2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for sysctl_local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/semaphore.h>
55 #include <asm/ioctls.h>
56 #include <linux/bitops.h>
57 #include <linux/interrupt.h>
58 #include <linux/netdevice.h> /* for network interface checks */
59 #include <linux/netlink.h>
60 #include <linux/tcp.h>
61 #include <linux/udp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h> /* for Unix socket types */
64 #include <net/af_unix.h> /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
79 #include "selinux_netlabel.h"
81 #define XATTR_SELINUX_SUFFIX "selinux"
82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84 extern unsigned int policydb_loaded_version
;
85 extern int selinux_nlmsg_lookup(u16 sclass
, u16 nlmsg_type
, u32
*perm
);
86 extern int selinux_compat_net
;
88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89 int selinux_enforcing
= 0;
91 static int __init
enforcing_setup(char *str
)
93 selinux_enforcing
= simple_strtol(str
,NULL
,0);
96 __setup("enforcing=", enforcing_setup
);
99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
102 static int __init
selinux_enabled_setup(char *str
)
104 selinux_enabled
= simple_strtol(str
, NULL
, 0);
107 __setup("selinux=", selinux_enabled_setup
);
109 int selinux_enabled
= 1;
112 /* Original (dummy) security module. */
113 static struct security_operations
*original_ops
= NULL
;
115 /* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119 static struct security_operations
*secondary_ops
= NULL
;
121 /* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123 static LIST_HEAD(superblock_security_head
);
124 static DEFINE_SPINLOCK(sb_security_lock
);
126 static kmem_cache_t
*sel_inode_cache
;
128 /* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130 static int selinux_getsecurity(u32 sid
, void *buffer
, size_t size
)
136 rc
= security_sid_to_context(sid
, &context
, &len
);
140 if (!buffer
|| !size
)
141 goto getsecurity_exit
;
145 goto getsecurity_exit
;
147 memcpy(buffer
, context
, len
);
154 /* Allocate and free functions for each kind of security blob. */
156 static int task_alloc_security(struct task_struct
*task
)
158 struct task_security_struct
*tsec
;
160 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
165 tsec
->osid
= tsec
->sid
= tsec
->ptrace_sid
= SECINITSID_UNLABELED
;
166 task
->security
= tsec
;
171 static void task_free_security(struct task_struct
*task
)
173 struct task_security_struct
*tsec
= task
->security
;
174 task
->security
= NULL
;
178 static int inode_alloc_security(struct inode
*inode
)
180 struct task_security_struct
*tsec
= current
->security
;
181 struct inode_security_struct
*isec
;
183 isec
= kmem_cache_alloc(sel_inode_cache
, SLAB_KERNEL
);
187 memset(isec
, 0, sizeof(*isec
));
188 init_MUTEX(&isec
->sem
);
189 INIT_LIST_HEAD(&isec
->list
);
191 isec
->sid
= SECINITSID_UNLABELED
;
192 isec
->sclass
= SECCLASS_FILE
;
193 isec
->task_sid
= tsec
->sid
;
194 inode
->i_security
= isec
;
199 static void inode_free_security(struct inode
*inode
)
201 struct inode_security_struct
*isec
= inode
->i_security
;
202 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
204 spin_lock(&sbsec
->isec_lock
);
205 if (!list_empty(&isec
->list
))
206 list_del_init(&isec
->list
);
207 spin_unlock(&sbsec
->isec_lock
);
209 inode
->i_security
= NULL
;
210 kmem_cache_free(sel_inode_cache
, isec
);
213 static int file_alloc_security(struct file
*file
)
215 struct task_security_struct
*tsec
= current
->security
;
216 struct file_security_struct
*fsec
;
218 fsec
= kzalloc(sizeof(struct file_security_struct
), GFP_KERNEL
);
223 fsec
->sid
= tsec
->sid
;
224 fsec
->fown_sid
= tsec
->sid
;
225 file
->f_security
= fsec
;
230 static void file_free_security(struct file
*file
)
232 struct file_security_struct
*fsec
= file
->f_security
;
233 file
->f_security
= NULL
;
237 static int superblock_alloc_security(struct super_block
*sb
)
239 struct superblock_security_struct
*sbsec
;
241 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
245 init_MUTEX(&sbsec
->sem
);
246 INIT_LIST_HEAD(&sbsec
->list
);
247 INIT_LIST_HEAD(&sbsec
->isec_head
);
248 spin_lock_init(&sbsec
->isec_lock
);
250 sbsec
->sid
= SECINITSID_UNLABELED
;
251 sbsec
->def_sid
= SECINITSID_FILE
;
252 sbsec
->mntpoint_sid
= SECINITSID_UNLABELED
;
253 sb
->s_security
= sbsec
;
258 static void superblock_free_security(struct super_block
*sb
)
260 struct superblock_security_struct
*sbsec
= sb
->s_security
;
262 spin_lock(&sb_security_lock
);
263 if (!list_empty(&sbsec
->list
))
264 list_del_init(&sbsec
->list
);
265 spin_unlock(&sb_security_lock
);
267 sb
->s_security
= NULL
;
271 static int sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
273 struct sk_security_struct
*ssec
;
275 ssec
= kzalloc(sizeof(*ssec
), priority
);
280 ssec
->peer_sid
= SECINITSID_UNLABELED
;
281 ssec
->sid
= SECINITSID_UNLABELED
;
282 sk
->sk_security
= ssec
;
287 static void sk_free_security(struct sock
*sk
)
289 struct sk_security_struct
*ssec
= sk
->sk_security
;
291 sk
->sk_security
= NULL
;
295 /* The security server must be initialized before
296 any labeling or access decisions can be provided. */
297 extern int ss_initialized
;
299 /* The file system's label must be initialized prior to use. */
301 static char *labeling_behaviors
[6] = {
303 "uses transition SIDs",
305 "uses genfs_contexts",
306 "not configured for labeling",
307 "uses mountpoint labeling",
310 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
312 static inline int inode_doinit(struct inode
*inode
)
314 return inode_doinit_with_dentry(inode
, NULL
);
324 static match_table_t tokens
= {
325 {Opt_context
, "context=%s"},
326 {Opt_fscontext
, "fscontext=%s"},
327 {Opt_defcontext
, "defcontext=%s"},
328 {Opt_rootcontext
, "rootcontext=%s"},
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333 static int may_context_mount_sb_relabel(u32 sid
,
334 struct superblock_security_struct
*sbsec
,
335 struct task_security_struct
*tsec
)
339 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
340 FILESYSTEM__RELABELFROM
, NULL
);
344 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
345 FILESYSTEM__RELABELTO
, NULL
);
349 static int may_context_mount_inode_relabel(u32 sid
,
350 struct superblock_security_struct
*sbsec
,
351 struct task_security_struct
*tsec
)
354 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
355 FILESYSTEM__RELABELFROM
, NULL
);
359 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
360 FILESYSTEM__ASSOCIATE
, NULL
);
364 static int try_context_mount(struct super_block
*sb
, void *data
)
366 char *context
= NULL
, *defcontext
= NULL
;
367 char *fscontext
= NULL
, *rootcontext
= NULL
;
370 int alloc
= 0, rc
= 0, seen
= 0;
371 struct task_security_struct
*tsec
= current
->security
;
372 struct superblock_security_struct
*sbsec
= sb
->s_security
;
377 name
= sb
->s_type
->name
;
379 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
381 /* NFS we understand. */
382 if (!strcmp(name
, "nfs")) {
383 struct nfs_mount_data
*d
= data
;
385 if (d
->version
< NFS_MOUNT_VERSION
)
389 context
= d
->context
;
396 /* Standard string-based options. */
397 char *p
, *options
= data
;
399 while ((p
= strsep(&options
, ",")) != NULL
) {
401 substring_t args
[MAX_OPT_ARGS
];
406 token
= match_token(p
, tokens
, args
);
410 if (seen
& (Opt_context
|Opt_defcontext
)) {
412 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
415 context
= match_strdup(&args
[0]);
426 if (seen
& Opt_fscontext
) {
428 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
431 fscontext
= match_strdup(&args
[0]);
438 seen
|= Opt_fscontext
;
441 case Opt_rootcontext
:
442 if (seen
& Opt_rootcontext
) {
444 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
447 rootcontext
= match_strdup(&args
[0]);
454 seen
|= Opt_rootcontext
;
458 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
) {
460 printk(KERN_WARNING
"SELinux: "
461 "defcontext option is invalid "
462 "for this filesystem type\n");
465 if (seen
& (Opt_context
|Opt_defcontext
)) {
467 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
470 defcontext
= match_strdup(&args
[0]);
477 seen
|= Opt_defcontext
;
482 printk(KERN_WARNING
"SELinux: unknown mount "
493 /* sets the context of the superblock for the fs being mounted. */
495 rc
= security_context_to_sid(fscontext
, strlen(fscontext
), &sid
);
497 printk(KERN_WARNING
"SELinux: security_context_to_sid"
498 "(%s) failed for (dev %s, type %s) errno=%d\n",
499 fscontext
, sb
->s_id
, name
, rc
);
503 rc
= may_context_mount_sb_relabel(sid
, sbsec
, tsec
);
511 * Switch to using mount point labeling behavior.
512 * sets the label used on all file below the mountpoint, and will set
513 * the superblock context if not already set.
516 rc
= security_context_to_sid(context
, strlen(context
), &sid
);
518 printk(KERN_WARNING
"SELinux: security_context_to_sid"
519 "(%s) failed for (dev %s, type %s) errno=%d\n",
520 context
, sb
->s_id
, name
, rc
);
525 rc
= may_context_mount_sb_relabel(sid
, sbsec
, tsec
);
530 rc
= may_context_mount_inode_relabel(sid
, sbsec
, tsec
);
534 sbsec
->mntpoint_sid
= sid
;
536 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
540 struct inode
*inode
= sb
->s_root
->d_inode
;
541 struct inode_security_struct
*isec
= inode
->i_security
;
542 rc
= security_context_to_sid(rootcontext
, strlen(rootcontext
), &sid
);
544 printk(KERN_WARNING
"SELinux: security_context_to_sid"
545 "(%s) failed for (dev %s, type %s) errno=%d\n",
546 rootcontext
, sb
->s_id
, name
, rc
);
550 rc
= may_context_mount_inode_relabel(sid
, sbsec
, tsec
);
555 isec
->initialized
= 1;
559 rc
= security_context_to_sid(defcontext
, strlen(defcontext
), &sid
);
561 printk(KERN_WARNING
"SELinux: security_context_to_sid"
562 "(%s) failed for (dev %s, type %s) errno=%d\n",
563 defcontext
, sb
->s_id
, name
, rc
);
567 if (sid
== sbsec
->def_sid
)
570 rc
= may_context_mount_inode_relabel(sid
, sbsec
, tsec
);
574 sbsec
->def_sid
= sid
;
588 static int superblock_doinit(struct super_block
*sb
, void *data
)
590 struct superblock_security_struct
*sbsec
= sb
->s_security
;
591 struct dentry
*root
= sb
->s_root
;
592 struct inode
*inode
= root
->d_inode
;
596 if (sbsec
->initialized
)
599 if (!ss_initialized
) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
603 spin_lock(&sb_security_lock
);
604 if (list_empty(&sbsec
->list
))
605 list_add(&sbsec
->list
, &superblock_security_head
);
606 spin_unlock(&sb_security_lock
);
610 /* Determine the labeling behavior to use for this filesystem type. */
611 rc
= security_fs_use(sb
->s_type
->name
, &sbsec
->behavior
, &sbsec
->sid
);
613 printk(KERN_WARNING
"%s: security_fs_use(%s) returned %d\n",
614 __FUNCTION__
, sb
->s_type
->name
, rc
);
618 rc
= try_context_mount(sb
, data
);
622 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
623 /* Make sure that the xattr handler exists and that no
624 error other than -ENODATA is returned by getxattr on
625 the root directory. -ENODATA is ok, as this may be
626 the first boot of the SELinux kernel before we have
627 assigned xattr values to the filesystem. */
628 if (!inode
->i_op
->getxattr
) {
629 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
630 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
634 rc
= inode
->i_op
->getxattr(root
, XATTR_NAME_SELINUX
, NULL
, 0);
635 if (rc
< 0 && rc
!= -ENODATA
) {
636 if (rc
== -EOPNOTSUPP
)
637 printk(KERN_WARNING
"SELinux: (dev %s, type "
638 "%s) has no security xattr handler\n",
639 sb
->s_id
, sb
->s_type
->name
);
641 printk(KERN_WARNING
"SELinux: (dev %s, type "
642 "%s) getxattr errno %d\n", sb
->s_id
,
643 sb
->s_type
->name
, -rc
);
648 if (strcmp(sb
->s_type
->name
, "proc") == 0)
651 sbsec
->initialized
= 1;
653 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
)) {
654 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
655 sb
->s_id
, sb
->s_type
->name
);
658 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), %s\n",
659 sb
->s_id
, sb
->s_type
->name
,
660 labeling_behaviors
[sbsec
->behavior
-1]);
663 /* Initialize the root inode. */
664 rc
= inode_doinit_with_dentry(sb
->s_root
->d_inode
, sb
->s_root
);
666 /* Initialize any other inodes associated with the superblock, e.g.
667 inodes created prior to initial policy load or inodes created
668 during get_sb by a pseudo filesystem that directly
670 spin_lock(&sbsec
->isec_lock
);
672 if (!list_empty(&sbsec
->isec_head
)) {
673 struct inode_security_struct
*isec
=
674 list_entry(sbsec
->isec_head
.next
,
675 struct inode_security_struct
, list
);
676 struct inode
*inode
= isec
->inode
;
677 spin_unlock(&sbsec
->isec_lock
);
678 inode
= igrab(inode
);
680 if (!IS_PRIVATE (inode
))
684 spin_lock(&sbsec
->isec_lock
);
685 list_del_init(&isec
->list
);
688 spin_unlock(&sbsec
->isec_lock
);
694 static inline u16
inode_mode_to_security_class(umode_t mode
)
696 switch (mode
& S_IFMT
) {
698 return SECCLASS_SOCK_FILE
;
700 return SECCLASS_LNK_FILE
;
702 return SECCLASS_FILE
;
704 return SECCLASS_BLK_FILE
;
708 return SECCLASS_CHR_FILE
;
710 return SECCLASS_FIFO_FILE
;
714 return SECCLASS_FILE
;
717 static inline int default_protocol_stream(int protocol
)
719 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
722 static inline int default_protocol_dgram(int protocol
)
724 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
727 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
734 return SECCLASS_UNIX_STREAM_SOCKET
;
736 return SECCLASS_UNIX_DGRAM_SOCKET
;
743 if (default_protocol_stream(protocol
))
744 return SECCLASS_TCP_SOCKET
;
746 return SECCLASS_RAWIP_SOCKET
;
748 if (default_protocol_dgram(protocol
))
749 return SECCLASS_UDP_SOCKET
;
751 return SECCLASS_RAWIP_SOCKET
;
753 return SECCLASS_RAWIP_SOCKET
;
759 return SECCLASS_NETLINK_ROUTE_SOCKET
;
760 case NETLINK_FIREWALL
:
761 return SECCLASS_NETLINK_FIREWALL_SOCKET
;
762 case NETLINK_INET_DIAG
:
763 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
765 return SECCLASS_NETLINK_NFLOG_SOCKET
;
767 return SECCLASS_NETLINK_XFRM_SOCKET
;
768 case NETLINK_SELINUX
:
769 return SECCLASS_NETLINK_SELINUX_SOCKET
;
771 return SECCLASS_NETLINK_AUDIT_SOCKET
;
773 return SECCLASS_NETLINK_IP6FW_SOCKET
;
774 case NETLINK_DNRTMSG
:
775 return SECCLASS_NETLINK_DNRT_SOCKET
;
776 case NETLINK_KOBJECT_UEVENT
:
777 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
779 return SECCLASS_NETLINK_SOCKET
;
782 return SECCLASS_PACKET_SOCKET
;
784 return SECCLASS_KEY_SOCKET
;
786 return SECCLASS_APPLETALK_SOCKET
;
789 return SECCLASS_SOCKET
;
792 #ifdef CONFIG_PROC_FS
793 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
798 char *buffer
, *path
, *end
;
800 buffer
= (char*)__get_free_page(GFP_KERNEL
);
810 while (de
&& de
!= de
->parent
) {
811 buflen
-= de
->namelen
+ 1;
815 memcpy(end
, de
->name
, de
->namelen
);
820 rc
= security_genfs_sid("proc", path
, tclass
, sid
);
821 free_page((unsigned long)buffer
);
825 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
833 /* The inode's security attributes must be initialized before first use. */
834 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
836 struct superblock_security_struct
*sbsec
= NULL
;
837 struct inode_security_struct
*isec
= inode
->i_security
;
839 struct dentry
*dentry
;
840 #define INITCONTEXTLEN 255
841 char *context
= NULL
;
846 if (isec
->initialized
)
851 if (isec
->initialized
)
854 sbsec
= inode
->i_sb
->s_security
;
855 if (!sbsec
->initialized
) {
856 /* Defer initialization until selinux_complete_init,
857 after the initial policy is loaded and the security
858 server is ready to handle calls. */
859 spin_lock(&sbsec
->isec_lock
);
860 if (list_empty(&isec
->list
))
861 list_add(&isec
->list
, &sbsec
->isec_head
);
862 spin_unlock(&sbsec
->isec_lock
);
866 switch (sbsec
->behavior
) {
867 case SECURITY_FS_USE_XATTR
:
868 if (!inode
->i_op
->getxattr
) {
869 isec
->sid
= sbsec
->def_sid
;
873 /* Need a dentry, since the xattr API requires one.
874 Life would be simpler if we could just pass the inode. */
876 /* Called from d_instantiate or d_splice_alias. */
877 dentry
= dget(opt_dentry
);
879 /* Called from selinux_complete_init, try to find a dentry. */
880 dentry
= d_find_alias(inode
);
883 printk(KERN_WARNING
"%s: no dentry for dev=%s "
884 "ino=%ld\n", __FUNCTION__
, inode
->i_sb
->s_id
,
889 len
= INITCONTEXTLEN
;
890 context
= kmalloc(len
, GFP_KERNEL
);
896 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
899 /* Need a larger buffer. Query for the right size. */
900 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
908 context
= kmalloc(len
, GFP_KERNEL
);
914 rc
= inode
->i_op
->getxattr(dentry
,
920 if (rc
!= -ENODATA
) {
921 printk(KERN_WARNING
"%s: getxattr returned "
922 "%d for dev=%s ino=%ld\n", __FUNCTION__
,
923 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
927 /* Map ENODATA to the default file SID */
928 sid
= sbsec
->def_sid
;
931 rc
= security_context_to_sid_default(context
, rc
, &sid
,
934 printk(KERN_WARNING
"%s: context_to_sid(%s) "
935 "returned %d for dev=%s ino=%ld\n",
936 __FUNCTION__
, context
, -rc
,
937 inode
->i_sb
->s_id
, inode
->i_ino
);
939 /* Leave with the unlabeled SID */
947 case SECURITY_FS_USE_TASK
:
948 isec
->sid
= isec
->task_sid
;
950 case SECURITY_FS_USE_TRANS
:
951 /* Default to the fs SID. */
952 isec
->sid
= sbsec
->sid
;
954 /* Try to obtain a transition SID. */
955 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
956 rc
= security_transition_sid(isec
->task_sid
,
964 case SECURITY_FS_USE_MNTPOINT
:
965 isec
->sid
= sbsec
->mntpoint_sid
;
968 /* Default to the fs superblock SID. */
969 isec
->sid
= sbsec
->sid
;
972 struct proc_inode
*proci
= PROC_I(inode
);
974 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
975 rc
= selinux_proc_get_sid(proci
->pde
,
986 isec
->initialized
= 1;
989 if (isec
->sclass
== SECCLASS_FILE
)
990 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
997 /* Convert a Linux signal to an access vector. */
998 static inline u32
signal_to_av(int sig
)
1004 /* Commonly granted from child to parent. */
1005 perm
= PROCESS__SIGCHLD
;
1008 /* Cannot be caught or ignored */
1009 perm
= PROCESS__SIGKILL
;
1012 /* Cannot be caught or ignored */
1013 perm
= PROCESS__SIGSTOP
;
1016 /* All other signals. */
1017 perm
= PROCESS__SIGNAL
;
1024 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1025 fork check, ptrace check, etc. */
1026 static int task_has_perm(struct task_struct
*tsk1
,
1027 struct task_struct
*tsk2
,
1030 struct task_security_struct
*tsec1
, *tsec2
;
1032 tsec1
= tsk1
->security
;
1033 tsec2
= tsk2
->security
;
1034 return avc_has_perm(tsec1
->sid
, tsec2
->sid
,
1035 SECCLASS_PROCESS
, perms
, NULL
);
1038 /* Check whether a task is allowed to use a capability. */
1039 static int task_has_capability(struct task_struct
*tsk
,
1042 struct task_security_struct
*tsec
;
1043 struct avc_audit_data ad
;
1045 tsec
= tsk
->security
;
1047 AVC_AUDIT_DATA_INIT(&ad
,CAP
);
1051 return avc_has_perm(tsec
->sid
, tsec
->sid
,
1052 SECCLASS_CAPABILITY
, CAP_TO_MASK(cap
), &ad
);
1055 /* Check whether a task is allowed to use a system operation. */
1056 static int task_has_system(struct task_struct
*tsk
,
1059 struct task_security_struct
*tsec
;
1061 tsec
= tsk
->security
;
1063 return avc_has_perm(tsec
->sid
, SECINITSID_KERNEL
,
1064 SECCLASS_SYSTEM
, perms
, NULL
);
1067 /* Check whether a task has a particular permission to an inode.
1068 The 'adp' parameter is optional and allows other audit
1069 data to be passed (e.g. the dentry). */
1070 static int inode_has_perm(struct task_struct
*tsk
,
1071 struct inode
*inode
,
1073 struct avc_audit_data
*adp
)
1075 struct task_security_struct
*tsec
;
1076 struct inode_security_struct
*isec
;
1077 struct avc_audit_data ad
;
1079 tsec
= tsk
->security
;
1080 isec
= inode
->i_security
;
1084 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1085 ad
.u
.fs
.inode
= inode
;
1088 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
1091 /* Same as inode_has_perm, but pass explicit audit data containing
1092 the dentry to help the auditing code to more easily generate the
1093 pathname if needed. */
1094 static inline int dentry_has_perm(struct task_struct
*tsk
,
1095 struct vfsmount
*mnt
,
1096 struct dentry
*dentry
,
1099 struct inode
*inode
= dentry
->d_inode
;
1100 struct avc_audit_data ad
;
1101 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1103 ad
.u
.fs
.dentry
= dentry
;
1104 return inode_has_perm(tsk
, inode
, av
, &ad
);
1107 /* Check whether a task can use an open file descriptor to
1108 access an inode in a given way. Check access to the
1109 descriptor itself, and then use dentry_has_perm to
1110 check a particular permission to the file.
1111 Access to the descriptor is implicitly granted if it
1112 has the same SID as the process. If av is zero, then
1113 access to the file is not checked, e.g. for cases
1114 where only the descriptor is affected like seek. */
1115 static int file_has_perm(struct task_struct
*tsk
,
1119 struct task_security_struct
*tsec
= tsk
->security
;
1120 struct file_security_struct
*fsec
= file
->f_security
;
1121 struct vfsmount
*mnt
= file
->f_vfsmnt
;
1122 struct dentry
*dentry
= file
->f_dentry
;
1123 struct inode
*inode
= dentry
->d_inode
;
1124 struct avc_audit_data ad
;
1127 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1129 ad
.u
.fs
.dentry
= dentry
;
1131 if (tsec
->sid
!= fsec
->sid
) {
1132 rc
= avc_has_perm(tsec
->sid
, fsec
->sid
,
1140 /* av is zero if only checking access to the descriptor. */
1142 return inode_has_perm(tsk
, inode
, av
, &ad
);
1147 /* Check whether a task can create a file. */
1148 static int may_create(struct inode
*dir
,
1149 struct dentry
*dentry
,
1152 struct task_security_struct
*tsec
;
1153 struct inode_security_struct
*dsec
;
1154 struct superblock_security_struct
*sbsec
;
1156 struct avc_audit_data ad
;
1159 tsec
= current
->security
;
1160 dsec
= dir
->i_security
;
1161 sbsec
= dir
->i_sb
->s_security
;
1163 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1164 ad
.u
.fs
.dentry
= dentry
;
1166 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
,
1167 DIR__ADD_NAME
| DIR__SEARCH
,
1172 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1173 newsid
= tsec
->create_sid
;
1175 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1181 rc
= avc_has_perm(tsec
->sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1185 return avc_has_perm(newsid
, sbsec
->sid
,
1186 SECCLASS_FILESYSTEM
,
1187 FILESYSTEM__ASSOCIATE
, &ad
);
1190 /* Check whether a task can create a key. */
1191 static int may_create_key(u32 ksid
,
1192 struct task_struct
*ctx
)
1194 struct task_security_struct
*tsec
;
1196 tsec
= ctx
->security
;
1198 return avc_has_perm(tsec
->sid
, ksid
, SECCLASS_KEY
, KEY__CREATE
, NULL
);
1202 #define MAY_UNLINK 1
1205 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1206 static int may_link(struct inode
*dir
,
1207 struct dentry
*dentry
,
1211 struct task_security_struct
*tsec
;
1212 struct inode_security_struct
*dsec
, *isec
;
1213 struct avc_audit_data ad
;
1217 tsec
= current
->security
;
1218 dsec
= dir
->i_security
;
1219 isec
= dentry
->d_inode
->i_security
;
1221 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1222 ad
.u
.fs
.dentry
= dentry
;
1225 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1226 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1241 printk(KERN_WARNING
"may_link: unrecognized kind %d\n", kind
);
1245 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1249 static inline int may_rename(struct inode
*old_dir
,
1250 struct dentry
*old_dentry
,
1251 struct inode
*new_dir
,
1252 struct dentry
*new_dentry
)
1254 struct task_security_struct
*tsec
;
1255 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1256 struct avc_audit_data ad
;
1258 int old_is_dir
, new_is_dir
;
1261 tsec
= current
->security
;
1262 old_dsec
= old_dir
->i_security
;
1263 old_isec
= old_dentry
->d_inode
->i_security
;
1264 old_is_dir
= S_ISDIR(old_dentry
->d_inode
->i_mode
);
1265 new_dsec
= new_dir
->i_security
;
1267 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1269 ad
.u
.fs
.dentry
= old_dentry
;
1270 rc
= avc_has_perm(tsec
->sid
, old_dsec
->sid
, SECCLASS_DIR
,
1271 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1274 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1275 old_isec
->sclass
, FILE__RENAME
, &ad
);
1278 if (old_is_dir
&& new_dir
!= old_dir
) {
1279 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1280 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1285 ad
.u
.fs
.dentry
= new_dentry
;
1286 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1287 if (new_dentry
->d_inode
)
1288 av
|= DIR__REMOVE_NAME
;
1289 rc
= avc_has_perm(tsec
->sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1292 if (new_dentry
->d_inode
) {
1293 new_isec
= new_dentry
->d_inode
->i_security
;
1294 new_is_dir
= S_ISDIR(new_dentry
->d_inode
->i_mode
);
1295 rc
= avc_has_perm(tsec
->sid
, new_isec
->sid
,
1297 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1305 /* Check whether a task can perform a filesystem operation. */
1306 static int superblock_has_perm(struct task_struct
*tsk
,
1307 struct super_block
*sb
,
1309 struct avc_audit_data
*ad
)
1311 struct task_security_struct
*tsec
;
1312 struct superblock_security_struct
*sbsec
;
1314 tsec
= tsk
->security
;
1315 sbsec
= sb
->s_security
;
1316 return avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
1320 /* Convert a Linux mode and permission mask to an access vector. */
1321 static inline u32
file_mask_to_av(int mode
, int mask
)
1325 if ((mode
& S_IFMT
) != S_IFDIR
) {
1326 if (mask
& MAY_EXEC
)
1327 av
|= FILE__EXECUTE
;
1328 if (mask
& MAY_READ
)
1331 if (mask
& MAY_APPEND
)
1333 else if (mask
& MAY_WRITE
)
1337 if (mask
& MAY_EXEC
)
1339 if (mask
& MAY_WRITE
)
1341 if (mask
& MAY_READ
)
1348 /* Convert a Linux file to an access vector. */
1349 static inline u32
file_to_av(struct file
*file
)
1353 if (file
->f_mode
& FMODE_READ
)
1355 if (file
->f_mode
& FMODE_WRITE
) {
1356 if (file
->f_flags
& O_APPEND
)
1365 /* Set an inode's SID to a specified value. */
1366 static int inode_security_set_sid(struct inode
*inode
, u32 sid
)
1368 struct inode_security_struct
*isec
= inode
->i_security
;
1369 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
1371 if (!sbsec
->initialized
) {
1372 /* Defer initialization to selinux_complete_init. */
1377 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1379 isec
->initialized
= 1;
1384 /* Hook functions begin here. */
1386 static int selinux_ptrace(struct task_struct
*parent
, struct task_struct
*child
)
1388 struct task_security_struct
*psec
= parent
->security
;
1389 struct task_security_struct
*csec
= child
->security
;
1392 rc
= secondary_ops
->ptrace(parent
,child
);
1396 rc
= task_has_perm(parent
, child
, PROCESS__PTRACE
);
1397 /* Save the SID of the tracing process for later use in apply_creds. */
1398 if (!(child
->ptrace
& PT_PTRACED
) && !rc
)
1399 csec
->ptrace_sid
= psec
->sid
;
1403 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
1404 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1408 error
= task_has_perm(current
, target
, PROCESS__GETCAP
);
1412 return secondary_ops
->capget(target
, effective
, inheritable
, permitted
);
1415 static int selinux_capset_check(struct task_struct
*target
, kernel_cap_t
*effective
,
1416 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1420 error
= secondary_ops
->capset_check(target
, effective
, inheritable
, permitted
);
1424 return task_has_perm(current
, target
, PROCESS__SETCAP
);
1427 static void selinux_capset_set(struct task_struct
*target
, kernel_cap_t
*effective
,
1428 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1430 secondary_ops
->capset_set(target
, effective
, inheritable
, permitted
);
1433 static int selinux_capable(struct task_struct
*tsk
, int cap
)
1437 rc
= secondary_ops
->capable(tsk
, cap
);
1441 return task_has_capability(tsk
,cap
);
1444 static int selinux_sysctl(ctl_table
*table
, int op
)
1448 struct task_security_struct
*tsec
;
1452 rc
= secondary_ops
->sysctl(table
, op
);
1456 tsec
= current
->security
;
1458 rc
= selinux_proc_get_sid(table
->de
, (op
== 001) ?
1459 SECCLASS_DIR
: SECCLASS_FILE
, &tsid
);
1461 /* Default to the well-defined sysctl SID. */
1462 tsid
= SECINITSID_SYSCTL
;
1465 /* The op values are "defined" in sysctl.c, thereby creating
1466 * a bad coupling between this module and sysctl.c */
1468 error
= avc_has_perm(tsec
->sid
, tsid
,
1469 SECCLASS_DIR
, DIR__SEARCH
, NULL
);
1477 error
= avc_has_perm(tsec
->sid
, tsid
,
1478 SECCLASS_FILE
, av
, NULL
);
1484 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
1497 rc
= superblock_has_perm(current
,
1499 FILESYSTEM__QUOTAMOD
, NULL
);
1504 rc
= superblock_has_perm(current
,
1506 FILESYSTEM__QUOTAGET
, NULL
);
1509 rc
= 0; /* let the kernel handle invalid cmds */
1515 static int selinux_quota_on(struct dentry
*dentry
)
1517 return dentry_has_perm(current
, NULL
, dentry
, FILE__QUOTAON
);
1520 static int selinux_syslog(int type
)
1524 rc
= secondary_ops
->syslog(type
);
1529 case 3: /* Read last kernel messages */
1530 case 10: /* Return size of the log buffer */
1531 rc
= task_has_system(current
, SYSTEM__SYSLOG_READ
);
1533 case 6: /* Disable logging to console */
1534 case 7: /* Enable logging to console */
1535 case 8: /* Set level of messages printed to console */
1536 rc
= task_has_system(current
, SYSTEM__SYSLOG_CONSOLE
);
1538 case 0: /* Close log */
1539 case 1: /* Open log */
1540 case 2: /* Read from log */
1541 case 4: /* Read/clear last kernel messages */
1542 case 5: /* Clear ring buffer */
1544 rc
= task_has_system(current
, SYSTEM__SYSLOG_MOD
);
1551 * Check that a process has enough memory to allocate a new virtual
1552 * mapping. 0 means there is enough memory for the allocation to
1553 * succeed and -ENOMEM implies there is not.
1555 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1556 * if the capability is granted, but __vm_enough_memory requires 1 if
1557 * the capability is granted.
1559 * Do not audit the selinux permission check, as this is applied to all
1560 * processes that allocate mappings.
1562 static int selinux_vm_enough_memory(long pages
)
1564 int rc
, cap_sys_admin
= 0;
1565 struct task_security_struct
*tsec
= current
->security
;
1567 rc
= secondary_ops
->capable(current
, CAP_SYS_ADMIN
);
1569 rc
= avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
1570 SECCLASS_CAPABILITY
,
1571 CAP_TO_MASK(CAP_SYS_ADMIN
),
1577 return __vm_enough_memory(pages
, cap_sys_admin
);
1580 /* binprm security operations */
1582 static int selinux_bprm_alloc_security(struct linux_binprm
*bprm
)
1584 struct bprm_security_struct
*bsec
;
1586 bsec
= kzalloc(sizeof(struct bprm_security_struct
), GFP_KERNEL
);
1591 bsec
->sid
= SECINITSID_UNLABELED
;
1594 bprm
->security
= bsec
;
1598 static int selinux_bprm_set_security(struct linux_binprm
*bprm
)
1600 struct task_security_struct
*tsec
;
1601 struct inode
*inode
= bprm
->file
->f_dentry
->d_inode
;
1602 struct inode_security_struct
*isec
;
1603 struct bprm_security_struct
*bsec
;
1605 struct avc_audit_data ad
;
1608 rc
= secondary_ops
->bprm_set_security(bprm
);
1612 bsec
= bprm
->security
;
1617 tsec
= current
->security
;
1618 isec
= inode
->i_security
;
1620 /* Default to the current task SID. */
1621 bsec
->sid
= tsec
->sid
;
1623 /* Reset fs, key, and sock SIDs on execve. */
1624 tsec
->create_sid
= 0;
1625 tsec
->keycreate_sid
= 0;
1626 tsec
->sockcreate_sid
= 0;
1628 if (tsec
->exec_sid
) {
1629 newsid
= tsec
->exec_sid
;
1630 /* Reset exec SID on execve. */
1633 /* Check for a default transition on this program. */
1634 rc
= security_transition_sid(tsec
->sid
, isec
->sid
,
1635 SECCLASS_PROCESS
, &newsid
);
1640 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1641 ad
.u
.fs
.mnt
= bprm
->file
->f_vfsmnt
;
1642 ad
.u
.fs
.dentry
= bprm
->file
->f_dentry
;
1644 if (bprm
->file
->f_vfsmnt
->mnt_flags
& MNT_NOSUID
)
1647 if (tsec
->sid
== newsid
) {
1648 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
1649 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
1653 /* Check permissions for the transition. */
1654 rc
= avc_has_perm(tsec
->sid
, newsid
,
1655 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
1659 rc
= avc_has_perm(newsid
, isec
->sid
,
1660 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
1664 /* Clear any possibly unsafe personality bits on exec: */
1665 current
->personality
&= ~PER_CLEAR_ON_SETID
;
1667 /* Set the security field to the new SID. */
1675 static int selinux_bprm_check_security (struct linux_binprm
*bprm
)
1677 return secondary_ops
->bprm_check_security(bprm
);
1681 static int selinux_bprm_secureexec (struct linux_binprm
*bprm
)
1683 struct task_security_struct
*tsec
= current
->security
;
1686 if (tsec
->osid
!= tsec
->sid
) {
1687 /* Enable secure mode for SIDs transitions unless
1688 the noatsecure permission is granted between
1689 the two SIDs, i.e. ahp returns 0. */
1690 atsecure
= avc_has_perm(tsec
->osid
, tsec
->sid
,
1692 PROCESS__NOATSECURE
, NULL
);
1695 return (atsecure
|| secondary_ops
->bprm_secureexec(bprm
));
1698 static void selinux_bprm_free_security(struct linux_binprm
*bprm
)
1700 kfree(bprm
->security
);
1701 bprm
->security
= NULL
;
1704 extern struct vfsmount
*selinuxfs_mount
;
1705 extern struct dentry
*selinux_null
;
1707 /* Derived from fs/exec.c:flush_old_files. */
1708 static inline void flush_unauthorized_files(struct files_struct
* files
)
1710 struct avc_audit_data ad
;
1711 struct file
*file
, *devnull
= NULL
;
1712 struct tty_struct
*tty
= current
->signal
->tty
;
1713 struct fdtable
*fdt
;
1718 file
= list_entry(tty
->tty_files
.next
, typeof(*file
), f_u
.fu_list
);
1720 /* Revalidate access to controlling tty.
1721 Use inode_has_perm on the tty inode directly rather
1722 than using file_has_perm, as this particular open
1723 file may belong to another process and we are only
1724 interested in the inode-based check here. */
1725 struct inode
*inode
= file
->f_dentry
->d_inode
;
1726 if (inode_has_perm(current
, inode
,
1727 FILE__READ
| FILE__WRITE
, NULL
)) {
1728 /* Reset controlling tty. */
1729 current
->signal
->tty
= NULL
;
1730 current
->signal
->tty_old_pgrp
= 0;
1736 /* Revalidate access to inherited open files. */
1738 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1740 spin_lock(&files
->file_lock
);
1742 unsigned long set
, i
;
1747 fdt
= files_fdtable(files
);
1748 if (i
>= fdt
->max_fds
|| i
>= fdt
->max_fdset
)
1750 set
= fdt
->open_fds
->fds_bits
[j
];
1753 spin_unlock(&files
->file_lock
);
1754 for ( ; set
; i
++,set
>>= 1) {
1759 if (file_has_perm(current
,
1761 file_to_av(file
))) {
1763 fd
= get_unused_fd();
1773 devnull
= dentry_open(dget(selinux_null
), mntget(selinuxfs_mount
), O_RDWR
);
1780 fd_install(fd
, devnull
);
1785 spin_lock(&files
->file_lock
);
1788 spin_unlock(&files
->file_lock
);
1791 static void selinux_bprm_apply_creds(struct linux_binprm
*bprm
, int unsafe
)
1793 struct task_security_struct
*tsec
;
1794 struct bprm_security_struct
*bsec
;
1798 secondary_ops
->bprm_apply_creds(bprm
, unsafe
);
1800 tsec
= current
->security
;
1802 bsec
= bprm
->security
;
1805 tsec
->osid
= tsec
->sid
;
1807 if (tsec
->sid
!= sid
) {
1808 /* Check for shared state. If not ok, leave SID
1809 unchanged and kill. */
1810 if (unsafe
& LSM_UNSAFE_SHARE
) {
1811 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
1812 PROCESS__SHARE
, NULL
);
1819 /* Check for ptracing, and update the task SID if ok.
1820 Otherwise, leave SID unchanged and kill. */
1821 if (unsafe
& (LSM_UNSAFE_PTRACE
| LSM_UNSAFE_PTRACE_CAP
)) {
1822 rc
= avc_has_perm(tsec
->ptrace_sid
, sid
,
1823 SECCLASS_PROCESS
, PROCESS__PTRACE
,
1835 * called after apply_creds without the task lock held
1837 static void selinux_bprm_post_apply_creds(struct linux_binprm
*bprm
)
1839 struct task_security_struct
*tsec
;
1840 struct rlimit
*rlim
, *initrlim
;
1841 struct itimerval itimer
;
1842 struct bprm_security_struct
*bsec
;
1845 tsec
= current
->security
;
1846 bsec
= bprm
->security
;
1849 force_sig_specific(SIGKILL
, current
);
1852 if (tsec
->osid
== tsec
->sid
)
1855 /* Close files for which the new task SID is not authorized. */
1856 flush_unauthorized_files(current
->files
);
1858 /* Check whether the new SID can inherit signal state
1859 from the old SID. If not, clear itimers to avoid
1860 subsequent signal generation and flush and unblock
1861 signals. This must occur _after_ the task SID has
1862 been updated so that any kill done after the flush
1863 will be checked against the new SID. */
1864 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1865 PROCESS__SIGINH
, NULL
);
1867 memset(&itimer
, 0, sizeof itimer
);
1868 for (i
= 0; i
< 3; i
++)
1869 do_setitimer(i
, &itimer
, NULL
);
1870 flush_signals(current
);
1871 spin_lock_irq(¤t
->sighand
->siglock
);
1872 flush_signal_handlers(current
, 1);
1873 sigemptyset(¤t
->blocked
);
1874 recalc_sigpending();
1875 spin_unlock_irq(¤t
->sighand
->siglock
);
1878 /* Check whether the new SID can inherit resource limits
1879 from the old SID. If not, reset all soft limits to
1880 the lower of the current task's hard limit and the init
1881 task's soft limit. Note that the setting of hard limits
1882 (even to lower them) can be controlled by the setrlimit
1883 check. The inclusion of the init task's soft limit into
1884 the computation is to avoid resetting soft limits higher
1885 than the default soft limit for cases where the default
1886 is lower than the hard limit, e.g. RLIMIT_CORE or
1888 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1889 PROCESS__RLIMITINH
, NULL
);
1891 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
1892 rlim
= current
->signal
->rlim
+ i
;
1893 initrlim
= init_task
.signal
->rlim
+i
;
1894 rlim
->rlim_cur
= min(rlim
->rlim_max
,initrlim
->rlim_cur
);
1896 if (current
->signal
->rlim
[RLIMIT_CPU
].rlim_cur
!= RLIM_INFINITY
) {
1898 * This will cause RLIMIT_CPU calculations
1901 current
->it_prof_expires
= jiffies_to_cputime(1);
1905 /* Wake up the parent if it is waiting so that it can
1906 recheck wait permission to the new task SID. */
1907 wake_up_interruptible(¤t
->parent
->signal
->wait_chldexit
);
1910 /* superblock security operations */
1912 static int selinux_sb_alloc_security(struct super_block
*sb
)
1914 return superblock_alloc_security(sb
);
1917 static void selinux_sb_free_security(struct super_block
*sb
)
1919 superblock_free_security(sb
);
1922 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
1927 return !memcmp(prefix
, option
, plen
);
1930 static inline int selinux_option(char *option
, int len
)
1932 return (match_prefix("context=", sizeof("context=")-1, option
, len
) ||
1933 match_prefix("fscontext=", sizeof("fscontext=")-1, option
, len
) ||
1934 match_prefix("defcontext=", sizeof("defcontext=")-1, option
, len
) ||
1935 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option
, len
));
1938 static inline void take_option(char **to
, char *from
, int *first
, int len
)
1946 memcpy(*to
, from
, len
);
1950 static int selinux_sb_copy_data(struct file_system_type
*type
, void *orig
, void *copy
)
1952 int fnosec
, fsec
, rc
= 0;
1953 char *in_save
, *in_curr
, *in_end
;
1954 char *sec_curr
, *nosec_save
, *nosec
;
1959 /* Binary mount data: just copy */
1960 if (type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
1961 copy_page(sec_curr
, in_curr
);
1965 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
1973 in_save
= in_end
= orig
;
1976 if (*in_end
== ',' || *in_end
== '\0') {
1977 int len
= in_end
- in_curr
;
1979 if (selinux_option(in_curr
, len
))
1980 take_option(&sec_curr
, in_curr
, &fsec
, len
);
1982 take_option(&nosec
, in_curr
, &fnosec
, len
);
1984 in_curr
= in_end
+ 1;
1986 } while (*in_end
++);
1988 strcpy(in_save
, nosec_save
);
1989 free_page((unsigned long)nosec_save
);
1994 static int selinux_sb_kern_mount(struct super_block
*sb
, void *data
)
1996 struct avc_audit_data ad
;
1999 rc
= superblock_doinit(sb
, data
);
2003 AVC_AUDIT_DATA_INIT(&ad
,FS
);
2004 ad
.u
.fs
.dentry
= sb
->s_root
;
2005 return superblock_has_perm(current
, sb
, FILESYSTEM__MOUNT
, &ad
);
2008 static int selinux_sb_statfs(struct dentry
*dentry
)
2010 struct avc_audit_data ad
;
2012 AVC_AUDIT_DATA_INIT(&ad
,FS
);
2013 ad
.u
.fs
.dentry
= dentry
->d_sb
->s_root
;
2014 return superblock_has_perm(current
, dentry
->d_sb
, FILESYSTEM__GETATTR
, &ad
);
2017 static int selinux_mount(char * dev_name
,
2018 struct nameidata
*nd
,
2020 unsigned long flags
,
2025 rc
= secondary_ops
->sb_mount(dev_name
, nd
, type
, flags
, data
);
2029 if (flags
& MS_REMOUNT
)
2030 return superblock_has_perm(current
, nd
->mnt
->mnt_sb
,
2031 FILESYSTEM__REMOUNT
, NULL
);
2033 return dentry_has_perm(current
, nd
->mnt
, nd
->dentry
,
2037 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
2041 rc
= secondary_ops
->sb_umount(mnt
, flags
);
2045 return superblock_has_perm(current
,mnt
->mnt_sb
,
2046 FILESYSTEM__UNMOUNT
,NULL
);
2049 /* inode security operations */
2051 static int selinux_inode_alloc_security(struct inode
*inode
)
2053 return inode_alloc_security(inode
);
2056 static void selinux_inode_free_security(struct inode
*inode
)
2058 inode_free_security(inode
);
2061 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
2062 char **name
, void **value
,
2065 struct task_security_struct
*tsec
;
2066 struct inode_security_struct
*dsec
;
2067 struct superblock_security_struct
*sbsec
;
2070 char *namep
= NULL
, *context
;
2072 tsec
= current
->security
;
2073 dsec
= dir
->i_security
;
2074 sbsec
= dir
->i_sb
->s_security
;
2076 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
2077 newsid
= tsec
->create_sid
;
2079 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
,
2080 inode_mode_to_security_class(inode
->i_mode
),
2083 printk(KERN_WARNING
"%s: "
2084 "security_transition_sid failed, rc=%d (dev=%s "
2087 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
2092 inode_security_set_sid(inode
, newsid
);
2094 if (!ss_initialized
|| sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2098 namep
= kstrdup(XATTR_SELINUX_SUFFIX
, GFP_KERNEL
);
2105 rc
= security_sid_to_context(newsid
, &context
, &clen
);
2117 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2119 return may_create(dir
, dentry
, SECCLASS_FILE
);
2122 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2126 rc
= secondary_ops
->inode_link(old_dentry
,dir
,new_dentry
);
2129 return may_link(dir
, old_dentry
, MAY_LINK
);
2132 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2136 rc
= secondary_ops
->inode_unlink(dir
, dentry
);
2139 return may_link(dir
, dentry
, MAY_UNLINK
);
2142 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2144 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2147 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2149 return may_create(dir
, dentry
, SECCLASS_DIR
);
2152 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2154 return may_link(dir
, dentry
, MAY_RMDIR
);
2157 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, int mode
, dev_t dev
)
2161 rc
= secondary_ops
->inode_mknod(dir
, dentry
, mode
, dev
);
2165 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2168 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2169 struct inode
*new_inode
, struct dentry
*new_dentry
)
2171 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2174 static int selinux_inode_readlink(struct dentry
*dentry
)
2176 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2179 static int selinux_inode_follow_link(struct dentry
*dentry
, struct nameidata
*nameidata
)
2183 rc
= secondary_ops
->inode_follow_link(dentry
,nameidata
);
2186 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2189 static int selinux_inode_permission(struct inode
*inode
, int mask
,
2190 struct nameidata
*nd
)
2194 rc
= secondary_ops
->inode_permission(inode
, mask
, nd
);
2199 /* No permission to check. Existence test. */
2203 return inode_has_perm(current
, inode
,
2204 file_mask_to_av(inode
->i_mode
, mask
), NULL
);
2207 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
2211 rc
= secondary_ops
->inode_setattr(dentry
, iattr
);
2215 if (iattr
->ia_valid
& ATTR_FORCE
)
2218 if (iattr
->ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
2219 ATTR_ATIME_SET
| ATTR_MTIME_SET
))
2220 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2222 return dentry_has_perm(current
, NULL
, dentry
, FILE__WRITE
);
2225 static int selinux_inode_getattr(struct vfsmount
*mnt
, struct dentry
*dentry
)
2227 return dentry_has_perm(current
, mnt
, dentry
, FILE__GETATTR
);
2230 static int selinux_inode_setxattr(struct dentry
*dentry
, char *name
, void *value
, size_t size
, int flags
)
2232 struct task_security_struct
*tsec
= current
->security
;
2233 struct inode
*inode
= dentry
->d_inode
;
2234 struct inode_security_struct
*isec
= inode
->i_security
;
2235 struct superblock_security_struct
*sbsec
;
2236 struct avc_audit_data ad
;
2240 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2241 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2242 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2243 !capable(CAP_SYS_ADMIN
)) {
2244 /* A different attribute in the security namespace.
2245 Restrict to administrator. */
2249 /* Not an attribute we recognize, so just check the
2250 ordinary setattr permission. */
2251 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2254 sbsec
= inode
->i_sb
->s_security
;
2255 if (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2258 if ((current
->fsuid
!= inode
->i_uid
) && !capable(CAP_FOWNER
))
2261 AVC_AUDIT_DATA_INIT(&ad
,FS
);
2262 ad
.u
.fs
.dentry
= dentry
;
2264 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
,
2265 FILE__RELABELFROM
, &ad
);
2269 rc
= security_context_to_sid(value
, size
, &newsid
);
2273 rc
= avc_has_perm(tsec
->sid
, newsid
, isec
->sclass
,
2274 FILE__RELABELTO
, &ad
);
2278 rc
= security_validate_transition(isec
->sid
, newsid
, tsec
->sid
,
2283 return avc_has_perm(newsid
,
2285 SECCLASS_FILESYSTEM
,
2286 FILESYSTEM__ASSOCIATE
,
2290 static void selinux_inode_post_setxattr(struct dentry
*dentry
, char *name
,
2291 void *value
, size_t size
, int flags
)
2293 struct inode
*inode
= dentry
->d_inode
;
2294 struct inode_security_struct
*isec
= inode
->i_security
;
2298 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2299 /* Not an attribute we recognize, so nothing to do. */
2303 rc
= security_context_to_sid(value
, size
, &newsid
);
2305 printk(KERN_WARNING
"%s: unable to obtain SID for context "
2306 "%s, rc=%d\n", __FUNCTION__
, (char*)value
, -rc
);
2314 static int selinux_inode_getxattr (struct dentry
*dentry
, char *name
)
2316 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2319 static int selinux_inode_listxattr (struct dentry
*dentry
)
2321 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2324 static int selinux_inode_removexattr (struct dentry
*dentry
, char *name
)
2326 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2327 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2328 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2329 !capable(CAP_SYS_ADMIN
)) {
2330 /* A different attribute in the security namespace.
2331 Restrict to administrator. */
2335 /* Not an attribute we recognize, so just check the
2336 ordinary setattr permission. Might want a separate
2337 permission for removexattr. */
2338 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2341 /* No one is allowed to remove a SELinux security label.
2342 You can change the label, but all data must be labeled. */
2346 static const char *selinux_inode_xattr_getsuffix(void)
2348 return XATTR_SELINUX_SUFFIX
;
2352 * Copy the in-core inode security context value to the user. If the
2353 * getxattr() prior to this succeeded, check to see if we need to
2354 * canonicalize the value to be finally returned to the user.
2356 * Permission check is handled by selinux_inode_getxattr hook.
2358 static int selinux_inode_getsecurity(const struct inode
*inode
, const char *name
, void *buffer
, size_t size
, int err
)
2360 struct inode_security_struct
*isec
= inode
->i_security
;
2362 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2365 return selinux_getsecurity(isec
->sid
, buffer
, size
);
2368 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
2369 const void *value
, size_t size
, int flags
)
2371 struct inode_security_struct
*isec
= inode
->i_security
;
2375 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2378 if (!value
|| !size
)
2381 rc
= security_context_to_sid((void*)value
, size
, &newsid
);
2389 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
2391 const int len
= sizeof(XATTR_NAME_SELINUX
);
2392 if (buffer
&& len
<= buffer_size
)
2393 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
2397 /* file security operations */
2399 static int selinux_file_permission(struct file
*file
, int mask
)
2402 struct inode
*inode
= file
->f_dentry
->d_inode
;
2405 /* No permission to check. Existence test. */
2409 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2410 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
2413 rc
= file_has_perm(current
, file
,
2414 file_mask_to_av(inode
->i_mode
, mask
));
2418 return selinux_netlbl_inode_permission(inode
, mask
);
2421 static int selinux_file_alloc_security(struct file
*file
)
2423 return file_alloc_security(file
);
2426 static void selinux_file_free_security(struct file
*file
)
2428 file_free_security(file
);
2431 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
2443 case EXT2_IOC_GETFLAGS
:
2445 case EXT2_IOC_GETVERSION
:
2446 error
= file_has_perm(current
, file
, FILE__GETATTR
);
2449 case EXT2_IOC_SETFLAGS
:
2451 case EXT2_IOC_SETVERSION
:
2452 error
= file_has_perm(current
, file
, FILE__SETATTR
);
2455 /* sys_ioctl() checks */
2459 error
= file_has_perm(current
, file
, 0);
2464 error
= task_has_capability(current
,CAP_SYS_TTY_CONFIG
);
2467 /* default case assumes that the command will go
2468 * to the file's ioctl() function.
2471 error
= file_has_perm(current
, file
, FILE__IOCTL
);
2477 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
2479 #ifndef CONFIG_PPC32
2480 if ((prot
& PROT_EXEC
) && (!file
|| (!shared
&& (prot
& PROT_WRITE
)))) {
2482 * We are making executable an anonymous mapping or a
2483 * private file mapping that will also be writable.
2484 * This has an additional check.
2486 int rc
= task_has_perm(current
, current
, PROCESS__EXECMEM
);
2493 /* read access is always possible with a mapping */
2494 u32 av
= FILE__READ
;
2496 /* write access only matters if the mapping is shared */
2497 if (shared
&& (prot
& PROT_WRITE
))
2500 if (prot
& PROT_EXEC
)
2501 av
|= FILE__EXECUTE
;
2503 return file_has_perm(current
, file
, av
);
2508 static int selinux_file_mmap(struct file
*file
, unsigned long reqprot
,
2509 unsigned long prot
, unsigned long flags
)
2513 rc
= secondary_ops
->file_mmap(file
, reqprot
, prot
, flags
);
2517 if (selinux_checkreqprot
)
2520 return file_map_prot_check(file
, prot
,
2521 (flags
& MAP_TYPE
) == MAP_SHARED
);
2524 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
2525 unsigned long reqprot
,
2530 rc
= secondary_ops
->file_mprotect(vma
, reqprot
, prot
);
2534 if (selinux_checkreqprot
)
2537 #ifndef CONFIG_PPC32
2538 if ((prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXEC
)) {
2540 if (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
2541 vma
->vm_end
<= vma
->vm_mm
->brk
) {
2542 rc
= task_has_perm(current
, current
,
2544 } else if (!vma
->vm_file
&&
2545 vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
2546 vma
->vm_end
>= vma
->vm_mm
->start_stack
) {
2547 rc
= task_has_perm(current
, current
, PROCESS__EXECSTACK
);
2548 } else if (vma
->vm_file
&& vma
->anon_vma
) {
2550 * We are making executable a file mapping that has
2551 * had some COW done. Since pages might have been
2552 * written, check ability to execute the possibly
2553 * modified content. This typically should only
2554 * occur for text relocations.
2556 rc
= file_has_perm(current
, vma
->vm_file
,
2564 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
2567 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
2569 return file_has_perm(current
, file
, FILE__LOCK
);
2572 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
2579 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2584 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
2585 err
= file_has_perm(current
, file
,FILE__WRITE
);
2594 /* Just check FD__USE permission */
2595 err
= file_has_perm(current
, file
, 0);
2600 #if BITS_PER_LONG == 32
2605 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2609 err
= file_has_perm(current
, file
, FILE__LOCK
);
2616 static int selinux_file_set_fowner(struct file
*file
)
2618 struct task_security_struct
*tsec
;
2619 struct file_security_struct
*fsec
;
2621 tsec
= current
->security
;
2622 fsec
= file
->f_security
;
2623 fsec
->fown_sid
= tsec
->sid
;
2628 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
2629 struct fown_struct
*fown
, int signum
)
2633 struct task_security_struct
*tsec
;
2634 struct file_security_struct
*fsec
;
2636 /* struct fown_struct is never outside the context of a struct file */
2637 file
= (struct file
*)((long)fown
- offsetof(struct file
,f_owner
));
2639 tsec
= tsk
->security
;
2640 fsec
= file
->f_security
;
2643 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
2645 perm
= signal_to_av(signum
);
2647 return avc_has_perm(fsec
->fown_sid
, tsec
->sid
,
2648 SECCLASS_PROCESS
, perm
, NULL
);
2651 static int selinux_file_receive(struct file
*file
)
2653 return file_has_perm(current
, file
, file_to_av(file
));
2656 /* task security operations */
2658 static int selinux_task_create(unsigned long clone_flags
)
2662 rc
= secondary_ops
->task_create(clone_flags
);
2666 return task_has_perm(current
, current
, PROCESS__FORK
);
2669 static int selinux_task_alloc_security(struct task_struct
*tsk
)
2671 struct task_security_struct
*tsec1
, *tsec2
;
2674 tsec1
= current
->security
;
2676 rc
= task_alloc_security(tsk
);
2679 tsec2
= tsk
->security
;
2681 tsec2
->osid
= tsec1
->osid
;
2682 tsec2
->sid
= tsec1
->sid
;
2684 /* Retain the exec, fs, key, and sock SIDs across fork */
2685 tsec2
->exec_sid
= tsec1
->exec_sid
;
2686 tsec2
->create_sid
= tsec1
->create_sid
;
2687 tsec2
->keycreate_sid
= tsec1
->keycreate_sid
;
2688 tsec2
->sockcreate_sid
= tsec1
->sockcreate_sid
;
2690 /* Retain ptracer SID across fork, if any.
2691 This will be reset by the ptrace hook upon any
2692 subsequent ptrace_attach operations. */
2693 tsec2
->ptrace_sid
= tsec1
->ptrace_sid
;
2698 static void selinux_task_free_security(struct task_struct
*tsk
)
2700 task_free_security(tsk
);
2703 static int selinux_task_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2705 /* Since setuid only affects the current process, and
2706 since the SELinux controls are not based on the Linux
2707 identity attributes, SELinux does not need to control
2708 this operation. However, SELinux does control the use
2709 of the CAP_SETUID and CAP_SETGID capabilities using the
2714 static int selinux_task_post_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2716 return secondary_ops
->task_post_setuid(id0
,id1
,id2
,flags
);
2719 static int selinux_task_setgid(gid_t id0
, gid_t id1
, gid_t id2
, int flags
)
2721 /* See the comment for setuid above. */
2725 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
2727 return task_has_perm(current
, p
, PROCESS__SETPGID
);
2730 static int selinux_task_getpgid(struct task_struct
*p
)
2732 return task_has_perm(current
, p
, PROCESS__GETPGID
);
2735 static int selinux_task_getsid(struct task_struct
*p
)
2737 return task_has_perm(current
, p
, PROCESS__GETSESSION
);
2740 static void selinux_task_getsecid(struct task_struct
*p
, u32
*secid
)
2742 selinux_get_task_sid(p
, secid
);
2745 static int selinux_task_setgroups(struct group_info
*group_info
)
2747 /* See the comment for setuid above. */
2751 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
2755 rc
= secondary_ops
->task_setnice(p
, nice
);
2759 return task_has_perm(current
,p
, PROCESS__SETSCHED
);
2762 static int selinux_task_setioprio(struct task_struct
*p
, int ioprio
)
2764 return task_has_perm(current
, p
, PROCESS__SETSCHED
);
2767 static int selinux_task_getioprio(struct task_struct
*p
)
2769 return task_has_perm(current
, p
, PROCESS__GETSCHED
);
2772 static int selinux_task_setrlimit(unsigned int resource
, struct rlimit
*new_rlim
)
2774 struct rlimit
*old_rlim
= current
->signal
->rlim
+ resource
;
2777 rc
= secondary_ops
->task_setrlimit(resource
, new_rlim
);
2781 /* Control the ability to change the hard limit (whether
2782 lowering or raising it), so that the hard limit can
2783 later be used as a safe reset point for the soft limit
2784 upon context transitions. See selinux_bprm_apply_creds. */
2785 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
2786 return task_has_perm(current
, current
, PROCESS__SETRLIMIT
);
2791 static int selinux_task_setscheduler(struct task_struct
*p
, int policy
, struct sched_param
*lp
)
2793 return task_has_perm(current
, p
, PROCESS__SETSCHED
);
2796 static int selinux_task_getscheduler(struct task_struct
*p
)
2798 return task_has_perm(current
, p
, PROCESS__GETSCHED
);
2801 static int selinux_task_movememory(struct task_struct
*p
)
2803 return task_has_perm(current
, p
, PROCESS__SETSCHED
);
2806 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
,
2811 struct task_security_struct
*tsec
;
2813 rc
= secondary_ops
->task_kill(p
, info
, sig
, secid
);
2817 if (info
!= SEND_SIG_NOINFO
&& (is_si_special(info
) || SI_FROMKERNEL(info
)))
2821 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
2823 perm
= signal_to_av(sig
);
2826 rc
= avc_has_perm(secid
, tsec
->sid
, SECCLASS_PROCESS
, perm
, NULL
);
2828 rc
= task_has_perm(current
, p
, perm
);
2832 static int selinux_task_prctl(int option
,
2838 /* The current prctl operations do not appear to require
2839 any SELinux controls since they merely observe or modify
2840 the state of the current process. */
2844 static int selinux_task_wait(struct task_struct
*p
)
2848 perm
= signal_to_av(p
->exit_signal
);
2850 return task_has_perm(p
, current
, perm
);
2853 static void selinux_task_reparent_to_init(struct task_struct
*p
)
2855 struct task_security_struct
*tsec
;
2857 secondary_ops
->task_reparent_to_init(p
);
2860 tsec
->osid
= tsec
->sid
;
2861 tsec
->sid
= SECINITSID_KERNEL
;
2865 static void selinux_task_to_inode(struct task_struct
*p
,
2866 struct inode
*inode
)
2868 struct task_security_struct
*tsec
= p
->security
;
2869 struct inode_security_struct
*isec
= inode
->i_security
;
2871 isec
->sid
= tsec
->sid
;
2872 isec
->initialized
= 1;
2876 /* Returns error only if unable to parse addresses */
2877 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2879 int offset
, ihlen
, ret
= -EINVAL
;
2880 struct iphdr _iph
, *ih
;
2882 offset
= skb
->nh
.raw
- skb
->data
;
2883 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
2887 ihlen
= ih
->ihl
* 4;
2888 if (ihlen
< sizeof(_iph
))
2891 ad
->u
.net
.v4info
.saddr
= ih
->saddr
;
2892 ad
->u
.net
.v4info
.daddr
= ih
->daddr
;
2895 switch (ih
->protocol
) {
2897 struct tcphdr _tcph
, *th
;
2899 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2903 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2907 ad
->u
.net
.sport
= th
->source
;
2908 ad
->u
.net
.dport
= th
->dest
;
2913 struct udphdr _udph
, *uh
;
2915 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2919 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2923 ad
->u
.net
.sport
= uh
->source
;
2924 ad
->u
.net
.dport
= uh
->dest
;
2935 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2937 /* Returns error only if unable to parse addresses */
2938 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2941 int ret
= -EINVAL
, offset
;
2942 struct ipv6hdr _ipv6h
, *ip6
;
2944 offset
= skb
->nh
.raw
- skb
->data
;
2945 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
2949 ipv6_addr_copy(&ad
->u
.net
.v6info
.saddr
, &ip6
->saddr
);
2950 ipv6_addr_copy(&ad
->u
.net
.v6info
.daddr
, &ip6
->daddr
);
2953 nexthdr
= ip6
->nexthdr
;
2954 offset
+= sizeof(_ipv6h
);
2955 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
);
2961 struct tcphdr _tcph
, *th
;
2963 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2967 ad
->u
.net
.sport
= th
->source
;
2968 ad
->u
.net
.dport
= th
->dest
;
2973 struct udphdr _udph
, *uh
;
2975 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2979 ad
->u
.net
.sport
= uh
->source
;
2980 ad
->u
.net
.dport
= uh
->dest
;
2984 /* includes fragments */
2994 static int selinux_parse_skb(struct sk_buff
*skb
, struct avc_audit_data
*ad
,
2995 char **addrp
, int *len
, int src
)
2999 switch (ad
->u
.net
.family
) {
3001 ret
= selinux_parse_skb_ipv4(skb
, ad
);
3005 *addrp
= (char *)(src
? &ad
->u
.net
.v4info
.saddr
:
3006 &ad
->u
.net
.v4info
.daddr
);
3009 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3011 ret
= selinux_parse_skb_ipv6(skb
, ad
);
3015 *addrp
= (char *)(src
? &ad
->u
.net
.v6info
.saddr
:
3016 &ad
->u
.net
.v6info
.daddr
);
3026 /* socket security operations */
3027 static int socket_has_perm(struct task_struct
*task
, struct socket
*sock
,
3030 struct inode_security_struct
*isec
;
3031 struct task_security_struct
*tsec
;
3032 struct avc_audit_data ad
;
3035 tsec
= task
->security
;
3036 isec
= SOCK_INODE(sock
)->i_security
;
3038 if (isec
->sid
== SECINITSID_KERNEL
)
3041 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3042 ad
.u
.net
.sk
= sock
->sk
;
3043 err
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3049 static int selinux_socket_create(int family
, int type
,
3050 int protocol
, int kern
)
3053 struct task_security_struct
*tsec
;
3059 tsec
= current
->security
;
3060 newsid
= tsec
->sockcreate_sid
? : tsec
->sid
;
3061 err
= avc_has_perm(tsec
->sid
, newsid
,
3062 socket_type_to_security_class(family
, type
,
3063 protocol
), SOCKET__CREATE
, NULL
);
3069 static int selinux_socket_post_create(struct socket
*sock
, int family
,
3070 int type
, int protocol
, int kern
)
3073 struct inode_security_struct
*isec
;
3074 struct task_security_struct
*tsec
;
3075 struct sk_security_struct
*sksec
;
3078 isec
= SOCK_INODE(sock
)->i_security
;
3080 tsec
= current
->security
;
3081 newsid
= tsec
->sockcreate_sid
? : tsec
->sid
;
3082 isec
->sclass
= socket_type_to_security_class(family
, type
, protocol
);
3083 isec
->sid
= kern
? SECINITSID_KERNEL
: newsid
;
3084 isec
->initialized
= 1;
3087 sksec
= sock
->sk
->sk_security
;
3088 sksec
->sid
= isec
->sid
;
3089 err
= selinux_netlbl_socket_post_create(sock
,
3097 /* Range of port numbers used to automatically bind.
3098 Need to determine whether we should perform a name_bind
3099 permission check between the socket and the port number. */
3100 #define ip_local_port_range_0 sysctl_local_port_range[0]
3101 #define ip_local_port_range_1 sysctl_local_port_range[1]
3103 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3108 err
= socket_has_perm(current
, sock
, SOCKET__BIND
);
3113 * If PF_INET or PF_INET6, check name_bind permission for the port.
3114 * Multiple address binding for SCTP is not supported yet: we just
3115 * check the first address now.
3117 family
= sock
->sk
->sk_family
;
3118 if (family
== PF_INET
|| family
== PF_INET6
) {
3120 struct inode_security_struct
*isec
;
3121 struct task_security_struct
*tsec
;
3122 struct avc_audit_data ad
;
3123 struct sockaddr_in
*addr4
= NULL
;
3124 struct sockaddr_in6
*addr6
= NULL
;
3125 unsigned short snum
;
3126 struct sock
*sk
= sock
->sk
;
3127 u32 sid
, node_perm
, addrlen
;
3129 tsec
= current
->security
;
3130 isec
= SOCK_INODE(sock
)->i_security
;
3132 if (family
== PF_INET
) {
3133 addr4
= (struct sockaddr_in
*)address
;
3134 snum
= ntohs(addr4
->sin_port
);
3135 addrlen
= sizeof(addr4
->sin_addr
.s_addr
);
3136 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
3138 addr6
= (struct sockaddr_in6
*)address
;
3139 snum
= ntohs(addr6
->sin6_port
);
3140 addrlen
= sizeof(addr6
->sin6_addr
.s6_addr
);
3141 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
3144 if (snum
&&(snum
< max(PROT_SOCK
,ip_local_port_range_0
) ||
3145 snum
> ip_local_port_range_1
)) {
3146 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3147 sk
->sk_protocol
, snum
, &sid
);
3150 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3151 ad
.u
.net
.sport
= htons(snum
);
3152 ad
.u
.net
.family
= family
;
3153 err
= avc_has_perm(isec
->sid
, sid
,
3155 SOCKET__NAME_BIND
, &ad
);
3160 switch(isec
->sclass
) {
3161 case SECCLASS_TCP_SOCKET
:
3162 node_perm
= TCP_SOCKET__NODE_BIND
;
3165 case SECCLASS_UDP_SOCKET
:
3166 node_perm
= UDP_SOCKET__NODE_BIND
;
3170 node_perm
= RAWIP_SOCKET__NODE_BIND
;
3174 err
= security_node_sid(family
, addrp
, addrlen
, &sid
);
3178 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3179 ad
.u
.net
.sport
= htons(snum
);
3180 ad
.u
.net
.family
= family
;
3182 if (family
== PF_INET
)
3183 ad
.u
.net
.v4info
.saddr
= addr4
->sin_addr
.s_addr
;
3185 ipv6_addr_copy(&ad
.u
.net
.v6info
.saddr
, &addr6
->sin6_addr
);
3187 err
= avc_has_perm(isec
->sid
, sid
,
3188 isec
->sclass
, node_perm
, &ad
);
3196 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3198 struct inode_security_struct
*isec
;
3201 err
= socket_has_perm(current
, sock
, SOCKET__CONNECT
);
3206 * If a TCP socket, check name_connect permission for the port.
3208 isec
= SOCK_INODE(sock
)->i_security
;
3209 if (isec
->sclass
== SECCLASS_TCP_SOCKET
) {
3210 struct sock
*sk
= sock
->sk
;
3211 struct avc_audit_data ad
;
3212 struct sockaddr_in
*addr4
= NULL
;
3213 struct sockaddr_in6
*addr6
= NULL
;
3214 unsigned short snum
;
3217 if (sk
->sk_family
== PF_INET
) {
3218 addr4
= (struct sockaddr_in
*)address
;
3219 if (addrlen
< sizeof(struct sockaddr_in
))
3221 snum
= ntohs(addr4
->sin_port
);
3223 addr6
= (struct sockaddr_in6
*)address
;
3224 if (addrlen
< SIN6_LEN_RFC2133
)
3226 snum
= ntohs(addr6
->sin6_port
);
3229 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3230 sk
->sk_protocol
, snum
, &sid
);
3234 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3235 ad
.u
.net
.dport
= htons(snum
);
3236 ad
.u
.net
.family
= sk
->sk_family
;
3237 err
= avc_has_perm(isec
->sid
, sid
, isec
->sclass
,
3238 TCP_SOCKET__NAME_CONNECT
, &ad
);
3247 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
3249 return socket_has_perm(current
, sock
, SOCKET__LISTEN
);
3252 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
3255 struct inode_security_struct
*isec
;
3256 struct inode_security_struct
*newisec
;
3258 err
= socket_has_perm(current
, sock
, SOCKET__ACCEPT
);
3262 newisec
= SOCK_INODE(newsock
)->i_security
;
3264 isec
= SOCK_INODE(sock
)->i_security
;
3265 newisec
->sclass
= isec
->sclass
;
3266 newisec
->sid
= isec
->sid
;
3267 newisec
->initialized
= 1;
3272 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
3277 rc
= socket_has_perm(current
, sock
, SOCKET__WRITE
);
3281 return selinux_netlbl_inode_permission(SOCK_INODE(sock
), MAY_WRITE
);
3284 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
3285 int size
, int flags
)
3287 return socket_has_perm(current
, sock
, SOCKET__READ
);
3290 static int selinux_socket_getsockname(struct socket
*sock
)
3292 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3295 static int selinux_socket_getpeername(struct socket
*sock
)
3297 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3300 static int selinux_socket_setsockopt(struct socket
*sock
,int level
,int optname
)
3302 return socket_has_perm(current
, sock
, SOCKET__SETOPT
);
3305 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
3308 return socket_has_perm(current
, sock
, SOCKET__GETOPT
);
3311 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
3313 return socket_has_perm(current
, sock
, SOCKET__SHUTDOWN
);
3316 static int selinux_socket_unix_stream_connect(struct socket
*sock
,
3317 struct socket
*other
,
3320 struct sk_security_struct
*ssec
;
3321 struct inode_security_struct
*isec
;
3322 struct inode_security_struct
*other_isec
;
3323 struct avc_audit_data ad
;
3326 err
= secondary_ops
->unix_stream_connect(sock
, other
, newsk
);
3330 isec
= SOCK_INODE(sock
)->i_security
;
3331 other_isec
= SOCK_INODE(other
)->i_security
;
3333 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3334 ad
.u
.net
.sk
= other
->sk
;
3336 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3338 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
3342 /* connecting socket */
3343 ssec
= sock
->sk
->sk_security
;
3344 ssec
->peer_sid
= other_isec
->sid
;
3346 /* server child socket */
3347 ssec
= newsk
->sk_security
;
3348 ssec
->peer_sid
= isec
->sid
;
3349 err
= security_sid_mls_copy(other_isec
->sid
, ssec
->peer_sid
, &ssec
->sid
);
3354 static int selinux_socket_unix_may_send(struct socket
*sock
,
3355 struct socket
*other
)
3357 struct inode_security_struct
*isec
;
3358 struct inode_security_struct
*other_isec
;
3359 struct avc_audit_data ad
;
3362 isec
= SOCK_INODE(sock
)->i_security
;
3363 other_isec
= SOCK_INODE(other
)->i_security
;
3365 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3366 ad
.u
.net
.sk
= other
->sk
;
3368 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3369 isec
->sclass
, SOCKET__SENDTO
, &ad
);
3376 static int selinux_sock_rcv_skb_compat(struct sock
*sk
, struct sk_buff
*skb
,
3377 struct avc_audit_data
*ad
, u16 family
, char *addrp
, int len
)
3380 u32 netif_perm
, node_perm
, node_sid
, if_sid
, recv_perm
= 0;
3381 struct socket
*sock
;
3385 read_lock_bh(&sk
->sk_callback_lock
);
3386 sock
= sk
->sk_socket
;
3388 struct inode
*inode
;
3389 inode
= SOCK_INODE(sock
);
3391 struct inode_security_struct
*isec
;
3392 isec
= inode
->i_security
;
3393 sock_sid
= isec
->sid
;
3394 sock_class
= isec
->sclass
;
3397 read_unlock_bh(&sk
->sk_callback_lock
);
3404 err
= sel_netif_sids(skb
->dev
, &if_sid
, NULL
);
3408 switch (sock_class
) {
3409 case SECCLASS_UDP_SOCKET
:
3410 netif_perm
= NETIF__UDP_RECV
;
3411 node_perm
= NODE__UDP_RECV
;
3412 recv_perm
= UDP_SOCKET__RECV_MSG
;
3415 case SECCLASS_TCP_SOCKET
:
3416 netif_perm
= NETIF__TCP_RECV
;
3417 node_perm
= NODE__TCP_RECV
;
3418 recv_perm
= TCP_SOCKET__RECV_MSG
;
3422 netif_perm
= NETIF__RAWIP_RECV
;
3423 node_perm
= NODE__RAWIP_RECV
;
3427 err
= avc_has_perm(sock_sid
, if_sid
, SECCLASS_NETIF
, netif_perm
, ad
);
3431 err
= security_node_sid(family
, addrp
, len
, &node_sid
);
3435 err
= avc_has_perm(sock_sid
, node_sid
, SECCLASS_NODE
, node_perm
, ad
);
3442 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3443 sk
->sk_protocol
, ntohs(ad
->u
.net
.sport
),
3448 err
= avc_has_perm(sock_sid
, port_sid
,
3449 sock_class
, recv_perm
, ad
);
3456 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
3461 struct avc_audit_data ad
;
3462 struct sk_security_struct
*sksec
= sk
->sk_security
;
3464 family
= sk
->sk_family
;
3465 if (family
!= PF_INET
&& family
!= PF_INET6
)
3468 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3469 if (family
== PF_INET6
&& skb
->protocol
== ntohs(ETH_P_IP
))
3472 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3473 ad
.u
.net
.netif
= skb
->dev
? skb
->dev
->name
: "[unknown]";
3474 ad
.u
.net
.family
= family
;
3476 err
= selinux_parse_skb(skb
, &ad
, &addrp
, &len
, 1);
3480 if (selinux_compat_net
)
3481 err
= selinux_sock_rcv_skb_compat(sk
, skb
, &ad
, family
,
3484 err
= avc_has_perm(sksec
->sid
, skb
->secmark
, SECCLASS_PACKET
,
3489 err
= selinux_netlbl_sock_rcv_skb(sksec
, skb
, &ad
);
3493 err
= selinux_xfrm_sock_rcv_skb(sksec
->sid
, skb
, &ad
);
3498 static int selinux_socket_getpeersec_stream(struct socket
*sock
, char __user
*optval
,
3499 int __user
*optlen
, unsigned len
)
3504 struct sk_security_struct
*ssec
;
3505 struct inode_security_struct
*isec
;
3508 isec
= SOCK_INODE(sock
)->i_security
;
3510 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3511 if (isec
->sclass
== SECCLASS_UNIX_STREAM_SOCKET
) {
3512 ssec
= sock
->sk
->sk_security
;
3513 peer_sid
= ssec
->peer_sid
;
3515 else if (isec
->sclass
== SECCLASS_TCP_SOCKET
) {
3516 peer_sid
= selinux_netlbl_socket_getpeersec_stream(sock
);
3517 if (peer_sid
== SECSID_NULL
)
3518 peer_sid
= selinux_socket_getpeer_stream(sock
->sk
);
3519 if (peer_sid
== SECSID_NULL
) {
3529 err
= security_sid_to_context(peer_sid
, &scontext
, &scontext_len
);
3534 if (scontext_len
> len
) {
3539 if (copy_to_user(optval
, scontext
, scontext_len
))
3543 if (put_user(scontext_len
, optlen
))
3551 static int selinux_socket_getpeersec_dgram(struct socket
*sock
, struct sk_buff
*skb
, u32
*secid
)
3553 u32 peer_secid
= SECSID_NULL
;
3556 if (sock
&& (sock
->sk
->sk_family
== PF_UNIX
))
3557 selinux_get_inode_sid(SOCK_INODE(sock
), &peer_secid
);
3559 peer_secid
= selinux_netlbl_socket_getpeersec_dgram(skb
);
3560 if (peer_secid
== SECSID_NULL
)
3561 peer_secid
= selinux_socket_getpeer_dgram(skb
);
3564 if (peer_secid
== SECSID_NULL
)
3566 *secid
= peer_secid
;
3571 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
3573 return sk_alloc_security(sk
, family
, priority
);
3576 static void selinux_sk_free_security(struct sock
*sk
)
3578 sk_free_security(sk
);
3581 static void selinux_sk_clone_security(const struct sock
*sk
, struct sock
*newsk
)
3583 struct sk_security_struct
*ssec
= sk
->sk_security
;
3584 struct sk_security_struct
*newssec
= newsk
->sk_security
;
3586 newssec
->sid
= ssec
->sid
;
3587 newssec
->peer_sid
= ssec
->peer_sid
;
3590 static void selinux_sk_getsecid(struct sock
*sk
, u32
*secid
)
3593 *secid
= SECINITSID_ANY_SOCKET
;
3595 struct sk_security_struct
*sksec
= sk
->sk_security
;
3597 *secid
= sksec
->sid
;
3601 void selinux_sock_graft(struct sock
* sk
, struct socket
*parent
)
3603 struct inode_security_struct
*isec
= SOCK_INODE(parent
)->i_security
;
3604 struct sk_security_struct
*sksec
= sk
->sk_security
;
3606 isec
->sid
= sksec
->sid
;
3608 selinux_netlbl_sock_graft(sk
, parent
);
3611 int selinux_inet_conn_request(struct sock
*sk
, struct sk_buff
*skb
,
3612 struct request_sock
*req
)
3614 struct sk_security_struct
*sksec
= sk
->sk_security
;
3619 newsid
= selinux_netlbl_inet_conn_request(skb
, sksec
->sid
);
3620 if (newsid
!= SECSID_NULL
) {
3621 req
->secid
= newsid
;
3625 err
= selinux_xfrm_decode_session(skb
, &peersid
, 0);
3628 if (peersid
== SECSID_NULL
) {
3629 req
->secid
= sksec
->sid
;
3633 err
= security_sid_mls_copy(sksec
->sid
, peersid
, &newsid
);
3637 req
->secid
= newsid
;
3641 void selinux_inet_csk_clone(struct sock
*newsk
, const struct request_sock
*req
)
3643 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
3645 newsksec
->sid
= req
->secid
;
3646 /* NOTE: Ideally, we should also get the isec->sid for the
3647 new socket in sync, but we don't have the isec available yet.
3648 So we will wait until sock_graft to do it, by which
3649 time it will have been created and available. */
3652 void selinux_req_classify_flow(const struct request_sock
*req
, struct flowi
*fl
)
3654 fl
->secid
= req
->secid
;
3657 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
3661 struct nlmsghdr
*nlh
;
3662 struct socket
*sock
= sk
->sk_socket
;
3663 struct inode_security_struct
*isec
= SOCK_INODE(sock
)->i_security
;
3665 if (skb
->len
< NLMSG_SPACE(0)) {
3669 nlh
= (struct nlmsghdr
*)skb
->data
;
3671 err
= selinux_nlmsg_lookup(isec
->sclass
, nlh
->nlmsg_type
, &perm
);
3673 if (err
== -EINVAL
) {
3674 audit_log(current
->audit_context
, GFP_KERNEL
, AUDIT_SELINUX_ERR
,
3675 "SELinux: unrecognized netlink message"
3676 " type=%hu for sclass=%hu\n",
3677 nlh
->nlmsg_type
, isec
->sclass
);
3678 if (!selinux_enforcing
)
3688 err
= socket_has_perm(current
, sock
, perm
);
3693 #ifdef CONFIG_NETFILTER
3695 static int selinux_ip_postroute_last_compat(struct sock
*sk
, struct net_device
*dev
,
3696 struct avc_audit_data
*ad
,
3697 u16 family
, char *addrp
, int len
)
3700 u32 netif_perm
, node_perm
, node_sid
, if_sid
, send_perm
= 0;
3701 struct socket
*sock
;
3702 struct inode
*inode
;
3703 struct inode_security_struct
*isec
;
3705 sock
= sk
->sk_socket
;
3709 inode
= SOCK_INODE(sock
);
3713 isec
= inode
->i_security
;
3715 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3719 switch (isec
->sclass
) {
3720 case SECCLASS_UDP_SOCKET
:
3721 netif_perm
= NETIF__UDP_SEND
;
3722 node_perm
= NODE__UDP_SEND
;
3723 send_perm
= UDP_SOCKET__SEND_MSG
;
3726 case SECCLASS_TCP_SOCKET
:
3727 netif_perm
= NETIF__TCP_SEND
;
3728 node_perm
= NODE__TCP_SEND
;
3729 send_perm
= TCP_SOCKET__SEND_MSG
;
3733 netif_perm
= NETIF__RAWIP_SEND
;
3734 node_perm
= NODE__RAWIP_SEND
;
3738 err
= avc_has_perm(isec
->sid
, if_sid
, SECCLASS_NETIF
, netif_perm
, ad
);
3742 err
= security_node_sid(family
, addrp
, len
, &node_sid
);
3746 err
= avc_has_perm(isec
->sid
, node_sid
, SECCLASS_NODE
, node_perm
, ad
);
3753 err
= security_port_sid(sk
->sk_family
,
3756 ntohs(ad
->u
.net
.dport
),
3761 err
= avc_has_perm(isec
->sid
, port_sid
, isec
->sclass
,
3768 static unsigned int selinux_ip_postroute_last(unsigned int hooknum
,
3769 struct sk_buff
**pskb
,
3770 const struct net_device
*in
,
3771 const struct net_device
*out
,
3772 int (*okfn
)(struct sk_buff
*),
3778 struct sk_buff
*skb
= *pskb
;
3779 struct avc_audit_data ad
;
3780 struct net_device
*dev
= (struct net_device
*)out
;
3781 struct sk_security_struct
*sksec
;
3787 sksec
= sk
->sk_security
;
3789 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3790 ad
.u
.net
.netif
= dev
->name
;
3791 ad
.u
.net
.family
= family
;
3793 err
= selinux_parse_skb(skb
, &ad
, &addrp
, &len
, 0);
3797 if (selinux_compat_net
)
3798 err
= selinux_ip_postroute_last_compat(sk
, dev
, &ad
,
3799 family
, addrp
, len
);
3801 err
= avc_has_perm(sksec
->sid
, skb
->secmark
, SECCLASS_PACKET
,
3807 err
= selinux_xfrm_postroute_last(sksec
->sid
, skb
, &ad
);
3809 return err
? NF_DROP
: NF_ACCEPT
;
3812 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum
,
3813 struct sk_buff
**pskb
,
3814 const struct net_device
*in
,
3815 const struct net_device
*out
,
3816 int (*okfn
)(struct sk_buff
*))
3818 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET
);
3821 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3823 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum
,
3824 struct sk_buff
**pskb
,
3825 const struct net_device
*in
,
3826 const struct net_device
*out
,
3827 int (*okfn
)(struct sk_buff
*))
3829 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET6
);
3834 #endif /* CONFIG_NETFILTER */
3836 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
3840 err
= secondary_ops
->netlink_send(sk
, skb
);
3844 if (policydb_loaded_version
>= POLICYDB_VERSION_NLCLASS
)
3845 err
= selinux_nlmsg_perm(sk
, skb
);
3850 static int selinux_netlink_recv(struct sk_buff
*skb
, int capability
)
3853 struct avc_audit_data ad
;
3855 err
= secondary_ops
->netlink_recv(skb
, capability
);
3859 AVC_AUDIT_DATA_INIT(&ad
, CAP
);
3860 ad
.u
.cap
= capability
;
3862 return avc_has_perm(NETLINK_CB(skb
).sid
, NETLINK_CB(skb
).sid
,
3863 SECCLASS_CAPABILITY
, CAP_TO_MASK(capability
), &ad
);
3866 static int ipc_alloc_security(struct task_struct
*task
,
3867 struct kern_ipc_perm
*perm
,
3870 struct task_security_struct
*tsec
= task
->security
;
3871 struct ipc_security_struct
*isec
;
3873 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
3877 isec
->sclass
= sclass
;
3878 isec
->ipc_perm
= perm
;
3879 isec
->sid
= tsec
->sid
;
3880 perm
->security
= isec
;
3885 static void ipc_free_security(struct kern_ipc_perm
*perm
)
3887 struct ipc_security_struct
*isec
= perm
->security
;
3888 perm
->security
= NULL
;
3892 static int msg_msg_alloc_security(struct msg_msg
*msg
)
3894 struct msg_security_struct
*msec
;
3896 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
3901 msec
->sid
= SECINITSID_UNLABELED
;
3902 msg
->security
= msec
;
3907 static void msg_msg_free_security(struct msg_msg
*msg
)
3909 struct msg_security_struct
*msec
= msg
->security
;
3911 msg
->security
= NULL
;
3915 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
3918 struct task_security_struct
*tsec
;
3919 struct ipc_security_struct
*isec
;
3920 struct avc_audit_data ad
;
3922 tsec
= current
->security
;
3923 isec
= ipc_perms
->security
;
3925 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3926 ad
.u
.ipc_id
= ipc_perms
->key
;
3928 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3931 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
3933 return msg_msg_alloc_security(msg
);
3936 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
3938 msg_msg_free_security(msg
);
3941 /* message queue security operations */
3942 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
3944 struct task_security_struct
*tsec
;
3945 struct ipc_security_struct
*isec
;
3946 struct avc_audit_data ad
;
3949 rc
= ipc_alloc_security(current
, &msq
->q_perm
, SECCLASS_MSGQ
);
3953 tsec
= current
->security
;
3954 isec
= msq
->q_perm
.security
;
3956 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3957 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3959 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3962 ipc_free_security(&msq
->q_perm
);
3968 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
3970 ipc_free_security(&msq
->q_perm
);
3973 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
3975 struct task_security_struct
*tsec
;
3976 struct ipc_security_struct
*isec
;
3977 struct avc_audit_data ad
;
3979 tsec
= current
->security
;
3980 isec
= msq
->q_perm
.security
;
3982 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3983 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3985 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3986 MSGQ__ASSOCIATE
, &ad
);
3989 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
3997 /* No specific object, just general system-wide information. */
3998 return task_has_system(current
, SYSTEM__IPC_INFO
);
4001 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
4004 perms
= MSGQ__SETATTR
;
4007 perms
= MSGQ__DESTROY
;
4013 err
= ipc_has_perm(&msq
->q_perm
, perms
);
4017 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
4019 struct task_security_struct
*tsec
;
4020 struct ipc_security_struct
*isec
;
4021 struct msg_security_struct
*msec
;
4022 struct avc_audit_data ad
;
4025 tsec
= current
->security
;
4026 isec
= msq
->q_perm
.security
;
4027 msec
= msg
->security
;
4030 * First time through, need to assign label to the message
4032 if (msec
->sid
== SECINITSID_UNLABELED
) {
4034 * Compute new sid based on current process and
4035 * message queue this message will be stored in
4037 rc
= security_transition_sid(tsec
->sid
,
4045 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4046 ad
.u
.ipc_id
= msq
->q_perm
.key
;
4048 /* Can this process write to the queue? */
4049 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
4052 /* Can this process send the message */
4053 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
4054 SECCLASS_MSG
, MSG__SEND
, &ad
);
4056 /* Can the message be put in the queue? */
4057 rc
= avc_has_perm(msec
->sid
, isec
->sid
,
4058 SECCLASS_MSGQ
, MSGQ__ENQUEUE
, &ad
);
4063 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
4064 struct task_struct
*target
,
4065 long type
, int mode
)
4067 struct task_security_struct
*tsec
;
4068 struct ipc_security_struct
*isec
;
4069 struct msg_security_struct
*msec
;
4070 struct avc_audit_data ad
;
4073 tsec
= target
->security
;
4074 isec
= msq
->q_perm
.security
;
4075 msec
= msg
->security
;
4077 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4078 ad
.u
.ipc_id
= msq
->q_perm
.key
;
4080 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
4081 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
4083 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
4084 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
4088 /* Shared Memory security operations */
4089 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
4091 struct task_security_struct
*tsec
;
4092 struct ipc_security_struct
*isec
;
4093 struct avc_audit_data ad
;
4096 rc
= ipc_alloc_security(current
, &shp
->shm_perm
, SECCLASS_SHM
);
4100 tsec
= current
->security
;
4101 isec
= shp
->shm_perm
.security
;
4103 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4104 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
4106 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
4109 ipc_free_security(&shp
->shm_perm
);
4115 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
4117 ipc_free_security(&shp
->shm_perm
);
4120 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
4122 struct task_security_struct
*tsec
;
4123 struct ipc_security_struct
*isec
;
4124 struct avc_audit_data ad
;
4126 tsec
= current
->security
;
4127 isec
= shp
->shm_perm
.security
;
4129 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4130 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
4132 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
4133 SHM__ASSOCIATE
, &ad
);
4136 /* Note, at this point, shp is locked down */
4137 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
4145 /* No specific object, just general system-wide information. */
4146 return task_has_system(current
, SYSTEM__IPC_INFO
);
4149 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
4152 perms
= SHM__SETATTR
;
4159 perms
= SHM__DESTROY
;
4165 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
4169 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
4170 char __user
*shmaddr
, int shmflg
)
4175 rc
= secondary_ops
->shm_shmat(shp
, shmaddr
, shmflg
);
4179 if (shmflg
& SHM_RDONLY
)
4182 perms
= SHM__READ
| SHM__WRITE
;
4184 return ipc_has_perm(&shp
->shm_perm
, perms
);
4187 /* Semaphore security operations */
4188 static int selinux_sem_alloc_security(struct sem_array
*sma
)
4190 struct task_security_struct
*tsec
;
4191 struct ipc_security_struct
*isec
;
4192 struct avc_audit_data ad
;
4195 rc
= ipc_alloc_security(current
, &sma
->sem_perm
, SECCLASS_SEM
);
4199 tsec
= current
->security
;
4200 isec
= sma
->sem_perm
.security
;
4202 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4203 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
4205 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
4208 ipc_free_security(&sma
->sem_perm
);
4214 static void selinux_sem_free_security(struct sem_array
*sma
)
4216 ipc_free_security(&sma
->sem_perm
);
4219 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
4221 struct task_security_struct
*tsec
;
4222 struct ipc_security_struct
*isec
;
4223 struct avc_audit_data ad
;
4225 tsec
= current
->security
;
4226 isec
= sma
->sem_perm
.security
;
4228 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
4229 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
4231 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
4232 SEM__ASSOCIATE
, &ad
);
4235 /* Note, at this point, sma is locked down */
4236 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
4244 /* No specific object, just general system-wide information. */
4245 return task_has_system(current
, SYSTEM__IPC_INFO
);
4249 perms
= SEM__GETATTR
;
4260 perms
= SEM__DESTROY
;
4263 perms
= SEM__SETATTR
;
4267 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
4273 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
4277 static int selinux_sem_semop(struct sem_array
*sma
,
4278 struct sembuf
*sops
, unsigned nsops
, int alter
)
4283 perms
= SEM__READ
| SEM__WRITE
;
4287 return ipc_has_perm(&sma
->sem_perm
, perms
);
4290 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
4296 av
|= IPC__UNIX_READ
;
4298 av
|= IPC__UNIX_WRITE
;
4303 return ipc_has_perm(ipcp
, av
);
4306 /* module stacking operations */
4307 static int selinux_register_security (const char *name
, struct security_operations
*ops
)
4309 if (secondary_ops
!= original_ops
) {
4310 printk(KERN_INFO
"%s: There is already a secondary security "
4311 "module registered.\n", __FUNCTION__
);
4315 secondary_ops
= ops
;
4317 printk(KERN_INFO
"%s: Registering secondary module %s\n",
4324 static int selinux_unregister_security (const char *name
, struct security_operations
*ops
)
4326 if (ops
!= secondary_ops
) {
4327 printk (KERN_INFO
"%s: trying to unregister a security module "
4328 "that is not registered.\n", __FUNCTION__
);
4332 secondary_ops
= original_ops
;
4337 static void selinux_d_instantiate (struct dentry
*dentry
, struct inode
*inode
)
4340 inode_doinit_with_dentry(inode
, dentry
);
4343 static int selinux_getprocattr(struct task_struct
*p
,
4344 char *name
, void *value
, size_t size
)
4346 struct task_security_struct
*tsec
;
4351 error
= task_has_perm(current
, p
, PROCESS__GETATTR
);
4358 if (!strcmp(name
, "current"))
4360 else if (!strcmp(name
, "prev"))
4362 else if (!strcmp(name
, "exec"))
4363 sid
= tsec
->exec_sid
;
4364 else if (!strcmp(name
, "fscreate"))
4365 sid
= tsec
->create_sid
;
4366 else if (!strcmp(name
, "keycreate"))
4367 sid
= tsec
->keycreate_sid
;
4368 else if (!strcmp(name
, "sockcreate"))
4369 sid
= tsec
->sockcreate_sid
;
4376 return selinux_getsecurity(sid
, value
, size
);
4379 static int selinux_setprocattr(struct task_struct
*p
,
4380 char *name
, void *value
, size_t size
)
4382 struct task_security_struct
*tsec
;
4388 /* SELinux only allows a process to change its own
4389 security attributes. */
4394 * Basic control over ability to set these attributes at all.
4395 * current == p, but we'll pass them separately in case the
4396 * above restriction is ever removed.
4398 if (!strcmp(name
, "exec"))
4399 error
= task_has_perm(current
, p
, PROCESS__SETEXEC
);
4400 else if (!strcmp(name
, "fscreate"))
4401 error
= task_has_perm(current
, p
, PROCESS__SETFSCREATE
);
4402 else if (!strcmp(name
, "keycreate"))
4403 error
= task_has_perm(current
, p
, PROCESS__SETKEYCREATE
);
4404 else if (!strcmp(name
, "sockcreate"))
4405 error
= task_has_perm(current
, p
, PROCESS__SETSOCKCREATE
);
4406 else if (!strcmp(name
, "current"))
4407 error
= task_has_perm(current
, p
, PROCESS__SETCURRENT
);
4413 /* Obtain a SID for the context, if one was specified. */
4414 if (size
&& str
[1] && str
[1] != '\n') {
4415 if (str
[size
-1] == '\n') {
4419 error
= security_context_to_sid(value
, size
, &sid
);
4424 /* Permission checking based on the specified context is
4425 performed during the actual operation (execve,
4426 open/mkdir/...), when we know the full context of the
4427 operation. See selinux_bprm_set_security for the execve
4428 checks and may_create for the file creation checks. The
4429 operation will then fail if the context is not permitted. */
4431 if (!strcmp(name
, "exec"))
4432 tsec
->exec_sid
= sid
;
4433 else if (!strcmp(name
, "fscreate"))
4434 tsec
->create_sid
= sid
;
4435 else if (!strcmp(name
, "keycreate")) {
4436 error
= may_create_key(sid
, p
);
4439 tsec
->keycreate_sid
= sid
;
4440 } else if (!strcmp(name
, "sockcreate"))
4441 tsec
->sockcreate_sid
= sid
;
4442 else if (!strcmp(name
, "current")) {
4443 struct av_decision avd
;
4448 /* Only allow single threaded processes to change context */
4449 if (atomic_read(&p
->mm
->mm_users
) != 1) {
4450 struct task_struct
*g
, *t
;
4451 struct mm_struct
*mm
= p
->mm
;
4452 read_lock(&tasklist_lock
);
4453 do_each_thread(g
, t
)
4454 if (t
->mm
== mm
&& t
!= p
) {
4455 read_unlock(&tasklist_lock
);
4458 while_each_thread(g
, t
);
4459 read_unlock(&tasklist_lock
);
4462 /* Check permissions for the transition. */
4463 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
4464 PROCESS__DYNTRANSITION
, NULL
);
4468 /* Check for ptracing, and update the task SID if ok.
4469 Otherwise, leave SID unchanged and fail. */
4471 if (p
->ptrace
& PT_PTRACED
) {
4472 error
= avc_has_perm_noaudit(tsec
->ptrace_sid
, sid
,
4474 PROCESS__PTRACE
, &avd
);
4478 avc_audit(tsec
->ptrace_sid
, sid
, SECCLASS_PROCESS
,
4479 PROCESS__PTRACE
, &avd
, error
, NULL
);
4493 static int selinux_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
4495 return security_sid_to_context(secid
, secdata
, seclen
);
4498 static void selinux_release_secctx(char *secdata
, u32 seclen
)
4506 static int selinux_key_alloc(struct key
*k
, struct task_struct
*tsk
,
4507 unsigned long flags
)
4509 struct task_security_struct
*tsec
= tsk
->security
;
4510 struct key_security_struct
*ksec
;
4512 ksec
= kzalloc(sizeof(struct key_security_struct
), GFP_KERNEL
);
4517 if (tsec
->keycreate_sid
)
4518 ksec
->sid
= tsec
->keycreate_sid
;
4520 ksec
->sid
= tsec
->sid
;
4526 static void selinux_key_free(struct key
*k
)
4528 struct key_security_struct
*ksec
= k
->security
;
4534 static int selinux_key_permission(key_ref_t key_ref
,
4535 struct task_struct
*ctx
,
4539 struct task_security_struct
*tsec
;
4540 struct key_security_struct
*ksec
;
4542 key
= key_ref_to_ptr(key_ref
);
4544 tsec
= ctx
->security
;
4545 ksec
= key
->security
;
4547 /* if no specific permissions are requested, we skip the
4548 permission check. No serious, additional covert channels
4549 appear to be created. */
4553 return avc_has_perm(tsec
->sid
, ksec
->sid
,
4554 SECCLASS_KEY
, perm
, NULL
);
4559 static struct security_operations selinux_ops
= {
4560 .ptrace
= selinux_ptrace
,
4561 .capget
= selinux_capget
,
4562 .capset_check
= selinux_capset_check
,
4563 .capset_set
= selinux_capset_set
,
4564 .sysctl
= selinux_sysctl
,
4565 .capable
= selinux_capable
,
4566 .quotactl
= selinux_quotactl
,
4567 .quota_on
= selinux_quota_on
,
4568 .syslog
= selinux_syslog
,
4569 .vm_enough_memory
= selinux_vm_enough_memory
,
4571 .netlink_send
= selinux_netlink_send
,
4572 .netlink_recv
= selinux_netlink_recv
,
4574 .bprm_alloc_security
= selinux_bprm_alloc_security
,
4575 .bprm_free_security
= selinux_bprm_free_security
,
4576 .bprm_apply_creds
= selinux_bprm_apply_creds
,
4577 .bprm_post_apply_creds
= selinux_bprm_post_apply_creds
,
4578 .bprm_set_security
= selinux_bprm_set_security
,
4579 .bprm_check_security
= selinux_bprm_check_security
,
4580 .bprm_secureexec
= selinux_bprm_secureexec
,
4582 .sb_alloc_security
= selinux_sb_alloc_security
,
4583 .sb_free_security
= selinux_sb_free_security
,
4584 .sb_copy_data
= selinux_sb_copy_data
,
4585 .sb_kern_mount
= selinux_sb_kern_mount
,
4586 .sb_statfs
= selinux_sb_statfs
,
4587 .sb_mount
= selinux_mount
,
4588 .sb_umount
= selinux_umount
,
4590 .inode_alloc_security
= selinux_inode_alloc_security
,
4591 .inode_free_security
= selinux_inode_free_security
,
4592 .inode_init_security
= selinux_inode_init_security
,
4593 .inode_create
= selinux_inode_create
,
4594 .inode_link
= selinux_inode_link
,
4595 .inode_unlink
= selinux_inode_unlink
,
4596 .inode_symlink
= selinux_inode_symlink
,
4597 .inode_mkdir
= selinux_inode_mkdir
,
4598 .inode_rmdir
= selinux_inode_rmdir
,
4599 .inode_mknod
= selinux_inode_mknod
,
4600 .inode_rename
= selinux_inode_rename
,
4601 .inode_readlink
= selinux_inode_readlink
,
4602 .inode_follow_link
= selinux_inode_follow_link
,
4603 .inode_permission
= selinux_inode_permission
,
4604 .inode_setattr
= selinux_inode_setattr
,
4605 .inode_getattr
= selinux_inode_getattr
,
4606 .inode_setxattr
= selinux_inode_setxattr
,
4607 .inode_post_setxattr
= selinux_inode_post_setxattr
,
4608 .inode_getxattr
= selinux_inode_getxattr
,
4609 .inode_listxattr
= selinux_inode_listxattr
,
4610 .inode_removexattr
= selinux_inode_removexattr
,
4611 .inode_xattr_getsuffix
= selinux_inode_xattr_getsuffix
,
4612 .inode_getsecurity
= selinux_inode_getsecurity
,
4613 .inode_setsecurity
= selinux_inode_setsecurity
,
4614 .inode_listsecurity
= selinux_inode_listsecurity
,
4616 .file_permission
= selinux_file_permission
,
4617 .file_alloc_security
= selinux_file_alloc_security
,
4618 .file_free_security
= selinux_file_free_security
,
4619 .file_ioctl
= selinux_file_ioctl
,
4620 .file_mmap
= selinux_file_mmap
,
4621 .file_mprotect
= selinux_file_mprotect
,
4622 .file_lock
= selinux_file_lock
,
4623 .file_fcntl
= selinux_file_fcntl
,
4624 .file_set_fowner
= selinux_file_set_fowner
,
4625 .file_send_sigiotask
= selinux_file_send_sigiotask
,
4626 .file_receive
= selinux_file_receive
,
4628 .task_create
= selinux_task_create
,
4629 .task_alloc_security
= selinux_task_alloc_security
,
4630 .task_free_security
= selinux_task_free_security
,
4631 .task_setuid
= selinux_task_setuid
,
4632 .task_post_setuid
= selinux_task_post_setuid
,
4633 .task_setgid
= selinux_task_setgid
,
4634 .task_setpgid
= selinux_task_setpgid
,
4635 .task_getpgid
= selinux_task_getpgid
,
4636 .task_getsid
= selinux_task_getsid
,
4637 .task_getsecid
= selinux_task_getsecid
,
4638 .task_setgroups
= selinux_task_setgroups
,
4639 .task_setnice
= selinux_task_setnice
,
4640 .task_setioprio
= selinux_task_setioprio
,
4641 .task_getioprio
= selinux_task_getioprio
,
4642 .task_setrlimit
= selinux_task_setrlimit
,
4643 .task_setscheduler
= selinux_task_setscheduler
,
4644 .task_getscheduler
= selinux_task_getscheduler
,
4645 .task_movememory
= selinux_task_movememory
,
4646 .task_kill
= selinux_task_kill
,
4647 .task_wait
= selinux_task_wait
,
4648 .task_prctl
= selinux_task_prctl
,
4649 .task_reparent_to_init
= selinux_task_reparent_to_init
,
4650 .task_to_inode
= selinux_task_to_inode
,
4652 .ipc_permission
= selinux_ipc_permission
,
4654 .msg_msg_alloc_security
= selinux_msg_msg_alloc_security
,
4655 .msg_msg_free_security
= selinux_msg_msg_free_security
,
4657 .msg_queue_alloc_security
= selinux_msg_queue_alloc_security
,
4658 .msg_queue_free_security
= selinux_msg_queue_free_security
,
4659 .msg_queue_associate
= selinux_msg_queue_associate
,
4660 .msg_queue_msgctl
= selinux_msg_queue_msgctl
,
4661 .msg_queue_msgsnd
= selinux_msg_queue_msgsnd
,
4662 .msg_queue_msgrcv
= selinux_msg_queue_msgrcv
,
4664 .shm_alloc_security
= selinux_shm_alloc_security
,
4665 .shm_free_security
= selinux_shm_free_security
,
4666 .shm_associate
= selinux_shm_associate
,
4667 .shm_shmctl
= selinux_shm_shmctl
,
4668 .shm_shmat
= selinux_shm_shmat
,
4670 .sem_alloc_security
= selinux_sem_alloc_security
,
4671 .sem_free_security
= selinux_sem_free_security
,
4672 .sem_associate
= selinux_sem_associate
,
4673 .sem_semctl
= selinux_sem_semctl
,
4674 .sem_semop
= selinux_sem_semop
,
4676 .register_security
= selinux_register_security
,
4677 .unregister_security
= selinux_unregister_security
,
4679 .d_instantiate
= selinux_d_instantiate
,
4681 .getprocattr
= selinux_getprocattr
,
4682 .setprocattr
= selinux_setprocattr
,
4684 .secid_to_secctx
= selinux_secid_to_secctx
,
4685 .release_secctx
= selinux_release_secctx
,
4687 .unix_stream_connect
= selinux_socket_unix_stream_connect
,
4688 .unix_may_send
= selinux_socket_unix_may_send
,
4690 .socket_create
= selinux_socket_create
,
4691 .socket_post_create
= selinux_socket_post_create
,
4692 .socket_bind
= selinux_socket_bind
,
4693 .socket_connect
= selinux_socket_connect
,
4694 .socket_listen
= selinux_socket_listen
,
4695 .socket_accept
= selinux_socket_accept
,
4696 .socket_sendmsg
= selinux_socket_sendmsg
,
4697 .socket_recvmsg
= selinux_socket_recvmsg
,
4698 .socket_getsockname
= selinux_socket_getsockname
,
4699 .socket_getpeername
= selinux_socket_getpeername
,
4700 .socket_getsockopt
= selinux_socket_getsockopt
,
4701 .socket_setsockopt
= selinux_socket_setsockopt
,
4702 .socket_shutdown
= selinux_socket_shutdown
,
4703 .socket_sock_rcv_skb
= selinux_socket_sock_rcv_skb
,
4704 .socket_getpeersec_stream
= selinux_socket_getpeersec_stream
,
4705 .socket_getpeersec_dgram
= selinux_socket_getpeersec_dgram
,
4706 .sk_alloc_security
= selinux_sk_alloc_security
,
4707 .sk_free_security
= selinux_sk_free_security
,
4708 .sk_clone_security
= selinux_sk_clone_security
,
4709 .sk_getsecid
= selinux_sk_getsecid
,
4710 .sock_graft
= selinux_sock_graft
,
4711 .inet_conn_request
= selinux_inet_conn_request
,
4712 .inet_csk_clone
= selinux_inet_csk_clone
,
4713 .req_classify_flow
= selinux_req_classify_flow
,
4715 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4716 .xfrm_policy_alloc_security
= selinux_xfrm_policy_alloc
,
4717 .xfrm_policy_clone_security
= selinux_xfrm_policy_clone
,
4718 .xfrm_policy_free_security
= selinux_xfrm_policy_free
,
4719 .xfrm_policy_delete_security
= selinux_xfrm_policy_delete
,
4720 .xfrm_state_alloc_security
= selinux_xfrm_state_alloc
,
4721 .xfrm_state_free_security
= selinux_xfrm_state_free
,
4722 .xfrm_state_delete_security
= selinux_xfrm_state_delete
,
4723 .xfrm_policy_lookup
= selinux_xfrm_policy_lookup
,
4724 .xfrm_state_pol_flow_match
= selinux_xfrm_state_pol_flow_match
,
4725 .xfrm_flow_state_match
= selinux_xfrm_flow_state_match
,
4726 .xfrm_decode_session
= selinux_xfrm_decode_session
,
4730 .key_alloc
= selinux_key_alloc
,
4731 .key_free
= selinux_key_free
,
4732 .key_permission
= selinux_key_permission
,
4736 static __init
int selinux_init(void)
4738 struct task_security_struct
*tsec
;
4740 if (!selinux_enabled
) {
4741 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
4745 printk(KERN_INFO
"SELinux: Initializing.\n");
4747 /* Set the security state for the initial task. */
4748 if (task_alloc_security(current
))
4749 panic("SELinux: Failed to initialize initial task.\n");
4750 tsec
= current
->security
;
4751 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
4753 sel_inode_cache
= kmem_cache_create("selinux_inode_security",
4754 sizeof(struct inode_security_struct
),
4755 0, SLAB_PANIC
, NULL
, NULL
);
4758 original_ops
= secondary_ops
= security_ops
;
4760 panic ("SELinux: No initial security operations\n");
4761 if (register_security (&selinux_ops
))
4762 panic("SELinux: Unable to register with kernel.\n");
4764 if (selinux_enforcing
) {
4765 printk(KERN_INFO
"SELinux: Starting in enforcing mode\n");
4767 printk(KERN_INFO
"SELinux: Starting in permissive mode\n");
4771 /* Add security information to initial keyrings */
4772 selinux_key_alloc(&root_user_keyring
, current
,
4773 KEY_ALLOC_NOT_IN_QUOTA
);
4774 selinux_key_alloc(&root_session_keyring
, current
,
4775 KEY_ALLOC_NOT_IN_QUOTA
);
4781 void selinux_complete_init(void)
4783 printk(KERN_INFO
"SELinux: Completing initialization.\n");
4785 /* Set up any superblocks initialized prior to the policy load. */
4786 printk(KERN_INFO
"SELinux: Setting up existing superblocks.\n");
4787 spin_lock(&sb_lock
);
4788 spin_lock(&sb_security_lock
);
4790 if (!list_empty(&superblock_security_head
)) {
4791 struct superblock_security_struct
*sbsec
=
4792 list_entry(superblock_security_head
.next
,
4793 struct superblock_security_struct
,
4795 struct super_block
*sb
= sbsec
->sb
;
4797 spin_unlock(&sb_security_lock
);
4798 spin_unlock(&sb_lock
);
4799 down_read(&sb
->s_umount
);
4801 superblock_doinit(sb
, NULL
);
4803 spin_lock(&sb_lock
);
4804 spin_lock(&sb_security_lock
);
4805 list_del_init(&sbsec
->list
);
4808 spin_unlock(&sb_security_lock
);
4809 spin_unlock(&sb_lock
);
4812 /* SELinux requires early initialization in order to label
4813 all processes and objects when they are created. */
4814 security_initcall(selinux_init
);
4816 #if defined(CONFIG_NETFILTER)
4818 static struct nf_hook_ops selinux_ipv4_op
= {
4819 .hook
= selinux_ipv4_postroute_last
,
4820 .owner
= THIS_MODULE
,
4822 .hooknum
= NF_IP_POST_ROUTING
,
4823 .priority
= NF_IP_PRI_SELINUX_LAST
,
4826 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4828 static struct nf_hook_ops selinux_ipv6_op
= {
4829 .hook
= selinux_ipv6_postroute_last
,
4830 .owner
= THIS_MODULE
,
4832 .hooknum
= NF_IP6_POST_ROUTING
,
4833 .priority
= NF_IP6_PRI_SELINUX_LAST
,
4838 static int __init
selinux_nf_ip_init(void)
4842 if (!selinux_enabled
)
4845 printk(KERN_INFO
"SELinux: Registering netfilter hooks\n");
4847 err
= nf_register_hook(&selinux_ipv4_op
);
4849 panic("SELinux: nf_register_hook for IPv4: error %d\n", err
);
4851 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4853 err
= nf_register_hook(&selinux_ipv6_op
);
4855 panic("SELinux: nf_register_hook for IPv6: error %d\n", err
);
4863 __initcall(selinux_nf_ip_init
);
4865 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4866 static void selinux_nf_ip_exit(void)
4868 printk(KERN_INFO
"SELinux: Unregistering netfilter hooks\n");
4870 nf_unregister_hook(&selinux_ipv4_op
);
4871 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4872 nf_unregister_hook(&selinux_ipv6_op
);
4877 #else /* CONFIG_NETFILTER */
4879 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4880 #define selinux_nf_ip_exit()
4883 #endif /* CONFIG_NETFILTER */
4885 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4886 int selinux_disable(void)
4888 extern void exit_sel_fs(void);
4889 static int selinux_disabled
= 0;
4891 if (ss_initialized
) {
4892 /* Not permitted after initial policy load. */
4896 if (selinux_disabled
) {
4897 /* Only do this once. */
4901 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
4903 selinux_disabled
= 1;
4904 selinux_enabled
= 0;
4906 /* Reset security_ops to the secondary module, dummy or capability. */
4907 security_ops
= secondary_ops
;
4909 /* Unregister netfilter hooks. */
4910 selinux_nf_ip_exit();
4912 /* Unregister selinuxfs. */