projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'range-macro' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie...
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/security.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 #define NUM_SEL_MNT_OPTS 5
99
100 extern struct security_operations *security_ops;
101
102 /* SECMARK reference count */
103 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
104
105 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
106 int selinux_enforcing;
107
108 static int __init enforcing_setup(char *str)
109 {
110 unsigned long enforcing;
111 if (!strict_strtoul(str, 0, &enforcing))
112 selinux_enforcing = enforcing ? 1 : 0;
113 return 1;
114 }
115 __setup("enforcing=", enforcing_setup);
116 #endif
117
118 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
119 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
120
121 static int __init selinux_enabled_setup(char *str)
122 {
123 unsigned long enabled;
124 if (!strict_strtoul(str, 0, &enabled))
125 selinux_enabled = enabled ? 1 : 0;
126 return 1;
127 }
128 __setup("selinux=", selinux_enabled_setup);
129 #else
130 int selinux_enabled = 1;
131 #endif
132
133 static struct kmem_cache *sel_inode_cache;
134
135 /**
136 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
137 *
138 * Description:
139 * This function checks the SECMARK reference counter to see if any SECMARK
140 * targets are currently configured, if the reference counter is greater than
141 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
142 * enabled, false (0) if SECMARK is disabled.
143 *
144 */
145 static int selinux_secmark_enabled(void)
146 {
147 return (atomic_read(&selinux_secmark_refcount) > 0);
148 }
149
150 /*
151 * initialise the security for the init task
152 */
153 static void cred_init_security(void)
154 {
155 struct cred *cred = (struct cred *) current->real_cred;
156 struct task_security_struct *tsec;
157
158 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
159 if (!tsec)
160 panic("SELinux: Failed to initialize initial task.\n");
161
162 tsec->osid = tsec->sid = SECINITSID_KERNEL;
163 cred->security = tsec;
164 }
165
166 /*
167 * get the security ID of a set of credentials
168 */
169 static inline u32 cred_sid(const struct cred *cred)
170 {
171 const struct task_security_struct *tsec;
172
173 tsec = cred->security;
174 return tsec->sid;
175 }
176
177 /*
178 * get the objective security ID of a task
179 */
180 static inline u32 task_sid(const struct task_struct *task)
181 {
182 u32 sid;
183
184 rcu_read_lock();
185 sid = cred_sid(__task_cred(task));
186 rcu_read_unlock();
187 return sid;
188 }
189
190 /*
191 * get the subjective security ID of the current task
192 */
193 static inline u32 current_sid(void)
194 {
195 const struct task_security_struct *tsec = current_security();
196
197 return tsec->sid;
198 }
199
200 /* Allocate and free functions for each kind of security blob. */
201
202 static int inode_alloc_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec;
205 u32 sid = current_sid();
206
207 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
208 if (!isec)
209 return -ENOMEM;
210
211 mutex_init(&isec->lock);
212 INIT_LIST_HEAD(&isec->list);
213 isec->inode = inode;
214 isec->sid = SECINITSID_UNLABELED;
215 isec->sclass = SECCLASS_FILE;
216 isec->task_sid = sid;
217 inode->i_security = isec;
218
219 return 0;
220 }
221
222 static void inode_free_security(struct inode *inode)
223 {
224 struct inode_security_struct *isec = inode->i_security;
225 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
226
227 spin_lock(&sbsec->isec_lock);
228 if (!list_empty(&isec->list))
229 list_del_init(&isec->list);
230 spin_unlock(&sbsec->isec_lock);
231
232 inode->i_security = NULL;
233 kmem_cache_free(sel_inode_cache, isec);
234 }
235
236 static int file_alloc_security(struct file *file)
237 {
238 struct file_security_struct *fsec;
239 u32 sid = current_sid();
240
241 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 if (!fsec)
243 return -ENOMEM;
244
245 fsec->sid = sid;
246 fsec->fown_sid = sid;
247 file->f_security = fsec;
248
249 return 0;
250 }
251
252 static void file_free_security(struct file *file)
253 {
254 struct file_security_struct *fsec = file->f_security;
255 file->f_security = NULL;
256 kfree(fsec);
257 }
258
259 static int superblock_alloc_security(struct super_block *sb)
260 {
261 struct superblock_security_struct *sbsec;
262
263 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
264 if (!sbsec)
265 return -ENOMEM;
266
267 mutex_init(&sbsec->lock);
268 INIT_LIST_HEAD(&sbsec->isec_head);
269 spin_lock_init(&sbsec->isec_lock);
270 sbsec->sb = sb;
271 sbsec->sid = SECINITSID_UNLABELED;
272 sbsec->def_sid = SECINITSID_FILE;
273 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
274 sb->s_security = sbsec;
275
276 return 0;
277 }
278
279 static void superblock_free_security(struct super_block *sb)
280 {
281 struct superblock_security_struct *sbsec = sb->s_security;
282 sb->s_security = NULL;
283 kfree(sbsec);
284 }
285
286 /* The file system's label must be initialized prior to use. */
287
288 static const char *labeling_behaviors[7] = {
289 "uses xattr",
290 "uses transition SIDs",
291 "uses task SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
295 "uses native labeling",
296 };
297
298 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
299
300 static inline int inode_doinit(struct inode *inode)
301 {
302 return inode_doinit_with_dentry(inode, NULL);
303 }
304
305 enum {
306 Opt_error = -1,
307 Opt_context = 1,
308 Opt_fscontext = 2,
309 Opt_defcontext = 3,
310 Opt_rootcontext = 4,
311 Opt_labelsupport = 5,
312 };
313
314 static const match_table_t tokens = {
315 {Opt_context, CONTEXT_STR "%s"},
316 {Opt_fscontext, FSCONTEXT_STR "%s"},
317 {Opt_defcontext, DEFCONTEXT_STR "%s"},
318 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
319 {Opt_labelsupport, LABELSUPP_STR},
320 {Opt_error, NULL},
321 };
322
323 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
324
325 static int may_context_mount_sb_relabel(u32 sid,
326 struct superblock_security_struct *sbsec,
327 const struct cred *cred)
328 {
329 const struct task_security_struct *tsec = cred->security;
330 int rc;
331
332 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
333 FILESYSTEM__RELABELFROM, NULL);
334 if (rc)
335 return rc;
336
337 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
338 FILESYSTEM__RELABELTO, NULL);
339 return rc;
340 }
341
342 static int may_context_mount_inode_relabel(u32 sid,
343 struct superblock_security_struct *sbsec,
344 const struct cred *cred)
345 {
346 const struct task_security_struct *tsec = cred->security;
347 int rc;
348 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
349 FILESYSTEM__RELABELFROM, NULL);
350 if (rc)
351 return rc;
352
353 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__ASSOCIATE, NULL);
355 return rc;
356 }
357
358 static int sb_finish_set_opts(struct super_block *sb)
359 {
360 struct superblock_security_struct *sbsec = sb->s_security;
361 struct dentry *root = sb->s_root;
362 struct inode *root_inode = root->d_inode;
363 int rc = 0;
364
365 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
366 /* Make sure that the xattr handler exists and that no
367 error other than -ENODATA is returned by getxattr on
368 the root directory. -ENODATA is ok, as this may be
369 the first boot of the SELinux kernel before we have
370 assigned xattr values to the filesystem. */
371 if (!root_inode->i_op->getxattr) {
372 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
373 "xattr support\n", sb->s_id, sb->s_type->name);
374 rc = -EOPNOTSUPP;
375 goto out;
376 }
377 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
378 if (rc < 0 && rc != -ENODATA) {
379 if (rc == -EOPNOTSUPP)
380 printk(KERN_WARNING "SELinux: (dev %s, type "
381 "%s) has no security xattr handler\n",
382 sb->s_id, sb->s_type->name);
383 else
384 printk(KERN_WARNING "SELinux: (dev %s, type "
385 "%s) getxattr errno %d\n", sb->s_id,
386 sb->s_type->name, -rc);
387 goto out;
388 }
389 }
390
391 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
392
393 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
394 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
395 sb->s_id, sb->s_type->name);
396 else
397 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
398 sb->s_id, sb->s_type->name,
399 labeling_behaviors[sbsec->behavior-1]);
400
401 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
402 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
403 sbsec->behavior == SECURITY_FS_USE_NONE ||
404 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
405 sbsec->flags &= ~SE_SBLABELSUPP;
406
407 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
408 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
409 sbsec->flags |= SE_SBLABELSUPP;
410
411 /* Initialize the root inode. */
412 rc = inode_doinit_with_dentry(root_inode, root);
413
414 /* Initialize any other inodes associated with the superblock, e.g.
415 inodes created prior to initial policy load or inodes created
416 during get_sb by a pseudo filesystem that directly
417 populates itself. */
418 spin_lock(&sbsec->isec_lock);
419 next_inode:
420 if (!list_empty(&sbsec->isec_head)) {
421 struct inode_security_struct *isec =
422 list_entry(sbsec->isec_head.next,
423 struct inode_security_struct, list);
424 struct inode *inode = isec->inode;
425 spin_unlock(&sbsec->isec_lock);
426 inode = igrab(inode);
427 if (inode) {
428 if (!IS_PRIVATE(inode))
429 inode_doinit(inode);
430 iput(inode);
431 }
432 spin_lock(&sbsec->isec_lock);
433 list_del_init(&isec->list);
434 goto next_inode;
435 }
436 spin_unlock(&sbsec->isec_lock);
437 out:
438 return rc;
439 }
440
441 /*
442 * This function should allow an FS to ask what it's mount security
443 * options were so it can use those later for submounts, displaying
444 * mount options, or whatever.
445 */
446 static int selinux_get_mnt_opts(const struct super_block *sb,
447 struct security_mnt_opts *opts)
448 {
449 int rc = 0, i;
450 struct superblock_security_struct *sbsec = sb->s_security;
451 char *context = NULL;
452 u32 len;
453 char tmp;
454
455 security_init_mnt_opts(opts);
456
457 if (!(sbsec->flags & SE_SBINITIALIZED))
458 return -EINVAL;
459
460 if (!ss_initialized)
461 return -EINVAL;
462
463 tmp = sbsec->flags & SE_MNTMASK;
464 /* count the number of mount options for this sb */
465 for (i = 0; i < 8; i++) {
466 if (tmp & 0x01)
467 opts->num_mnt_opts++;
468 tmp >>= 1;
469 }
470 /* Check if the Label support flag is set */
471 if (sbsec->flags & SE_SBLABELSUPP)
472 opts->num_mnt_opts++;
473
474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
476 rc = -ENOMEM;
477 goto out_free;
478 }
479
480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
482 rc = -ENOMEM;
483 goto out_free;
484 }
485
486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
511
512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 }
518 if (sbsec->flags & SE_SBLABELSUPP) {
519 opts->mnt_opts[i] = NULL;
520 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
521 }
522
523 BUG_ON(i != opts->num_mnt_opts);
524
525 return 0;
526
527 out_free:
528 security_free_mnt_opts(opts);
529 return rc;
530 }
531
532 static int bad_option(struct superblock_security_struct *sbsec, char flag,
533 u32 old_sid, u32 new_sid)
534 {
535 char mnt_flags = sbsec->flags & SE_MNTMASK;
536
537 /* check if the old mount command had the same options */
538 if (sbsec->flags & SE_SBINITIALIZED)
539 if (!(sbsec->flags & flag) ||
540 (old_sid != new_sid))
541 return 1;
542
543 /* check if we were passed the same options twice,
544 * aka someone passed context=a,context=b
545 */
546 if (!(sbsec->flags & SE_SBINITIALIZED))
547 if (mnt_flags & flag)
548 return 1;
549 return 0;
550 }
551
552 /*
553 * Allow filesystems with binary mount data to explicitly set mount point
554 * labeling information.
555 */
556 static int selinux_set_mnt_opts(struct super_block *sb,
557 struct security_mnt_opts *opts,
558 unsigned long kern_flags,
559 unsigned long *set_kern_flags)
560 {
561 const struct cred *cred = current_cred();
562 int rc = 0, i;
563 struct superblock_security_struct *sbsec = sb->s_security;
564 const char *name = sb->s_type->name;
565 struct inode *inode = sbsec->sb->s_root->d_inode;
566 struct inode_security_struct *root_isec = inode->i_security;
567 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
568 u32 defcontext_sid = 0;
569 char **mount_options = opts->mnt_opts;
570 int *flags = opts->mnt_opts_flags;
571 int num_opts = opts->num_mnt_opts;
572
573 mutex_lock(&sbsec->lock);
574
575 if (!ss_initialized) {
576 if (!num_opts) {
577 /* Defer initialization until selinux_complete_init,
578 after the initial policy is loaded and the security
579 server is ready to handle calls. */
580 goto out;
581 }
582 rc = -EINVAL;
583 printk(KERN_WARNING "SELinux: Unable to set superblock options "
584 "before the security server is initialized\n");
585 goto out;
586 }
587 if (kern_flags && !set_kern_flags) {
588 /* Specifying internal flags without providing a place to
589 * place the results is not allowed */
590 rc = -EINVAL;
591 goto out;
592 }
593
594 /*
595 * Binary mount data FS will come through this function twice. Once
596 * from an explicit call and once from the generic calls from the vfs.
597 * Since the generic VFS calls will not contain any security mount data
598 * we need to skip the double mount verification.
599 *
600 * This does open a hole in which we will not notice if the first
601 * mount using this sb set explict options and a second mount using
602 * this sb does not set any security options. (The first options
603 * will be used for both mounts)
604 */
605 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
606 && (num_opts == 0))
607 goto out;
608
609 /*
610 * parse the mount options, check if they are valid sids.
611 * also check if someone is trying to mount the same sb more
612 * than once with different security options.
613 */
614 for (i = 0; i < num_opts; i++) {
615 u32 sid;
616
617 if (flags[i] == SE_SBLABELSUPP)
618 continue;
619 rc = security_context_to_sid(mount_options[i],
620 strlen(mount_options[i]), &sid);
621 if (rc) {
622 printk(KERN_WARNING "SELinux: security_context_to_sid"
623 "(%s) failed for (dev %s, type %s) errno=%d\n",
624 mount_options[i], sb->s_id, name, rc);
625 goto out;
626 }
627 switch (flags[i]) {
628 case FSCONTEXT_MNT:
629 fscontext_sid = sid;
630
631 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
632 fscontext_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= FSCONTEXT_MNT;
636 break;
637 case CONTEXT_MNT:
638 context_sid = sid;
639
640 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
641 context_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= CONTEXT_MNT;
645 break;
646 case ROOTCONTEXT_MNT:
647 rootcontext_sid = sid;
648
649 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
650 rootcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= ROOTCONTEXT_MNT;
654
655 break;
656 case DEFCONTEXT_MNT:
657 defcontext_sid = sid;
658
659 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
660 defcontext_sid))
661 goto out_double_mount;
662
663 sbsec->flags |= DEFCONTEXT_MNT;
664
665 break;
666 default:
667 rc = -EINVAL;
668 goto out;
669 }
670 }
671
672 if (sbsec->flags & SE_SBINITIALIZED) {
673 /* previously mounted with options, but not on this attempt? */
674 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
675 goto out_double_mount;
676 rc = 0;
677 goto out;
678 }
679
680 if (strcmp(sb->s_type->name, "proc") == 0)
681 sbsec->flags |= SE_SBPROC;
682
683 if (!sbsec->behavior) {
684 /*
685 * Determine the labeling behavior to use for this
686 * filesystem type.
687 */
688 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
689 "proc" : sb->s_type->name,
690 &sbsec->behavior, &sbsec->sid);
691 if (rc) {
692 printk(KERN_WARNING
693 "%s: security_fs_use(%s) returned %d\n",
694 __func__, sb->s_type->name, rc);
695 goto out;
696 }
697 }
698 /* sets the context of the superblock for the fs being mounted. */
699 if (fscontext_sid) {
700 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
701 if (rc)
702 goto out;
703
704 sbsec->sid = fscontext_sid;
705 }
706
707 /*
708 * Switch to using mount point labeling behavior.
709 * sets the label used on all file below the mountpoint, and will set
710 * the superblock context if not already set.
711 */
712 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
713 sbsec->behavior = SECURITY_FS_USE_NATIVE;
714 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
715 }
716
717 if (context_sid) {
718 if (!fscontext_sid) {
719 rc = may_context_mount_sb_relabel(context_sid, sbsec,
720 cred);
721 if (rc)
722 goto out;
723 sbsec->sid = context_sid;
724 } else {
725 rc = may_context_mount_inode_relabel(context_sid, sbsec,
726 cred);
727 if (rc)
728 goto out;
729 }
730 if (!rootcontext_sid)
731 rootcontext_sid = context_sid;
732
733 sbsec->mntpoint_sid = context_sid;
734 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
735 }
736
737 if (rootcontext_sid) {
738 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
739 cred);
740 if (rc)
741 goto out;
742
743 root_isec->sid = rootcontext_sid;
744 root_isec->initialized = 1;
745 }
746
747 if (defcontext_sid) {
748 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
749 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
750 rc = -EINVAL;
751 printk(KERN_WARNING "SELinux: defcontext option is "
752 "invalid for this filesystem type\n");
753 goto out;
754 }
755
756 if (defcontext_sid != sbsec->def_sid) {
757 rc = may_context_mount_inode_relabel(defcontext_sid,
758 sbsec, cred);
759 if (rc)
760 goto out;
761 }
762
763 sbsec->def_sid = defcontext_sid;
764 }
765
766 rc = sb_finish_set_opts(sb);
767 out:
768 mutex_unlock(&sbsec->lock);
769 return rc;
770 out_double_mount:
771 rc = -EINVAL;
772 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
773 "security settings for (dev %s, type %s)\n", sb->s_id, name);
774 goto out;
775 }
776
777 static int selinux_cmp_sb_context(const struct super_block *oldsb,
778 const struct super_block *newsb)
779 {
780 struct superblock_security_struct *old = oldsb->s_security;
781 struct superblock_security_struct *new = newsb->s_security;
782 char oldflags = old->flags & SE_MNTMASK;
783 char newflags = new->flags & SE_MNTMASK;
784
785 if (oldflags != newflags)
786 goto mismatch;
787 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
788 goto mismatch;
789 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
790 goto mismatch;
791 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
792 goto mismatch;
793 if (oldflags & ROOTCONTEXT_MNT) {
794 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
795 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
796 if (oldroot->sid != newroot->sid)
797 goto mismatch;
798 }
799 return 0;
800 mismatch:
801 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
802 "different security settings for (dev %s, "
803 "type %s)\n", newsb->s_id, newsb->s_type->name);
804 return -EBUSY;
805 }
806
807 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
808 struct super_block *newsb)
809 {
810 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
811 struct superblock_security_struct *newsbsec = newsb->s_security;
812
813 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
814 int set_context = (oldsbsec->flags & CONTEXT_MNT);
815 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
816
817 /*
818 * if the parent was able to be mounted it clearly had no special lsm
819 * mount options. thus we can safely deal with this superblock later
820 */
821 if (!ss_initialized)
822 return 0;
823
824 /* how can we clone if the old one wasn't set up?? */
825 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
826
827 /* if fs is reusing a sb, make sure that the contexts match */
828 if (newsbsec->flags & SE_SBINITIALIZED)
829 return selinux_cmp_sb_context(oldsb, newsb);
830
831 mutex_lock(&newsbsec->lock);
832
833 newsbsec->flags = oldsbsec->flags;
834
835 newsbsec->sid = oldsbsec->sid;
836 newsbsec->def_sid = oldsbsec->def_sid;
837 newsbsec->behavior = oldsbsec->behavior;
838
839 if (set_context) {
840 u32 sid = oldsbsec->mntpoint_sid;
841
842 if (!set_fscontext)
843 newsbsec->sid = sid;
844 if (!set_rootcontext) {
845 struct inode *newinode = newsb->s_root->d_inode;
846 struct inode_security_struct *newisec = newinode->i_security;
847 newisec->sid = sid;
848 }
849 newsbsec->mntpoint_sid = sid;
850 }
851 if (set_rootcontext) {
852 const struct inode *oldinode = oldsb->s_root->d_inode;
853 const struct inode_security_struct *oldisec = oldinode->i_security;
854 struct inode *newinode = newsb->s_root->d_inode;
855 struct inode_security_struct *newisec = newinode->i_security;
856
857 newisec->sid = oldisec->sid;
858 }
859
860 sb_finish_set_opts(newsb);
861 mutex_unlock(&newsbsec->lock);
862 return 0;
863 }
864
865 static int selinux_parse_opts_str(char *options,
866 struct security_mnt_opts *opts)
867 {
868 char *p;
869 char *context = NULL, *defcontext = NULL;
870 char *fscontext = NULL, *rootcontext = NULL;
871 int rc, num_mnt_opts = 0;
872
873 opts->num_mnt_opts = 0;
874
875 /* Standard string-based options. */
876 while ((p = strsep(&options, "|")) != NULL) {
877 int token;
878 substring_t args[MAX_OPT_ARGS];
879
880 if (!*p)
881 continue;
882
883 token = match_token(p, tokens, args);
884
885 switch (token) {
886 case Opt_context:
887 if (context || defcontext) {
888 rc = -EINVAL;
889 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
890 goto out_err;
891 }
892 context = match_strdup(&args[0]);
893 if (!context) {
894 rc = -ENOMEM;
895 goto out_err;
896 }
897 break;
898
899 case Opt_fscontext:
900 if (fscontext) {
901 rc = -EINVAL;
902 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
903 goto out_err;
904 }
905 fscontext = match_strdup(&args[0]);
906 if (!fscontext) {
907 rc = -ENOMEM;
908 goto out_err;
909 }
910 break;
911
912 case Opt_rootcontext:
913 if (rootcontext) {
914 rc = -EINVAL;
915 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
916 goto out_err;
917 }
918 rootcontext = match_strdup(&args[0]);
919 if (!rootcontext) {
920 rc = -ENOMEM;
921 goto out_err;
922 }
923 break;
924
925 case Opt_defcontext:
926 if (context || defcontext) {
927 rc = -EINVAL;
928 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
929 goto out_err;
930 }
931 defcontext = match_strdup(&args[0]);
932 if (!defcontext) {
933 rc = -ENOMEM;
934 goto out_err;
935 }
936 break;
937 case Opt_labelsupport:
938 break;
939 default:
940 rc = -EINVAL;
941 printk(KERN_WARNING "SELinux: unknown mount option\n");
942 goto out_err;
943
944 }
945 }
946
947 rc = -ENOMEM;
948 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
949 if (!opts->mnt_opts)
950 goto out_err;
951
952 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
953 if (!opts->mnt_opts_flags) {
954 kfree(opts->mnt_opts);
955 goto out_err;
956 }
957
958 if (fscontext) {
959 opts->mnt_opts[num_mnt_opts] = fscontext;
960 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
961 }
962 if (context) {
963 opts->mnt_opts[num_mnt_opts] = context;
964 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
965 }
966 if (rootcontext) {
967 opts->mnt_opts[num_mnt_opts] = rootcontext;
968 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
969 }
970 if (defcontext) {
971 opts->mnt_opts[num_mnt_opts] = defcontext;
972 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
973 }
974
975 opts->num_mnt_opts = num_mnt_opts;
976 return 0;
977
978 out_err:
979 kfree(context);
980 kfree(defcontext);
981 kfree(fscontext);
982 kfree(rootcontext);
983 return rc;
984 }
985 /*
986 * string mount options parsing and call set the sbsec
987 */
988 static int superblock_doinit(struct super_block *sb, void *data)
989 {
990 int rc = 0;
991 char *options = data;
992 struct security_mnt_opts opts;
993
994 security_init_mnt_opts(&opts);
995
996 if (!data)
997 goto out;
998
999 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1000
1001 rc = selinux_parse_opts_str(options, &opts);
1002 if (rc)
1003 goto out_err;
1004
1005 out:
1006 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1007
1008 out_err:
1009 security_free_mnt_opts(&opts);
1010 return rc;
1011 }
1012
1013 static void selinux_write_opts(struct seq_file *m,
1014 struct security_mnt_opts *opts)
1015 {
1016 int i;
1017 char *prefix;
1018
1019 for (i = 0; i < opts->num_mnt_opts; i++) {
1020 char *has_comma;
1021
1022 if (opts->mnt_opts[i])
1023 has_comma = strchr(opts->mnt_opts[i], ',');
1024 else
1025 has_comma = NULL;
1026
1027 switch (opts->mnt_opts_flags[i]) {
1028 case CONTEXT_MNT:
1029 prefix = CONTEXT_STR;
1030 break;
1031 case FSCONTEXT_MNT:
1032 prefix = FSCONTEXT_STR;
1033 break;
1034 case ROOTCONTEXT_MNT:
1035 prefix = ROOTCONTEXT_STR;
1036 break;
1037 case DEFCONTEXT_MNT:
1038 prefix = DEFCONTEXT_STR;
1039 break;
1040 case SE_SBLABELSUPP:
1041 seq_putc(m, ',');
1042 seq_puts(m, LABELSUPP_STR);
1043 continue;
1044 default:
1045 BUG();
1046 return;
1047 };
1048 /* we need a comma before each option */
1049 seq_putc(m, ',');
1050 seq_puts(m, prefix);
1051 if (has_comma)
1052 seq_putc(m, '\"');
1053 seq_puts(m, opts->mnt_opts[i]);
1054 if (has_comma)
1055 seq_putc(m, '\"');
1056 }
1057 }
1058
1059 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060 {
1061 struct security_mnt_opts opts;
1062 int rc;
1063
1064 rc = selinux_get_mnt_opts(sb, &opts);
1065 if (rc) {
1066 /* before policy load we may get EINVAL, don't show anything */
1067 if (rc == -EINVAL)
1068 rc = 0;
1069 return rc;
1070 }
1071
1072 selinux_write_opts(m, &opts);
1073
1074 security_free_mnt_opts(&opts);
1075
1076 return rc;
1077 }
1078
1079 static inline u16 inode_mode_to_security_class(umode_t mode)
1080 {
1081 switch (mode & S_IFMT) {
1082 case S_IFSOCK:
1083 return SECCLASS_SOCK_FILE;
1084 case S_IFLNK:
1085 return SECCLASS_LNK_FILE;
1086 case S_IFREG:
1087 return SECCLASS_FILE;
1088 case S_IFBLK:
1089 return SECCLASS_BLK_FILE;
1090 case S_IFDIR:
1091 return SECCLASS_DIR;
1092 case S_IFCHR:
1093 return SECCLASS_CHR_FILE;
1094 case S_IFIFO:
1095 return SECCLASS_FIFO_FILE;
1096
1097 }
1098
1099 return SECCLASS_FILE;
1100 }
1101
1102 static inline int default_protocol_stream(int protocol)
1103 {
1104 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105 }
1106
1107 static inline int default_protocol_dgram(int protocol)
1108 {
1109 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110 }
1111
1112 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113 {
1114 switch (family) {
1115 case PF_UNIX:
1116 switch (type) {
1117 case SOCK_STREAM:
1118 case SOCK_SEQPACKET:
1119 return SECCLASS_UNIX_STREAM_SOCKET;
1120 case SOCK_DGRAM:
1121 return SECCLASS_UNIX_DGRAM_SOCKET;
1122 }
1123 break;
1124 case PF_INET:
1125 case PF_INET6:
1126 switch (type) {
1127 case SOCK_STREAM:
1128 if (default_protocol_stream(protocol))
1129 return SECCLASS_TCP_SOCKET;
1130 else
1131 return SECCLASS_RAWIP_SOCKET;
1132 case SOCK_DGRAM:
1133 if (default_protocol_dgram(protocol))
1134 return SECCLASS_UDP_SOCKET;
1135 else
1136 return SECCLASS_RAWIP_SOCKET;
1137 case SOCK_DCCP:
1138 return SECCLASS_DCCP_SOCKET;
1139 default:
1140 return SECCLASS_RAWIP_SOCKET;
1141 }
1142 break;
1143 case PF_NETLINK:
1144 switch (protocol) {
1145 case NETLINK_ROUTE:
1146 return SECCLASS_NETLINK_ROUTE_SOCKET;
1147 case NETLINK_FIREWALL:
1148 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1149 case NETLINK_SOCK_DIAG:
1150 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151 case NETLINK_NFLOG:
1152 return SECCLASS_NETLINK_NFLOG_SOCKET;
1153 case NETLINK_XFRM:
1154 return SECCLASS_NETLINK_XFRM_SOCKET;
1155 case NETLINK_SELINUX:
1156 return SECCLASS_NETLINK_SELINUX_SOCKET;
1157 case NETLINK_AUDIT:
1158 return SECCLASS_NETLINK_AUDIT_SOCKET;
1159 case NETLINK_IP6_FW:
1160 return SECCLASS_NETLINK_IP6FW_SOCKET;
1161 case NETLINK_DNRTMSG:
1162 return SECCLASS_NETLINK_DNRT_SOCKET;
1163 case NETLINK_KOBJECT_UEVENT:
1164 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1165 default:
1166 return SECCLASS_NETLINK_SOCKET;
1167 }
1168 case PF_PACKET:
1169 return SECCLASS_PACKET_SOCKET;
1170 case PF_KEY:
1171 return SECCLASS_KEY_SOCKET;
1172 case PF_APPLETALK:
1173 return SECCLASS_APPLETALK_SOCKET;
1174 }
1175
1176 return SECCLASS_SOCKET;
1177 }
1178
1179 #ifdef CONFIG_PROC_FS
1180 static int selinux_proc_get_sid(struct dentry *dentry,
1181 u16 tclass,
1182 u32 *sid)
1183 {
1184 int rc;
1185 char *buffer, *path;
1186
1187 buffer = (char *)__get_free_page(GFP_KERNEL);
1188 if (!buffer)
1189 return -ENOMEM;
1190
1191 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1192 if (IS_ERR(path))
1193 rc = PTR_ERR(path);
1194 else {
1195 /* each process gets a /proc/PID/ entry. Strip off the
1196 * PID part to get a valid selinux labeling.
1197 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1198 while (path[1] >= '0' && path[1] <= '9') {
1199 path[1] = '/';
1200 path++;
1201 }
1202 rc = security_genfs_sid("proc", path, tclass, sid);
1203 }
1204 free_page((unsigned long)buffer);
1205 return rc;
1206 }
1207 #else
1208 static int selinux_proc_get_sid(struct dentry *dentry,
1209 u16 tclass,
1210 u32 *sid)
1211 {
1212 return -EINVAL;
1213 }
1214 #endif
1215
1216 /* The inode's security attributes must be initialized before first use. */
1217 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1218 {
1219 struct superblock_security_struct *sbsec = NULL;
1220 struct inode_security_struct *isec = inode->i_security;
1221 u32 sid;
1222 struct dentry *dentry;
1223 #define INITCONTEXTLEN 255
1224 char *context = NULL;
1225 unsigned len = 0;
1226 int rc = 0;
1227
1228 if (isec->initialized)
1229 goto out;
1230
1231 mutex_lock(&isec->lock);
1232 if (isec->initialized)
1233 goto out_unlock;
1234
1235 sbsec = inode->i_sb->s_security;
1236 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1237 /* Defer initialization until selinux_complete_init,
1238 after the initial policy is loaded and the security
1239 server is ready to handle calls. */
1240 spin_lock(&sbsec->isec_lock);
1241 if (list_empty(&isec->list))
1242 list_add(&isec->list, &sbsec->isec_head);
1243 spin_unlock(&sbsec->isec_lock);
1244 goto out_unlock;
1245 }
1246
1247 switch (sbsec->behavior) {
1248 case SECURITY_FS_USE_NATIVE:
1249 break;
1250 case SECURITY_FS_USE_XATTR:
1251 if (!inode->i_op->getxattr) {
1252 isec->sid = sbsec->def_sid;
1253 break;
1254 }
1255
1256 /* Need a dentry, since the xattr API requires one.
1257 Life would be simpler if we could just pass the inode. */
1258 if (opt_dentry) {
1259 /* Called from d_instantiate or d_splice_alias. */
1260 dentry = dget(opt_dentry);
1261 } else {
1262 /* Called from selinux_complete_init, try to find a dentry. */
1263 dentry = d_find_alias(inode);
1264 }
1265 if (!dentry) {
1266 /*
1267 * this is can be hit on boot when a file is accessed
1268 * before the policy is loaded. When we load policy we
1269 * may find inodes that have no dentry on the
1270 * sbsec->isec_head list. No reason to complain as these
1271 * will get fixed up the next time we go through
1272 * inode_doinit with a dentry, before these inodes could
1273 * be used again by userspace.
1274 */
1275 goto out_unlock;
1276 }
1277
1278 len = INITCONTEXTLEN;
1279 context = kmalloc(len+1, GFP_NOFS);
1280 if (!context) {
1281 rc = -ENOMEM;
1282 dput(dentry);
1283 goto out_unlock;
1284 }
1285 context[len] = '\0';
1286 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1287 context, len);
1288 if (rc == -ERANGE) {
1289 kfree(context);
1290
1291 /* Need a larger buffer. Query for the right size. */
1292 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1293 NULL, 0);
1294 if (rc < 0) {
1295 dput(dentry);
1296 goto out_unlock;
1297 }
1298 len = rc;
1299 context = kmalloc(len+1, GFP_NOFS);
1300 if (!context) {
1301 rc = -ENOMEM;
1302 dput(dentry);
1303 goto out_unlock;
1304 }
1305 context[len] = '\0';
1306 rc = inode->i_op->getxattr(dentry,
1307 XATTR_NAME_SELINUX,
1308 context, len);
1309 }
1310 dput(dentry);
1311 if (rc < 0) {
1312 if (rc != -ENODATA) {
1313 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1314 "%d for dev=%s ino=%ld\n", __func__,
1315 -rc, inode->i_sb->s_id, inode->i_ino);
1316 kfree(context);
1317 goto out_unlock;
1318 }
1319 /* Map ENODATA to the default file SID */
1320 sid = sbsec->def_sid;
1321 rc = 0;
1322 } else {
1323 rc = security_context_to_sid_default(context, rc, &sid,
1324 sbsec->def_sid,
1325 GFP_NOFS);
1326 if (rc) {
1327 char *dev = inode->i_sb->s_id;
1328 unsigned long ino = inode->i_ino;
1329
1330 if (rc == -EINVAL) {
1331 if (printk_ratelimit())
1332 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1333 "context=%s. This indicates you may need to relabel the inode or the "
1334 "filesystem in question.\n", ino, dev, context);
1335 } else {
1336 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1337 "returned %d for dev=%s ino=%ld\n",
1338 __func__, context, -rc, dev, ino);
1339 }
1340 kfree(context);
1341 /* Leave with the unlabeled SID */
1342 rc = 0;
1343 break;
1344 }
1345 }
1346 kfree(context);
1347 isec->sid = sid;
1348 break;
1349 case SECURITY_FS_USE_TASK:
1350 isec->sid = isec->task_sid;
1351 break;
1352 case SECURITY_FS_USE_TRANS:
1353 /* Default to the fs SID. */
1354 isec->sid = sbsec->sid;
1355
1356 /* Try to obtain a transition SID. */
1357 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1358 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1359 isec->sclass, NULL, &sid);
1360 if (rc)
1361 goto out_unlock;
1362 isec->sid = sid;
1363 break;
1364 case SECURITY_FS_USE_MNTPOINT:
1365 isec->sid = sbsec->mntpoint_sid;
1366 break;
1367 default:
1368 /* Default to the fs superblock SID. */
1369 isec->sid = sbsec->sid;
1370
1371 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1372 if (opt_dentry) {
1373 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1374 rc = selinux_proc_get_sid(opt_dentry,
1375 isec->sclass,
1376 &sid);
1377 if (rc)
1378 goto out_unlock;
1379 isec->sid = sid;
1380 }
1381 }
1382 break;
1383 }
1384
1385 isec->initialized = 1;
1386
1387 out_unlock:
1388 mutex_unlock(&isec->lock);
1389 out:
1390 if (isec->sclass == SECCLASS_FILE)
1391 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1392 return rc;
1393 }
1394
1395 /* Convert a Linux signal to an access vector. */
1396 static inline u32 signal_to_av(int sig)
1397 {
1398 u32 perm = 0;
1399
1400 switch (sig) {
1401 case SIGCHLD:
1402 /* Commonly granted from child to parent. */
1403 perm = PROCESS__SIGCHLD;
1404 break;
1405 case SIGKILL:
1406 /* Cannot be caught or ignored */
1407 perm = PROCESS__SIGKILL;
1408 break;
1409 case SIGSTOP:
1410 /* Cannot be caught or ignored */
1411 perm = PROCESS__SIGSTOP;
1412 break;
1413 default:
1414 /* All other signals. */
1415 perm = PROCESS__SIGNAL;
1416 break;
1417 }
1418
1419 return perm;
1420 }
1421
1422 /*
1423 * Check permission between a pair of credentials
1424 * fork check, ptrace check, etc.
1425 */
1426 static int cred_has_perm(const struct cred *actor,
1427 const struct cred *target,
1428 u32 perms)
1429 {
1430 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1431
1432 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1433 }
1434
1435 /*
1436 * Check permission between a pair of tasks, e.g. signal checks,
1437 * fork check, ptrace check, etc.
1438 * tsk1 is the actor and tsk2 is the target
1439 * - this uses the default subjective creds of tsk1
1440 */
1441 static int task_has_perm(const struct task_struct *tsk1,
1442 const struct task_struct *tsk2,
1443 u32 perms)
1444 {
1445 const struct task_security_struct *__tsec1, *__tsec2;
1446 u32 sid1, sid2;
1447
1448 rcu_read_lock();
1449 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1450 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1451 rcu_read_unlock();
1452 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1453 }
1454
1455 /*
1456 * Check permission between current and another task, e.g. signal checks,
1457 * fork check, ptrace check, etc.
1458 * current is the actor and tsk2 is the target
1459 * - this uses current's subjective creds
1460 */
1461 static int current_has_perm(const struct task_struct *tsk,
1462 u32 perms)
1463 {
1464 u32 sid, tsid;
1465
1466 sid = current_sid();
1467 tsid = task_sid(tsk);
1468 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1469 }
1470
1471 #if CAP_LAST_CAP > 63
1472 #error Fix SELinux to handle capabilities > 63.
1473 #endif
1474
1475 /* Check whether a task is allowed to use a capability. */
1476 static int cred_has_capability(const struct cred *cred,
1477 int cap, int audit)
1478 {
1479 struct common_audit_data ad;
1480 struct av_decision avd;
1481 u16 sclass;
1482 u32 sid = cred_sid(cred);
1483 u32 av = CAP_TO_MASK(cap);
1484 int rc;
1485
1486 ad.type = LSM_AUDIT_DATA_CAP;
1487 ad.u.cap = cap;
1488
1489 switch (CAP_TO_INDEX(cap)) {
1490 case 0:
1491 sclass = SECCLASS_CAPABILITY;
1492 break;
1493 case 1:
1494 sclass = SECCLASS_CAPABILITY2;
1495 break;
1496 default:
1497 printk(KERN_ERR
1498 "SELinux: out of range capability %d\n", cap);
1499 BUG();
1500 return -EINVAL;
1501 }
1502
1503 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1504 if (audit == SECURITY_CAP_AUDIT) {
1505 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1506 if (rc2)
1507 return rc2;
1508 }
1509 return rc;
1510 }
1511
1512 /* Check whether a task is allowed to use a system operation. */
1513 static int task_has_system(struct task_struct *tsk,
1514 u32 perms)
1515 {
1516 u32 sid = task_sid(tsk);
1517
1518 return avc_has_perm(sid, SECINITSID_KERNEL,
1519 SECCLASS_SYSTEM, perms, NULL);
1520 }
1521
1522 /* Check whether a task has a particular permission to an inode.
1523 The 'adp' parameter is optional and allows other audit
1524 data to be passed (e.g. the dentry). */
1525 static int inode_has_perm(const struct cred *cred,
1526 struct inode *inode,
1527 u32 perms,
1528 struct common_audit_data *adp)
1529 {
1530 struct inode_security_struct *isec;
1531 u32 sid;
1532
1533 validate_creds(cred);
1534
1535 if (unlikely(IS_PRIVATE(inode)))
1536 return 0;
1537
1538 sid = cred_sid(cred);
1539 isec = inode->i_security;
1540
1541 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1542 }
1543
1544 /* Same as inode_has_perm, but pass explicit audit data containing
1545 the dentry to help the auditing code to more easily generate the
1546 pathname if needed. */
1547 static inline int dentry_has_perm(const struct cred *cred,
1548 struct dentry *dentry,
1549 u32 av)
1550 {
1551 struct inode *inode = dentry->d_inode;
1552 struct common_audit_data ad;
1553
1554 ad.type = LSM_AUDIT_DATA_DENTRY;
1555 ad.u.dentry = dentry;
1556 return inode_has_perm(cred, inode, av, &ad);
1557 }
1558
1559 /* Same as inode_has_perm, but pass explicit audit data containing
1560 the path to help the auditing code to more easily generate the
1561 pathname if needed. */
1562 static inline int path_has_perm(const struct cred *cred,
1563 struct path *path,
1564 u32 av)
1565 {
1566 struct inode *inode = path->dentry->d_inode;
1567 struct common_audit_data ad;
1568
1569 ad.type = LSM_AUDIT_DATA_PATH;
1570 ad.u.path = *path;
1571 return inode_has_perm(cred, inode, av, &ad);
1572 }
1573
1574 /* Same as path_has_perm, but uses the inode from the file struct. */
1575 static inline int file_path_has_perm(const struct cred *cred,
1576 struct file *file,
1577 u32 av)
1578 {
1579 struct common_audit_data ad;
1580
1581 ad.type = LSM_AUDIT_DATA_PATH;
1582 ad.u.path = file->f_path;
1583 return inode_has_perm(cred, file_inode(file), av, &ad);
1584 }
1585
1586 /* Check whether a task can use an open file descriptor to
1587 access an inode in a given way. Check access to the
1588 descriptor itself, and then use dentry_has_perm to
1589 check a particular permission to the file.
1590 Access to the descriptor is implicitly granted if it
1591 has the same SID as the process. If av is zero, then
1592 access to the file is not checked, e.g. for cases
1593 where only the descriptor is affected like seek. */
1594 static int file_has_perm(const struct cred *cred,
1595 struct file *file,
1596 u32 av)
1597 {
1598 struct file_security_struct *fsec = file->f_security;
1599 struct inode *inode = file_inode(file);
1600 struct common_audit_data ad;
1601 u32 sid = cred_sid(cred);
1602 int rc;
1603
1604 ad.type = LSM_AUDIT_DATA_PATH;
1605 ad.u.path = file->f_path;
1606
1607 if (sid != fsec->sid) {
1608 rc = avc_has_perm(sid, fsec->sid,
1609 SECCLASS_FD,
1610 FD__USE,
1611 &ad);
1612 if (rc)
1613 goto out;
1614 }
1615
1616 /* av is zero if only checking access to the descriptor. */
1617 rc = 0;
1618 if (av)
1619 rc = inode_has_perm(cred, inode, av, &ad);
1620
1621 out:
1622 return rc;
1623 }
1624
1625 /* Check whether a task can create a file. */
1626 static int may_create(struct inode *dir,
1627 struct dentry *dentry,
1628 u16 tclass)
1629 {
1630 const struct task_security_struct *tsec = current_security();
1631 struct inode_security_struct *dsec;
1632 struct superblock_security_struct *sbsec;
1633 u32 sid, newsid;
1634 struct common_audit_data ad;
1635 int rc;
1636
1637 dsec = dir->i_security;
1638 sbsec = dir->i_sb->s_security;
1639
1640 sid = tsec->sid;
1641 newsid = tsec->create_sid;
1642
1643 ad.type = LSM_AUDIT_DATA_DENTRY;
1644 ad.u.dentry = dentry;
1645
1646 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1647 DIR__ADD_NAME | DIR__SEARCH,
1648 &ad);
1649 if (rc)
1650 return rc;
1651
1652 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1653 rc = security_transition_sid(sid, dsec->sid, tclass,
1654 &dentry->d_name, &newsid);
1655 if (rc)
1656 return rc;
1657 }
1658
1659 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1660 if (rc)
1661 return rc;
1662
1663 return avc_has_perm(newsid, sbsec->sid,
1664 SECCLASS_FILESYSTEM,
1665 FILESYSTEM__ASSOCIATE, &ad);
1666 }
1667
1668 /* Check whether a task can create a key. */
1669 static int may_create_key(u32 ksid,
1670 struct task_struct *ctx)
1671 {
1672 u32 sid = task_sid(ctx);
1673
1674 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1675 }
1676
1677 #define MAY_LINK 0
1678 #define MAY_UNLINK 1
1679 #define MAY_RMDIR 2
1680
1681 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1682 static int may_link(struct inode *dir,
1683 struct dentry *dentry,
1684 int kind)
1685
1686 {
1687 struct inode_security_struct *dsec, *isec;
1688 struct common_audit_data ad;
1689 u32 sid = current_sid();
1690 u32 av;
1691 int rc;
1692
1693 dsec = dir->i_security;
1694 isec = dentry->d_inode->i_security;
1695
1696 ad.type = LSM_AUDIT_DATA_DENTRY;
1697 ad.u.dentry = dentry;
1698
1699 av = DIR__SEARCH;
1700 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1701 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1702 if (rc)
1703 return rc;
1704
1705 switch (kind) {
1706 case MAY_LINK:
1707 av = FILE__LINK;
1708 break;
1709 case MAY_UNLINK:
1710 av = FILE__UNLINK;
1711 break;
1712 case MAY_RMDIR:
1713 av = DIR__RMDIR;
1714 break;
1715 default:
1716 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1717 __func__, kind);
1718 return 0;
1719 }
1720
1721 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1722 return rc;
1723 }
1724
1725 static inline int may_rename(struct inode *old_dir,
1726 struct dentry *old_dentry,
1727 struct inode *new_dir,
1728 struct dentry *new_dentry)
1729 {
1730 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1731 struct common_audit_data ad;
1732 u32 sid = current_sid();
1733 u32 av;
1734 int old_is_dir, new_is_dir;
1735 int rc;
1736
1737 old_dsec = old_dir->i_security;
1738 old_isec = old_dentry->d_inode->i_security;
1739 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1740 new_dsec = new_dir->i_security;
1741
1742 ad.type = LSM_AUDIT_DATA_DENTRY;
1743
1744 ad.u.dentry = old_dentry;
1745 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1746 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1747 if (rc)
1748 return rc;
1749 rc = avc_has_perm(sid, old_isec->sid,
1750 old_isec->sclass, FILE__RENAME, &ad);
1751 if (rc)
1752 return rc;
1753 if (old_is_dir && new_dir != old_dir) {
1754 rc = avc_has_perm(sid, old_isec->sid,
1755 old_isec->sclass, DIR__REPARENT, &ad);
1756 if (rc)
1757 return rc;
1758 }
1759
1760 ad.u.dentry = new_dentry;
1761 av = DIR__ADD_NAME | DIR__SEARCH;
1762 if (new_dentry->d_inode)
1763 av |= DIR__REMOVE_NAME;
1764 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1765 if (rc)
1766 return rc;
1767 if (new_dentry->d_inode) {
1768 new_isec = new_dentry->d_inode->i_security;
1769 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1770 rc = avc_has_perm(sid, new_isec->sid,
1771 new_isec->sclass,
1772 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1773 if (rc)
1774 return rc;
1775 }
1776
1777 return 0;
1778 }
1779
1780 /* Check whether a task can perform a filesystem operation. */
1781 static int superblock_has_perm(const struct cred *cred,
1782 struct super_block *sb,
1783 u32 perms,
1784 struct common_audit_data *ad)
1785 {
1786 struct superblock_security_struct *sbsec;
1787 u32 sid = cred_sid(cred);
1788
1789 sbsec = sb->s_security;
1790 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1791 }
1792
1793 /* Convert a Linux mode and permission mask to an access vector. */
1794 static inline u32 file_mask_to_av(int mode, int mask)
1795 {
1796 u32 av = 0;
1797
1798 if (!S_ISDIR(mode)) {
1799 if (mask & MAY_EXEC)
1800 av |= FILE__EXECUTE;
1801 if (mask & MAY_READ)
1802 av |= FILE__READ;
1803
1804 if (mask & MAY_APPEND)
1805 av |= FILE__APPEND;
1806 else if (mask & MAY_WRITE)
1807 av |= FILE__WRITE;
1808
1809 } else {
1810 if (mask & MAY_EXEC)
1811 av |= DIR__SEARCH;
1812 if (mask & MAY_WRITE)
1813 av |= DIR__WRITE;
1814 if (mask & MAY_READ)
1815 av |= DIR__READ;
1816 }
1817
1818 return av;
1819 }
1820
1821 /* Convert a Linux file to an access vector. */
1822 static inline u32 file_to_av(struct file *file)
1823 {
1824 u32 av = 0;
1825
1826 if (file->f_mode & FMODE_READ)
1827 av |= FILE__READ;
1828 if (file->f_mode & FMODE_WRITE) {
1829 if (file->f_flags & O_APPEND)
1830 av |= FILE__APPEND;
1831 else
1832 av |= FILE__WRITE;
1833 }
1834 if (!av) {
1835 /*
1836 * Special file opened with flags 3 for ioctl-only use.
1837 */
1838 av = FILE__IOCTL;
1839 }
1840
1841 return av;
1842 }
1843
1844 /*
1845 * Convert a file to an access vector and include the correct open
1846 * open permission.
1847 */
1848 static inline u32 open_file_to_av(struct file *file)
1849 {
1850 u32 av = file_to_av(file);
1851
1852 if (selinux_policycap_openperm)
1853 av |= FILE__OPEN;
1854
1855 return av;
1856 }
1857
1858 /* Hook functions begin here. */
1859
1860 static int selinux_ptrace_access_check(struct task_struct *child,
1861 unsigned int mode)
1862 {
1863 int rc;
1864
1865 rc = cap_ptrace_access_check(child, mode);
1866 if (rc)
1867 return rc;
1868
1869 if (mode & PTRACE_MODE_READ) {
1870 u32 sid = current_sid();
1871 u32 csid = task_sid(child);
1872 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1873 }
1874
1875 return current_has_perm(child, PROCESS__PTRACE);
1876 }
1877
1878 static int selinux_ptrace_traceme(struct task_struct *parent)
1879 {
1880 int rc;
1881
1882 rc = cap_ptrace_traceme(parent);
1883 if (rc)
1884 return rc;
1885
1886 return task_has_perm(parent, current, PROCESS__PTRACE);
1887 }
1888
1889 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1890 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1891 {
1892 int error;
1893
1894 error = current_has_perm(target, PROCESS__GETCAP);
1895 if (error)
1896 return error;
1897
1898 return cap_capget(target, effective, inheritable, permitted);
1899 }
1900
1901 static int selinux_capset(struct cred *new, const struct cred *old,
1902 const kernel_cap_t *effective,
1903 const kernel_cap_t *inheritable,
1904 const kernel_cap_t *permitted)
1905 {
1906 int error;
1907
1908 error = cap_capset(new, old,
1909 effective, inheritable, permitted);
1910 if (error)
1911 return error;
1912
1913 return cred_has_perm(old, new, PROCESS__SETCAP);
1914 }
1915
1916 /*
1917 * (This comment used to live with the selinux_task_setuid hook,
1918 * which was removed).
1919 *
1920 * Since setuid only affects the current process, and since the SELinux
1921 * controls are not based on the Linux identity attributes, SELinux does not
1922 * need to control this operation. However, SELinux does control the use of
1923 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1924 */
1925
1926 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1927 int cap, int audit)
1928 {
1929 int rc;
1930
1931 rc = cap_capable(cred, ns, cap, audit);
1932 if (rc)
1933 return rc;
1934
1935 return cred_has_capability(cred, cap, audit);
1936 }
1937
1938 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1939 {
1940 const struct cred *cred = current_cred();
1941 int rc = 0;
1942
1943 if (!sb)
1944 return 0;
1945
1946 switch (cmds) {
1947 case Q_SYNC:
1948 case Q_QUOTAON:
1949 case Q_QUOTAOFF:
1950 case Q_SETINFO:
1951 case Q_SETQUOTA:
1952 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1953 break;
1954 case Q_GETFMT:
1955 case Q_GETINFO:
1956 case Q_GETQUOTA:
1957 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1958 break;
1959 default:
1960 rc = 0; /* let the kernel handle invalid cmds */
1961 break;
1962 }
1963 return rc;
1964 }
1965
1966 static int selinux_quota_on(struct dentry *dentry)
1967 {
1968 const struct cred *cred = current_cred();
1969
1970 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1971 }
1972
1973 static int selinux_syslog(int type)
1974 {
1975 int rc;
1976
1977 switch (type) {
1978 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1979 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1980 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1981 break;
1982 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1983 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1984 /* Set level of messages printed to console */
1985 case SYSLOG_ACTION_CONSOLE_LEVEL:
1986 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1987 break;
1988 case SYSLOG_ACTION_CLOSE: /* Close log */
1989 case SYSLOG_ACTION_OPEN: /* Open log */
1990 case SYSLOG_ACTION_READ: /* Read from log */
1991 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1992 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1993 default:
1994 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1995 break;
1996 }
1997 return rc;
1998 }
1999
2000 /*
2001 * Check that a process has enough memory to allocate a new virtual
2002 * mapping. 0 means there is enough memory for the allocation to
2003 * succeed and -ENOMEM implies there is not.
2004 *
2005 * Do not audit the selinux permission check, as this is applied to all
2006 * processes that allocate mappings.
2007 */
2008 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2009 {
2010 int rc, cap_sys_admin = 0;
2011
2012 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2013 SECURITY_CAP_NOAUDIT);
2014 if (rc == 0)
2015 cap_sys_admin = 1;
2016
2017 return __vm_enough_memory(mm, pages, cap_sys_admin);
2018 }
2019
2020 /* binprm security operations */
2021
2022 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2023 {
2024 const struct task_security_struct *old_tsec;
2025 struct task_security_struct *new_tsec;
2026 struct inode_security_struct *isec;
2027 struct common_audit_data ad;
2028 struct inode *inode = file_inode(bprm->file);
2029 int rc;
2030
2031 rc = cap_bprm_set_creds(bprm);
2032 if (rc)
2033 return rc;
2034
2035 /* SELinux context only depends on initial program or script and not
2036 * the script interpreter */
2037 if (bprm->cred_prepared)
2038 return 0;
2039
2040 old_tsec = current_security();
2041 new_tsec = bprm->cred->security;
2042 isec = inode->i_security;
2043
2044 /* Default to the current task SID. */
2045 new_tsec->sid = old_tsec->sid;
2046 new_tsec->osid = old_tsec->sid;
2047
2048 /* Reset fs, key, and sock SIDs on execve. */
2049 new_tsec->create_sid = 0;
2050 new_tsec->keycreate_sid = 0;
2051 new_tsec->sockcreate_sid = 0;
2052
2053 if (old_tsec->exec_sid) {
2054 new_tsec->sid = old_tsec->exec_sid;
2055 /* Reset exec SID on execve. */
2056 new_tsec->exec_sid = 0;
2057
2058 /*
2059 * Minimize confusion: if no_new_privs and a transition is
2060 * explicitly requested, then fail the exec.
2061 */
2062 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2063 return -EPERM;
2064 } else {
2065 /* Check for a default transition on this program. */
2066 rc = security_transition_sid(old_tsec->sid, isec->sid,
2067 SECCLASS_PROCESS, NULL,
2068 &new_tsec->sid);
2069 if (rc)
2070 return rc;
2071 }
2072
2073 ad.type = LSM_AUDIT_DATA_PATH;
2074 ad.u.path = bprm->file->f_path;
2075
2076 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2077 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2078 new_tsec->sid = old_tsec->sid;
2079
2080 if (new_tsec->sid == old_tsec->sid) {
2081 rc = avc_has_perm(old_tsec->sid, isec->sid,
2082 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2083 if (rc)
2084 return rc;
2085 } else {
2086 /* Check permissions for the transition. */
2087 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2088 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2089 if (rc)
2090 return rc;
2091
2092 rc = avc_has_perm(new_tsec->sid, isec->sid,
2093 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2094 if (rc)
2095 return rc;
2096
2097 /* Check for shared state */
2098 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2099 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2100 SECCLASS_PROCESS, PROCESS__SHARE,
2101 NULL);
2102 if (rc)
2103 return -EPERM;
2104 }
2105
2106 /* Make sure that anyone attempting to ptrace over a task that
2107 * changes its SID has the appropriate permit */
2108 if (bprm->unsafe &
2109 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2110 struct task_struct *tracer;
2111 struct task_security_struct *sec;
2112 u32 ptsid = 0;
2113
2114 rcu_read_lock();
2115 tracer = ptrace_parent(current);
2116 if (likely(tracer != NULL)) {
2117 sec = __task_cred(tracer)->security;
2118 ptsid = sec->sid;
2119 }
2120 rcu_read_unlock();
2121
2122 if (ptsid != 0) {
2123 rc = avc_has_perm(ptsid, new_tsec->sid,
2124 SECCLASS_PROCESS,
2125 PROCESS__PTRACE, NULL);
2126 if (rc)
2127 return -EPERM;
2128 }
2129 }
2130
2131 /* Clear any possibly unsafe personality bits on exec: */
2132 bprm->per_clear |= PER_CLEAR_ON_SETID;
2133 }
2134
2135 return 0;
2136 }
2137
2138 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2139 {
2140 const struct task_security_struct *tsec = current_security();
2141 u32 sid, osid;
2142 int atsecure = 0;
2143
2144 sid = tsec->sid;
2145 osid = tsec->osid;
2146
2147 if (osid != sid) {
2148 /* Enable secure mode for SIDs transitions unless
2149 the noatsecure permission is granted between
2150 the two SIDs, i.e. ahp returns 0. */
2151 atsecure = avc_has_perm(osid, sid,
2152 SECCLASS_PROCESS,
2153 PROCESS__NOATSECURE, NULL);
2154 }
2155
2156 return (atsecure || cap_bprm_secureexec(bprm));
2157 }
2158
2159 static int match_file(const void *p, struct file *file, unsigned fd)
2160 {
2161 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2162 }
2163
2164 /* Derived from fs/exec.c:flush_old_files. */
2165 static inline void flush_unauthorized_files(const struct cred *cred,
2166 struct files_struct *files)
2167 {
2168 struct file *file, *devnull = NULL;
2169 struct tty_struct *tty;
2170 int drop_tty = 0;
2171 unsigned n;
2172
2173 tty = get_current_tty();
2174 if (tty) {
2175 spin_lock(&tty_files_lock);
2176 if (!list_empty(&tty->tty_files)) {
2177 struct tty_file_private *file_priv;
2178
2179 /* Revalidate access to controlling tty.
2180 Use file_path_has_perm on the tty path directly
2181 rather than using file_has_perm, as this particular
2182 open file may belong to another process and we are
2183 only interested in the inode-based check here. */
2184 file_priv = list_first_entry(&tty->tty_files,
2185 struct tty_file_private, list);
2186 file = file_priv->file;
2187 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2188 drop_tty = 1;
2189 }
2190 spin_unlock(&tty_files_lock);
2191 tty_kref_put(tty);
2192 }
2193 /* Reset controlling tty. */
2194 if (drop_tty)
2195 no_tty();
2196
2197 /* Revalidate access to inherited open files. */
2198 n = iterate_fd(files, 0, match_file, cred);
2199 if (!n) /* none found? */
2200 return;
2201
2202 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2203 if (IS_ERR(devnull))
2204 devnull = NULL;
2205 /* replace all the matching ones with this */
2206 do {
2207 replace_fd(n - 1, devnull, 0);
2208 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2209 if (devnull)
2210 fput(devnull);
2211 }
2212
2213 /*
2214 * Prepare a process for imminent new credential changes due to exec
2215 */
2216 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2217 {
2218 struct task_security_struct *new_tsec;
2219 struct rlimit *rlim, *initrlim;
2220 int rc, i;
2221
2222 new_tsec = bprm->cred->security;
2223 if (new_tsec->sid == new_tsec->osid)
2224 return;
2225
2226 /* Close files for which the new task SID is not authorized. */
2227 flush_unauthorized_files(bprm->cred, current->files);
2228
2229 /* Always clear parent death signal on SID transitions. */
2230 current->pdeath_signal = 0;
2231
2232 /* Check whether the new SID can inherit resource limits from the old
2233 * SID. If not, reset all soft limits to the lower of the current
2234 * task's hard limit and the init task's soft limit.
2235 *
2236 * Note that the setting of hard limits (even to lower them) can be
2237 * controlled by the setrlimit check. The inclusion of the init task's
2238 * soft limit into the computation is to avoid resetting soft limits
2239 * higher than the default soft limit for cases where the default is
2240 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2241 */
2242 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2243 PROCESS__RLIMITINH, NULL);
2244 if (rc) {
2245 /* protect against do_prlimit() */
2246 task_lock(current);
2247 for (i = 0; i < RLIM_NLIMITS; i++) {
2248 rlim = current->signal->rlim + i;
2249 initrlim = init_task.signal->rlim + i;
2250 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2251 }
2252 task_unlock(current);
2253 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2254 }
2255 }
2256
2257 /*
2258 * Clean up the process immediately after the installation of new credentials
2259 * due to exec
2260 */
2261 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2262 {
2263 const struct task_security_struct *tsec = current_security();
2264 struct itimerval itimer;
2265 u32 osid, sid;
2266 int rc, i;
2267
2268 osid = tsec->osid;
2269 sid = tsec->sid;
2270
2271 if (sid == osid)
2272 return;
2273
2274 /* Check whether the new SID can inherit signal state from the old SID.
2275 * If not, clear itimers to avoid subsequent signal generation and
2276 * flush and unblock signals.
2277 *
2278 * This must occur _after_ the task SID has been updated so that any
2279 * kill done after the flush will be checked against the new SID.
2280 */
2281 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2282 if (rc) {
2283 memset(&itimer, 0, sizeof itimer);
2284 for (i = 0; i < 3; i++)
2285 do_setitimer(i, &itimer, NULL);
2286 spin_lock_irq(&current->sighand->siglock);
2287 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2288 __flush_signals(current);
2289 flush_signal_handlers(current, 1);
2290 sigemptyset(&current->blocked);
2291 }
2292 spin_unlock_irq(&current->sighand->siglock);
2293 }
2294
2295 /* Wake up the parent if it is waiting so that it can recheck
2296 * wait permission to the new task SID. */
2297 read_lock(&tasklist_lock);
2298 __wake_up_parent(current, current->real_parent);
2299 read_unlock(&tasklist_lock);
2300 }
2301
2302 /* superblock security operations */
2303
2304 static int selinux_sb_alloc_security(struct super_block *sb)
2305 {
2306 return superblock_alloc_security(sb);
2307 }
2308
2309 static void selinux_sb_free_security(struct super_block *sb)
2310 {
2311 superblock_free_security(sb);
2312 }
2313
2314 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2315 {
2316 if (plen > olen)
2317 return 0;
2318
2319 return !memcmp(prefix, option, plen);
2320 }
2321
2322 static inline int selinux_option(char *option, int len)
2323 {
2324 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2325 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2326 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2327 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2328 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2329 }
2330
2331 static inline void take_option(char **to, char *from, int *first, int len)
2332 {
2333 if (!*first) {
2334 **to = ',';
2335 *to += 1;
2336 } else
2337 *first = 0;
2338 memcpy(*to, from, len);
2339 *to += len;
2340 }
2341
2342 static inline void take_selinux_option(char **to, char *from, int *first,
2343 int len)
2344 {
2345 int current_size = 0;
2346
2347 if (!*first) {
2348 **to = '|';
2349 *to += 1;
2350 } else
2351 *first = 0;
2352
2353 while (current_size < len) {
2354 if (*from != '"') {
2355 **to = *from;
2356 *to += 1;
2357 }
2358 from += 1;
2359 current_size += 1;
2360 }
2361 }
2362
2363 static int selinux_sb_copy_data(char *orig, char *copy)
2364 {
2365 int fnosec, fsec, rc = 0;
2366 char *in_save, *in_curr, *in_end;
2367 char *sec_curr, *nosec_save, *nosec;
2368 int open_quote = 0;
2369
2370 in_curr = orig;
2371 sec_curr = copy;
2372
2373 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2374 if (!nosec) {
2375 rc = -ENOMEM;
2376 goto out;
2377 }
2378
2379 nosec_save = nosec;
2380 fnosec = fsec = 1;
2381 in_save = in_end = orig;
2382
2383 do {
2384 if (*in_end == '"')
2385 open_quote = !open_quote;
2386 if ((*in_end == ',' && open_quote == 0) ||
2387 *in_end == '\0') {
2388 int len = in_end - in_curr;
2389
2390 if (selinux_option(in_curr, len))
2391 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2392 else
2393 take_option(&nosec, in_curr, &fnosec, len);
2394
2395 in_curr = in_end + 1;
2396 }
2397 } while (*in_end++);
2398
2399 strcpy(in_save, nosec_save);
2400 free_page((unsigned long)nosec_save);
2401 out:
2402 return rc;
2403 }
2404
2405 static int selinux_sb_remount(struct super_block *sb, void *data)
2406 {
2407 int rc, i, *flags;
2408 struct security_mnt_opts opts;
2409 char *secdata, **mount_options;
2410 struct superblock_security_struct *sbsec = sb->s_security;
2411
2412 if (!(sbsec->flags & SE_SBINITIALIZED))
2413 return 0;
2414
2415 if (!data)
2416 return 0;
2417
2418 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2419 return 0;
2420
2421 security_init_mnt_opts(&opts);
2422 secdata = alloc_secdata();
2423 if (!secdata)
2424 return -ENOMEM;
2425 rc = selinux_sb_copy_data(data, secdata);
2426 if (rc)
2427 goto out_free_secdata;
2428
2429 rc = selinux_parse_opts_str(secdata, &opts);
2430 if (rc)
2431 goto out_free_secdata;
2432
2433 mount_options = opts.mnt_opts;
2434 flags = opts.mnt_opts_flags;
2435
2436 for (i = 0; i < opts.num_mnt_opts; i++) {
2437 u32 sid;
2438 size_t len;
2439
2440 if (flags[i] == SE_SBLABELSUPP)
2441 continue;
2442 len = strlen(mount_options[i]);
2443 rc = security_context_to_sid(mount_options[i], len, &sid);
2444 if (rc) {
2445 printk(KERN_WARNING "SELinux: security_context_to_sid"
2446 "(%s) failed for (dev %s, type %s) errno=%d\n",
2447 mount_options[i], sb->s_id, sb->s_type->name, rc);
2448 goto out_free_opts;
2449 }
2450 rc = -EINVAL;
2451 switch (flags[i]) {
2452 case FSCONTEXT_MNT:
2453 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2454 goto out_bad_option;
2455 break;
2456 case CONTEXT_MNT:
2457 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2458 goto out_bad_option;
2459 break;
2460 case ROOTCONTEXT_MNT: {
2461 struct inode_security_struct *root_isec;
2462 root_isec = sb->s_root->d_inode->i_security;
2463
2464 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2465 goto out_bad_option;
2466 break;
2467 }
2468 case DEFCONTEXT_MNT:
2469 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2470 goto out_bad_option;
2471 break;
2472 default:
2473 goto out_free_opts;
2474 }
2475 }
2476
2477 rc = 0;
2478 out_free_opts:
2479 security_free_mnt_opts(&opts);
2480 out_free_secdata:
2481 free_secdata(secdata);
2482 return rc;
2483 out_bad_option:
2484 printk(KERN_WARNING "SELinux: unable to change security options "
2485 "during remount (dev %s, type=%s)\n", sb->s_id,
2486 sb->s_type->name);
2487 goto out_free_opts;
2488 }
2489
2490 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2491 {
2492 const struct cred *cred = current_cred();
2493 struct common_audit_data ad;
2494 int rc;
2495
2496 rc = superblock_doinit(sb, data);
2497 if (rc)
2498 return rc;
2499
2500 /* Allow all mounts performed by the kernel */
2501 if (flags & MS_KERNMOUNT)
2502 return 0;
2503
2504 ad.type = LSM_AUDIT_DATA_DENTRY;
2505 ad.u.dentry = sb->s_root;
2506 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2507 }
2508
2509 static int selinux_sb_statfs(struct dentry *dentry)
2510 {
2511 const struct cred *cred = current_cred();
2512 struct common_audit_data ad;
2513
2514 ad.type = LSM_AUDIT_DATA_DENTRY;
2515 ad.u.dentry = dentry->d_sb->s_root;
2516 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2517 }
2518
2519 static int selinux_mount(const char *dev_name,
2520 struct path *path,
2521 const char *type,
2522 unsigned long flags,
2523 void *data)
2524 {
2525 const struct cred *cred = current_cred();
2526
2527 if (flags & MS_REMOUNT)
2528 return superblock_has_perm(cred, path->dentry->d_sb,
2529 FILESYSTEM__REMOUNT, NULL);
2530 else
2531 return path_has_perm(cred, path, FILE__MOUNTON);
2532 }
2533
2534 static int selinux_umount(struct vfsmount *mnt, int flags)
2535 {
2536 const struct cred *cred = current_cred();
2537
2538 return superblock_has_perm(cred, mnt->mnt_sb,
2539 FILESYSTEM__UNMOUNT, NULL);
2540 }
2541
2542 /* inode security operations */
2543
2544 static int selinux_inode_alloc_security(struct inode *inode)
2545 {
2546 return inode_alloc_security(inode);
2547 }
2548
2549 static void selinux_inode_free_security(struct inode *inode)
2550 {
2551 inode_free_security(inode);
2552 }
2553
2554 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2555 struct qstr *name, void **ctx,
2556 u32 *ctxlen)
2557 {
2558 const struct cred *cred = current_cred();
2559 struct task_security_struct *tsec;
2560 struct inode_security_struct *dsec;
2561 struct superblock_security_struct *sbsec;
2562 struct inode *dir = dentry->d_parent->d_inode;
2563 u32 newsid;
2564 int rc;
2565
2566 tsec = cred->security;
2567 dsec = dir->i_security;
2568 sbsec = dir->i_sb->s_security;
2569
2570 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2571 newsid = tsec->create_sid;
2572 } else {
2573 rc = security_transition_sid(tsec->sid, dsec->sid,
2574 inode_mode_to_security_class(mode),
2575 name,
2576 &newsid);
2577 if (rc) {
2578 printk(KERN_WARNING
2579 "%s: security_transition_sid failed, rc=%d\n",
2580 __func__, -rc);
2581 return rc;
2582 }
2583 }
2584
2585 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2586 }
2587
2588 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2589 const struct qstr *qstr,
2590 const char **name,
2591 void **value, size_t *len)
2592 {
2593 const struct task_security_struct *tsec = current_security();
2594 struct inode_security_struct *dsec;
2595 struct superblock_security_struct *sbsec;
2596 u32 sid, newsid, clen;
2597 int rc;
2598 char *context;
2599
2600 dsec = dir->i_security;
2601 sbsec = dir->i_sb->s_security;
2602
2603 sid = tsec->sid;
2604 newsid = tsec->create_sid;
2605
2606 if ((sbsec->flags & SE_SBINITIALIZED) &&
2607 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2608 newsid = sbsec->mntpoint_sid;
2609 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2610 rc = security_transition_sid(sid, dsec->sid,
2611 inode_mode_to_security_class(inode->i_mode),
2612 qstr, &newsid);
2613 if (rc) {
2614 printk(KERN_WARNING "%s: "
2615 "security_transition_sid failed, rc=%d (dev=%s "
2616 "ino=%ld)\n",
2617 __func__,
2618 -rc, inode->i_sb->s_id, inode->i_ino);
2619 return rc;
2620 }
2621 }
2622
2623 /* Possibly defer initialization to selinux_complete_init. */
2624 if (sbsec->flags & SE_SBINITIALIZED) {
2625 struct inode_security_struct *isec = inode->i_security;
2626 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2627 isec->sid = newsid;
2628 isec->initialized = 1;
2629 }
2630
2631 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2632 return -EOPNOTSUPP;
2633
2634 if (name)
2635 *name = XATTR_SELINUX_SUFFIX;
2636
2637 if (value && len) {
2638 rc = security_sid_to_context_force(newsid, &context, &clen);
2639 if (rc)
2640 return rc;
2641 *value = context;
2642 *len = clen;
2643 }
2644
2645 return 0;
2646 }
2647
2648 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2649 {
2650 return may_create(dir, dentry, SECCLASS_FILE);
2651 }
2652
2653 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2654 {
2655 return may_link(dir, old_dentry, MAY_LINK);
2656 }
2657
2658 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2659 {
2660 return may_link(dir, dentry, MAY_UNLINK);
2661 }
2662
2663 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2664 {
2665 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2666 }
2667
2668 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2669 {
2670 return may_create(dir, dentry, SECCLASS_DIR);
2671 }
2672
2673 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2674 {
2675 return may_link(dir, dentry, MAY_RMDIR);
2676 }
2677
2678 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2679 {
2680 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2681 }
2682
2683 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2684 struct inode *new_inode, struct dentry *new_dentry)
2685 {
2686 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2687 }
2688
2689 static int selinux_inode_readlink(struct dentry *dentry)
2690 {
2691 const struct cred *cred = current_cred();
2692
2693 return dentry_has_perm(cred, dentry, FILE__READ);
2694 }
2695
2696 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2697 {
2698 const struct cred *cred = current_cred();
2699
2700 return dentry_has_perm(cred, dentry, FILE__READ);
2701 }
2702
2703 static noinline int audit_inode_permission(struct inode *inode,
2704 u32 perms, u32 audited, u32 denied,
2705 unsigned flags)
2706 {
2707 struct common_audit_data ad;
2708 struct inode_security_struct *isec = inode->i_security;
2709 int rc;
2710
2711 ad.type = LSM_AUDIT_DATA_INODE;
2712 ad.u.inode = inode;
2713
2714 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2715 audited, denied, &ad, flags);
2716 if (rc)
2717 return rc;
2718 return 0;
2719 }
2720
2721 static int selinux_inode_permission(struct inode *inode, int mask)
2722 {
2723 const struct cred *cred = current_cred();
2724 u32 perms;
2725 bool from_access;
2726 unsigned flags = mask & MAY_NOT_BLOCK;
2727 struct inode_security_struct *isec;
2728 u32 sid;
2729 struct av_decision avd;
2730 int rc, rc2;
2731 u32 audited, denied;
2732
2733 from_access = mask & MAY_ACCESS;
2734 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2735
2736 /* No permission to check. Existence test. */
2737 if (!mask)
2738 return 0;
2739
2740 validate_creds(cred);
2741
2742 if (unlikely(IS_PRIVATE(inode)))
2743 return 0;
2744
2745 perms = file_mask_to_av(inode->i_mode, mask);
2746
2747 sid = cred_sid(cred);
2748 isec = inode->i_security;
2749
2750 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2751 audited = avc_audit_required(perms, &avd, rc,
2752 from_access ? FILE__AUDIT_ACCESS : 0,
2753 &denied);
2754 if (likely(!audited))
2755 return rc;
2756
2757 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2758 if (rc2)
2759 return rc2;
2760 return rc;
2761 }
2762
2763 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2764 {
2765 const struct cred *cred = current_cred();
2766 unsigned int ia_valid = iattr->ia_valid;
2767 __u32 av = FILE__WRITE;
2768
2769 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2770 if (ia_valid & ATTR_FORCE) {
2771 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2772 ATTR_FORCE);
2773 if (!ia_valid)
2774 return 0;
2775 }
2776
2777 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2778 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2779 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2780
2781 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2782 av |= FILE__OPEN;
2783
2784 return dentry_has_perm(cred, dentry, av);
2785 }
2786
2787 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2788 {
2789 const struct cred *cred = current_cred();
2790 struct path path;
2791
2792 path.dentry = dentry;
2793 path.mnt = mnt;
2794
2795 return path_has_perm(cred, &path, FILE__GETATTR);
2796 }
2797
2798 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2799 {
2800 const struct cred *cred = current_cred();
2801
2802 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2803 sizeof XATTR_SECURITY_PREFIX - 1)) {
2804 if (!strcmp(name, XATTR_NAME_CAPS)) {
2805 if (!capable(CAP_SETFCAP))
2806 return -EPERM;
2807 } else if (!capable(CAP_SYS_ADMIN)) {
2808 /* A different attribute in the security namespace.
2809 Restrict to administrator. */
2810 return -EPERM;
2811 }
2812 }
2813
2814 /* Not an attribute we recognize, so just check the
2815 ordinary setattr permission. */
2816 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2817 }
2818
2819 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2820 const void *value, size_t size, int flags)
2821 {
2822 struct inode *inode = dentry->d_inode;
2823 struct inode_security_struct *isec = inode->i_security;
2824 struct superblock_security_struct *sbsec;
2825 struct common_audit_data ad;
2826 u32 newsid, sid = current_sid();
2827 int rc = 0;
2828
2829 if (strcmp(name, XATTR_NAME_SELINUX))
2830 return selinux_inode_setotherxattr(dentry, name);
2831
2832 sbsec = inode->i_sb->s_security;
2833 if (!(sbsec->flags & SE_SBLABELSUPP))
2834 return -EOPNOTSUPP;
2835
2836 if (!inode_owner_or_capable(inode))
2837 return -EPERM;
2838
2839 ad.type = LSM_AUDIT_DATA_DENTRY;
2840 ad.u.dentry = dentry;
2841
2842 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2843 FILE__RELABELFROM, &ad);
2844 if (rc)
2845 return rc;
2846
2847 rc = security_context_to_sid(value, size, &newsid);
2848 if (rc == -EINVAL) {
2849 if (!capable(CAP_MAC_ADMIN)) {
2850 struct audit_buffer *ab;
2851 size_t audit_size;
2852 const char *str;
2853
2854 /* We strip a nul only if it is at the end, otherwise the
2855 * context contains a nul and we should audit that */
2856 if (value) {
2857 str = value;
2858 if (str[size - 1] == '\0')
2859 audit_size = size - 1;
2860 else
2861 audit_size = size;
2862 } else {
2863 str = "";
2864 audit_size = 0;
2865 }
2866 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2867 audit_log_format(ab, "op=setxattr invalid_context=");
2868 audit_log_n_untrustedstring(ab, value, audit_size);
2869 audit_log_end(ab);
2870
2871 return rc;
2872 }
2873 rc = security_context_to_sid_force(value, size, &newsid);
2874 }
2875 if (rc)
2876 return rc;
2877
2878 rc = avc_has_perm(sid, newsid, isec->sclass,
2879 FILE__RELABELTO, &ad);
2880 if (rc)
2881 return rc;
2882
2883 rc = security_validate_transition(isec->sid, newsid, sid,
2884 isec->sclass);
2885 if (rc)
2886 return rc;
2887
2888 return avc_has_perm(newsid,
2889 sbsec->sid,
2890 SECCLASS_FILESYSTEM,
2891 FILESYSTEM__ASSOCIATE,
2892 &ad);
2893 }
2894
2895 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2896 const void *value, size_t size,
2897 int flags)
2898 {
2899 struct inode *inode = dentry->d_inode;
2900 struct inode_security_struct *isec = inode->i_security;
2901 u32 newsid;
2902 int rc;
2903
2904 if (strcmp(name, XATTR_NAME_SELINUX)) {
2905 /* Not an attribute we recognize, so nothing to do. */
2906 return;
2907 }
2908
2909 rc = security_context_to_sid_force(value, size, &newsid);
2910 if (rc) {
2911 printk(KERN_ERR "SELinux: unable to map context to SID"
2912 "for (%s, %lu), rc=%d\n",
2913 inode->i_sb->s_id, inode->i_ino, -rc);
2914 return;
2915 }
2916
2917 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2918 isec->sid = newsid;
2919 isec->initialized = 1;
2920
2921 return;
2922 }
2923
2924 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2925 {
2926 const struct cred *cred = current_cred();
2927
2928 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2929 }
2930
2931 static int selinux_inode_listxattr(struct dentry *dentry)
2932 {
2933 const struct cred *cred = current_cred();
2934
2935 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2936 }
2937
2938 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2939 {
2940 if (strcmp(name, XATTR_NAME_SELINUX))
2941 return selinux_inode_setotherxattr(dentry, name);
2942
2943 /* No one is allowed to remove a SELinux security label.
2944 You can change the label, but all data must be labeled. */
2945 return -EACCES;
2946 }
2947
2948 /*
2949 * Copy the inode security context value to the user.
2950 *
2951 * Permission check is handled by selinux_inode_getxattr hook.
2952 */
2953 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2954 {
2955 u32 size;
2956 int error;
2957 char *context = NULL;
2958 struct inode_security_struct *isec = inode->i_security;
2959
2960 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2961 return -EOPNOTSUPP;
2962
2963 /*
2964 * If the caller has CAP_MAC_ADMIN, then get the raw context
2965 * value even if it is not defined by current policy; otherwise,
2966 * use the in-core value under current policy.
2967 * Use the non-auditing forms of the permission checks since
2968 * getxattr may be called by unprivileged processes commonly
2969 * and lack of permission just means that we fall back to the
2970 * in-core context value, not a denial.
2971 */
2972 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2973 SECURITY_CAP_NOAUDIT);
2974 if (!error)
2975 error = security_sid_to_context_force(isec->sid, &context,
2976 &size);
2977 else
2978 error = security_sid_to_context(isec->sid, &context, &size);
2979 if (error)
2980 return error;
2981 error = size;
2982 if (alloc) {
2983 *buffer = context;
2984 goto out_nofree;
2985 }
2986 kfree(context);
2987 out_nofree:
2988 return error;
2989 }
2990
2991 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2992 const void *value, size_t size, int flags)
2993 {
2994 struct inode_security_struct *isec = inode->i_security;
2995 u32 newsid;
2996 int rc;
2997
2998 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2999 return -EOPNOTSUPP;
3000
3001 if (!value || !size)
3002 return -EACCES;
3003
3004 rc = security_context_to_sid((void *)value, size, &newsid);
3005 if (rc)
3006 return rc;
3007
3008 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3009 isec->sid = newsid;
3010 isec->initialized = 1;
3011 return 0;
3012 }
3013
3014 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3015 {
3016 const int len = sizeof(XATTR_NAME_SELINUX);
3017 if (buffer && len <= buffer_size)
3018 memcpy(buffer, XATTR_NAME_SELINUX, len);
3019 return len;
3020 }
3021
3022 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3023 {
3024 struct inode_security_struct *isec = inode->i_security;
3025 *secid = isec->sid;
3026 }
3027
3028 /* file security operations */
3029
3030 static int selinux_revalidate_file_permission(struct file *file, int mask)
3031 {
3032 const struct cred *cred = current_cred();
3033 struct inode *inode = file_inode(file);
3034
3035 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3036 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3037 mask |= MAY_APPEND;
3038
3039 return file_has_perm(cred, file,
3040 file_mask_to_av(inode->i_mode, mask));
3041 }
3042
3043 static int selinux_file_permission(struct file *file, int mask)
3044 {
3045 struct inode *inode = file_inode(file);
3046 struct file_security_struct *fsec = file->f_security;
3047 struct inode_security_struct *isec = inode->i_security;
3048 u32 sid = current_sid();
3049
3050 if (!mask)
3051 /* No permission to check. Existence test. */
3052 return 0;
3053
3054 if (sid == fsec->sid && fsec->isid == isec->sid &&
3055 fsec->pseqno == avc_policy_seqno())
3056 /* No change since file_open check. */
3057 return 0;
3058
3059 return selinux_revalidate_file_permission(file, mask);
3060 }
3061
3062 static int selinux_file_alloc_security(struct file *file)
3063 {
3064 return file_alloc_security(file);
3065 }
3066
3067 static void selinux_file_free_security(struct file *file)
3068 {
3069 file_free_security(file);
3070 }
3071
3072 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3073 unsigned long arg)
3074 {
3075 const struct cred *cred = current_cred();
3076 int error = 0;
3077
3078 switch (cmd) {
3079 case FIONREAD:
3080 /* fall through */
3081 case FIBMAP:
3082 /* fall through */
3083 case FIGETBSZ:
3084 /* fall through */
3085 case FS_IOC_GETFLAGS:
3086 /* fall through */
3087 case FS_IOC_GETVERSION:
3088 error = file_has_perm(cred, file, FILE__GETATTR);
3089 break;
3090
3091 case FS_IOC_SETFLAGS:
3092 /* fall through */
3093 case FS_IOC_SETVERSION:
3094 error = file_has_perm(cred, file, FILE__SETATTR);
3095 break;
3096
3097 /* sys_ioctl() checks */
3098 case FIONBIO:
3099 /* fall through */
3100 case FIOASYNC:
3101 error = file_has_perm(cred, file, 0);
3102 break;
3103
3104 case KDSKBENT:
3105 case KDSKBSENT:
3106 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3107 SECURITY_CAP_AUDIT);
3108 break;
3109
3110 /* default case assumes that the command will go
3111 * to the file's ioctl() function.
3112 */
3113 default:
3114 error = file_has_perm(cred, file, FILE__IOCTL);
3115 }
3116 return error;
3117 }
3118
3119 static int default_noexec;
3120
3121 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3122 {
3123 const struct cred *cred = current_cred();
3124 int rc = 0;
3125
3126 if (default_noexec &&
3127 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3128 /*
3129 * We are making executable an anonymous mapping or a
3130 * private file mapping that will also be writable.
3131 * This has an additional check.
3132 */
3133 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3134 if (rc)
3135 goto error;
3136 }
3137
3138 if (file) {
3139 /* read access is always possible with a mapping */
3140 u32 av = FILE__READ;
3141
3142 /* write access only matters if the mapping is shared */
3143 if (shared && (prot & PROT_WRITE))
3144 av |= FILE__WRITE;
3145
3146 if (prot & PROT_EXEC)
3147 av |= FILE__EXECUTE;
3148
3149 return file_has_perm(cred, file, av);
3150 }
3151
3152 error:
3153 return rc;
3154 }
3155
3156 static int selinux_mmap_addr(unsigned long addr)
3157 {
3158 int rc = 0;
3159 u32 sid = current_sid();
3160
3161 /*
3162 * notice that we are intentionally putting the SELinux check before
3163 * the secondary cap_file_mmap check. This is such a likely attempt
3164 * at bad behaviour/exploit that we always want to get the AVC, even
3165 * if DAC would have also denied the operation.
3166 */
3167 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3168 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3169 MEMPROTECT__MMAP_ZERO, NULL);
3170 if (rc)
3171 return rc;
3172 }
3173
3174 /* do DAC check on address space usage */
3175 return cap_mmap_addr(addr);
3176 }
3177
3178 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3179 unsigned long prot, unsigned long flags)
3180 {
3181 if (selinux_checkreqprot)
3182 prot = reqprot;
3183
3184 return file_map_prot_check(file, prot,
3185 (flags & MAP_TYPE) == MAP_SHARED);
3186 }
3187
3188 static int selinux_file_mprotect(struct vm_area_struct *vma,
3189 unsigned long reqprot,
3190 unsigned long prot)
3191 {
3192 const struct cred *cred = current_cred();
3193
3194 if (selinux_checkreqprot)
3195 prot = reqprot;
3196
3197 if (default_noexec &&
3198 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3199 int rc = 0;
3200 if (vma->vm_start >= vma->vm_mm->start_brk &&
3201 vma->vm_end <= vma->vm_mm->brk) {
3202 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3203 } else if (!vma->vm_file &&
3204 vma->vm_start <= vma->vm_mm->start_stack &&
3205 vma->vm_end >= vma->vm_mm->start_stack) {
3206 rc = current_has_perm(current, PROCESS__EXECSTACK);
3207 } else if (vma->vm_file && vma->anon_vma) {
3208 /*
3209 * We are making executable a file mapping that has
3210 * had some COW done. Since pages might have been
3211 * written, check ability to execute the possibly
3212 * modified content. This typically should only
3213 * occur for text relocations.
3214 */
3215 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3216 }
3217 if (rc)
3218 return rc;
3219 }
3220
3221 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3222 }
3223
3224 static int selinux_file_lock(struct file *file, unsigned int cmd)
3225 {
3226 const struct cred *cred = current_cred();
3227
3228 return file_has_perm(cred, file, FILE__LOCK);
3229 }
3230
3231 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3232 unsigned long arg)
3233 {
3234 const struct cred *cred = current_cred();
3235 int err = 0;
3236
3237 switch (cmd) {
3238 case F_SETFL:
3239 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3240 err = file_has_perm(cred, file, FILE__WRITE);
3241 break;
3242 }
3243 /* fall through */
3244 case F_SETOWN:
3245 case F_SETSIG:
3246 case F_GETFL:
3247 case F_GETOWN:
3248 case F_GETSIG:
3249 case F_GETOWNER_UIDS:
3250 /* Just check FD__USE permission */
3251 err = file_has_perm(cred, file, 0);
3252 break;
3253 case F_GETLK:
3254 case F_SETLK:
3255 case F_SETLKW:
3256 #if BITS_PER_LONG == 32
3257 case F_GETLK64:
3258 case F_SETLK64:
3259 case F_SETLKW64:
3260 #endif
3261 err = file_has_perm(cred, file, FILE__LOCK);
3262 break;
3263 }
3264
3265 return err;
3266 }
3267
3268 static int selinux_file_set_fowner(struct file *file)
3269 {
3270 struct file_security_struct *fsec;
3271
3272 fsec = file->f_security;
3273 fsec->fown_sid = current_sid();
3274
3275 return 0;
3276 }
3277
3278 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3279 struct fown_struct *fown, int signum)
3280 {
3281 struct file *file;
3282 u32 sid = task_sid(tsk);
3283 u32 perm;
3284 struct file_security_struct *fsec;
3285
3286 /* struct fown_struct is never outside the context of a struct file */
3287 file = container_of(fown, struct file, f_owner);
3288
3289 fsec = file->f_security;
3290
3291 if (!signum)
3292 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3293 else
3294 perm = signal_to_av(signum);
3295
3296 return avc_has_perm(fsec->fown_sid, sid,
3297 SECCLASS_PROCESS, perm, NULL);
3298 }
3299
3300 static int selinux_file_receive(struct file *file)
3301 {
3302 const struct cred *cred = current_cred();
3303
3304 return file_has_perm(cred, file, file_to_av(file));
3305 }
3306
3307 static int selinux_file_open(struct file *file, const struct cred *cred)
3308 {
3309 struct file_security_struct *fsec;
3310 struct inode_security_struct *isec;
3311
3312 fsec = file->f_security;
3313 isec = file_inode(file)->i_security;
3314 /*
3315 * Save inode label and policy sequence number
3316 * at open-time so that selinux_file_permission
3317 * can determine whether revalidation is necessary.
3318 * Task label is already saved in the file security
3319 * struct as its SID.
3320 */
3321 fsec->isid = isec->sid;
3322 fsec->pseqno = avc_policy_seqno();
3323 /*
3324 * Since the inode label or policy seqno may have changed
3325 * between the selinux_inode_permission check and the saving
3326 * of state above, recheck that access is still permitted.
3327 * Otherwise, access might never be revalidated against the
3328 * new inode label or new policy.
3329 * This check is not redundant - do not remove.
3330 */
3331 return file_path_has_perm(cred, file, open_file_to_av(file));
3332 }
3333
3334 /* task security operations */
3335
3336 static int selinux_task_create(unsigned long clone_flags)
3337 {
3338 return current_has_perm(current, PROCESS__FORK);
3339 }
3340
3341 /*
3342 * allocate the SELinux part of blank credentials
3343 */
3344 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3345 {
3346 struct task_security_struct *tsec;
3347
3348 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3349 if (!tsec)
3350 return -ENOMEM;
3351
3352 cred->security = tsec;
3353 return 0;
3354 }
3355
3356 /*
3357 * detach and free the LSM part of a set of credentials
3358 */
3359 static void selinux_cred_free(struct cred *cred)
3360 {
3361 struct task_security_struct *tsec = cred->security;
3362
3363 /*
3364 * cred->security == NULL if security_cred_alloc_blank() or
3365 * security_prepare_creds() returned an error.
3366 */
3367 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3368 cred->security = (void *) 0x7UL;
3369 kfree(tsec);
3370 }
3371
3372 /*
3373 * prepare a new set of credentials for modification
3374 */
3375 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3376 gfp_t gfp)
3377 {
3378 const struct task_security_struct *old_tsec;
3379 struct task_security_struct *tsec;
3380
3381 old_tsec = old->security;
3382
3383 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3384 if (!tsec)
3385 return -ENOMEM;
3386
3387 new->security = tsec;
3388 return 0;
3389 }
3390
3391 /*
3392 * transfer the SELinux data to a blank set of creds
3393 */
3394 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3395 {
3396 const struct task_security_struct *old_tsec = old->security;
3397 struct task_security_struct *tsec = new->security;
3398
3399 *tsec = *old_tsec;
3400 }
3401
3402 /*
3403 * set the security data for a kernel service
3404 * - all the creation contexts are set to unlabelled
3405 */
3406 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3407 {
3408 struct task_security_struct *tsec = new->security;
3409 u32 sid = current_sid();
3410 int ret;
3411
3412 ret = avc_has_perm(sid, secid,
3413 SECCLASS_KERNEL_SERVICE,
3414 KERNEL_SERVICE__USE_AS_OVERRIDE,
3415 NULL);
3416 if (ret == 0) {
3417 tsec->sid = secid;
3418 tsec->create_sid = 0;
3419 tsec->keycreate_sid = 0;
3420 tsec->sockcreate_sid = 0;
3421 }
3422 return ret;
3423 }
3424
3425 /*
3426 * set the file creation context in a security record to the same as the
3427 * objective context of the specified inode
3428 */
3429 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3430 {
3431 struct inode_security_struct *isec = inode->i_security;
3432 struct task_security_struct *tsec = new->security;
3433 u32 sid = current_sid();
3434 int ret;
3435
3436 ret = avc_has_perm(sid, isec->sid,
3437 SECCLASS_KERNEL_SERVICE,
3438 KERNEL_SERVICE__CREATE_FILES_AS,
3439 NULL);
3440
3441 if (ret == 0)
3442 tsec->create_sid = isec->sid;
3443 return ret;
3444 }
3445
3446 static int selinux_kernel_module_request(char *kmod_name)
3447 {
3448 u32 sid;
3449 struct common_audit_data ad;
3450
3451 sid = task_sid(current);
3452
3453 ad.type = LSM_AUDIT_DATA_KMOD;
3454 ad.u.kmod_name = kmod_name;
3455
3456 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3457 SYSTEM__MODULE_REQUEST, &ad);
3458 }
3459
3460 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3461 {
3462 return current_has_perm(p, PROCESS__SETPGID);
3463 }
3464
3465 static int selinux_task_getpgid(struct task_struct *p)
3466 {
3467 return current_has_perm(p, PROCESS__GETPGID);
3468 }
3469
3470 static int selinux_task_getsid(struct task_struct *p)
3471 {
3472 return current_has_perm(p, PROCESS__GETSESSION);
3473 }
3474
3475 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3476 {
3477 *secid = task_sid(p);
3478 }
3479
3480 static int selinux_task_setnice(struct task_struct *p, int nice)
3481 {
3482 int rc;
3483
3484 rc = cap_task_setnice(p, nice);
3485 if (rc)
3486 return rc;
3487
3488 return current_has_perm(p, PROCESS__SETSCHED);
3489 }
3490
3491 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3492 {
3493 int rc;
3494
3495 rc = cap_task_setioprio(p, ioprio);
3496 if (rc)
3497 return rc;
3498
3499 return current_has_perm(p, PROCESS__SETSCHED);
3500 }
3501
3502 static int selinux_task_getioprio(struct task_struct *p)
3503 {
3504 return current_has_perm(p, PROCESS__GETSCHED);
3505 }
3506
3507 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3508 struct rlimit *new_rlim)
3509 {
3510 struct rlimit *old_rlim = p->signal->rlim + resource;
3511
3512 /* Control the ability to change the hard limit (whether
3513 lowering or raising it), so that the hard limit can
3514 later be used as a safe reset point for the soft limit
3515 upon context transitions. See selinux_bprm_committing_creds. */
3516 if (old_rlim->rlim_max != new_rlim->rlim_max)
3517 return current_has_perm(p, PROCESS__SETRLIMIT);
3518
3519 return 0;
3520 }
3521
3522 static int selinux_task_setscheduler(struct task_struct *p)
3523 {
3524 int rc;
3525
3526 rc = cap_task_setscheduler(p);
3527 if (rc)
3528 return rc;
3529
3530 return current_has_perm(p, PROCESS__SETSCHED);
3531 }
3532
3533 static int selinux_task_getscheduler(struct task_struct *p)
3534 {
3535 return current_has_perm(p, PROCESS__GETSCHED);
3536 }
3537
3538 static int selinux_task_movememory(struct task_struct *p)
3539 {
3540 return current_has_perm(p, PROCESS__SETSCHED);
3541 }
3542
3543 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3544 int sig, u32 secid)
3545 {
3546 u32 perm;
3547 int rc;
3548
3549 if (!sig)
3550 perm = PROCESS__SIGNULL; /* null signal; existence test */
3551 else
3552 perm = signal_to_av(sig);
3553 if (secid)
3554 rc = avc_has_perm(secid, task_sid(p),
3555 SECCLASS_PROCESS, perm, NULL);
3556 else
3557 rc = current_has_perm(p, perm);
3558 return rc;
3559 }
3560
3561 static int selinux_task_wait(struct task_struct *p)
3562 {
3563 return task_has_perm(p, current, PROCESS__SIGCHLD);
3564 }
3565
3566 static void selinux_task_to_inode(struct task_struct *p,
3567 struct inode *inode)
3568 {
3569 struct inode_security_struct *isec = inode->i_security;
3570 u32 sid = task_sid(p);
3571
3572 isec->sid = sid;
3573 isec->initialized = 1;
3574 }
3575
3576 /* Returns error only if unable to parse addresses */
3577 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3578 struct common_audit_data *ad, u8 *proto)
3579 {
3580 int offset, ihlen, ret = -EINVAL;
3581 struct iphdr _iph, *ih;
3582
3583 offset = skb_network_offset(skb);
3584 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3585 if (ih == NULL)
3586 goto out;
3587
3588 ihlen = ih->ihl * 4;
3589 if (ihlen < sizeof(_iph))
3590 goto out;
3591
3592 ad->u.net->v4info.saddr = ih->saddr;
3593 ad->u.net->v4info.daddr = ih->daddr;
3594 ret = 0;
3595
3596 if (proto)
3597 *proto = ih->protocol;
3598
3599 switch (ih->protocol) {
3600 case IPPROTO_TCP: {
3601 struct tcphdr _tcph, *th;
3602
3603 if (ntohs(ih->frag_off) & IP_OFFSET)
3604 break;
3605
3606 offset += ihlen;
3607 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3608 if (th == NULL)
3609 break;
3610
3611 ad->u.net->sport = th->source;
3612 ad->u.net->dport = th->dest;
3613 break;
3614 }
3615
3616 case IPPROTO_UDP: {
3617 struct udphdr _udph, *uh;
3618
3619 if (ntohs(ih->frag_off) & IP_OFFSET)
3620 break;
3621
3622 offset += ihlen;
3623 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3624 if (uh == NULL)
3625 break;
3626
3627 ad->u.net->sport = uh->source;
3628 ad->u.net->dport = uh->dest;
3629 break;
3630 }
3631
3632 case IPPROTO_DCCP: {
3633 struct dccp_hdr _dccph, *dh;
3634
3635 if (ntohs(ih->frag_off) & IP_OFFSET)
3636 break;
3637
3638 offset += ihlen;
3639 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3640 if (dh == NULL)
3641 break;
3642
3643 ad->u.net->sport = dh->dccph_sport;
3644 ad->u.net->dport = dh->dccph_dport;
3645 break;
3646 }
3647
3648 default:
3649 break;
3650 }
3651 out:
3652 return ret;
3653 }
3654
3655 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3656
3657 /* Returns error only if unable to parse addresses */
3658 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3659 struct common_audit_data *ad, u8 *proto)
3660 {
3661 u8 nexthdr;
3662 int ret = -EINVAL, offset;
3663 struct ipv6hdr _ipv6h, *ip6;
3664 __be16 frag_off;
3665
3666 offset = skb_network_offset(skb);
3667 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3668 if (ip6 == NULL)
3669 goto out;
3670
3671 ad->u.net->v6info.saddr = ip6->saddr;
3672 ad->u.net->v6info.daddr = ip6->daddr;
3673 ret = 0;
3674
3675 nexthdr = ip6->nexthdr;
3676 offset += sizeof(_ipv6h);
3677 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3678 if (offset < 0)
3679 goto out;
3680
3681 if (proto)
3682 *proto = nexthdr;
3683
3684 switch (nexthdr) {
3685 case IPPROTO_TCP: {
3686 struct tcphdr _tcph, *th;
3687
3688 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3689 if (th == NULL)
3690 break;
3691
3692 ad->u.net->sport = th->source;
3693 ad->u.net->dport = th->dest;
3694 break;
3695 }
3696
3697 case IPPROTO_UDP: {
3698 struct udphdr _udph, *uh;
3699
3700 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3701 if (uh == NULL)
3702 break;
3703
3704 ad->u.net->sport = uh->source;
3705 ad->u.net->dport = uh->dest;
3706 break;
3707 }
3708
3709 case IPPROTO_DCCP: {
3710 struct dccp_hdr _dccph, *dh;
3711
3712 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3713 if (dh == NULL)
3714 break;
3715
3716 ad->u.net->sport = dh->dccph_sport;
3717 ad->u.net->dport = dh->dccph_dport;
3718 break;
3719 }
3720
3721 /* includes fragments */
3722 default:
3723 break;
3724 }
3725 out:
3726 return ret;
3727 }
3728
3729 #endif /* IPV6 */
3730
3731 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3732 char **_addrp, int src, u8 *proto)
3733 {
3734 char *addrp;
3735 int ret;
3736
3737 switch (ad->u.net->family) {
3738 case PF_INET:
3739 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3740 if (ret)
3741 goto parse_error;
3742 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3743 &ad->u.net->v4info.daddr);
3744 goto okay;
3745
3746 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3747 case PF_INET6:
3748 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3749 if (ret)
3750 goto parse_error;
3751 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3752 &ad->u.net->v6info.daddr);
3753 goto okay;
3754 #endif /* IPV6 */
3755 default:
3756 addrp = NULL;
3757 goto okay;
3758 }
3759
3760 parse_error:
3761 printk(KERN_WARNING
3762 "SELinux: failure in selinux_parse_skb(),"
3763 " unable to parse packet\n");
3764 return ret;
3765
3766 okay:
3767 if (_addrp)
3768 *_addrp = addrp;
3769 return 0;
3770 }
3771
3772 /**
3773 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3774 * @skb: the packet
3775 * @family: protocol family
3776 * @sid: the packet's peer label SID
3777 *
3778 * Description:
3779 * Check the various different forms of network peer labeling and determine
3780 * the peer label/SID for the packet; most of the magic actually occurs in
3781 * the security server function security_net_peersid_cmp(). The function
3782 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3783 * or -EACCES if @sid is invalid due to inconsistencies with the different
3784 * peer labels.
3785 *
3786 */
3787 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3788 {
3789 int err;
3790 u32 xfrm_sid;
3791 u32 nlbl_sid;
3792 u32 nlbl_type;
3793
3794 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3795 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3796
3797 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3798 if (unlikely(err)) {
3799 printk(KERN_WARNING
3800 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3801 " unable to determine packet's peer label\n");
3802 return -EACCES;
3803 }
3804
3805 return 0;
3806 }
3807
3808 /* socket security operations */
3809
3810 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3811 u16 secclass, u32 *socksid)
3812 {
3813 if (tsec->sockcreate_sid > SECSID_NULL) {
3814 *socksid = tsec->sockcreate_sid;
3815 return 0;
3816 }
3817
3818 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3819 socksid);
3820 }
3821
3822 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3823 {
3824 struct sk_security_struct *sksec = sk->sk_security;
3825 struct common_audit_data ad;
3826 struct lsm_network_audit net = {0,};
3827 u32 tsid = task_sid(task);
3828
3829 if (sksec->sid == SECINITSID_KERNEL)
3830 return 0;
3831
3832 ad.type = LSM_AUDIT_DATA_NET;
3833 ad.u.net = &net;
3834 ad.u.net->sk = sk;
3835
3836 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3837 }
3838
3839 static int selinux_socket_create(int family, int type,
3840 int protocol, int kern)
3841 {
3842 const struct task_security_struct *tsec = current_security();
3843 u32 newsid;
3844 u16 secclass;
3845 int rc;
3846
3847 if (kern)
3848 return 0;
3849
3850 secclass = socket_type_to_security_class(family, type, protocol);
3851 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3852 if (rc)
3853 return rc;
3854
3855 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3856 }
3857
3858 static int selinux_socket_post_create(struct socket *sock, int family,
3859 int type, int protocol, int kern)
3860 {
3861 const struct task_security_struct *tsec = current_security();
3862 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3863 struct sk_security_struct *sksec;
3864 int err = 0;
3865
3866 isec->sclass = socket_type_to_security_class(family, type, protocol);
3867
3868 if (kern)
3869 isec->sid = SECINITSID_KERNEL;
3870 else {
3871 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3872 if (err)
3873 return err;
3874 }
3875
3876 isec->initialized = 1;
3877
3878 if (sock->sk) {
3879 sksec = sock->sk->sk_security;
3880 sksec->sid = isec->sid;
3881 sksec->sclass = isec->sclass;
3882 err = selinux_netlbl_socket_post_create(sock->sk, family);
3883 }
3884
3885 return err;
3886 }
3887
3888 /* Range of port numbers used to automatically bind.
3889 Need to determine whether we should perform a name_bind
3890 permission check between the socket and the port number. */
3891
3892 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3893 {
3894 struct sock *sk = sock->sk;
3895 u16 family;
3896 int err;
3897
3898 err = sock_has_perm(current, sk, SOCKET__BIND);
3899 if (err)
3900 goto out;
3901
3902 /*
3903 * If PF_INET or PF_INET6, check name_bind permission for the port.
3904 * Multiple address binding for SCTP is not supported yet: we just
3905 * check the first address now.
3906 */
3907 family = sk->sk_family;
3908 if (family == PF_INET || family == PF_INET6) {
3909 char *addrp;
3910 struct sk_security_struct *sksec = sk->sk_security;
3911 struct common_audit_data ad;
3912 struct lsm_network_audit net = {0,};
3913 struct sockaddr_in *addr4 = NULL;
3914 struct sockaddr_in6 *addr6 = NULL;
3915 unsigned short snum;
3916 u32 sid, node_perm;
3917
3918 if (family == PF_INET) {
3919 addr4 = (struct sockaddr_in *)address;
3920 snum = ntohs(addr4->sin_port);
3921 addrp = (char *)&addr4->sin_addr.s_addr;
3922 } else {
3923 addr6 = (struct sockaddr_in6 *)address;
3924 snum = ntohs(addr6->sin6_port);
3925 addrp = (char *)&addr6->sin6_addr.s6_addr;
3926 }
3927
3928 if (snum) {
3929 int low, high;
3930
3931 inet_get_local_port_range(&low, &high);
3932
3933 if (snum < max(PROT_SOCK, low) || snum > high) {
3934 err = sel_netport_sid(sk->sk_protocol,
3935 snum, &sid);
3936 if (err)
3937 goto out;
3938 ad.type = LSM_AUDIT_DATA_NET;
3939 ad.u.net = &net;
3940 ad.u.net->sport = htons(snum);
3941 ad.u.net->family = family;
3942 err = avc_has_perm(sksec->sid, sid,
3943 sksec->sclass,
3944 SOCKET__NAME_BIND, &ad);
3945 if (err)
3946 goto out;
3947 }
3948 }
3949
3950 switch (sksec->sclass) {
3951 case SECCLASS_TCP_SOCKET:
3952 node_perm = TCP_SOCKET__NODE_BIND;
3953 break;
3954
3955 case SECCLASS_UDP_SOCKET:
3956 node_perm = UDP_SOCKET__NODE_BIND;
3957 break;
3958
3959 case SECCLASS_DCCP_SOCKET:
3960 node_perm = DCCP_SOCKET__NODE_BIND;
3961 break;
3962
3963 default:
3964 node_perm = RAWIP_SOCKET__NODE_BIND;
3965 break;
3966 }
3967
3968 err = sel_netnode_sid(addrp, family, &sid);
3969 if (err)
3970 goto out;
3971
3972 ad.type = LSM_AUDIT_DATA_NET;
3973 ad.u.net = &net;
3974 ad.u.net->sport = htons(snum);
3975 ad.u.net->family = family;
3976
3977 if (family == PF_INET)
3978 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3979 else
3980 ad.u.net->v6info.saddr = addr6->sin6_addr;
3981
3982 err = avc_has_perm(sksec->sid, sid,
3983 sksec->sclass, node_perm, &ad);
3984 if (err)
3985 goto out;
3986 }
3987 out:
3988 return err;
3989 }
3990
3991 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3992 {
3993 struct sock *sk = sock->sk;
3994 struct sk_security_struct *sksec = sk->sk_security;
3995 int err;
3996
3997 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3998 if (err)
3999 return err;
4000
4001 /*
4002 * If a TCP or DCCP socket, check name_connect permission for the port.
4003 */
4004 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4005 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4006 struct common_audit_data ad;
4007 struct lsm_network_audit net = {0,};
4008 struct sockaddr_in *addr4 = NULL;
4009 struct sockaddr_in6 *addr6 = NULL;
4010 unsigned short snum;
4011 u32 sid, perm;
4012
4013 if (sk->sk_family == PF_INET) {
4014 addr4 = (struct sockaddr_in *)address;
4015 if (addrlen < sizeof(struct sockaddr_in))
4016 return -EINVAL;
4017 snum = ntohs(addr4->sin_port);
4018 } else {
4019 addr6 = (struct sockaddr_in6 *)address;
4020 if (addrlen < SIN6_LEN_RFC2133)
4021 return -EINVAL;
4022 snum = ntohs(addr6->sin6_port);
4023 }
4024
4025 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4026 if (err)
4027 goto out;
4028
4029 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4030 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4031
4032 ad.type = LSM_AUDIT_DATA_NET;
4033 ad.u.net = &net;
4034 ad.u.net->dport = htons(snum);
4035 ad.u.net->family = sk->sk_family;
4036 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4037 if (err)
4038 goto out;
4039 }
4040
4041 err = selinux_netlbl_socket_connect(sk, address);
4042
4043 out:
4044 return err;
4045 }
4046
4047 static int selinux_socket_listen(struct socket *sock, int backlog)
4048 {
4049 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4050 }
4051
4052 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4053 {
4054 int err;
4055 struct inode_security_struct *isec;
4056 struct inode_security_struct *newisec;
4057
4058 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4059 if (err)
4060 return err;
4061
4062 newisec = SOCK_INODE(newsock)->i_security;
4063
4064 isec = SOCK_INODE(sock)->i_security;
4065 newisec->sclass = isec->sclass;
4066 newisec->sid = isec->sid;
4067 newisec->initialized = 1;
4068
4069 return 0;
4070 }
4071
4072 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4073 int size)
4074 {
4075 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4076 }
4077
4078 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4079 int size, int flags)
4080 {
4081 return sock_has_perm(current, sock->sk, SOCKET__READ);
4082 }
4083
4084 static int selinux_socket_getsockname(struct socket *sock)
4085 {
4086 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4087 }
4088
4089 static int selinux_socket_getpeername(struct socket *sock)
4090 {
4091 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4092 }
4093
4094 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4095 {
4096 int err;
4097
4098 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4099 if (err)
4100 return err;
4101
4102 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4103 }
4104
4105 static int selinux_socket_getsockopt(struct socket *sock, int level,
4106 int optname)
4107 {
4108 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4109 }
4110
4111 static int selinux_socket_shutdown(struct socket *sock, int how)
4112 {
4113 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4114 }
4115
4116 static int selinux_socket_unix_stream_connect(struct sock *sock,
4117 struct sock *other,
4118 struct sock *newsk)
4119 {
4120 struct sk_security_struct *sksec_sock = sock->sk_security;
4121 struct sk_security_struct *sksec_other = other->sk_security;
4122 struct sk_security_struct *sksec_new = newsk->sk_security;
4123 struct common_audit_data ad;
4124 struct lsm_network_audit net = {0,};
4125 int err;
4126
4127 ad.type = LSM_AUDIT_DATA_NET;
4128 ad.u.net = &net;
4129 ad.u.net->sk = other;
4130
4131 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4132 sksec_other->sclass,
4133 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4134 if (err)
4135 return err;
4136
4137 /* server child socket */
4138 sksec_new->peer_sid = sksec_sock->sid;
4139 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4140 &sksec_new->sid);
4141 if (err)
4142 return err;
4143
4144 /* connecting socket */
4145 sksec_sock->peer_sid = sksec_new->sid;
4146
4147 return 0;
4148 }
4149
4150 static int selinux_socket_unix_may_send(struct socket *sock,
4151 struct socket *other)
4152 {
4153 struct sk_security_struct *ssec = sock->sk->sk_security;
4154 struct sk_security_struct *osec = other->sk->sk_security;
4155 struct common_audit_data ad;
4156 struct lsm_network_audit net = {0,};
4157
4158 ad.type = LSM_AUDIT_DATA_NET;
4159 ad.u.net = &net;
4160 ad.u.net->sk = other->sk;
4161
4162 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4163 &ad);
4164 }
4165
4166 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4167 u32 peer_sid,
4168 struct common_audit_data *ad)
4169 {
4170 int err;
4171 u32 if_sid;
4172 u32 node_sid;
4173
4174 err = sel_netif_sid(ifindex, &if_sid);
4175 if (err)
4176 return err;
4177 err = avc_has_perm(peer_sid, if_sid,
4178 SECCLASS_NETIF, NETIF__INGRESS, ad);
4179 if (err)
4180 return err;
4181
4182 err = sel_netnode_sid(addrp, family, &node_sid);
4183 if (err)
4184 return err;
4185 return avc_has_perm(peer_sid, node_sid,
4186 SECCLASS_NODE, NODE__RECVFROM, ad);
4187 }
4188
4189 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4190 u16 family)
4191 {
4192 int err = 0;
4193 struct sk_security_struct *sksec = sk->sk_security;
4194 u32 sk_sid = sksec->sid;
4195 struct common_audit_data ad;
4196 struct lsm_network_audit net = {0,};
4197 char *addrp;
4198
4199 ad.type = LSM_AUDIT_DATA_NET;
4200 ad.u.net = &net;
4201 ad.u.net->netif = skb->skb_iif;
4202 ad.u.net->family = family;
4203 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4204 if (err)
4205 return err;
4206
4207 if (selinux_secmark_enabled()) {
4208 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4209 PACKET__RECV, &ad);
4210 if (err)
4211 return err;
4212 }
4213
4214 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4215 if (err)
4216 return err;
4217 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4218
4219 return err;
4220 }
4221
4222 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4223 {
4224 int err;
4225 struct sk_security_struct *sksec = sk->sk_security;
4226 u16 family = sk->sk_family;
4227 u32 sk_sid = sksec->sid;
4228 struct common_audit_data ad;
4229 struct lsm_network_audit net = {0,};
4230 char *addrp;
4231 u8 secmark_active;
4232 u8 peerlbl_active;
4233
4234 if (family != PF_INET && family != PF_INET6)
4235 return 0;
4236
4237 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4238 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4239 family = PF_INET;
4240
4241 /* If any sort of compatibility mode is enabled then handoff processing
4242 * to the selinux_sock_rcv_skb_compat() function to deal with the
4243 * special handling. We do this in an attempt to keep this function
4244 * as fast and as clean as possible. */
4245 if (!selinux_policycap_netpeer)
4246 return selinux_sock_rcv_skb_compat(sk, skb, family);
4247
4248 secmark_active = selinux_secmark_enabled();
4249 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4250 if (!secmark_active && !peerlbl_active)
4251 return 0;
4252
4253 ad.type = LSM_AUDIT_DATA_NET;
4254 ad.u.net = &net;
4255 ad.u.net->netif = skb->skb_iif;
4256 ad.u.net->family = family;
4257 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4258 if (err)
4259 return err;
4260
4261 if (peerlbl_active) {
4262 u32 peer_sid;
4263
4264 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4265 if (err)
4266 return err;
4267 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4268 peer_sid, &ad);
4269 if (err) {
4270 selinux_netlbl_err(skb, err, 0);
4271 return err;
4272 }
4273 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4274 PEER__RECV, &ad);
4275 if (err)
4276 selinux_netlbl_err(skb, err, 0);
4277 }
4278
4279 if (secmark_active) {
4280 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4281 PACKET__RECV, &ad);
4282 if (err)
4283 return err;
4284 }
4285
4286 return err;
4287 }
4288
4289 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4290 int __user *optlen, unsigned len)
4291 {
4292 int err = 0;
4293 char *scontext;
4294 u32 scontext_len;
4295 struct sk_security_struct *sksec = sock->sk->sk_security;
4296 u32 peer_sid = SECSID_NULL;
4297
4298 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4299 sksec->sclass == SECCLASS_TCP_SOCKET)
4300 peer_sid = sksec->peer_sid;
4301 if (peer_sid == SECSID_NULL)
4302 return -ENOPROTOOPT;
4303
4304 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4305 if (err)
4306 return err;
4307
4308 if (scontext_len > len) {
4309 err = -ERANGE;
4310 goto out_len;
4311 }
4312
4313 if (copy_to_user(optval, scontext, scontext_len))
4314 err = -EFAULT;
4315
4316 out_len:
4317 if (put_user(scontext_len, optlen))
4318 err = -EFAULT;
4319 kfree(scontext);
4320 return err;
4321 }
4322
4323 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4324 {
4325 u32 peer_secid = SECSID_NULL;
4326 u16 family;
4327
4328 if (skb && skb->protocol == htons(ETH_P_IP))
4329 family = PF_INET;
4330 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4331 family = PF_INET6;
4332 else if (sock)
4333 family = sock->sk->sk_family;
4334 else
4335 goto out;
4336
4337 if (sock && family == PF_UNIX)
4338 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4339 else if (skb)
4340 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4341
4342 out:
4343 *secid = peer_secid;
4344 if (peer_secid == SECSID_NULL)
4345 return -EINVAL;
4346 return 0;
4347 }
4348
4349 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4350 {
4351 struct sk_security_struct *sksec;
4352
4353 sksec = kzalloc(sizeof(*sksec), priority);
4354 if (!sksec)
4355 return -ENOMEM;
4356
4357 sksec->peer_sid = SECINITSID_UNLABELED;
4358 sksec->sid = SECINITSID_UNLABELED;
4359 selinux_netlbl_sk_security_reset(sksec);
4360 sk->sk_security = sksec;
4361
4362 return 0;
4363 }
4364
4365 static void selinux_sk_free_security(struct sock *sk)
4366 {
4367 struct sk_security_struct *sksec = sk->sk_security;
4368
4369 sk->sk_security = NULL;
4370 selinux_netlbl_sk_security_free(sksec);
4371 kfree(sksec);
4372 }
4373
4374 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4375 {
4376 struct sk_security_struct *sksec = sk->sk_security;
4377 struct sk_security_struct *newsksec = newsk->sk_security;
4378
4379 newsksec->sid = sksec->sid;
4380 newsksec->peer_sid = sksec->peer_sid;
4381 newsksec->sclass = sksec->sclass;
4382
4383 selinux_netlbl_sk_security_reset(newsksec);
4384 }
4385
4386 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4387 {
4388 if (!sk)
4389 *secid = SECINITSID_ANY_SOCKET;
4390 else {
4391 struct sk_security_struct *sksec = sk->sk_security;
4392
4393 *secid = sksec->sid;
4394 }
4395 }
4396
4397 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4398 {
4399 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4400 struct sk_security_struct *sksec = sk->sk_security;
4401
4402 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4403 sk->sk_family == PF_UNIX)
4404 isec->sid = sksec->sid;
4405 sksec->sclass = isec->sclass;
4406 }
4407
4408 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4409 struct request_sock *req)
4410 {
4411 struct sk_security_struct *sksec = sk->sk_security;
4412 int err;
4413 u16 family = sk->sk_family;
4414 u32 newsid;
4415 u32 peersid;
4416
4417 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4418 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4419 family = PF_INET;
4420
4421 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4422 if (err)
4423 return err;
4424 if (peersid == SECSID_NULL) {
4425 req->secid = sksec->sid;
4426 req->peer_secid = SECSID_NULL;
4427 } else {
4428 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4429 if (err)
4430 return err;
4431 req->secid = newsid;
4432 req->peer_secid = peersid;
4433 }
4434
4435 return selinux_netlbl_inet_conn_request(req, family);
4436 }
4437
4438 static void selinux_inet_csk_clone(struct sock *newsk,
4439 const struct request_sock *req)
4440 {
4441 struct sk_security_struct *newsksec = newsk->sk_security;
4442
4443 newsksec->sid = req->secid;
4444 newsksec->peer_sid = req->peer_secid;
4445 /* NOTE: Ideally, we should also get the isec->sid for the
4446 new socket in sync, but we don't have the isec available yet.
4447 So we will wait until sock_graft to do it, by which
4448 time it will have been created and available. */
4449
4450 /* We don't need to take any sort of lock here as we are the only
4451 * thread with access to newsksec */
4452 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4453 }
4454
4455 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4456 {
4457 u16 family = sk->sk_family;
4458 struct sk_security_struct *sksec = sk->sk_security;
4459
4460 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4461 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4462 family = PF_INET;
4463
4464 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4465 }
4466
4467 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4468 {
4469 skb_set_owner_w(skb, sk);
4470 }
4471
4472 static int selinux_secmark_relabel_packet(u32 sid)
4473 {
4474 const struct task_security_struct *__tsec;
4475 u32 tsid;
4476
4477 __tsec = current_security();
4478 tsid = __tsec->sid;
4479
4480 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4481 }
4482
4483 static void selinux_secmark_refcount_inc(void)
4484 {
4485 atomic_inc(&selinux_secmark_refcount);
4486 }
4487
4488 static void selinux_secmark_refcount_dec(void)
4489 {
4490 atomic_dec(&selinux_secmark_refcount);
4491 }
4492
4493 static void selinux_req_classify_flow(const struct request_sock *req,
4494 struct flowi *fl)
4495 {
4496 fl->flowi_secid = req->secid;
4497 }
4498
4499 static int selinux_tun_dev_alloc_security(void **security)
4500 {
4501 struct tun_security_struct *tunsec;
4502
4503 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4504 if (!tunsec)
4505 return -ENOMEM;
4506 tunsec->sid = current_sid();
4507
4508 *security = tunsec;
4509 return 0;
4510 }
4511
4512 static void selinux_tun_dev_free_security(void *security)
4513 {
4514 kfree(security);
4515 }
4516
4517 static int selinux_tun_dev_create(void)
4518 {
4519 u32 sid = current_sid();
4520
4521 /* we aren't taking into account the "sockcreate" SID since the socket
4522 * that is being created here is not a socket in the traditional sense,
4523 * instead it is a private sock, accessible only to the kernel, and
4524 * representing a wide range of network traffic spanning multiple
4525 * connections unlike traditional sockets - check the TUN driver to
4526 * get a better understanding of why this socket is special */
4527
4528 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4529 NULL);
4530 }
4531
4532 static int selinux_tun_dev_attach_queue(void *security)
4533 {
4534 struct tun_security_struct *tunsec = security;
4535
4536 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4537 TUN_SOCKET__ATTACH_QUEUE, NULL);
4538 }
4539
4540 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4541 {
4542 struct tun_security_struct *tunsec = security;
4543 struct sk_security_struct *sksec = sk->sk_security;
4544
4545 /* we don't currently perform any NetLabel based labeling here and it
4546 * isn't clear that we would want to do so anyway; while we could apply
4547 * labeling without the support of the TUN user the resulting labeled
4548 * traffic from the other end of the connection would almost certainly
4549 * cause confusion to the TUN user that had no idea network labeling
4550 * protocols were being used */
4551
4552 sksec->sid = tunsec->sid;
4553 sksec->sclass = SECCLASS_TUN_SOCKET;
4554
4555 return 0;
4556 }
4557
4558 static int selinux_tun_dev_open(void *security)
4559 {
4560 struct tun_security_struct *tunsec = security;
4561 u32 sid = current_sid();
4562 int err;
4563
4564 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4565 TUN_SOCKET__RELABELFROM, NULL);
4566 if (err)
4567 return err;
4568 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4569 TUN_SOCKET__RELABELTO, NULL);
4570 if (err)
4571 return err;
4572 tunsec->sid = sid;
4573
4574 return 0;
4575 }
4576
4577 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4578 {
4579 int err = 0;
4580 u32 perm;
4581 struct nlmsghdr *nlh;
4582 struct sk_security_struct *sksec = sk->sk_security;
4583
4584 if (skb->len < NLMSG_HDRLEN) {
4585 err = -EINVAL;
4586 goto out;
4587 }
4588 nlh = nlmsg_hdr(skb);
4589
4590 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4591 if (err) {
4592 if (err == -EINVAL) {
4593 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4594 "SELinux: unrecognized netlink message"
4595 " type=%hu for sclass=%hu\n",
4596 nlh->nlmsg_type, sksec->sclass);
4597 if (!selinux_enforcing || security_get_allow_unknown())
4598 err = 0;
4599 }
4600
4601 /* Ignore */
4602 if (err == -ENOENT)
4603 err = 0;
4604 goto out;
4605 }
4606
4607 err = sock_has_perm(current, sk, perm);
4608 out:
4609 return err;
4610 }
4611
4612 #ifdef CONFIG_NETFILTER
4613
4614 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4615 u16 family)
4616 {
4617 int err;
4618 char *addrp;
4619 u32 peer_sid;
4620 struct common_audit_data ad;
4621 struct lsm_network_audit net = {0,};
4622 u8 secmark_active;
4623 u8 netlbl_active;
4624 u8 peerlbl_active;
4625
4626 if (!selinux_policycap_netpeer)
4627 return NF_ACCEPT;
4628
4629 secmark_active = selinux_secmark_enabled();
4630 netlbl_active = netlbl_enabled();
4631 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4632 if (!secmark_active && !peerlbl_active)
4633 return NF_ACCEPT;
4634
4635 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4636 return NF_DROP;
4637
4638 ad.type = LSM_AUDIT_DATA_NET;
4639 ad.u.net = &net;
4640 ad.u.net->netif = ifindex;
4641 ad.u.net->family = family;
4642 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4643 return NF_DROP;
4644
4645 if (peerlbl_active) {
4646 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4647 peer_sid, &ad);
4648 if (err) {
4649 selinux_netlbl_err(skb, err, 1);
4650 return NF_DROP;
4651 }
4652 }
4653
4654 if (secmark_active)
4655 if (avc_has_perm(peer_sid, skb->secmark,
4656 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4657 return NF_DROP;
4658
4659 if (netlbl_active)
4660 /* we do this in the FORWARD path and not the POST_ROUTING
4661 * path because we want to make sure we apply the necessary
4662 * labeling before IPsec is applied so we can leverage AH
4663 * protection */
4664 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4665 return NF_DROP;
4666
4667 return NF_ACCEPT;
4668 }
4669
4670 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4671 struct sk_buff *skb,
4672 const struct net_device *in,
4673 const struct net_device *out,
4674 int (*okfn)(struct sk_buff *))
4675 {
4676 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4677 }
4678
4679 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4680 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4681 struct sk_buff *skb,
4682 const struct net_device *in,
4683 const struct net_device *out,
4684 int (*okfn)(struct sk_buff *))
4685 {
4686 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4687 }
4688 #endif /* IPV6 */
4689
4690 static unsigned int selinux_ip_output(struct sk_buff *skb,
4691 u16 family)
4692 {
4693 u32 sid;
4694
4695 if (!netlbl_enabled())
4696 return NF_ACCEPT;
4697
4698 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4699 * because we want to make sure we apply the necessary labeling
4700 * before IPsec is applied so we can leverage AH protection */
4701 if (skb->sk) {
4702 struct sk_security_struct *sksec = skb->sk->sk_security;
4703 sid = sksec->sid;
4704 } else
4705 sid = SECINITSID_KERNEL;
4706 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4707 return NF_DROP;
4708
4709 return NF_ACCEPT;
4710 }
4711
4712 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4713 struct sk_buff *skb,
4714 const struct net_device *in,
4715 const struct net_device *out,
4716 int (*okfn)(struct sk_buff *))
4717 {
4718 return selinux_ip_output(skb, PF_INET);
4719 }
4720
4721 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4722 int ifindex,
4723 u16 family)
4724 {
4725 struct sock *sk = skb->sk;
4726 struct sk_security_struct *sksec;
4727 struct common_audit_data ad;
4728 struct lsm_network_audit net = {0,};
4729 char *addrp;
4730 u8 proto;
4731
4732 if (sk == NULL)
4733 return NF_ACCEPT;
4734 sksec = sk->sk_security;
4735
4736 ad.type = LSM_AUDIT_DATA_NET;
4737 ad.u.net = &net;
4738 ad.u.net->netif = ifindex;
4739 ad.u.net->family = family;
4740 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4741 return NF_DROP;
4742
4743 if (selinux_secmark_enabled())
4744 if (avc_has_perm(sksec->sid, skb->secmark,
4745 SECCLASS_PACKET, PACKET__SEND, &ad))
4746 return NF_DROP_ERR(-ECONNREFUSED);
4747
4748 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4749 return NF_DROP_ERR(-ECONNREFUSED);
4750
4751 return NF_ACCEPT;
4752 }
4753
4754 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4755 u16 family)
4756 {
4757 u32 secmark_perm;
4758 u32 peer_sid;
4759 struct sock *sk;
4760 struct common_audit_data ad;
4761 struct lsm_network_audit net = {0,};
4762 char *addrp;
4763 u8 secmark_active;
4764 u8 peerlbl_active;
4765
4766 /* If any sort of compatibility mode is enabled then handoff processing
4767 * to the selinux_ip_postroute_compat() function to deal with the
4768 * special handling. We do this in an attempt to keep this function
4769 * as fast and as clean as possible. */
4770 if (!selinux_policycap_netpeer)
4771 return selinux_ip_postroute_compat(skb, ifindex, family);
4772 #ifdef CONFIG_XFRM
4773 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4774 * packet transformation so allow the packet to pass without any checks
4775 * since we'll have another chance to perform access control checks
4776 * when the packet is on it's final way out.
4777 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4778 * is NULL, in this case go ahead and apply access control. */
4779 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4780 return NF_ACCEPT;
4781 #endif
4782 secmark_active = selinux_secmark_enabled();
4783 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4784 if (!secmark_active && !peerlbl_active)
4785 return NF_ACCEPT;
4786
4787 /* if the packet is being forwarded then get the peer label from the
4788 * packet itself; otherwise check to see if it is from a local
4789 * application or the kernel, if from an application get the peer label
4790 * from the sending socket, otherwise use the kernel's sid */
4791 sk = skb->sk;
4792 if (sk == NULL) {
4793 if (skb->skb_iif) {
4794 secmark_perm = PACKET__FORWARD_OUT;
4795 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4796 return NF_DROP;
4797 } else {
4798 secmark_perm = PACKET__SEND;
4799 peer_sid = SECINITSID_KERNEL;
4800 }
4801 } else {
4802 struct sk_security_struct *sksec = sk->sk_security;
4803 peer_sid = sksec->sid;
4804 secmark_perm = PACKET__SEND;
4805 }
4806
4807 ad.type = LSM_AUDIT_DATA_NET;
4808 ad.u.net = &net;
4809 ad.u.net->netif = ifindex;
4810 ad.u.net->family = family;
4811 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4812 return NF_DROP;
4813
4814 if (secmark_active)
4815 if (avc_has_perm(peer_sid, skb->secmark,
4816 SECCLASS_PACKET, secmark_perm, &ad))
4817 return NF_DROP_ERR(-ECONNREFUSED);
4818
4819 if (peerlbl_active) {
4820 u32 if_sid;
4821 u32 node_sid;
4822
4823 if (sel_netif_sid(ifindex, &if_sid))
4824 return NF_DROP;
4825 if (avc_has_perm(peer_sid, if_sid,
4826 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4827 return NF_DROP_ERR(-ECONNREFUSED);
4828
4829 if (sel_netnode_sid(addrp, family, &node_sid))
4830 return NF_DROP;
4831 if (avc_has_perm(peer_sid, node_sid,
4832 SECCLASS_NODE, NODE__SENDTO, &ad))
4833 return NF_DROP_ERR(-ECONNREFUSED);
4834 }
4835
4836 return NF_ACCEPT;
4837 }
4838
4839 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4840 struct sk_buff *skb,
4841 const struct net_device *in,
4842 const struct net_device *out,
4843 int (*okfn)(struct sk_buff *))
4844 {
4845 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4846 }
4847
4848 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4849 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4850 struct sk_buff *skb,
4851 const struct net_device *in,
4852 const struct net_device *out,
4853 int (*okfn)(struct sk_buff *))
4854 {
4855 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4856 }
4857 #endif /* IPV6 */
4858
4859 #endif /* CONFIG_NETFILTER */
4860
4861 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4862 {
4863 int err;
4864
4865 err = cap_netlink_send(sk, skb);
4866 if (err)
4867 return err;
4868
4869 return selinux_nlmsg_perm(sk, skb);
4870 }
4871
4872 static int ipc_alloc_security(struct task_struct *task,
4873 struct kern_ipc_perm *perm,
4874 u16 sclass)
4875 {
4876 struct ipc_security_struct *isec;
4877 u32 sid;
4878
4879 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4880 if (!isec)
4881 return -ENOMEM;
4882
4883 sid = task_sid(task);
4884 isec->sclass = sclass;
4885 isec->sid = sid;
4886 perm->security = isec;
4887
4888 return 0;
4889 }
4890
4891 static void ipc_free_security(struct kern_ipc_perm *perm)
4892 {
4893 struct ipc_security_struct *isec = perm->security;
4894 perm->security = NULL;
4895 kfree(isec);
4896 }
4897
4898 static int msg_msg_alloc_security(struct msg_msg *msg)
4899 {
4900 struct msg_security_struct *msec;
4901
4902 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4903 if (!msec)
4904 return -ENOMEM;
4905
4906 msec->sid = SECINITSID_UNLABELED;
4907 msg->security = msec;
4908
4909 return 0;
4910 }
4911
4912 static void msg_msg_free_security(struct msg_msg *msg)
4913 {
4914 struct msg_security_struct *msec = msg->security;
4915
4916 msg->security = NULL;
4917 kfree(msec);
4918 }
4919
4920 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4921 u32 perms)
4922 {
4923 struct ipc_security_struct *isec;
4924 struct common_audit_data ad;
4925 u32 sid = current_sid();
4926
4927 isec = ipc_perms->security;
4928
4929 ad.type = LSM_AUDIT_DATA_IPC;
4930 ad.u.ipc_id = ipc_perms->key;
4931
4932 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4933 }
4934
4935 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4936 {
4937 return msg_msg_alloc_security(msg);
4938 }
4939
4940 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4941 {
4942 msg_msg_free_security(msg);
4943 }
4944
4945 /* message queue security operations */
4946 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4947 {
4948 struct ipc_security_struct *isec;
4949 struct common_audit_data ad;
4950 u32 sid = current_sid();
4951 int rc;
4952
4953 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4954 if (rc)
4955 return rc;
4956
4957 isec = msq->q_perm.security;
4958
4959 ad.type = LSM_AUDIT_DATA_IPC;
4960 ad.u.ipc_id = msq->q_perm.key;
4961
4962 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4963 MSGQ__CREATE, &ad);
4964 if (rc) {
4965 ipc_free_security(&msq->q_perm);
4966 return rc;
4967 }
4968 return 0;
4969 }
4970
4971 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4972 {
4973 ipc_free_security(&msq->q_perm);
4974 }
4975
4976 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4977 {
4978 struct ipc_security_struct *isec;
4979 struct common_audit_data ad;
4980 u32 sid = current_sid();
4981
4982 isec = msq->q_perm.security;
4983
4984 ad.type = LSM_AUDIT_DATA_IPC;
4985 ad.u.ipc_id = msq->q_perm.key;
4986
4987 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4988 MSGQ__ASSOCIATE, &ad);
4989 }
4990
4991 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4992 {
4993 int err;
4994 int perms;
4995
4996 switch (cmd) {
4997 case IPC_INFO:
4998 case MSG_INFO:
4999 /* No specific object, just general system-wide information. */
5000 return task_has_system(current, SYSTEM__IPC_INFO);
5001 case IPC_STAT:
5002 case MSG_STAT:
5003 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5004 break;
5005 case IPC_SET:
5006 perms = MSGQ__SETATTR;
5007 break;
5008 case IPC_RMID:
5009 perms = MSGQ__DESTROY;
5010 break;
5011 default:
5012 return 0;
5013 }
5014
5015 err = ipc_has_perm(&msq->q_perm, perms);
5016 return err;
5017 }
5018
5019 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5020 {
5021 struct ipc_security_struct *isec;
5022 struct msg_security_struct *msec;
5023 struct common_audit_data ad;
5024 u32 sid = current_sid();
5025 int rc;
5026
5027 isec = msq->q_perm.security;
5028 msec = msg->security;
5029
5030 /*
5031 * First time through, need to assign label to the message
5032 */
5033 if (msec->sid == SECINITSID_UNLABELED) {
5034 /*
5035 * Compute new sid based on current process and
5036 * message queue this message will be stored in
5037 */
5038 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5039 NULL, &msec->sid);
5040 if (rc)
5041 return rc;
5042 }
5043
5044 ad.type = LSM_AUDIT_DATA_IPC;
5045 ad.u.ipc_id = msq->q_perm.key;
5046
5047 /* Can this process write to the queue? */
5048 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5049 MSGQ__WRITE, &ad);
5050 if (!rc)
5051 /* Can this process send the message */
5052 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5053 MSG__SEND, &ad);
5054 if (!rc)
5055 /* Can the message be put in the queue? */
5056 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5057 MSGQ__ENQUEUE, &ad);
5058
5059 return rc;
5060 }
5061
5062 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5063 struct task_struct *target,
5064 long type, int mode)
5065 {
5066 struct ipc_security_struct *isec;
5067 struct msg_security_struct *msec;
5068 struct common_audit_data ad;
5069 u32 sid = task_sid(target);
5070 int rc;
5071
5072 isec = msq->q_perm.security;
5073 msec = msg->security;
5074
5075 ad.type = LSM_AUDIT_DATA_IPC;
5076 ad.u.ipc_id = msq->q_perm.key;
5077
5078 rc = avc_has_perm(sid, isec->sid,
5079 SECCLASS_MSGQ, MSGQ__READ, &ad);
5080 if (!rc)
5081 rc = avc_has_perm(sid, msec->sid,
5082 SECCLASS_MSG, MSG__RECEIVE, &ad);
5083 return rc;
5084 }
5085
5086 /* Shared Memory security operations */
5087 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5088 {
5089 struct ipc_security_struct *isec;
5090 struct common_audit_data ad;
5091 u32 sid = current_sid();
5092 int rc;
5093
5094 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5095 if (rc)
5096 return rc;
5097
5098 isec = shp->shm_perm.security;
5099
5100 ad.type = LSM_AUDIT_DATA_IPC;
5101 ad.u.ipc_id = shp->shm_perm.key;
5102
5103 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5104 SHM__CREATE, &ad);
5105 if (rc) {
5106 ipc_free_security(&shp->shm_perm);
5107 return rc;
5108 }
5109 return 0;
5110 }
5111
5112 static void selinux_shm_free_security(struct shmid_kernel *shp)
5113 {
5114 ipc_free_security(&shp->shm_perm);
5115 }
5116
5117 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5118 {
5119 struct ipc_security_struct *isec;
5120 struct common_audit_data ad;
5121 u32 sid = current_sid();
5122
5123 isec = shp->shm_perm.security;
5124
5125 ad.type = LSM_AUDIT_DATA_IPC;
5126 ad.u.ipc_id = shp->shm_perm.key;
5127
5128 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5129 SHM__ASSOCIATE, &ad);
5130 }
5131
5132 /* Note, at this point, shp is locked down */
5133 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5134 {
5135 int perms;
5136 int err;
5137
5138 switch (cmd) {
5139 case IPC_INFO:
5140 case SHM_INFO:
5141 /* No specific object, just general system-wide information. */
5142 return task_has_system(current, SYSTEM__IPC_INFO);
5143 case IPC_STAT:
5144 case SHM_STAT:
5145 perms = SHM__GETATTR | SHM__ASSOCIATE;
5146 break;
5147 case IPC_SET:
5148 perms = SHM__SETATTR;
5149 break;
5150 case SHM_LOCK:
5151 case SHM_UNLOCK:
5152 perms = SHM__LOCK;
5153 break;
5154 case IPC_RMID:
5155 perms = SHM__DESTROY;
5156 break;
5157 default:
5158 return 0;
5159 }
5160
5161 err = ipc_has_perm(&shp->shm_perm, perms);
5162 return err;
5163 }
5164
5165 static int selinux_shm_shmat(struct shmid_kernel *shp,
5166 char __user *shmaddr, int shmflg)
5167 {
5168 u32 perms;
5169
5170 if (shmflg & SHM_RDONLY)
5171 perms = SHM__READ;
5172 else
5173 perms = SHM__READ | SHM__WRITE;
5174
5175 return ipc_has_perm(&shp->shm_perm, perms);
5176 }
5177
5178 /* Semaphore security operations */
5179 static int selinux_sem_alloc_security(struct sem_array *sma)
5180 {
5181 struct ipc_security_struct *isec;
5182 struct common_audit_data ad;
5183 u32 sid = current_sid();
5184 int rc;
5185
5186 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5187 if (rc)
5188 return rc;
5189
5190 isec = sma->sem_perm.security;
5191
5192 ad.type = LSM_AUDIT_DATA_IPC;
5193 ad.u.ipc_id = sma->sem_perm.key;
5194
5195 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5196 SEM__CREATE, &ad);
5197 if (rc) {
5198 ipc_free_security(&sma->sem_perm);
5199 return rc;
5200 }
5201 return 0;
5202 }
5203
5204 static void selinux_sem_free_security(struct sem_array *sma)
5205 {
5206 ipc_free_security(&sma->sem_perm);
5207 }
5208
5209 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5210 {
5211 struct ipc_security_struct *isec;
5212 struct common_audit_data ad;
5213 u32 sid = current_sid();
5214
5215 isec = sma->sem_perm.security;
5216
5217 ad.type = LSM_AUDIT_DATA_IPC;
5218 ad.u.ipc_id = sma->sem_perm.key;
5219
5220 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5221 SEM__ASSOCIATE, &ad);
5222 }
5223
5224 /* Note, at this point, sma is locked down */
5225 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5226 {
5227 int err;
5228 u32 perms;
5229
5230 switch (cmd) {
5231 case IPC_INFO:
5232 case SEM_INFO:
5233 /* No specific object, just general system-wide information. */
5234 return task_has_system(current, SYSTEM__IPC_INFO);
5235 case GETPID:
5236 case GETNCNT:
5237 case GETZCNT:
5238 perms = SEM__GETATTR;
5239 break;
5240 case GETVAL:
5241 case GETALL:
5242 perms = SEM__READ;
5243 break;
5244 case SETVAL:
5245 case SETALL:
5246 perms = SEM__WRITE;
5247 break;
5248 case IPC_RMID:
5249 perms = SEM__DESTROY;
5250 break;
5251 case IPC_SET:
5252 perms = SEM__SETATTR;
5253 break;
5254 case IPC_STAT:
5255 case SEM_STAT:
5256 perms = SEM__GETATTR | SEM__ASSOCIATE;
5257 break;
5258 default:
5259 return 0;
5260 }
5261
5262 err = ipc_has_perm(&sma->sem_perm, perms);
5263 return err;
5264 }
5265
5266 static int selinux_sem_semop(struct sem_array *sma,
5267 struct sembuf *sops, unsigned nsops, int alter)
5268 {
5269 u32 perms;
5270
5271 if (alter)
5272 perms = SEM__READ | SEM__WRITE;
5273 else
5274 perms = SEM__READ;
5275
5276 return ipc_has_perm(&sma->sem_perm, perms);
5277 }
5278
5279 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5280 {
5281 u32 av = 0;
5282
5283 av = 0;
5284 if (flag & S_IRUGO)
5285 av |= IPC__UNIX_READ;
5286 if (flag & S_IWUGO)
5287 av |= IPC__UNIX_WRITE;
5288
5289 if (av == 0)
5290 return 0;
5291
5292 return ipc_has_perm(ipcp, av);
5293 }
5294
5295 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5296 {
5297 struct ipc_security_struct *isec = ipcp->security;
5298 *secid = isec->sid;
5299 }
5300
5301 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5302 {
5303 if (inode)
5304 inode_doinit_with_dentry(inode, dentry);
5305 }
5306
5307 static int selinux_getprocattr(struct task_struct *p,
5308 char *name, char **value)
5309 {
5310 const struct task_security_struct *__tsec;
5311 u32 sid;
5312 int error;
5313 unsigned len;
5314
5315 if (current != p) {
5316 error = current_has_perm(p, PROCESS__GETATTR);
5317 if (error)
5318 return error;
5319 }
5320
5321 rcu_read_lock();
5322 __tsec = __task_cred(p)->security;
5323
5324 if (!strcmp(name, "current"))
5325 sid = __tsec->sid;
5326 else if (!strcmp(name, "prev"))
5327 sid = __tsec->osid;
5328 else if (!strcmp(name, "exec"))
5329 sid = __tsec->exec_sid;
5330 else if (!strcmp(name, "fscreate"))
5331 sid = __tsec->create_sid;
5332 else if (!strcmp(name, "keycreate"))
5333 sid = __tsec->keycreate_sid;
5334 else if (!strcmp(name, "sockcreate"))
5335 sid = __tsec->sockcreate_sid;
5336 else
5337 goto invalid;
5338 rcu_read_unlock();
5339
5340 if (!sid)
5341 return 0;
5342
5343 error = security_sid_to_context(sid, value, &len);
5344 if (error)
5345 return error;
5346 return len;
5347
5348 invalid:
5349 rcu_read_unlock();
5350 return -EINVAL;
5351 }
5352
5353 static int selinux_setprocattr(struct task_struct *p,
5354 char *name, void *value, size_t size)
5355 {
5356 struct task_security_struct *tsec;
5357 struct task_struct *tracer;
5358 struct cred *new;
5359 u32 sid = 0, ptsid;
5360 int error;
5361 char *str = value;
5362
5363 if (current != p) {
5364 /* SELinux only allows a process to change its own
5365 security attributes. */
5366 return -EACCES;
5367 }
5368
5369 /*
5370 * Basic control over ability to set these attributes at all.
5371 * current == p, but we'll pass them separately in case the
5372 * above restriction is ever removed.
5373 */
5374 if (!strcmp(name, "exec"))
5375 error = current_has_perm(p, PROCESS__SETEXEC);
5376 else if (!strcmp(name, "fscreate"))
5377 error = current_has_perm(p, PROCESS__SETFSCREATE);
5378 else if (!strcmp(name, "keycreate"))
5379 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5380 else if (!strcmp(name, "sockcreate"))
5381 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5382 else if (!strcmp(name, "current"))
5383 error = current_has_perm(p, PROCESS__SETCURRENT);
5384 else
5385 error = -EINVAL;
5386 if (error)
5387 return error;
5388
5389 /* Obtain a SID for the context, if one was specified. */
5390 if (size && str[1] && str[1] != '\n') {
5391 if (str[size-1] == '\n') {
5392 str[size-1] = 0;
5393 size--;
5394 }
5395 error = security_context_to_sid(value, size, &sid);
5396 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5397 if (!capable(CAP_MAC_ADMIN)) {
5398 struct audit_buffer *ab;
5399 size_t audit_size;
5400
5401 /* We strip a nul only if it is at the end, otherwise the
5402 * context contains a nul and we should audit that */
5403 if (str[size - 1] == '\0')
5404 audit_size = size - 1;
5405 else
5406 audit_size = size;
5407 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5408 audit_log_format(ab, "op=fscreate invalid_context=");
5409 audit_log_n_untrustedstring(ab, value, audit_size);
5410 audit_log_end(ab);
5411
5412 return error;
5413 }
5414 error = security_context_to_sid_force(value, size,
5415 &sid);
5416 }
5417 if (error)
5418 return error;
5419 }
5420
5421 new = prepare_creds();
5422 if (!new)
5423 return -ENOMEM;
5424
5425 /* Permission checking based on the specified context is
5426 performed during the actual operation (execve,
5427 open/mkdir/...), when we know the full context of the
5428 operation. See selinux_bprm_set_creds for the execve
5429 checks and may_create for the file creation checks. The
5430 operation will then fail if the context is not permitted. */
5431 tsec = new->security;
5432 if (!strcmp(name, "exec")) {
5433 tsec->exec_sid = sid;
5434 } else if (!strcmp(name, "fscreate")) {
5435 tsec->create_sid = sid;
5436 } else if (!strcmp(name, "keycreate")) {
5437 error = may_create_key(sid, p);
5438 if (error)
5439 goto abort_change;
5440 tsec->keycreate_sid = sid;
5441 } else if (!strcmp(name, "sockcreate")) {
5442 tsec->sockcreate_sid = sid;
5443 } else if (!strcmp(name, "current")) {
5444 error = -EINVAL;
5445 if (sid == 0)
5446 goto abort_change;
5447
5448 /* Only allow single threaded processes to change context */
5449 error = -EPERM;
5450 if (!current_is_single_threaded()) {
5451 error = security_bounded_transition(tsec->sid, sid);
5452 if (error)
5453 goto abort_change;
5454 }
5455
5456 /* Check permissions for the transition. */
5457 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5458 PROCESS__DYNTRANSITION, NULL);
5459 if (error)
5460 goto abort_change;
5461
5462 /* Check for ptracing, and update the task SID if ok.
5463 Otherwise, leave SID unchanged and fail. */
5464 ptsid = 0;
5465 task_lock(p);
5466 tracer = ptrace_parent(p);
5467 if (tracer)
5468 ptsid = task_sid(tracer);
5469 task_unlock(p);
5470
5471 if (tracer) {
5472 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5473 PROCESS__PTRACE, NULL);
5474 if (error)
5475 goto abort_change;
5476 }
5477
5478 tsec->sid = sid;
5479 } else {
5480 error = -EINVAL;
5481 goto abort_change;
5482 }
5483
5484 commit_creds(new);
5485 return size;
5486
5487 abort_change:
5488 abort_creds(new);
5489 return error;
5490 }
5491
5492 static int selinux_ismaclabel(const char *name)
5493 {
5494 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5495 }
5496
5497 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5498 {
5499 return security_sid_to_context(secid, secdata, seclen);
5500 }
5501
5502 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5503 {
5504 return security_context_to_sid(secdata, seclen, secid);
5505 }
5506
5507 static void selinux_release_secctx(char *secdata, u32 seclen)
5508 {
5509 kfree(secdata);
5510 }
5511
5512 /*
5513 * called with inode->i_mutex locked
5514 */
5515 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5516 {
5517 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5518 }
5519
5520 /*
5521 * called with inode->i_mutex locked
5522 */
5523 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5524 {
5525 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5526 }
5527
5528 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5529 {
5530 int len = 0;
5531 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5532 ctx, true);
5533 if (len < 0)
5534 return len;
5535 *ctxlen = len;
5536 return 0;
5537 }
5538 #ifdef CONFIG_KEYS
5539
5540 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5541 unsigned long flags)
5542 {
5543 const struct task_security_struct *tsec;
5544 struct key_security_struct *ksec;
5545
5546 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5547 if (!ksec)
5548 return -ENOMEM;
5549
5550 tsec = cred->security;
5551 if (tsec->keycreate_sid)
5552 ksec->sid = tsec->keycreate_sid;
5553 else
5554 ksec->sid = tsec->sid;
5555
5556 k->security = ksec;
5557 return 0;
5558 }
5559
5560 static void selinux_key_free(struct key *k)
5561 {
5562 struct key_security_struct *ksec = k->security;
5563
5564 k->security = NULL;
5565 kfree(ksec);
5566 }
5567
5568 static int selinux_key_permission(key_ref_t key_ref,
5569 const struct cred *cred,
5570 key_perm_t perm)
5571 {
5572 struct key *key;
5573 struct key_security_struct *ksec;
5574 u32 sid;
5575
5576 /* if no specific permissions are requested, we skip the
5577 permission check. No serious, additional covert channels
5578 appear to be created. */
5579 if (perm == 0)
5580 return 0;
5581
5582 sid = cred_sid(cred);
5583
5584 key = key_ref_to_ptr(key_ref);
5585 ksec = key->security;
5586
5587 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5588 }
5589
5590 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5591 {
5592 struct key_security_struct *ksec = key->security;
5593 char *context = NULL;
5594 unsigned len;
5595 int rc;
5596
5597 rc = security_sid_to_context(ksec->sid, &context, &len);
5598 if (!rc)
5599 rc = len;
5600 *_buffer = context;
5601 return rc;
5602 }
5603
5604 #endif
5605
5606 static struct security_operations selinux_ops = {
5607 .name = "selinux",
5608
5609 .ptrace_access_check = selinux_ptrace_access_check,
5610 .ptrace_traceme = selinux_ptrace_traceme,
5611 .capget = selinux_capget,
5612 .capset = selinux_capset,
5613 .capable = selinux_capable,
5614 .quotactl = selinux_quotactl,
5615 .quota_on = selinux_quota_on,
5616 .syslog = selinux_syslog,
5617 .vm_enough_memory = selinux_vm_enough_memory,
5618
5619 .netlink_send = selinux_netlink_send,
5620
5621 .bprm_set_creds = selinux_bprm_set_creds,
5622 .bprm_committing_creds = selinux_bprm_committing_creds,
5623 .bprm_committed_creds = selinux_bprm_committed_creds,
5624 .bprm_secureexec = selinux_bprm_secureexec,
5625
5626 .sb_alloc_security = selinux_sb_alloc_security,
5627 .sb_free_security = selinux_sb_free_security,
5628 .sb_copy_data = selinux_sb_copy_data,
5629 .sb_remount = selinux_sb_remount,
5630 .sb_kern_mount = selinux_sb_kern_mount,
5631 .sb_show_options = selinux_sb_show_options,
5632 .sb_statfs = selinux_sb_statfs,
5633 .sb_mount = selinux_mount,
5634 .sb_umount = selinux_umount,
5635 .sb_set_mnt_opts = selinux_set_mnt_opts,
5636 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5637 .sb_parse_opts_str = selinux_parse_opts_str,
5638
5639 .dentry_init_security = selinux_dentry_init_security,
5640
5641 .inode_alloc_security = selinux_inode_alloc_security,
5642 .inode_free_security = selinux_inode_free_security,
5643 .inode_init_security = selinux_inode_init_security,
5644 .inode_create = selinux_inode_create,
5645 .inode_link = selinux_inode_link,
5646 .inode_unlink = selinux_inode_unlink,
5647 .inode_symlink = selinux_inode_symlink,
5648 .inode_mkdir = selinux_inode_mkdir,
5649 .inode_rmdir = selinux_inode_rmdir,
5650 .inode_mknod = selinux_inode_mknod,
5651 .inode_rename = selinux_inode_rename,
5652 .inode_readlink = selinux_inode_readlink,
5653 .inode_follow_link = selinux_inode_follow_link,
5654 .inode_permission = selinux_inode_permission,
5655 .inode_setattr = selinux_inode_setattr,
5656 .inode_getattr = selinux_inode_getattr,
5657 .inode_setxattr = selinux_inode_setxattr,
5658 .inode_post_setxattr = selinux_inode_post_setxattr,
5659 .inode_getxattr = selinux_inode_getxattr,
5660 .inode_listxattr = selinux_inode_listxattr,
5661 .inode_removexattr = selinux_inode_removexattr,
5662 .inode_getsecurity = selinux_inode_getsecurity,
5663 .inode_setsecurity = selinux_inode_setsecurity,
5664 .inode_listsecurity = selinux_inode_listsecurity,
5665 .inode_getsecid = selinux_inode_getsecid,
5666
5667 .file_permission = selinux_file_permission,
5668 .file_alloc_security = selinux_file_alloc_security,
5669 .file_free_security = selinux_file_free_security,
5670 .file_ioctl = selinux_file_ioctl,
5671 .mmap_file = selinux_mmap_file,
5672 .mmap_addr = selinux_mmap_addr,
5673 .file_mprotect = selinux_file_mprotect,
5674 .file_lock = selinux_file_lock,
5675 .file_fcntl = selinux_file_fcntl,
5676 .file_set_fowner = selinux_file_set_fowner,
5677 .file_send_sigiotask = selinux_file_send_sigiotask,
5678 .file_receive = selinux_file_receive,
5679
5680 .file_open = selinux_file_open,
5681
5682 .task_create = selinux_task_create,
5683 .cred_alloc_blank = selinux_cred_alloc_blank,
5684 .cred_free = selinux_cred_free,
5685 .cred_prepare = selinux_cred_prepare,
5686 .cred_transfer = selinux_cred_transfer,
5687 .kernel_act_as = selinux_kernel_act_as,
5688 .kernel_create_files_as = selinux_kernel_create_files_as,
5689 .kernel_module_request = selinux_kernel_module_request,
5690 .task_setpgid = selinux_task_setpgid,
5691 .task_getpgid = selinux_task_getpgid,
5692 .task_getsid = selinux_task_getsid,
5693 .task_getsecid = selinux_task_getsecid,
5694 .task_setnice = selinux_task_setnice,
5695 .task_setioprio = selinux_task_setioprio,
5696 .task_getioprio = selinux_task_getioprio,
5697 .task_setrlimit = selinux_task_setrlimit,
5698 .task_setscheduler = selinux_task_setscheduler,
5699 .task_getscheduler = selinux_task_getscheduler,
5700 .task_movememory = selinux_task_movememory,
5701 .task_kill = selinux_task_kill,
5702 .task_wait = selinux_task_wait,
5703 .task_to_inode = selinux_task_to_inode,
5704
5705 .ipc_permission = selinux_ipc_permission,
5706 .ipc_getsecid = selinux_ipc_getsecid,
5707
5708 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5709 .msg_msg_free_security = selinux_msg_msg_free_security,
5710
5711 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5712 .msg_queue_free_security = selinux_msg_queue_free_security,
5713 .msg_queue_associate = selinux_msg_queue_associate,
5714 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5715 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5716 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5717
5718 .shm_alloc_security = selinux_shm_alloc_security,
5719 .shm_free_security = selinux_shm_free_security,
5720 .shm_associate = selinux_shm_associate,
5721 .shm_shmctl = selinux_shm_shmctl,
5722 .shm_shmat = selinux_shm_shmat,
5723
5724 .sem_alloc_security = selinux_sem_alloc_security,
5725 .sem_free_security = selinux_sem_free_security,
5726 .sem_associate = selinux_sem_associate,
5727 .sem_semctl = selinux_sem_semctl,
5728 .sem_semop = selinux_sem_semop,
5729
5730 .d_instantiate = selinux_d_instantiate,
5731
5732 .getprocattr = selinux_getprocattr,
5733 .setprocattr = selinux_setprocattr,
5734
5735 .ismaclabel = selinux_ismaclabel,
5736 .secid_to_secctx = selinux_secid_to_secctx,
5737 .secctx_to_secid = selinux_secctx_to_secid,
5738 .release_secctx = selinux_release_secctx,
5739 .inode_notifysecctx = selinux_inode_notifysecctx,
5740 .inode_setsecctx = selinux_inode_setsecctx,
5741 .inode_getsecctx = selinux_inode_getsecctx,
5742
5743 .unix_stream_connect = selinux_socket_unix_stream_connect,
5744 .unix_may_send = selinux_socket_unix_may_send,
5745
5746 .socket_create = selinux_socket_create,
5747 .socket_post_create = selinux_socket_post_create,
5748 .socket_bind = selinux_socket_bind,
5749 .socket_connect = selinux_socket_connect,
5750 .socket_listen = selinux_socket_listen,
5751 .socket_accept = selinux_socket_accept,
5752 .socket_sendmsg = selinux_socket_sendmsg,
5753 .socket_recvmsg = selinux_socket_recvmsg,
5754 .socket_getsockname = selinux_socket_getsockname,
5755 .socket_getpeername = selinux_socket_getpeername,
5756 .socket_getsockopt = selinux_socket_getsockopt,
5757 .socket_setsockopt = selinux_socket_setsockopt,
5758 .socket_shutdown = selinux_socket_shutdown,
5759 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5760 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5761 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5762 .sk_alloc_security = selinux_sk_alloc_security,
5763 .sk_free_security = selinux_sk_free_security,
5764 .sk_clone_security = selinux_sk_clone_security,
5765 .sk_getsecid = selinux_sk_getsecid,
5766 .sock_graft = selinux_sock_graft,
5767 .inet_conn_request = selinux_inet_conn_request,
5768 .inet_csk_clone = selinux_inet_csk_clone,
5769 .inet_conn_established = selinux_inet_conn_established,
5770 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5771 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5772 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5773 .req_classify_flow = selinux_req_classify_flow,
5774 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5775 .tun_dev_free_security = selinux_tun_dev_free_security,
5776 .tun_dev_create = selinux_tun_dev_create,
5777 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5778 .tun_dev_attach = selinux_tun_dev_attach,
5779 .tun_dev_open = selinux_tun_dev_open,
5780 .skb_owned_by = selinux_skb_owned_by,
5781
5782 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5783 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5784 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5785 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5786 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5787 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5788 .xfrm_state_free_security = selinux_xfrm_state_free,
5789 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5790 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5791 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5792 .xfrm_decode_session = selinux_xfrm_decode_session,
5793 #endif
5794
5795 #ifdef CONFIG_KEYS
5796 .key_alloc = selinux_key_alloc,
5797 .key_free = selinux_key_free,
5798 .key_permission = selinux_key_permission,
5799 .key_getsecurity = selinux_key_getsecurity,
5800 #endif
5801
5802 #ifdef CONFIG_AUDIT
5803 .audit_rule_init = selinux_audit_rule_init,
5804 .audit_rule_known = selinux_audit_rule_known,
5805 .audit_rule_match = selinux_audit_rule_match,
5806 .audit_rule_free = selinux_audit_rule_free,
5807 #endif
5808 };
5809
5810 static __init int selinux_init(void)
5811 {
5812 if (!security_module_enable(&selinux_ops)) {
5813 selinux_enabled = 0;
5814 return 0;
5815 }
5816
5817 if (!selinux_enabled) {
5818 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5819 return 0;
5820 }
5821
5822 printk(KERN_INFO "SELinux: Initializing.\n");
5823
5824 /* Set the security state for the initial task. */
5825 cred_init_security();
5826
5827 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5828
5829 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5830 sizeof(struct inode_security_struct),
5831 0, SLAB_PANIC, NULL);
5832 avc_init();
5833
5834 if (register_security(&selinux_ops))
5835 panic("SELinux: Unable to register with kernel.\n");
5836
5837 if (selinux_enforcing)
5838 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5839 else
5840 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5841
5842 return 0;
5843 }
5844
5845 static void delayed_superblock_init(struct super_block *sb, void *unused)
5846 {
5847 superblock_doinit(sb, NULL);
5848 }
5849
5850 void selinux_complete_init(void)
5851 {
5852 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5853
5854 /* Set up any superblocks initialized prior to the policy load. */
5855 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5856 iterate_supers(delayed_superblock_init, NULL);
5857 }
5858
5859 /* SELinux requires early initialization in order to label
5860 all processes and objects when they are created. */
5861 security_initcall(selinux_init);
5862
5863 #if defined(CONFIG_NETFILTER)
5864
5865 static struct nf_hook_ops selinux_ipv4_ops[] = {
5866 {
5867 .hook = selinux_ipv4_postroute,
5868 .owner = THIS_MODULE,
5869 .pf = NFPROTO_IPV4,
5870 .hooknum = NF_INET_POST_ROUTING,
5871 .priority = NF_IP_PRI_SELINUX_LAST,
5872 },
5873 {
5874 .hook = selinux_ipv4_forward,
5875 .owner = THIS_MODULE,
5876 .pf = NFPROTO_IPV4,
5877 .hooknum = NF_INET_FORWARD,
5878 .priority = NF_IP_PRI_SELINUX_FIRST,
5879 },
5880 {
5881 .hook = selinux_ipv4_output,
5882 .owner = THIS_MODULE,
5883 .pf = NFPROTO_IPV4,
5884 .hooknum = NF_INET_LOCAL_OUT,
5885 .priority = NF_IP_PRI_SELINUX_FIRST,
5886 }
5887 };
5888
5889 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5890
5891 static struct nf_hook_ops selinux_ipv6_ops[] = {
5892 {
5893 .hook = selinux_ipv6_postroute,
5894 .owner = THIS_MODULE,
5895 .pf = NFPROTO_IPV6,
5896 .hooknum = NF_INET_POST_ROUTING,
5897 .priority = NF_IP6_PRI_SELINUX_LAST,
5898 },
5899 {
5900 .hook = selinux_ipv6_forward,
5901 .owner = THIS_MODULE,
5902 .pf = NFPROTO_IPV6,
5903 .hooknum = NF_INET_FORWARD,
5904 .priority = NF_IP6_PRI_SELINUX_FIRST,
5905 }
5906 };
5907
5908 #endif /* IPV6 */
5909
5910 static int __init selinux_nf_ip_init(void)
5911 {
5912 int err = 0;
5913
5914 if (!selinux_enabled)
5915 goto out;
5916
5917 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5918
5919 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5920 if (err)
5921 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5922
5923 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5924 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5925 if (err)
5926 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5927 #endif /* IPV6 */
5928
5929 out:
5930 return err;
5931 }
5932
5933 __initcall(selinux_nf_ip_init);
5934
5935 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5936 static void selinux_nf_ip_exit(void)
5937 {
5938 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5939
5940 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5941 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5942 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5943 #endif /* IPV6 */
5944 }
5945 #endif
5946
5947 #else /* CONFIG_NETFILTER */
5948
5949 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5950 #define selinux_nf_ip_exit()
5951 #endif
5952
5953 #endif /* CONFIG_NETFILTER */
5954
5955 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5956 static int selinux_disabled;
5957
5958 int selinux_disable(void)
5959 {
5960 if (ss_initialized) {
5961 /* Not permitted after initial policy load. */
5962 return -EINVAL;
5963 }
5964
5965 if (selinux_disabled) {
5966 /* Only do this once. */
5967 return -EINVAL;
5968 }
5969
5970 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5971
5972 selinux_disabled = 1;
5973 selinux_enabled = 0;
5974
5975 reset_security_ops();
5976
5977 /* Try to destroy the avc node cache */
5978 avc_disable();
5979
5980 /* Unregister netfilter hooks. */
5981 selinux_nf_ip_exit();
5982
5983 /* Unregister selinuxfs. */
5984 exit_sel_fs();
5985
5986 return 0;
5987 }
5988 #endif
Linux kernel - Deliverables
This page took 0.160257 seconds and 5 git commands to generate.