_SOCKET;
1196 case NETLINK_FIREWALL:
1197 return SECCLASS_NETLINK_FIREWALL_SOCKET;
7f1fb60c 1198 case NETLINK_SOCK_DIAG:
1da177e4
LT		 1199 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200 case NETLINK_NFLOG:
1201 return SECCLASS_NETLINK_NFLOG_SOCKET;
1202 case NETLINK_XFRM:
1203 return SECCLASS_NETLINK_XFRM_SOCKET;
1204 case NETLINK_SELINUX:
1205 return SECCLASS_NETLINK_SELINUX_SOCKET;
1206 case NETLINK_AUDIT:
1207 return SECCLASS_NETLINK_AUDIT_SOCKET;
1208 case NETLINK_IP6_FW:
1209 return SECCLASS_NETLINK_IP6FW_SOCKET;
1210 case NETLINK_DNRTMSG:
1211 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 1212 case NETLINK_KOBJECT_UEVENT:
1213 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 1214 default:
1215 return SECCLASS_NETLINK_SOCKET;
1216 }
1217 case PF_PACKET:
1218 return SECCLASS_PACKET_SOCKET;
1219 case PF_KEY:
1220 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP		 1221 case PF_APPLETALK:
1222 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT		 1223 }
1224
1225 return SECCLASS_SOCKET;
1226}
1227
1228#ifdef CONFIG_PROC_FS
8e6c9693 1229static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT		 1230 u16 tclass,
1231 u32 *sid)
1232{
8e6c9693
LAG		 1233 int rc;
1234 char *buffer, *path;
1da177e4 1235
828dfe1d 1236 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT		 1237 if (!buffer)
1238 return -ENOMEM;
1239
8e6c9693
LAG		 1240 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241 if (IS_ERR(path))
1242 rc = PTR_ERR(path);
1243 else {
1244 /* each process gets a /proc/PID/ entry. Strip off the
1245 * PID part to get a valid selinux labeling.
1246 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247 while (path[1] >= '0' && path[1] <= '9') {
1248 path[1] = '/';
1249 path++;
1250 }
1251 rc = security_genfs_sid("proc", path, tclass, sid);
1da177e4 1252 }
1da177e4
LT		 1253 free_page((unsigned long)buffer);
1254 return rc;
1255}
1256#else
8e6c9693 1257static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT		 1258 u16 tclass,
1259 u32 *sid)
1260{
1261 return -EINVAL;
1262}
1263#endif
1264
1265/* The inode's security attributes must be initialized before first use. */
1266static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267{
1268 struct superblock_security_struct *sbsec = NULL;
1269 struct inode_security_struct *isec = inode->i_security;
1270 u32 sid;
1271 struct dentry *dentry;
1272#define INITCONTEXTLEN 255
1273 char *context = NULL;
1274 unsigned len = 0;
1275 int rc = 0;
1da177e4
LT		 1276
1277 if (isec->initialized)
1278 goto out;
1279
23970741 1280 mutex_lock(&isec->lock);
1da177e4 1281 if (isec->initialized)
23970741 1282 goto out_unlock;
1da177e4
LT		 1283
1284 sbsec = inode->i_sb->s_security;
0d90a7ec 1285 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1da177e4
LT		 1286 /* Defer initialization until selinux_complete_init,
1287 after the initial policy is loaded and the security
1288 server is ready to handle calls. */
1289 spin_lock(&sbsec->isec_lock);
1290 if (list_empty(&isec->list))
1291 list_add(&isec->list, &sbsec->isec_head);
1292 spin_unlock(&sbsec->isec_lock);
23970741 1293 goto out_unlock;
1da177e4
LT		 1294 }
1295
1296 switch (sbsec->behavior) {
eb9ae686
DQ		 1297 case SECURITY_FS_USE_NATIVE:
1298 break;
1da177e4
LT		 1299 case SECURITY_FS_USE_XATTR:
1300 if (!inode->i_op->getxattr) {
1301 isec->sid = sbsec->def_sid;
1302 break;
1303 }
1304
1305 /* Need a dentry, since the xattr API requires one.
1306 Life would be simpler if we could just pass the inode. */
1307 if (opt_dentry) {
1308 /* Called from d_instantiate or d_splice_alias. */
1309 dentry = dget(opt_dentry);
1310 } else {
1311 /* Called from selinux_complete_init, try to find a dentry. */
1312 dentry = d_find_alias(inode);
1313 }
1314 if (!dentry) {
df7f54c0
EP		 1315 /*
1316 * this is can be hit on boot when a file is accessed
1317 * before the policy is loaded. When we load policy we
1318 * may find inodes that have no dentry on the
1319 * sbsec->isec_head list. No reason to complain as these
1320 * will get fixed up the next time we go through
1321 * inode_doinit with a dentry, before these inodes could
1322 * be used again by userspace.
1323 */
23970741 1324 goto out_unlock;
1da177e4
LT		 1325 }
1326
1327 len = INITCONTEXTLEN;
4cb912f1 1328 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT		 1329 if (!context) {
1330 rc = -ENOMEM;
1331 dput(dentry);
23970741 1332 goto out_unlock;
1da177e4 1333 }
4cb912f1 1334 context[len] = '\0';
1da177e4
LT		 1335 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336 context, len);
1337 if (rc == -ERANGE) {
314dabb8
JM		 1338 kfree(context);
1339
1da177e4
LT		 1340 /* Need a larger buffer. Query for the right size. */
1341 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342 NULL, 0);
1343 if (rc < 0) {
1344 dput(dentry);
23970741 1345 goto out_unlock;
1da177e4 1346 }
1da177e4 1347 len = rc;
4cb912f1 1348 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT		 1349 if (!context) {
1350 rc = -ENOMEM;
1351 dput(dentry);
23970741 1352 goto out_unlock;
1da177e4 1353 }
4cb912f1 1354 context[len] = '\0';
1da177e4
LT		 1355 rc = inode->i_op->getxattr(dentry,
1356 XATTR_NAME_SELINUX,
1357 context, len);
1358 }
1359 dput(dentry);
1360 if (rc < 0) {
1361 if (rc != -ENODATA) {
744ba35e 1362 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1363 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT		 1364 -rc, inode->i_sb->s_id, inode->i_ino);
1365 kfree(context);
23970741 1366 goto out_unlock;
1da177e4
LT		 1367 }
1368 /* Map ENODATA to the default file SID */
1369 sid = sbsec->def_sid;
1370 rc = 0;
1371 } else {
f5c1d5b2 1372 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS		 1373 sbsec->def_sid,
1374 GFP_NOFS);
1da177e4 1375 if (rc) {
4ba0a8ad
EP		 1376 char *dev = inode->i_sb->s_id;
1377 unsigned long ino = inode->i_ino;
1378
1379 if (rc == -EINVAL) {
1380 if (printk_ratelimit())
1381 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382 "context=%s. This indicates you may need to relabel the inode or the "
1383 "filesystem in question.\n", ino, dev, context);
1384 } else {
1385 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1386 "returned %d for dev=%s ino=%ld\n",
1387 __func__, context, -rc, dev, ino);
1388 }
1da177e4
LT		 1389 kfree(context);
1390 /* Leave with the unlabeled SID */
1391 rc = 0;
1392 break;
1393 }
1394 }
1395 kfree(context);
1396 isec->sid = sid;
1397 break;
1398 case SECURITY_FS_USE_TASK:
1399 isec->sid = isec->task_sid;
1400 break;
1401 case SECURITY_FS_USE_TRANS:
1402 /* Default to the fs SID. */
1403 isec->sid = sbsec->sid;
1404
1405 /* Try to obtain a transition SID. */
1406 isec->sclass = inode_mode_to_security_class(inode->i_mode);
652bb9b0
EP		 1407 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408 isec->sclass, NULL, &sid);
1da177e4 1409 if (rc)
23970741 1410 goto out_unlock;
1da177e4
LT		 1411 isec->sid = sid;
1412 break;
c312feb2
EP		 1413 case SECURITY_FS_USE_MNTPOINT:
1414 isec->sid = sbsec->mntpoint_sid;
1415 break;
1da177e4 1416 default:
c312feb2 1417 /* Default to the fs superblock SID. */
1da177e4
LT		 1418 isec->sid = sbsec->sid;
1419
0d90a7ec 1420 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
f64410ec
PM		 1421 /* We must have a dentry to determine the label on
1422 * procfs inodes */
1423 if (opt_dentry)
1424 /* Called from d_instantiate or
1425 * d_splice_alias. */
1426 dentry = dget(opt_dentry);
1427 else
1428 /* Called from selinux_complete_init, try to
1429 * find a dentry. */
1430 dentry = d_find_alias(inode);
1431 /*
1432 * This can be hit on boot when a file is accessed
1433 * before the policy is loaded. When we load policy we
1434 * may find inodes that have no dentry on the
1435 * sbsec->isec_head list. No reason to complain as
1436 * these will get fixed up the next time we go through
1437 * inode_doinit() with a dentry, before these inodes
1438 * could be used again by userspace.
1439 */
1440 if (!dentry)
1441 goto out_unlock;
1442 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1443 rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1444 dput(dentry);
1445 if (rc)
1446 goto out_unlock;
1447 isec->sid = sid;
1da177e4
LT		 1448 }
1449 break;
1450 }
1451
1452 isec->initialized = 1;
1453
23970741
EP		 1454out_unlock:
1455 mutex_unlock(&isec->lock);
1da177e4
LT		 1456out:
1457 if (isec->sclass == SECCLASS_FILE)
1458 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT		 1459 return rc;
1460}
1461
1462/* Convert a Linux signal to an access vector. */
1463static inline u32 signal_to_av(int sig)
1464{
1465 u32 perm = 0;
1466
1467 switch (sig) {
1468 case SIGCHLD:
1469 /* Commonly granted from child to parent. */
1470 perm = PROCESS__SIGCHLD;
1471 break;
1472 case SIGKILL:
1473 /* Cannot be caught or ignored */
1474 perm = PROCESS__SIGKILL;
1475 break;
1476 case SIGSTOP:
1477 /* Cannot be caught or ignored */
1478 perm = PROCESS__SIGSTOP;
1479 break;
1480 default:
1481 /* All other signals. */
1482 perm = PROCESS__SIGNAL;
1483 break;
1484 }
1485
1486 return perm;
1487}
1488
d84f4f99
DH		 1489/*
1490 * Check permission between a pair of credentials
1491 * fork check, ptrace check, etc.
1492 */
1493static int cred_has_perm(const struct cred *actor,
1494 const struct cred *target,
1495 u32 perms)
1496{
1497 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1498
1499 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1500}
1501
275bb41e 1502/*
88e67f3b 1503 * Check permission between a pair of tasks, e.g. signal checks,
275bb41e
DH		 1504 * fork check, ptrace check, etc.
1505 * tsk1 is the actor and tsk2 is the target
3b11a1de 1506 * - this uses the default subjective creds of tsk1
275bb41e
DH		 1507 */
1508static int task_has_perm(const struct task_struct *tsk1,
1509 const struct task_struct *tsk2,
1da177e4
LT		 1510 u32 perms)
1511{
275bb41e
DH		 1512 const struct task_security_struct *__tsec1, *__tsec2;
1513 u32 sid1, sid2;
1da177e4 1514
275bb41e
DH		 1515 rcu_read_lock();
1516 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1517 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1518 rcu_read_unlock();
1519 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1da177e4
LT		 1520}
1521
3b11a1de
DH		 1522/*
1523 * Check permission between current and another task, e.g. signal checks,
1524 * fork check, ptrace check, etc.
1525 * current is the actor and tsk2 is the target
1526 * - this uses current's subjective creds
1527 */
1528static int current_has_perm(const struct task_struct *tsk,
1529 u32 perms)
1530{
1531 u32 sid, tsid;
1532
1533 sid = current_sid();
1534 tsid = task_sid(tsk);
1535 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1536}
1537
b68e418c
SS		 1538#if CAP_LAST_CAP > 63
1539#error Fix SELinux to handle capabilities > 63.
1540#endif
1541
1da177e4 1542/* Check whether a task is allowed to use a capability. */
6a9de491 1543static int cred_has_capability(const struct cred *cred,
06112163 1544 int cap, int audit)
1da177e4 1545{
2bf49690 1546 struct common_audit_data ad;
06112163 1547 struct av_decision avd;
b68e418c 1548 u16 sclass;
3699c53c 1549 u32 sid = cred_sid(cred);
b68e418c 1550 u32 av = CAP_TO_MASK(cap);
06112163 1551 int rc;
1da177e4 1552
50c205f5 1553 ad.type = LSM_AUDIT_DATA_CAP;
1da177e4
LT		 1554 ad.u.cap = cap;
1555
b68e418c
SS		 1556 switch (CAP_TO_INDEX(cap)) {
1557 case 0:
1558 sclass = SECCLASS_CAPABILITY;
1559 break;
1560 case 1:
1561 sclass = SECCLASS_CAPABILITY2;
1562 break;
1563 default:
1564 printk(KERN_ERR
1565 "SELinux: out of range capability %d\n", cap);
1566 BUG();
a35c6c83 1567 return -EINVAL;
b68e418c 1568 }
06112163 1569
275bb41e 1570 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
9ade0cf4 1571 if (audit == SECURITY_CAP_AUDIT) {
ab354062 1572 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
9ade0cf4
EP		 1573 if (rc2)
1574 return rc2;
1575 }
06112163 1576 return rc;
1da177e4
LT		 1577}
1578
1579/* Check whether a task is allowed to use a system operation. */
1580static int task_has_system(struct task_struct *tsk,
1581 u32 perms)
1582{
275bb41e 1583 u32 sid = task_sid(tsk);
1da177e4 1584
275bb41e 1585 return avc_has_perm(sid, SECINITSID_KERNEL,
1da177e4
LT		 1586 SECCLASS_SYSTEM, perms, NULL);
1587}
1588
1589/* Check whether a task has a particular permission to an inode.
1590 The 'adp' parameter is optional and allows other audit
1591 data to be passed (e.g. the dentry). */
88e67f3b 1592static int inode_has_perm(const struct cred *cred,
1da177e4
LT		 1593 struct inode *inode,
1594 u32 perms,
19e49834 1595 struct common_audit_data *adp)
1da177e4 1596{
1da177e4 1597 struct inode_security_struct *isec;
275bb41e 1598 u32 sid;
1da177e4 1599
e0e81739
DH		 1600 validate_creds(cred);
1601
828dfe1d 1602 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS		 1603 return 0;
1604
88e67f3b 1605 sid = cred_sid(cred);
1da177e4
LT		 1606 isec = inode->i_security;
1607
19e49834 1608 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1da177e4
LT		 1609}
1610
1611/* Same as inode_has_perm, but pass explicit audit data containing
1612 the dentry to help the auditing code to more easily generate the
1613 pathname if needed. */
88e67f3b 1614static inline int dentry_has_perm(const struct cred *cred,
1da177e4
LT		 1615 struct dentry *dentry,
1616 u32 av)
1617{
1618 struct inode *inode = dentry->d_inode;
2bf49690 1619 struct common_audit_data ad;
88e67f3b 1620
50c205f5 1621 ad.type = LSM_AUDIT_DATA_DENTRY;
2875fa00 1622 ad.u.dentry = dentry;
19e49834 1623 return inode_has_perm(cred, inode, av, &ad);
2875fa00
EP		 1624}
1625
1626/* Same as inode_has_perm, but pass explicit audit data containing
1627 the path to help the auditing code to more easily generate the
1628 pathname if needed. */
1629static inline int path_has_perm(const struct cred *cred,
1630 struct path *path,
1631 u32 av)
1632{
1633 struct inode *inode = path->dentry->d_inode;
1634 struct common_audit_data ad;
1635
50c205f5 1636 ad.type = LSM_AUDIT_DATA_PATH;
2875fa00 1637 ad.u.path = *path;
19e49834 1638 return inode_has_perm(cred, inode, av, &ad);
1da177e4
LT		 1639}
1640
13f8e981
DH		 1641/* Same as path_has_perm, but uses the inode from the file struct. */
1642static inline int file_path_has_perm(const struct cred *cred,
1643 struct file *file,
1644 u32 av)
1645{
1646 struct common_audit_data ad;
1647
1648 ad.type = LSM_AUDIT_DATA_PATH;
1649 ad.u.path = file->f_path;
19e49834 1650 return inode_has_perm(cred, file_inode(file), av, &ad);
13f8e981
DH		 1651}
1652
1da177e4
LT		 1653/* Check whether a task can use an open file descriptor to
1654 access an inode in a given way. Check access to the
1655 descriptor itself, and then use dentry_has_perm to
1656 check a particular permission to the file.
1657 Access to the descriptor is implicitly granted if it
1658 has the same SID as the process. If av is zero, then
1659 access to the file is not checked, e.g. for cases
1660 where only the descriptor is affected like seek. */
88e67f3b
DH		 1661static int file_has_perm(const struct cred *cred,
1662 struct file *file,
1663 u32 av)
1da177e4 1664{
1da177e4 1665 struct file_security_struct *fsec = file->f_security;
496ad9aa 1666 struct inode *inode = file_inode(file);
2bf49690 1667 struct common_audit_data ad;
88e67f3b 1668 u32 sid = cred_sid(cred);
1da177e4
LT		 1669 int rc;
1670
50c205f5 1671 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 1672 ad.u.path = file->f_path;
1da177e4 1673
275bb41e
DH		 1674 if (sid != fsec->sid) {
1675 rc = avc_has_perm(sid, fsec->sid,
1da177e4
LT		 1676 SECCLASS_FD,
1677 FD__USE,
1678 &ad);
1679 if (rc)
88e67f3b 1680 goto out;
1da177e4
LT		 1681 }
1682
1683 /* av is zero if only checking access to the descriptor. */
88e67f3b 1684 rc = 0;
1da177e4 1685 if (av)
19e49834 1686 rc = inode_has_perm(cred, inode, av, &ad);
1da177e4 1687
88e67f3b
DH		 1688out:
1689 return rc;
1da177e4
LT		 1690}
1691
1692/* Check whether a task can create a file. */
1693static int may_create(struct inode *dir,
1694 struct dentry *dentry,
1695 u16 tclass)
1696{
5fb49870 1697 const struct task_security_struct *tsec = current_security();
1da177e4
LT		 1698 struct inode_security_struct *dsec;
1699 struct superblock_security_struct *sbsec;
275bb41e 1700 u32 sid, newsid;
2bf49690 1701 struct common_audit_data ad;
1da177e4
LT		 1702 int rc;
1703
1da177e4
LT		 1704 dsec = dir->i_security;
1705 sbsec = dir->i_sb->s_security;
1706
275bb41e
DH		 1707 sid = tsec->sid;
1708 newsid = tsec->create_sid;
1709
50c205f5 1710 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1711 ad.u.dentry = dentry;
1da177e4 1712
275bb41e 1713 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1da177e4
LT		 1714 DIR__ADD_NAME | DIR__SEARCH,
1715 &ad);
1716 if (rc)
1717 return rc;
1718
12f348b9 1719 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
cb1e922f
EP		 1720 rc = security_transition_sid(sid, dsec->sid, tclass,
1721 &dentry->d_name, &newsid);
1da177e4
LT		 1722 if (rc)
1723 return rc;
1724 }
1725
275bb41e 1726 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1da177e4
LT		 1727 if (rc)
1728 return rc;
1729
1730 return avc_has_perm(newsid, sbsec->sid,
1731 SECCLASS_FILESYSTEM,
1732 FILESYSTEM__ASSOCIATE, &ad);
1733}
1734
4eb582cf
ML		 1735/* Check whether a task can create a key. */
1736static int may_create_key(u32 ksid,
1737 struct task_struct *ctx)
1738{
275bb41e 1739 u32 sid = task_sid(ctx);
4eb582cf 1740
275bb41e 1741 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
4eb582cf
ML		 1742}
1743
828dfe1d
EP		 1744#define MAY_LINK 0
1745#define MAY_UNLINK 1
1746#define MAY_RMDIR 2
1da177e4
LT		 1747
1748/* Check whether a task can link, unlink, or rmdir a file/directory. */
1749static int may_link(struct inode *dir,
1750 struct dentry *dentry,
1751 int kind)
1752
1753{
1da177e4 1754 struct inode_security_struct *dsec, *isec;
2bf49690 1755 struct common_audit_data ad;
275bb41e 1756 u32 sid = current_sid();
1da177e4
LT		 1757 u32 av;
1758 int rc;
1759
1da177e4
LT		 1760 dsec = dir->i_security;
1761 isec = dentry->d_inode->i_security;
1762
50c205f5 1763 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1764 ad.u.dentry = dentry;
1da177e4
LT		 1765
1766 av = DIR__SEARCH;
1767 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
275bb41e 1768 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT		 1769 if (rc)
1770 return rc;
1771
1772 switch (kind) {
1773 case MAY_LINK:
1774 av = FILE__LINK;
1775 break;
1776 case MAY_UNLINK:
1777 av = FILE__UNLINK;
1778 break;
1779 case MAY_RMDIR:
1780 av = DIR__RMDIR;
1781 break;
1782 default:
744ba35e
EP		 1783 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1784 __func__, kind);
1da177e4
LT		 1785 return 0;
1786 }
1787
275bb41e 1788 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1da177e4
LT		 1789 return rc;
1790}
1791
1792static inline int may_rename(struct inode *old_dir,
1793 struct dentry *old_dentry,
1794 struct inode *new_dir,
1795 struct dentry *new_dentry)
1796{
1da177e4 1797 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2bf49690 1798 struct common_audit_data ad;
275bb41e 1799 u32 sid = current_sid();
1da177e4
LT		 1800 u32 av;
1801 int old_is_dir, new_is_dir;
1802 int rc;
1803
1da177e4
LT		 1804 old_dsec = old_dir->i_security;
1805 old_isec = old_dentry->d_inode->i_security;
1806 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1807 new_dsec = new_dir->i_security;
1808
50c205f5 1809 ad.type = LSM_AUDIT_DATA_DENTRY;
1da177e4 1810
a269434d 1811 ad.u.dentry = old_dentry;
275bb41e 1812 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1da177e4
LT		 1813 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1814 if (rc)
1815 return rc;
275bb41e 1816 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT		 1817 old_isec->sclass, FILE__RENAME, &ad);
1818 if (rc)
1819 return rc;
1820 if (old_is_dir && new_dir != old_dir) {
275bb41e 1821 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT		 1822 old_isec->sclass, DIR__REPARENT, &ad);
1823 if (rc)
1824 return rc;
1825 }
1826
a269434d 1827 ad.u.dentry = new_dentry;
1da177e4
LT		 1828 av = DIR__ADD_NAME | DIR__SEARCH;
1829 if (new_dentry->d_inode)
1830 av |= DIR__REMOVE_NAME;
275bb41e 1831 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT		 1832 if (rc)
1833 return rc;
1834 if (new_dentry->d_inode) {
1835 new_isec = new_dentry->d_inode->i_security;
1836 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
275bb41e 1837 rc = avc_has_perm(sid, new_isec->sid,
1da177e4
LT		 1838 new_isec->sclass,
1839 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1840 if (rc)
1841 return rc;
1842 }
1843
1844 return 0;
1845}
1846
1847/* Check whether a task can perform a filesystem operation. */
88e67f3b 1848static int superblock_has_perm(const struct cred *cred,
1da177e4
LT		 1849 struct super_block *sb,
1850 u32 perms,
2bf49690 1851 struct common_audit_data *ad)
1da177e4 1852{
1da177e4 1853 struct superblock_security_struct *sbsec;
88e67f3b 1854 u32 sid = cred_sid(cred);
1da177e4 1855
1da177e4 1856 sbsec = sb->s_security;
275bb41e 1857 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1da177e4
LT		 1858}
1859
1860/* Convert a Linux mode and permission mask to an access vector. */
1861static inline u32 file_mask_to_av(int mode, int mask)
1862{
1863 u32 av = 0;
1864
dba19c60 1865 if (!S_ISDIR(mode)) {
1da177e4
LT		 1866 if (mask & MAY_EXEC)
1867 av |= FILE__EXECUTE;
1868 if (mask & MAY_READ)
1869 av |= FILE__READ;
1870
1871 if (mask & MAY_APPEND)
1872 av |= FILE__APPEND;
1873 else if (mask & MAY_WRITE)
1874 av |= FILE__WRITE;
1875
1876 } else {
1877 if (mask & MAY_EXEC)
1878 av |= DIR__SEARCH;
1879 if (mask & MAY_WRITE)
1880 av |= DIR__WRITE;
1881 if (mask & MAY_READ)
1882 av |= DIR__READ;
1883 }
1884
1885 return av;
1886}
1887
8b6a5a37
EP		 1888/* Convert a Linux file to an access vector. */
1889static inline u32 file_to_av(struct file *file)
1890{
1891 u32 av = 0;
1892
1893 if (file->f_mode & FMODE_READ)
1894 av |= FILE__READ;
1895 if (file->f_mode & FMODE_WRITE) {
1896 if (file->f_flags & O_APPEND)
1897 av |= FILE__APPEND;
1898 else
1899 av |= FILE__WRITE;
1900 }
1901 if (!av) {
1902 /*
1903 * Special file opened with flags 3 for ioctl-only use.
1904 */
1905 av = FILE__IOCTL;
1906 }
1907
1908 return av;
1909}
1910
b0c636b9 1911/*
8b6a5a37 1912 * Convert a file to an access vector and include the correct open
b0c636b9
EP		 1913 * open permission.
1914 */
8b6a5a37 1915static inline u32 open_file_to_av(struct file *file)
b0c636b9 1916{
8b6a5a37 1917 u32 av = file_to_av(file);
b0c636b9 1918
49b7b8de
EP		 1919 if (selinux_policycap_openperm)
1920 av |= FILE__OPEN;
1921
b0c636b9
EP		 1922 return av;
1923}
1924
1da177e4
LT		 1925/* Hook functions begin here. */
1926
9e48858f 1927static int selinux_ptrace_access_check(struct task_struct *child,
5cd9c58f 1928 unsigned int mode)
1da177e4 1929{
1da177e4
LT		 1930 int rc;
1931
9e48858f 1932 rc = cap_ptrace_access_check(child, mode);
1da177e4
LT		 1933 if (rc)
1934 return rc;
1935
69f594a3 1936 if (mode & PTRACE_MODE_READ) {
275bb41e
DH		 1937 u32 sid = current_sid();
1938 u32 csid = task_sid(child);
1939 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
006ebb40
SS		 1940 }
1941
3b11a1de 1942 return current_has_perm(child, PROCESS__PTRACE);
5cd9c58f
DH		 1943}
1944
1945static int selinux_ptrace_traceme(struct task_struct *parent)
1946{
1947 int rc;
1948
200ac532 1949 rc = cap_ptrace_traceme(parent);
5cd9c58f
DH		 1950 if (rc)
1951 return rc;
1952
1953 return task_has_perm(parent, current, PROCESS__PTRACE);
1da177e4
LT		 1954}
1955
1956static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1957 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT		 1958{
1959 int error;
1960
3b11a1de 1961 error = current_has_perm(target, PROCESS__GETCAP);
1da177e4
LT		 1962 if (error)
1963 return error;
1964
200ac532 1965 return cap_capget(target, effective, inheritable, permitted);
1da177e4
LT		 1966}
1967
d84f4f99
DH		 1968static int selinux_capset(struct cred *new, const struct cred *old,
1969 const kernel_cap_t *effective,
1970 const kernel_cap_t *inheritable,
1971 const kernel_cap_t *permitted)
1da177e4
LT		 1972{
1973 int error;
1974
200ac532 1975 error = cap_capset(new, old,
d84f4f99 1976 effective, inheritable, permitted);
1da177e4
LT		 1977 if (error)
1978 return error;
1979
d84f4f99 1980 return cred_has_perm(old, new, PROCESS__SETCAP);
1da177e4
LT		 1981}
1982
5626d3e8
JM		 1983/*
1984 * (This comment used to live with the selinux_task_setuid hook,
1985 * which was removed).
1986 *
1987 * Since setuid only affects the current process, and since the SELinux
1988 * controls are not based on the Linux identity attributes, SELinux does not
1989 * need to control this operation. However, SELinux does control the use of
1990 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1991 */
1992
6a9de491
EP		 1993static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1994 int cap, int audit)
1da177e4
LT		 1995{
1996 int rc;
1997
6a9de491 1998 rc = cap_capable(cred, ns, cap, audit);
1da177e4
LT		 1999 if (rc)
2000 return rc;
2001
6a9de491 2002 return cred_has_capability(cred, cap, audit);
1da177e4
LT		 2003}
2004
1da177e4
LT		 2005static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2006{
88e67f3b 2007 const struct cred *cred = current_cred();
1da177e4
LT		 2008 int rc = 0;
2009
2010 if (!sb)
2011 return 0;
2012
2013 switch (cmds) {
828dfe1d
EP		 2014 case Q_SYNC:
2015 case Q_QUOTAON:
2016 case Q_QUOTAOFF:
2017 case Q_SETINFO:
2018 case Q_SETQUOTA:
88e67f3b 2019 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
828dfe1d
EP		 2020 break;
2021 case Q_GETFMT:
2022 case Q_GETINFO:
2023 case Q_GETQUOTA:
88e67f3b 2024 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
828dfe1d
EP		 2025 break;
2026 default:
2027 rc = 0; /* let the kernel handle invalid cmds */
2028 break;
1da177e4
LT		 2029 }
2030 return rc;
2031}
2032
2033static int selinux_quota_on(struct dentry *dentry)
2034{
88e67f3b
DH		 2035 const struct cred *cred = current_cred();
2036
2875fa00 2037 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1da177e4
LT		 2038}
2039
12b3052c 2040static int selinux_syslog(int type)
1da177e4
LT		 2041{
2042 int rc;
2043
1da177e4 2044 switch (type) {
d78ca3cd
KC		 2045 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2046 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
828dfe1d
EP		 2047 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2048 break;
d78ca3cd
KC		 2049 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2050 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2051 /* Set level of messages printed to console */
2052 case SYSLOG_ACTION_CONSOLE_LEVEL:
828dfe1d
EP		 2053 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2054 break;
d78ca3cd
KC		 2055 case SYSLOG_ACTION_CLOSE: /* Close log */
2056 case SYSLOG_ACTION_OPEN: /* Open log */
2057 case SYSLOG_ACTION_READ: /* Read from log */
2058 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2059 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
828dfe1d
EP		 2060 default:
2061 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2062 break;
1da177e4
LT		 2063 }
2064 return rc;
2065}
2066
2067/*
2068 * Check that a process has enough memory to allocate a new virtual
2069 * mapping. 0 means there is enough memory for the allocation to
2070 * succeed and -ENOMEM implies there is not.
2071 *
1da177e4
LT		 2072 * Do not audit the selinux permission check, as this is applied to all
2073 * processes that allocate mappings.
2074 */
34b4e4aa 2075static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT		 2076{
2077 int rc, cap_sys_admin = 0;
1da177e4 2078
6a9de491 2079 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
3699c53c 2080 SECURITY_CAP_NOAUDIT);
1da177e4
LT		 2081 if (rc == 0)
2082 cap_sys_admin = 1;
2083
34b4e4aa 2084 return __vm_enough_memory(mm, pages, cap_sys_admin);
1da177e4
LT		 2085}
2086
2087/* binprm security operations */
2088
a6f76f23 2089static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1da177e4 2090{
a6f76f23
DH		 2091 const struct task_security_struct *old_tsec;
2092 struct task_security_struct *new_tsec;
1da177e4 2093 struct inode_security_struct *isec;
2bf49690 2094 struct common_audit_data ad;
496ad9aa 2095 struct inode *inode = file_inode(bprm->file);
1da177e4
LT		 2096 int rc;
2097
200ac532 2098 rc = cap_bprm_set_creds(bprm);
1da177e4
LT		 2099 if (rc)
2100 return rc;
2101
a6f76f23
DH		 2102 /* SELinux context only depends on initial program or script and not
2103 * the script interpreter */
2104 if (bprm->cred_prepared)
1da177e4
LT		 2105 return 0;
2106
a6f76f23
DH		 2107 old_tsec = current_security();
2108 new_tsec = bprm->cred->security;
1da177e4
LT		 2109 isec = inode->i_security;
2110
2111 /* Default to the current task SID. */
a6f76f23
DH		 2112 new_tsec->sid = old_tsec->sid;
2113 new_tsec->osid = old_tsec->sid;
1da177e4 2114
28eba5bf 2115 /* Reset fs, key, and sock SIDs on execve. */
a6f76f23
DH		 2116 new_tsec->create_sid = 0;
2117 new_tsec->keycreate_sid = 0;
2118 new_tsec->sockcreate_sid = 0;
1da177e4 2119
a6f76f23
DH		 2120 if (old_tsec->exec_sid) {
2121 new_tsec->sid = old_tsec->exec_sid;
1da177e4 2122 /* Reset exec SID on execve. */
a6f76f23 2123 new_tsec->exec_sid = 0;
259e5e6c
AL		 2124
2125 /*
2126 * Minimize confusion: if no_new_privs and a transition is
2127 * explicitly requested, then fail the exec.
2128 */
2129 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2130 return -EPERM;
1da177e4
LT		 2131 } else {
2132 /* Check for a default transition on this program. */
a6f76f23 2133 rc = security_transition_sid(old_tsec->sid, isec->sid,
652bb9b0
EP		 2134 SECCLASS_PROCESS, NULL,
2135 &new_tsec->sid);
1da177e4
LT		 2136 if (rc)
2137 return rc;
2138 }
2139
50c205f5 2140 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 2141 ad.u.path = bprm->file->f_path;
1da177e4 2142
259e5e6c
AL		 2143 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2144 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
a6f76f23 2145 new_tsec->sid = old_tsec->sid;
1da177e4 2146
a6f76f23
DH		 2147 if (new_tsec->sid == old_tsec->sid) {
2148 rc = avc_has_perm(old_tsec->sid, isec->sid,
1da177e4
LT		 2149 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2150 if (rc)
2151 return rc;
2152 } else {
2153 /* Check permissions for the transition. */
a6f76f23 2154 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
1da177e4
LT		 2155 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2156 if (rc)
2157 return rc;
2158
a6f76f23 2159 rc = avc_has_perm(new_tsec->sid, isec->sid,
1da177e4
LT		 2160 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2161 if (rc)
2162 return rc;
2163
a6f76f23
DH		 2164 /* Check for shared state */
2165 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2166 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2167 SECCLASS_PROCESS, PROCESS__SHARE,
2168 NULL);
2169 if (rc)
2170 return -EPERM;
2171 }
2172
2173 /* Make sure that anyone attempting to ptrace over a task that
2174 * changes its SID has the appropriate permit */
2175 if (bprm->unsafe &
2176 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2177 struct task_struct *tracer;
2178 struct task_security_struct *sec;
2179 u32 ptsid = 0;
2180
2181 rcu_read_lock();
06d98473 2182 tracer = ptrace_parent(current);
a6f76f23
DH		 2183 if (likely(tracer != NULL)) {
2184 sec = __task_cred(tracer)->security;
2185 ptsid = sec->sid;
2186 }
2187 rcu_read_unlock();
2188
2189 if (ptsid != 0) {
2190 rc = avc_has_perm(ptsid, new_tsec->sid,
2191 SECCLASS_PROCESS,
2192 PROCESS__PTRACE, NULL);
2193 if (rc)
2194 return -EPERM;
2195 }
2196 }
1da177e4 2197
a6f76f23
DH		 2198 /* Clear any possibly unsafe personality bits on exec: */
2199 bprm->per_clear |= PER_CLEAR_ON_SETID;
1da177e4
LT		 2200 }
2201
1da177e4
LT		 2202 return 0;
2203}
2204
828dfe1d 2205static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4 2206{
5fb49870 2207 const struct task_security_struct *tsec = current_security();
275bb41e 2208 u32 sid, osid;
1da177e4
LT		 2209 int atsecure = 0;
2210
275bb41e
DH		 2211 sid = tsec->sid;
2212 osid = tsec->osid;
2213
2214 if (osid != sid) {
1da177e4
LT		 2215 /* Enable secure mode for SIDs transitions unless
2216 the noatsecure permission is granted between
2217 the two SIDs, i.e. ahp returns 0. */
275bb41e 2218 atsecure = avc_has_perm(osid, sid,
a6f76f23
DH		 2219 SECCLASS_PROCESS,
2220 PROCESS__NOATSECURE, NULL);
1da177e4
LT		 2221 }
2222
200ac532 2223 return (atsecure || cap_bprm_secureexec(bprm));
1da177e4
LT		 2224}
2225
c3c073f8
AV		 2226static int match_file(const void *p, struct file *file, unsigned fd)
2227{
2228 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2229}
2230
1da177e4 2231/* Derived from fs/exec.c:flush_old_files. */
745ca247
DH		 2232static inline void flush_unauthorized_files(const struct cred *cred,
2233 struct files_struct *files)
1da177e4 2234{
1da177e4 2235 struct file *file, *devnull = NULL;
b20c8122 2236 struct tty_struct *tty;
24ec839c 2237 int drop_tty = 0;
c3c073f8 2238 unsigned n;
1da177e4 2239
24ec839c 2240 tty = get_current_tty();
1da177e4 2241 if (tty) {
ee2ffa0d 2242 spin_lock(&tty_files_lock);
37dd0bd0 2243 if (!list_empty(&tty->tty_files)) {
d996b62a 2244 struct tty_file_private *file_priv;
37dd0bd0 2245
1da177e4 2246 /* Revalidate access to controlling tty.
13f8e981
DH		 2247 Use file_path_has_perm on the tty path directly
2248 rather than using file_has_perm, as this particular
2249 open file may belong to another process and we are
2250 only interested in the inode-based check here. */
d996b62a
NP		 2251 file_priv = list_first_entry(&tty->tty_files,
2252 struct tty_file_private, list);
2253 file = file_priv->file;
13f8e981 2254 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
24ec839c 2255 drop_tty = 1;
1da177e4 2256 }
ee2ffa0d 2257 spin_unlock(&tty_files_lock);
452a00d2 2258 tty_kref_put(tty);
1da177e4 2259 }
98a27ba4
EB		 2260 /* Reset controlling tty. */
2261 if (drop_tty)
2262 no_tty();
1da177e4
LT		 2263
2264 /* Revalidate access to inherited open files. */
c3c073f8
AV		 2265 n = iterate_fd(files, 0, match_file, cred);
2266 if (!n) /* none found? */
2267 return;
1da177e4 2268
c3c073f8 2269 devnull = dentry_open(&selinux_null, O_RDWR, cred);
45525b26
AV		 2270 if (IS_ERR(devnull))
2271 devnull = NULL;
2272 /* replace all the matching ones with this */
2273 do {
2274 replace_fd(n - 1, devnull, 0);
2275 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2276 if (devnull)
c3c073f8 2277 fput(devnull);
1da177e4
LT		 2278}
2279
a6f76f23
DH		 2280/*
2281 * Prepare a process for imminent new credential changes due to exec
2282 */
2283static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
1da177e4 2284{
a6f76f23
DH		 2285 struct task_security_struct *new_tsec;
2286 struct rlimit *rlim, *initrlim;
2287 int rc, i;
d84f4f99 2288
a6f76f23
DH		 2289 new_tsec = bprm->cred->security;
2290 if (new_tsec->sid == new_tsec->osid)
2291 return;
1da177e4 2292
a6f76f23
DH		 2293 /* Close files for which the new task SID is not authorized. */
2294 flush_unauthorized_files(bprm->cred, current->files);
0356357c 2295
a6f76f23
DH		 2296 /* Always clear parent death signal on SID transitions. */
2297 current->pdeath_signal = 0;
0356357c 2298
a6f76f23
DH		 2299 /* Check whether the new SID can inherit resource limits from the old
2300 * SID. If not, reset all soft limits to the lower of the current
2301 * task's hard limit and the init task's soft limit.
2302 *
2303 * Note that the setting of hard limits (even to lower them) can be
2304 * controlled by the setrlimit check. The inclusion of the init task's
2305 * soft limit into the computation is to avoid resetting soft limits
2306 * higher than the default soft limit for cases where the default is
2307 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2308 */
2309 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2310 PROCESS__RLIMITINH, NULL);
2311 if (rc) {
eb2d55a3
ON		 2312 /* protect against do_prlimit() */
2313 task_lock(current);
a6f76f23
DH		 2314 for (i = 0; i < RLIM_NLIMITS; i++) {
2315 rlim = current->signal->rlim + i;
2316 initrlim = init_task.signal->rlim + i;
2317 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4 2318 }
eb2d55a3
ON		 2319 task_unlock(current);
2320 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
1da177e4
LT		 2321 }
2322}
2323
2324/*
a6f76f23
DH		 2325 * Clean up the process immediately after the installation of new credentials
2326 * due to exec
1da177e4 2327 */
a6f76f23 2328static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
1da177e4 2329{
a6f76f23 2330 const struct task_security_struct *tsec = current_security();
1da177e4 2331 struct itimerval itimer;
a6f76f23 2332 u32 osid, sid;
1da177e4
LT		 2333 int rc, i;
2334
a6f76f23
DH		 2335 osid = tsec->osid;
2336 sid = tsec->sid;
2337
2338 if (sid == osid)
1da177e4
LT		 2339 return;
2340
a6f76f23
DH		 2341 /* Check whether the new SID can inherit signal state from the old SID.
2342 * If not, clear itimers to avoid subsequent signal generation and
2343 * flush and unblock signals.
2344 *
2345 * This must occur _after_ the task SID has been updated so that any
2346 * kill done after the flush will be checked against the new SID.
2347 */
2348 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
1da177e4
LT		 2349 if (rc) {
2350 memset(&itimer, 0, sizeof itimer);
2351 for (i = 0; i < 3; i++)
2352 do_setitimer(i, &itimer, NULL);
1da177e4 2353 spin_lock_irq(&current->sighand->siglock);
3bcac026
DH		 2354 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2355 __flush_signals(current);
2356 flush_signal_handlers(current, 1);
2357 sigemptyset(&current->blocked);
2358 }
1da177e4
LT		 2359 spin_unlock_irq(&current->sighand->siglock);
2360 }
2361
a6f76f23
DH		 2362 /* Wake up the parent if it is waiting so that it can recheck
2363 * wait permission to the new task SID. */
ecd6de3c 2364 read_lock(&tasklist_lock);
0b7570e7 2365 __wake_up_parent(current, current->real_parent);
ecd6de3c 2366 read_unlock(&tasklist_lock);
1da177e4
LT		 2367}
2368
2369/* superblock security operations */
2370
2371static int selinux_sb_alloc_security(struct super_block *sb)
2372{
2373 return superblock_alloc_security(sb);
2374}
2375
2376static void selinux_sb_free_security(struct super_block *sb)
2377{
2378 superblock_free_security(sb);
2379}
2380
2381static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2382{
2383 if (plen > olen)
2384 return 0;
2385
2386 return !memcmp(prefix, option, plen);
2387}
2388
2389static inline int selinux_option(char *option, int len)
2390{
832cbd9a
EP		 2391 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2392 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2393 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
11689d47
DQ		 2394 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2395 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
1da177e4
LT		 2396}
2397
2398static inline void take_option(char **to, char *from, int *first, int len)
2399{
2400 if (!*first) {
2401 **to = ',';
2402 *to += 1;
3528a953 2403 } else
1da177e4
LT		 2404 *first = 0;
2405 memcpy(*to, from, len);
2406 *to += len;
2407}
2408
828dfe1d
EP		 2409static inline void take_selinux_option(char **to, char *from, int *first,
2410 int len)
3528a953
CO		 2411{
2412 int current_size = 0;
2413
2414 if (!*first) {
2415 **to = '|';
2416 *to += 1;
828dfe1d 2417 } else
3528a953
CO		 2418 *first = 0;
2419
2420 while (current_size < len) {
2421 if (*from != '"') {
2422 **to = *from;
2423 *to += 1;
2424 }
2425 from += 1;
2426 current_size += 1;
2427 }
2428}
2429
e0007529 2430static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT		 2431{
2432 int fnosec, fsec, rc = 0;
2433 char *in_save, *in_curr, *in_end;
2434 char *sec_curr, *nosec_save, *nosec;
3528a953 2435 int open_quote = 0;
1da177e4
LT		 2436
2437 in_curr = orig;
2438 sec_curr = copy;
2439
1da177e4
LT		 2440 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2441 if (!nosec) {
2442 rc = -ENOMEM;
2443 goto out;
2444 }
2445
2446 nosec_save = nosec;
2447 fnosec = fsec = 1;
2448 in_save = in_end = orig;
2449
2450 do {
3528a953
CO		 2451 if (*in_end == '"')
2452 open_quote = !open_quote;
2453 if ((*in_end == ',' && open_quote == 0) ||
2454 *in_end == '\0') {
1da177e4
LT		 2455 int len = in_end - in_curr;
2456
2457 if (selinux_option(in_curr, len))
3528a953 2458 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT		 2459 else
2460 take_option(&nosec, in_curr, &fnosec, len);
2461
2462 in_curr = in_end + 1;
2463 }
2464 } while (*in_end++);
2465
6931dfc9 2466 strcpy(in_save, nosec_save);
da3caa20 2467 free_page((unsigned long)nosec_save);
1da177e4
LT		 2468out:
2469 return rc;
2470}
2471
026eb167
EP		 2472static int selinux_sb_remount(struct super_block *sb, void *data)
2473{
2474 int rc, i, *flags;
2475 struct security_mnt_opts opts;
2476 char *secdata, **mount_options;
2477 struct superblock_security_struct *sbsec = sb->s_security;
2478
2479 if (!(sbsec->flags & SE_SBINITIALIZED))
2480 return 0;
2481
2482 if (!data)
2483 return 0;
2484
2485 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2486 return 0;
2487
2488 security_init_mnt_opts(&opts);
2489 secdata = alloc_secdata();
2490 if (!secdata)
2491 return -ENOMEM;
2492 rc = selinux_sb_copy_data(data, secdata);
2493 if (rc)
2494 goto out_free_secdata;
2495
2496 rc = selinux_parse_opts_str(secdata, &opts);
2497 if (rc)
2498 goto out_free_secdata;
2499
2500 mount_options = opts.mnt_opts;
2501 flags = opts.mnt_opts_flags;
2502
2503 for (i = 0; i < opts.num_mnt_opts; i++) {
2504 u32 sid;
2505 size_t len;
2506
12f348b9 2507 if (flags[i] == SBLABEL_MNT)
026eb167
EP		 2508 continue;
2509 len = strlen(mount_options[i]);
52a4c640
NA		 2510 rc = security_context_to_sid(mount_options[i], len, &sid,
2511 GFP_KERNEL);
026eb167
EP		 2512 if (rc) {
2513 printk(KERN_WARNING "SELinux: security_context_to_sid"
29b1deb2
LT		 2514 "(%s) failed for (dev %s, type %s) errno=%d\n",
2515 mount_options[i], sb->s_id, sb->s_type->name, rc);
026eb167
EP		 2516 goto out_free_opts;
2517 }
2518 rc = -EINVAL;
2519 switch (flags[i]) {
2520 case FSCONTEXT_MNT:
2521 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2522 goto out_bad_option;
2523 break;
2524 case CONTEXT_MNT:
2525 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2526 goto out_bad_option;
2527 break;
2528 case ROOTCONTEXT_MNT: {
2529 struct inode_security_struct *root_isec;
2530 root_isec = sb->s_root->d_inode->i_security;
2531
2532 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2533 goto out_bad_option;
2534 break;
2535 }
2536 case DEFCONTEXT_MNT:
2537 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2538 goto out_bad_option;
2539 break;
2540 default:
2541 goto out_free_opts;
2542 }
2543 }
2544
2545 rc = 0;
2546out_free_opts:
2547 security_free_mnt_opts(&opts);
2548out_free_secdata:
2549 free_secdata(secdata);
2550 return rc;
2551out_bad_option:
2552 printk(KERN_WARNING "SELinux: unable to change security options "
29b1deb2
LT		 2553 "during remount (dev %s, type=%s)\n", sb->s_id,
2554 sb->s_type->name);
026eb167
EP		 2555 goto out_free_opts;
2556}
2557
12204e24 2558static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
1da177e4 2559{
88e67f3b 2560 const struct cred *cred = current_cred();
2bf49690 2561 struct common_audit_data ad;
1da177e4
LT		 2562 int rc;
2563
2564 rc = superblock_doinit(sb, data);
2565 if (rc)
2566 return rc;
2567
74192246
JM		 2568 /* Allow all mounts performed by the kernel */
2569 if (flags & MS_KERNMOUNT)
2570 return 0;
2571
50c205f5 2572 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2573 ad.u.dentry = sb->s_root;
88e67f3b 2574 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
1da177e4
LT		 2575}
2576
726c3342 2577static int selinux_sb_statfs(struct dentry *dentry)
1da177e4 2578{
88e67f3b 2579 const struct cred *cred = current_cred();
2bf49690 2580 struct common_audit_data ad;
1da177e4 2581
50c205f5 2582 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2583 ad.u.dentry = dentry->d_sb->s_root;
88e67f3b 2584 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT		 2585}
2586
808d4e3c 2587static int selinux_mount(const char *dev_name,
b5266eb4 2588 struct path *path,
808d4e3c 2589 const char *type,
828dfe1d
EP		 2590 unsigned long flags,
2591 void *data)
1da177e4 2592{
88e67f3b 2593 const struct cred *cred = current_cred();
1da177e4
LT		 2594
2595 if (flags & MS_REMOUNT)
d8c9584e 2596 return superblock_has_perm(cred, path->dentry->d_sb,
828dfe1d 2597 FILESYSTEM__REMOUNT, NULL);
1da177e4 2598 else
2875fa00 2599 return path_has_perm(cred, path, FILE__MOUNTON);
1da177e4
LT		 2600}
2601
2602static int selinux_umount(struct vfsmount *mnt, int flags)
2603{
88e67f3b 2604 const struct cred *cred = current_cred();
1da177e4 2605
88e67f3b 2606 return superblock_has_perm(cred, mnt->mnt_sb,
828dfe1d 2607 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT		 2608}
2609
2610/* inode security operations */
2611
2612static int selinux_inode_alloc_security(struct inode *inode)
2613{
2614 return inode_alloc_security(inode);
2615}
2616
2617static void selinux_inode_free_security(struct inode *inode)
2618{
2619 inode_free_security(inode);
2620}
2621
d47be3df
DQ		 2622static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2623 struct qstr *name, void **ctx,
2624 u32 *ctxlen)
2625{
2626 const struct cred *cred = current_cred();
2627 struct task_security_struct *tsec;
2628 struct inode_security_struct *dsec;
2629 struct superblock_security_struct *sbsec;
2630 struct inode *dir = dentry->d_parent->d_inode;
2631 u32 newsid;
2632 int rc;
2633
2634 tsec = cred->security;
2635 dsec = dir->i_security;
2636 sbsec = dir->i_sb->s_security;
2637
2638 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2639 newsid = tsec->create_sid;
2640 } else {
2641 rc = security_transition_sid(tsec->sid, dsec->sid,
2642 inode_mode_to_security_class(mode),
2643 name,
2644 &newsid);
2645 if (rc) {
2646 printk(KERN_WARNING
2647 "%s: security_transition_sid failed, rc=%d\n",
2648 __func__, -rc);
2649 return rc;
2650 }
2651 }
2652
2653 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2654}
2655
5e41ff9e 2656static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
9548906b
TH		 2657 const struct qstr *qstr,
2658 const char **name,
2a7dba39 2659 void **value, size_t *len)
5e41ff9e 2660{
5fb49870 2661 const struct task_security_struct *tsec = current_security();
5e41ff9e
SS		 2662 struct inode_security_struct *dsec;
2663 struct superblock_security_struct *sbsec;
275bb41e 2664 u32 sid, newsid, clen;
5e41ff9e 2665 int rc;
9548906b 2666 char *context;
5e41ff9e 2667
5e41ff9e
SS		 2668 dsec = dir->i_security;
2669 sbsec = dir->i_sb->s_security;
5e41ff9e 2670
275bb41e
DH		 2671 sid = tsec->sid;
2672 newsid = tsec->create_sid;
2673
415103f9
EP		 2674 if ((sbsec->flags & SE_SBINITIALIZED) &&
2675 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2676 newsid = sbsec->mntpoint_sid;
12f348b9 2677 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
275bb41e 2678 rc = security_transition_sid(sid, dsec->sid,
5e41ff9e 2679 inode_mode_to_security_class(inode->i_mode),
652bb9b0 2680 qstr, &newsid);
5e41ff9e
SS		 2681 if (rc) {
2682 printk(KERN_WARNING "%s: "
2683 "security_transition_sid failed, rc=%d (dev=%s "
2684 "ino=%ld)\n",
dd6f953a 2685 __func__,
5e41ff9e
SS		 2686 -rc, inode->i_sb->s_id, inode->i_ino);
2687 return rc;
2688 }
2689 }
2690
296fddf7 2691 /* Possibly defer initialization to selinux_complete_init. */
0d90a7ec 2692 if (sbsec->flags & SE_SBINITIALIZED) {
296fddf7
EP		 2693 struct inode_security_struct *isec = inode->i_security;
2694 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2695 isec->sid = newsid;
2696 isec->initialized = 1;
2697 }
5e41ff9e 2698
12f348b9 2699 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
25a74f3b
SS		 2700 return -EOPNOTSUPP;
2701
9548906b
TH		 2702 if (name)
2703 *name = XATTR_SELINUX_SUFFIX;
5e41ff9e 2704
570bc1c2 2705 if (value && len) {
12b29f34 2706 rc = security_sid_to_context_force(newsid, &context, &clen);
9548906b 2707 if (rc)
570bc1c2 2708 return rc;
570bc1c2
SS		 2709 *value = context;
2710 *len = clen;
5e41ff9e 2711 }
5e41ff9e 2712
5e41ff9e
SS		 2713 return 0;
2714}
2715
4acdaf27 2716static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
1da177e4
LT		 2717{
2718 return may_create(dir, dentry, SECCLASS_FILE);
2719}
2720
1da177e4
LT		 2721static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2722{
1da177e4
LT		 2723 return may_link(dir, old_dentry, MAY_LINK);
2724}
2725
1da177e4
LT		 2726static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2727{
1da177e4
LT		 2728 return may_link(dir, dentry, MAY_UNLINK);
2729}
2730
2731static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2732{
2733 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2734}
2735
18bb1db3 2736static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
1da177e4
LT		 2737{
2738 return may_create(dir, dentry, SECCLASS_DIR);
2739}
2740
1da177e4
LT		 2741static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2742{
2743 return may_link(dir, dentry, MAY_RMDIR);
2744}
2745
1a67aafb 2746static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
1da177e4 2747{
1da177e4
LT		 2748 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2749}
2750
1da177e4 2751static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2752 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT		 2753{
2754 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2755}
2756
1da177e4
LT		 2757static int selinux_inode_readlink(struct dentry *dentry)
2758{
88e67f3b
DH		 2759 const struct cred *cred = current_cred();
2760
2875fa00 2761 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT		 2762}
2763
2764static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2765{
88e67f3b 2766 const struct cred *cred = current_cred();
1da177e4 2767
2875fa00 2768 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT		 2769}
2770
d4cf970d
EP		 2771static noinline int audit_inode_permission(struct inode *inode,
2772 u32 perms, u32 audited, u32 denied,
2773 unsigned flags)
1da177e4 2774{
b782e0a6 2775 struct common_audit_data ad;
d4cf970d
EP		 2776 struct inode_security_struct *isec = inode->i_security;
2777 int rc;
2778
50c205f5 2779 ad.type = LSM_AUDIT_DATA_INODE;
d4cf970d
EP		 2780 ad.u.inode = inode;
2781
2782 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2783 audited, denied, &ad, flags);
2784 if (rc)
2785 return rc;
2786 return 0;
2787}
2788
e74f71eb 2789static int selinux_inode_permission(struct inode *inode, int mask)
1da177e4 2790{
88e67f3b 2791 const struct cred *cred = current_cred();
b782e0a6
EP		 2792 u32 perms;
2793 bool from_access;
cf1dd1da 2794 unsigned flags = mask & MAY_NOT_BLOCK;
2e334057
EP		 2795 struct inode_security_struct *isec;
2796 u32 sid;
2797 struct av_decision avd;
2798 int rc, rc2;
2799 u32 audited, denied;
1da177e4 2800
b782e0a6 2801 from_access = mask & MAY_ACCESS;
d09ca739
EP		 2802 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2803
b782e0a6
EP		 2804 /* No permission to check. Existence test. */
2805 if (!mask)
1da177e4 2806 return 0;
1da177e4 2807
2e334057 2808 validate_creds(cred);
b782e0a6 2809
2e334057
EP		 2810 if (unlikely(IS_PRIVATE(inode)))
2811 return 0;
b782e0a6
EP		 2812
2813 perms = file_mask_to_av(inode->i_mode, mask);
2814
2e334057
EP		 2815 sid = cred_sid(cred);
2816 isec = inode->i_security;
2817
2818 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2819 audited = avc_audit_required(perms, &avd, rc,
2820 from_access ? FILE__AUDIT_ACCESS : 0,
2821 &denied);
2822 if (likely(!audited))
2823 return rc;
2824
d4cf970d 2825 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2e334057
EP		 2826 if (rc2)
2827 return rc2;
2828 return rc;
1da177e4
LT		 2829}
2830
2831static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2832{
88e67f3b 2833 const struct cred *cred = current_cred();
bc6a6008 2834 unsigned int ia_valid = iattr->ia_valid;
95dbf739 2835 __u32 av = FILE__WRITE;
1da177e4 2836
bc6a6008
AW		 2837 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2838 if (ia_valid & ATTR_FORCE) {
2839 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2840 ATTR_FORCE);
2841 if (!ia_valid)
2842 return 0;
2843 }
1da177e4 2844
bc6a6008
AW		 2845 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2846 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2875fa00 2847 return dentry_has_perm(cred, dentry, FILE__SETATTR);
1da177e4 2848
3d2195c3 2849 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
95dbf739
EP		 2850 av |= FILE__OPEN;
2851
2852 return dentry_has_perm(cred, dentry, av);
1da177e4
LT		 2853}
2854
2855static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2856{
88e67f3b 2857 const struct cred *cred = current_cred();
2875fa00
EP		 2858 struct path path;
2859
2860 path.dentry = dentry;
2861 path.mnt = mnt;
88e67f3b 2862
2875fa00 2863 return path_has_perm(cred, &path, FILE__GETATTR);
1da177e4
LT		 2864}
2865
8f0cfa52 2866static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771 2867{
88e67f3b
DH		 2868 const struct cred *cred = current_cred();
2869
b5376771
SH		 2870 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2871 sizeof XATTR_SECURITY_PREFIX - 1)) {
2872 if (!strcmp(name, XATTR_NAME_CAPS)) {
2873 if (!capable(CAP_SETFCAP))
2874 return -EPERM;
2875 } else if (!capable(CAP_SYS_ADMIN)) {
2876 /* A different attribute in the security namespace.
2877 Restrict to administrator. */
2878 return -EPERM;
2879 }
2880 }
2881
2882 /* Not an attribute we recognize, so just check the
2883 ordinary setattr permission. */
2875fa00 2884 return dentry_has_perm(cred, dentry, FILE__SETATTR);
b5376771
SH		 2885}
2886
8f0cfa52
DH		 2887static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2888 const void *value, size_t size, int flags)
1da177e4 2889{
1da177e4
LT		 2890 struct inode *inode = dentry->d_inode;
2891 struct inode_security_struct *isec = inode->i_security;
2892 struct superblock_security_struct *sbsec;
2bf49690 2893 struct common_audit_data ad;
275bb41e 2894 u32 newsid, sid = current_sid();
1da177e4
LT		 2895 int rc = 0;
2896
b5376771
SH		 2897 if (strcmp(name, XATTR_NAME_SELINUX))
2898 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT		 2899
2900 sbsec = inode->i_sb->s_security;
12f348b9 2901 if (!(sbsec->flags & SBLABEL_MNT))
1da177e4
LT		 2902 return -EOPNOTSUPP;
2903
2e149670 2904 if (!inode_owner_or_capable(inode))
1da177e4
LT		 2905 return -EPERM;
2906
50c205f5 2907 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2908 ad.u.dentry = dentry;
1da177e4 2909
275bb41e 2910 rc = avc_has_perm(sid, isec->sid, isec->sclass,
1da177e4
LT		 2911 FILE__RELABELFROM, &ad);
2912 if (rc)
2913 return rc;
2914
52a4c640 2915 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
12b29f34 2916 if (rc == -EINVAL) {
d6ea83ec
EP		 2917 if (!capable(CAP_MAC_ADMIN)) {
2918 struct audit_buffer *ab;
2919 size_t audit_size;
2920 const char *str;
2921
2922 /* We strip a nul only if it is at the end, otherwise the
2923 * context contains a nul and we should audit that */
e3fea3f7
AV		 2924 if (value) {
2925 str = value;
2926 if (str[size - 1] == '\0')
2927 audit_size = size - 1;
2928 else
2929 audit_size = size;
2930 } else {
2931 str = "";
2932 audit_size = 0;
2933 }
d6ea83ec
EP		 2934 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2935 audit_log_format(ab, "op=setxattr invalid_context=");
2936 audit_log_n_untrustedstring(ab, value, audit_size);
2937 audit_log_end(ab);
2938
12b29f34 2939 return rc;
d6ea83ec 2940 }
12b29f34
SS		 2941 rc = security_context_to_sid_force(value, size, &newsid);
2942 }
1da177e4
LT		 2943 if (rc)
2944 return rc;
2945
275bb41e 2946 rc = avc_has_perm(sid, newsid, isec->sclass,
1da177e4
LT		 2947 FILE__RELABELTO, &ad);
2948 if (rc)
2949 return rc;
2950
275bb41e 2951 rc = security_validate_transition(isec->sid, newsid, sid,
828dfe1d 2952 isec->sclass);
1da177e4
LT		 2953 if (rc)
2954 return rc;
2955
2956 return avc_has_perm(newsid,
2957 sbsec->sid,
2958 SECCLASS_FILESYSTEM,
2959 FILESYSTEM__ASSOCIATE,
2960 &ad);
2961}
2962
8f0cfa52 2963static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
f5269710 2964 const void *value, size_t size,
8f0cfa52 2965 int flags)
1da177e4
LT		 2966{
2967 struct inode *inode = dentry->d_inode;
2968 struct inode_security_struct *isec = inode->i_security;
2969 u32 newsid;
2970 int rc;
2971
2972 if (strcmp(name, XATTR_NAME_SELINUX)) {
2973 /* Not an attribute we recognize, so nothing to do. */
2974 return;
2975 }
2976
12b29f34 2977 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 2978 if (rc) {
12b29f34
SS		 2979 printk(KERN_ERR "SELinux: unable to map context to SID"
2980 "for (%s, %lu), rc=%d\n",
2981 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT		 2982 return;
2983 }
2984
aa9c2669 2985 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 2986 isec->sid = newsid;
aa9c2669
DQ		 2987 isec->initialized = 1;
2988
1da177e4
LT		 2989 return;
2990}
2991
8f0cfa52 2992static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 2993{
88e67f3b
DH		 2994 const struct cred *cred = current_cred();
2995
2875fa00 2996 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT		 2997}
2998
828dfe1d 2999static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4 3000{
88e67f3b
DH		 3001 const struct cred *cred = current_cred();
3002
2875fa00 3003 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT		 3004}
3005
8f0cfa52 3006static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 3007{
b5376771
SH		 3008 if (strcmp(name, XATTR_NAME_SELINUX))
3009 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT		 3010
3011 /* No one is allowed to remove a SELinux security label.
3012 You can change the label, but all data must be labeled. */
3013 return -EACCES;
3014}
3015
d381d8a9 3016/*
abc69bb6 3017 * Copy the inode security context value to the user.
d381d8a9
JM		 3018 *
3019 * Permission check is handled by selinux_inode_getxattr hook.
3020 */
42492594 3021static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 3022{
42492594
DQ		 3023 u32 size;
3024 int error;
3025 char *context = NULL;
1da177e4 3026 struct inode_security_struct *isec = inode->i_security;
d381d8a9 3027
8c8570fb
DK		 3028 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3029 return -EOPNOTSUPP;
d381d8a9 3030
abc69bb6
SS		 3031 /*
3032 * If the caller has CAP_MAC_ADMIN, then get the raw context
3033 * value even if it is not defined by current policy; otherwise,
3034 * use the in-core value under current policy.
3035 * Use the non-auditing forms of the permission checks since
3036 * getxattr may be called by unprivileged processes commonly
3037 * and lack of permission just means that we fall back to the
3038 * in-core context value, not a denial.
3039 */
6a9de491 3040 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3699c53c 3041 SECURITY_CAP_NOAUDIT);
abc69bb6
SS		 3042 if (!error)
3043 error = security_sid_to_context_force(isec->sid, &context,
3044 &size);
3045 else
3046 error = security_sid_to_context(isec->sid, &context, &size);
42492594
DQ		 3047 if (error)
3048 return error;
3049 error = size;
3050 if (alloc) {
3051 *buffer = context;
3052 goto out_nofree;
3053 }
3054 kfree(context);
3055out_nofree:
3056 return error;
1da177e4
LT		 3057}
3058
3059static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 3060 const void *value, size_t size, int flags)
1da177e4
LT		 3061{
3062 struct inode_security_struct *isec = inode->i_security;
3063 u32 newsid;
3064 int rc;
3065
3066 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3067 return -EOPNOTSUPP;
3068
3069 if (!value || !size)
3070 return -EACCES;
3071
52a4c640 3072 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
1da177e4
LT		 3073 if (rc)
3074 return rc;
3075
aa9c2669 3076 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 3077 isec->sid = newsid;
ddd29ec6 3078 isec->initialized = 1;
1da177e4
LT		 3079 return 0;
3080}
3081
3082static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3083{
3084 const int len = sizeof(XATTR_NAME_SELINUX);
3085 if (buffer && len <= buffer_size)
3086 memcpy(buffer, XATTR_NAME_SELINUX, len);
3087 return len;
3088}
3089
713a04ae
AD		 3090static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3091{
3092 struct inode_security_struct *isec = inode->i_security;
3093 *secid = isec->sid;
3094}
3095
1da177e4
LT		 3096/* file security operations */
3097
788e7dd4 3098static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 3099{
88e67f3b 3100 const struct cred *cred = current_cred();
496ad9aa 3101 struct inode *inode = file_inode(file);
1da177e4 3102
1da177e4
LT		 3103 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3104 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3105 mask |= MAY_APPEND;
3106
389fb800
PM		 3107 return file_has_perm(cred, file,
3108 file_mask_to_av(inode->i_mode, mask));
1da177e4
LT		 3109}
3110
788e7dd4
YN		 3111static int selinux_file_permission(struct file *file, int mask)
3112{
496ad9aa 3113 struct inode *inode = file_inode(file);
20dda18b
SS		 3114 struct file_security_struct *fsec = file->f_security;
3115 struct inode_security_struct *isec = inode->i_security;
3116 u32 sid = current_sid();
3117
389fb800 3118 if (!mask)
788e7dd4
YN		 3119 /* No permission to check. Existence test. */
3120 return 0;
788e7dd4 3121
20dda18b
SS		 3122 if (sid == fsec->sid && fsec->isid == isec->sid &&
3123 fsec->pseqno == avc_policy_seqno())
83d49856 3124 /* No change since file_open check. */
20dda18b
SS		 3125 return 0;
3126
788e7dd4
YN		 3127 return selinux_revalidate_file_permission(file, mask);
3128}
3129
1da177e4
LT		 3130static int selinux_file_alloc_security(struct file *file)
3131{
3132 return file_alloc_security(file);
3133}
3134
3135static void selinux_file_free_security(struct file *file)
3136{
3137 file_free_security(file);
3138}
3139
3140static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3141 unsigned long arg)
3142{
88e67f3b 3143 const struct cred *cred = current_cred();
0b24dcb7 3144 int error = 0;
1da177e4 3145
0b24dcb7
EP		 3146 switch (cmd) {
3147 case FIONREAD:
3148 /* fall through */
3149 case FIBMAP:
3150 /* fall through */
3151 case FIGETBSZ:
3152 /* fall through */
2f99c369 3153 case FS_IOC_GETFLAGS:
0b24dcb7 3154 /* fall through */
2f99c369 3155 case FS_IOC_GETVERSION:
0b24dcb7
EP		 3156 error = file_has_perm(cred, file, FILE__GETATTR);
3157 break;
1da177e4 3158
2f99c369 3159 case FS_IOC_SETFLAGS:
0b24dcb7 3160 /* fall through */
2f99c369 3161 case FS_IOC_SETVERSION:
0b24dcb7
EP		 3162 error = file_has_perm(cred, file, FILE__SETATTR);
3163 break;
3164
3165 /* sys_ioctl() checks */
3166 case FIONBIO:
3167 /* fall through */
3168 case FIOASYNC:
3169 error = file_has_perm(cred, file, 0);
3170 break;
1da177e4 3171
0b24dcb7
EP		 3172 case KDSKBENT:
3173 case KDSKBSENT:
6a9de491
EP		 3174 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3175 SECURITY_CAP_AUDIT);
0b24dcb7
EP		 3176 break;
3177
3178 /* default case assumes that the command will go
3179 * to the file's ioctl() function.
3180 */
3181 default:
3182 error = file_has_perm(cred, file, FILE__IOCTL);
3183 }
3184 return error;
1da177e4
LT		 3185}
3186
fcaaade1
SS		 3187static int default_noexec;
3188
1da177e4
LT		 3189static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3190{
88e67f3b 3191 const struct cred *cred = current_cred();
d84f4f99 3192 int rc = 0;
88e67f3b 3193
fcaaade1
SS		 3194 if (default_noexec &&
3195 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
1da177e4
LT		 3196 /*
3197 * We are making executable an anonymous mapping or a
3198 * private file mapping that will also be writable.
3199 * This has an additional check.
3200 */
d84f4f99 3201 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
1da177e4 3202 if (rc)
d84f4f99 3203 goto error;
1da177e4 3204 }
1da177e4
LT		 3205
3206 if (file) {
3207 /* read access is always possible with a mapping */
3208 u32 av = FILE__READ;
3209
3210 /* write access only matters if the mapping is shared */
3211 if (shared && (prot & PROT_WRITE))
3212 av |= FILE__WRITE;
3213
3214 if (prot & PROT_EXEC)
3215 av |= FILE__EXECUTE;
3216
88e67f3b 3217 return file_has_perm(cred, file, av);
1da177e4 3218 }
d84f4f99
DH		 3219
3220error:
3221 return rc;
1da177e4
LT		 3222}
3223
e5467859 3224static int selinux_mmap_addr(unsigned long addr)
1da177e4 3225{
98883bfd
PM		 3226 int rc;
3227
3228 /* do DAC check on address space usage */
3229 rc = cap_mmap_addr(addr);
3230 if (rc)
3231 return rc;
1da177e4 3232
a2551df7 3233 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
98883bfd 3234 u32 sid = current_sid();
ed032189
EP		 3235 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3236 MEMPROTECT__MMAP_ZERO, NULL);
84336d1a
EP		 3237 }
3238
98883bfd 3239 return rc;
e5467859 3240}
1da177e4 3241
e5467859
AV		 3242static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3243 unsigned long prot, unsigned long flags)
3244{
1da177e4
LT		 3245 if (selinux_checkreqprot)
3246 prot = reqprot;
3247
3248 return file_map_prot_check(file, prot,
3249 (flags & MAP_TYPE) == MAP_SHARED);
3250}
3251
3252static int selinux_file_mprotect(struct vm_area_struct *vma,
3253 unsigned long reqprot,
3254 unsigned long prot)
3255{
88e67f3b 3256 const struct cred *cred = current_cred();
1da177e4
LT		 3257
3258 if (selinux_checkreqprot)
3259 prot = reqprot;
3260
fcaaade1
SS		 3261 if (default_noexec &&
3262 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
d541bbee 3263 int rc = 0;
db4c9641
SS		 3264 if (vma->vm_start >= vma->vm_mm->start_brk &&
3265 vma->vm_end <= vma->vm_mm->brk) {
d84f4f99 3266 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
db4c9641
SS		 3267 } else if (!vma->vm_file &&
3268 vma->vm_start <= vma->vm_mm->start_stack &&
3269 vma->vm_end >= vma->vm_mm->start_stack) {
3b11a1de 3270 rc = current_has_perm(current, PROCESS__EXECSTACK);
db4c9641
SS		 3271 } else if (vma->vm_file && vma->anon_vma) {
3272 /*
3273 * We are making executable a file mapping that has
3274 * had some COW done. Since pages might have been
3275 * written, check ability to execute the possibly
3276 * modified content. This typically should only
3277 * occur for text relocations.
3278 */
d84f4f99 3279 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
db4c9641 3280 }