projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
selinux: fix broken peer recv check
[deliverable/linux.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP		 7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT		 10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
2069f457
EP		 12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
1da177e4 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 15 * <dgoeddel@trustedcs.com>
ed6d76e4 16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
82c21bfa 17 * Paul Moore <paul@paul-moore.com>
788e7dd4 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT		 20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
828dfe1d 23 * as published by the Free Software Foundation.
1da177e4
LT		 24 */
25
1da177e4 26#include <linux/init.h>
0b24dcb7 27#include <linux/kd.h>
1da177e4 28#include <linux/kernel.h>
0d094efe 29#include <linux/tracehook.h>
1da177e4
LT		 30#include <linux/errno.h>
31#include <linux/sched.h>
32#include <linux/security.h>
33#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
0b24dcb7 40#include <linux/proc_fs.h>
1da177e4 41#include <linux/swap.h>
1da177e4
LT		 42#include <linux/spinlock.h>
43#include <linux/syscalls.h>
2a7dba39 44#include <linux/dcache.h>
1da177e4 45#include <linux/file.h>
9f3acc31 46#include <linux/fdtable.h>
1da177e4
LT		 47#include <linux/namei.h>
48#include <linux/mount.h>
1da177e4
LT		 49#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
227b60f5 53#include <net/ip.h> /* for local_port_range[] */
ca10b9e9 54#include <net/sock.h>
1da177e4 55#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
da2ea0d0 56#include <net/inet_connection_sock.h>
220deb96 57#include <net/net_namespace.h>
d621d35e 58#include <net/netlabel.h>
f5269710 59#include <linux/uaccess.h>
1da177e4 60#include <asm/ioctls.h>
60063497 61#include <linux/atomic.h>
1da177e4
LT		 62#include <linux/bitops.h>
63#include <linux/interrupt.h>
64#include <linux/netdevice.h> /* for network interface checks */
77954983 65#include <net/netlink.h>
1da177e4
LT		 66#include <linux/tcp.h>
67#include <linux/udp.h>
2ee92d46 68#include <linux/dccp.h>
1da177e4
LT		 69#include <linux/quota.h>
70#include <linux/un.h> /* for Unix socket types */
71#include <net/af_unix.h> /* for Unix socket types */
72#include <linux/parser.h>
73#include <linux/nfs_mount.h>
74#include <net/ipv6.h>
75#include <linux/hugetlb.h>
76#include <linux/personality.h>
1da177e4 77#include <linux/audit.h>
6931dfc9 78#include <linux/string.h>
877ce7c1 79#include <linux/selinux.h>
23970741 80#include <linux/mutex.h>
f06febc9 81#include <linux/posix-timers.h>
00234592 82#include <linux/syslog.h>
3486740a 83#include <linux/user_namespace.h>
44fc7ea0 84#include <linux/export.h>
eb9ae686 85#include <linux/security.h>
40401530
AV		 86#include <linux/msg.h>
87#include <linux/shm.h>
1da177e4
LT		 88
89#include "avc.h"
90#include "objsec.h"
91#include "netif.h"
224dfbd8 92#include "netnode.h"
3e112172 93#include "netport.h"
d28d1e08 94#include "xfrm.h"
c60475bf 95#include "netlabel.h"
9d57a7f9 96#include "audit.h"
7b98a585 97#include "avc_ss.h"
1da177e4 98
102aefdd
AA		 99#define SB_TYPE_FMT "%s%s%s"
100#define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
101#define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
c9180a57 102
20510f2f 103extern struct security_operations *security_ops;
1da177e4 104
d621d35e 105/* SECMARK reference count */
56a4ca99 106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
d621d35e 107
1da177e4 108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 109int selinux_enforcing;
1da177e4
LT		 110
111static int __init enforcing_setup(char *str)
112{
f5269710
EP		 113 unsigned long enforcing;
114 if (!strict_strtoul(str, 0, &enforcing))
115 selinux_enforcing = enforcing ? 1 : 0;
1da177e4
LT		 116 return 1;
117}
118__setup("enforcing=", enforcing_setup);
119#endif
120
121#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
122int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
123
124static int __init selinux_enabled_setup(char *str)
125{
f5269710
EP		 126 unsigned long enabled;
127 if (!strict_strtoul(str, 0, &enabled))
128 selinux_enabled = enabled ? 1 : 0;
1da177e4
LT		 129 return 1;
130}
131__setup("selinux=", selinux_enabled_setup);
30d55280
SS		 132#else
133int selinux_enabled = 1;
1da177e4
LT		 134#endif
135
e18b890b 136static struct kmem_cache *sel_inode_cache;
7cae7e26 137
d621d35e
PM		 138/**
139 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
140 *
141 * Description:
142 * This function checks the SECMARK reference counter to see if any SECMARK
143 * targets are currently configured, if the reference counter is greater than
144 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
2be4d74f
CP		 145 * enabled, false (0) if SECMARK is disabled. If the always_check_network
146 * policy capability is enabled, SECMARK is always considered enabled.
d621d35e
PM		 147 *
148 */
149static int selinux_secmark_enabled(void)
150{
2be4d74f
CP		 151 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
152}
153
154/**
155 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
156 *
157 * Description:
158 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
159 * (1) if any are enabled or false (0) if neither are enabled. If the
160 * always_check_network policy capability is enabled, peer labeling
161 * is always considered enabled.
162 *
163 */
164static int selinux_peerlbl_enabled(void)
165{
166 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
d621d35e
PM		 167}
168
d84f4f99
DH		 169/*
170 * initialise the security for the init task
171 */
172static void cred_init_security(void)
1da177e4 173{
3b11a1de 174 struct cred *cred = (struct cred *) current->real_cred;
1da177e4
LT		 175 struct task_security_struct *tsec;
176
89d155ef 177 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4 178 if (!tsec)
d84f4f99 179 panic("SELinux: Failed to initialize initial task.\n");
1da177e4 180
d84f4f99 181 tsec->osid = tsec->sid = SECINITSID_KERNEL;
f1752eec 182 cred->security = tsec;
1da177e4
LT		 183}
184
88e67f3b
DH		 185/*
186 * get the security ID of a set of credentials
187 */
188static inline u32 cred_sid(const struct cred *cred)
189{
190 const struct task_security_struct *tsec;
191
192 tsec = cred->security;
193 return tsec->sid;
194}
195
275bb41e 196/*
3b11a1de 197 * get the objective security ID of a task
275bb41e
DH		 198 */
199static inline u32 task_sid(const struct task_struct *task)
200{
275bb41e
DH		 201 u32 sid;
202
203 rcu_read_lock();
88e67f3b 204 sid = cred_sid(__task_cred(task));
275bb41e
DH		 205 rcu_read_unlock();
206 return sid;
207}
208
209/*
3b11a1de 210 * get the subjective security ID of the current task
275bb41e
DH		 211 */
212static inline u32 current_sid(void)
213{
5fb49870 214 const struct task_security_struct *tsec = current_security();
275bb41e
DH		 215
216 return tsec->sid;
217}
218
88e67f3b
DH		 219/* Allocate and free functions for each kind of security blob. */
220
1da177e4
LT		 221static int inode_alloc_security(struct inode *inode)
222{
1da177e4 223 struct inode_security_struct *isec;
275bb41e 224 u32 sid = current_sid();
1da177e4 225
a02fe132 226 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT		 227 if (!isec)
228 return -ENOMEM;
229
23970741 230 mutex_init(&isec->lock);
1da177e4 231 INIT_LIST_HEAD(&isec->list);
1da177e4
LT		 232 isec->inode = inode;
233 isec->sid = SECINITSID_UNLABELED;
234 isec->sclass = SECCLASS_FILE;
275bb41e 235 isec->task_sid = sid;
1da177e4
LT		 236 inode->i_security = isec;
237
238 return 0;
239}
240
241static void inode_free_security(struct inode *inode)
242{
243 struct inode_security_struct *isec = inode->i_security;
244 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
245
1da177e4
LT		 246 spin_lock(&sbsec->isec_lock);
247 if (!list_empty(&isec->list))
248 list_del_init(&isec->list);
249 spin_unlock(&sbsec->isec_lock);
250
251 inode->i_security = NULL;
7cae7e26 252 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT		 253}
254
255static int file_alloc_security(struct file *file)
256{
1da177e4 257 struct file_security_struct *fsec;
275bb41e 258 u32 sid = current_sid();
1da177e4 259
26d2a4be 260 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT		 261 if (!fsec)
262 return -ENOMEM;
263
275bb41e
DH		 264 fsec->sid = sid;
265 fsec->fown_sid = sid;
1da177e4
LT		 266 file->f_security = fsec;
267
268 return 0;
269}
270
271static void file_free_security(struct file *file)
272{
273 struct file_security_struct *fsec = file->f_security;
1da177e4
LT		 274 file->f_security = NULL;
275 kfree(fsec);
276}
277
278static int superblock_alloc_security(struct super_block *sb)
279{
280 struct superblock_security_struct *sbsec;
281
89d155ef 282 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT		 283 if (!sbsec)
284 return -ENOMEM;
285
bc7e982b 286 mutex_init(&sbsec->lock);
1da177e4
LT		 287 INIT_LIST_HEAD(&sbsec->isec_head);
288 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT		 289 sbsec->sb = sb;
290 sbsec->sid = SECINITSID_UNLABELED;
291 sbsec->def_sid = SECINITSID_FILE;
c312feb2 292 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT		 293 sb->s_security = sbsec;
294
295 return 0;
296}
297
298static void superblock_free_security(struct super_block *sb)
299{
300 struct superblock_security_struct *sbsec = sb->s_security;
1da177e4
LT		 301 sb->s_security = NULL;
302 kfree(sbsec);
303}
304
1da177e4
LT		 305/* The file system's label must be initialized prior to use. */
306
eb9ae686 307static const char *labeling_behaviors[7] = {
1da177e4
LT		 308 "uses xattr",
309 "uses transition SIDs",
310 "uses task SIDs",
311 "uses genfs_contexts",
312 "not configured for labeling",
313 "uses mountpoint labeling",
eb9ae686 314 "uses native labeling",
1da177e4
LT		 315};
316
317static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
318
319static inline int inode_doinit(struct inode *inode)
320{
321 return inode_doinit_with_dentry(inode, NULL);
322}
323
324enum {
31e87930 325 Opt_error = -1,
1da177e4
LT		 326 Opt_context = 1,
327 Opt_fscontext = 2,
c9180a57
EP		 328 Opt_defcontext = 3,
329 Opt_rootcontext = 4,
11689d47 330 Opt_labelsupport = 5,
d355987f 331 Opt_nextmntopt = 6,
1da177e4
LT		 332};
333
d355987f
EP		 334#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
335
a447c093 336static const match_table_t tokens = {
832cbd9a
EP		 337 {Opt_context, CONTEXT_STR "%s"},
338 {Opt_fscontext, FSCONTEXT_STR "%s"},
339 {Opt_defcontext, DEFCONTEXT_STR "%s"},
340 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
11689d47 341 {Opt_labelsupport, LABELSUPP_STR},
31e87930 342 {Opt_error, NULL},
1da177e4
LT		 343};
344
345#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
346
c312feb2
EP		 347static int may_context_mount_sb_relabel(u32 sid,
348 struct superblock_security_struct *sbsec,
275bb41e 349 const struct cred *cred)
c312feb2 350{
275bb41e 351 const struct task_security_struct *tsec = cred->security;
c312feb2
EP		 352 int rc;
353
354 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
355 FILESYSTEM__RELABELFROM, NULL);
356 if (rc)
357 return rc;
358
359 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
360 FILESYSTEM__RELABELTO, NULL);
361 return rc;
362}
363
0808925e
EP		 364static int may_context_mount_inode_relabel(u32 sid,
365 struct superblock_security_struct *sbsec,
275bb41e 366 const struct cred *cred)
0808925e 367{
275bb41e 368 const struct task_security_struct *tsec = cred->security;
0808925e
EP		 369 int rc;
370 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
371 FILESYSTEM__RELABELFROM, NULL);
372 if (rc)
373 return rc;
374
375 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
376 FILESYSTEM__ASSOCIATE, NULL);
377 return rc;
378}
379
b43e725d
EP		 380static int selinux_is_sblabel_mnt(struct super_block *sb)
381{
382 struct superblock_security_struct *sbsec = sb->s_security;
383
384 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
385 sbsec->behavior == SECURITY_FS_USE_TRANS ||
386 sbsec->behavior == SECURITY_FS_USE_TASK)
387 return 1;
388
389 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
390 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
391 return 1;
392
393 /*
394 * Special handling for rootfs. Is genfs but supports
395 * setting SELinux context on in-core inodes.
396 */
397 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
398 return 1;
399
400 return 0;
401}
402
c9180a57 403static int sb_finish_set_opts(struct super_block *sb)
1da177e4 404{
1da177e4 405 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57
EP		 406 struct dentry *root = sb->s_root;
407 struct inode *root_inode = root->d_inode;
408 int rc = 0;
1da177e4 409
c9180a57
EP		 410 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
411 /* Make sure that the xattr handler exists and that no
412 error other than -ENODATA is returned by getxattr on
413 the root directory. -ENODATA is ok, as this may be
414 the first boot of the SELinux kernel before we have
415 assigned xattr values to the filesystem. */
416 if (!root_inode->i_op->getxattr) {
102aefdd
AA		 417 printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
418 "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
c9180a57
EP		 419 rc = -EOPNOTSUPP;
420 goto out;
421 }
422 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
423 if (rc < 0 && rc != -ENODATA) {
424 if (rc == -EOPNOTSUPP)
425 printk(KERN_WARNING "SELinux: (dev %s, type "
102aefdd
AA		 426 SB_TYPE_FMT") has no security xattr handler\n",
427 sb->s_id, SB_TYPE_ARGS(sb));
c9180a57
EP		 428 else
429 printk(KERN_WARNING "SELinux: (dev %s, type "
102aefdd
AA		 430 SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
431 SB_TYPE_ARGS(sb), -rc);
c9180a57
EP		 432 goto out;
433 }
434 }
1da177e4 435
c9180a57 436 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
102aefdd
AA		 437 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
438 sb->s_id, SB_TYPE_ARGS(sb));
c9180a57 439 else
102aefdd
AA		 440 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
441 sb->s_id, SB_TYPE_ARGS(sb),
c9180a57 442 labeling_behaviors[sbsec->behavior-1]);
1da177e4 443
eadcabc6 444 sbsec->flags |= SE_SBINITIALIZED;
b43e725d 445 if (selinux_is_sblabel_mnt(sb))
12f348b9 446 sbsec->flags |= SBLABEL_MNT;
ddd29ec6 447
c9180a57
EP		 448 /* Initialize the root inode. */
449 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 450
c9180a57
EP		 451 /* Initialize any other inodes associated with the superblock, e.g.
452 inodes created prior to initial policy load or inodes created
453 during get_sb by a pseudo filesystem that directly
454 populates itself. */
455 spin_lock(&sbsec->isec_lock);
456next_inode:
457 if (!list_empty(&sbsec->isec_head)) {
458 struct inode_security_struct *isec =
459 list_entry(sbsec->isec_head.next,
460 struct inode_security_struct, list);
461 struct inode *inode = isec->inode;
462 spin_unlock(&sbsec->isec_lock);
463 inode = igrab(inode);
464 if (inode) {
465 if (!IS_PRIVATE(inode))
466 inode_doinit(inode);
467 iput(inode);
468 }
469 spin_lock(&sbsec->isec_lock);
470 list_del_init(&isec->list);
471 goto next_inode;
472 }
473 spin_unlock(&sbsec->isec_lock);
474out:
475 return rc;
476}
1da177e4 477
c9180a57
EP		 478/*
479 * This function should allow an FS to ask what it's mount security
480 * options were so it can use those later for submounts, displaying
481 * mount options, or whatever.
482 */
483static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 484 struct security_mnt_opts *opts)
c9180a57
EP		 485{
486 int rc = 0, i;
487 struct superblock_security_struct *sbsec = sb->s_security;
488 char *context = NULL;
489 u32 len;
490 char tmp;
1da177e4 491
e0007529 492 security_init_mnt_opts(opts);
1da177e4 493
0d90a7ec 494 if (!(sbsec->flags & SE_SBINITIALIZED))
c9180a57 495 return -EINVAL;
1da177e4 496
c9180a57
EP		 497 if (!ss_initialized)
498 return -EINVAL;
1da177e4 499
af8e50cc
EP		 500 /* make sure we always check enough bits to cover the mask */
501 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
502
0d90a7ec 503 tmp = sbsec->flags & SE_MNTMASK;
c9180a57 504 /* count the number of mount options for this sb */
af8e50cc 505 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
c9180a57 506 if (tmp & 0x01)
e0007529 507 opts->num_mnt_opts++;
c9180a57
EP		 508 tmp >>= 1;
509 }
11689d47 510 /* Check if the Label support flag is set */
0b4bdb35 511 if (sbsec->flags & SBLABEL_MNT)
11689d47 512 opts->num_mnt_opts++;
1da177e4 513
e0007529
EP		 514 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
515 if (!opts->mnt_opts) {
c9180a57
EP		 516 rc = -ENOMEM;
517 goto out_free;
518 }
1da177e4 519
e0007529
EP		 520 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
521 if (!opts->mnt_opts_flags) {
c9180a57
EP		 522 rc = -ENOMEM;
523 goto out_free;
524 }
1da177e4 525
c9180a57
EP		 526 i = 0;
527 if (sbsec->flags & FSCONTEXT_MNT) {
528 rc = security_sid_to_context(sbsec->sid, &context, &len);
529 if (rc)
530 goto out_free;
e0007529
EP		 531 opts->mnt_opts[i] = context;
532 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP		 533 }
534 if (sbsec->flags & CONTEXT_MNT) {
535 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
536 if (rc)
537 goto out_free;
e0007529
EP		 538 opts->mnt_opts[i] = context;
539 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP		 540 }
541 if (sbsec->flags & DEFCONTEXT_MNT) {
542 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
543 if (rc)
544 goto out_free;
e0007529
EP		 545 opts->mnt_opts[i] = context;
546 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP		 547 }
548 if (sbsec->flags & ROOTCONTEXT_MNT) {
549 struct inode *root = sbsec->sb->s_root->d_inode;
550 struct inode_security_struct *isec = root->i_security;
0808925e 551
c9180a57
EP		 552 rc = security_sid_to_context(isec->sid, &context, &len);
553 if (rc)
554 goto out_free;
e0007529
EP		 555 opts->mnt_opts[i] = context;
556 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 557 }
12f348b9 558 if (sbsec->flags & SBLABEL_MNT) {
11689d47 559 opts->mnt_opts[i] = NULL;
12f348b9 560 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
11689d47 561 }
1da177e4 562
e0007529 563 BUG_ON(i != opts->num_mnt_opts);
1da177e4 564
c9180a57
EP		 565 return 0;
566
567out_free:
e0007529 568 security_free_mnt_opts(opts);
c9180a57
EP		 569 return rc;
570}
1da177e4 571
c9180a57
EP		 572static int bad_option(struct superblock_security_struct *sbsec, char flag,
573 u32 old_sid, u32 new_sid)
574{
0d90a7ec
DQ		 575 char mnt_flags = sbsec->flags & SE_MNTMASK;
576
c9180a57 577 /* check if the old mount command had the same options */
0d90a7ec 578 if (sbsec->flags & SE_SBINITIALIZED)
c9180a57
EP		 579 if (!(sbsec->flags & flag) ||
580 (old_sid != new_sid))
581 return 1;
582
583 /* check if we were passed the same options twice,
584 * aka someone passed context=a,context=b
585 */
0d90a7ec
DQ		 586 if (!(sbsec->flags & SE_SBINITIALIZED))
587 if (mnt_flags & flag)
c9180a57
EP		 588 return 1;
589 return 0;
590}
e0007529 591
c9180a57
EP		 592/*
593 * Allow filesystems with binary mount data to explicitly set mount point
594 * labeling information.
595 */
e0007529 596static int selinux_set_mnt_opts(struct super_block *sb,
649f6e77
DQ		 597 struct security_mnt_opts *opts,
598 unsigned long kern_flags,
599 unsigned long *set_kern_flags)
c9180a57 600{
275bb41e 601 const struct cred *cred = current_cred();
c9180a57 602 int rc = 0, i;
c9180a57 603 struct superblock_security_struct *sbsec = sb->s_security;
089be43e
JM		 604 struct inode *inode = sbsec->sb->s_root->d_inode;
605 struct inode_security_struct *root_isec = inode->i_security;
c9180a57
EP		 606 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
607 u32 defcontext_sid = 0;
e0007529
EP		 608 char **mount_options = opts->mnt_opts;
609 int *flags = opts->mnt_opts_flags;
610 int num_opts = opts->num_mnt_opts;
c9180a57
EP		 611
612 mutex_lock(&sbsec->lock);
613
614 if (!ss_initialized) {
615 if (!num_opts) {
616 /* Defer initialization until selinux_complete_init,
617 after the initial policy is loaded and the security
618 server is ready to handle calls. */
c9180a57
EP		 619 goto out;
620 }
621 rc = -EINVAL;
744ba35e
EP		 622 printk(KERN_WARNING "SELinux: Unable to set superblock options "
623 "before the security server is initialized\n");
1da177e4 624 goto out;
c9180a57 625 }
649f6e77
DQ		 626 if (kern_flags && !set_kern_flags) {
627 /* Specifying internal flags without providing a place to
628 * place the results is not allowed */
629 rc = -EINVAL;
630 goto out;
631 }
1da177e4 632
e0007529
EP		 633 /*
634 * Binary mount data FS will come through this function twice. Once
635 * from an explicit call and once from the generic calls from the vfs.
636 * Since the generic VFS calls will not contain any security mount data
637 * we need to skip the double mount verification.
638 *
639 * This does open a hole in which we will not notice if the first
640 * mount using this sb set explict options and a second mount using
641 * this sb does not set any security options. (The first options
642 * will be used for both mounts)
643 */
0d90a7ec 644 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
e0007529 645 && (num_opts == 0))
f5269710 646 goto out;
e0007529 647
c9180a57
EP		 648 /*
649 * parse the mount options, check if they are valid sids.
650 * also check if someone is trying to mount the same sb more
651 * than once with different security options.
652 */
653 for (i = 0; i < num_opts; i++) {
654 u32 sid;
11689d47 655
12f348b9 656 if (flags[i] == SBLABEL_MNT)
11689d47 657 continue;
c9180a57
EP		 658 rc = security_context_to_sid(mount_options[i],
659 strlen(mount_options[i]), &sid);
1da177e4
LT		 660 if (rc) {
661 printk(KERN_WARNING "SELinux: security_context_to_sid"
102aefdd
AA		 662 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
663 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
c9180a57
EP		 664 goto out;
665 }
666 switch (flags[i]) {
667 case FSCONTEXT_MNT:
668 fscontext_sid = sid;
669
670 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
671 fscontext_sid))
672 goto out_double_mount;
673
674 sbsec->flags |= FSCONTEXT_MNT;
675 break;
676 case CONTEXT_MNT:
677 context_sid = sid;
678
679 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
680 context_sid))
681 goto out_double_mount;
682
683 sbsec->flags |= CONTEXT_MNT;
684 break;
685 case ROOTCONTEXT_MNT:
686 rootcontext_sid = sid;
687
688 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
689 rootcontext_sid))
690 goto out_double_mount;
691
692 sbsec->flags |= ROOTCONTEXT_MNT;
693
694 break;
695 case DEFCONTEXT_MNT:
696 defcontext_sid = sid;
697
698 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
699 defcontext_sid))
700 goto out_double_mount;
701
702 sbsec->flags |= DEFCONTEXT_MNT;
703
704 break;
705 default:
706 rc = -EINVAL;
707 goto out;
1da177e4 708 }
c9180a57
EP		 709 }
710
0d90a7ec 711 if (sbsec->flags & SE_SBINITIALIZED) {
c9180a57 712 /* previously mounted with options, but not on this attempt? */
0d90a7ec 713 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
c9180a57
EP		 714 goto out_double_mount;
715 rc = 0;
716 goto out;
717 }
718
089be43e 719 if (strcmp(sb->s_type->name, "proc") == 0)
0d90a7ec 720 sbsec->flags |= SE_SBPROC;
c9180a57 721
eb9ae686
DQ		 722 if (!sbsec->behavior) {
723 /*
724 * Determine the labeling behavior to use for this
725 * filesystem type.
726 */
98f700f3 727 rc = security_fs_use(sb);
eb9ae686
DQ		 728 if (rc) {
729 printk(KERN_WARNING
730 "%s: security_fs_use(%s) returned %d\n",
731 __func__, sb->s_type->name, rc);
732 goto out;
733 }
c9180a57 734 }
c9180a57
EP		 735 /* sets the context of the superblock for the fs being mounted. */
736 if (fscontext_sid) {
275bb41e 737 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
1da177e4 738 if (rc)
c9180a57 739 goto out;
1da177e4 740
c9180a57 741 sbsec->sid = fscontext_sid;
c312feb2
EP		 742 }
743
744 /*
745 * Switch to using mount point labeling behavior.
746 * sets the label used on all file below the mountpoint, and will set
747 * the superblock context if not already set.
748 */
eb9ae686
DQ		 749 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
750 sbsec->behavior = SECURITY_FS_USE_NATIVE;
751 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
752 }
753
c9180a57
EP		 754 if (context_sid) {
755 if (!fscontext_sid) {
275bb41e
DH		 756 rc = may_context_mount_sb_relabel(context_sid, sbsec,
757 cred);
b04ea3ce 758 if (rc)
c9180a57
EP		 759 goto out;
760 sbsec->sid = context_sid;
b04ea3ce 761 } else {
275bb41e
DH		 762 rc = may_context_mount_inode_relabel(context_sid, sbsec,
763 cred);
b04ea3ce 764 if (rc)
c9180a57 765 goto out;
b04ea3ce 766 }
c9180a57
EP		 767 if (!rootcontext_sid)
768 rootcontext_sid = context_sid;
1da177e4 769
c9180a57 770 sbsec->mntpoint_sid = context_sid;
c312feb2 771 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT		 772 }
773
c9180a57 774 if (rootcontext_sid) {
275bb41e
DH		 775 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
776 cred);
0808925e 777 if (rc)
c9180a57 778 goto out;
0808925e 779
c9180a57
EP		 780 root_isec->sid = rootcontext_sid;
781 root_isec->initialized = 1;
0808925e
EP		 782 }
783
c9180a57 784 if (defcontext_sid) {
eb9ae686
DQ		 785 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
786 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
c9180a57
EP		 787 rc = -EINVAL;
788 printk(KERN_WARNING "SELinux: defcontext option is "
789 "invalid for this filesystem type\n");
790 goto out;
1da177e4
LT		 791 }
792
c9180a57
EP		 793 if (defcontext_sid != sbsec->def_sid) {
794 rc = may_context_mount_inode_relabel(defcontext_sid,
275bb41e 795 sbsec, cred);
c9180a57
EP		 796 if (rc)
797 goto out;
798 }
1da177e4 799
c9180a57 800 sbsec->def_sid = defcontext_sid;
1da177e4
LT		 801 }
802
c9180a57 803 rc = sb_finish_set_opts(sb);
1da177e4 804out:
c9180a57 805 mutex_unlock(&sbsec->lock);
1da177e4 806 return rc;
c9180a57
EP		 807out_double_mount:
808 rc = -EINVAL;
809 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
102aefdd
AA		 810 "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
811 SB_TYPE_ARGS(sb));
c9180a57 812 goto out;
1da177e4
LT		 813}
814
094f7b69
JL		 815static int selinux_cmp_sb_context(const struct super_block *oldsb,
816 const struct super_block *newsb)
817{
818 struct superblock_security_struct *old = oldsb->s_security;
819 struct superblock_security_struct *new = newsb->s_security;
820 char oldflags = old->flags & SE_MNTMASK;
821 char newflags = new->flags & SE_MNTMASK;
822
823 if (oldflags != newflags)
824 goto mismatch;
825 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
826 goto mismatch;
827 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
828 goto mismatch;
829 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
830 goto mismatch;
831 if (oldflags & ROOTCONTEXT_MNT) {
832 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
833 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
834 if (oldroot->sid != newroot->sid)
835 goto mismatch;
836 }
837 return 0;
838mismatch:
839 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
840 "different security settings for (dev %s, "
841 "type %s)\n", newsb->s_id, newsb->s_type->name);
842 return -EBUSY;
843}
844
845static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
c9180a57 846 struct super_block *newsb)
1da177e4 847{
c9180a57
EP		 848 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
849 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 850
c9180a57
EP		 851 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
852 int set_context = (oldsbsec->flags & CONTEXT_MNT);
853 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 854
0f5e6420
EP		 855 /*
856 * if the parent was able to be mounted it clearly had no special lsm
e8c26255 857 * mount options. thus we can safely deal with this superblock later
0f5e6420 858 */
e8c26255 859 if (!ss_initialized)
094f7b69 860 return 0;
c9180a57 861
c9180a57 862 /* how can we clone if the old one wasn't set up?? */
0d90a7ec 863 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
c9180a57 864
094f7b69 865 /* if fs is reusing a sb, make sure that the contexts match */
0d90a7ec 866 if (newsbsec->flags & SE_SBINITIALIZED)
094f7b69 867 return selinux_cmp_sb_context(oldsb, newsb);
5a552617 868
c9180a57
EP		 869 mutex_lock(&newsbsec->lock);
870
871 newsbsec->flags = oldsbsec->flags;
872
873 newsbsec->sid = oldsbsec->sid;
874 newsbsec->def_sid = oldsbsec->def_sid;
875 newsbsec->behavior = oldsbsec->behavior;
876
877 if (set_context) {
878 u32 sid = oldsbsec->mntpoint_sid;
879
880 if (!set_fscontext)
881 newsbsec->sid = sid;
882 if (!set_rootcontext) {
883 struct inode *newinode = newsb->s_root->d_inode;
884 struct inode_security_struct *newisec = newinode->i_security;
885 newisec->sid = sid;
886 }
887 newsbsec->mntpoint_sid = sid;
1da177e4 888 }
c9180a57
EP		 889 if (set_rootcontext) {
890 const struct inode *oldinode = oldsb->s_root->d_inode;
891 const struct inode_security_struct *oldisec = oldinode->i_security;
892 struct inode *newinode = newsb->s_root->d_inode;
893 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 894
c9180a57 895 newisec->sid = oldisec->sid;
1da177e4
LT		 896 }
897
c9180a57
EP		 898 sb_finish_set_opts(newsb);
899 mutex_unlock(&newsbsec->lock);
094f7b69 900 return 0;
c9180a57
EP		 901}
902
2e1479d9
AB		 903static int selinux_parse_opts_str(char *options,
904 struct security_mnt_opts *opts)
c9180a57 905{
e0007529 906 char *p;
c9180a57
EP		 907 char *context = NULL, *defcontext = NULL;
908 char *fscontext = NULL, *rootcontext = NULL;
e0007529 909 int rc, num_mnt_opts = 0;
1da177e4 910
e0007529 911 opts->num_mnt_opts = 0;
1da177e4 912
c9180a57
EP		 913 /* Standard string-based options. */
914 while ((p = strsep(&options, "|")) != NULL) {
915 int token;
916 substring_t args[MAX_OPT_ARGS];
1da177e4 917
c9180a57
EP		 918 if (!*p)
919 continue;
1da177e4 920
c9180a57 921 token = match_token(p, tokens, args);
1da177e4 922
c9180a57
EP		 923 switch (token) {
924 case Opt_context:
925 if (context || defcontext) {
926 rc = -EINVAL;
927 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
928 goto out_err;
929 }
930 context = match_strdup(&args[0]);
931 if (!context) {
932 rc = -ENOMEM;
933 goto out_err;
934 }
935 break;
936
937 case Opt_fscontext:
938 if (fscontext) {
939 rc = -EINVAL;
940 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
941 goto out_err;
942 }
943 fscontext = match_strdup(&args[0]);
944 if (!fscontext) {
945 rc = -ENOMEM;
946 goto out_err;
947 }
948 break;
949
950 case Opt_rootcontext:
951 if (rootcontext) {
952 rc = -EINVAL;
953 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
954 goto out_err;
955 }
956 rootcontext = match_strdup(&args[0]);
957 if (!rootcontext) {
958 rc = -ENOMEM;
959 goto out_err;
960 }
961 break;
962
963 case Opt_defcontext:
964 if (context || defcontext) {
965 rc = -EINVAL;
966 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
967 goto out_err;
968 }
969 defcontext = match_strdup(&args[0]);
970 if (!defcontext) {
971 rc = -ENOMEM;
972 goto out_err;
973 }
974 break;
11689d47
DQ		 975 case Opt_labelsupport:
976 break;
c9180a57
EP		 977 default:
978 rc = -EINVAL;
979 printk(KERN_WARNING "SELinux: unknown mount option\n");
980 goto out_err;
1da177e4 981
1da177e4 982 }
1da177e4 983 }
c9180a57 984
e0007529
EP		 985 rc = -ENOMEM;
986 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
987 if (!opts->mnt_opts)
988 goto out_err;
989
990 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
991 if (!opts->mnt_opts_flags) {
992 kfree(opts->mnt_opts);
993 goto out_err;
994 }
995
c9180a57 996 if (fscontext) {
e0007529
EP		 997 opts->mnt_opts[num_mnt_opts] = fscontext;
998 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP		 999 }
1000 if (context) {
e0007529
EP		 1001 opts->mnt_opts[num_mnt_opts] = context;
1002 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP		 1003 }
1004 if (rootcontext) {
e0007529
EP		 1005 opts->mnt_opts[num_mnt_opts] = rootcontext;
1006 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP		 1007 }
1008 if (defcontext) {
e0007529
EP		 1009 opts->mnt_opts[num_mnt_opts] = defcontext;
1010 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP		 1011 }
1012
e0007529
EP		 1013 opts->num_mnt_opts = num_mnt_opts;
1014 return 0;
1015
c9180a57
EP		 1016out_err:
1017 kfree(context);
1018 kfree(defcontext);
1019 kfree(fscontext);
1020 kfree(rootcontext);
1da177e4
LT		 1021 return rc;
1022}
e0007529
EP		 1023/*
1024 * string mount options parsing and call set the sbsec
1025 */
1026static int superblock_doinit(struct super_block *sb, void *data)
1027{
1028 int rc = 0;
1029 char *options = data;
1030 struct security_mnt_opts opts;
1031
1032 security_init_mnt_opts(&opts);
1033
1034 if (!data)
1035 goto out;
1036
1037 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1038
1039 rc = selinux_parse_opts_str(options, &opts);
1040 if (rc)
1041 goto out_err;
1042
1043out:
649f6e77 1044 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
e0007529
EP		 1045
1046out_err:
1047 security_free_mnt_opts(&opts);
1048 return rc;
1049}
1da177e4 1050
3583a711
AB		 1051static void selinux_write_opts(struct seq_file *m,
1052 struct security_mnt_opts *opts)
2069f457
EP		 1053{
1054 int i;
1055 char *prefix;
1056
1057 for (i = 0; i < opts->num_mnt_opts; i++) {
11689d47
DQ		 1058 char *has_comma;
1059
1060 if (opts->mnt_opts[i])
1061 has_comma = strchr(opts->mnt_opts[i], ',');
1062 else
1063 has_comma = NULL;
2069f457
EP		 1064
1065 switch (opts->mnt_opts_flags[i]) {
1066 case CONTEXT_MNT:
1067 prefix = CONTEXT_STR;
1068 break;
1069 case FSCONTEXT_MNT:
1070 prefix = FSCONTEXT_STR;
1071 break;
1072 case ROOTCONTEXT_MNT:
1073 prefix = ROOTCONTEXT_STR;
1074 break;
1075 case DEFCONTEXT_MNT:
1076 prefix = DEFCONTEXT_STR;
1077 break;
12f348b9 1078 case SBLABEL_MNT:
11689d47
DQ		 1079 seq_putc(m, ',');
1080 seq_puts(m, LABELSUPP_STR);
1081 continue;
2069f457
EP		 1082 default:
1083 BUG();
a35c6c83 1084 return;
2069f457
EP		 1085 };
1086 /* we need a comma before each option */
1087 seq_putc(m, ',');
1088 seq_puts(m, prefix);
1089 if (has_comma)
1090 seq_putc(m, '\"');
1091 seq_puts(m, opts->mnt_opts[i]);
1092 if (has_comma)
1093 seq_putc(m, '\"');
1094 }
1095}
1096
1097static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1098{
1099 struct security_mnt_opts opts;
1100 int rc;
1101
1102 rc = selinux_get_mnt_opts(sb, &opts);
383795c2
EP		 1103 if (rc) {
1104 /* before policy load we may get EINVAL, don't show anything */
1105 if (rc == -EINVAL)
1106 rc = 0;
2069f457 1107 return rc;
383795c2 1108 }
2069f457
EP		 1109
1110 selinux_write_opts(m, &opts);
1111
1112 security_free_mnt_opts(&opts);
1113
1114 return rc;
1115}
1116
1da177e4
LT		 1117static inline u16 inode_mode_to_security_class(umode_t mode)
1118{
1119 switch (mode & S_IFMT) {
1120 case S_IFSOCK:
1121 return SECCLASS_SOCK_FILE;
1122 case S_IFLNK:
1123 return SECCLASS_LNK_FILE;
1124 case S_IFREG:
1125 return SECCLASS_FILE;
1126 case S_IFBLK:
1127 return SECCLASS_BLK_FILE;
1128 case S_IFDIR:
1129 return SECCLASS_DIR;
1130 case S_IFCHR:
1131 return SECCLASS_CHR_FILE;
1132 case S_IFIFO:
1133 return SECCLASS_FIFO_FILE;
1134
1135 }
1136
1137 return SECCLASS_FILE;
1138}
1139
13402580
JM		 1140static inline int default_protocol_stream(int protocol)
1141{
1142 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1143}
1144
1145static inline int default_protocol_dgram(int protocol)
1146{
1147 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1148}
1149
1da177e4
LT		 1150static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1151{
1152 switch (family) {
1153 case PF_UNIX:
1154 switch (type) {
1155 case SOCK_STREAM:
1156 case SOCK_SEQPACKET:
1157 return SECCLASS_UNIX_STREAM_SOCKET;
1158 case SOCK_DGRAM:
1159 return SECCLASS_UNIX_DGRAM_SOCKET;
1160 }
1161 break;
1162 case PF_INET:
1163 case PF_INET6:
1164 switch (type) {
1165 case SOCK_STREAM:
13402580
JM		 1166 if (default_protocol_stream(protocol))
1167 return SECCLASS_TCP_SOCKET;
1168 else
1169 return SECCLASS_RAWIP_SOCKET;
1da177e4 1170 case SOCK_DGRAM:
13402580
JM		 1171 if (default_protocol_dgram(protocol))
1172 return SECCLASS_UDP_SOCKET;
1173 else
1174 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM		 1175 case SOCK_DCCP:
1176 return SECCLASS_DCCP_SOCKET;
13402580 1177 default:
1da177e4
LT		 1178 return SECCLASS_RAWIP_SOCKET;
1179 }
1180 break;
1181 case PF_NETLINK:
1182 switch (protocol) {
1183 case NETLINK_ROUTE:
1184 return SECCLASS_NETLINK_ROUTE_SOCKET;
1185 case NETLINK_FIREWALL:
1186 return SECCLASS_NETLINK_FIREWALL_SOCKET;
7f1fb60c 1187 case NETLINK_SOCK_DIAG:
1da177e4
LT		 1188 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1189 case NETLINK_NFLOG:
1190 return SECCLASS_NETLINK_NFLOG_SOCKET;
1191 case NETLINK_XFRM:
1192 return SECCLASS_NETLINK_XFRM_SOCKET;
1193 case NETLINK_SELINUX:
1194 return SECCLASS_NETLINK_SELINUX_SOCKET;
1195 case NETLINK_AUDIT:
1196 return SECCLASS_NETLINK_AUDIT_SOCKET;
1197 case NETLINK_IP6_FW:
1198 return SECCLASS_NETLINK_IP6FW_SOCKET;
1199 case NETLINK_DNRTMSG:
1200 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 1201 case NETLINK_KOBJECT_UEVENT:
1202 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 1203 default:
1204 return SECCLASS_NETLINK_SOCKET;
1205 }
1206 case PF_PACKET:
1207 return SECCLASS_PACKET_SOCKET;
1208 case PF_KEY:
1209 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP		 1210 case PF_APPLETALK:
1211 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT		 1212 }
1213
1214 return SECCLASS_SOCKET;
1215}
1216
1217#ifdef CONFIG_PROC_FS
8e6c9693 1218static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT		 1219 u16 tclass,
1220 u32 *sid)
1221{
8e6c9693
LAG		 1222 int rc;
1223 char *buffer, *path;
1da177e4 1224
828dfe1d 1225 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT		 1226 if (!buffer)
1227 return -ENOMEM;
1228
8e6c9693
LAG		 1229 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1230 if (IS_ERR(path))
1231 rc = PTR_ERR(path);
1232 else {
1233 /* each process gets a /proc/PID/ entry. Strip off the
1234 * PID part to get a valid selinux labeling.
1235 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1236 while (path[1] >= '0' && path[1] <= '9') {
1237 path[1] = '/';
1238 path++;
1239 }
1240 rc = security_genfs_sid("proc", path, tclass, sid);
1da177e4 1241 }
1da177e4
LT		 1242 free_page((unsigned long)buffer);
1243 return rc;
1244}
1245#else
8e6c9693 1246static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT		 1247 u16 tclass,
1248 u32 *sid)
1249{
1250 return -EINVAL;
1251}
1252#endif
1253
1254/* The inode's security attributes must be initialized before first use. */
1255static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1256{
1257 struct superblock_security_struct *sbsec = NULL;
1258 struct inode_security_struct *isec = inode->i_security;
1259 u32 sid;
1260 struct dentry *dentry;
1261#define INITCONTEXTLEN 255
1262 char *context = NULL;
1263 unsigned len = 0;
1264 int rc = 0;
1da177e4
LT		 1265
1266 if (isec->initialized)
1267 goto out;
1268
23970741 1269 mutex_lock(&isec->lock);
1da177e4 1270 if (isec->initialized)
23970741 1271 goto out_unlock;
1da177e4
LT		 1272
1273 sbsec = inode->i_sb->s_security;
0d90a7ec 1274 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1da177e4
LT		 1275 /* Defer initialization until selinux_complete_init,
1276 after the initial policy is loaded and the security
1277 server is ready to handle calls. */
1278 spin_lock(&sbsec->isec_lock);
1279 if (list_empty(&isec->list))
1280 list_add(&isec->list, &sbsec->isec_head);
1281 spin_unlock(&sbsec->isec_lock);
23970741 1282 goto out_unlock;
1da177e4
LT		 1283 }
1284
1285 switch (sbsec->behavior) {
eb9ae686
DQ		 1286 case SECURITY_FS_USE_NATIVE:
1287 break;
1da177e4
LT		 1288 case SECURITY_FS_USE_XATTR:
1289 if (!inode->i_op->getxattr) {
1290 isec->sid = sbsec->def_sid;
1291 break;
1292 }
1293
1294 /* Need a dentry, since the xattr API requires one.
1295 Life would be simpler if we could just pass the inode. */
1296 if (opt_dentry) {
1297 /* Called from d_instantiate or d_splice_alias. */
1298 dentry = dget(opt_dentry);
1299 } else {
1300 /* Called from selinux_complete_init, try to find a dentry. */
1301 dentry = d_find_alias(inode);
1302 }
1303 if (!dentry) {
df7f54c0
EP		 1304 /*
1305 * this is can be hit on boot when a file is accessed
1306 * before the policy is loaded. When we load policy we
1307 * may find inodes that have no dentry on the
1308 * sbsec->isec_head list. No reason to complain as these
1309 * will get fixed up the next time we go through
1310 * inode_doinit with a dentry, before these inodes could
1311 * be used again by userspace.
1312 */
23970741 1313 goto out_unlock;
1da177e4
LT		 1314 }
1315
1316 len = INITCONTEXTLEN;
4cb912f1 1317 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT		 1318 if (!context) {
1319 rc = -ENOMEM;
1320 dput(dentry);
23970741 1321 goto out_unlock;
1da177e4 1322 }
4cb912f1 1323 context[len] = '\0';
1da177e4
LT		 1324 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1325 context, len);
1326 if (rc == -ERANGE) {
314dabb8
JM		 1327 kfree(context);
1328
1da177e4
LT		 1329 /* Need a larger buffer. Query for the right size. */
1330 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1331 NULL, 0);
1332 if (rc < 0) {
1333 dput(dentry);
23970741 1334 goto out_unlock;
1da177e4 1335 }
1da177e4 1336 len = rc;
4cb912f1 1337 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT		 1338 if (!context) {
1339 rc = -ENOMEM;
1340 dput(dentry);
23970741 1341 goto out_unlock;
1da177e4 1342 }
4cb912f1 1343 context[len] = '\0';
1da177e4
LT		 1344 rc = inode->i_op->getxattr(dentry,
1345 XATTR_NAME_SELINUX,
1346 context, len);
1347 }
1348 dput(dentry);
1349 if (rc < 0) {
1350 if (rc != -ENODATA) {
744ba35e 1351 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1352 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT		 1353 -rc, inode->i_sb->s_id, inode->i_ino);
1354 kfree(context);
23970741 1355 goto out_unlock;
1da177e4
LT		 1356 }
1357 /* Map ENODATA to the default file SID */
1358 sid = sbsec->def_sid;
1359 rc = 0;
1360 } else {
f5c1d5b2 1361 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS		 1362 sbsec->def_sid,
1363 GFP_NOFS);
1da177e4 1364 if (rc) {
4ba0a8ad
EP		 1365 char *dev = inode->i_sb->s_id;
1366 unsigned long ino = inode->i_ino;
1367
1368 if (rc == -EINVAL) {
1369 if (printk_ratelimit())
1370 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1371 "context=%s. This indicates you may need to relabel the inode or the "
1372 "filesystem in question.\n", ino, dev, context);
1373 } else {
1374 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1375 "returned %d for dev=%s ino=%ld\n",
1376 __func__, context, -rc, dev, ino);
1377 }
1da177e4
LT		 1378 kfree(context);
1379 /* Leave with the unlabeled SID */
1380 rc = 0;
1381 break;
1382 }
1383 }
1384 kfree(context);
1385 isec->sid = sid;
1386 break;
1387 case SECURITY_FS_USE_TASK:
1388 isec->sid = isec->task_sid;
1389 break;
1390 case SECURITY_FS_USE_TRANS:
1391 /* Default to the fs SID. */
1392 isec->sid = sbsec->sid;
1393
1394 /* Try to obtain a transition SID. */
1395 isec->sclass = inode_mode_to_security_class(inode->i_mode);
652bb9b0
EP		 1396 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1397 isec->sclass, NULL, &sid);
1da177e4 1398 if (rc)
23970741 1399 goto out_unlock;
1da177e4
LT		 1400 isec->sid = sid;
1401 break;
c312feb2
EP		 1402 case SECURITY_FS_USE_MNTPOINT:
1403 isec->sid = sbsec->mntpoint_sid;
1404 break;
1da177e4 1405 default:
c312feb2 1406 /* Default to the fs superblock SID. */
1da177e4
LT		 1407 isec->sid = sbsec->sid;
1408
0d90a7ec 1409 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
8e6c9693 1410 if (opt_dentry) {
1da177e4 1411 isec->sclass = inode_mode_to_security_class(inode->i_mode);
8e6c9693 1412 rc = selinux_proc_get_sid(opt_dentry,
1da177e4
LT		 1413 isec->sclass,
1414 &sid);
1415 if (rc)
23970741 1416 goto out_unlock;
1da177e4
LT		 1417 isec->sid = sid;
1418 }
1419 }
1420 break;
1421 }
1422
1423 isec->initialized = 1;
1424
23970741
EP		 1425out_unlock:
1426 mutex_unlock(&isec->lock);
1da177e4
LT		 1427out:
1428 if (isec->sclass == SECCLASS_FILE)
1429 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT		 1430 return rc;
1431}
1432
1433/* Convert a Linux signal to an access vector. */
1434static inline u32 signal_to_av(int sig)
1435{
1436 u32 perm = 0;
1437
1438 switch (sig) {
1439 case SIGCHLD:
1440 /* Commonly granted from child to parent. */
1441 perm = PROCESS__SIGCHLD;
1442 break;
1443 case SIGKILL:
1444 /* Cannot be caught or ignored */
1445 perm = PROCESS__SIGKILL;
1446 break;
1447 case SIGSTOP:
1448 /* Cannot be caught or ignored */
1449 perm = PROCESS__SIGSTOP;
1450 break;
1451 default:
1452 /* All other signals. */
1453 perm = PROCESS__SIGNAL;
1454 break;
1455 }
1456
1457 return perm;
1458}
1459
d84f4f99
DH		 1460/*
1461 * Check permission between a pair of credentials
1462 * fork check, ptrace check, etc.
1463 */
1464static int cred_has_perm(const struct cred *actor,
1465 const struct cred *target,
1466 u32 perms)
1467{
1468 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1469
1470 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1471}
1472
275bb41e 1473/*
88e67f3b 1474 * Check permission between a pair of tasks, e.g. signal checks,
275bb41e
DH		 1475 * fork check, ptrace check, etc.
1476 * tsk1 is the actor and tsk2 is the target
3b11a1de 1477 * - this uses the default subjective creds of tsk1
275bb41e
DH		 1478 */
1479static int task_has_perm(const struct task_struct *tsk1,
1480 const struct task_struct *tsk2,
1da177e4
LT		 1481 u32 perms)
1482{
275bb41e
DH		 1483 const struct task_security_struct *__tsec1, *__tsec2;
1484 u32 sid1, sid2;
1da177e4 1485
275bb41e
DH		 1486 rcu_read_lock();
1487 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1488 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1489 rcu_read_unlock();
1490 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1da177e4
LT		 1491}
1492
3b11a1de
DH		 1493/*
1494 * Check permission between current and another task, e.g. signal checks,
1495 * fork check, ptrace check, etc.
1496 * current is the actor and tsk2 is the target
1497 * - this uses current's subjective creds
1498 */
1499static int current_has_perm(const struct task_struct *tsk,
1500 u32 perms)
1501{
1502 u32 sid, tsid;
1503
1504 sid = current_sid();
1505 tsid = task_sid(tsk);
1506 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1507}
1508
b68e418c
SS		 1509#if CAP_LAST_CAP > 63
1510#error Fix SELinux to handle capabilities > 63.
1511#endif
1512
1da177e4 1513/* Check whether a task is allowed to use a capability. */
6a9de491 1514static int cred_has_capability(const struct cred *cred,
06112163 1515 int cap, int audit)
1da177e4 1516{
2bf49690 1517 struct common_audit_data ad;
06112163 1518 struct av_decision avd;
b68e418c 1519 u16 sclass;
3699c53c 1520 u32 sid = cred_sid(cred);
b68e418c 1521 u32 av = CAP_TO_MASK(cap);
06112163 1522 int rc;
1da177e4 1523
50c205f5 1524 ad.type = LSM_AUDIT_DATA_CAP;
1da177e4
LT		 1525 ad.u.cap = cap;
1526
b68e418c
SS		 1527 switch (CAP_TO_INDEX(cap)) {
1528 case 0:
1529 sclass = SECCLASS_CAPABILITY;
1530 break;
1531 case 1:
1532 sclass = SECCLASS_CAPABILITY2;
1533 break;
1534 default:
1535 printk(KERN_ERR
1536 "SELinux: out of range capability %d\n", cap);
1537 BUG();
a35c6c83 1538 return -EINVAL;
b68e418c 1539 }
06112163 1540
275bb41e 1541 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
9ade0cf4 1542 if (audit == SECURITY_CAP_AUDIT) {
ab354062 1543 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
9ade0cf4
EP		 1544 if (rc2)
1545 return rc2;
1546 }
06112163 1547 return rc;
1da177e4
LT		 1548}
1549
1550/* Check whether a task is allowed to use a system operation. */
1551static int task_has_system(struct task_struct *tsk,
1552 u32 perms)
1553{
275bb41e 1554 u32 sid = task_sid(tsk);
1da177e4 1555
275bb41e 1556 return avc_has_perm(sid, SECINITSID_KERNEL,
1da177e4
LT		 1557 SECCLASS_SYSTEM, perms, NULL);
1558}
1559
1560/* Check whether a task has a particular permission to an inode.
1561 The 'adp' parameter is optional and allows other audit
1562 data to be passed (e.g. the dentry). */
88e67f3b 1563static int inode_has_perm(const struct cred *cred,
1da177e4
LT		 1564 struct inode *inode,
1565 u32 perms,
19e49834 1566 struct common_audit_data *adp)
1da177e4 1567{
1da177e4 1568 struct inode_security_struct *isec;
275bb41e 1569 u32 sid;
1da177e4 1570
e0e81739
DH		 1571 validate_creds(cred);
1572
828dfe1d 1573 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS		 1574 return 0;
1575
88e67f3b 1576 sid = cred_sid(cred);
1da177e4
LT		 1577 isec = inode->i_security;
1578
19e49834 1579 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1da177e4
LT		 1580}
1581
1582/* Same as inode_has_perm, but pass explicit audit data containing
1583 the dentry to help the auditing code to more easily generate the
1584 pathname if needed. */
88e67f3b 1585static inline int dentry_has_perm(const struct cred *cred,
1da177e4
LT		 1586 struct dentry *dentry,
1587 u32 av)
1588{
1589 struct inode *inode = dentry->d_inode;
2bf49690 1590 struct common_audit_data ad;
88e67f3b 1591
50c205f5 1592 ad.type = LSM_AUDIT_DATA_DENTRY;
2875fa00 1593 ad.u.dentry = dentry;
19e49834 1594 return inode_has_perm(cred, inode, av, &ad);
2875fa00
EP		 1595}
1596
1597/* Same as inode_has_perm, but pass explicit audit data containing
1598 the path to help the auditing code to more easily generate the
1599 pathname if needed. */
1600static inline int path_has_perm(const struct cred *cred,
1601 struct path *path,
1602 u32 av)
1603{
1604 struct inode *inode = path->dentry->d_inode;
1605 struct common_audit_data ad;
1606
50c205f5 1607 ad.type = LSM_AUDIT_DATA_PATH;
2875fa00 1608 ad.u.path = *path;
19e49834 1609 return inode_has_perm(cred, inode, av, &ad);
1da177e4
LT		 1610}
1611
13f8e981
DH		 1612/* Same as path_has_perm, but uses the inode from the file struct. */
1613static inline int file_path_has_perm(const struct cred *cred,
1614 struct file *file,
1615 u32 av)
1616{
1617 struct common_audit_data ad;
1618
1619 ad.type = LSM_AUDIT_DATA_PATH;
1620 ad.u.path = file->f_path;
19e49834 1621 return inode_has_perm(cred, file_inode(file), av, &ad);
13f8e981
DH		 1622}
1623
1da177e4
LT		 1624/* Check whether a task can use an open file descriptor to
1625 access an inode in a given way. Check access to the
1626 descriptor itself, and then use dentry_has_perm to
1627 check a particular permission to the file.
1628 Access to the descriptor is implicitly granted if it
1629 has the same SID as the process. If av is zero, then
1630 access to the file is not checked, e.g. for cases
1631 where only the descriptor is affected like seek. */
88e67f3b
DH		 1632static int file_has_perm(const struct cred *cred,
1633 struct file *file,
1634 u32 av)
1da177e4 1635{
1da177e4 1636 struct file_security_struct *fsec = file->f_security;
496ad9aa 1637 struct inode *inode = file_inode(file);
2bf49690 1638 struct common_audit_data ad;
88e67f3b 1639 u32 sid = cred_sid(cred);
1da177e4
LT		 1640 int rc;
1641
50c205f5 1642 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 1643 ad.u.path = file->f_path;
1da177e4 1644
275bb41e
DH		 1645 if (sid != fsec->sid) {
1646 rc = avc_has_perm(sid, fsec->sid,
1da177e4
LT		 1647 SECCLASS_FD,
1648 FD__USE,
1649 &ad);
1650 if (rc)
88e67f3b 1651 goto out;
1da177e4
LT		 1652 }
1653
1654 /* av is zero if only checking access to the descriptor. */
88e67f3b 1655 rc = 0;
1da177e4 1656 if (av)
19e49834 1657 rc = inode_has_perm(cred, inode, av, &ad);
1da177e4 1658
88e67f3b
DH		 1659out:
1660 return rc;
1da177e4
LT		 1661}
1662
1663/* Check whether a task can create a file. */
1664static int may_create(struct inode *dir,
1665 struct dentry *dentry,
1666 u16 tclass)
1667{
5fb49870 1668 const struct task_security_struct *tsec = current_security();
1da177e4
LT		 1669 struct inode_security_struct *dsec;
1670 struct superblock_security_struct *sbsec;
275bb41e 1671 u32 sid, newsid;
2bf49690 1672 struct common_audit_data ad;
1da177e4
LT		 1673 int rc;
1674
1da177e4
LT		 1675 dsec = dir->i_security;
1676 sbsec = dir->i_sb->s_security;
1677
275bb41e
DH		 1678 sid = tsec->sid;
1679 newsid = tsec->create_sid;
1680
50c205f5 1681 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1682 ad.u.dentry = dentry;
1da177e4 1683
275bb41e 1684 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1da177e4
LT		 1685 DIR__ADD_NAME | DIR__SEARCH,
1686 &ad);
1687 if (rc)
1688 return rc;
1689
12f348b9 1690 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
cb1e922f
EP		 1691 rc = security_transition_sid(sid, dsec->sid, tclass,
1692 &dentry->d_name, &newsid);
1da177e4
LT		 1693 if (rc)
1694 return rc;
1695 }
1696
275bb41e 1697 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1da177e4
LT		 1698 if (rc)
1699 return rc;
1700
1701 return avc_has_perm(newsid, sbsec->sid,
1702 SECCLASS_FILESYSTEM,
1703 FILESYSTEM__ASSOCIATE, &ad);
1704}
1705
4eb582cf
ML		 1706/* Check whether a task can create a key. */
1707static int may_create_key(u32 ksid,
1708 struct task_struct *ctx)
1709{
275bb41e 1710 u32 sid = task_sid(ctx);
4eb582cf 1711
275bb41e 1712 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
4eb582cf
ML		 1713}
1714
828dfe1d
EP		 1715#define MAY_LINK 0
1716#define MAY_UNLINK 1
1717#define MAY_RMDIR 2
1da177e4
LT		 1718
1719/* Check whether a task can link, unlink, or rmdir a file/directory. */
1720static int may_link(struct inode *dir,
1721 struct dentry *dentry,
1722 int kind)
1723
1724{
1da177e4 1725 struct inode_security_struct *dsec, *isec;
2bf49690 1726 struct common_audit_data ad;
275bb41e 1727 u32 sid = current_sid();
1da177e4
LT		 1728 u32 av;
1729 int rc;
1730
1da177e4
LT		 1731 dsec = dir->i_security;
1732 isec = dentry->d_inode->i_security;
1733
50c205f5 1734 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1735 ad.u.dentry = dentry;
1da177e4
LT		 1736
1737 av = DIR__SEARCH;
1738 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
275bb41e 1739 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT		 1740 if (rc)
1741 return rc;
1742
1743 switch (kind) {
1744 case MAY_LINK:
1745 av = FILE__LINK;
1746 break;
1747 case MAY_UNLINK:
1748 av = FILE__UNLINK;
1749 break;
1750 case MAY_RMDIR:
1751 av = DIR__RMDIR;
1752 break;
1753 default:
744ba35e
EP		 1754 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1755 __func__, kind);
1da177e4
LT		 1756 return 0;
1757 }
1758
275bb41e 1759 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1da177e4
LT		 1760 return rc;
1761}
1762
1763static inline int may_rename(struct inode *old_dir,
1764 struct dentry *old_dentry,
1765 struct inode *new_dir,
1766 struct dentry *new_dentry)
1767{
1da177e4 1768 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2bf49690 1769 struct common_audit_data ad;
275bb41e 1770 u32 sid = current_sid();
1da177e4
LT		 1771 u32 av;
1772 int old_is_dir, new_is_dir;
1773 int rc;
1774
1da177e4
LT		 1775 old_dsec = old_dir->i_security;
1776 old_isec = old_dentry->d_inode->i_security;
1777 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1778 new_dsec = new_dir->i_security;
1779
50c205f5 1780 ad.type = LSM_AUDIT_DATA_DENTRY;
1da177e4 1781
a269434d 1782 ad.u.dentry = old_dentry;
275bb41e 1783 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1da177e4
LT		 1784 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1785 if (rc)
1786 return rc;
275bb41e 1787 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT		 1788 old_isec->sclass, FILE__RENAME, &ad);
1789 if (rc)
1790 return rc;
1791 if (old_is_dir && new_dir != old_dir) {
275bb41e 1792 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT		 1793 old_isec->sclass, DIR__REPARENT, &ad);
1794 if (rc)
1795 return rc;
1796 }
1797
a269434d 1798 ad.u.dentry = new_dentry;
1da177e4
LT		 1799 av = DIR__ADD_NAME | DIR__SEARCH;
1800 if (new_dentry->d_inode)
1801 av |= DIR__REMOVE_NAME;
275bb41e 1802 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT		 1803 if (rc)
1804 return rc;
1805 if (new_dentry->d_inode) {
1806 new_isec = new_dentry->d_inode->i_security;
1807 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
275bb41e 1808 rc = avc_has_perm(sid, new_isec->sid,
1da177e4
LT		 1809 new_isec->sclass,
1810 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1811 if (rc)
1812 return rc;
1813 }
1814
1815 return 0;
1816}
1817
1818/* Check whether a task can perform a filesystem operation. */
88e67f3b 1819static int superblock_has_perm(const struct cred *cred,
1da177e4
LT		 1820 struct super_block *sb,
1821 u32 perms,
2bf49690 1822 struct common_audit_data *ad)
1da177e4 1823{
1da177e4 1824 struct superblock_security_struct *sbsec;
88e67f3b 1825 u32 sid = cred_sid(cred);
1da177e4 1826
1da177e4 1827 sbsec = sb->s_security;
275bb41e 1828 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1da177e4
LT		 1829}
1830
1831/* Convert a Linux mode and permission mask to an access vector. */
1832static inline u32 file_mask_to_av(int mode, int mask)
1833{
1834 u32 av = 0;
1835
dba19c60 1836 if (!S_ISDIR(mode)) {
1da177e4
LT		 1837 if (mask & MAY_EXEC)
1838 av |= FILE__EXECUTE;
1839 if (mask & MAY_READ)
1840 av |= FILE__READ;
1841
1842 if (mask & MAY_APPEND)
1843 av |= FILE__APPEND;
1844 else if (mask & MAY_WRITE)
1845 av |= FILE__WRITE;
1846
1847 } else {
1848 if (mask & MAY_EXEC)
1849 av |= DIR__SEARCH;
1850 if (mask & MAY_WRITE)
1851 av |= DIR__WRITE;
1852 if (mask & MAY_READ)
1853 av |= DIR__READ;
1854 }
1855
1856 return av;
1857}
1858
8b6a5a37
EP		 1859/* Convert a Linux file to an access vector. */
1860static inline u32 file_to_av(struct file *file)
1861{
1862 u32 av = 0;
1863
1864 if (file->f_mode & FMODE_READ)
1865 av |= FILE__READ;
1866 if (file->f_mode & FMODE_WRITE) {
1867 if (file->f_flags & O_APPEND)
1868 av |= FILE__APPEND;
1869 else
1870 av |= FILE__WRITE;
1871 }
1872 if (!av) {
1873 /*
1874 * Special file opened with flags 3 for ioctl-only use.
1875 */
1876 av = FILE__IOCTL;
1877 }
1878
1879 return av;
1880}
1881
b0c636b9 1882/*
8b6a5a37 1883 * Convert a file to an access vector and include the correct open
b0c636b9
EP		 1884 * open permission.
1885 */
8b6a5a37 1886static inline u32 open_file_to_av(struct file *file)
b0c636b9 1887{
8b6a5a37 1888 u32 av = file_to_av(file);
b0c636b9 1889
49b7b8de
EP		 1890 if (selinux_policycap_openperm)
1891 av |= FILE__OPEN;
1892
b0c636b9
EP		 1893 return av;
1894}
1895
1da177e4
LT		 1896/* Hook functions begin here. */
1897
9e48858f 1898static int selinux_ptrace_access_check(struct task_struct *child,
5cd9c58f 1899 unsigned int mode)
1da177e4 1900{
1da177e4
LT		 1901 int rc;
1902
9e48858f 1903 rc = cap_ptrace_access_check(child, mode);
1da177e4
LT		 1904 if (rc)
1905 return rc;
1906
69f594a3 1907 if (mode & PTRACE_MODE_READ) {
275bb41e
DH		 1908 u32 sid = current_sid();
1909 u32 csid = task_sid(child);
1910 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
006ebb40
SS		 1911 }
1912
3b11a1de 1913 return current_has_perm(child, PROCESS__PTRACE);
5cd9c58f
DH		 1914}
1915
1916static int selinux_ptrace_traceme(struct task_struct *parent)
1917{
1918 int rc;
1919
200ac532 1920 rc = cap_ptrace_traceme(parent);
5cd9c58f
DH		 1921 if (rc)
1922 return rc;
1923
1924 return task_has_perm(parent, current, PROCESS__PTRACE);
1da177e4
LT		 1925}
1926
1927static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1928 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT		 1929{
1930 int error;
1931
3b11a1de 1932 error = current_has_perm(target, PROCESS__GETCAP);
1da177e4
LT		 1933 if (error)
1934 return error;
1935
200ac532 1936 return cap_capget(target, effective, inheritable, permitted);
1da177e4
LT		 1937}
1938
d84f4f99
DH		 1939static int selinux_capset(struct cred *new, const struct cred *old,
1940 const kernel_cap_t *effective,
1941 const kernel_cap_t *inheritable,
1942 const kernel_cap_t *permitted)
1da177e4
LT		 1943{
1944 int error;
1945
200ac532 1946 error = cap_capset(new, old,
d84f4f99 1947 effective, inheritable, permitted);
1da177e4
LT		 1948 if (error)
1949 return error;
1950
d84f4f99 1951 return cred_has_perm(old, new, PROCESS__SETCAP);
1da177e4
LT		 1952}
1953
5626d3e8
JM		 1954/*
1955 * (This comment used to live with the selinux_task_setuid hook,
1956 * which was removed).
1957 *
1958 * Since setuid only affects the current process, and since the SELinux
1959 * controls are not based on the Linux identity attributes, SELinux does not
1960 * need to control this operation. However, SELinux does control the use of
1961 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1962 */
1963
6a9de491
EP		 1964static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1965 int cap, int audit)
1da177e4
LT		 1966{
1967 int rc;
1968
6a9de491 1969 rc = cap_capable(cred, ns, cap, audit);
1da177e4
LT		 1970 if (rc)
1971 return rc;
1972
6a9de491 1973 return cred_has_capability(cred, cap, audit);
1da177e4
LT		 1974}
1975
1da177e4
LT		 1976static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1977{
88e67f3b 1978 const struct cred *cred = current_cred();
1da177e4
LT		 1979 int rc = 0;
1980
1981 if (!sb)
1982 return 0;
1983
1984 switch (cmds) {
828dfe1d
EP		 1985 case Q_SYNC:
1986 case Q_QUOTAON:
1987 case Q_QUOTAOFF:
1988 case Q_SETINFO:
1989 case Q_SETQUOTA:
88e67f3b 1990 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
828dfe1d
EP		 1991 break;
1992 case Q_GETFMT:
1993 case Q_GETINFO:
1994 case Q_GETQUOTA:
88e67f3b 1995 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
828dfe1d
EP		 1996 break;
1997 default:
1998 rc = 0; /* let the kernel handle invalid cmds */
1999 break;
1da177e4
LT		 2000 }
2001 return rc;
2002}
2003
2004static int selinux_quota_on(struct dentry *dentry)
2005{
88e67f3b
DH		 2006 const struct cred *cred = current_cred();
2007
2875fa00 2008 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1da177e4
LT		 2009}
2010
12b3052c 2011static int selinux_syslog(int type)
1da177e4
LT		 2012{
2013 int rc;
2014
1da177e4 2015 switch (type) {
d78ca3cd
KC		 2016 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2017 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
828dfe1d
EP		 2018 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2019 break;
d78ca3cd
KC		 2020 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2021 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2022 /* Set level of messages printed to console */
2023 case SYSLOG_ACTION_CONSOLE_LEVEL:
828dfe1d
EP		 2024 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2025 break;
d78ca3cd
KC		 2026 case SYSLOG_ACTION_CLOSE: /* Close log */
2027 case SYSLOG_ACTION_OPEN: /* Open log */
2028 case SYSLOG_ACTION_READ: /* Read from log */
2029 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2030 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
828dfe1d
EP		 2031 default:
2032 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2033 break;
1da177e4
LT		 2034 }
2035 return rc;
2036}
2037
2038/*
2039 * Check that a process has enough memory to allocate a new virtual
2040 * mapping. 0 means there is enough memory for the allocation to
2041 * succeed and -ENOMEM implies there is not.
2042 *
1da177e4
LT		 2043 * Do not audit the selinux permission check, as this is applied to all
2044 * processes that allocate mappings.
2045 */
34b4e4aa 2046static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT		 2047{
2048 int rc, cap_sys_admin = 0;
1da177e4 2049
6a9de491 2050 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
3699c53c 2051 SECURITY_CAP_NOAUDIT);
1da177e4
LT		 2052 if (rc == 0)
2053 cap_sys_admin = 1;
2054
34b4e4aa 2055 return __vm_enough_memory(mm, pages, cap_sys_admin);
1da177e4
LT		 2056}
2057
2058/* binprm security operations */
2059
a6f76f23 2060static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1da177e4 2061{
a6f76f23
DH		 2062 const struct task_security_struct *old_tsec;
2063 struct task_security_struct *new_tsec;
1da177e4 2064 struct inode_security_struct *isec;
2bf49690 2065 struct common_audit_data ad;
496ad9aa 2066 struct inode *inode = file_inode(bprm->file);
1da177e4
LT		 2067 int rc;
2068
200ac532 2069 rc = cap_bprm_set_creds(bprm);
1da177e4
LT		 2070 if (rc)
2071 return rc;
2072
a6f76f23
DH		 2073 /* SELinux context only depends on initial program or script and not
2074 * the script interpreter */
2075 if (bprm->cred_prepared)
1da177e4
LT		 2076 return 0;
2077
a6f76f23
DH		 2078 old_tsec = current_security();
2079 new_tsec = bprm->cred->security;
1da177e4
LT		 2080 isec = inode->i_security;
2081
2082 /* Default to the current task SID. */
a6f76f23
DH		 2083 new_tsec->sid = old_tsec->sid;
2084 new_tsec->osid = old_tsec->sid;
1da177e4 2085
28eba5bf 2086 /* Reset fs, key, and sock SIDs on execve. */
a6f76f23
DH		 2087 new_tsec->create_sid = 0;
2088 new_tsec->keycreate_sid = 0;
2089 new_tsec->sockcreate_sid = 0;
1da177e4 2090
a6f76f23
DH		 2091 if (old_tsec->exec_sid) {
2092 new_tsec->sid = old_tsec->exec_sid;
1da177e4 2093 /* Reset exec SID on execve. */
a6f76f23 2094 new_tsec->exec_sid = 0;
259e5e6c
AL		 2095
2096 /*
2097 * Minimize confusion: if no_new_privs and a transition is
2098 * explicitly requested, then fail the exec.
2099 */
2100 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2101 return -EPERM;
1da177e4
LT		 2102 } else {
2103 /* Check for a default transition on this program. */
a6f76f23 2104 rc = security_transition_sid(old_tsec->sid, isec->sid,
652bb9b0
EP		 2105 SECCLASS_PROCESS, NULL,
2106 &new_tsec->sid);
1da177e4
LT		 2107 if (rc)
2108 return rc;
2109 }
2110
50c205f5 2111 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 2112 ad.u.path = bprm->file->f_path;
1da177e4 2113
259e5e6c
AL		 2114 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2115 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
a6f76f23 2116 new_tsec->sid = old_tsec->sid;
1da177e4 2117
a6f76f23
DH		 2118 if (new_tsec->sid == old_tsec->sid) {
2119 rc = avc_has_perm(old_tsec->sid, isec->sid,
1da177e4
LT		 2120 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2121 if (rc)
2122 return rc;
2123 } else {
2124 /* Check permissions for the transition. */
a6f76f23 2125 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
1da177e4
LT		 2126 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2127 if (rc)
2128 return rc;
2129
a6f76f23 2130 rc = avc_has_perm(new_tsec->sid, isec->sid,
1da177e4
LT		 2131 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2132 if (rc)
2133 return rc;
2134
a6f76f23
DH		 2135 /* Check for shared state */
2136 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2137 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2138 SECCLASS_PROCESS, PROCESS__SHARE,
2139 NULL);
2140 if (rc)
2141 return -EPERM;
2142 }
2143
2144 /* Make sure that anyone attempting to ptrace over a task that
2145 * changes its SID has the appropriate permit */
2146 if (bprm->unsafe &
2147 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2148 struct task_struct *tracer;
2149 struct task_security_struct *sec;
2150 u32 ptsid = 0;
2151
2152 rcu_read_lock();
06d98473 2153 tracer = ptrace_parent(current);
a6f76f23
DH		 2154 if (likely(tracer != NULL)) {
2155 sec = __task_cred(tracer)->security;
2156 ptsid = sec->sid;
2157 }
2158 rcu_read_unlock();
2159
2160 if (ptsid != 0) {
2161 rc = avc_has_perm(ptsid, new_tsec->sid,
2162 SECCLASS_PROCESS,
2163 PROCESS__PTRACE, NULL);
2164 if (rc)
2165 return -EPERM;
2166 }
2167 }
1da177e4 2168
a6f76f23
DH		 2169 /* Clear any possibly unsafe personality bits on exec: */
2170 bprm->per_clear |= PER_CLEAR_ON_SETID;
1da177e4
LT		 2171 }
2172
1da177e4
LT		 2173 return 0;
2174}
2175
828dfe1d 2176static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4 2177{
5fb49870 2178 const struct task_security_struct *tsec = current_security();
275bb41e 2179 u32 sid, osid;
1da177e4
LT		 2180 int atsecure = 0;
2181
275bb41e
DH		 2182 sid = tsec->sid;
2183 osid = tsec->osid;
2184
2185 if (osid != sid) {
1da177e4
LT		 2186 /* Enable secure mode for SIDs transitions unless
2187 the noatsecure permission is granted between
2188 the two SIDs, i.e. ahp returns 0. */
275bb41e 2189 atsecure = avc_has_perm(osid, sid,
a6f76f23
DH		 2190 SECCLASS_PROCESS,
2191 PROCESS__NOATSECURE, NULL);
1da177e4
LT		 2192 }
2193
200ac532 2194 return (atsecure || cap_bprm_secureexec(bprm));
1da177e4
LT		 2195}
2196
c3c073f8
AV		 2197static int match_file(const void *p, struct file *file, unsigned fd)
2198{
2199 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2200}
2201
1da177e4 2202/* Derived from fs/exec.c:flush_old_files. */
745ca247
DH		 2203static inline void flush_unauthorized_files(const struct cred *cred,
2204 struct files_struct *files)
1da177e4 2205{
1da177e4 2206 struct file *file, *devnull = NULL;
b20c8122 2207 struct tty_struct *tty;
24ec839c 2208 int drop_tty = 0;
c3c073f8 2209 unsigned n;
1da177e4 2210
24ec839c 2211 tty = get_current_tty();
1da177e4 2212 if (tty) {
ee2ffa0d 2213 spin_lock(&tty_files_lock);
37dd0bd0 2214 if (!list_empty(&tty->tty_files)) {
d996b62a 2215 struct tty_file_private *file_priv;
37dd0bd0 2216
1da177e4 2217 /* Revalidate access to controlling tty.
13f8e981
DH		 2218 Use file_path_has_perm on the tty path directly
2219 rather than using file_has_perm, as this particular
2220 open file may belong to another process and we are
2221 only interested in the inode-based check here. */
d996b62a
NP		 2222 file_priv = list_first_entry(&tty->tty_files,
2223 struct tty_file_private, list);
2224 file = file_priv->file;
13f8e981 2225 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
24ec839c 2226 drop_tty = 1;
1da177e4 2227 }
ee2ffa0d 2228 spin_unlock(&tty_files_lock);
452a00d2 2229 tty_kref_put(tty);
1da177e4 2230 }
98a27ba4
EB		 2231 /* Reset controlling tty. */
2232 if (drop_tty)
2233 no_tty();
1da177e4
LT		 2234
2235 /* Revalidate access to inherited open files. */
c3c073f8
AV		 2236 n = iterate_fd(files, 0, match_file, cred);
2237 if (!n) /* none found? */
2238 return;
1da177e4 2239
c3c073f8 2240 devnull = dentry_open(&selinux_null, O_RDWR, cred);
45525b26
AV		 2241 if (IS_ERR(devnull))
2242 devnull = NULL;
2243 /* replace all the matching ones with this */
2244 do {
2245 replace_fd(n - 1, devnull, 0);
2246 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2247 if (devnull)
c3c073f8 2248 fput(devnull);
1da177e4
LT		 2249}
2250
a6f76f23
DH		 2251/*
2252 * Prepare a process for imminent new credential changes due to exec
2253 */
2254static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
1da177e4 2255{
a6f76f23
DH		 2256 struct task_security_struct *new_tsec;
2257 struct rlimit *rlim, *initrlim;
2258 int rc, i;
d84f4f99 2259
a6f76f23
DH		 2260 new_tsec = bprm->cred->security;
2261 if (new_tsec->sid == new_tsec->osid)
2262 return;
1da177e4 2263
a6f76f23
DH		 2264 /* Close files for which the new task SID is not authorized. */
2265 flush_unauthorized_files(bprm->cred, current->files);
0356357c 2266
a6f76f23
DH		 2267 /* Always clear parent death signal on SID transitions. */
2268 current->pdeath_signal = 0;
0356357c 2269
a6f76f23
DH		 2270 /* Check whether the new SID can inherit resource limits from the old
2271 * SID. If not, reset all soft limits to the lower of the current
2272 * task's hard limit and the init task's soft limit.
2273 *
2274 * Note that the setting of hard limits (even to lower them) can be
2275 * controlled by the setrlimit check. The inclusion of the init task's
2276 * soft limit into the computation is to avoid resetting soft limits
2277 * higher than the default soft limit for cases where the default is
2278 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2279 */
2280 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2281 PROCESS__RLIMITINH, NULL);
2282 if (rc) {
eb2d55a3
ON		 2283 /* protect against do_prlimit() */
2284 task_lock(current);
a6f76f23
DH		 2285 for (i = 0; i < RLIM_NLIMITS; i++) {
2286 rlim = current->signal->rlim + i;
2287 initrlim = init_task.signal->rlim + i;
2288 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4 2289 }
eb2d55a3
ON		 2290 task_unlock(current);
2291 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
1da177e4
LT		 2292 }
2293}
2294
2295/*
a6f76f23
DH		 2296 * Clean up the process immediately after the installation of new credentials
2297 * due to exec
1da177e4 2298 */
a6f76f23 2299static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
1da177e4 2300{
a6f76f23 2301 const struct task_security_struct *tsec = current_security();
1da177e4 2302 struct itimerval itimer;
a6f76f23 2303 u32 osid, sid;
1da177e4
LT		 2304 int rc, i;
2305
a6f76f23
DH		 2306 osid = tsec->osid;
2307 sid = tsec->sid;
2308
2309 if (sid == osid)
1da177e4
LT		 2310 return;
2311
a6f76f23
DH		 2312 /* Check whether the new SID can inherit signal state from the old SID.
2313 * If not, clear itimers to avoid subsequent signal generation and
2314 * flush and unblock signals.
2315 *
2316 * This must occur _after_ the task SID has been updated so that any
2317 * kill done after the flush will be checked against the new SID.
2318 */
2319 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
1da177e4
LT		 2320 if (rc) {
2321 memset(&itimer, 0, sizeof itimer);
2322 for (i = 0; i < 3; i++)
2323 do_setitimer(i, &itimer, NULL);
1da177e4 2324 spin_lock_irq(&current->sighand->siglock);
3bcac026
DH		 2325 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2326 __flush_signals(current);
2327 flush_signal_handlers(current, 1);
2328 sigemptyset(&current->blocked);
2329 }
1da177e4
LT		 2330 spin_unlock_irq(&current->sighand->siglock);
2331 }
2332
a6f76f23
DH		 2333 /* Wake up the parent if it is waiting so that it can recheck
2334 * wait permission to the new task SID. */
ecd6de3c 2335 read_lock(&tasklist_lock);
0b7570e7 2336 __wake_up_parent(current, current->real_parent);
ecd6de3c 2337 read_unlock(&tasklist_lock);
1da177e4
LT		 2338}
2339
2340/* superblock security operations */
2341
2342static int selinux_sb_alloc_security(struct super_block *sb)
2343{
2344 return superblock_alloc_security(sb);
2345}
2346
2347static void selinux_sb_free_security(struct super_block *sb)
2348{
2349 superblock_free_security(sb);
2350}
2351
2352static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2353{
2354 if (plen > olen)
2355 return 0;
2356
2357 return !memcmp(prefix, option, plen);
2358}
2359
2360static inline int selinux_option(char *option, int len)
2361{
832cbd9a
EP		 2362 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2363 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2364 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
11689d47
DQ		 2365 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2366 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
1da177e4
LT		 2367}
2368
2369static inline void take_option(char **to, char *from, int *first, int len)
2370{
2371 if (!*first) {
2372 **to = ',';
2373 *to += 1;
3528a953 2374 } else
1da177e4
LT		 2375 *first = 0;
2376 memcpy(*to, from, len);
2377 *to += len;
2378}
2379
828dfe1d
EP		 2380static inline void take_selinux_option(char **to, char *from, int *first,
2381 int len)
3528a953
CO		 2382{
2383 int current_size = 0;
2384
2385 if (!*first) {
2386 **to = '|';
2387 *to += 1;
828dfe1d 2388 } else
3528a953
CO		 2389 *first = 0;
2390
2391 while (current_size < len) {
2392 if (*from != '"') {
2393 **to = *from;
2394 *to += 1;
2395 }
2396 from += 1;
2397 current_size += 1;
2398 }
2399}
2400
e0007529 2401static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT		 2402{
2403 int fnosec, fsec, rc = 0;
2404 char *in_save, *in_curr, *in_end;
2405 char *sec_curr, *nosec_save, *nosec;
3528a953 2406 int open_quote = 0;
1da177e4
LT		 2407
2408 in_curr = orig;
2409 sec_curr = copy;
2410
1da177e4
LT		 2411 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2412 if (!nosec) {
2413 rc = -ENOMEM;
2414 goto out;
2415 }
2416
2417 nosec_save = nosec;
2418 fnosec = fsec = 1;
2419 in_save = in_end = orig;
2420
2421 do {
3528a953
CO		 2422 if (*in_end == '"')
2423 open_quote = !open_quote;
2424 if ((*in_end == ',' && open_quote == 0) ||
2425 *in_end == '\0') {
1da177e4
LT		 2426 int len = in_end - in_curr;
2427
2428 if (selinux_option(in_curr, len))
3528a953 2429 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT		 2430 else
2431 take_option(&nosec, in_curr, &fnosec, len);
2432
2433 in_curr = in_end + 1;
2434 }
2435 } while (*in_end++);
2436
6931dfc9 2437 strcpy(in_save, nosec_save);
da3caa20 2438 free_page((unsigned long)nosec_save);
1da177e4
LT		 2439out:
2440 return rc;
2441}
2442
026eb167
EP		 2443static int selinux_sb_remount(struct super_block *sb, void *data)
2444{
2445 int rc, i, *flags;
2446 struct security_mnt_opts opts;
2447 char *secdata, **mount_options;
2448 struct superblock_security_struct *sbsec = sb->s_security;
2449
2450 if (!(sbsec->flags & SE_SBINITIALIZED))
2451 return 0;
2452
2453 if (!data)
2454 return 0;
2455
2456 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2457 return 0;
2458
2459 security_init_mnt_opts(&opts);
2460 secdata = alloc_secdata();
2461 if (!secdata)
2462 return -ENOMEM;
2463 rc = selinux_sb_copy_data(data, secdata);
2464 if (rc)
2465 goto out_free_secdata;
2466
2467 rc = selinux_parse_opts_str(secdata, &opts);
2468 if (rc)
2469 goto out_free_secdata;
2470
2471 mount_options = opts.mnt_opts;
2472 flags = opts.mnt_opts_flags;
2473
2474 for (i = 0; i < opts.num_mnt_opts; i++) {
2475 u32 sid;
2476 size_t len;
2477
12f348b9 2478 if (flags[i] == SBLABEL_MNT)
026eb167
EP		 2479 continue;
2480 len = strlen(mount_options[i]);
2481 rc = security_context_to_sid(mount_options[i], len, &sid);
2482 if (rc) {
2483 printk(KERN_WARNING "SELinux: security_context_to_sid"
102aefdd
AA		 2484 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2485 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
026eb167
EP		 2486 goto out_free_opts;
2487 }
2488 rc = -EINVAL;
2489 switch (flags[i]) {
2490 case FSCONTEXT_MNT:
2491 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2492 goto out_bad_option;
2493 break;
2494 case CONTEXT_MNT:
2495 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2496 goto out_bad_option;
2497 break;
2498 case ROOTCONTEXT_MNT: {
2499 struct inode_security_struct *root_isec;
2500 root_isec = sb->s_root->d_inode->i_security;
2501
2502 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2503 goto out_bad_option;
2504 break;
2505 }
2506 case DEFCONTEXT_MNT:
2507 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2508 goto out_bad_option;
2509 break;
2510 default:
2511 goto out_free_opts;
2512 }
2513 }
2514
2515 rc = 0;
2516out_free_opts:
2517 security_free_mnt_opts(&opts);
2518out_free_secdata:
2519 free_secdata(secdata);
2520 return rc;
2521out_bad_option:
2522 printk(KERN_WARNING "SELinux: unable to change security options "
102aefdd
AA		 2523 "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2524 SB_TYPE_ARGS(sb));
026eb167
EP		 2525 goto out_free_opts;
2526}
2527
12204e24 2528static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
1da177e4 2529{
88e67f3b 2530 const struct cred *cred = current_cred();
2bf49690 2531 struct common_audit_data ad;
1da177e4
LT		 2532 int rc;
2533
2534 rc = superblock_doinit(sb, data);
2535 if (rc)
2536 return rc;
2537
74192246
JM		 2538 /* Allow all mounts performed by the kernel */
2539 if (flags & MS_KERNMOUNT)
2540 return 0;
2541
50c205f5 2542 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2543 ad.u.dentry = sb->s_root;
88e67f3b 2544 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
1da177e4
LT		 2545}
2546
726c3342 2547static int selinux_sb_statfs(struct dentry *dentry)
1da177e4 2548{
88e67f3b 2549 const struct cred *cred = current_cred();
2bf49690 2550 struct common_audit_data ad;
1da177e4 2551
50c205f5 2552 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2553 ad.u.dentry = dentry->d_sb->s_root;
88e67f3b 2554 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT		 2555}
2556
808d4e3c 2557static int selinux_mount(const char *dev_name,
b5266eb4 2558 struct path *path,
808d4e3c 2559 const char *type,
828dfe1d
EP		 2560 unsigned long flags,
2561 void *data)
1da177e4 2562{
88e67f3b 2563 const struct cred *cred = current_cred();
1da177e4
LT		 2564
2565 if (flags & MS_REMOUNT)
d8c9584e 2566 return superblock_has_perm(cred, path->dentry->d_sb,
828dfe1d 2567 FILESYSTEM__REMOUNT, NULL);
1da177e4 2568 else
2875fa00 2569 return path_has_perm(cred, path, FILE__MOUNTON);
1da177e4
LT		 2570}
2571
2572static int selinux_umount(struct vfsmount *mnt, int flags)
2573{
88e67f3b 2574 const struct cred *cred = current_cred();
1da177e4 2575
88e67f3b 2576 return superblock_has_perm(cred, mnt->mnt_sb,
828dfe1d 2577 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT		 2578}
2579
2580/* inode security operations */
2581
2582static int selinux_inode_alloc_security(struct inode *inode)
2583{
2584 return inode_alloc_security(inode);
2585}
2586
2587static void selinux_inode_free_security(struct inode *inode)
2588{
2589 inode_free_security(inode);
2590}
2591
d47be3df
DQ		 2592static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2593 struct qstr *name, void **ctx,
2594 u32 *ctxlen)
2595{
2596 const struct cred *cred = current_cred();
2597 struct task_security_struct *tsec;
2598 struct inode_security_struct *dsec;
2599 struct superblock_security_struct *sbsec;
2600 struct inode *dir = dentry->d_parent->d_inode;
2601 u32 newsid;
2602 int rc;
2603
2604 tsec = cred->security;
2605 dsec = dir->i_security;
2606 sbsec = dir->i_sb->s_security;
2607
2608 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2609 newsid = tsec->create_sid;
2610 } else {
2611 rc = security_transition_sid(tsec->sid, dsec->sid,
2612 inode_mode_to_security_class(mode),
2613 name,
2614 &newsid);
2615 if (rc) {
2616 printk(KERN_WARNING
2617 "%s: security_transition_sid failed, rc=%d\n",
2618 __func__, -rc);
2619 return rc;
2620 }
2621 }
2622
2623 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2624}
2625
5e41ff9e 2626static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
9548906b
TH		 2627 const struct qstr *qstr,
2628 const char **name,
2a7dba39 2629 void **value, size_t *len)
5e41ff9e 2630{
5fb49870 2631 const struct task_security_struct *tsec = current_security();
5e41ff9e
SS		 2632 struct inode_security_struct *dsec;
2633 struct superblock_security_struct *sbsec;
275bb41e 2634 u32 sid, newsid, clen;
5e41ff9e 2635 int rc;
9548906b 2636 char *context;
5e41ff9e 2637
5e41ff9e
SS		 2638 dsec = dir->i_security;
2639 sbsec = dir->i_sb->s_security;
5e41ff9e 2640
275bb41e
DH		 2641 sid = tsec->sid;
2642 newsid = tsec->create_sid;
2643
415103f9
EP		 2644 if ((sbsec->flags & SE_SBINITIALIZED) &&
2645 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2646 newsid = sbsec->mntpoint_sid;
12f348b9 2647 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
275bb41e 2648 rc = security_transition_sid(sid, dsec->sid,
5e41ff9e 2649 inode_mode_to_security_class(inode->i_mode),
652bb9b0 2650 qstr, &newsid);
5e41ff9e
SS		 2651 if (rc) {
2652 printk(KERN_WARNING "%s: "
2653 "security_transition_sid failed, rc=%d (dev=%s "
2654 "ino=%ld)\n",
dd6f953a 2655 __func__,
5e41ff9e
SS		 2656 -rc, inode->i_sb->s_id, inode->i_ino);
2657 return rc;
2658 }
2659 }
2660
296fddf7 2661 /* Possibly defer initialization to selinux_complete_init. */
0d90a7ec 2662 if (sbsec->flags & SE_SBINITIALIZED) {
296fddf7
EP		 2663 struct inode_security_struct *isec = inode->i_security;
2664 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2665 isec->sid = newsid;
2666 isec->initialized = 1;
2667 }
5e41ff9e 2668
12f348b9 2669 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
25a74f3b
SS		 2670 return -EOPNOTSUPP;
2671
9548906b
TH		 2672 if (name)
2673 *name = XATTR_SELINUX_SUFFIX;
5e41ff9e 2674
570bc1c2 2675 if (value && len) {
12b29f34 2676 rc = security_sid_to_context_force(newsid, &context, &clen);
9548906b 2677 if (rc)
570bc1c2 2678 return rc;
570bc1c2
SS		 2679 *value = context;
2680 *len = clen;
5e41ff9e 2681 }
5e41ff9e 2682
5e41ff9e
SS		 2683 return 0;
2684}
2685
4acdaf27 2686static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
1da177e4
LT		 2687{
2688 return may_create(dir, dentry, SECCLASS_FILE);
2689}
2690
1da177e4
LT		 2691static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2692{
1da177e4
LT		 2693 return may_link(dir, old_dentry, MAY_LINK);
2694}
2695
1da177e4
LT		 2696static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2697{
1da177e4
LT		 2698 return may_link(dir, dentry, MAY_UNLINK);
2699}
2700
2701static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2702{
2703 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2704}
2705
18bb1db3 2706static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
1da177e4
LT		 2707{
2708 return may_create(dir, dentry, SECCLASS_DIR);
2709}
2710
1da177e4
LT		 2711static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2712{
2713 return may_link(dir, dentry, MAY_RMDIR);
2714}
2715
1a67aafb 2716static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
1da177e4 2717{
1da177e4
LT		 2718 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2719}
2720
1da177e4 2721static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2722 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT		 2723{
2724 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2725}
2726
1da177e4
LT		 2727static int selinux_inode_readlink(struct dentry *dentry)
2728{
88e67f3b
DH		 2729 const struct cred *cred = current_cred();
2730
2875fa00 2731 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT		 2732}
2733
2734static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2735{
88e67f3b 2736 const struct cred *cred = current_cred();
1da177e4 2737
2875fa00 2738 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT		 2739}
2740
d4cf970d
EP		 2741static noinline int audit_inode_permission(struct inode *inode,
2742 u32 perms, u32 audited, u32 denied,
2743 unsigned flags)
1da177e4 2744{
b782e0a6 2745 struct common_audit_data ad;
d4cf970d
EP		 2746 struct inode_security_struct *isec = inode->i_security;
2747 int rc;
2748
50c205f5 2749 ad.type = LSM_AUDIT_DATA_INODE;
d4cf970d
EP		 2750 ad.u.inode = inode;
2751
2752 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2753 audited, denied, &ad, flags);
2754 if (rc)
2755 return rc;
2756 return 0;
2757}
2758
e74f71eb 2759static int selinux_inode_permission(struct inode *inode, int mask)
1da177e4 2760{
88e67f3b 2761 const struct cred *cred = current_cred();
b782e0a6
EP		 2762 u32 perms;
2763 bool from_access;
cf1dd1da 2764 unsigned flags = mask & MAY_NOT_BLOCK;
2e334057
EP		 2765 struct inode_security_struct *isec;
2766 u32 sid;
2767 struct av_decision avd;
2768 int rc, rc2;
2769 u32 audited, denied;
1da177e4 2770
b782e0a6 2771 from_access = mask & MAY_ACCESS;
d09ca739
EP		 2772 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2773
b782e0a6
EP		 2774 /* No permission to check. Existence test. */
2775 if (!mask)
1da177e4 2776 return 0;
1da177e4 2777
2e334057 2778 validate_creds(cred);
b782e0a6 2779
2e334057
EP		 2780 if (unlikely(IS_PRIVATE(inode)))
2781 return 0;
b782e0a6
EP		 2782
2783 perms = file_mask_to_av(inode->i_mode, mask);
2784
2e334057
EP		 2785 sid = cred_sid(cred);
2786 isec = inode->i_security;
2787
2788 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2789 audited = avc_audit_required(perms, &avd, rc,
2790 from_access ? FILE__AUDIT_ACCESS : 0,
2791 &denied);
2792 if (likely(!audited))
2793 return rc;
2794
d4cf970d 2795 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2e334057
EP		 2796 if (rc2)
2797 return rc2;
2798 return rc;
1da177e4
LT		 2799}
2800
2801static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2802{
88e67f3b 2803 const struct cred *cred = current_cred();
bc6a6008 2804 unsigned int ia_valid = iattr->ia_valid;
95dbf739 2805 __u32 av = FILE__WRITE;
1da177e4 2806
bc6a6008
AW		 2807 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2808 if (ia_valid & ATTR_FORCE) {
2809 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2810 ATTR_FORCE);
2811 if (!ia_valid)
2812 return 0;
2813 }
1da177e4 2814
bc6a6008
AW		 2815 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2816 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2875fa00 2817 return dentry_has_perm(cred, dentry, FILE__SETATTR);
1da177e4 2818
3d2195c3 2819 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
95dbf739
EP		 2820 av |= FILE__OPEN;
2821
2822 return dentry_has_perm(cred, dentry, av);
1da177e4
LT		 2823}
2824
2825static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2826{
88e67f3b 2827 const struct cred *cred = current_cred();
2875fa00
EP		 2828 struct path path;
2829
2830 path.dentry = dentry;
2831 path.mnt = mnt;
88e67f3b 2832
2875fa00 2833 return path_has_perm(cred, &path, FILE__GETATTR);
1da177e4
LT		 2834}
2835
8f0cfa52 2836static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771 2837{
88e67f3b
DH		 2838 const struct cred *cred = current_cred();
2839
b5376771
SH		 2840 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2841 sizeof XATTR_SECURITY_PREFIX - 1)) {
2842 if (!strcmp(name, XATTR_NAME_CAPS)) {
2843 if (!capable(CAP_SETFCAP))
2844 return -EPERM;
2845 } else if (!capable(CAP_SYS_ADMIN)) {
2846 /* A different attribute in the security namespace.
2847 Restrict to administrator. */
2848 return -EPERM;
2849 }
2850 }
2851
2852 /* Not an attribute we recognize, so just check the
2853 ordinary setattr permission. */
2875fa00 2854 return dentry_has_perm(cred, dentry, FILE__SETATTR);
b5376771
SH		 2855}
2856
8f0cfa52
DH		 2857static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2858 const void *value, size_t size, int flags)
1da177e4 2859{
1da177e4
LT		 2860 struct inode *inode = dentry->d_inode;
2861 struct inode_security_struct *isec = inode->i_security;
2862 struct superblock_security_struct *sbsec;
2bf49690 2863 struct common_audit_data ad;
275bb41e 2864 u32 newsid, sid = current_sid();
1da177e4
LT		 2865 int rc = 0;
2866
b5376771
SH		 2867 if (strcmp(name, XATTR_NAME_SELINUX))
2868 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT		 2869
2870 sbsec = inode->i_sb->s_security;
12f348b9 2871 if (!(sbsec->flags & SBLABEL_MNT))
1da177e4
LT		 2872 return -EOPNOTSUPP;
2873
2e149670 2874 if (!inode_owner_or_capable(inode))
1da177e4
LT		 2875 return -EPERM;
2876
50c205f5 2877 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2878 ad.u.dentry = dentry;
1da177e4 2879
275bb41e 2880 rc = avc_has_perm(sid, isec->sid, isec->sclass,
1da177e4
LT		 2881 FILE__RELABELFROM, &ad);
2882 if (rc)
2883 return rc;
2884
2885 rc = security_context_to_sid(value, size, &newsid);
12b29f34 2886 if (rc == -EINVAL) {
d6ea83ec
EP		 2887 if (!capable(CAP_MAC_ADMIN)) {
2888 struct audit_buffer *ab;
2889 size_t audit_size;
2890 const char *str;
2891
2892 /* We strip a nul only if it is at the end, otherwise the
2893 * context contains a nul and we should audit that */
e3fea3f7
AV		 2894 if (value) {
2895 str = value;
2896 if (str[size - 1] == '\0')
2897 audit_size = size - 1;
2898 else
2899 audit_size = size;
2900 } else {
2901 str = "";
2902 audit_size = 0;
2903 }
d6ea83ec
EP		 2904 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2905 audit_log_format(ab, "op=setxattr invalid_context=");
2906 audit_log_n_untrustedstring(ab, value, audit_size);
2907 audit_log_end(ab);
2908
12b29f34 2909 return rc;
d6ea83ec 2910 }
12b29f34
SS		 2911 rc = security_context_to_sid_force(value, size, &newsid);
2912 }
1da177e4
LT		 2913 if (rc)
2914 return rc;
2915
275bb41e 2916 rc = avc_has_perm(sid, newsid, isec->sclass,
1da177e4
LT		 2917 FILE__RELABELTO, &ad);
2918 if (rc)
2919 return rc;
2920
275bb41e 2921 rc = security_validate_transition(isec->sid, newsid, sid,
828dfe1d 2922 isec->sclass);
1da177e4
LT		 2923 if (rc)
2924 return rc;
2925
2926 return avc_has_perm(newsid,
2927 sbsec->sid,
2928 SECCLASS_FILESYSTEM,
2929 FILESYSTEM__ASSOCIATE,
2930 &ad);
2931}
2932
8f0cfa52 2933static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
f5269710 2934 const void *value, size_t size,
8f0cfa52 2935 int flags)
1da177e4
LT		 2936{
2937 struct inode *inode = dentry->d_inode;
2938 struct inode_security_struct *isec = inode->i_security;
2939 u32 newsid;
2940 int rc;
2941
2942 if (strcmp(name, XATTR_NAME_SELINUX)) {
2943 /* Not an attribute we recognize, so nothing to do. */
2944 return;
2945 }
2946
12b29f34 2947 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 2948 if (rc) {
12b29f34
SS		 2949 printk(KERN_ERR "SELinux: unable to map context to SID"
2950 "for (%s, %lu), rc=%d\n",
2951 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT		 2952 return;
2953 }
2954
aa9c2669 2955 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 2956 isec->sid = newsid;
aa9c2669
DQ		 2957 isec->initialized = 1;
2958
1da177e4
LT		 2959 return;
2960}
2961
8f0cfa52 2962static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 2963{
88e67f3b
DH		 2964 const struct cred *cred = current_cred();
2965
2875fa00 2966 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT		 2967}
2968
828dfe1d 2969static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4 2970{
88e67f3b
DH		 2971 const struct cred *cred = current_cred();
2972
2875fa00 2973 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT		 2974}
2975
8f0cfa52 2976static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 2977{
b5376771
SH		 2978 if (strcmp(name, XATTR_NAME_SELINUX))
2979 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT		 2980
2981 /* No one is allowed to remove a SELinux security label.
2982 You can change the label, but all data must be labeled. */
2983 return -EACCES;
2984}
2985
d381d8a9 2986/*
abc69bb6 2987 * Copy the inode security context value to the user.
d381d8a9
JM		 2988 *
2989 * Permission check is handled by selinux_inode_getxattr hook.
2990 */
42492594 2991static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 2992{
42492594
DQ		 2993 u32 size;
2994 int error;
2995 char *context = NULL;
1da177e4 2996 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2997
8c8570fb
DK		 2998 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2999 return -EOPNOTSUPP;
d381d8a9 3000
abc69bb6
SS		 3001 /*
3002 * If the caller has CAP_MAC_ADMIN, then get the raw context
3003 * value even if it is not defined by current policy; otherwise,
3004 * use the in-core value under current policy.
3005 * Use the non-auditing forms of the permission checks since
3006 * getxattr may be called by unprivileged processes commonly
3007 * and lack of permission just means that we fall back to the
3008 * in-core context value, not a denial.
3009 */
6a9de491 3010 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3699c53c 3011 SECURITY_CAP_NOAUDIT);
abc69bb6
SS		 3012 if (!error)
3013 error = security_sid_to_context_force(isec->sid, &context,
3014 &size);
3015 else
3016 error = security_sid_to_context(isec->sid, &context, &size);
42492594
DQ		 3017 if (error)
3018 return error;
3019 error = size;
3020 if (alloc) {
3021 *buffer = context;
3022 goto out_nofree;
3023 }
3024 kfree(context);
3025out_nofree:
3026 return error;
1da177e4
LT		 3027}
3028
3029static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 3030 const void *value, size_t size, int flags)
1da177e4
LT		 3031{
3032 struct inode_security_struct *isec = inode->i_security;
3033 u32 newsid;
3034 int rc;
3035
3036 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3037 return -EOPNOTSUPP;
3038
3039 if (!value || !size)
3040 return -EACCES;
3041
828dfe1d 3042 rc = security_context_to_sid((void *)value, size, &newsid);
1da177e4
LT		 3043 if (rc)
3044 return rc;
3045
aa9c2669 3046 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 3047 isec->sid = newsid;
ddd29ec6 3048 isec->initialized = 1;
1da177e4
LT		 3049 return 0;
3050}
3051
3052static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3053{
3054 const int len = sizeof(XATTR_NAME_SELINUX);
3055 if (buffer && len <= buffer_size)
3056 memcpy(buffer, XATTR_NAME_SELINUX, len);
3057 return len;
3058}
3059
713a04ae
AD		 3060static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3061{
3062 struct inode_security_struct *isec = inode->i_security;
3063 *secid = isec->sid;
3064}
3065
1da177e4
LT		 3066/* file security operations */
3067
788e7dd4 3068static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 3069{
88e67f3b 3070 const struct cred *cred = current_cred();
496ad9aa 3071 struct inode *inode = file_inode(file);
1da177e4 3072
1da177e4
LT		 3073 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3074 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3075 mask |= MAY_APPEND;
3076
389fb800
PM		 3077 return file_has_perm(cred, file,
3078 file_mask_to_av(inode->i_mode, mask));
1da177e4
LT		 3079}
3080
788e7dd4
YN		 3081static int selinux_file_permission(struct file *file, int mask)
3082{
496ad9aa 3083 struct inode *inode = file_inode(file);
20dda18b
SS		 3084 struct file_security_struct *fsec = file->f_security;
3085 struct inode_security_struct *isec = inode->i_security;
3086 u32 sid = current_sid();
3087
389fb800 3088 if (!mask)
788e7dd4
YN		 3089 /* No permission to check. Existence test. */
3090 return 0;
788e7dd4 3091
20dda18b
SS		 3092 if (sid == fsec->sid && fsec->isid == isec->sid &&
3093 fsec->pseqno == avc_policy_seqno())
83d49856 3094 /* No change since file_open check. */
20dda18b
SS		 3095 return 0;
3096
788e7dd4
YN		 3097 return selinux_revalidate_file_permission(file, mask);
3098}
3099
1da177e4
LT		 3100static int selinux_file_alloc_security(struct file *file)
3101{
3102 return file_alloc_security(file);
3103}
3104
3105static void selinux_file_free_security(struct file *file)
3106{
3107 file_free_security(file);
3108}
3109
3110static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3111 unsigned long arg)
3112{
88e67f3b 3113 const struct cred *cred = current_cred();
0b24dcb7 3114 int error = 0;
1da177e4 3115
0b24dcb7
EP		 3116 switch (cmd) {
3117 case FIONREAD:
3118 /* fall through */
3119 case FIBMAP:
3120 /* fall through */
3121 case FIGETBSZ:
3122 /* fall through */
2f99c369 3123 case FS_IOC_GETFLAGS:
0b24dcb7 3124 /* fall through */
2f99c369 3125 case FS_IOC_GETVERSION:
0b24dcb7
EP		 3126 error = file_has_perm(cred, file, FILE__GETATTR);
3127 break;
1da177e4 3128
2f99c369 3129 case FS_IOC_SETFLAGS:
0b24dcb7 3130 /* fall through */
2f99c369 3131 case FS_IOC_SETVERSION:
0b24dcb7
EP		 3132 error = file_has_perm(cred, file, FILE__SETATTR);
3133 break;
3134
3135 /* sys_ioctl() checks */
3136 case FIONBIO:
3137 /* fall through */
3138 case FIOASYNC:
3139 error = file_has_perm(cred, file, 0);
3140 break;
1da177e4 3141
0b24dcb7
EP		 3142 case KDSKBENT:
3143 case KDSKBSENT:
6a9de491
EP		 3144 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3145 SECURITY_CAP_AUDIT);
0b24dcb7
EP		 3146 break;
3147
3148 /* default case assumes that the command will go
3149 * to the file's ioctl() function.
3150 */
3151 default:
3152 error = file_has_perm(cred, file, FILE__IOCTL);
3153 }
3154 return error;
1da177e4
LT		 3155}
3156
fcaaade1
SS		 3157static int default_noexec;
3158
1da177e4
LT		 3159static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3160{
88e67f3b 3161 const struct cred *cred = current_cred();
d84f4f99 3162 int rc = 0;
88e67f3b 3163
fcaaade1
SS		 3164 if (default_noexec &&
3165 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
1da177e4
LT		 3166 /*
3167 * We are making executable an anonymous mapping or a
3168 * private file mapping that will also be writable.
3169 * This has an additional check.
3170 */
d84f4f99 3171 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
1da177e4 3172 if (rc)
d84f4f99 3173 goto error;
1da177e4 3174 }
1da177e4
LT		 3175
3176 if (file) {
3177 /* read access is always possible with a mapping */
3178 u32 av = FILE__READ;
3179
3180 /* write access only matters if the mapping is shared */
3181 if (shared && (prot & PROT_WRITE))
3182 av |= FILE__WRITE;
3183
3184 if (prot & PROT_EXEC)
3185 av |= FILE__EXECUTE;
3186
88e67f3b 3187 return file_has_perm(cred, file, av);
1da177e4 3188 }
d84f4f99
DH		 3189
3190error:
3191 return rc;
1da177e4
LT		 3192}
3193
e5467859 3194static int selinux_mmap_addr(unsigned long addr)
1da177e4 3195{
ed032189 3196 int rc = 0;
275bb41e 3197 u32 sid = current_sid();
1da177e4 3198
84336d1a
EP		 3199 /*
3200 * notice that we are intentionally putting the SELinux check before
3201 * the secondary cap_file_mmap check. This is such a likely attempt
3202 * at bad behaviour/exploit that we always want to get the AVC, even
3203 * if DAC would have also denied the operation.
3204 */
a2551df7 3205 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
ed032189
EP		 3206 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3207 MEMPROTECT__MMAP_ZERO, NULL);
84336d1a
EP		 3208 if (rc)
3209 return rc;
3210 }
3211
3212 /* do DAC check on address space usage */
e5467859
AV		 3213 return cap_mmap_addr(addr);
3214}
1da177e4 3215
e5467859
AV		 3216static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3217 unsigned long prot, unsigned long flags)
3218{
1da177e4
LT		 3219 if (selinux_checkreqprot)
3220 prot = reqprot;
3221
3222 return file_map_prot_check(file, prot,
3223 (flags & MAP_TYPE) == MAP_SHARED);
3224}
3225
3226static int selinux_file_mprotect(struct vm_area_struct *vma,
3227 unsigned long reqprot,
3228 unsigned long prot)
3229{
88e67f3b 3230 const struct cred *cred = current_cred();
1da177e4
LT		 3231
3232 if (selinux_checkreqprot)
3233 prot = reqprot;
3234
fcaaade1
SS		 3235 if (default_noexec &&
3236 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
d541bbee 3237 int rc = 0;
db4c9641
SS		 3238 if (vma->vm_start >= vma->vm_mm->start_brk &&
3239 vma->vm_end <= vma->vm_mm->brk) {
d84f4f99 3240 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
db4c9641
SS		 3241 } else if (!vma->vm_file &&
3242 vma->vm_start <= vma->vm_mm->start_stack &&
3243 vma->vm_end >= vma->vm_mm->start_stack) {
3b11a1de 3244 rc = current_has_perm(current, PROCESS__EXECSTACK);
db4c9641
SS		 3245 } else if (vma->vm_file && vma->anon_vma) {
3246 /*
3247 * We are making executable a file mapping that has
3248 * had some COW done. Since pages might have been
3249 * written, check ability to execute the possibly
3250 * modified content. This typically should only
3251 * occur for text relocations.
3252 */
d84f4f99 3253 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
db4c9641 3254 }