projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'picoxcell/timer' into next/timer
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/net_namespace.h>
56 #include <net/netlabel.h>
57 #include <linux/uaccess.h>
58 #include <asm/ioctls.h>
59 #include <linux/atomic.h>
60 #include <linux/bitops.h>
61 #include <linux/interrupt.h>
62 #include <linux/netdevice.h> /* for network interface checks */
63 #include <linux/netlink.h>
64 #include <linux/tcp.h>
65 #include <linux/udp.h>
66 #include <linux/dccp.h>
67 #include <linux/quota.h>
68 #include <linux/un.h> /* for Unix socket types */
69 #include <net/af_unix.h> /* for Unix socket types */
70 #include <linux/parser.h>
71 #include <linux/nfs_mount.h>
72 #include <net/ipv6.h>
73 #include <linux/hugetlb.h>
74 #include <linux/personality.h>
75 #include <linux/audit.h>
76 #include <linux/string.h>
77 #include <linux/selinux.h>
78 #include <linux/mutex.h>
79 #include <linux/posix-timers.h>
80 #include <linux/syslog.h>
81 #include <linux/user_namespace.h>
82 #include <linux/export.h>
83 #include <linux/msg.h>
84 #include <linux/shm.h>
85
86 #include "avc.h"
87 #include "objsec.h"
88 #include "netif.h"
89 #include "netnode.h"
90 #include "netport.h"
91 #include "xfrm.h"
92 #include "netlabel.h"
93 #include "audit.h"
94 #include "avc_ss.h"
95
96 #define NUM_SEL_MNT_OPTS 5
97
98 extern struct security_operations *security_ops;
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!strict_strtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!strict_strtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132
133 /**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled.
141 *
142 */
143 static int selinux_secmark_enabled(void)
144 {
145 return (atomic_read(&selinux_secmark_refcount) > 0);
146 }
147
148 /*
149 * initialise the security for the init task
150 */
151 static void cred_init_security(void)
152 {
153 struct cred *cred = (struct cred *) current->real_cred;
154 struct task_security_struct *tsec;
155
156 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
157 if (!tsec)
158 panic("SELinux: Failed to initialize initial task.\n");
159
160 tsec->osid = tsec->sid = SECINITSID_KERNEL;
161 cred->security = tsec;
162 }
163
164 /*
165 * get the security ID of a set of credentials
166 */
167 static inline u32 cred_sid(const struct cred *cred)
168 {
169 const struct task_security_struct *tsec;
170
171 tsec = cred->security;
172 return tsec->sid;
173 }
174
175 /*
176 * get the objective security ID of a task
177 */
178 static inline u32 task_sid(const struct task_struct *task)
179 {
180 u32 sid;
181
182 rcu_read_lock();
183 sid = cred_sid(__task_cred(task));
184 rcu_read_unlock();
185 return sid;
186 }
187
188 /*
189 * get the subjective security ID of the current task
190 */
191 static inline u32 current_sid(void)
192 {
193 const struct task_security_struct *tsec = current_security();
194
195 return tsec->sid;
196 }
197
198 /* Allocate and free functions for each kind of security blob. */
199
200 static int inode_alloc_security(struct inode *inode)
201 {
202 struct inode_security_struct *isec;
203 u32 sid = current_sid();
204
205 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
206 if (!isec)
207 return -ENOMEM;
208
209 mutex_init(&isec->lock);
210 INIT_LIST_HEAD(&isec->list);
211 isec->inode = inode;
212 isec->sid = SECINITSID_UNLABELED;
213 isec->sclass = SECCLASS_FILE;
214 isec->task_sid = sid;
215 inode->i_security = isec;
216
217 return 0;
218 }
219
220 static void inode_free_security(struct inode *inode)
221 {
222 struct inode_security_struct *isec = inode->i_security;
223 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
224
225 spin_lock(&sbsec->isec_lock);
226 if (!list_empty(&isec->list))
227 list_del_init(&isec->list);
228 spin_unlock(&sbsec->isec_lock);
229
230 inode->i_security = NULL;
231 kmem_cache_free(sel_inode_cache, isec);
232 }
233
234 static int file_alloc_security(struct file *file)
235 {
236 struct file_security_struct *fsec;
237 u32 sid = current_sid();
238
239 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
240 if (!fsec)
241 return -ENOMEM;
242
243 fsec->sid = sid;
244 fsec->fown_sid = sid;
245 file->f_security = fsec;
246
247 return 0;
248 }
249
250 static void file_free_security(struct file *file)
251 {
252 struct file_security_struct *fsec = file->f_security;
253 file->f_security = NULL;
254 kfree(fsec);
255 }
256
257 static int superblock_alloc_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec;
260
261 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
262 if (!sbsec)
263 return -ENOMEM;
264
265 mutex_init(&sbsec->lock);
266 INIT_LIST_HEAD(&sbsec->isec_head);
267 spin_lock_init(&sbsec->isec_lock);
268 sbsec->sb = sb;
269 sbsec->sid = SECINITSID_UNLABELED;
270 sbsec->def_sid = SECINITSID_FILE;
271 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
272 sb->s_security = sbsec;
273
274 return 0;
275 }
276
277 static void superblock_free_security(struct super_block *sb)
278 {
279 struct superblock_security_struct *sbsec = sb->s_security;
280 sb->s_security = NULL;
281 kfree(sbsec);
282 }
283
284 /* The file system's label must be initialized prior to use. */
285
286 static const char *labeling_behaviors[6] = {
287 "uses xattr",
288 "uses transition SIDs",
289 "uses task SIDs",
290 "uses genfs_contexts",
291 "not configured for labeling",
292 "uses mountpoint labeling",
293 };
294
295 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
296
297 static inline int inode_doinit(struct inode *inode)
298 {
299 return inode_doinit_with_dentry(inode, NULL);
300 }
301
302 enum {
303 Opt_error = -1,
304 Opt_context = 1,
305 Opt_fscontext = 2,
306 Opt_defcontext = 3,
307 Opt_rootcontext = 4,
308 Opt_labelsupport = 5,
309 };
310
311 static const match_table_t tokens = {
312 {Opt_context, CONTEXT_STR "%s"},
313 {Opt_fscontext, FSCONTEXT_STR "%s"},
314 {Opt_defcontext, DEFCONTEXT_STR "%s"},
315 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
316 {Opt_labelsupport, LABELSUPP_STR},
317 {Opt_error, NULL},
318 };
319
320 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
321
322 static int may_context_mount_sb_relabel(u32 sid,
323 struct superblock_security_struct *sbsec,
324 const struct cred *cred)
325 {
326 const struct task_security_struct *tsec = cred->security;
327 int rc;
328
329 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
330 FILESYSTEM__RELABELFROM, NULL);
331 if (rc)
332 return rc;
333
334 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
335 FILESYSTEM__RELABELTO, NULL);
336 return rc;
337 }
338
339 static int may_context_mount_inode_relabel(u32 sid,
340 struct superblock_security_struct *sbsec,
341 const struct cred *cred)
342 {
343 const struct task_security_struct *tsec = cred->security;
344 int rc;
345 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELFROM, NULL);
347 if (rc)
348 return rc;
349
350 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
351 FILESYSTEM__ASSOCIATE, NULL);
352 return rc;
353 }
354
355 static int sb_finish_set_opts(struct super_block *sb)
356 {
357 struct superblock_security_struct *sbsec = sb->s_security;
358 struct dentry *root = sb->s_root;
359 struct inode *root_inode = root->d_inode;
360 int rc = 0;
361
362 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
363 /* Make sure that the xattr handler exists and that no
364 error other than -ENODATA is returned by getxattr on
365 the root directory. -ENODATA is ok, as this may be
366 the first boot of the SELinux kernel before we have
367 assigned xattr values to the filesystem. */
368 if (!root_inode->i_op->getxattr) {
369 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
370 "xattr support\n", sb->s_id, sb->s_type->name);
371 rc = -EOPNOTSUPP;
372 goto out;
373 }
374 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
375 if (rc < 0 && rc != -ENODATA) {
376 if (rc == -EOPNOTSUPP)
377 printk(KERN_WARNING "SELinux: (dev %s, type "
378 "%s) has no security xattr handler\n",
379 sb->s_id, sb->s_type->name);
380 else
381 printk(KERN_WARNING "SELinux: (dev %s, type "
382 "%s) getxattr errno %d\n", sb->s_id,
383 sb->s_type->name, -rc);
384 goto out;
385 }
386 }
387
388 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
389
390 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
391 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
392 sb->s_id, sb->s_type->name);
393 else
394 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
395 sb->s_id, sb->s_type->name,
396 labeling_behaviors[sbsec->behavior-1]);
397
398 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
399 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
400 sbsec->behavior == SECURITY_FS_USE_NONE ||
401 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
402 sbsec->flags &= ~SE_SBLABELSUPP;
403
404 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
405 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
406 sbsec->flags |= SE_SBLABELSUPP;
407
408 /* Initialize the root inode. */
409 rc = inode_doinit_with_dentry(root_inode, root);
410
411 /* Initialize any other inodes associated with the superblock, e.g.
412 inodes created prior to initial policy load or inodes created
413 during get_sb by a pseudo filesystem that directly
414 populates itself. */
415 spin_lock(&sbsec->isec_lock);
416 next_inode:
417 if (!list_empty(&sbsec->isec_head)) {
418 struct inode_security_struct *isec =
419 list_entry(sbsec->isec_head.next,
420 struct inode_security_struct, list);
421 struct inode *inode = isec->inode;
422 spin_unlock(&sbsec->isec_lock);
423 inode = igrab(inode);
424 if (inode) {
425 if (!IS_PRIVATE(inode))
426 inode_doinit(inode);
427 iput(inode);
428 }
429 spin_lock(&sbsec->isec_lock);
430 list_del_init(&isec->list);
431 goto next_inode;
432 }
433 spin_unlock(&sbsec->isec_lock);
434 out:
435 return rc;
436 }
437
438 /*
439 * This function should allow an FS to ask what it's mount security
440 * options were so it can use those later for submounts, displaying
441 * mount options, or whatever.
442 */
443 static int selinux_get_mnt_opts(const struct super_block *sb,
444 struct security_mnt_opts *opts)
445 {
446 int rc = 0, i;
447 struct superblock_security_struct *sbsec = sb->s_security;
448 char *context = NULL;
449 u32 len;
450 char tmp;
451
452 security_init_mnt_opts(opts);
453
454 if (!(sbsec->flags & SE_SBINITIALIZED))
455 return -EINVAL;
456
457 if (!ss_initialized)
458 return -EINVAL;
459
460 tmp = sbsec->flags & SE_MNTMASK;
461 /* count the number of mount options for this sb */
462 for (i = 0; i < 8; i++) {
463 if (tmp & 0x01)
464 opts->num_mnt_opts++;
465 tmp >>= 1;
466 }
467 /* Check if the Label support flag is set */
468 if (sbsec->flags & SE_SBLABELSUPP)
469 opts->num_mnt_opts++;
470
471 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
472 if (!opts->mnt_opts) {
473 rc = -ENOMEM;
474 goto out_free;
475 }
476
477 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
478 if (!opts->mnt_opts_flags) {
479 rc = -ENOMEM;
480 goto out_free;
481 }
482
483 i = 0;
484 if (sbsec->flags & FSCONTEXT_MNT) {
485 rc = security_sid_to_context(sbsec->sid, &context, &len);
486 if (rc)
487 goto out_free;
488 opts->mnt_opts[i] = context;
489 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
490 }
491 if (sbsec->flags & CONTEXT_MNT) {
492 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
493 if (rc)
494 goto out_free;
495 opts->mnt_opts[i] = context;
496 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
497 }
498 if (sbsec->flags & DEFCONTEXT_MNT) {
499 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
500 if (rc)
501 goto out_free;
502 opts->mnt_opts[i] = context;
503 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
504 }
505 if (sbsec->flags & ROOTCONTEXT_MNT) {
506 struct inode *root = sbsec->sb->s_root->d_inode;
507 struct inode_security_struct *isec = root->i_security;
508
509 rc = security_sid_to_context(isec->sid, &context, &len);
510 if (rc)
511 goto out_free;
512 opts->mnt_opts[i] = context;
513 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
514 }
515 if (sbsec->flags & SE_SBLABELSUPP) {
516 opts->mnt_opts[i] = NULL;
517 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
518 }
519
520 BUG_ON(i != opts->num_mnt_opts);
521
522 return 0;
523
524 out_free:
525 security_free_mnt_opts(opts);
526 return rc;
527 }
528
529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
530 u32 old_sid, u32 new_sid)
531 {
532 char mnt_flags = sbsec->flags & SE_MNTMASK;
533
534 /* check if the old mount command had the same options */
535 if (sbsec->flags & SE_SBINITIALIZED)
536 if (!(sbsec->flags & flag) ||
537 (old_sid != new_sid))
538 return 1;
539
540 /* check if we were passed the same options twice,
541 * aka someone passed context=a,context=b
542 */
543 if (!(sbsec->flags & SE_SBINITIALIZED))
544 if (mnt_flags & flag)
545 return 1;
546 return 0;
547 }
548
549 /*
550 * Allow filesystems with binary mount data to explicitly set mount point
551 * labeling information.
552 */
553 static int selinux_set_mnt_opts(struct super_block *sb,
554 struct security_mnt_opts *opts)
555 {
556 const struct cred *cred = current_cred();
557 int rc = 0, i;
558 struct superblock_security_struct *sbsec = sb->s_security;
559 const char *name = sb->s_type->name;
560 struct inode *inode = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *root_isec = inode->i_security;
562 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
563 u32 defcontext_sid = 0;
564 char **mount_options = opts->mnt_opts;
565 int *flags = opts->mnt_opts_flags;
566 int num_opts = opts->num_mnt_opts;
567
568 mutex_lock(&sbsec->lock);
569
570 if (!ss_initialized) {
571 if (!num_opts) {
572 /* Defer initialization until selinux_complete_init,
573 after the initial policy is loaded and the security
574 server is ready to handle calls. */
575 goto out;
576 }
577 rc = -EINVAL;
578 printk(KERN_WARNING "SELinux: Unable to set superblock options "
579 "before the security server is initialized\n");
580 goto out;
581 }
582
583 /*
584 * Binary mount data FS will come through this function twice. Once
585 * from an explicit call and once from the generic calls from the vfs.
586 * Since the generic VFS calls will not contain any security mount data
587 * we need to skip the double mount verification.
588 *
589 * This does open a hole in which we will not notice if the first
590 * mount using this sb set explict options and a second mount using
591 * this sb does not set any security options. (The first options
592 * will be used for both mounts)
593 */
594 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
595 && (num_opts == 0))
596 goto out;
597
598 /*
599 * parse the mount options, check if they are valid sids.
600 * also check if someone is trying to mount the same sb more
601 * than once with different security options.
602 */
603 for (i = 0; i < num_opts; i++) {
604 u32 sid;
605
606 if (flags[i] == SE_SBLABELSUPP)
607 continue;
608 rc = security_context_to_sid(mount_options[i],
609 strlen(mount_options[i]), &sid);
610 if (rc) {
611 printk(KERN_WARNING "SELinux: security_context_to_sid"
612 "(%s) failed for (dev %s, type %s) errno=%d\n",
613 mount_options[i], sb->s_id, name, rc);
614 goto out;
615 }
616 switch (flags[i]) {
617 case FSCONTEXT_MNT:
618 fscontext_sid = sid;
619
620 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
621 fscontext_sid))
622 goto out_double_mount;
623
624 sbsec->flags |= FSCONTEXT_MNT;
625 break;
626 case CONTEXT_MNT:
627 context_sid = sid;
628
629 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
630 context_sid))
631 goto out_double_mount;
632
633 sbsec->flags |= CONTEXT_MNT;
634 break;
635 case ROOTCONTEXT_MNT:
636 rootcontext_sid = sid;
637
638 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
639 rootcontext_sid))
640 goto out_double_mount;
641
642 sbsec->flags |= ROOTCONTEXT_MNT;
643
644 break;
645 case DEFCONTEXT_MNT:
646 defcontext_sid = sid;
647
648 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
649 defcontext_sid))
650 goto out_double_mount;
651
652 sbsec->flags |= DEFCONTEXT_MNT;
653
654 break;
655 default:
656 rc = -EINVAL;
657 goto out;
658 }
659 }
660
661 if (sbsec->flags & SE_SBINITIALIZED) {
662 /* previously mounted with options, but not on this attempt? */
663 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
664 goto out_double_mount;
665 rc = 0;
666 goto out;
667 }
668
669 if (strcmp(sb->s_type->name, "proc") == 0)
670 sbsec->flags |= SE_SBPROC;
671
672 /* Determine the labeling behavior to use for this filesystem type. */
673 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
674 if (rc) {
675 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
676 __func__, sb->s_type->name, rc);
677 goto out;
678 }
679
680 /* sets the context of the superblock for the fs being mounted. */
681 if (fscontext_sid) {
682 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
683 if (rc)
684 goto out;
685
686 sbsec->sid = fscontext_sid;
687 }
688
689 /*
690 * Switch to using mount point labeling behavior.
691 * sets the label used on all file below the mountpoint, and will set
692 * the superblock context if not already set.
693 */
694 if (context_sid) {
695 if (!fscontext_sid) {
696 rc = may_context_mount_sb_relabel(context_sid, sbsec,
697 cred);
698 if (rc)
699 goto out;
700 sbsec->sid = context_sid;
701 } else {
702 rc = may_context_mount_inode_relabel(context_sid, sbsec,
703 cred);
704 if (rc)
705 goto out;
706 }
707 if (!rootcontext_sid)
708 rootcontext_sid = context_sid;
709
710 sbsec->mntpoint_sid = context_sid;
711 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
712 }
713
714 if (rootcontext_sid) {
715 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
716 cred);
717 if (rc)
718 goto out;
719
720 root_isec->sid = rootcontext_sid;
721 root_isec->initialized = 1;
722 }
723
724 if (defcontext_sid) {
725 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
726 rc = -EINVAL;
727 printk(KERN_WARNING "SELinux: defcontext option is "
728 "invalid for this filesystem type\n");
729 goto out;
730 }
731
732 if (defcontext_sid != sbsec->def_sid) {
733 rc = may_context_mount_inode_relabel(defcontext_sid,
734 sbsec, cred);
735 if (rc)
736 goto out;
737 }
738
739 sbsec->def_sid = defcontext_sid;
740 }
741
742 rc = sb_finish_set_opts(sb);
743 out:
744 mutex_unlock(&sbsec->lock);
745 return rc;
746 out_double_mount:
747 rc = -EINVAL;
748 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
749 "security settings for (dev %s, type %s)\n", sb->s_id, name);
750 goto out;
751 }
752
753 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
754 struct super_block *newsb)
755 {
756 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
757 struct superblock_security_struct *newsbsec = newsb->s_security;
758
759 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
760 int set_context = (oldsbsec->flags & CONTEXT_MNT);
761 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
762
763 /*
764 * if the parent was able to be mounted it clearly had no special lsm
765 * mount options. thus we can safely deal with this superblock later
766 */
767 if (!ss_initialized)
768 return;
769
770 /* how can we clone if the old one wasn't set up?? */
771 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
772
773 /* if fs is reusing a sb, just let its options stand... */
774 if (newsbsec->flags & SE_SBINITIALIZED)
775 return;
776
777 mutex_lock(&newsbsec->lock);
778
779 newsbsec->flags = oldsbsec->flags;
780
781 newsbsec->sid = oldsbsec->sid;
782 newsbsec->def_sid = oldsbsec->def_sid;
783 newsbsec->behavior = oldsbsec->behavior;
784
785 if (set_context) {
786 u32 sid = oldsbsec->mntpoint_sid;
787
788 if (!set_fscontext)
789 newsbsec->sid = sid;
790 if (!set_rootcontext) {
791 struct inode *newinode = newsb->s_root->d_inode;
792 struct inode_security_struct *newisec = newinode->i_security;
793 newisec->sid = sid;
794 }
795 newsbsec->mntpoint_sid = sid;
796 }
797 if (set_rootcontext) {
798 const struct inode *oldinode = oldsb->s_root->d_inode;
799 const struct inode_security_struct *oldisec = oldinode->i_security;
800 struct inode *newinode = newsb->s_root->d_inode;
801 struct inode_security_struct *newisec = newinode->i_security;
802
803 newisec->sid = oldisec->sid;
804 }
805
806 sb_finish_set_opts(newsb);
807 mutex_unlock(&newsbsec->lock);
808 }
809
810 static int selinux_parse_opts_str(char *options,
811 struct security_mnt_opts *opts)
812 {
813 char *p;
814 char *context = NULL, *defcontext = NULL;
815 char *fscontext = NULL, *rootcontext = NULL;
816 int rc, num_mnt_opts = 0;
817
818 opts->num_mnt_opts = 0;
819
820 /* Standard string-based options. */
821 while ((p = strsep(&options, "|")) != NULL) {
822 int token;
823 substring_t args[MAX_OPT_ARGS];
824
825 if (!*p)
826 continue;
827
828 token = match_token(p, tokens, args);
829
830 switch (token) {
831 case Opt_context:
832 if (context || defcontext) {
833 rc = -EINVAL;
834 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
835 goto out_err;
836 }
837 context = match_strdup(&args[0]);
838 if (!context) {
839 rc = -ENOMEM;
840 goto out_err;
841 }
842 break;
843
844 case Opt_fscontext:
845 if (fscontext) {
846 rc = -EINVAL;
847 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
848 goto out_err;
849 }
850 fscontext = match_strdup(&args[0]);
851 if (!fscontext) {
852 rc = -ENOMEM;
853 goto out_err;
854 }
855 break;
856
857 case Opt_rootcontext:
858 if (rootcontext) {
859 rc = -EINVAL;
860 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
861 goto out_err;
862 }
863 rootcontext = match_strdup(&args[0]);
864 if (!rootcontext) {
865 rc = -ENOMEM;
866 goto out_err;
867 }
868 break;
869
870 case Opt_defcontext:
871 if (context || defcontext) {
872 rc = -EINVAL;
873 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
874 goto out_err;
875 }
876 defcontext = match_strdup(&args[0]);
877 if (!defcontext) {
878 rc = -ENOMEM;
879 goto out_err;
880 }
881 break;
882 case Opt_labelsupport:
883 break;
884 default:
885 rc = -EINVAL;
886 printk(KERN_WARNING "SELinux: unknown mount option\n");
887 goto out_err;
888
889 }
890 }
891
892 rc = -ENOMEM;
893 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
894 if (!opts->mnt_opts)
895 goto out_err;
896
897 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
898 if (!opts->mnt_opts_flags) {
899 kfree(opts->mnt_opts);
900 goto out_err;
901 }
902
903 if (fscontext) {
904 opts->mnt_opts[num_mnt_opts] = fscontext;
905 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
906 }
907 if (context) {
908 opts->mnt_opts[num_mnt_opts] = context;
909 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
910 }
911 if (rootcontext) {
912 opts->mnt_opts[num_mnt_opts] = rootcontext;
913 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
914 }
915 if (defcontext) {
916 opts->mnt_opts[num_mnt_opts] = defcontext;
917 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
918 }
919
920 opts->num_mnt_opts = num_mnt_opts;
921 return 0;
922
923 out_err:
924 kfree(context);
925 kfree(defcontext);
926 kfree(fscontext);
927 kfree(rootcontext);
928 return rc;
929 }
930 /*
931 * string mount options parsing and call set the sbsec
932 */
933 static int superblock_doinit(struct super_block *sb, void *data)
934 {
935 int rc = 0;
936 char *options = data;
937 struct security_mnt_opts opts;
938
939 security_init_mnt_opts(&opts);
940
941 if (!data)
942 goto out;
943
944 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
945
946 rc = selinux_parse_opts_str(options, &opts);
947 if (rc)
948 goto out_err;
949
950 out:
951 rc = selinux_set_mnt_opts(sb, &opts);
952
953 out_err:
954 security_free_mnt_opts(&opts);
955 return rc;
956 }
957
958 static void selinux_write_opts(struct seq_file *m,
959 struct security_mnt_opts *opts)
960 {
961 int i;
962 char *prefix;
963
964 for (i = 0; i < opts->num_mnt_opts; i++) {
965 char *has_comma;
966
967 if (opts->mnt_opts[i])
968 has_comma = strchr(opts->mnt_opts[i], ',');
969 else
970 has_comma = NULL;
971
972 switch (opts->mnt_opts_flags[i]) {
973 case CONTEXT_MNT:
974 prefix = CONTEXT_STR;
975 break;
976 case FSCONTEXT_MNT:
977 prefix = FSCONTEXT_STR;
978 break;
979 case ROOTCONTEXT_MNT:
980 prefix = ROOTCONTEXT_STR;
981 break;
982 case DEFCONTEXT_MNT:
983 prefix = DEFCONTEXT_STR;
984 break;
985 case SE_SBLABELSUPP:
986 seq_putc(m, ',');
987 seq_puts(m, LABELSUPP_STR);
988 continue;
989 default:
990 BUG();
991 return;
992 };
993 /* we need a comma before each option */
994 seq_putc(m, ',');
995 seq_puts(m, prefix);
996 if (has_comma)
997 seq_putc(m, '\"');
998 seq_puts(m, opts->mnt_opts[i]);
999 if (has_comma)
1000 seq_putc(m, '\"');
1001 }
1002 }
1003
1004 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1005 {
1006 struct security_mnt_opts opts;
1007 int rc;
1008
1009 rc = selinux_get_mnt_opts(sb, &opts);
1010 if (rc) {
1011 /* before policy load we may get EINVAL, don't show anything */
1012 if (rc == -EINVAL)
1013 rc = 0;
1014 return rc;
1015 }
1016
1017 selinux_write_opts(m, &opts);
1018
1019 security_free_mnt_opts(&opts);
1020
1021 return rc;
1022 }
1023
1024 static inline u16 inode_mode_to_security_class(umode_t mode)
1025 {
1026 switch (mode & S_IFMT) {
1027 case S_IFSOCK:
1028 return SECCLASS_SOCK_FILE;
1029 case S_IFLNK:
1030 return SECCLASS_LNK_FILE;
1031 case S_IFREG:
1032 return SECCLASS_FILE;
1033 case S_IFBLK:
1034 return SECCLASS_BLK_FILE;
1035 case S_IFDIR:
1036 return SECCLASS_DIR;
1037 case S_IFCHR:
1038 return SECCLASS_CHR_FILE;
1039 case S_IFIFO:
1040 return SECCLASS_FIFO_FILE;
1041
1042 }
1043
1044 return SECCLASS_FILE;
1045 }
1046
1047 static inline int default_protocol_stream(int protocol)
1048 {
1049 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1050 }
1051
1052 static inline int default_protocol_dgram(int protocol)
1053 {
1054 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1055 }
1056
1057 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1058 {
1059 switch (family) {
1060 case PF_UNIX:
1061 switch (type) {
1062 case SOCK_STREAM:
1063 case SOCK_SEQPACKET:
1064 return SECCLASS_UNIX_STREAM_SOCKET;
1065 case SOCK_DGRAM:
1066 return SECCLASS_UNIX_DGRAM_SOCKET;
1067 }
1068 break;
1069 case PF_INET:
1070 case PF_INET6:
1071 switch (type) {
1072 case SOCK_STREAM:
1073 if (default_protocol_stream(protocol))
1074 return SECCLASS_TCP_SOCKET;
1075 else
1076 return SECCLASS_RAWIP_SOCKET;
1077 case SOCK_DGRAM:
1078 if (default_protocol_dgram(protocol))
1079 return SECCLASS_UDP_SOCKET;
1080 else
1081 return SECCLASS_RAWIP_SOCKET;
1082 case SOCK_DCCP:
1083 return SECCLASS_DCCP_SOCKET;
1084 default:
1085 return SECCLASS_RAWIP_SOCKET;
1086 }
1087 break;
1088 case PF_NETLINK:
1089 switch (protocol) {
1090 case NETLINK_ROUTE:
1091 return SECCLASS_NETLINK_ROUTE_SOCKET;
1092 case NETLINK_FIREWALL:
1093 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1094 case NETLINK_SOCK_DIAG:
1095 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1096 case NETLINK_NFLOG:
1097 return SECCLASS_NETLINK_NFLOG_SOCKET;
1098 case NETLINK_XFRM:
1099 return SECCLASS_NETLINK_XFRM_SOCKET;
1100 case NETLINK_SELINUX:
1101 return SECCLASS_NETLINK_SELINUX_SOCKET;
1102 case NETLINK_AUDIT:
1103 return SECCLASS_NETLINK_AUDIT_SOCKET;
1104 case NETLINK_IP6_FW:
1105 return SECCLASS_NETLINK_IP6FW_SOCKET;
1106 case NETLINK_DNRTMSG:
1107 return SECCLASS_NETLINK_DNRT_SOCKET;
1108 case NETLINK_KOBJECT_UEVENT:
1109 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1110 default:
1111 return SECCLASS_NETLINK_SOCKET;
1112 }
1113 case PF_PACKET:
1114 return SECCLASS_PACKET_SOCKET;
1115 case PF_KEY:
1116 return SECCLASS_KEY_SOCKET;
1117 case PF_APPLETALK:
1118 return SECCLASS_APPLETALK_SOCKET;
1119 }
1120
1121 return SECCLASS_SOCKET;
1122 }
1123
1124 #ifdef CONFIG_PROC_FS
1125 static int selinux_proc_get_sid(struct dentry *dentry,
1126 u16 tclass,
1127 u32 *sid)
1128 {
1129 int rc;
1130 char *buffer, *path;
1131
1132 buffer = (char *)__get_free_page(GFP_KERNEL);
1133 if (!buffer)
1134 return -ENOMEM;
1135
1136 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1137 if (IS_ERR(path))
1138 rc = PTR_ERR(path);
1139 else {
1140 /* each process gets a /proc/PID/ entry. Strip off the
1141 * PID part to get a valid selinux labeling.
1142 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1143 while (path[1] >= '0' && path[1] <= '9') {
1144 path[1] = '/';
1145 path++;
1146 }
1147 rc = security_genfs_sid("proc", path, tclass, sid);
1148 }
1149 free_page((unsigned long)buffer);
1150 return rc;
1151 }
1152 #else
1153 static int selinux_proc_get_sid(struct dentry *dentry,
1154 u16 tclass,
1155 u32 *sid)
1156 {
1157 return -EINVAL;
1158 }
1159 #endif
1160
1161 /* The inode's security attributes must be initialized before first use. */
1162 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1163 {
1164 struct superblock_security_struct *sbsec = NULL;
1165 struct inode_security_struct *isec = inode->i_security;
1166 u32 sid;
1167 struct dentry *dentry;
1168 #define INITCONTEXTLEN 255
1169 char *context = NULL;
1170 unsigned len = 0;
1171 int rc = 0;
1172
1173 if (isec->initialized)
1174 goto out;
1175
1176 mutex_lock(&isec->lock);
1177 if (isec->initialized)
1178 goto out_unlock;
1179
1180 sbsec = inode->i_sb->s_security;
1181 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1182 /* Defer initialization until selinux_complete_init,
1183 after the initial policy is loaded and the security
1184 server is ready to handle calls. */
1185 spin_lock(&sbsec->isec_lock);
1186 if (list_empty(&isec->list))
1187 list_add(&isec->list, &sbsec->isec_head);
1188 spin_unlock(&sbsec->isec_lock);
1189 goto out_unlock;
1190 }
1191
1192 switch (sbsec->behavior) {
1193 case SECURITY_FS_USE_XATTR:
1194 if (!inode->i_op->getxattr) {
1195 isec->sid = sbsec->def_sid;
1196 break;
1197 }
1198
1199 /* Need a dentry, since the xattr API requires one.
1200 Life would be simpler if we could just pass the inode. */
1201 if (opt_dentry) {
1202 /* Called from d_instantiate or d_splice_alias. */
1203 dentry = dget(opt_dentry);
1204 } else {
1205 /* Called from selinux_complete_init, try to find a dentry. */
1206 dentry = d_find_alias(inode);
1207 }
1208 if (!dentry) {
1209 /*
1210 * this is can be hit on boot when a file is accessed
1211 * before the policy is loaded. When we load policy we
1212 * may find inodes that have no dentry on the
1213 * sbsec->isec_head list. No reason to complain as these
1214 * will get fixed up the next time we go through
1215 * inode_doinit with a dentry, before these inodes could
1216 * be used again by userspace.
1217 */
1218 goto out_unlock;
1219 }
1220
1221 len = INITCONTEXTLEN;
1222 context = kmalloc(len+1, GFP_NOFS);
1223 if (!context) {
1224 rc = -ENOMEM;
1225 dput(dentry);
1226 goto out_unlock;
1227 }
1228 context[len] = '\0';
1229 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1230 context, len);
1231 if (rc == -ERANGE) {
1232 kfree(context);
1233
1234 /* Need a larger buffer. Query for the right size. */
1235 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1236 NULL, 0);
1237 if (rc < 0) {
1238 dput(dentry);
1239 goto out_unlock;
1240 }
1241 len = rc;
1242 context = kmalloc(len+1, GFP_NOFS);
1243 if (!context) {
1244 rc = -ENOMEM;
1245 dput(dentry);
1246 goto out_unlock;
1247 }
1248 context[len] = '\0';
1249 rc = inode->i_op->getxattr(dentry,
1250 XATTR_NAME_SELINUX,
1251 context, len);
1252 }
1253 dput(dentry);
1254 if (rc < 0) {
1255 if (rc != -ENODATA) {
1256 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1257 "%d for dev=%s ino=%ld\n", __func__,
1258 -rc, inode->i_sb->s_id, inode->i_ino);
1259 kfree(context);
1260 goto out_unlock;
1261 }
1262 /* Map ENODATA to the default file SID */
1263 sid = sbsec->def_sid;
1264 rc = 0;
1265 } else {
1266 rc = security_context_to_sid_default(context, rc, &sid,
1267 sbsec->def_sid,
1268 GFP_NOFS);
1269 if (rc) {
1270 char *dev = inode->i_sb->s_id;
1271 unsigned long ino = inode->i_ino;
1272
1273 if (rc == -EINVAL) {
1274 if (printk_ratelimit())
1275 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1276 "context=%s. This indicates you may need to relabel the inode or the "
1277 "filesystem in question.\n", ino, dev, context);
1278 } else {
1279 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1280 "returned %d for dev=%s ino=%ld\n",
1281 __func__, context, -rc, dev, ino);
1282 }
1283 kfree(context);
1284 /* Leave with the unlabeled SID */
1285 rc = 0;
1286 break;
1287 }
1288 }
1289 kfree(context);
1290 isec->sid = sid;
1291 break;
1292 case SECURITY_FS_USE_TASK:
1293 isec->sid = isec->task_sid;
1294 break;
1295 case SECURITY_FS_USE_TRANS:
1296 /* Default to the fs SID. */
1297 isec->sid = sbsec->sid;
1298
1299 /* Try to obtain a transition SID. */
1300 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1301 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1302 isec->sclass, NULL, &sid);
1303 if (rc)
1304 goto out_unlock;
1305 isec->sid = sid;
1306 break;
1307 case SECURITY_FS_USE_MNTPOINT:
1308 isec->sid = sbsec->mntpoint_sid;
1309 break;
1310 default:
1311 /* Default to the fs superblock SID. */
1312 isec->sid = sbsec->sid;
1313
1314 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1315 if (opt_dentry) {
1316 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1317 rc = selinux_proc_get_sid(opt_dentry,
1318 isec->sclass,
1319 &sid);
1320 if (rc)
1321 goto out_unlock;
1322 isec->sid = sid;
1323 }
1324 }
1325 break;
1326 }
1327
1328 isec->initialized = 1;
1329
1330 out_unlock:
1331 mutex_unlock(&isec->lock);
1332 out:
1333 if (isec->sclass == SECCLASS_FILE)
1334 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1335 return rc;
1336 }
1337
1338 /* Convert a Linux signal to an access vector. */
1339 static inline u32 signal_to_av(int sig)
1340 {
1341 u32 perm = 0;
1342
1343 switch (sig) {
1344 case SIGCHLD:
1345 /* Commonly granted from child to parent. */
1346 perm = PROCESS__SIGCHLD;
1347 break;
1348 case SIGKILL:
1349 /* Cannot be caught or ignored */
1350 perm = PROCESS__SIGKILL;
1351 break;
1352 case SIGSTOP:
1353 /* Cannot be caught or ignored */
1354 perm = PROCESS__SIGSTOP;
1355 break;
1356 default:
1357 /* All other signals. */
1358 perm = PROCESS__SIGNAL;
1359 break;
1360 }
1361
1362 return perm;
1363 }
1364
1365 /*
1366 * Check permission between a pair of credentials
1367 * fork check, ptrace check, etc.
1368 */
1369 static int cred_has_perm(const struct cred *actor,
1370 const struct cred *target,
1371 u32 perms)
1372 {
1373 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1374
1375 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1376 }
1377
1378 /*
1379 * Check permission between a pair of tasks, e.g. signal checks,
1380 * fork check, ptrace check, etc.
1381 * tsk1 is the actor and tsk2 is the target
1382 * - this uses the default subjective creds of tsk1
1383 */
1384 static int task_has_perm(const struct task_struct *tsk1,
1385 const struct task_struct *tsk2,
1386 u32 perms)
1387 {
1388 const struct task_security_struct *__tsec1, *__tsec2;
1389 u32 sid1, sid2;
1390
1391 rcu_read_lock();
1392 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1393 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1394 rcu_read_unlock();
1395 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1396 }
1397
1398 /*
1399 * Check permission between current and another task, e.g. signal checks,
1400 * fork check, ptrace check, etc.
1401 * current is the actor and tsk2 is the target
1402 * - this uses current's subjective creds
1403 */
1404 static int current_has_perm(const struct task_struct *tsk,
1405 u32 perms)
1406 {
1407 u32 sid, tsid;
1408
1409 sid = current_sid();
1410 tsid = task_sid(tsk);
1411 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1412 }
1413
1414 #if CAP_LAST_CAP > 63
1415 #error Fix SELinux to handle capabilities > 63.
1416 #endif
1417
1418 /* Check whether a task is allowed to use a capability. */
1419 static int cred_has_capability(const struct cred *cred,
1420 int cap, int audit)
1421 {
1422 struct common_audit_data ad;
1423 struct av_decision avd;
1424 u16 sclass;
1425 u32 sid = cred_sid(cred);
1426 u32 av = CAP_TO_MASK(cap);
1427 int rc;
1428
1429 ad.type = LSM_AUDIT_DATA_CAP;
1430 ad.u.cap = cap;
1431
1432 switch (CAP_TO_INDEX(cap)) {
1433 case 0:
1434 sclass = SECCLASS_CAPABILITY;
1435 break;
1436 case 1:
1437 sclass = SECCLASS_CAPABILITY2;
1438 break;
1439 default:
1440 printk(KERN_ERR
1441 "SELinux: out of range capability %d\n", cap);
1442 BUG();
1443 return -EINVAL;
1444 }
1445
1446 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1447 if (audit == SECURITY_CAP_AUDIT) {
1448 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1449 if (rc2)
1450 return rc2;
1451 }
1452 return rc;
1453 }
1454
1455 /* Check whether a task is allowed to use a system operation. */
1456 static int task_has_system(struct task_struct *tsk,
1457 u32 perms)
1458 {
1459 u32 sid = task_sid(tsk);
1460
1461 return avc_has_perm(sid, SECINITSID_KERNEL,
1462 SECCLASS_SYSTEM, perms, NULL);
1463 }
1464
1465 /* Check whether a task has a particular permission to an inode.
1466 The 'adp' parameter is optional and allows other audit
1467 data to be passed (e.g. the dentry). */
1468 static int inode_has_perm(const struct cred *cred,
1469 struct inode *inode,
1470 u32 perms,
1471 struct common_audit_data *adp,
1472 unsigned flags)
1473 {
1474 struct inode_security_struct *isec;
1475 u32 sid;
1476
1477 validate_creds(cred);
1478
1479 if (unlikely(IS_PRIVATE(inode)))
1480 return 0;
1481
1482 sid = cred_sid(cred);
1483 isec = inode->i_security;
1484
1485 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1486 }
1487
1488 /* Same as inode_has_perm, but pass explicit audit data containing
1489 the dentry to help the auditing code to more easily generate the
1490 pathname if needed. */
1491 static inline int dentry_has_perm(const struct cred *cred,
1492 struct dentry *dentry,
1493 u32 av)
1494 {
1495 struct inode *inode = dentry->d_inode;
1496 struct common_audit_data ad;
1497
1498 ad.type = LSM_AUDIT_DATA_DENTRY;
1499 ad.u.dentry = dentry;
1500 return inode_has_perm(cred, inode, av, &ad, 0);
1501 }
1502
1503 /* Same as inode_has_perm, but pass explicit audit data containing
1504 the path to help the auditing code to more easily generate the
1505 pathname if needed. */
1506 static inline int path_has_perm(const struct cred *cred,
1507 struct path *path,
1508 u32 av)
1509 {
1510 struct inode *inode = path->dentry->d_inode;
1511 struct common_audit_data ad;
1512
1513 ad.type = LSM_AUDIT_DATA_PATH;
1514 ad.u.path = *path;
1515 return inode_has_perm(cred, inode, av, &ad, 0);
1516 }
1517
1518 /* Check whether a task can use an open file descriptor to
1519 access an inode in a given way. Check access to the
1520 descriptor itself, and then use dentry_has_perm to
1521 check a particular permission to the file.
1522 Access to the descriptor is implicitly granted if it
1523 has the same SID as the process. If av is zero, then
1524 access to the file is not checked, e.g. for cases
1525 where only the descriptor is affected like seek. */
1526 static int file_has_perm(const struct cred *cred,
1527 struct file *file,
1528 u32 av)
1529 {
1530 struct file_security_struct *fsec = file->f_security;
1531 struct inode *inode = file->f_path.dentry->d_inode;
1532 struct common_audit_data ad;
1533 u32 sid = cred_sid(cred);
1534 int rc;
1535
1536 ad.type = LSM_AUDIT_DATA_PATH;
1537 ad.u.path = file->f_path;
1538
1539 if (sid != fsec->sid) {
1540 rc = avc_has_perm(sid, fsec->sid,
1541 SECCLASS_FD,
1542 FD__USE,
1543 &ad);
1544 if (rc)
1545 goto out;
1546 }
1547
1548 /* av is zero if only checking access to the descriptor. */
1549 rc = 0;
1550 if (av)
1551 rc = inode_has_perm(cred, inode, av, &ad, 0);
1552
1553 out:
1554 return rc;
1555 }
1556
1557 /* Check whether a task can create a file. */
1558 static int may_create(struct inode *dir,
1559 struct dentry *dentry,
1560 u16 tclass)
1561 {
1562 const struct task_security_struct *tsec = current_security();
1563 struct inode_security_struct *dsec;
1564 struct superblock_security_struct *sbsec;
1565 u32 sid, newsid;
1566 struct common_audit_data ad;
1567 int rc;
1568
1569 dsec = dir->i_security;
1570 sbsec = dir->i_sb->s_security;
1571
1572 sid = tsec->sid;
1573 newsid = tsec->create_sid;
1574
1575 ad.type = LSM_AUDIT_DATA_DENTRY;
1576 ad.u.dentry = dentry;
1577
1578 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1579 DIR__ADD_NAME | DIR__SEARCH,
1580 &ad);
1581 if (rc)
1582 return rc;
1583
1584 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1585 rc = security_transition_sid(sid, dsec->sid, tclass,
1586 &dentry->d_name, &newsid);
1587 if (rc)
1588 return rc;
1589 }
1590
1591 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1592 if (rc)
1593 return rc;
1594
1595 return avc_has_perm(newsid, sbsec->sid,
1596 SECCLASS_FILESYSTEM,
1597 FILESYSTEM__ASSOCIATE, &ad);
1598 }
1599
1600 /* Check whether a task can create a key. */
1601 static int may_create_key(u32 ksid,
1602 struct task_struct *ctx)
1603 {
1604 u32 sid = task_sid(ctx);
1605
1606 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1607 }
1608
1609 #define MAY_LINK 0
1610 #define MAY_UNLINK 1
1611 #define MAY_RMDIR 2
1612
1613 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1614 static int may_link(struct inode *dir,
1615 struct dentry *dentry,
1616 int kind)
1617
1618 {
1619 struct inode_security_struct *dsec, *isec;
1620 struct common_audit_data ad;
1621 u32 sid = current_sid();
1622 u32 av;
1623 int rc;
1624
1625 dsec = dir->i_security;
1626 isec = dentry->d_inode->i_security;
1627
1628 ad.type = LSM_AUDIT_DATA_DENTRY;
1629 ad.u.dentry = dentry;
1630
1631 av = DIR__SEARCH;
1632 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1633 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1634 if (rc)
1635 return rc;
1636
1637 switch (kind) {
1638 case MAY_LINK:
1639 av = FILE__LINK;
1640 break;
1641 case MAY_UNLINK:
1642 av = FILE__UNLINK;
1643 break;
1644 case MAY_RMDIR:
1645 av = DIR__RMDIR;
1646 break;
1647 default:
1648 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1649 __func__, kind);
1650 return 0;
1651 }
1652
1653 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1654 return rc;
1655 }
1656
1657 static inline int may_rename(struct inode *old_dir,
1658 struct dentry *old_dentry,
1659 struct inode *new_dir,
1660 struct dentry *new_dentry)
1661 {
1662 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1663 struct common_audit_data ad;
1664 u32 sid = current_sid();
1665 u32 av;
1666 int old_is_dir, new_is_dir;
1667 int rc;
1668
1669 old_dsec = old_dir->i_security;
1670 old_isec = old_dentry->d_inode->i_security;
1671 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1672 new_dsec = new_dir->i_security;
1673
1674 ad.type = LSM_AUDIT_DATA_DENTRY;
1675
1676 ad.u.dentry = old_dentry;
1677 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1678 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1679 if (rc)
1680 return rc;
1681 rc = avc_has_perm(sid, old_isec->sid,
1682 old_isec->sclass, FILE__RENAME, &ad);
1683 if (rc)
1684 return rc;
1685 if (old_is_dir && new_dir != old_dir) {
1686 rc = avc_has_perm(sid, old_isec->sid,
1687 old_isec->sclass, DIR__REPARENT, &ad);
1688 if (rc)
1689 return rc;
1690 }
1691
1692 ad.u.dentry = new_dentry;
1693 av = DIR__ADD_NAME | DIR__SEARCH;
1694 if (new_dentry->d_inode)
1695 av |= DIR__REMOVE_NAME;
1696 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1697 if (rc)
1698 return rc;
1699 if (new_dentry->d_inode) {
1700 new_isec = new_dentry->d_inode->i_security;
1701 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1702 rc = avc_has_perm(sid, new_isec->sid,
1703 new_isec->sclass,
1704 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1705 if (rc)
1706 return rc;
1707 }
1708
1709 return 0;
1710 }
1711
1712 /* Check whether a task can perform a filesystem operation. */
1713 static int superblock_has_perm(const struct cred *cred,
1714 struct super_block *sb,
1715 u32 perms,
1716 struct common_audit_data *ad)
1717 {
1718 struct superblock_security_struct *sbsec;
1719 u32 sid = cred_sid(cred);
1720
1721 sbsec = sb->s_security;
1722 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1723 }
1724
1725 /* Convert a Linux mode and permission mask to an access vector. */
1726 static inline u32 file_mask_to_av(int mode, int mask)
1727 {
1728 u32 av = 0;
1729
1730 if (!S_ISDIR(mode)) {
1731 if (mask & MAY_EXEC)
1732 av |= FILE__EXECUTE;
1733 if (mask & MAY_READ)
1734 av |= FILE__READ;
1735
1736 if (mask & MAY_APPEND)
1737 av |= FILE__APPEND;
1738 else if (mask & MAY_WRITE)
1739 av |= FILE__WRITE;
1740
1741 } else {
1742 if (mask & MAY_EXEC)
1743 av |= DIR__SEARCH;
1744 if (mask & MAY_WRITE)
1745 av |= DIR__WRITE;
1746 if (mask & MAY_READ)
1747 av |= DIR__READ;
1748 }
1749
1750 return av;
1751 }
1752
1753 /* Convert a Linux file to an access vector. */
1754 static inline u32 file_to_av(struct file *file)
1755 {
1756 u32 av = 0;
1757
1758 if (file->f_mode & FMODE_READ)
1759 av |= FILE__READ;
1760 if (file->f_mode & FMODE_WRITE) {
1761 if (file->f_flags & O_APPEND)
1762 av |= FILE__APPEND;
1763 else
1764 av |= FILE__WRITE;
1765 }
1766 if (!av) {
1767 /*
1768 * Special file opened with flags 3 for ioctl-only use.
1769 */
1770 av = FILE__IOCTL;
1771 }
1772
1773 return av;
1774 }
1775
1776 /*
1777 * Convert a file to an access vector and include the correct open
1778 * open permission.
1779 */
1780 static inline u32 open_file_to_av(struct file *file)
1781 {
1782 u32 av = file_to_av(file);
1783
1784 if (selinux_policycap_openperm)
1785 av |= FILE__OPEN;
1786
1787 return av;
1788 }
1789
1790 /* Hook functions begin here. */
1791
1792 static int selinux_ptrace_access_check(struct task_struct *child,
1793 unsigned int mode)
1794 {
1795 int rc;
1796
1797 rc = cap_ptrace_access_check(child, mode);
1798 if (rc)
1799 return rc;
1800
1801 if (mode & PTRACE_MODE_READ) {
1802 u32 sid = current_sid();
1803 u32 csid = task_sid(child);
1804 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1805 }
1806
1807 return current_has_perm(child, PROCESS__PTRACE);
1808 }
1809
1810 static int selinux_ptrace_traceme(struct task_struct *parent)
1811 {
1812 int rc;
1813
1814 rc = cap_ptrace_traceme(parent);
1815 if (rc)
1816 return rc;
1817
1818 return task_has_perm(parent, current, PROCESS__PTRACE);
1819 }
1820
1821 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1822 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1823 {
1824 int error;
1825
1826 error = current_has_perm(target, PROCESS__GETCAP);
1827 if (error)
1828 return error;
1829
1830 return cap_capget(target, effective, inheritable, permitted);
1831 }
1832
1833 static int selinux_capset(struct cred *new, const struct cred *old,
1834 const kernel_cap_t *effective,
1835 const kernel_cap_t *inheritable,
1836 const kernel_cap_t *permitted)
1837 {
1838 int error;
1839
1840 error = cap_capset(new, old,
1841 effective, inheritable, permitted);
1842 if (error)
1843 return error;
1844
1845 return cred_has_perm(old, new, PROCESS__SETCAP);
1846 }
1847
1848 /*
1849 * (This comment used to live with the selinux_task_setuid hook,
1850 * which was removed).
1851 *
1852 * Since setuid only affects the current process, and since the SELinux
1853 * controls are not based on the Linux identity attributes, SELinux does not
1854 * need to control this operation. However, SELinux does control the use of
1855 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1856 */
1857
1858 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1859 int cap, int audit)
1860 {
1861 int rc;
1862
1863 rc = cap_capable(cred, ns, cap, audit);
1864 if (rc)
1865 return rc;
1866
1867 return cred_has_capability(cred, cap, audit);
1868 }
1869
1870 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1871 {
1872 const struct cred *cred = current_cred();
1873 int rc = 0;
1874
1875 if (!sb)
1876 return 0;
1877
1878 switch (cmds) {
1879 case Q_SYNC:
1880 case Q_QUOTAON:
1881 case Q_QUOTAOFF:
1882 case Q_SETINFO:
1883 case Q_SETQUOTA:
1884 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1885 break;
1886 case Q_GETFMT:
1887 case Q_GETINFO:
1888 case Q_GETQUOTA:
1889 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1890 break;
1891 default:
1892 rc = 0; /* let the kernel handle invalid cmds */
1893 break;
1894 }
1895 return rc;
1896 }
1897
1898 static int selinux_quota_on(struct dentry *dentry)
1899 {
1900 const struct cred *cred = current_cred();
1901
1902 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1903 }
1904
1905 static int selinux_syslog(int type)
1906 {
1907 int rc;
1908
1909 switch (type) {
1910 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1911 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1912 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1913 break;
1914 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1915 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1916 /* Set level of messages printed to console */
1917 case SYSLOG_ACTION_CONSOLE_LEVEL:
1918 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1919 break;
1920 case SYSLOG_ACTION_CLOSE: /* Close log */
1921 case SYSLOG_ACTION_OPEN: /* Open log */
1922 case SYSLOG_ACTION_READ: /* Read from log */
1923 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1924 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1925 default:
1926 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1927 break;
1928 }
1929 return rc;
1930 }
1931
1932 /*
1933 * Check that a process has enough memory to allocate a new virtual
1934 * mapping. 0 means there is enough memory for the allocation to
1935 * succeed and -ENOMEM implies there is not.
1936 *
1937 * Do not audit the selinux permission check, as this is applied to all
1938 * processes that allocate mappings.
1939 */
1940 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1941 {
1942 int rc, cap_sys_admin = 0;
1943
1944 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1945 SECURITY_CAP_NOAUDIT);
1946 if (rc == 0)
1947 cap_sys_admin = 1;
1948
1949 return __vm_enough_memory(mm, pages, cap_sys_admin);
1950 }
1951
1952 /* binprm security operations */
1953
1954 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1955 {
1956 const struct task_security_struct *old_tsec;
1957 struct task_security_struct *new_tsec;
1958 struct inode_security_struct *isec;
1959 struct common_audit_data ad;
1960 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1961 int rc;
1962
1963 rc = cap_bprm_set_creds(bprm);
1964 if (rc)
1965 return rc;
1966
1967 /* SELinux context only depends on initial program or script and not
1968 * the script interpreter */
1969 if (bprm->cred_prepared)
1970 return 0;
1971
1972 old_tsec = current_security();
1973 new_tsec = bprm->cred->security;
1974 isec = inode->i_security;
1975
1976 /* Default to the current task SID. */
1977 new_tsec->sid = old_tsec->sid;
1978 new_tsec->osid = old_tsec->sid;
1979
1980 /* Reset fs, key, and sock SIDs on execve. */
1981 new_tsec->create_sid = 0;
1982 new_tsec->keycreate_sid = 0;
1983 new_tsec->sockcreate_sid = 0;
1984
1985 if (old_tsec->exec_sid) {
1986 new_tsec->sid = old_tsec->exec_sid;
1987 /* Reset exec SID on execve. */
1988 new_tsec->exec_sid = 0;
1989
1990 /*
1991 * Minimize confusion: if no_new_privs and a transition is
1992 * explicitly requested, then fail the exec.
1993 */
1994 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
1995 return -EPERM;
1996 } else {
1997 /* Check for a default transition on this program. */
1998 rc = security_transition_sid(old_tsec->sid, isec->sid,
1999 SECCLASS_PROCESS, NULL,
2000 &new_tsec->sid);
2001 if (rc)
2002 return rc;
2003 }
2004
2005 ad.type = LSM_AUDIT_DATA_PATH;
2006 ad.u.path = bprm->file->f_path;
2007
2008 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2009 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2010 new_tsec->sid = old_tsec->sid;
2011
2012 if (new_tsec->sid == old_tsec->sid) {
2013 rc = avc_has_perm(old_tsec->sid, isec->sid,
2014 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2015 if (rc)
2016 return rc;
2017 } else {
2018 /* Check permissions for the transition. */
2019 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2020 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2021 if (rc)
2022 return rc;
2023
2024 rc = avc_has_perm(new_tsec->sid, isec->sid,
2025 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2026 if (rc)
2027 return rc;
2028
2029 /* Check for shared state */
2030 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2031 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2032 SECCLASS_PROCESS, PROCESS__SHARE,
2033 NULL);
2034 if (rc)
2035 return -EPERM;
2036 }
2037
2038 /* Make sure that anyone attempting to ptrace over a task that
2039 * changes its SID has the appropriate permit */
2040 if (bprm->unsafe &
2041 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2042 struct task_struct *tracer;
2043 struct task_security_struct *sec;
2044 u32 ptsid = 0;
2045
2046 rcu_read_lock();
2047 tracer = ptrace_parent(current);
2048 if (likely(tracer != NULL)) {
2049 sec = __task_cred(tracer)->security;
2050 ptsid = sec->sid;
2051 }
2052 rcu_read_unlock();
2053
2054 if (ptsid != 0) {
2055 rc = avc_has_perm(ptsid, new_tsec->sid,
2056 SECCLASS_PROCESS,
2057 PROCESS__PTRACE, NULL);
2058 if (rc)
2059 return -EPERM;
2060 }
2061 }
2062
2063 /* Clear any possibly unsafe personality bits on exec: */
2064 bprm->per_clear |= PER_CLEAR_ON_SETID;
2065 }
2066
2067 return 0;
2068 }
2069
2070 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2071 {
2072 const struct task_security_struct *tsec = current_security();
2073 u32 sid, osid;
2074 int atsecure = 0;
2075
2076 sid = tsec->sid;
2077 osid = tsec->osid;
2078
2079 if (osid != sid) {
2080 /* Enable secure mode for SIDs transitions unless
2081 the noatsecure permission is granted between
2082 the two SIDs, i.e. ahp returns 0. */
2083 atsecure = avc_has_perm(osid, sid,
2084 SECCLASS_PROCESS,
2085 PROCESS__NOATSECURE, NULL);
2086 }
2087
2088 return (atsecure || cap_bprm_secureexec(bprm));
2089 }
2090
2091 /* Derived from fs/exec.c:flush_old_files. */
2092 static inline void flush_unauthorized_files(const struct cred *cred,
2093 struct files_struct *files)
2094 {
2095 struct file *file, *devnull = NULL;
2096 struct tty_struct *tty;
2097 struct fdtable *fdt;
2098 long j = -1;
2099 int drop_tty = 0;
2100
2101 tty = get_current_tty();
2102 if (tty) {
2103 spin_lock(&tty_files_lock);
2104 if (!list_empty(&tty->tty_files)) {
2105 struct tty_file_private *file_priv;
2106
2107 /* Revalidate access to controlling tty.
2108 Use path_has_perm on the tty path directly rather
2109 than using file_has_perm, as this particular open
2110 file may belong to another process and we are only
2111 interested in the inode-based check here. */
2112 file_priv = list_first_entry(&tty->tty_files,
2113 struct tty_file_private, list);
2114 file = file_priv->file;
2115 if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2116 drop_tty = 1;
2117 }
2118 spin_unlock(&tty_files_lock);
2119 tty_kref_put(tty);
2120 }
2121 /* Reset controlling tty. */
2122 if (drop_tty)
2123 no_tty();
2124
2125 /* Revalidate access to inherited open files. */
2126 spin_lock(&files->file_lock);
2127 for (;;) {
2128 unsigned long set, i;
2129 int fd;
2130
2131 j++;
2132 i = j * __NFDBITS;
2133 fdt = files_fdtable(files);
2134 if (i >= fdt->max_fds)
2135 break;
2136 set = fdt->open_fds[j];
2137 if (!set)
2138 continue;
2139 spin_unlock(&files->file_lock);
2140 for ( ; set ; i++, set >>= 1) {
2141 if (set & 1) {
2142 file = fget(i);
2143 if (!file)
2144 continue;
2145 if (file_has_perm(cred,
2146 file,
2147 file_to_av(file))) {
2148 sys_close(i);
2149 fd = get_unused_fd();
2150 if (fd != i) {
2151 if (fd >= 0)
2152 put_unused_fd(fd);
2153 fput(file);
2154 continue;
2155 }
2156 if (devnull) {
2157 get_file(devnull);
2158 } else {
2159 devnull = dentry_open(
2160 dget(selinux_null),
2161 mntget(selinuxfs_mount),
2162 O_RDWR, cred);
2163 if (IS_ERR(devnull)) {
2164 devnull = NULL;
2165 put_unused_fd(fd);
2166 fput(file);
2167 continue;
2168 }
2169 }
2170 fd_install(fd, devnull);
2171 }
2172 fput(file);
2173 }
2174 }
2175 spin_lock(&files->file_lock);
2176
2177 }
2178 spin_unlock(&files->file_lock);
2179 }
2180
2181 /*
2182 * Prepare a process for imminent new credential changes due to exec
2183 */
2184 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2185 {
2186 struct task_security_struct *new_tsec;
2187 struct rlimit *rlim, *initrlim;
2188 int rc, i;
2189
2190 new_tsec = bprm->cred->security;
2191 if (new_tsec->sid == new_tsec->osid)
2192 return;
2193
2194 /* Close files for which the new task SID is not authorized. */
2195 flush_unauthorized_files(bprm->cred, current->files);
2196
2197 /* Always clear parent death signal on SID transitions. */
2198 current->pdeath_signal = 0;
2199
2200 /* Check whether the new SID can inherit resource limits from the old
2201 * SID. If not, reset all soft limits to the lower of the current
2202 * task's hard limit and the init task's soft limit.
2203 *
2204 * Note that the setting of hard limits (even to lower them) can be
2205 * controlled by the setrlimit check. The inclusion of the init task's
2206 * soft limit into the computation is to avoid resetting soft limits
2207 * higher than the default soft limit for cases where the default is
2208 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2209 */
2210 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2211 PROCESS__RLIMITINH, NULL);
2212 if (rc) {
2213 /* protect against do_prlimit() */
2214 task_lock(current);
2215 for (i = 0; i < RLIM_NLIMITS; i++) {
2216 rlim = current->signal->rlim + i;
2217 initrlim = init_task.signal->rlim + i;
2218 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2219 }
2220 task_unlock(current);
2221 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2222 }
2223 }
2224
2225 /*
2226 * Clean up the process immediately after the installation of new credentials
2227 * due to exec
2228 */
2229 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2230 {
2231 const struct task_security_struct *tsec = current_security();
2232 struct itimerval itimer;
2233 u32 osid, sid;
2234 int rc, i;
2235
2236 osid = tsec->osid;
2237 sid = tsec->sid;
2238
2239 if (sid == osid)
2240 return;
2241
2242 /* Check whether the new SID can inherit signal state from the old SID.
2243 * If not, clear itimers to avoid subsequent signal generation and
2244 * flush and unblock signals.
2245 *
2246 * This must occur _after_ the task SID has been updated so that any
2247 * kill done after the flush will be checked against the new SID.
2248 */
2249 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2250 if (rc) {
2251 memset(&itimer, 0, sizeof itimer);
2252 for (i = 0; i < 3; i++)
2253 do_setitimer(i, &itimer, NULL);
2254 spin_lock_irq(&current->sighand->siglock);
2255 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2256 __flush_signals(current);
2257 flush_signal_handlers(current, 1);
2258 sigemptyset(&current->blocked);
2259 }
2260 spin_unlock_irq(&current->sighand->siglock);
2261 }
2262
2263 /* Wake up the parent if it is waiting so that it can recheck
2264 * wait permission to the new task SID. */
2265 read_lock(&tasklist_lock);
2266 __wake_up_parent(current, current->real_parent);
2267 read_unlock(&tasklist_lock);
2268 }
2269
2270 /* superblock security operations */
2271
2272 static int selinux_sb_alloc_security(struct super_block *sb)
2273 {
2274 return superblock_alloc_security(sb);
2275 }
2276
2277 static void selinux_sb_free_security(struct super_block *sb)
2278 {
2279 superblock_free_security(sb);
2280 }
2281
2282 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2283 {
2284 if (plen > olen)
2285 return 0;
2286
2287 return !memcmp(prefix, option, plen);
2288 }
2289
2290 static inline int selinux_option(char *option, int len)
2291 {
2292 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2293 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2294 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2295 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2296 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2297 }
2298
2299 static inline void take_option(char **to, char *from, int *first, int len)
2300 {
2301 if (!*first) {
2302 **to = ',';
2303 *to += 1;
2304 } else
2305 *first = 0;
2306 memcpy(*to, from, len);
2307 *to += len;
2308 }
2309
2310 static inline void take_selinux_option(char **to, char *from, int *first,
2311 int len)
2312 {
2313 int current_size = 0;
2314
2315 if (!*first) {
2316 **to = '|';
2317 *to += 1;
2318 } else
2319 *first = 0;
2320
2321 while (current_size < len) {
2322 if (*from != '"') {
2323 **to = *from;
2324 *to += 1;
2325 }
2326 from += 1;
2327 current_size += 1;
2328 }
2329 }
2330
2331 static int selinux_sb_copy_data(char *orig, char *copy)
2332 {
2333 int fnosec, fsec, rc = 0;
2334 char *in_save, *in_curr, *in_end;
2335 char *sec_curr, *nosec_save, *nosec;
2336 int open_quote = 0;
2337
2338 in_curr = orig;
2339 sec_curr = copy;
2340
2341 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2342 if (!nosec) {
2343 rc = -ENOMEM;
2344 goto out;
2345 }
2346
2347 nosec_save = nosec;
2348 fnosec = fsec = 1;
2349 in_save = in_end = orig;
2350
2351 do {
2352 if (*in_end == '"')
2353 open_quote = !open_quote;
2354 if ((*in_end == ',' && open_quote == 0) ||
2355 *in_end == '\0') {
2356 int len = in_end - in_curr;
2357
2358 if (selinux_option(in_curr, len))
2359 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2360 else
2361 take_option(&nosec, in_curr, &fnosec, len);
2362
2363 in_curr = in_end + 1;
2364 }
2365 } while (*in_end++);
2366
2367 strcpy(in_save, nosec_save);
2368 free_page((unsigned long)nosec_save);
2369 out:
2370 return rc;
2371 }
2372
2373 static int selinux_sb_remount(struct super_block *sb, void *data)
2374 {
2375 int rc, i, *flags;
2376 struct security_mnt_opts opts;
2377 char *secdata, **mount_options;
2378 struct superblock_security_struct *sbsec = sb->s_security;
2379
2380 if (!(sbsec->flags & SE_SBINITIALIZED))
2381 return 0;
2382
2383 if (!data)
2384 return 0;
2385
2386 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2387 return 0;
2388
2389 security_init_mnt_opts(&opts);
2390 secdata = alloc_secdata();
2391 if (!secdata)
2392 return -ENOMEM;
2393 rc = selinux_sb_copy_data(data, secdata);
2394 if (rc)
2395 goto out_free_secdata;
2396
2397 rc = selinux_parse_opts_str(secdata, &opts);
2398 if (rc)
2399 goto out_free_secdata;
2400
2401 mount_options = opts.mnt_opts;
2402 flags = opts.mnt_opts_flags;
2403
2404 for (i = 0; i < opts.num_mnt_opts; i++) {
2405 u32 sid;
2406 size_t len;
2407
2408 if (flags[i] == SE_SBLABELSUPP)
2409 continue;
2410 len = strlen(mount_options[i]);
2411 rc = security_context_to_sid(mount_options[i], len, &sid);
2412 if (rc) {
2413 printk(KERN_WARNING "SELinux: security_context_to_sid"
2414 "(%s) failed for (dev %s, type %s) errno=%d\n",
2415 mount_options[i], sb->s_id, sb->s_type->name, rc);
2416 goto out_free_opts;
2417 }
2418 rc = -EINVAL;
2419 switch (flags[i]) {
2420 case FSCONTEXT_MNT:
2421 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2422 goto out_bad_option;
2423 break;
2424 case CONTEXT_MNT:
2425 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2426 goto out_bad_option;
2427 break;
2428 case ROOTCONTEXT_MNT: {
2429 struct inode_security_struct *root_isec;
2430 root_isec = sb->s_root->d_inode->i_security;
2431
2432 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2433 goto out_bad_option;
2434 break;
2435 }
2436 case DEFCONTEXT_MNT:
2437 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2438 goto out_bad_option;
2439 break;
2440 default:
2441 goto out_free_opts;
2442 }
2443 }
2444
2445 rc = 0;
2446 out_free_opts:
2447 security_free_mnt_opts(&opts);
2448 out_free_secdata:
2449 free_secdata(secdata);
2450 return rc;
2451 out_bad_option:
2452 printk(KERN_WARNING "SELinux: unable to change security options "
2453 "during remount (dev %s, type=%s)\n", sb->s_id,
2454 sb->s_type->name);
2455 goto out_free_opts;
2456 }
2457
2458 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2459 {
2460 const struct cred *cred = current_cred();
2461 struct common_audit_data ad;
2462 int rc;
2463
2464 rc = superblock_doinit(sb, data);
2465 if (rc)
2466 return rc;
2467
2468 /* Allow all mounts performed by the kernel */
2469 if (flags & MS_KERNMOUNT)
2470 return 0;
2471
2472 ad.type = LSM_AUDIT_DATA_DENTRY;
2473 ad.u.dentry = sb->s_root;
2474 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2475 }
2476
2477 static int selinux_sb_statfs(struct dentry *dentry)
2478 {
2479 const struct cred *cred = current_cred();
2480 struct common_audit_data ad;
2481
2482 ad.type = LSM_AUDIT_DATA_DENTRY;
2483 ad.u.dentry = dentry->d_sb->s_root;
2484 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2485 }
2486
2487 static int selinux_mount(char *dev_name,
2488 struct path *path,
2489 char *type,
2490 unsigned long flags,
2491 void *data)
2492 {
2493 const struct cred *cred = current_cred();
2494
2495 if (flags & MS_REMOUNT)
2496 return superblock_has_perm(cred, path->dentry->d_sb,
2497 FILESYSTEM__REMOUNT, NULL);
2498 else
2499 return path_has_perm(cred, path, FILE__MOUNTON);
2500 }
2501
2502 static int selinux_umount(struct vfsmount *mnt, int flags)
2503 {
2504 const struct cred *cred = current_cred();
2505
2506 return superblock_has_perm(cred, mnt->mnt_sb,
2507 FILESYSTEM__UNMOUNT, NULL);
2508 }
2509
2510 /* inode security operations */
2511
2512 static int selinux_inode_alloc_security(struct inode *inode)
2513 {
2514 return inode_alloc_security(inode);
2515 }
2516
2517 static void selinux_inode_free_security(struct inode *inode)
2518 {
2519 inode_free_security(inode);
2520 }
2521
2522 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2523 const struct qstr *qstr, char **name,
2524 void **value, size_t *len)
2525 {
2526 const struct task_security_struct *tsec = current_security();
2527 struct inode_security_struct *dsec;
2528 struct superblock_security_struct *sbsec;
2529 u32 sid, newsid, clen;
2530 int rc;
2531 char *namep = NULL, *context;
2532
2533 dsec = dir->i_security;
2534 sbsec = dir->i_sb->s_security;
2535
2536 sid = tsec->sid;
2537 newsid = tsec->create_sid;
2538
2539 if ((sbsec->flags & SE_SBINITIALIZED) &&
2540 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2541 newsid = sbsec->mntpoint_sid;
2542 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2543 rc = security_transition_sid(sid, dsec->sid,
2544 inode_mode_to_security_class(inode->i_mode),
2545 qstr, &newsid);
2546 if (rc) {
2547 printk(KERN_WARNING "%s: "
2548 "security_transition_sid failed, rc=%d (dev=%s "
2549 "ino=%ld)\n",
2550 __func__,
2551 -rc, inode->i_sb->s_id, inode->i_ino);
2552 return rc;
2553 }
2554 }
2555
2556 /* Possibly defer initialization to selinux_complete_init. */
2557 if (sbsec->flags & SE_SBINITIALIZED) {
2558 struct inode_security_struct *isec = inode->i_security;
2559 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2560 isec->sid = newsid;
2561 isec->initialized = 1;
2562 }
2563
2564 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2565 return -EOPNOTSUPP;
2566
2567 if (name) {
2568 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2569 if (!namep)
2570 return -ENOMEM;
2571 *name = namep;
2572 }
2573
2574 if (value && len) {
2575 rc = security_sid_to_context_force(newsid, &context, &clen);
2576 if (rc) {
2577 kfree(namep);
2578 return rc;
2579 }
2580 *value = context;
2581 *len = clen;
2582 }
2583
2584 return 0;
2585 }
2586
2587 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2588 {
2589 return may_create(dir, dentry, SECCLASS_FILE);
2590 }
2591
2592 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2593 {
2594 return may_link(dir, old_dentry, MAY_LINK);
2595 }
2596
2597 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2598 {
2599 return may_link(dir, dentry, MAY_UNLINK);
2600 }
2601
2602 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2603 {
2604 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2605 }
2606
2607 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2608 {
2609 return may_create(dir, dentry, SECCLASS_DIR);
2610 }
2611
2612 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2613 {
2614 return may_link(dir, dentry, MAY_RMDIR);
2615 }
2616
2617 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2618 {
2619 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2620 }
2621
2622 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2623 struct inode *new_inode, struct dentry *new_dentry)
2624 {
2625 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2626 }
2627
2628 static int selinux_inode_readlink(struct dentry *dentry)
2629 {
2630 const struct cred *cred = current_cred();
2631
2632 return dentry_has_perm(cred, dentry, FILE__READ);
2633 }
2634
2635 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2636 {
2637 const struct cred *cred = current_cred();
2638
2639 return dentry_has_perm(cred, dentry, FILE__READ);
2640 }
2641
2642 static noinline int audit_inode_permission(struct inode *inode,
2643 u32 perms, u32 audited, u32 denied,
2644 unsigned flags)
2645 {
2646 struct common_audit_data ad;
2647 struct inode_security_struct *isec = inode->i_security;
2648 int rc;
2649
2650 ad.type = LSM_AUDIT_DATA_INODE;
2651 ad.u.inode = inode;
2652
2653 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2654 audited, denied, &ad, flags);
2655 if (rc)
2656 return rc;
2657 return 0;
2658 }
2659
2660 static int selinux_inode_permission(struct inode *inode, int mask)
2661 {
2662 const struct cred *cred = current_cred();
2663 u32 perms;
2664 bool from_access;
2665 unsigned flags = mask & MAY_NOT_BLOCK;
2666 struct inode_security_struct *isec;
2667 u32 sid;
2668 struct av_decision avd;
2669 int rc, rc2;
2670 u32 audited, denied;
2671
2672 from_access = mask & MAY_ACCESS;
2673 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2674
2675 /* No permission to check. Existence test. */
2676 if (!mask)
2677 return 0;
2678
2679 validate_creds(cred);
2680
2681 if (unlikely(IS_PRIVATE(inode)))
2682 return 0;
2683
2684 perms = file_mask_to_av(inode->i_mode, mask);
2685
2686 sid = cred_sid(cred);
2687 isec = inode->i_security;
2688
2689 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2690 audited = avc_audit_required(perms, &avd, rc,
2691 from_access ? FILE__AUDIT_ACCESS : 0,
2692 &denied);
2693 if (likely(!audited))
2694 return rc;
2695
2696 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2697 if (rc2)
2698 return rc2;
2699 return rc;
2700 }
2701
2702 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2703 {
2704 const struct cred *cred = current_cred();
2705 unsigned int ia_valid = iattr->ia_valid;
2706 __u32 av = FILE__WRITE;
2707
2708 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2709 if (ia_valid & ATTR_FORCE) {
2710 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2711 ATTR_FORCE);
2712 if (!ia_valid)
2713 return 0;
2714 }
2715
2716 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2717 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2718 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2719
2720 if (ia_valid & ATTR_SIZE)
2721 av |= FILE__OPEN;
2722
2723 return dentry_has_perm(cred, dentry, av);
2724 }
2725
2726 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2727 {
2728 const struct cred *cred = current_cred();
2729 struct path path;
2730
2731 path.dentry = dentry;
2732 path.mnt = mnt;
2733
2734 return path_has_perm(cred, &path, FILE__GETATTR);
2735 }
2736
2737 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2738 {
2739 const struct cred *cred = current_cred();
2740
2741 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2742 sizeof XATTR_SECURITY_PREFIX - 1)) {
2743 if (!strcmp(name, XATTR_NAME_CAPS)) {
2744 if (!capable(CAP_SETFCAP))
2745 return -EPERM;
2746 } else if (!capable(CAP_SYS_ADMIN)) {
2747 /* A different attribute in the security namespace.
2748 Restrict to administrator. */
2749 return -EPERM;
2750 }
2751 }
2752
2753 /* Not an attribute we recognize, so just check the
2754 ordinary setattr permission. */
2755 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2756 }
2757
2758 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2759 const void *value, size_t size, int flags)
2760 {
2761 struct inode *inode = dentry->d_inode;
2762 struct inode_security_struct *isec = inode->i_security;
2763 struct superblock_security_struct *sbsec;
2764 struct common_audit_data ad;
2765 u32 newsid, sid = current_sid();
2766 int rc = 0;
2767
2768 if (strcmp(name, XATTR_NAME_SELINUX))
2769 return selinux_inode_setotherxattr(dentry, name);
2770
2771 sbsec = inode->i_sb->s_security;
2772 if (!(sbsec->flags & SE_SBLABELSUPP))
2773 return -EOPNOTSUPP;
2774
2775 if (!inode_owner_or_capable(inode))
2776 return -EPERM;
2777
2778 ad.type = LSM_AUDIT_DATA_DENTRY;
2779 ad.u.dentry = dentry;
2780
2781 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2782 FILE__RELABELFROM, &ad);
2783 if (rc)
2784 return rc;
2785
2786 rc = security_context_to_sid(value, size, &newsid);
2787 if (rc == -EINVAL) {
2788 if (!capable(CAP_MAC_ADMIN)) {
2789 struct audit_buffer *ab;
2790 size_t audit_size;
2791 const char *str;
2792
2793 /* We strip a nul only if it is at the end, otherwise the
2794 * context contains a nul and we should audit that */
2795 str = value;
2796 if (str[size - 1] == '\0')
2797 audit_size = size - 1;
2798 else
2799 audit_size = size;
2800 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2801 audit_log_format(ab, "op=setxattr invalid_context=");
2802 audit_log_n_untrustedstring(ab, value, audit_size);
2803 audit_log_end(ab);
2804
2805 return rc;
2806 }
2807 rc = security_context_to_sid_force(value, size, &newsid);
2808 }
2809 if (rc)
2810 return rc;
2811
2812 rc = avc_has_perm(sid, newsid, isec->sclass,
2813 FILE__RELABELTO, &ad);
2814 if (rc)
2815 return rc;
2816
2817 rc = security_validate_transition(isec->sid, newsid, sid,
2818 isec->sclass);
2819 if (rc)
2820 return rc;
2821
2822 return avc_has_perm(newsid,
2823 sbsec->sid,
2824 SECCLASS_FILESYSTEM,
2825 FILESYSTEM__ASSOCIATE,
2826 &ad);
2827 }
2828
2829 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2830 const void *value, size_t size,
2831 int flags)
2832 {
2833 struct inode *inode = dentry->d_inode;
2834 struct inode_security_struct *isec = inode->i_security;
2835 u32 newsid;
2836 int rc;
2837
2838 if (strcmp(name, XATTR_NAME_SELINUX)) {
2839 /* Not an attribute we recognize, so nothing to do. */
2840 return;
2841 }
2842
2843 rc = security_context_to_sid_force(value, size, &newsid);
2844 if (rc) {
2845 printk(KERN_ERR "SELinux: unable to map context to SID"
2846 "for (%s, %lu), rc=%d\n",
2847 inode->i_sb->s_id, inode->i_ino, -rc);
2848 return;
2849 }
2850
2851 isec->sid = newsid;
2852 return;
2853 }
2854
2855 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2856 {
2857 const struct cred *cred = current_cred();
2858
2859 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2860 }
2861
2862 static int selinux_inode_listxattr(struct dentry *dentry)
2863 {
2864 const struct cred *cred = current_cred();
2865
2866 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2867 }
2868
2869 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2870 {
2871 if (strcmp(name, XATTR_NAME_SELINUX))
2872 return selinux_inode_setotherxattr(dentry, name);
2873
2874 /* No one is allowed to remove a SELinux security label.
2875 You can change the label, but all data must be labeled. */
2876 return -EACCES;
2877 }
2878
2879 /*
2880 * Copy the inode security context value to the user.
2881 *
2882 * Permission check is handled by selinux_inode_getxattr hook.
2883 */
2884 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2885 {
2886 u32 size;
2887 int error;
2888 char *context = NULL;
2889 struct inode_security_struct *isec = inode->i_security;
2890
2891 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2892 return -EOPNOTSUPP;
2893
2894 /*
2895 * If the caller has CAP_MAC_ADMIN, then get the raw context
2896 * value even if it is not defined by current policy; otherwise,
2897 * use the in-core value under current policy.
2898 * Use the non-auditing forms of the permission checks since
2899 * getxattr may be called by unprivileged processes commonly
2900 * and lack of permission just means that we fall back to the
2901 * in-core context value, not a denial.
2902 */
2903 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2904 SECURITY_CAP_NOAUDIT);
2905 if (!error)
2906 error = security_sid_to_context_force(isec->sid, &context,
2907 &size);
2908 else
2909 error = security_sid_to_context(isec->sid, &context, &size);
2910 if (error)
2911 return error;
2912 error = size;
2913 if (alloc) {
2914 *buffer = context;
2915 goto out_nofree;
2916 }
2917 kfree(context);
2918 out_nofree:
2919 return error;
2920 }
2921
2922 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2923 const void *value, size_t size, int flags)
2924 {
2925 struct inode_security_struct *isec = inode->i_security;
2926 u32 newsid;
2927 int rc;
2928
2929 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2930 return -EOPNOTSUPP;
2931
2932 if (!value || !size)
2933 return -EACCES;
2934
2935 rc = security_context_to_sid((void *)value, size, &newsid);
2936 if (rc)
2937 return rc;
2938
2939 isec->sid = newsid;
2940 isec->initialized = 1;
2941 return 0;
2942 }
2943
2944 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2945 {
2946 const int len = sizeof(XATTR_NAME_SELINUX);
2947 if (buffer && len <= buffer_size)
2948 memcpy(buffer, XATTR_NAME_SELINUX, len);
2949 return len;
2950 }
2951
2952 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2953 {
2954 struct inode_security_struct *isec = inode->i_security;
2955 *secid = isec->sid;
2956 }
2957
2958 /* file security operations */
2959
2960 static int selinux_revalidate_file_permission(struct file *file, int mask)
2961 {
2962 const struct cred *cred = current_cred();
2963 struct inode *inode = file->f_path.dentry->d_inode;
2964
2965 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2966 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2967 mask |= MAY_APPEND;
2968
2969 return file_has_perm(cred, file,
2970 file_mask_to_av(inode->i_mode, mask));
2971 }
2972
2973 static int selinux_file_permission(struct file *file, int mask)
2974 {
2975 struct inode *inode = file->f_path.dentry->d_inode;
2976 struct file_security_struct *fsec = file->f_security;
2977 struct inode_security_struct *isec = inode->i_security;
2978 u32 sid = current_sid();
2979
2980 if (!mask)
2981 /* No permission to check. Existence test. */
2982 return 0;
2983
2984 if (sid == fsec->sid && fsec->isid == isec->sid &&
2985 fsec->pseqno == avc_policy_seqno())
2986 /* No change since file_open check. */
2987 return 0;
2988
2989 return selinux_revalidate_file_permission(file, mask);
2990 }
2991
2992 static int selinux_file_alloc_security(struct file *file)
2993 {
2994 return file_alloc_security(file);
2995 }
2996
2997 static void selinux_file_free_security(struct file *file)
2998 {
2999 file_free_security(file);
3000 }
3001
3002 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3003 unsigned long arg)
3004 {
3005 const struct cred *cred = current_cred();
3006 int error = 0;
3007
3008 switch (cmd) {
3009 case FIONREAD:
3010 /* fall through */
3011 case FIBMAP:
3012 /* fall through */
3013 case FIGETBSZ:
3014 /* fall through */
3015 case FS_IOC_GETFLAGS:
3016 /* fall through */
3017 case FS_IOC_GETVERSION:
3018 error = file_has_perm(cred, file, FILE__GETATTR);
3019 break;
3020
3021 case FS_IOC_SETFLAGS:
3022 /* fall through */
3023 case FS_IOC_SETVERSION:
3024 error = file_has_perm(cred, file, FILE__SETATTR);
3025 break;
3026
3027 /* sys_ioctl() checks */
3028 case FIONBIO:
3029 /* fall through */
3030 case FIOASYNC:
3031 error = file_has_perm(cred, file, 0);
3032 break;
3033
3034 case KDSKBENT:
3035 case KDSKBSENT:
3036 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3037 SECURITY_CAP_AUDIT);
3038 break;
3039
3040 /* default case assumes that the command will go
3041 * to the file's ioctl() function.
3042 */
3043 default:
3044 error = file_has_perm(cred, file, FILE__IOCTL);
3045 }
3046 return error;
3047 }
3048
3049 static int default_noexec;
3050
3051 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3052 {
3053 const struct cred *cred = current_cred();
3054 int rc = 0;
3055
3056 if (default_noexec &&
3057 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3058 /*
3059 * We are making executable an anonymous mapping or a
3060 * private file mapping that will also be writable.
3061 * This has an additional check.
3062 */
3063 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3064 if (rc)
3065 goto error;
3066 }
3067
3068 if (file) {
3069 /* read access is always possible with a mapping */
3070 u32 av = FILE__READ;
3071
3072 /* write access only matters if the mapping is shared */
3073 if (shared && (prot & PROT_WRITE))
3074 av |= FILE__WRITE;
3075
3076 if (prot & PROT_EXEC)
3077 av |= FILE__EXECUTE;
3078
3079 return file_has_perm(cred, file, av);
3080 }
3081
3082 error:
3083 return rc;
3084 }
3085
3086 static int selinux_mmap_addr(unsigned long addr)
3087 {
3088 int rc = 0;
3089 u32 sid = current_sid();
3090
3091 /*
3092 * notice that we are intentionally putting the SELinux check before
3093 * the secondary cap_file_mmap check. This is such a likely attempt
3094 * at bad behaviour/exploit that we always want to get the AVC, even
3095 * if DAC would have also denied the operation.
3096 */
3097 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3098 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3099 MEMPROTECT__MMAP_ZERO, NULL);
3100 if (rc)
3101 return rc;
3102 }
3103
3104 /* do DAC check on address space usage */
3105 return cap_mmap_addr(addr);
3106 }
3107
3108 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3109 unsigned long prot, unsigned long flags)
3110 {
3111 if (selinux_checkreqprot)
3112 prot = reqprot;
3113
3114 return file_map_prot_check(file, prot,
3115 (flags & MAP_TYPE) == MAP_SHARED);
3116 }
3117
3118 static int selinux_file_mprotect(struct vm_area_struct *vma,
3119 unsigned long reqprot,
3120 unsigned long prot)
3121 {
3122 const struct cred *cred = current_cred();
3123
3124 if (selinux_checkreqprot)
3125 prot = reqprot;
3126
3127 if (default_noexec &&
3128 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3129 int rc = 0;
3130 if (vma->vm_start >= vma->vm_mm->start_brk &&
3131 vma->vm_end <= vma->vm_mm->brk) {
3132 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3133 } else if (!vma->vm_file &&
3134 vma->vm_start <= vma->vm_mm->start_stack &&
3135 vma->vm_end >= vma->vm_mm->start_stack) {
3136 rc = current_has_perm(current, PROCESS__EXECSTACK);
3137 } else if (vma->vm_file && vma->anon_vma) {
3138 /*
3139 * We are making executable a file mapping that has
3140 * had some COW done. Since pages might have been
3141 * written, check ability to execute the possibly
3142 * modified content. This typically should only
3143 * occur for text relocations.
3144 */
3145 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3146 }
3147 if (rc)
3148 return rc;
3149 }
3150
3151 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3152 }
3153
3154 static int selinux_file_lock(struct file *file, unsigned int cmd)
3155 {
3156 const struct cred *cred = current_cred();
3157
3158 return file_has_perm(cred, file, FILE__LOCK);
3159 }
3160
3161 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3162 unsigned long arg)
3163 {
3164 const struct cred *cred = current_cred();
3165 int err = 0;
3166
3167 switch (cmd) {
3168 case F_SETFL:
3169 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3170 err = -EINVAL;
3171 break;
3172 }
3173
3174 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3175 err = file_has_perm(cred, file, FILE__WRITE);
3176 break;
3177 }
3178 /* fall through */
3179 case F_SETOWN:
3180 case F_SETSIG:
3181 case F_GETFL:
3182 case F_GETOWN:
3183 case F_GETSIG:
3184 /* Just check FD__USE permission */
3185 err = file_has_perm(cred, file, 0);
3186 break;
3187 case F_GETLK:
3188 case F_SETLK:
3189 case F_SETLKW:
3190 #if BITS_PER_LONG == 32
3191 case F_GETLK64:
3192 case F_SETLK64:
3193 case F_SETLKW64:
3194 #endif
3195 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3196 err = -EINVAL;
3197 break;
3198 }
3199 err = file_has_perm(cred, file, FILE__LOCK);
3200 break;
3201 }
3202
3203 return err;
3204 }
3205
3206 static int selinux_file_set_fowner(struct file *file)
3207 {
3208 struct file_security_struct *fsec;
3209
3210 fsec = file->f_security;
3211 fsec->fown_sid = current_sid();
3212
3213 return 0;
3214 }
3215
3216 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3217 struct fown_struct *fown, int signum)
3218 {
3219 struct file *file;
3220 u32 sid = task_sid(tsk);
3221 u32 perm;
3222 struct file_security_struct *fsec;
3223
3224 /* struct fown_struct is never outside the context of a struct file */
3225 file = container_of(fown, struct file, f_owner);
3226
3227 fsec = file->f_security;
3228
3229 if (!signum)
3230 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3231 else
3232 perm = signal_to_av(signum);
3233
3234 return avc_has_perm(fsec->fown_sid, sid,
3235 SECCLASS_PROCESS, perm, NULL);
3236 }
3237
3238 static int selinux_file_receive(struct file *file)
3239 {
3240 const struct cred *cred = current_cred();
3241
3242 return file_has_perm(cred, file, file_to_av(file));
3243 }
3244
3245 static int selinux_file_open(struct file *file, const struct cred *cred)
3246 {
3247 struct file_security_struct *fsec;
3248 struct inode_security_struct *isec;
3249
3250 fsec = file->f_security;
3251 isec = file->f_path.dentry->d_inode->i_security;
3252 /*
3253 * Save inode label and policy sequence number
3254 * at open-time so that selinux_file_permission
3255 * can determine whether revalidation is necessary.
3256 * Task label is already saved in the file security
3257 * struct as its SID.
3258 */
3259 fsec->isid = isec->sid;
3260 fsec->pseqno = avc_policy_seqno();
3261 /*
3262 * Since the inode label or policy seqno may have changed
3263 * between the selinux_inode_permission check and the saving
3264 * of state above, recheck that access is still permitted.
3265 * Otherwise, access might never be revalidated against the
3266 * new inode label or new policy.
3267 * This check is not redundant - do not remove.
3268 */
3269 return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3270 }
3271
3272 /* task security operations */
3273
3274 static int selinux_task_create(unsigned long clone_flags)
3275 {
3276 return current_has_perm(current, PROCESS__FORK);
3277 }
3278
3279 /*
3280 * allocate the SELinux part of blank credentials
3281 */
3282 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3283 {
3284 struct task_security_struct *tsec;
3285
3286 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3287 if (!tsec)
3288 return -ENOMEM;
3289
3290 cred->security = tsec;
3291 return 0;
3292 }
3293
3294 /*
3295 * detach and free the LSM part of a set of credentials
3296 */
3297 static void selinux_cred_free(struct cred *cred)
3298 {
3299 struct task_security_struct *tsec = cred->security;
3300
3301 /*
3302 * cred->security == NULL if security_cred_alloc_blank() or
3303 * security_prepare_creds() returned an error.
3304 */
3305 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3306 cred->security = (void *) 0x7UL;
3307 kfree(tsec);
3308 }
3309
3310 /*
3311 * prepare a new set of credentials for modification
3312 */
3313 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3314 gfp_t gfp)
3315 {
3316 const struct task_security_struct *old_tsec;
3317 struct task_security_struct *tsec;
3318
3319 old_tsec = old->security;
3320
3321 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3322 if (!tsec)
3323 return -ENOMEM;
3324
3325 new->security = tsec;
3326 return 0;
3327 }
3328
3329 /*
3330 * transfer the SELinux data to a blank set of creds
3331 */
3332 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3333 {
3334 const struct task_security_struct *old_tsec = old->security;
3335 struct task_security_struct *tsec = new->security;
3336
3337 *tsec = *old_tsec;
3338 }
3339
3340 /*
3341 * set the security data for a kernel service
3342 * - all the creation contexts are set to unlabelled
3343 */
3344 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3345 {
3346 struct task_security_struct *tsec = new->security;
3347 u32 sid = current_sid();
3348 int ret;
3349
3350 ret = avc_has_perm(sid, secid,
3351 SECCLASS_KERNEL_SERVICE,
3352 KERNEL_SERVICE__USE_AS_OVERRIDE,
3353 NULL);
3354 if (ret == 0) {
3355 tsec->sid = secid;
3356 tsec->create_sid = 0;
3357 tsec->keycreate_sid = 0;
3358 tsec->sockcreate_sid = 0;
3359 }
3360 return ret;
3361 }
3362
3363 /*
3364 * set the file creation context in a security record to the same as the
3365 * objective context of the specified inode
3366 */
3367 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3368 {
3369 struct inode_security_struct *isec = inode->i_security;
3370 struct task_security_struct *tsec = new->security;
3371 u32 sid = current_sid();
3372 int ret;
3373
3374 ret = avc_has_perm(sid, isec->sid,
3375 SECCLASS_KERNEL_SERVICE,
3376 KERNEL_SERVICE__CREATE_FILES_AS,
3377 NULL);
3378
3379 if (ret == 0)
3380 tsec->create_sid = isec->sid;
3381 return ret;
3382 }
3383
3384 static int selinux_kernel_module_request(char *kmod_name)
3385 {
3386 u32 sid;
3387 struct common_audit_data ad;
3388
3389 sid = task_sid(current);
3390
3391 ad.type = LSM_AUDIT_DATA_KMOD;
3392 ad.u.kmod_name = kmod_name;
3393
3394 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3395 SYSTEM__MODULE_REQUEST, &ad);
3396 }
3397
3398 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3399 {
3400 return current_has_perm(p, PROCESS__SETPGID);
3401 }
3402
3403 static int selinux_task_getpgid(struct task_struct *p)
3404 {
3405 return current_has_perm(p, PROCESS__GETPGID);
3406 }
3407
3408 static int selinux_task_getsid(struct task_struct *p)
3409 {
3410 return current_has_perm(p, PROCESS__GETSESSION);
3411 }
3412
3413 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3414 {
3415 *secid = task_sid(p);
3416 }
3417
3418 static int selinux_task_setnice(struct task_struct *p, int nice)
3419 {
3420 int rc;
3421
3422 rc = cap_task_setnice(p, nice);
3423 if (rc)
3424 return rc;
3425
3426 return current_has_perm(p, PROCESS__SETSCHED);
3427 }
3428
3429 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3430 {
3431 int rc;
3432
3433 rc = cap_task_setioprio(p, ioprio);
3434 if (rc)
3435 return rc;
3436
3437 return current_has_perm(p, PROCESS__SETSCHED);
3438 }
3439
3440 static int selinux_task_getioprio(struct task_struct *p)
3441 {
3442 return current_has_perm(p, PROCESS__GETSCHED);
3443 }
3444
3445 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3446 struct rlimit *new_rlim)
3447 {
3448 struct rlimit *old_rlim = p->signal->rlim + resource;
3449
3450 /* Control the ability to change the hard limit (whether
3451 lowering or raising it), so that the hard limit can
3452 later be used as a safe reset point for the soft limit
3453 upon context transitions. See selinux_bprm_committing_creds. */
3454 if (old_rlim->rlim_max != new_rlim->rlim_max)
3455 return current_has_perm(p, PROCESS__SETRLIMIT);
3456
3457 return 0;
3458 }
3459
3460 static int selinux_task_setscheduler(struct task_struct *p)
3461 {
3462 int rc;
3463
3464 rc = cap_task_setscheduler(p);
3465 if (rc)
3466 return rc;
3467
3468 return current_has_perm(p, PROCESS__SETSCHED);
3469 }
3470
3471 static int selinux_task_getscheduler(struct task_struct *p)
3472 {
3473 return current_has_perm(p, PROCESS__GETSCHED);
3474 }
3475
3476 static int selinux_task_movememory(struct task_struct *p)
3477 {
3478 return current_has_perm(p, PROCESS__SETSCHED);
3479 }
3480
3481 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3482 int sig, u32 secid)
3483 {
3484 u32 perm;
3485 int rc;
3486
3487 if (!sig)
3488 perm = PROCESS__SIGNULL; /* null signal; existence test */
3489 else
3490 perm = signal_to_av(sig);
3491 if (secid)
3492 rc = avc_has_perm(secid, task_sid(p),
3493 SECCLASS_PROCESS, perm, NULL);
3494 else
3495 rc = current_has_perm(p, perm);
3496 return rc;
3497 }
3498
3499 static int selinux_task_wait(struct task_struct *p)
3500 {
3501 return task_has_perm(p, current, PROCESS__SIGCHLD);
3502 }
3503
3504 static void selinux_task_to_inode(struct task_struct *p,
3505 struct inode *inode)
3506 {
3507 struct inode_security_struct *isec = inode->i_security;
3508 u32 sid = task_sid(p);
3509
3510 isec->sid = sid;
3511 isec->initialized = 1;
3512 }
3513
3514 /* Returns error only if unable to parse addresses */
3515 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3516 struct common_audit_data *ad, u8 *proto)
3517 {
3518 int offset, ihlen, ret = -EINVAL;
3519 struct iphdr _iph, *ih;
3520
3521 offset = skb_network_offset(skb);
3522 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3523 if (ih == NULL)
3524 goto out;
3525
3526 ihlen = ih->ihl * 4;
3527 if (ihlen < sizeof(_iph))
3528 goto out;
3529
3530 ad->u.net->v4info.saddr = ih->saddr;
3531 ad->u.net->v4info.daddr = ih->daddr;
3532 ret = 0;
3533
3534 if (proto)
3535 *proto = ih->protocol;
3536
3537 switch (ih->protocol) {
3538 case IPPROTO_TCP: {
3539 struct tcphdr _tcph, *th;
3540
3541 if (ntohs(ih->frag_off) & IP_OFFSET)
3542 break;
3543
3544 offset += ihlen;
3545 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3546 if (th == NULL)
3547 break;
3548
3549 ad->u.net->sport = th->source;
3550 ad->u.net->dport = th->dest;
3551 break;
3552 }
3553
3554 case IPPROTO_UDP: {
3555 struct udphdr _udph, *uh;
3556
3557 if (ntohs(ih->frag_off) & IP_OFFSET)
3558 break;
3559
3560 offset += ihlen;
3561 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3562 if (uh == NULL)
3563 break;
3564
3565 ad->u.net->sport = uh->source;
3566 ad->u.net->dport = uh->dest;
3567 break;
3568 }
3569
3570 case IPPROTO_DCCP: {
3571 struct dccp_hdr _dccph, *dh;
3572
3573 if (ntohs(ih->frag_off) & IP_OFFSET)
3574 break;
3575
3576 offset += ihlen;
3577 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3578 if (dh == NULL)
3579 break;
3580
3581 ad->u.net->sport = dh->dccph_sport;
3582 ad->u.net->dport = dh->dccph_dport;
3583 break;
3584 }
3585
3586 default:
3587 break;
3588 }
3589 out:
3590 return ret;
3591 }
3592
3593 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3594
3595 /* Returns error only if unable to parse addresses */
3596 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3597 struct common_audit_data *ad, u8 *proto)
3598 {
3599 u8 nexthdr;
3600 int ret = -EINVAL, offset;
3601 struct ipv6hdr _ipv6h, *ip6;
3602 __be16 frag_off;
3603
3604 offset = skb_network_offset(skb);
3605 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3606 if (ip6 == NULL)
3607 goto out;
3608
3609 ad->u.net->v6info.saddr = ip6->saddr;
3610 ad->u.net->v6info.daddr = ip6->daddr;
3611 ret = 0;
3612
3613 nexthdr = ip6->nexthdr;
3614 offset += sizeof(_ipv6h);
3615 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3616 if (offset < 0)
3617 goto out;
3618
3619 if (proto)
3620 *proto = nexthdr;
3621
3622 switch (nexthdr) {
3623 case IPPROTO_TCP: {
3624 struct tcphdr _tcph, *th;
3625
3626 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3627 if (th == NULL)
3628 break;
3629
3630 ad->u.net->sport = th->source;
3631 ad->u.net->dport = th->dest;
3632 break;
3633 }
3634
3635 case IPPROTO_UDP: {
3636 struct udphdr _udph, *uh;
3637
3638 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3639 if (uh == NULL)
3640 break;
3641
3642 ad->u.net->sport = uh->source;
3643 ad->u.net->dport = uh->dest;
3644 break;
3645 }
3646
3647 case IPPROTO_DCCP: {
3648 struct dccp_hdr _dccph, *dh;
3649
3650 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3651 if (dh == NULL)
3652 break;
3653
3654 ad->u.net->sport = dh->dccph_sport;
3655 ad->u.net->dport = dh->dccph_dport;
3656 break;
3657 }
3658
3659 /* includes fragments */
3660 default:
3661 break;
3662 }
3663 out:
3664 return ret;
3665 }
3666
3667 #endif /* IPV6 */
3668
3669 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3670 char **_addrp, int src, u8 *proto)
3671 {
3672 char *addrp;
3673 int ret;
3674
3675 switch (ad->u.net->family) {
3676 case PF_INET:
3677 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3678 if (ret)
3679 goto parse_error;
3680 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3681 &ad->u.net->v4info.daddr);
3682 goto okay;
3683
3684 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3685 case PF_INET6:
3686 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3687 if (ret)
3688 goto parse_error;
3689 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3690 &ad->u.net->v6info.daddr);
3691 goto okay;
3692 #endif /* IPV6 */
3693 default:
3694 addrp = NULL;
3695 goto okay;
3696 }
3697
3698 parse_error:
3699 printk(KERN_WARNING
3700 "SELinux: failure in selinux_parse_skb(),"
3701 " unable to parse packet\n");
3702 return ret;
3703
3704 okay:
3705 if (_addrp)
3706 *_addrp = addrp;
3707 return 0;
3708 }
3709
3710 /**
3711 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3712 * @skb: the packet
3713 * @family: protocol family
3714 * @sid: the packet's peer label SID
3715 *
3716 * Description:
3717 * Check the various different forms of network peer labeling and determine
3718 * the peer label/SID for the packet; most of the magic actually occurs in
3719 * the security server function security_net_peersid_cmp(). The function
3720 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3721 * or -EACCES if @sid is invalid due to inconsistencies with the different
3722 * peer labels.
3723 *
3724 */
3725 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3726 {
3727 int err;
3728 u32 xfrm_sid;
3729 u32 nlbl_sid;
3730 u32 nlbl_type;
3731
3732 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3733 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3734
3735 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3736 if (unlikely(err)) {
3737 printk(KERN_WARNING
3738 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3739 " unable to determine packet's peer label\n");
3740 return -EACCES;
3741 }
3742
3743 return 0;
3744 }
3745
3746 /* socket security operations */
3747
3748 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3749 u16 secclass, u32 *socksid)
3750 {
3751 if (tsec->sockcreate_sid > SECSID_NULL) {
3752 *socksid = tsec->sockcreate_sid;
3753 return 0;
3754 }
3755
3756 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3757 socksid);
3758 }
3759
3760 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3761 {
3762 struct sk_security_struct *sksec = sk->sk_security;
3763 struct common_audit_data ad;
3764 struct lsm_network_audit net = {0,};
3765 u32 tsid = task_sid(task);
3766
3767 if (sksec->sid == SECINITSID_KERNEL)
3768 return 0;
3769
3770 ad.type = LSM_AUDIT_DATA_NET;
3771 ad.u.net = &net;
3772 ad.u.net->sk = sk;
3773
3774 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3775 }
3776
3777 static int selinux_socket_create(int family, int type,
3778 int protocol, int kern)
3779 {
3780 const struct task_security_struct *tsec = current_security();
3781 u32 newsid;
3782 u16 secclass;
3783 int rc;
3784
3785 if (kern)
3786 return 0;
3787
3788 secclass = socket_type_to_security_class(family, type, protocol);
3789 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3790 if (rc)
3791 return rc;
3792
3793 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3794 }
3795
3796 static int selinux_socket_post_create(struct socket *sock, int family,
3797 int type, int protocol, int kern)
3798 {
3799 const struct task_security_struct *tsec = current_security();
3800 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3801 struct sk_security_struct *sksec;
3802 int err = 0;
3803
3804 isec->sclass = socket_type_to_security_class(family, type, protocol);
3805
3806 if (kern)
3807 isec->sid = SECINITSID_KERNEL;
3808 else {
3809 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3810 if (err)
3811 return err;
3812 }
3813
3814 isec->initialized = 1;
3815
3816 if (sock->sk) {
3817 sksec = sock->sk->sk_security;
3818 sksec->sid = isec->sid;
3819 sksec->sclass = isec->sclass;
3820 err = selinux_netlbl_socket_post_create(sock->sk, family);
3821 }
3822
3823 return err;
3824 }
3825
3826 /* Range of port numbers used to automatically bind.
3827 Need to determine whether we should perform a name_bind
3828 permission check between the socket and the port number. */
3829
3830 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3831 {
3832 struct sock *sk = sock->sk;
3833 u16 family;
3834 int err;
3835
3836 err = sock_has_perm(current, sk, SOCKET__BIND);
3837 if (err)
3838 goto out;
3839
3840 /*
3841 * If PF_INET or PF_INET6, check name_bind permission for the port.
3842 * Multiple address binding for SCTP is not supported yet: we just
3843 * check the first address now.
3844 */
3845 family = sk->sk_family;
3846 if (family == PF_INET || family == PF_INET6) {
3847 char *addrp;
3848 struct sk_security_struct *sksec = sk->sk_security;
3849 struct common_audit_data ad;
3850 struct lsm_network_audit net = {0,};
3851 struct sockaddr_in *addr4 = NULL;
3852 struct sockaddr_in6 *addr6 = NULL;
3853 unsigned short snum;
3854 u32 sid, node_perm;
3855
3856 if (family == PF_INET) {
3857 addr4 = (struct sockaddr_in *)address;
3858 snum = ntohs(addr4->sin_port);
3859 addrp = (char *)&addr4->sin_addr.s_addr;
3860 } else {
3861 addr6 = (struct sockaddr_in6 *)address;
3862 snum = ntohs(addr6->sin6_port);
3863 addrp = (char *)&addr6->sin6_addr.s6_addr;
3864 }
3865
3866 if (snum) {
3867 int low, high;
3868
3869 inet_get_local_port_range(&low, &high);
3870
3871 if (snum < max(PROT_SOCK, low) || snum > high) {
3872 err = sel_netport_sid(sk->sk_protocol,
3873 snum, &sid);
3874 if (err)
3875 goto out;
3876 ad.type = LSM_AUDIT_DATA_NET;
3877 ad.u.net = &net;
3878 ad.u.net->sport = htons(snum);
3879 ad.u.net->family = family;
3880 err = avc_has_perm(sksec->sid, sid,
3881 sksec->sclass,
3882 SOCKET__NAME_BIND, &ad);
3883 if (err)
3884 goto out;
3885 }
3886 }
3887
3888 switch (sksec->sclass) {
3889 case SECCLASS_TCP_SOCKET:
3890 node_perm = TCP_SOCKET__NODE_BIND;
3891 break;
3892
3893 case SECCLASS_UDP_SOCKET:
3894 node_perm = UDP_SOCKET__NODE_BIND;
3895 break;
3896
3897 case SECCLASS_DCCP_SOCKET:
3898 node_perm = DCCP_SOCKET__NODE_BIND;
3899 break;
3900
3901 default:
3902 node_perm = RAWIP_SOCKET__NODE_BIND;
3903 break;
3904 }
3905
3906 err = sel_netnode_sid(addrp, family, &sid);
3907 if (err)
3908 goto out;
3909
3910 ad.type = LSM_AUDIT_DATA_NET;
3911 ad.u.net = &net;
3912 ad.u.net->sport = htons(snum);
3913 ad.u.net->family = family;
3914
3915 if (family == PF_INET)
3916 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3917 else
3918 ad.u.net->v6info.saddr = addr6->sin6_addr;
3919
3920 err = avc_has_perm(sksec->sid, sid,
3921 sksec->sclass, node_perm, &ad);
3922 if (err)
3923 goto out;
3924 }
3925 out:
3926 return err;
3927 }
3928
3929 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3930 {
3931 struct sock *sk = sock->sk;
3932 struct sk_security_struct *sksec = sk->sk_security;
3933 int err;
3934
3935 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3936 if (err)
3937 return err;
3938
3939 /*
3940 * If a TCP or DCCP socket, check name_connect permission for the port.
3941 */
3942 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3943 sksec->sclass == SECCLASS_DCCP_SOCKET) {
3944 struct common_audit_data ad;
3945 struct lsm_network_audit net = {0,};
3946 struct sockaddr_in *addr4 = NULL;
3947 struct sockaddr_in6 *addr6 = NULL;
3948 unsigned short snum;
3949 u32 sid, perm;
3950
3951 if (sk->sk_family == PF_INET) {
3952 addr4 = (struct sockaddr_in *)address;
3953 if (addrlen < sizeof(struct sockaddr_in))
3954 return -EINVAL;
3955 snum = ntohs(addr4->sin_port);
3956 } else {
3957 addr6 = (struct sockaddr_in6 *)address;
3958 if (addrlen < SIN6_LEN_RFC2133)
3959 return -EINVAL;
3960 snum = ntohs(addr6->sin6_port);
3961 }
3962
3963 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3964 if (err)
3965 goto out;
3966
3967 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3968 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3969
3970 ad.type = LSM_AUDIT_DATA_NET;
3971 ad.u.net = &net;
3972 ad.u.net->dport = htons(snum);
3973 ad.u.net->family = sk->sk_family;
3974 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3975 if (err)
3976 goto out;
3977 }
3978
3979 err = selinux_netlbl_socket_connect(sk, address);
3980
3981 out:
3982 return err;
3983 }
3984
3985 static int selinux_socket_listen(struct socket *sock, int backlog)
3986 {
3987 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3988 }
3989
3990 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3991 {
3992 int err;
3993 struct inode_security_struct *isec;
3994 struct inode_security_struct *newisec;
3995
3996 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3997 if (err)
3998 return err;
3999
4000 newisec = SOCK_INODE(newsock)->i_security;
4001
4002 isec = SOCK_INODE(sock)->i_security;
4003 newisec->sclass = isec->sclass;
4004 newisec->sid = isec->sid;
4005 newisec->initialized = 1;
4006
4007 return 0;
4008 }
4009
4010 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4011 int size)
4012 {
4013 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4014 }
4015
4016 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4017 int size, int flags)
4018 {
4019 return sock_has_perm(current, sock->sk, SOCKET__READ);
4020 }
4021
4022 static int selinux_socket_getsockname(struct socket *sock)
4023 {
4024 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4025 }
4026
4027 static int selinux_socket_getpeername(struct socket *sock)
4028 {
4029 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4030 }
4031
4032 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4033 {
4034 int err;
4035
4036 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4037 if (err)
4038 return err;
4039
4040 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4041 }
4042
4043 static int selinux_socket_getsockopt(struct socket *sock, int level,
4044 int optname)
4045 {
4046 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4047 }
4048
4049 static int selinux_socket_shutdown(struct socket *sock, int how)
4050 {
4051 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4052 }
4053
4054 static int selinux_socket_unix_stream_connect(struct sock *sock,
4055 struct sock *other,
4056 struct sock *newsk)
4057 {
4058 struct sk_security_struct *sksec_sock = sock->sk_security;
4059 struct sk_security_struct *sksec_other = other->sk_security;
4060 struct sk_security_struct *sksec_new = newsk->sk_security;
4061 struct common_audit_data ad;
4062 struct lsm_network_audit net = {0,};
4063 int err;
4064
4065 ad.type = LSM_AUDIT_DATA_NET;
4066 ad.u.net = &net;
4067 ad.u.net->sk = other;
4068
4069 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4070 sksec_other->sclass,
4071 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4072 if (err)
4073 return err;
4074
4075 /* server child socket */
4076 sksec_new->peer_sid = sksec_sock->sid;
4077 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4078 &sksec_new->sid);
4079 if (err)
4080 return err;
4081
4082 /* connecting socket */
4083 sksec_sock->peer_sid = sksec_new->sid;
4084
4085 return 0;
4086 }
4087
4088 static int selinux_socket_unix_may_send(struct socket *sock,
4089 struct socket *other)
4090 {
4091 struct sk_security_struct *ssec = sock->sk->sk_security;
4092 struct sk_security_struct *osec = other->sk->sk_security;
4093 struct common_audit_data ad;
4094 struct lsm_network_audit net = {0,};
4095
4096 ad.type = LSM_AUDIT_DATA_NET;
4097 ad.u.net = &net;
4098 ad.u.net->sk = other->sk;
4099
4100 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4101 &ad);
4102 }
4103
4104 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4105 u32 peer_sid,
4106 struct common_audit_data *ad)
4107 {
4108 int err;
4109 u32 if_sid;
4110 u32 node_sid;
4111
4112 err = sel_netif_sid(ifindex, &if_sid);
4113 if (err)
4114 return err;
4115 err = avc_has_perm(peer_sid, if_sid,
4116 SECCLASS_NETIF, NETIF__INGRESS, ad);
4117 if (err)
4118 return err;
4119
4120 err = sel_netnode_sid(addrp, family, &node_sid);
4121 if (err)
4122 return err;
4123 return avc_has_perm(peer_sid, node_sid,
4124 SECCLASS_NODE, NODE__RECVFROM, ad);
4125 }
4126
4127 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4128 u16 family)
4129 {
4130 int err = 0;
4131 struct sk_security_struct *sksec = sk->sk_security;
4132 u32 sk_sid = sksec->sid;
4133 struct common_audit_data ad;
4134 struct lsm_network_audit net = {0,};
4135 char *addrp;
4136
4137 ad.type = LSM_AUDIT_DATA_NET;
4138 ad.u.net = &net;
4139 ad.u.net->netif = skb->skb_iif;
4140 ad.u.net->family = family;
4141 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4142 if (err)
4143 return err;
4144
4145 if (selinux_secmark_enabled()) {
4146 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4147 PACKET__RECV, &ad);
4148 if (err)
4149 return err;
4150 }
4151
4152 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4153 if (err)
4154 return err;
4155 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4156
4157 return err;
4158 }
4159
4160 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4161 {
4162 int err;
4163 struct sk_security_struct *sksec = sk->sk_security;
4164 u16 family = sk->sk_family;
4165 u32 sk_sid = sksec->sid;
4166 struct common_audit_data ad;
4167 struct lsm_network_audit net = {0,};
4168 char *addrp;
4169 u8 secmark_active;
4170 u8 peerlbl_active;
4171
4172 if (family != PF_INET && family != PF_INET6)
4173 return 0;
4174
4175 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4176 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4177 family = PF_INET;
4178
4179 /* If any sort of compatibility mode is enabled then handoff processing
4180 * to the selinux_sock_rcv_skb_compat() function to deal with the
4181 * special handling. We do this in an attempt to keep this function
4182 * as fast and as clean as possible. */
4183 if (!selinux_policycap_netpeer)
4184 return selinux_sock_rcv_skb_compat(sk, skb, family);
4185
4186 secmark_active = selinux_secmark_enabled();
4187 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4188 if (!secmark_active && !peerlbl_active)
4189 return 0;
4190
4191 ad.type = LSM_AUDIT_DATA_NET;
4192 ad.u.net = &net;
4193 ad.u.net->netif = skb->skb_iif;
4194 ad.u.net->family = family;
4195 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4196 if (err)
4197 return err;
4198
4199 if (peerlbl_active) {
4200 u32 peer_sid;
4201
4202 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4203 if (err)
4204 return err;
4205 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4206 peer_sid, &ad);
4207 if (err) {
4208 selinux_netlbl_err(skb, err, 0);
4209 return err;
4210 }
4211 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4212 PEER__RECV, &ad);
4213 if (err)
4214 selinux_netlbl_err(skb, err, 0);
4215 }
4216
4217 if (secmark_active) {
4218 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4219 PACKET__RECV, &ad);
4220 if (err)
4221 return err;
4222 }
4223
4224 return err;
4225 }
4226
4227 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4228 int __user *optlen, unsigned len)
4229 {
4230 int err = 0;
4231 char *scontext;
4232 u32 scontext_len;
4233 struct sk_security_struct *sksec = sock->sk->sk_security;
4234 u32 peer_sid = SECSID_NULL;
4235
4236 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4237 sksec->sclass == SECCLASS_TCP_SOCKET)
4238 peer_sid = sksec->peer_sid;
4239 if (peer_sid == SECSID_NULL)
4240 return -ENOPROTOOPT;
4241
4242 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4243 if (err)
4244 return err;
4245
4246 if (scontext_len > len) {
4247 err = -ERANGE;
4248 goto out_len;
4249 }
4250
4251 if (copy_to_user(optval, scontext, scontext_len))
4252 err = -EFAULT;
4253
4254 out_len:
4255 if (put_user(scontext_len, optlen))
4256 err = -EFAULT;
4257 kfree(scontext);
4258 return err;
4259 }
4260
4261 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4262 {
4263 u32 peer_secid = SECSID_NULL;
4264 u16 family;
4265
4266 if (skb && skb->protocol == htons(ETH_P_IP))
4267 family = PF_INET;
4268 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4269 family = PF_INET6;
4270 else if (sock)
4271 family = sock->sk->sk_family;
4272 else
4273 goto out;
4274
4275 if (sock && family == PF_UNIX)
4276 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4277 else if (skb)
4278 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4279
4280 out:
4281 *secid = peer_secid;
4282 if (peer_secid == SECSID_NULL)
4283 return -EINVAL;
4284 return 0;
4285 }
4286
4287 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4288 {
4289 struct sk_security_struct *sksec;
4290
4291 sksec = kzalloc(sizeof(*sksec), priority);
4292 if (!sksec)
4293 return -ENOMEM;
4294
4295 sksec->peer_sid = SECINITSID_UNLABELED;
4296 sksec->sid = SECINITSID_UNLABELED;
4297 selinux_netlbl_sk_security_reset(sksec);
4298 sk->sk_security = sksec;
4299
4300 return 0;
4301 }
4302
4303 static void selinux_sk_free_security(struct sock *sk)
4304 {
4305 struct sk_security_struct *sksec = sk->sk_security;
4306
4307 sk->sk_security = NULL;
4308 selinux_netlbl_sk_security_free(sksec);
4309 kfree(sksec);
4310 }
4311
4312 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4313 {
4314 struct sk_security_struct *sksec = sk->sk_security;
4315 struct sk_security_struct *newsksec = newsk->sk_security;
4316
4317 newsksec->sid = sksec->sid;
4318 newsksec->peer_sid = sksec->peer_sid;
4319 newsksec->sclass = sksec->sclass;
4320
4321 selinux_netlbl_sk_security_reset(newsksec);
4322 }
4323
4324 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4325 {
4326 if (!sk)
4327 *secid = SECINITSID_ANY_SOCKET;
4328 else {
4329 struct sk_security_struct *sksec = sk->sk_security;
4330
4331 *secid = sksec->sid;
4332 }
4333 }
4334
4335 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4336 {
4337 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4338 struct sk_security_struct *sksec = sk->sk_security;
4339
4340 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4341 sk->sk_family == PF_UNIX)
4342 isec->sid = sksec->sid;
4343 sksec->sclass = isec->sclass;
4344 }
4345
4346 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4347 struct request_sock *req)
4348 {
4349 struct sk_security_struct *sksec = sk->sk_security;
4350 int err;
4351 u16 family = sk->sk_family;
4352 u32 newsid;
4353 u32 peersid;
4354
4355 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4356 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4357 family = PF_INET;
4358
4359 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4360 if (err)
4361 return err;
4362 if (peersid == SECSID_NULL) {
4363 req->secid = sksec->sid;
4364 req->peer_secid = SECSID_NULL;
4365 } else {
4366 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4367 if (err)
4368 return err;
4369 req->secid = newsid;
4370 req->peer_secid = peersid;
4371 }
4372
4373 return selinux_netlbl_inet_conn_request(req, family);
4374 }
4375
4376 static void selinux_inet_csk_clone(struct sock *newsk,
4377 const struct request_sock *req)
4378 {
4379 struct sk_security_struct *newsksec = newsk->sk_security;
4380
4381 newsksec->sid = req->secid;
4382 newsksec->peer_sid = req->peer_secid;
4383 /* NOTE: Ideally, we should also get the isec->sid for the
4384 new socket in sync, but we don't have the isec available yet.
4385 So we will wait until sock_graft to do it, by which
4386 time it will have been created and available. */
4387
4388 /* We don't need to take any sort of lock here as we are the only
4389 * thread with access to newsksec */
4390 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4391 }
4392
4393 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4394 {
4395 u16 family = sk->sk_family;
4396 struct sk_security_struct *sksec = sk->sk_security;
4397
4398 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4399 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4400 family = PF_INET;
4401
4402 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4403 }
4404
4405 static int selinux_secmark_relabel_packet(u32 sid)
4406 {
4407 const struct task_security_struct *__tsec;
4408 u32 tsid;
4409
4410 __tsec = current_security();
4411 tsid = __tsec->sid;
4412
4413 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4414 }
4415
4416 static void selinux_secmark_refcount_inc(void)
4417 {
4418 atomic_inc(&selinux_secmark_refcount);
4419 }
4420
4421 static void selinux_secmark_refcount_dec(void)
4422 {
4423 atomic_dec(&selinux_secmark_refcount);
4424 }
4425
4426 static void selinux_req_classify_flow(const struct request_sock *req,
4427 struct flowi *fl)
4428 {
4429 fl->flowi_secid = req->secid;
4430 }
4431
4432 static int selinux_tun_dev_create(void)
4433 {
4434 u32 sid = current_sid();
4435
4436 /* we aren't taking into account the "sockcreate" SID since the socket
4437 * that is being created here is not a socket in the traditional sense,
4438 * instead it is a private sock, accessible only to the kernel, and
4439 * representing a wide range of network traffic spanning multiple
4440 * connections unlike traditional sockets - check the TUN driver to
4441 * get a better understanding of why this socket is special */
4442
4443 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4444 NULL);
4445 }
4446
4447 static void selinux_tun_dev_post_create(struct sock *sk)
4448 {
4449 struct sk_security_struct *sksec = sk->sk_security;
4450
4451 /* we don't currently perform any NetLabel based labeling here and it
4452 * isn't clear that we would want to do so anyway; while we could apply
4453 * labeling without the support of the TUN user the resulting labeled
4454 * traffic from the other end of the connection would almost certainly
4455 * cause confusion to the TUN user that had no idea network labeling
4456 * protocols were being used */
4457
4458 /* see the comments in selinux_tun_dev_create() about why we don't use
4459 * the sockcreate SID here */
4460
4461 sksec->sid = current_sid();
4462 sksec->sclass = SECCLASS_TUN_SOCKET;
4463 }
4464
4465 static int selinux_tun_dev_attach(struct sock *sk)
4466 {
4467 struct sk_security_struct *sksec = sk->sk_security;
4468 u32 sid = current_sid();
4469 int err;
4470
4471 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4472 TUN_SOCKET__RELABELFROM, NULL);
4473 if (err)
4474 return err;
4475 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4476 TUN_SOCKET__RELABELTO, NULL);
4477 if (err)
4478 return err;
4479
4480 sksec->sid = sid;
4481
4482 return 0;
4483 }
4484
4485 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4486 {
4487 int err = 0;
4488 u32 perm;
4489 struct nlmsghdr *nlh;
4490 struct sk_security_struct *sksec = sk->sk_security;
4491
4492 if (skb->len < NLMSG_SPACE(0)) {
4493 err = -EINVAL;
4494 goto out;
4495 }
4496 nlh = nlmsg_hdr(skb);
4497
4498 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4499 if (err) {
4500 if (err == -EINVAL) {
4501 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4502 "SELinux: unrecognized netlink message"
4503 " type=%hu for sclass=%hu\n",
4504 nlh->nlmsg_type, sksec->sclass);
4505 if (!selinux_enforcing || security_get_allow_unknown())
4506 err = 0;
4507 }
4508
4509 /* Ignore */
4510 if (err == -ENOENT)
4511 err = 0;
4512 goto out;
4513 }
4514
4515 err = sock_has_perm(current, sk, perm);
4516 out:
4517 return err;
4518 }
4519
4520 #ifdef CONFIG_NETFILTER
4521
4522 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4523 u16 family)
4524 {
4525 int err;
4526 char *addrp;
4527 u32 peer_sid;
4528 struct common_audit_data ad;
4529 struct lsm_network_audit net = {0,};
4530 u8 secmark_active;
4531 u8 netlbl_active;
4532 u8 peerlbl_active;
4533
4534 if (!selinux_policycap_netpeer)
4535 return NF_ACCEPT;
4536
4537 secmark_active = selinux_secmark_enabled();
4538 netlbl_active = netlbl_enabled();
4539 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4540 if (!secmark_active && !peerlbl_active)
4541 return NF_ACCEPT;
4542
4543 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4544 return NF_DROP;
4545
4546 ad.type = LSM_AUDIT_DATA_NET;
4547 ad.u.net = &net;
4548 ad.u.net->netif = ifindex;
4549 ad.u.net->family = family;
4550 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4551 return NF_DROP;
4552
4553 if (peerlbl_active) {
4554 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4555 peer_sid, &ad);
4556 if (err) {
4557 selinux_netlbl_err(skb, err, 1);
4558 return NF_DROP;
4559 }
4560 }
4561
4562 if (secmark_active)
4563 if (avc_has_perm(peer_sid, skb->secmark,
4564 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4565 return NF_DROP;
4566
4567 if (netlbl_active)
4568 /* we do this in the FORWARD path and not the POST_ROUTING
4569 * path because we want to make sure we apply the necessary
4570 * labeling before IPsec is applied so we can leverage AH
4571 * protection */
4572 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4573 return NF_DROP;
4574
4575 return NF_ACCEPT;
4576 }
4577
4578 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4579 struct sk_buff *skb,
4580 const struct net_device *in,
4581 const struct net_device *out,
4582 int (*okfn)(struct sk_buff *))
4583 {
4584 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4585 }
4586
4587 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4588 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4589 struct sk_buff *skb,
4590 const struct net_device *in,
4591 const struct net_device *out,
4592 int (*okfn)(struct sk_buff *))
4593 {
4594 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4595 }
4596 #endif /* IPV6 */
4597
4598 static unsigned int selinux_ip_output(struct sk_buff *skb,
4599 u16 family)
4600 {
4601 u32 sid;
4602
4603 if (!netlbl_enabled())
4604 return NF_ACCEPT;
4605
4606 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4607 * because we want to make sure we apply the necessary labeling
4608 * before IPsec is applied so we can leverage AH protection */
4609 if (skb->sk) {
4610 struct sk_security_struct *sksec = skb->sk->sk_security;
4611 sid = sksec->sid;
4612 } else
4613 sid = SECINITSID_KERNEL;
4614 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4615 return NF_DROP;
4616
4617 return NF_ACCEPT;
4618 }
4619
4620 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4621 struct sk_buff *skb,
4622 const struct net_device *in,
4623 const struct net_device *out,
4624 int (*okfn)(struct sk_buff *))
4625 {
4626 return selinux_ip_output(skb, PF_INET);
4627 }
4628
4629 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4630 int ifindex,
4631 u16 family)
4632 {
4633 struct sock *sk = skb->sk;
4634 struct sk_security_struct *sksec;
4635 struct common_audit_data ad;
4636 struct lsm_network_audit net = {0,};
4637 char *addrp;
4638 u8 proto;
4639
4640 if (sk == NULL)
4641 return NF_ACCEPT;
4642 sksec = sk->sk_security;
4643
4644 ad.type = LSM_AUDIT_DATA_NET;
4645 ad.u.net = &net;
4646 ad.u.net->netif = ifindex;
4647 ad.u.net->family = family;
4648 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4649 return NF_DROP;
4650
4651 if (selinux_secmark_enabled())
4652 if (avc_has_perm(sksec->sid, skb->secmark,
4653 SECCLASS_PACKET, PACKET__SEND, &ad))
4654 return NF_DROP_ERR(-ECONNREFUSED);
4655
4656 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4657 return NF_DROP_ERR(-ECONNREFUSED);
4658
4659 return NF_ACCEPT;
4660 }
4661
4662 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4663 u16 family)
4664 {
4665 u32 secmark_perm;
4666 u32 peer_sid;
4667 struct sock *sk;
4668 struct common_audit_data ad;
4669 struct lsm_network_audit net = {0,};
4670 char *addrp;
4671 u8 secmark_active;
4672 u8 peerlbl_active;
4673
4674 /* If any sort of compatibility mode is enabled then handoff processing
4675 * to the selinux_ip_postroute_compat() function to deal with the
4676 * special handling. We do this in an attempt to keep this function
4677 * as fast and as clean as possible. */
4678 if (!selinux_policycap_netpeer)
4679 return selinux_ip_postroute_compat(skb, ifindex, family);
4680 #ifdef CONFIG_XFRM
4681 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4682 * packet transformation so allow the packet to pass without any checks
4683 * since we'll have another chance to perform access control checks
4684 * when the packet is on it's final way out.
4685 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4686 * is NULL, in this case go ahead and apply access control. */
4687 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4688 return NF_ACCEPT;
4689 #endif
4690 secmark_active = selinux_secmark_enabled();
4691 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4692 if (!secmark_active && !peerlbl_active)
4693 return NF_ACCEPT;
4694
4695 /* if the packet is being forwarded then get the peer label from the
4696 * packet itself; otherwise check to see if it is from a local
4697 * application or the kernel, if from an application get the peer label
4698 * from the sending socket, otherwise use the kernel's sid */
4699 sk = skb->sk;
4700 if (sk == NULL) {
4701 if (skb->skb_iif) {
4702 secmark_perm = PACKET__FORWARD_OUT;
4703 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4704 return NF_DROP;
4705 } else {
4706 secmark_perm = PACKET__SEND;
4707 peer_sid = SECINITSID_KERNEL;
4708 }
4709 } else {
4710 struct sk_security_struct *sksec = sk->sk_security;
4711 peer_sid = sksec->sid;
4712 secmark_perm = PACKET__SEND;
4713 }
4714
4715 ad.type = LSM_AUDIT_DATA_NET;
4716 ad.u.net = &net;
4717 ad.u.net->netif = ifindex;
4718 ad.u.net->family = family;
4719 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4720 return NF_DROP;
4721
4722 if (secmark_active)
4723 if (avc_has_perm(peer_sid, skb->secmark,
4724 SECCLASS_PACKET, secmark_perm, &ad))
4725 return NF_DROP_ERR(-ECONNREFUSED);
4726
4727 if (peerlbl_active) {
4728 u32 if_sid;
4729 u32 node_sid;
4730
4731 if (sel_netif_sid(ifindex, &if_sid))
4732 return NF_DROP;
4733 if (avc_has_perm(peer_sid, if_sid,
4734 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4735 return NF_DROP_ERR(-ECONNREFUSED);
4736
4737 if (sel_netnode_sid(addrp, family, &node_sid))
4738 return NF_DROP;
4739 if (avc_has_perm(peer_sid, node_sid,
4740 SECCLASS_NODE, NODE__SENDTO, &ad))
4741 return NF_DROP_ERR(-ECONNREFUSED);
4742 }
4743
4744 return NF_ACCEPT;
4745 }
4746
4747 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4748 struct sk_buff *skb,
4749 const struct net_device *in,
4750 const struct net_device *out,
4751 int (*okfn)(struct sk_buff *))
4752 {
4753 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4754 }
4755
4756 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4757 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4758 struct sk_buff *skb,
4759 const struct net_device *in,
4760 const struct net_device *out,
4761 int (*okfn)(struct sk_buff *))
4762 {
4763 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4764 }
4765 #endif /* IPV6 */
4766
4767 #endif /* CONFIG_NETFILTER */
4768
4769 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4770 {
4771 int err;
4772
4773 err = cap_netlink_send(sk, skb);
4774 if (err)
4775 return err;
4776
4777 return selinux_nlmsg_perm(sk, skb);
4778 }
4779
4780 static int ipc_alloc_security(struct task_struct *task,
4781 struct kern_ipc_perm *perm,
4782 u16 sclass)
4783 {
4784 struct ipc_security_struct *isec;
4785 u32 sid;
4786
4787 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4788 if (!isec)
4789 return -ENOMEM;
4790
4791 sid = task_sid(task);
4792 isec->sclass = sclass;
4793 isec->sid = sid;
4794 perm->security = isec;
4795
4796 return 0;
4797 }
4798
4799 static void ipc_free_security(struct kern_ipc_perm *perm)
4800 {
4801 struct ipc_security_struct *isec = perm->security;
4802 perm->security = NULL;
4803 kfree(isec);
4804 }
4805
4806 static int msg_msg_alloc_security(struct msg_msg *msg)
4807 {
4808 struct msg_security_struct *msec;
4809
4810 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4811 if (!msec)
4812 return -ENOMEM;
4813
4814 msec->sid = SECINITSID_UNLABELED;
4815 msg->security = msec;
4816
4817 return 0;
4818 }
4819
4820 static void msg_msg_free_security(struct msg_msg *msg)
4821 {
4822 struct msg_security_struct *msec = msg->security;
4823
4824 msg->security = NULL;
4825 kfree(msec);
4826 }
4827
4828 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4829 u32 perms)
4830 {
4831 struct ipc_security_struct *isec;
4832 struct common_audit_data ad;
4833 u32 sid = current_sid();
4834
4835 isec = ipc_perms->security;
4836
4837 ad.type = LSM_AUDIT_DATA_IPC;
4838 ad.u.ipc_id = ipc_perms->key;
4839
4840 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4841 }
4842
4843 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4844 {
4845 return msg_msg_alloc_security(msg);
4846 }
4847
4848 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4849 {
4850 msg_msg_free_security(msg);
4851 }
4852
4853 /* message queue security operations */
4854 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4855 {
4856 struct ipc_security_struct *isec;
4857 struct common_audit_data ad;
4858 u32 sid = current_sid();
4859 int rc;
4860
4861 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4862 if (rc)
4863 return rc;
4864
4865 isec = msq->q_perm.security;
4866
4867 ad.type = LSM_AUDIT_DATA_IPC;
4868 ad.u.ipc_id = msq->q_perm.key;
4869
4870 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4871 MSGQ__CREATE, &ad);
4872 if (rc) {
4873 ipc_free_security(&msq->q_perm);
4874 return rc;
4875 }
4876 return 0;
4877 }
4878
4879 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4880 {
4881 ipc_free_security(&msq->q_perm);
4882 }
4883
4884 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4885 {
4886 struct ipc_security_struct *isec;
4887 struct common_audit_data ad;
4888 u32 sid = current_sid();
4889
4890 isec = msq->q_perm.security;
4891
4892 ad.type = LSM_AUDIT_DATA_IPC;
4893 ad.u.ipc_id = msq->q_perm.key;
4894
4895 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4896 MSGQ__ASSOCIATE, &ad);
4897 }
4898
4899 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4900 {
4901 int err;
4902 int perms;
4903
4904 switch (cmd) {
4905 case IPC_INFO:
4906 case MSG_INFO:
4907 /* No specific object, just general system-wide information. */
4908 return task_has_system(current, SYSTEM__IPC_INFO);
4909 case IPC_STAT:
4910 case MSG_STAT:
4911 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4912 break;
4913 case IPC_SET:
4914 perms = MSGQ__SETATTR;
4915 break;
4916 case IPC_RMID:
4917 perms = MSGQ__DESTROY;
4918 break;
4919 default:
4920 return 0;
4921 }
4922
4923 err = ipc_has_perm(&msq->q_perm, perms);
4924 return err;
4925 }
4926
4927 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4928 {
4929 struct ipc_security_struct *isec;
4930 struct msg_security_struct *msec;
4931 struct common_audit_data ad;
4932 u32 sid = current_sid();
4933 int rc;
4934
4935 isec = msq->q_perm.security;
4936 msec = msg->security;
4937
4938 /*
4939 * First time through, need to assign label to the message
4940 */
4941 if (msec->sid == SECINITSID_UNLABELED) {
4942 /*
4943 * Compute new sid based on current process and
4944 * message queue this message will be stored in
4945 */
4946 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4947 NULL, &msec->sid);
4948 if (rc)
4949 return rc;
4950 }
4951
4952 ad.type = LSM_AUDIT_DATA_IPC;
4953 ad.u.ipc_id = msq->q_perm.key;
4954
4955 /* Can this process write to the queue? */
4956 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4957 MSGQ__WRITE, &ad);
4958 if (!rc)
4959 /* Can this process send the message */
4960 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4961 MSG__SEND, &ad);
4962 if (!rc)
4963 /* Can the message be put in the queue? */
4964 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4965 MSGQ__ENQUEUE, &ad);
4966
4967 return rc;
4968 }
4969
4970 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4971 struct task_struct *target,
4972 long type, int mode)
4973 {
4974 struct ipc_security_struct *isec;
4975 struct msg_security_struct *msec;
4976 struct common_audit_data ad;
4977 u32 sid = task_sid(target);
4978 int rc;
4979
4980 isec = msq->q_perm.security;
4981 msec = msg->security;
4982
4983 ad.type = LSM_AUDIT_DATA_IPC;
4984 ad.u.ipc_id = msq->q_perm.key;
4985
4986 rc = avc_has_perm(sid, isec->sid,
4987 SECCLASS_MSGQ, MSGQ__READ, &ad);
4988 if (!rc)
4989 rc = avc_has_perm(sid, msec->sid,
4990 SECCLASS_MSG, MSG__RECEIVE, &ad);
4991 return rc;
4992 }
4993
4994 /* Shared Memory security operations */
4995 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4996 {
4997 struct ipc_security_struct *isec;
4998 struct common_audit_data ad;
4999 u32 sid = current_sid();
5000 int rc;
5001
5002 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5003 if (rc)
5004 return rc;
5005
5006 isec = shp->shm_perm.security;
5007
5008 ad.type = LSM_AUDIT_DATA_IPC;
5009 ad.u.ipc_id = shp->shm_perm.key;
5010
5011 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5012 SHM__CREATE, &ad);
5013 if (rc) {
5014 ipc_free_security(&shp->shm_perm);
5015 return rc;
5016 }
5017 return 0;
5018 }
5019
5020 static void selinux_shm_free_security(struct shmid_kernel *shp)
5021 {
5022 ipc_free_security(&shp->shm_perm);
5023 }
5024
5025 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5026 {
5027 struct ipc_security_struct *isec;
5028 struct common_audit_data ad;
5029 u32 sid = current_sid();
5030
5031 isec = shp->shm_perm.security;
5032
5033 ad.type = LSM_AUDIT_DATA_IPC;
5034 ad.u.ipc_id = shp->shm_perm.key;
5035
5036 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5037 SHM__ASSOCIATE, &ad);
5038 }
5039
5040 /* Note, at this point, shp is locked down */
5041 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5042 {
5043 int perms;
5044 int err;
5045
5046 switch (cmd) {
5047 case IPC_INFO:
5048 case SHM_INFO:
5049 /* No specific object, just general system-wide information. */
5050 return task_has_system(current, SYSTEM__IPC_INFO);
5051 case IPC_STAT:
5052 case SHM_STAT:
5053 perms = SHM__GETATTR | SHM__ASSOCIATE;
5054 break;
5055 case IPC_SET:
5056 perms = SHM__SETATTR;
5057 break;
5058 case SHM_LOCK:
5059 case SHM_UNLOCK:
5060 perms = SHM__LOCK;
5061 break;
5062 case IPC_RMID:
5063 perms = SHM__DESTROY;
5064 break;
5065 default:
5066 return 0;
5067 }
5068
5069 err = ipc_has_perm(&shp->shm_perm, perms);
5070 return err;
5071 }
5072
5073 static int selinux_shm_shmat(struct shmid_kernel *shp,
5074 char __user *shmaddr, int shmflg)
5075 {
5076 u32 perms;
5077
5078 if (shmflg & SHM_RDONLY)
5079 perms = SHM__READ;
5080 else
5081 perms = SHM__READ | SHM__WRITE;
5082
5083 return ipc_has_perm(&shp->shm_perm, perms);
5084 }
5085
5086 /* Semaphore security operations */
5087 static int selinux_sem_alloc_security(struct sem_array *sma)
5088 {
5089 struct ipc_security_struct *isec;
5090 struct common_audit_data ad;
5091 u32 sid = current_sid();
5092 int rc;
5093
5094 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5095 if (rc)
5096 return rc;
5097
5098 isec = sma->sem_perm.security;
5099
5100 ad.type = LSM_AUDIT_DATA_IPC;
5101 ad.u.ipc_id = sma->sem_perm.key;
5102
5103 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5104 SEM__CREATE, &ad);
5105 if (rc) {
5106 ipc_free_security(&sma->sem_perm);
5107 return rc;
5108 }
5109 return 0;
5110 }
5111
5112 static void selinux_sem_free_security(struct sem_array *sma)
5113 {
5114 ipc_free_security(&sma->sem_perm);
5115 }
5116
5117 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5118 {
5119 struct ipc_security_struct *isec;
5120 struct common_audit_data ad;
5121 u32 sid = current_sid();
5122
5123 isec = sma->sem_perm.security;
5124
5125 ad.type = LSM_AUDIT_DATA_IPC;
5126 ad.u.ipc_id = sma->sem_perm.key;
5127
5128 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5129 SEM__ASSOCIATE, &ad);
5130 }
5131
5132 /* Note, at this point, sma is locked down */
5133 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5134 {
5135 int err;
5136 u32 perms;
5137
5138 switch (cmd) {
5139 case IPC_INFO:
5140 case SEM_INFO:
5141 /* No specific object, just general system-wide information. */
5142 return task_has_system(current, SYSTEM__IPC_INFO);
5143 case GETPID:
5144 case GETNCNT:
5145 case GETZCNT:
5146 perms = SEM__GETATTR;
5147 break;
5148 case GETVAL:
5149 case GETALL:
5150 perms = SEM__READ;
5151 break;
5152 case SETVAL:
5153 case SETALL:
5154 perms = SEM__WRITE;
5155 break;
5156 case IPC_RMID:
5157 perms = SEM__DESTROY;
5158 break;
5159 case IPC_SET:
5160 perms = SEM__SETATTR;
5161 break;
5162 case IPC_STAT:
5163 case SEM_STAT:
5164 perms = SEM__GETATTR | SEM__ASSOCIATE;
5165 break;
5166 default:
5167 return 0;
5168 }
5169
5170 err = ipc_has_perm(&sma->sem_perm, perms);
5171 return err;
5172 }
5173
5174 static int selinux_sem_semop(struct sem_array *sma,
5175 struct sembuf *sops, unsigned nsops, int alter)
5176 {
5177 u32 perms;
5178
5179 if (alter)
5180 perms = SEM__READ | SEM__WRITE;
5181 else
5182 perms = SEM__READ;
5183
5184 return ipc_has_perm(&sma->sem_perm, perms);
5185 }
5186
5187 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5188 {
5189 u32 av = 0;
5190
5191 av = 0;
5192 if (flag & S_IRUGO)
5193 av |= IPC__UNIX_READ;
5194 if (flag & S_IWUGO)
5195 av |= IPC__UNIX_WRITE;
5196
5197 if (av == 0)
5198 return 0;
5199
5200 return ipc_has_perm(ipcp, av);
5201 }
5202
5203 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5204 {
5205 struct ipc_security_struct *isec = ipcp->security;
5206 *secid = isec->sid;
5207 }
5208
5209 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5210 {
5211 if (inode)
5212 inode_doinit_with_dentry(inode, dentry);
5213 }
5214
5215 static int selinux_getprocattr(struct task_struct *p,
5216 char *name, char **value)
5217 {
5218 const struct task_security_struct *__tsec;
5219 u32 sid;
5220 int error;
5221 unsigned len;
5222
5223 if (current != p) {
5224 error = current_has_perm(p, PROCESS__GETATTR);
5225 if (error)
5226 return error;
5227 }
5228
5229 rcu_read_lock();
5230 __tsec = __task_cred(p)->security;
5231
5232 if (!strcmp(name, "current"))
5233 sid = __tsec->sid;
5234 else if (!strcmp(name, "prev"))
5235 sid = __tsec->osid;
5236 else if (!strcmp(name, "exec"))
5237 sid = __tsec->exec_sid;
5238 else if (!strcmp(name, "fscreate"))
5239 sid = __tsec->create_sid;
5240 else if (!strcmp(name, "keycreate"))
5241 sid = __tsec->keycreate_sid;
5242 else if (!strcmp(name, "sockcreate"))
5243 sid = __tsec->sockcreate_sid;
5244 else
5245 goto invalid;
5246 rcu_read_unlock();
5247
5248 if (!sid)
5249 return 0;
5250
5251 error = security_sid_to_context(sid, value, &len);
5252 if (error)
5253 return error;
5254 return len;
5255
5256 invalid:
5257 rcu_read_unlock();
5258 return -EINVAL;
5259 }
5260
5261 static int selinux_setprocattr(struct task_struct *p,
5262 char *name, void *value, size_t size)
5263 {
5264 struct task_security_struct *tsec;
5265 struct task_struct *tracer;
5266 struct cred *new;
5267 u32 sid = 0, ptsid;
5268 int error;
5269 char *str = value;
5270
5271 if (current != p) {
5272 /* SELinux only allows a process to change its own
5273 security attributes. */
5274 return -EACCES;
5275 }
5276
5277 /*
5278 * Basic control over ability to set these attributes at all.
5279 * current == p, but we'll pass them separately in case the
5280 * above restriction is ever removed.
5281 */
5282 if (!strcmp(name, "exec"))
5283 error = current_has_perm(p, PROCESS__SETEXEC);
5284 else if (!strcmp(name, "fscreate"))
5285 error = current_has_perm(p, PROCESS__SETFSCREATE);
5286 else if (!strcmp(name, "keycreate"))
5287 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5288 else if (!strcmp(name, "sockcreate"))
5289 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5290 else if (!strcmp(name, "current"))
5291 error = current_has_perm(p, PROCESS__SETCURRENT);
5292 else
5293 error = -EINVAL;
5294 if (error)
5295 return error;
5296
5297 /* Obtain a SID for the context, if one was specified. */
5298 if (size && str[1] && str[1] != '\n') {
5299 if (str[size-1] == '\n') {
5300 str[size-1] = 0;
5301 size--;
5302 }
5303 error = security_context_to_sid(value, size, &sid);
5304 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5305 if (!capable(CAP_MAC_ADMIN)) {
5306 struct audit_buffer *ab;
5307 size_t audit_size;
5308
5309 /* We strip a nul only if it is at the end, otherwise the
5310 * context contains a nul and we should audit that */
5311 if (str[size - 1] == '\0')
5312 audit_size = size - 1;
5313 else
5314 audit_size = size;
5315 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5316 audit_log_format(ab, "op=fscreate invalid_context=");
5317 audit_log_n_untrustedstring(ab, value, audit_size);
5318 audit_log_end(ab);
5319
5320 return error;
5321 }
5322 error = security_context_to_sid_force(value, size,
5323 &sid);
5324 }
5325 if (error)
5326 return error;
5327 }
5328
5329 new = prepare_creds();
5330 if (!new)
5331 return -ENOMEM;
5332
5333 /* Permission checking based on the specified context is
5334 performed during the actual operation (execve,
5335 open/mkdir/...), when we know the full context of the
5336 operation. See selinux_bprm_set_creds for the execve
5337 checks and may_create for the file creation checks. The
5338 operation will then fail if the context is not permitted. */
5339 tsec = new->security;
5340 if (!strcmp(name, "exec")) {
5341 tsec->exec_sid = sid;
5342 } else if (!strcmp(name, "fscreate")) {
5343 tsec->create_sid = sid;
5344 } else if (!strcmp(name, "keycreate")) {
5345 error = may_create_key(sid, p);
5346 if (error)
5347 goto abort_change;
5348 tsec->keycreate_sid = sid;
5349 } else if (!strcmp(name, "sockcreate")) {
5350 tsec->sockcreate_sid = sid;
5351 } else if (!strcmp(name, "current")) {
5352 error = -EINVAL;
5353 if (sid == 0)
5354 goto abort_change;
5355
5356 /* Only allow single threaded processes to change context */
5357 error = -EPERM;
5358 if (!current_is_single_threaded()) {
5359 error = security_bounded_transition(tsec->sid, sid);
5360 if (error)
5361 goto abort_change;
5362 }
5363
5364 /* Check permissions for the transition. */
5365 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5366 PROCESS__DYNTRANSITION, NULL);
5367 if (error)
5368 goto abort_change;
5369
5370 /* Check for ptracing, and update the task SID if ok.
5371 Otherwise, leave SID unchanged and fail. */
5372 ptsid = 0;
5373 task_lock(p);
5374 tracer = ptrace_parent(p);
5375 if (tracer)
5376 ptsid = task_sid(tracer);
5377 task_unlock(p);
5378
5379 if (tracer) {
5380 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5381 PROCESS__PTRACE, NULL);
5382 if (error)
5383 goto abort_change;
5384 }
5385
5386 tsec->sid = sid;
5387 } else {
5388 error = -EINVAL;
5389 goto abort_change;
5390 }
5391
5392 commit_creds(new);
5393 return size;
5394
5395 abort_change:
5396 abort_creds(new);
5397 return error;
5398 }
5399
5400 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5401 {
5402 return security_sid_to_context(secid, secdata, seclen);
5403 }
5404
5405 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5406 {
5407 return security_context_to_sid(secdata, seclen, secid);
5408 }
5409
5410 static void selinux_release_secctx(char *secdata, u32 seclen)
5411 {
5412 kfree(secdata);
5413 }
5414
5415 /*
5416 * called with inode->i_mutex locked
5417 */
5418 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5419 {
5420 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5421 }
5422
5423 /*
5424 * called with inode->i_mutex locked
5425 */
5426 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5427 {
5428 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5429 }
5430
5431 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5432 {
5433 int len = 0;
5434 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5435 ctx, true);
5436 if (len < 0)
5437 return len;
5438 *ctxlen = len;
5439 return 0;
5440 }
5441 #ifdef CONFIG_KEYS
5442
5443 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5444 unsigned long flags)
5445 {
5446 const struct task_security_struct *tsec;
5447 struct key_security_struct *ksec;
5448
5449 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5450 if (!ksec)
5451 return -ENOMEM;
5452
5453 tsec = cred->security;
5454 if (tsec->keycreate_sid)
5455 ksec->sid = tsec->keycreate_sid;
5456 else
5457 ksec->sid = tsec->sid;
5458
5459 k->security = ksec;
5460 return 0;
5461 }
5462
5463 static void selinux_key_free(struct key *k)
5464 {
5465 struct key_security_struct *ksec = k->security;
5466
5467 k->security = NULL;
5468 kfree(ksec);
5469 }
5470
5471 static int selinux_key_permission(key_ref_t key_ref,
5472 const struct cred *cred,
5473 key_perm_t perm)
5474 {
5475 struct key *key;
5476 struct key_security_struct *ksec;
5477 u32 sid;
5478
5479 /* if no specific permissions are requested, we skip the
5480 permission check. No serious, additional covert channels
5481 appear to be created. */
5482 if (perm == 0)
5483 return 0;
5484
5485 sid = cred_sid(cred);
5486
5487 key = key_ref_to_ptr(key_ref);
5488 ksec = key->security;
5489
5490 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5491 }
5492
5493 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5494 {
5495 struct key_security_struct *ksec = key->security;
5496 char *context = NULL;
5497 unsigned len;
5498 int rc;
5499
5500 rc = security_sid_to_context(ksec->sid, &context, &len);
5501 if (!rc)
5502 rc = len;
5503 *_buffer = context;
5504 return rc;
5505 }
5506
5507 #endif
5508
5509 static struct security_operations selinux_ops = {
5510 .name = "selinux",
5511
5512 .ptrace_access_check = selinux_ptrace_access_check,
5513 .ptrace_traceme = selinux_ptrace_traceme,
5514 .capget = selinux_capget,
5515 .capset = selinux_capset,
5516 .capable = selinux_capable,
5517 .quotactl = selinux_quotactl,
5518 .quota_on = selinux_quota_on,
5519 .syslog = selinux_syslog,
5520 .vm_enough_memory = selinux_vm_enough_memory,
5521
5522 .netlink_send = selinux_netlink_send,
5523
5524 .bprm_set_creds = selinux_bprm_set_creds,
5525 .bprm_committing_creds = selinux_bprm_committing_creds,
5526 .bprm_committed_creds = selinux_bprm_committed_creds,
5527 .bprm_secureexec = selinux_bprm_secureexec,
5528
5529 .sb_alloc_security = selinux_sb_alloc_security,
5530 .sb_free_security = selinux_sb_free_security,
5531 .sb_copy_data = selinux_sb_copy_data,
5532 .sb_remount = selinux_sb_remount,
5533 .sb_kern_mount = selinux_sb_kern_mount,
5534 .sb_show_options = selinux_sb_show_options,
5535 .sb_statfs = selinux_sb_statfs,
5536 .sb_mount = selinux_mount,
5537 .sb_umount = selinux_umount,
5538 .sb_set_mnt_opts = selinux_set_mnt_opts,
5539 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5540 .sb_parse_opts_str = selinux_parse_opts_str,
5541
5542
5543 .inode_alloc_security = selinux_inode_alloc_security,
5544 .inode_free_security = selinux_inode_free_security,
5545 .inode_init_security = selinux_inode_init_security,
5546 .inode_create = selinux_inode_create,
5547 .inode_link = selinux_inode_link,
5548 .inode_unlink = selinux_inode_unlink,
5549 .inode_symlink = selinux_inode_symlink,
5550 .inode_mkdir = selinux_inode_mkdir,
5551 .inode_rmdir = selinux_inode_rmdir,
5552 .inode_mknod = selinux_inode_mknod,
5553 .inode_rename = selinux_inode_rename,
5554 .inode_readlink = selinux_inode_readlink,
5555 .inode_follow_link = selinux_inode_follow_link,
5556 .inode_permission = selinux_inode_permission,
5557 .inode_setattr = selinux_inode_setattr,
5558 .inode_getattr = selinux_inode_getattr,
5559 .inode_setxattr = selinux_inode_setxattr,
5560 .inode_post_setxattr = selinux_inode_post_setxattr,
5561 .inode_getxattr = selinux_inode_getxattr,
5562 .inode_listxattr = selinux_inode_listxattr,
5563 .inode_removexattr = selinux_inode_removexattr,
5564 .inode_getsecurity = selinux_inode_getsecurity,
5565 .inode_setsecurity = selinux_inode_setsecurity,
5566 .inode_listsecurity = selinux_inode_listsecurity,
5567 .inode_getsecid = selinux_inode_getsecid,
5568
5569 .file_permission = selinux_file_permission,
5570 .file_alloc_security = selinux_file_alloc_security,
5571 .file_free_security = selinux_file_free_security,
5572 .file_ioctl = selinux_file_ioctl,
5573 .mmap_file = selinux_mmap_file,
5574 .mmap_addr = selinux_mmap_addr,
5575 .file_mprotect = selinux_file_mprotect,
5576 .file_lock = selinux_file_lock,
5577 .file_fcntl = selinux_file_fcntl,
5578 .file_set_fowner = selinux_file_set_fowner,
5579 .file_send_sigiotask = selinux_file_send_sigiotask,
5580 .file_receive = selinux_file_receive,
5581
5582 .file_open = selinux_file_open,
5583
5584 .task_create = selinux_task_create,
5585 .cred_alloc_blank = selinux_cred_alloc_blank,
5586 .cred_free = selinux_cred_free,
5587 .cred_prepare = selinux_cred_prepare,
5588 .cred_transfer = selinux_cred_transfer,
5589 .kernel_act_as = selinux_kernel_act_as,
5590 .kernel_create_files_as = selinux_kernel_create_files_as,
5591 .kernel_module_request = selinux_kernel_module_request,
5592 .task_setpgid = selinux_task_setpgid,
5593 .task_getpgid = selinux_task_getpgid,
5594 .task_getsid = selinux_task_getsid,
5595 .task_getsecid = selinux_task_getsecid,
5596 .task_setnice = selinux_task_setnice,
5597 .task_setioprio = selinux_task_setioprio,
5598 .task_getioprio = selinux_task_getioprio,
5599 .task_setrlimit = selinux_task_setrlimit,
5600 .task_setscheduler = selinux_task_setscheduler,
5601 .task_getscheduler = selinux_task_getscheduler,
5602 .task_movememory = selinux_task_movememory,
5603 .task_kill = selinux_task_kill,
5604 .task_wait = selinux_task_wait,
5605 .task_to_inode = selinux_task_to_inode,
5606
5607 .ipc_permission = selinux_ipc_permission,
5608 .ipc_getsecid = selinux_ipc_getsecid,
5609
5610 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5611 .msg_msg_free_security = selinux_msg_msg_free_security,
5612
5613 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5614 .msg_queue_free_security = selinux_msg_queue_free_security,
5615 .msg_queue_associate = selinux_msg_queue_associate,
5616 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5617 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5618 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5619
5620 .shm_alloc_security = selinux_shm_alloc_security,
5621 .shm_free_security = selinux_shm_free_security,
5622 .shm_associate = selinux_shm_associate,
5623 .shm_shmctl = selinux_shm_shmctl,
5624 .shm_shmat = selinux_shm_shmat,
5625
5626 .sem_alloc_security = selinux_sem_alloc_security,
5627 .sem_free_security = selinux_sem_free_security,
5628 .sem_associate = selinux_sem_associate,
5629 .sem_semctl = selinux_sem_semctl,
5630 .sem_semop = selinux_sem_semop,
5631
5632 .d_instantiate = selinux_d_instantiate,
5633
5634 .getprocattr = selinux_getprocattr,
5635 .setprocattr = selinux_setprocattr,
5636
5637 .secid_to_secctx = selinux_secid_to_secctx,
5638 .secctx_to_secid = selinux_secctx_to_secid,
5639 .release_secctx = selinux_release_secctx,
5640 .inode_notifysecctx = selinux_inode_notifysecctx,
5641 .inode_setsecctx = selinux_inode_setsecctx,
5642 .inode_getsecctx = selinux_inode_getsecctx,
5643
5644 .unix_stream_connect = selinux_socket_unix_stream_connect,
5645 .unix_may_send = selinux_socket_unix_may_send,
5646
5647 .socket_create = selinux_socket_create,
5648 .socket_post_create = selinux_socket_post_create,
5649 .socket_bind = selinux_socket_bind,
5650 .socket_connect = selinux_socket_connect,
5651 .socket_listen = selinux_socket_listen,
5652 .socket_accept = selinux_socket_accept,
5653 .socket_sendmsg = selinux_socket_sendmsg,
5654 .socket_recvmsg = selinux_socket_recvmsg,
5655 .socket_getsockname = selinux_socket_getsockname,
5656 .socket_getpeername = selinux_socket_getpeername,
5657 .socket_getsockopt = selinux_socket_getsockopt,
5658 .socket_setsockopt = selinux_socket_setsockopt,
5659 .socket_shutdown = selinux_socket_shutdown,
5660 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5661 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5662 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5663 .sk_alloc_security = selinux_sk_alloc_security,
5664 .sk_free_security = selinux_sk_free_security,
5665 .sk_clone_security = selinux_sk_clone_security,
5666 .sk_getsecid = selinux_sk_getsecid,
5667 .sock_graft = selinux_sock_graft,
5668 .inet_conn_request = selinux_inet_conn_request,
5669 .inet_csk_clone = selinux_inet_csk_clone,
5670 .inet_conn_established = selinux_inet_conn_established,
5671 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5672 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5673 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5674 .req_classify_flow = selinux_req_classify_flow,
5675 .tun_dev_create = selinux_tun_dev_create,
5676 .tun_dev_post_create = selinux_tun_dev_post_create,
5677 .tun_dev_attach = selinux_tun_dev_attach,
5678
5679 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5680 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5681 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5682 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5683 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5684 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5685 .xfrm_state_free_security = selinux_xfrm_state_free,
5686 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5687 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5688 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5689 .xfrm_decode_session = selinux_xfrm_decode_session,
5690 #endif
5691
5692 #ifdef CONFIG_KEYS
5693 .key_alloc = selinux_key_alloc,
5694 .key_free = selinux_key_free,
5695 .key_permission = selinux_key_permission,
5696 .key_getsecurity = selinux_key_getsecurity,
5697 #endif
5698
5699 #ifdef CONFIG_AUDIT
5700 .audit_rule_init = selinux_audit_rule_init,
5701 .audit_rule_known = selinux_audit_rule_known,
5702 .audit_rule_match = selinux_audit_rule_match,
5703 .audit_rule_free = selinux_audit_rule_free,
5704 #endif
5705 };
5706
5707 static __init int selinux_init(void)
5708 {
5709 if (!security_module_enable(&selinux_ops)) {
5710 selinux_enabled = 0;
5711 return 0;
5712 }
5713
5714 if (!selinux_enabled) {
5715 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5716 return 0;
5717 }
5718
5719 printk(KERN_INFO "SELinux: Initializing.\n");
5720
5721 /* Set the security state for the initial task. */
5722 cred_init_security();
5723
5724 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5725
5726 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5727 sizeof(struct inode_security_struct),
5728 0, SLAB_PANIC, NULL);
5729 avc_init();
5730
5731 if (register_security(&selinux_ops))
5732 panic("SELinux: Unable to register with kernel.\n");
5733
5734 if (selinux_enforcing)
5735 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5736 else
5737 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5738
5739 return 0;
5740 }
5741
5742 static void delayed_superblock_init(struct super_block *sb, void *unused)
5743 {
5744 superblock_doinit(sb, NULL);
5745 }
5746
5747 void selinux_complete_init(void)
5748 {
5749 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5750
5751 /* Set up any superblocks initialized prior to the policy load. */
5752 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5753 iterate_supers(delayed_superblock_init, NULL);
5754 }
5755
5756 /* SELinux requires early initialization in order to label
5757 all processes and objects when they are created. */
5758 security_initcall(selinux_init);
5759
5760 #if defined(CONFIG_NETFILTER)
5761
5762 static struct nf_hook_ops selinux_ipv4_ops[] = {
5763 {
5764 .hook = selinux_ipv4_postroute,
5765 .owner = THIS_MODULE,
5766 .pf = PF_INET,
5767 .hooknum = NF_INET_POST_ROUTING,
5768 .priority = NF_IP_PRI_SELINUX_LAST,
5769 },
5770 {
5771 .hook = selinux_ipv4_forward,
5772 .owner = THIS_MODULE,
5773 .pf = PF_INET,
5774 .hooknum = NF_INET_FORWARD,
5775 .priority = NF_IP_PRI_SELINUX_FIRST,
5776 },
5777 {
5778 .hook = selinux_ipv4_output,
5779 .owner = THIS_MODULE,
5780 .pf = PF_INET,
5781 .hooknum = NF_INET_LOCAL_OUT,
5782 .priority = NF_IP_PRI_SELINUX_FIRST,
5783 }
5784 };
5785
5786 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5787
5788 static struct nf_hook_ops selinux_ipv6_ops[] = {
5789 {
5790 .hook = selinux_ipv6_postroute,
5791 .owner = THIS_MODULE,
5792 .pf = PF_INET6,
5793 .hooknum = NF_INET_POST_ROUTING,
5794 .priority = NF_IP6_PRI_SELINUX_LAST,
5795 },
5796 {
5797 .hook = selinux_ipv6_forward,
5798 .owner = THIS_MODULE,
5799 .pf = PF_INET6,
5800 .hooknum = NF_INET_FORWARD,
5801 .priority = NF_IP6_PRI_SELINUX_FIRST,
5802 }
5803 };
5804
5805 #endif /* IPV6 */
5806
5807 static int __init selinux_nf_ip_init(void)
5808 {
5809 int err = 0;
5810
5811 if (!selinux_enabled)
5812 goto out;
5813
5814 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5815
5816 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5817 if (err)
5818 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5819
5820 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5821 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5822 if (err)
5823 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5824 #endif /* IPV6 */
5825
5826 out:
5827 return err;
5828 }
5829
5830 __initcall(selinux_nf_ip_init);
5831
5832 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5833 static void selinux_nf_ip_exit(void)
5834 {
5835 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5836
5837 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5838 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5839 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5840 #endif /* IPV6 */
5841 }
5842 #endif
5843
5844 #else /* CONFIG_NETFILTER */
5845
5846 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5847 #define selinux_nf_ip_exit()
5848 #endif
5849
5850 #endif /* CONFIG_NETFILTER */
5851
5852 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5853 static int selinux_disabled;
5854
5855 int selinux_disable(void)
5856 {
5857 if (ss_initialized) {
5858 /* Not permitted after initial policy load. */
5859 return -EINVAL;
5860 }
5861
5862 if (selinux_disabled) {
5863 /* Only do this once. */
5864 return -EINVAL;
5865 }
5866
5867 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5868
5869 selinux_disabled = 1;
5870 selinux_enabled = 0;
5871
5872 reset_security_ops();
5873
5874 /* Try to destroy the avc node cache */
5875 avc_disable();
5876
5877 /* Unregister netfilter hooks. */
5878 selinux_nf_ip_exit();
5879
5880 /* Unregister selinuxfs. */
5881 exit_sel_fs();
5882
5883 return 0;
5884 }
5885 #endif
Linux kernel - Deliverables
This page took 0.152262 seconds and 5 git commands to generate.