projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
regmap: add helper macro to set min/max range of register
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/security.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 #define NUM_SEL_MNT_OPTS 5
99
100 extern struct security_operations *security_ops;
101
102 /* SECMARK reference count */
103 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
104
105 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
106 int selinux_enforcing;
107
108 static int __init enforcing_setup(char *str)
109 {
110 unsigned long enforcing;
111 if (!strict_strtoul(str, 0, &enforcing))
112 selinux_enforcing = enforcing ? 1 : 0;
113 return 1;
114 }
115 __setup("enforcing=", enforcing_setup);
116 #endif
117
118 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
119 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
120
121 static int __init selinux_enabled_setup(char *str)
122 {
123 unsigned long enabled;
124 if (!strict_strtoul(str, 0, &enabled))
125 selinux_enabled = enabled ? 1 : 0;
126 return 1;
127 }
128 __setup("selinux=", selinux_enabled_setup);
129 #else
130 int selinux_enabled = 1;
131 #endif
132
133 static struct kmem_cache *sel_inode_cache;
134
135 /**
136 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
137 *
138 * Description:
139 * This function checks the SECMARK reference counter to see if any SECMARK
140 * targets are currently configured, if the reference counter is greater than
141 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
142 * enabled, false (0) if SECMARK is disabled.
143 *
144 */
145 static int selinux_secmark_enabled(void)
146 {
147 return (atomic_read(&selinux_secmark_refcount) > 0);
148 }
149
150 /*
151 * initialise the security for the init task
152 */
153 static void cred_init_security(void)
154 {
155 struct cred *cred = (struct cred *) current->real_cred;
156 struct task_security_struct *tsec;
157
158 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
159 if (!tsec)
160 panic("SELinux: Failed to initialize initial task.\n");
161
162 tsec->osid = tsec->sid = SECINITSID_KERNEL;
163 cred->security = tsec;
164 }
165
166 /*
167 * get the security ID of a set of credentials
168 */
169 static inline u32 cred_sid(const struct cred *cred)
170 {
171 const struct task_security_struct *tsec;
172
173 tsec = cred->security;
174 return tsec->sid;
175 }
176
177 /*
178 * get the objective security ID of a task
179 */
180 static inline u32 task_sid(const struct task_struct *task)
181 {
182 u32 sid;
183
184 rcu_read_lock();
185 sid = cred_sid(__task_cred(task));
186 rcu_read_unlock();
187 return sid;
188 }
189
190 /*
191 * get the subjective security ID of the current task
192 */
193 static inline u32 current_sid(void)
194 {
195 const struct task_security_struct *tsec = current_security();
196
197 return tsec->sid;
198 }
199
200 /* Allocate and free functions for each kind of security blob. */
201
202 static int inode_alloc_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec;
205 u32 sid = current_sid();
206
207 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
208 if (!isec)
209 return -ENOMEM;
210
211 mutex_init(&isec->lock);
212 INIT_LIST_HEAD(&isec->list);
213 isec->inode = inode;
214 isec->sid = SECINITSID_UNLABELED;
215 isec->sclass = SECCLASS_FILE;
216 isec->task_sid = sid;
217 inode->i_security = isec;
218
219 return 0;
220 }
221
222 static void inode_free_security(struct inode *inode)
223 {
224 struct inode_security_struct *isec = inode->i_security;
225 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
226
227 spin_lock(&sbsec->isec_lock);
228 if (!list_empty(&isec->list))
229 list_del_init(&isec->list);
230 spin_unlock(&sbsec->isec_lock);
231
232 inode->i_security = NULL;
233 kmem_cache_free(sel_inode_cache, isec);
234 }
235
236 static int file_alloc_security(struct file *file)
237 {
238 struct file_security_struct *fsec;
239 u32 sid = current_sid();
240
241 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 if (!fsec)
243 return -ENOMEM;
244
245 fsec->sid = sid;
246 fsec->fown_sid = sid;
247 file->f_security = fsec;
248
249 return 0;
250 }
251
252 static void file_free_security(struct file *file)
253 {
254 struct file_security_struct *fsec = file->f_security;
255 file->f_security = NULL;
256 kfree(fsec);
257 }
258
259 static int superblock_alloc_security(struct super_block *sb)
260 {
261 struct superblock_security_struct *sbsec;
262
263 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
264 if (!sbsec)
265 return -ENOMEM;
266
267 mutex_init(&sbsec->lock);
268 INIT_LIST_HEAD(&sbsec->isec_head);
269 spin_lock_init(&sbsec->isec_lock);
270 sbsec->sb = sb;
271 sbsec->sid = SECINITSID_UNLABELED;
272 sbsec->def_sid = SECINITSID_FILE;
273 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
274 sb->s_security = sbsec;
275
276 return 0;
277 }
278
279 static void superblock_free_security(struct super_block *sb)
280 {
281 struct superblock_security_struct *sbsec = sb->s_security;
282 sb->s_security = NULL;
283 kfree(sbsec);
284 }
285
286 /* The file system's label must be initialized prior to use. */
287
288 static const char *labeling_behaviors[7] = {
289 "uses xattr",
290 "uses transition SIDs",
291 "uses task SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
295 "uses native labeling",
296 };
297
298 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
299
300 static inline int inode_doinit(struct inode *inode)
301 {
302 return inode_doinit_with_dentry(inode, NULL);
303 }
304
305 enum {
306 Opt_error = -1,
307 Opt_context = 1,
308 Opt_fscontext = 2,
309 Opt_defcontext = 3,
310 Opt_rootcontext = 4,
311 Opt_labelsupport = 5,
312 };
313
314 static const match_table_t tokens = {
315 {Opt_context, CONTEXT_STR "%s"},
316 {Opt_fscontext, FSCONTEXT_STR "%s"},
317 {Opt_defcontext, DEFCONTEXT_STR "%s"},
318 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
319 {Opt_labelsupport, LABELSUPP_STR},
320 {Opt_error, NULL},
321 };
322
323 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
324
325 static int may_context_mount_sb_relabel(u32 sid,
326 struct superblock_security_struct *sbsec,
327 const struct cred *cred)
328 {
329 const struct task_security_struct *tsec = cred->security;
330 int rc;
331
332 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
333 FILESYSTEM__RELABELFROM, NULL);
334 if (rc)
335 return rc;
336
337 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
338 FILESYSTEM__RELABELTO, NULL);
339 return rc;
340 }
341
342 static int may_context_mount_inode_relabel(u32 sid,
343 struct superblock_security_struct *sbsec,
344 const struct cred *cred)
345 {
346 const struct task_security_struct *tsec = cred->security;
347 int rc;
348 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
349 FILESYSTEM__RELABELFROM, NULL);
350 if (rc)
351 return rc;
352
353 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__ASSOCIATE, NULL);
355 return rc;
356 }
357
358 static int sb_finish_set_opts(struct super_block *sb)
359 {
360 struct superblock_security_struct *sbsec = sb->s_security;
361 struct dentry *root = sb->s_root;
362 struct inode *root_inode = root->d_inode;
363 int rc = 0;
364
365 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
366 /* Make sure that the xattr handler exists and that no
367 error other than -ENODATA is returned by getxattr on
368 the root directory. -ENODATA is ok, as this may be
369 the first boot of the SELinux kernel before we have
370 assigned xattr values to the filesystem. */
371 if (!root_inode->i_op->getxattr) {
372 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
373 "xattr support\n", sb->s_id, sb->s_type->name);
374 rc = -EOPNOTSUPP;
375 goto out;
376 }
377 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
378 if (rc < 0 && rc != -ENODATA) {
379 if (rc == -EOPNOTSUPP)
380 printk(KERN_WARNING "SELinux: (dev %s, type "
381 "%s) has no security xattr handler\n",
382 sb->s_id, sb->s_type->name);
383 else
384 printk(KERN_WARNING "SELinux: (dev %s, type "
385 "%s) getxattr errno %d\n", sb->s_id,
386 sb->s_type->name, -rc);
387 goto out;
388 }
389 }
390
391 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
392
393 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
394 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
395 sb->s_id, sb->s_type->name);
396 else
397 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
398 sb->s_id, sb->s_type->name,
399 labeling_behaviors[sbsec->behavior-1]);
400
401 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
402 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
403 sbsec->behavior == SECURITY_FS_USE_NONE ||
404 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
405 sbsec->flags &= ~SE_SBLABELSUPP;
406
407 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
408 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
409 sbsec->flags |= SE_SBLABELSUPP;
410
411 /* Initialize the root inode. */
412 rc = inode_doinit_with_dentry(root_inode, root);
413
414 /* Initialize any other inodes associated with the superblock, e.g.
415 inodes created prior to initial policy load or inodes created
416 during get_sb by a pseudo filesystem that directly
417 populates itself. */
418 spin_lock(&sbsec->isec_lock);
419 next_inode:
420 if (!list_empty(&sbsec->isec_head)) {
421 struct inode_security_struct *isec =
422 list_entry(sbsec->isec_head.next,
423 struct inode_security_struct, list);
424 struct inode *inode = isec->inode;
425 spin_unlock(&sbsec->isec_lock);
426 inode = igrab(inode);
427 if (inode) {
428 if (!IS_PRIVATE(inode))
429 inode_doinit(inode);
430 iput(inode);
431 }
432 spin_lock(&sbsec->isec_lock);
433 list_del_init(&isec->list);
434 goto next_inode;
435 }
436 spin_unlock(&sbsec->isec_lock);
437 out:
438 return rc;
439 }
440
441 /*
442 * This function should allow an FS to ask what it's mount security
443 * options were so it can use those later for submounts, displaying
444 * mount options, or whatever.
445 */
446 static int selinux_get_mnt_opts(const struct super_block *sb,
447 struct security_mnt_opts *opts)
448 {
449 int rc = 0, i;
450 struct superblock_security_struct *sbsec = sb->s_security;
451 char *context = NULL;
452 u32 len;
453 char tmp;
454
455 security_init_mnt_opts(opts);
456
457 if (!(sbsec->flags & SE_SBINITIALIZED))
458 return -EINVAL;
459
460 if (!ss_initialized)
461 return -EINVAL;
462
463 tmp = sbsec->flags & SE_MNTMASK;
464 /* count the number of mount options for this sb */
465 for (i = 0; i < 8; i++) {
466 if (tmp & 0x01)
467 opts->num_mnt_opts++;
468 tmp >>= 1;
469 }
470 /* Check if the Label support flag is set */
471 if (sbsec->flags & SE_SBLABELSUPP)
472 opts->num_mnt_opts++;
473
474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
476 rc = -ENOMEM;
477 goto out_free;
478 }
479
480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
482 rc = -ENOMEM;
483 goto out_free;
484 }
485
486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
511
512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 }
518 if (sbsec->flags & SE_SBLABELSUPP) {
519 opts->mnt_opts[i] = NULL;
520 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
521 }
522
523 BUG_ON(i != opts->num_mnt_opts);
524
525 return 0;
526
527 out_free:
528 security_free_mnt_opts(opts);
529 return rc;
530 }
531
532 static int bad_option(struct superblock_security_struct *sbsec, char flag,
533 u32 old_sid, u32 new_sid)
534 {
535 char mnt_flags = sbsec->flags & SE_MNTMASK;
536
537 /* check if the old mount command had the same options */
538 if (sbsec->flags & SE_SBINITIALIZED)
539 if (!(sbsec->flags & flag) ||
540 (old_sid != new_sid))
541 return 1;
542
543 /* check if we were passed the same options twice,
544 * aka someone passed context=a,context=b
545 */
546 if (!(sbsec->flags & SE_SBINITIALIZED))
547 if (mnt_flags & flag)
548 return 1;
549 return 0;
550 }
551
552 /*
553 * Allow filesystems with binary mount data to explicitly set mount point
554 * labeling information.
555 */
556 static int selinux_set_mnt_opts(struct super_block *sb,
557 struct security_mnt_opts *opts,
558 unsigned long kern_flags,
559 unsigned long *set_kern_flags)
560 {
561 const struct cred *cred = current_cred();
562 int rc = 0, i;
563 struct superblock_security_struct *sbsec = sb->s_security;
564 const char *name = sb->s_type->name;
565 struct inode *inode = sbsec->sb->s_root->d_inode;
566 struct inode_security_struct *root_isec = inode->i_security;
567 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
568 u32 defcontext_sid = 0;
569 char **mount_options = opts->mnt_opts;
570 int *flags = opts->mnt_opts_flags;
571 int num_opts = opts->num_mnt_opts;
572
573 mutex_lock(&sbsec->lock);
574
575 if (!ss_initialized) {
576 if (!num_opts) {
577 /* Defer initialization until selinux_complete_init,
578 after the initial policy is loaded and the security
579 server is ready to handle calls. */
580 goto out;
581 }
582 rc = -EINVAL;
583 printk(KERN_WARNING "SELinux: Unable to set superblock options "
584 "before the security server is initialized\n");
585 goto out;
586 }
587 if (kern_flags && !set_kern_flags) {
588 /* Specifying internal flags without providing a place to
589 * place the results is not allowed */
590 rc = -EINVAL;
591 goto out;
592 }
593
594 /*
595 * Binary mount data FS will come through this function twice. Once
596 * from an explicit call and once from the generic calls from the vfs.
597 * Since the generic VFS calls will not contain any security mount data
598 * we need to skip the double mount verification.
599 *
600 * This does open a hole in which we will not notice if the first
601 * mount using this sb set explict options and a second mount using
602 * this sb does not set any security options. (The first options
603 * will be used for both mounts)
604 */
605 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
606 && (num_opts == 0))
607 goto out;
608
609 /*
610 * parse the mount options, check if they are valid sids.
611 * also check if someone is trying to mount the same sb more
612 * than once with different security options.
613 */
614 for (i = 0; i < num_opts; i++) {
615 u32 sid;
616
617 if (flags[i] == SE_SBLABELSUPP)
618 continue;
619 rc = security_context_to_sid(mount_options[i],
620 strlen(mount_options[i]), &sid);
621 if (rc) {
622 printk(KERN_WARNING "SELinux: security_context_to_sid"
623 "(%s) failed for (dev %s, type %s) errno=%d\n",
624 mount_options[i], sb->s_id, name, rc);
625 goto out;
626 }
627 switch (flags[i]) {
628 case FSCONTEXT_MNT:
629 fscontext_sid = sid;
630
631 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
632 fscontext_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= FSCONTEXT_MNT;
636 break;
637 case CONTEXT_MNT:
638 context_sid = sid;
639
640 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
641 context_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= CONTEXT_MNT;
645 break;
646 case ROOTCONTEXT_MNT:
647 rootcontext_sid = sid;
648
649 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
650 rootcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= ROOTCONTEXT_MNT;
654
655 break;
656 case DEFCONTEXT_MNT:
657 defcontext_sid = sid;
658
659 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
660 defcontext_sid))
661 goto out_double_mount;
662
663 sbsec->flags |= DEFCONTEXT_MNT;
664
665 break;
666 default:
667 rc = -EINVAL;
668 goto out;
669 }
670 }
671
672 if (sbsec->flags & SE_SBINITIALIZED) {
673 /* previously mounted with options, but not on this attempt? */
674 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
675 goto out_double_mount;
676 rc = 0;
677 goto out;
678 }
679
680 if (strcmp(sb->s_type->name, "proc") == 0)
681 sbsec->flags |= SE_SBPROC;
682
683 if (!sbsec->behavior) {
684 /*
685 * Determine the labeling behavior to use for this
686 * filesystem type.
687 */
688 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
689 "proc" : sb->s_type->name,
690 &sbsec->behavior, &sbsec->sid);
691 if (rc) {
692 printk(KERN_WARNING
693 "%s: security_fs_use(%s) returned %d\n",
694 __func__, sb->s_type->name, rc);
695 goto out;
696 }
697 }
698 /* sets the context of the superblock for the fs being mounted. */
699 if (fscontext_sid) {
700 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
701 if (rc)
702 goto out;
703
704 sbsec->sid = fscontext_sid;
705 }
706
707 /*
708 * Switch to using mount point labeling behavior.
709 * sets the label used on all file below the mountpoint, and will set
710 * the superblock context if not already set.
711 */
712 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
713 sbsec->behavior = SECURITY_FS_USE_NATIVE;
714 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
715 }
716
717 if (context_sid) {
718 if (!fscontext_sid) {
719 rc = may_context_mount_sb_relabel(context_sid, sbsec,
720 cred);
721 if (rc)
722 goto out;
723 sbsec->sid = context_sid;
724 } else {
725 rc = may_context_mount_inode_relabel(context_sid, sbsec,
726 cred);
727 if (rc)
728 goto out;
729 }
730 if (!rootcontext_sid)
731 rootcontext_sid = context_sid;
732
733 sbsec->mntpoint_sid = context_sid;
734 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
735 }
736
737 if (rootcontext_sid) {
738 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
739 cred);
740 if (rc)
741 goto out;
742
743 root_isec->sid = rootcontext_sid;
744 root_isec->initialized = 1;
745 }
746
747 if (defcontext_sid) {
748 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
749 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
750 rc = -EINVAL;
751 printk(KERN_WARNING "SELinux: defcontext option is "
752 "invalid for this filesystem type\n");
753 goto out;
754 }
755
756 if (defcontext_sid != sbsec->def_sid) {
757 rc = may_context_mount_inode_relabel(defcontext_sid,
758 sbsec, cred);
759 if (rc)
760 goto out;
761 }
762
763 sbsec->def_sid = defcontext_sid;
764 }
765
766 rc = sb_finish_set_opts(sb);
767 out:
768 mutex_unlock(&sbsec->lock);
769 return rc;
770 out_double_mount:
771 rc = -EINVAL;
772 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
773 "security settings for (dev %s, type %s)\n", sb->s_id, name);
774 goto out;
775 }
776
777 static int selinux_cmp_sb_context(const struct super_block *oldsb,
778 const struct super_block *newsb)
779 {
780 struct superblock_security_struct *old = oldsb->s_security;
781 struct superblock_security_struct *new = newsb->s_security;
782 char oldflags = old->flags & SE_MNTMASK;
783 char newflags = new->flags & SE_MNTMASK;
784
785 if (oldflags != newflags)
786 goto mismatch;
787 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
788 goto mismatch;
789 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
790 goto mismatch;
791 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
792 goto mismatch;
793 if (oldflags & ROOTCONTEXT_MNT) {
794 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
795 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
796 if (oldroot->sid != newroot->sid)
797 goto mismatch;
798 }
799 return 0;
800 mismatch:
801 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
802 "different security settings for (dev %s, "
803 "type %s)\n", newsb->s_id, newsb->s_type->name);
804 return -EBUSY;
805 }
806
807 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
808 struct super_block *newsb)
809 {
810 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
811 struct superblock_security_struct *newsbsec = newsb->s_security;
812
813 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
814 int set_context = (oldsbsec->flags & CONTEXT_MNT);
815 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
816
817 /*
818 * if the parent was able to be mounted it clearly had no special lsm
819 * mount options. thus we can safely deal with this superblock later
820 */
821 if (!ss_initialized)
822 return 0;
823
824 /* how can we clone if the old one wasn't set up?? */
825 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
826
827 /* if fs is reusing a sb, make sure that the contexts match */
828 if (newsbsec->flags & SE_SBINITIALIZED)
829 return selinux_cmp_sb_context(oldsb, newsb);
830
831 mutex_lock(&newsbsec->lock);
832
833 newsbsec->flags = oldsbsec->flags;
834
835 newsbsec->sid = oldsbsec->sid;
836 newsbsec->def_sid = oldsbsec->def_sid;
837 newsbsec->behavior = oldsbsec->behavior;
838
839 if (set_context) {
840 u32 sid = oldsbsec->mntpoint_sid;
841
842 if (!set_fscontext)
843 newsbsec->sid = sid;
844 if (!set_rootcontext) {
845 struct inode *newinode = newsb->s_root->d_inode;
846 struct inode_security_struct *newisec = newinode->i_security;
847 newisec->sid = sid;
848 }
849 newsbsec->mntpoint_sid = sid;
850 }
851 if (set_rootcontext) {
852 const struct inode *oldinode = oldsb->s_root->d_inode;
853 const struct inode_security_struct *oldisec = oldinode->i_security;
854 struct inode *newinode = newsb->s_root->d_inode;
855 struct inode_security_struct *newisec = newinode->i_security;
856
857 newisec->sid = oldisec->sid;
858 }
859
860 sb_finish_set_opts(newsb);
861 mutex_unlock(&newsbsec->lock);
862 return 0;
863 }
864
865 static int selinux_parse_opts_str(char *options,
866 struct security_mnt_opts *opts)
867 {
868 char *p;
869 char *context = NULL, *defcontext = NULL;
870 char *fscontext = NULL, *rootcontext = NULL;
871 int rc, num_mnt_opts = 0;
872
873 opts->num_mnt_opts = 0;
874
875 /* Standard string-based options. */
876 while ((p = strsep(&options, "|")) != NULL) {
877 int token;
878 substring_t args[MAX_OPT_ARGS];
879
880 if (!*p)
881 continue;
882
883 token = match_token(p, tokens, args);
884
885 switch (token) {
886 case Opt_context:
887 if (context || defcontext) {
888 rc = -EINVAL;
889 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
890 goto out_err;
891 }
892 context = match_strdup(&args[0]);
893 if (!context) {
894 rc = -ENOMEM;
895 goto out_err;
896 }
897 break;
898
899 case Opt_fscontext:
900 if (fscontext) {
901 rc = -EINVAL;
902 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
903 goto out_err;
904 }
905 fscontext = match_strdup(&args[0]);
906 if (!fscontext) {
907 rc = -ENOMEM;
908 goto out_err;
909 }
910 break;
911
912 case Opt_rootcontext:
913 if (rootcontext) {
914 rc = -EINVAL;
915 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
916 goto out_err;
917 }
918 rootcontext = match_strdup(&args[0]);
919 if (!rootcontext) {
920 rc = -ENOMEM;
921 goto out_err;
922 }
923 break;
924
925 case Opt_defcontext:
926 if (context || defcontext) {
927 rc = -EINVAL;
928 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
929 goto out_err;
930 }
931 defcontext = match_strdup(&args[0]);
932 if (!defcontext) {
933 rc = -ENOMEM;
934 goto out_err;
935 }
936 break;
937 case Opt_labelsupport:
938 break;
939 default:
940 rc = -EINVAL;
941 printk(KERN_WARNING "SELinux: unknown mount option\n");
942 goto out_err;
943
944 }
945 }
946
947 rc = -ENOMEM;
948 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
949 if (!opts->mnt_opts)
950 goto out_err;
951
952 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
953 if (!opts->mnt_opts_flags) {
954 kfree(opts->mnt_opts);
955 goto out_err;
956 }
957
958 if (fscontext) {
959 opts->mnt_opts[num_mnt_opts] = fscontext;
960 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
961 }
962 if (context) {
963 opts->mnt_opts[num_mnt_opts] = context;
964 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
965 }
966 if (rootcontext) {
967 opts->mnt_opts[num_mnt_opts] = rootcontext;
968 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
969 }
970 if (defcontext) {
971 opts->mnt_opts[num_mnt_opts] = defcontext;
972 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
973 }
974
975 opts->num_mnt_opts = num_mnt_opts;
976 return 0;
977
978 out_err:
979 kfree(context);
980 kfree(defcontext);
981 kfree(fscontext);
982 kfree(rootcontext);
983 return rc;
984 }
985 /*
986 * string mount options parsing and call set the sbsec
987 */
988 static int superblock_doinit(struct super_block *sb, void *data)
989 {
990 int rc = 0;
991 char *options = data;
992 struct security_mnt_opts opts;
993
994 security_init_mnt_opts(&opts);
995
996 if (!data)
997 goto out;
998
999 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1000
1001 rc = selinux_parse_opts_str(options, &opts);
1002 if (rc)
1003 goto out_err;
1004
1005 out:
1006 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1007
1008 out_err:
1009 security_free_mnt_opts(&opts);
1010 return rc;
1011 }
1012
1013 static void selinux_write_opts(struct seq_file *m,
1014 struct security_mnt_opts *opts)
1015 {
1016 int i;
1017 char *prefix;
1018
1019 for (i = 0; i < opts->num_mnt_opts; i++) {
1020 char *has_comma;
1021
1022 if (opts->mnt_opts[i])
1023 has_comma = strchr(opts->mnt_opts[i], ',');
1024 else
1025 has_comma = NULL;
1026
1027 switch (opts->mnt_opts_flags[i]) {
1028 case CONTEXT_MNT:
1029 prefix = CONTEXT_STR;
1030 break;
1031 case FSCONTEXT_MNT:
1032 prefix = FSCONTEXT_STR;
1033 break;
1034 case ROOTCONTEXT_MNT:
1035 prefix = ROOTCONTEXT_STR;
1036 break;
1037 case DEFCONTEXT_MNT:
1038 prefix = DEFCONTEXT_STR;
1039 break;
1040 case SE_SBLABELSUPP:
1041 seq_putc(m, ',');
1042 seq_puts(m, LABELSUPP_STR);
1043 continue;
1044 default:
1045 BUG();
1046 return;
1047 };
1048 /* we need a comma before each option */
1049 seq_putc(m, ',');
1050 seq_puts(m, prefix);
1051 if (has_comma)
1052 seq_putc(m, '\"');
1053 seq_puts(m, opts->mnt_opts[i]);
1054 if (has_comma)
1055 seq_putc(m, '\"');
1056 }
1057 }
1058
1059 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060 {
1061 struct security_mnt_opts opts;
1062 int rc;
1063
1064 rc = selinux_get_mnt_opts(sb, &opts);
1065 if (rc) {
1066 /* before policy load we may get EINVAL, don't show anything */
1067 if (rc == -EINVAL)
1068 rc = 0;
1069 return rc;
1070 }
1071
1072 selinux_write_opts(m, &opts);
1073
1074 security_free_mnt_opts(&opts);
1075
1076 return rc;
1077 }
1078
1079 static inline u16 inode_mode_to_security_class(umode_t mode)
1080 {
1081 switch (mode & S_IFMT) {
1082 case S_IFSOCK:
1083 return SECCLASS_SOCK_FILE;
1084 case S_IFLNK:
1085 return SECCLASS_LNK_FILE;
1086 case S_IFREG:
1087 return SECCLASS_FILE;
1088 case S_IFBLK:
1089 return SECCLASS_BLK_FILE;
1090 case S_IFDIR:
1091 return SECCLASS_DIR;
1092 case S_IFCHR:
1093 return SECCLASS_CHR_FILE;
1094 case S_IFIFO:
1095 return SECCLASS_FIFO_FILE;
1096
1097 }
1098
1099 return SECCLASS_FILE;
1100 }
1101
1102 static inline int default_protocol_stream(int protocol)
1103 {
1104 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105 }
1106
1107 static inline int default_protocol_dgram(int protocol)
1108 {
1109 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110 }
1111
1112 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113 {
1114 switch (family) {
1115 case PF_UNIX:
1116 switch (type) {
1117 case SOCK_STREAM:
1118 case SOCK_SEQPACKET:
1119 return SECCLASS_UNIX_STREAM_SOCKET;
1120 case SOCK_DGRAM:
1121 return SECCLASS_UNIX_DGRAM_SOCKET;
1122 }
1123 break;
1124 case PF_INET:
1125 case PF_INET6:
1126 switch (type) {
1127 case SOCK_STREAM:
1128 if (default_protocol_stream(protocol))
1129 return SECCLASS_TCP_SOCKET;
1130 else
1131 return SECCLASS_RAWIP_SOCKET;
1132 case SOCK_DGRAM:
1133 if (default_protocol_dgram(protocol))
1134 return SECCLASS_UDP_SOCKET;
1135 else
1136 return SECCLASS_RAWIP_SOCKET;
1137 case SOCK_DCCP:
1138 return SECCLASS_DCCP_SOCKET;
1139 default:
1140 return SECCLASS_RAWIP_SOCKET;
1141 }
1142 break;
1143 case PF_NETLINK:
1144 switch (protocol) {
1145 case NETLINK_ROUTE:
1146 return SECCLASS_NETLINK_ROUTE_SOCKET;
1147 case NETLINK_FIREWALL:
1148 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1149 case NETLINK_SOCK_DIAG:
1150 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151 case NETLINK_NFLOG:
1152 return SECCLASS_NETLINK_NFLOG_SOCKET;
1153 case NETLINK_XFRM:
1154 return SECCLASS_NETLINK_XFRM_SOCKET;
1155 case NETLINK_SELINUX:
1156 return SECCLASS_NETLINK_SELINUX_SOCKET;
1157 case NETLINK_AUDIT:
1158 return SECCLASS_NETLINK_AUDIT_SOCKET;
1159 case NETLINK_IP6_FW:
1160 return SECCLASS_NETLINK_IP6FW_SOCKET;
1161 case NETLINK_DNRTMSG:
1162 return SECCLASS_NETLINK_DNRT_SOCKET;
1163 case NETLINK_KOBJECT_UEVENT:
1164 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1165 default:
1166 return SECCLASS_NETLINK_SOCKET;
1167 }
1168 case PF_PACKET:
1169 return SECCLASS_PACKET_SOCKET;
1170 case PF_KEY:
1171 return SECCLASS_KEY_SOCKET;
1172 case PF_APPLETALK:
1173 return SECCLASS_APPLETALK_SOCKET;
1174 }
1175
1176 return SECCLASS_SOCKET;
1177 }
1178
1179 #ifdef CONFIG_PROC_FS
1180 static int selinux_proc_get_sid(struct dentry *dentry,
1181 u16 tclass,
1182 u32 *sid)
1183 {
1184 int rc;
1185 char *buffer, *path;
1186
1187 buffer = (char *)__get_free_page(GFP_KERNEL);
1188 if (!buffer)
1189 return -ENOMEM;
1190
1191 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1192 if (IS_ERR(path))
1193 rc = PTR_ERR(path);
1194 else {
1195 /* each process gets a /proc/PID/ entry. Strip off the
1196 * PID part to get a valid selinux labeling.
1197 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1198 while (path[1] >= '0' && path[1] <= '9') {
1199 path[1] = '/';
1200 path++;
1201 }
1202 rc = security_genfs_sid("proc", path, tclass, sid);
1203 }
1204 free_page((unsigned long)buffer);
1205 return rc;
1206 }
1207 #else
1208 static int selinux_proc_get_sid(struct dentry *dentry,
1209 u16 tclass,
1210 u32 *sid)
1211 {
1212 return -EINVAL;
1213 }
1214 #endif
1215
1216 /* The inode's security attributes must be initialized before first use. */
1217 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1218 {
1219 struct superblock_security_struct *sbsec = NULL;
1220 struct inode_security_struct *isec = inode->i_security;
1221 u32 sid;
1222 struct dentry *dentry;
1223 #define INITCONTEXTLEN 255
1224 char *context = NULL;
1225 unsigned len = 0;
1226 int rc = 0;
1227
1228 if (isec->initialized)
1229 goto out;
1230
1231 mutex_lock(&isec->lock);
1232 if (isec->initialized)
1233 goto out_unlock;
1234
1235 sbsec = inode->i_sb->s_security;
1236 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1237 /* Defer initialization until selinux_complete_init,
1238 after the initial policy is loaded and the security
1239 server is ready to handle calls. */
1240 spin_lock(&sbsec->isec_lock);
1241 if (list_empty(&isec->list))
1242 list_add(&isec->list, &sbsec->isec_head);
1243 spin_unlock(&sbsec->isec_lock);
1244 goto out_unlock;
1245 }
1246
1247 switch (sbsec->behavior) {
1248 case SECURITY_FS_USE_NATIVE:
1249 break;
1250 case SECURITY_FS_USE_XATTR:
1251 if (!inode->i_op->getxattr) {
1252 isec->sid = sbsec->def_sid;
1253 break;
1254 }
1255
1256 /* Need a dentry, since the xattr API requires one.
1257 Life would be simpler if we could just pass the inode. */
1258 if (opt_dentry) {
1259 /* Called from d_instantiate or d_splice_alias. */
1260 dentry = dget(opt_dentry);
1261 } else {
1262 /* Called from selinux_complete_init, try to find a dentry. */
1263 dentry = d_find_alias(inode);
1264 }
1265 if (!dentry) {
1266 /*
1267 * this is can be hit on boot when a file is accessed
1268 * before the policy is loaded. When we load policy we
1269 * may find inodes that have no dentry on the
1270 * sbsec->isec_head list. No reason to complain as these
1271 * will get fixed up the next time we go through
1272 * inode_doinit with a dentry, before these inodes could
1273 * be used again by userspace.
1274 */
1275 goto out_unlock;
1276 }
1277
1278 len = INITCONTEXTLEN;
1279 context = kmalloc(len+1, GFP_NOFS);
1280 if (!context) {
1281 rc = -ENOMEM;
1282 dput(dentry);
1283 goto out_unlock;
1284 }
1285 context[len] = '\0';
1286 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1287 context, len);
1288 if (rc == -ERANGE) {
1289 kfree(context);
1290
1291 /* Need a larger buffer. Query for the right size. */
1292 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1293 NULL, 0);
1294 if (rc < 0) {
1295 dput(dentry);
1296 goto out_unlock;
1297 }
1298 len = rc;
1299 context = kmalloc(len+1, GFP_NOFS);
1300 if (!context) {
1301 rc = -ENOMEM;
1302 dput(dentry);
1303 goto out_unlock;
1304 }
1305 context[len] = '\0';
1306 rc = inode->i_op->getxattr(dentry,
1307 XATTR_NAME_SELINUX,
1308 context, len);
1309 }
1310 dput(dentry);
1311 if (rc < 0) {
1312 if (rc != -ENODATA) {
1313 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1314 "%d for dev=%s ino=%ld\n", __func__,
1315 -rc, inode->i_sb->s_id, inode->i_ino);
1316 kfree(context);
1317 goto out_unlock;
1318 }
1319 /* Map ENODATA to the default file SID */
1320 sid = sbsec->def_sid;
1321 rc = 0;
1322 } else {
1323 rc = security_context_to_sid_default(context, rc, &sid,
1324 sbsec->def_sid,
1325 GFP_NOFS);
1326 if (rc) {
1327 char *dev = inode->i_sb->s_id;
1328 unsigned long ino = inode->i_ino;
1329
1330 if (rc == -EINVAL) {
1331 if (printk_ratelimit())
1332 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1333 "context=%s. This indicates you may need to relabel the inode or the "
1334 "filesystem in question.\n", ino, dev, context);
1335 } else {
1336 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1337 "returned %d for dev=%s ino=%ld\n",
1338 __func__, context, -rc, dev, ino);
1339 }
1340 kfree(context);
1341 /* Leave with the unlabeled SID */
1342 rc = 0;
1343 break;
1344 }
1345 }
1346 kfree(context);
1347 isec->sid = sid;
1348 break;
1349 case SECURITY_FS_USE_TASK:
1350 isec->sid = isec->task_sid;
1351 break;
1352 case SECURITY_FS_USE_TRANS:
1353 /* Default to the fs SID. */
1354 isec->sid = sbsec->sid;
1355
1356 /* Try to obtain a transition SID. */
1357 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1358 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1359 isec->sclass, NULL, &sid);
1360 if (rc)
1361 goto out_unlock;
1362 isec->sid = sid;
1363 break;
1364 case SECURITY_FS_USE_MNTPOINT:
1365 isec->sid = sbsec->mntpoint_sid;
1366 break;
1367 default:
1368 /* Default to the fs superblock SID. */
1369 isec->sid = sbsec->sid;
1370
1371 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1372 if (opt_dentry) {
1373 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1374 rc = selinux_proc_get_sid(opt_dentry,
1375 isec->sclass,
1376 &sid);
1377 if (rc)
1378 goto out_unlock;
1379 isec->sid = sid;
1380 }
1381 }
1382 break;
1383 }
1384
1385 isec->initialized = 1;
1386
1387 out_unlock:
1388 mutex_unlock(&isec->lock);
1389 out:
1390 if (isec->sclass == SECCLASS_FILE)
1391 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1392 return rc;
1393 }
1394
1395 /* Convert a Linux signal to an access vector. */
1396 static inline u32 signal_to_av(int sig)
1397 {
1398 u32 perm = 0;
1399
1400 switch (sig) {
1401 case SIGCHLD:
1402 /* Commonly granted from child to parent. */
1403 perm = PROCESS__SIGCHLD;
1404 break;
1405 case SIGKILL:
1406 /* Cannot be caught or ignored */
1407 perm = PROCESS__SIGKILL;
1408 break;
1409 case SIGSTOP:
1410 /* Cannot be caught or ignored */
1411 perm = PROCESS__SIGSTOP;
1412 break;
1413 default:
1414 /* All other signals. */
1415 perm = PROCESS__SIGNAL;
1416 break;
1417 }
1418
1419 return perm;
1420 }
1421
1422 /*
1423 * Check permission between a pair of credentials
1424 * fork check, ptrace check, etc.
1425 */
1426 static int cred_has_perm(const struct cred *actor,
1427 const struct cred *target,
1428 u32 perms)
1429 {
1430 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1431
1432 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1433 }
1434
1435 /*
1436 * Check permission between a pair of tasks, e.g. signal checks,
1437 * fork check, ptrace check, etc.
1438 * tsk1 is the actor and tsk2 is the target
1439 * - this uses the default subjective creds of tsk1
1440 */
1441 static int task_has_perm(const struct task_struct *tsk1,
1442 const struct task_struct *tsk2,
1443 u32 perms)
1444 {
1445 const struct task_security_struct *__tsec1, *__tsec2;
1446 u32 sid1, sid2;
1447
1448 rcu_read_lock();
1449 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1450 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1451 rcu_read_unlock();
1452 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1453 }
1454
1455 /*
1456 * Check permission between current and another task, e.g. signal checks,
1457 * fork check, ptrace check, etc.
1458 * current is the actor and tsk2 is the target
1459 * - this uses current's subjective creds
1460 */
1461 static int current_has_perm(const struct task_struct *tsk,
1462 u32 perms)
1463 {
1464 u32 sid, tsid;
1465
1466 sid = current_sid();
1467 tsid = task_sid(tsk);
1468 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1469 }
1470
1471 #if CAP_LAST_CAP > 63
1472 #error Fix SELinux to handle capabilities > 63.
1473 #endif
1474
1475 /* Check whether a task is allowed to use a capability. */
1476 static int cred_has_capability(const struct cred *cred,
1477 int cap, int audit)
1478 {
1479 struct common_audit_data ad;
1480 struct av_decision avd;
1481 u16 sclass;
1482 u32 sid = cred_sid(cred);
1483 u32 av = CAP_TO_MASK(cap);
1484 int rc;
1485
1486 ad.type = LSM_AUDIT_DATA_CAP;
1487 ad.u.cap = cap;
1488
1489 switch (CAP_TO_INDEX(cap)) {
1490 case 0:
1491 sclass = SECCLASS_CAPABILITY;
1492 break;
1493 case 1:
1494 sclass = SECCLASS_CAPABILITY2;
1495 break;
1496 default:
1497 printk(KERN_ERR
1498 "SELinux: out of range capability %d\n", cap);
1499 BUG();
1500 return -EINVAL;
1501 }
1502
1503 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1504 if (audit == SECURITY_CAP_AUDIT) {
1505 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1506 if (rc2)
1507 return rc2;
1508 }
1509 return rc;
1510 }
1511
1512 /* Check whether a task is allowed to use a system operation. */
1513 static int task_has_system(struct task_struct *tsk,
1514 u32 perms)
1515 {
1516 u32 sid = task_sid(tsk);
1517
1518 return avc_has_perm(sid, SECINITSID_KERNEL,
1519 SECCLASS_SYSTEM, perms, NULL);
1520 }
1521
1522 /* Check whether a task has a particular permission to an inode.
1523 The 'adp' parameter is optional and allows other audit
1524 data to be passed (e.g. the dentry). */
1525 static int inode_has_perm(const struct cred *cred,
1526 struct inode *inode,
1527 u32 perms,
1528 struct common_audit_data *adp,
1529 unsigned flags)
1530 {
1531 struct inode_security_struct *isec;
1532 u32 sid;
1533
1534 validate_creds(cred);
1535
1536 if (unlikely(IS_PRIVATE(inode)))
1537 return 0;
1538
1539 sid = cred_sid(cred);
1540 isec = inode->i_security;
1541
1542 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1543 }
1544
1545 /* Same as inode_has_perm, but pass explicit audit data containing
1546 the dentry to help the auditing code to more easily generate the
1547 pathname if needed. */
1548 static inline int dentry_has_perm(const struct cred *cred,
1549 struct dentry *dentry,
1550 u32 av)
1551 {
1552 struct inode *inode = dentry->d_inode;
1553 struct common_audit_data ad;
1554
1555 ad.type = LSM_AUDIT_DATA_DENTRY;
1556 ad.u.dentry = dentry;
1557 return inode_has_perm(cred, inode, av, &ad, 0);
1558 }
1559
1560 /* Same as inode_has_perm, but pass explicit audit data containing
1561 the path to help the auditing code to more easily generate the
1562 pathname if needed. */
1563 static inline int path_has_perm(const struct cred *cred,
1564 struct path *path,
1565 u32 av)
1566 {
1567 struct inode *inode = path->dentry->d_inode;
1568 struct common_audit_data ad;
1569
1570 ad.type = LSM_AUDIT_DATA_PATH;
1571 ad.u.path = *path;
1572 return inode_has_perm(cred, inode, av, &ad, 0);
1573 }
1574
1575 /* Same as path_has_perm, but uses the inode from the file struct. */
1576 static inline int file_path_has_perm(const struct cred *cred,
1577 struct file *file,
1578 u32 av)
1579 {
1580 struct common_audit_data ad;
1581
1582 ad.type = LSM_AUDIT_DATA_PATH;
1583 ad.u.path = file->f_path;
1584 return inode_has_perm(cred, file_inode(file), av, &ad, 0);
1585 }
1586
1587 /* Check whether a task can use an open file descriptor to
1588 access an inode in a given way. Check access to the
1589 descriptor itself, and then use dentry_has_perm to
1590 check a particular permission to the file.
1591 Access to the descriptor is implicitly granted if it
1592 has the same SID as the process. If av is zero, then
1593 access to the file is not checked, e.g. for cases
1594 where only the descriptor is affected like seek. */
1595 static int file_has_perm(const struct cred *cred,
1596 struct file *file,
1597 u32 av)
1598 {
1599 struct file_security_struct *fsec = file->f_security;
1600 struct inode *inode = file_inode(file);
1601 struct common_audit_data ad;
1602 u32 sid = cred_sid(cred);
1603 int rc;
1604
1605 ad.type = LSM_AUDIT_DATA_PATH;
1606 ad.u.path = file->f_path;
1607
1608 if (sid != fsec->sid) {
1609 rc = avc_has_perm(sid, fsec->sid,
1610 SECCLASS_FD,
1611 FD__USE,
1612 &ad);
1613 if (rc)
1614 goto out;
1615 }
1616
1617 /* av is zero if only checking access to the descriptor. */
1618 rc = 0;
1619 if (av)
1620 rc = inode_has_perm(cred, inode, av, &ad, 0);
1621
1622 out:
1623 return rc;
1624 }
1625
1626 /* Check whether a task can create a file. */
1627 static int may_create(struct inode *dir,
1628 struct dentry *dentry,
1629 u16 tclass)
1630 {
1631 const struct task_security_struct *tsec = current_security();
1632 struct inode_security_struct *dsec;
1633 struct superblock_security_struct *sbsec;
1634 u32 sid, newsid;
1635 struct common_audit_data ad;
1636 int rc;
1637
1638 dsec = dir->i_security;
1639 sbsec = dir->i_sb->s_security;
1640
1641 sid = tsec->sid;
1642 newsid = tsec->create_sid;
1643
1644 ad.type = LSM_AUDIT_DATA_DENTRY;
1645 ad.u.dentry = dentry;
1646
1647 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1648 DIR__ADD_NAME | DIR__SEARCH,
1649 &ad);
1650 if (rc)
1651 return rc;
1652
1653 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1654 rc = security_transition_sid(sid, dsec->sid, tclass,
1655 &dentry->d_name, &newsid);
1656 if (rc)
1657 return rc;
1658 }
1659
1660 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1661 if (rc)
1662 return rc;
1663
1664 return avc_has_perm(newsid, sbsec->sid,
1665 SECCLASS_FILESYSTEM,
1666 FILESYSTEM__ASSOCIATE, &ad);
1667 }
1668
1669 /* Check whether a task can create a key. */
1670 static int may_create_key(u32 ksid,
1671 struct task_struct *ctx)
1672 {
1673 u32 sid = task_sid(ctx);
1674
1675 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1676 }
1677
1678 #define MAY_LINK 0
1679 #define MAY_UNLINK 1
1680 #define MAY_RMDIR 2
1681
1682 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1683 static int may_link(struct inode *dir,
1684 struct dentry *dentry,
1685 int kind)
1686
1687 {
1688 struct inode_security_struct *dsec, *isec;
1689 struct common_audit_data ad;
1690 u32 sid = current_sid();
1691 u32 av;
1692 int rc;
1693
1694 dsec = dir->i_security;
1695 isec = dentry->d_inode->i_security;
1696
1697 ad.type = LSM_AUDIT_DATA_DENTRY;
1698 ad.u.dentry = dentry;
1699
1700 av = DIR__SEARCH;
1701 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1702 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1703 if (rc)
1704 return rc;
1705
1706 switch (kind) {
1707 case MAY_LINK:
1708 av = FILE__LINK;
1709 break;
1710 case MAY_UNLINK:
1711 av = FILE__UNLINK;
1712 break;
1713 case MAY_RMDIR:
1714 av = DIR__RMDIR;
1715 break;
1716 default:
1717 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1718 __func__, kind);
1719 return 0;
1720 }
1721
1722 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1723 return rc;
1724 }
1725
1726 static inline int may_rename(struct inode *old_dir,
1727 struct dentry *old_dentry,
1728 struct inode *new_dir,
1729 struct dentry *new_dentry)
1730 {
1731 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1732 struct common_audit_data ad;
1733 u32 sid = current_sid();
1734 u32 av;
1735 int old_is_dir, new_is_dir;
1736 int rc;
1737
1738 old_dsec = old_dir->i_security;
1739 old_isec = old_dentry->d_inode->i_security;
1740 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1741 new_dsec = new_dir->i_security;
1742
1743 ad.type = LSM_AUDIT_DATA_DENTRY;
1744
1745 ad.u.dentry = old_dentry;
1746 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1747 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1748 if (rc)
1749 return rc;
1750 rc = avc_has_perm(sid, old_isec->sid,
1751 old_isec->sclass, FILE__RENAME, &ad);
1752 if (rc)
1753 return rc;
1754 if (old_is_dir && new_dir != old_dir) {
1755 rc = avc_has_perm(sid, old_isec->sid,
1756 old_isec->sclass, DIR__REPARENT, &ad);
1757 if (rc)
1758 return rc;
1759 }
1760
1761 ad.u.dentry = new_dentry;
1762 av = DIR__ADD_NAME | DIR__SEARCH;
1763 if (new_dentry->d_inode)
1764 av |= DIR__REMOVE_NAME;
1765 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1766 if (rc)
1767 return rc;
1768 if (new_dentry->d_inode) {
1769 new_isec = new_dentry->d_inode->i_security;
1770 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1771 rc = avc_has_perm(sid, new_isec->sid,
1772 new_isec->sclass,
1773 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1774 if (rc)
1775 return rc;
1776 }
1777
1778 return 0;
1779 }
1780
1781 /* Check whether a task can perform a filesystem operation. */
1782 static int superblock_has_perm(const struct cred *cred,
1783 struct super_block *sb,
1784 u32 perms,
1785 struct common_audit_data *ad)
1786 {
1787 struct superblock_security_struct *sbsec;
1788 u32 sid = cred_sid(cred);
1789
1790 sbsec = sb->s_security;
1791 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1792 }
1793
1794 /* Convert a Linux mode and permission mask to an access vector. */
1795 static inline u32 file_mask_to_av(int mode, int mask)
1796 {
1797 u32 av = 0;
1798
1799 if (!S_ISDIR(mode)) {
1800 if (mask & MAY_EXEC)
1801 av |= FILE__EXECUTE;
1802 if (mask & MAY_READ)
1803 av |= FILE__READ;
1804
1805 if (mask & MAY_APPEND)
1806 av |= FILE__APPEND;
1807 else if (mask & MAY_WRITE)
1808 av |= FILE__WRITE;
1809
1810 } else {
1811 if (mask & MAY_EXEC)
1812 av |= DIR__SEARCH;
1813 if (mask & MAY_WRITE)
1814 av |= DIR__WRITE;
1815 if (mask & MAY_READ)
1816 av |= DIR__READ;
1817 }
1818
1819 return av;
1820 }
1821
1822 /* Convert a Linux file to an access vector. */
1823 static inline u32 file_to_av(struct file *file)
1824 {
1825 u32 av = 0;
1826
1827 if (file->f_mode & FMODE_READ)
1828 av |= FILE__READ;
1829 if (file->f_mode & FMODE_WRITE) {
1830 if (file->f_flags & O_APPEND)
1831 av |= FILE__APPEND;
1832 else
1833 av |= FILE__WRITE;
1834 }
1835 if (!av) {
1836 /*
1837 * Special file opened with flags 3 for ioctl-only use.
1838 */
1839 av = FILE__IOCTL;
1840 }
1841
1842 return av;
1843 }
1844
1845 /*
1846 * Convert a file to an access vector and include the correct open
1847 * open permission.
1848 */
1849 static inline u32 open_file_to_av(struct file *file)
1850 {
1851 u32 av = file_to_av(file);
1852
1853 if (selinux_policycap_openperm)
1854 av |= FILE__OPEN;
1855
1856 return av;
1857 }
1858
1859 /* Hook functions begin here. */
1860
1861 static int selinux_ptrace_access_check(struct task_struct *child,
1862 unsigned int mode)
1863 {
1864 int rc;
1865
1866 rc = cap_ptrace_access_check(child, mode);
1867 if (rc)
1868 return rc;
1869
1870 if (mode & PTRACE_MODE_READ) {
1871 u32 sid = current_sid();
1872 u32 csid = task_sid(child);
1873 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1874 }
1875
1876 return current_has_perm(child, PROCESS__PTRACE);
1877 }
1878
1879 static int selinux_ptrace_traceme(struct task_struct *parent)
1880 {
1881 int rc;
1882
1883 rc = cap_ptrace_traceme(parent);
1884 if (rc)
1885 return rc;
1886
1887 return task_has_perm(parent, current, PROCESS__PTRACE);
1888 }
1889
1890 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1891 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1892 {
1893 int error;
1894
1895 error = current_has_perm(target, PROCESS__GETCAP);
1896 if (error)
1897 return error;
1898
1899 return cap_capget(target, effective, inheritable, permitted);
1900 }
1901
1902 static int selinux_capset(struct cred *new, const struct cred *old,
1903 const kernel_cap_t *effective,
1904 const kernel_cap_t *inheritable,
1905 const kernel_cap_t *permitted)
1906 {
1907 int error;
1908
1909 error = cap_capset(new, old,
1910 effective, inheritable, permitted);
1911 if (error)
1912 return error;
1913
1914 return cred_has_perm(old, new, PROCESS__SETCAP);
1915 }
1916
1917 /*
1918 * (This comment used to live with the selinux_task_setuid hook,
1919 * which was removed).
1920 *
1921 * Since setuid only affects the current process, and since the SELinux
1922 * controls are not based on the Linux identity attributes, SELinux does not
1923 * need to control this operation. However, SELinux does control the use of
1924 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1925 */
1926
1927 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1928 int cap, int audit)
1929 {
1930 int rc;
1931
1932 rc = cap_capable(cred, ns, cap, audit);
1933 if (rc)
1934 return rc;
1935
1936 return cred_has_capability(cred, cap, audit);
1937 }
1938
1939 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1940 {
1941 const struct cred *cred = current_cred();
1942 int rc = 0;
1943
1944 if (!sb)
1945 return 0;
1946
1947 switch (cmds) {
1948 case Q_SYNC:
1949 case Q_QUOTAON:
1950 case Q_QUOTAOFF:
1951 case Q_SETINFO:
1952 case Q_SETQUOTA:
1953 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1954 break;
1955 case Q_GETFMT:
1956 case Q_GETINFO:
1957 case Q_GETQUOTA:
1958 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1959 break;
1960 default:
1961 rc = 0; /* let the kernel handle invalid cmds */
1962 break;
1963 }
1964 return rc;
1965 }
1966
1967 static int selinux_quota_on(struct dentry *dentry)
1968 {
1969 const struct cred *cred = current_cred();
1970
1971 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1972 }
1973
1974 static int selinux_syslog(int type)
1975 {
1976 int rc;
1977
1978 switch (type) {
1979 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1980 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1981 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1982 break;
1983 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1984 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1985 /* Set level of messages printed to console */
1986 case SYSLOG_ACTION_CONSOLE_LEVEL:
1987 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1988 break;
1989 case SYSLOG_ACTION_CLOSE: /* Close log */
1990 case SYSLOG_ACTION_OPEN: /* Open log */
1991 case SYSLOG_ACTION_READ: /* Read from log */
1992 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1993 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1994 default:
1995 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1996 break;
1997 }
1998 return rc;
1999 }
2000
2001 /*
2002 * Check that a process has enough memory to allocate a new virtual
2003 * mapping. 0 means there is enough memory for the allocation to
2004 * succeed and -ENOMEM implies there is not.
2005 *
2006 * Do not audit the selinux permission check, as this is applied to all
2007 * processes that allocate mappings.
2008 */
2009 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2010 {
2011 int rc, cap_sys_admin = 0;
2012
2013 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2014 SECURITY_CAP_NOAUDIT);
2015 if (rc == 0)
2016 cap_sys_admin = 1;
2017
2018 return __vm_enough_memory(mm, pages, cap_sys_admin);
2019 }
2020
2021 /* binprm security operations */
2022
2023 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2024 {
2025 const struct task_security_struct *old_tsec;
2026 struct task_security_struct *new_tsec;
2027 struct inode_security_struct *isec;
2028 struct common_audit_data ad;
2029 struct inode *inode = file_inode(bprm->file);
2030 int rc;
2031
2032 rc = cap_bprm_set_creds(bprm);
2033 if (rc)
2034 return rc;
2035
2036 /* SELinux context only depends on initial program or script and not
2037 * the script interpreter */
2038 if (bprm->cred_prepared)
2039 return 0;
2040
2041 old_tsec = current_security();
2042 new_tsec = bprm->cred->security;
2043 isec = inode->i_security;
2044
2045 /* Default to the current task SID. */
2046 new_tsec->sid = old_tsec->sid;
2047 new_tsec->osid = old_tsec->sid;
2048
2049 /* Reset fs, key, and sock SIDs on execve. */
2050 new_tsec->create_sid = 0;
2051 new_tsec->keycreate_sid = 0;
2052 new_tsec->sockcreate_sid = 0;
2053
2054 if (old_tsec->exec_sid) {
2055 new_tsec->sid = old_tsec->exec_sid;
2056 /* Reset exec SID on execve. */
2057 new_tsec->exec_sid = 0;
2058
2059 /*
2060 * Minimize confusion: if no_new_privs and a transition is
2061 * explicitly requested, then fail the exec.
2062 */
2063 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2064 return -EPERM;
2065 } else {
2066 /* Check for a default transition on this program. */
2067 rc = security_transition_sid(old_tsec->sid, isec->sid,
2068 SECCLASS_PROCESS, NULL,
2069 &new_tsec->sid);
2070 if (rc)
2071 return rc;
2072 }
2073
2074 ad.type = LSM_AUDIT_DATA_PATH;
2075 ad.u.path = bprm->file->f_path;
2076
2077 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2078 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2079 new_tsec->sid = old_tsec->sid;
2080
2081 if (new_tsec->sid == old_tsec->sid) {
2082 rc = avc_has_perm(old_tsec->sid, isec->sid,
2083 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2084 if (rc)
2085 return rc;
2086 } else {
2087 /* Check permissions for the transition. */
2088 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2089 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2090 if (rc)
2091 return rc;
2092
2093 rc = avc_has_perm(new_tsec->sid, isec->sid,
2094 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2095 if (rc)
2096 return rc;
2097
2098 /* Check for shared state */
2099 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2100 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2101 SECCLASS_PROCESS, PROCESS__SHARE,
2102 NULL);
2103 if (rc)
2104 return -EPERM;
2105 }
2106
2107 /* Make sure that anyone attempting to ptrace over a task that
2108 * changes its SID has the appropriate permit */
2109 if (bprm->unsafe &
2110 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2111 struct task_struct *tracer;
2112 struct task_security_struct *sec;
2113 u32 ptsid = 0;
2114
2115 rcu_read_lock();
2116 tracer = ptrace_parent(current);
2117 if (likely(tracer != NULL)) {
2118 sec = __task_cred(tracer)->security;
2119 ptsid = sec->sid;
2120 }
2121 rcu_read_unlock();
2122
2123 if (ptsid != 0) {
2124 rc = avc_has_perm(ptsid, new_tsec->sid,
2125 SECCLASS_PROCESS,
2126 PROCESS__PTRACE, NULL);
2127 if (rc)
2128 return -EPERM;
2129 }
2130 }
2131
2132 /* Clear any possibly unsafe personality bits on exec: */
2133 bprm->per_clear |= PER_CLEAR_ON_SETID;
2134 }
2135
2136 return 0;
2137 }
2138
2139 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2140 {
2141 const struct task_security_struct *tsec = current_security();
2142 u32 sid, osid;
2143 int atsecure = 0;
2144
2145 sid = tsec->sid;
2146 osid = tsec->osid;
2147
2148 if (osid != sid) {
2149 /* Enable secure mode for SIDs transitions unless
2150 the noatsecure permission is granted between
2151 the two SIDs, i.e. ahp returns 0. */
2152 atsecure = avc_has_perm(osid, sid,
2153 SECCLASS_PROCESS,
2154 PROCESS__NOATSECURE, NULL);
2155 }
2156
2157 return (atsecure || cap_bprm_secureexec(bprm));
2158 }
2159
2160 static int match_file(const void *p, struct file *file, unsigned fd)
2161 {
2162 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2163 }
2164
2165 /* Derived from fs/exec.c:flush_old_files. */
2166 static inline void flush_unauthorized_files(const struct cred *cred,
2167 struct files_struct *files)
2168 {
2169 struct file *file, *devnull = NULL;
2170 struct tty_struct *tty;
2171 int drop_tty = 0;
2172 unsigned n;
2173
2174 tty = get_current_tty();
2175 if (tty) {
2176 spin_lock(&tty_files_lock);
2177 if (!list_empty(&tty->tty_files)) {
2178 struct tty_file_private *file_priv;
2179
2180 /* Revalidate access to controlling tty.
2181 Use file_path_has_perm on the tty path directly
2182 rather than using file_has_perm, as this particular
2183 open file may belong to another process and we are
2184 only interested in the inode-based check here. */
2185 file_priv = list_first_entry(&tty->tty_files,
2186 struct tty_file_private, list);
2187 file = file_priv->file;
2188 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2189 drop_tty = 1;
2190 }
2191 spin_unlock(&tty_files_lock);
2192 tty_kref_put(tty);
2193 }
2194 /* Reset controlling tty. */
2195 if (drop_tty)
2196 no_tty();
2197
2198 /* Revalidate access to inherited open files. */
2199 n = iterate_fd(files, 0, match_file, cred);
2200 if (!n) /* none found? */
2201 return;
2202
2203 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2204 if (IS_ERR(devnull))
2205 devnull = NULL;
2206 /* replace all the matching ones with this */
2207 do {
2208 replace_fd(n - 1, devnull, 0);
2209 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2210 if (devnull)
2211 fput(devnull);
2212 }
2213
2214 /*
2215 * Prepare a process for imminent new credential changes due to exec
2216 */
2217 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2218 {
2219 struct task_security_struct *new_tsec;
2220 struct rlimit *rlim, *initrlim;
2221 int rc, i;
2222
2223 new_tsec = bprm->cred->security;
2224 if (new_tsec->sid == new_tsec->osid)
2225 return;
2226
2227 /* Close files for which the new task SID is not authorized. */
2228 flush_unauthorized_files(bprm->cred, current->files);
2229
2230 /* Always clear parent death signal on SID transitions. */
2231 current->pdeath_signal = 0;
2232
2233 /* Check whether the new SID can inherit resource limits from the old
2234 * SID. If not, reset all soft limits to the lower of the current
2235 * task's hard limit and the init task's soft limit.
2236 *
2237 * Note that the setting of hard limits (even to lower them) can be
2238 * controlled by the setrlimit check. The inclusion of the init task's
2239 * soft limit into the computation is to avoid resetting soft limits
2240 * higher than the default soft limit for cases where the default is
2241 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2242 */
2243 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2244 PROCESS__RLIMITINH, NULL);
2245 if (rc) {
2246 /* protect against do_prlimit() */
2247 task_lock(current);
2248 for (i = 0; i < RLIM_NLIMITS; i++) {
2249 rlim = current->signal->rlim + i;
2250 initrlim = init_task.signal->rlim + i;
2251 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2252 }
2253 task_unlock(current);
2254 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2255 }
2256 }
2257
2258 /*
2259 * Clean up the process immediately after the installation of new credentials
2260 * due to exec
2261 */
2262 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2263 {
2264 const struct task_security_struct *tsec = current_security();
2265 struct itimerval itimer;
2266 u32 osid, sid;
2267 int rc, i;
2268
2269 osid = tsec->osid;
2270 sid = tsec->sid;
2271
2272 if (sid == osid)
2273 return;
2274
2275 /* Check whether the new SID can inherit signal state from the old SID.
2276 * If not, clear itimers to avoid subsequent signal generation and
2277 * flush and unblock signals.
2278 *
2279 * This must occur _after_ the task SID has been updated so that any
2280 * kill done after the flush will be checked against the new SID.
2281 */
2282 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2283 if (rc) {
2284 memset(&itimer, 0, sizeof itimer);
2285 for (i = 0; i < 3; i++)
2286 do_setitimer(i, &itimer, NULL);
2287 spin_lock_irq(&current->sighand->siglock);
2288 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2289 __flush_signals(current);
2290 flush_signal_handlers(current, 1);
2291 sigemptyset(&current->blocked);
2292 }
2293 spin_unlock_irq(&current->sighand->siglock);
2294 }
2295
2296 /* Wake up the parent if it is waiting so that it can recheck
2297 * wait permission to the new task SID. */
2298 read_lock(&tasklist_lock);
2299 __wake_up_parent(current, current->real_parent);
2300 read_unlock(&tasklist_lock);
2301 }
2302
2303 /* superblock security operations */
2304
2305 static int selinux_sb_alloc_security(struct super_block *sb)
2306 {
2307 return superblock_alloc_security(sb);
2308 }
2309
2310 static void selinux_sb_free_security(struct super_block *sb)
2311 {
2312 superblock_free_security(sb);
2313 }
2314
2315 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2316 {
2317 if (plen > olen)
2318 return 0;
2319
2320 return !memcmp(prefix, option, plen);
2321 }
2322
2323 static inline int selinux_option(char *option, int len)
2324 {
2325 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2326 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2327 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2328 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2329 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2330 }
2331
2332 static inline void take_option(char **to, char *from, int *first, int len)
2333 {
2334 if (!*first) {
2335 **to = ',';
2336 *to += 1;
2337 } else
2338 *first = 0;
2339 memcpy(*to, from, len);
2340 *to += len;
2341 }
2342
2343 static inline void take_selinux_option(char **to, char *from, int *first,
2344 int len)
2345 {
2346 int current_size = 0;
2347
2348 if (!*first) {
2349 **to = '|';
2350 *to += 1;
2351 } else
2352 *first = 0;
2353
2354 while (current_size < len) {
2355 if (*from != '"') {
2356 **to = *from;
2357 *to += 1;
2358 }
2359 from += 1;
2360 current_size += 1;
2361 }
2362 }
2363
2364 static int selinux_sb_copy_data(char *orig, char *copy)
2365 {
2366 int fnosec, fsec, rc = 0;
2367 char *in_save, *in_curr, *in_end;
2368 char *sec_curr, *nosec_save, *nosec;
2369 int open_quote = 0;
2370
2371 in_curr = orig;
2372 sec_curr = copy;
2373
2374 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2375 if (!nosec) {
2376 rc = -ENOMEM;
2377 goto out;
2378 }
2379
2380 nosec_save = nosec;
2381 fnosec = fsec = 1;
2382 in_save = in_end = orig;
2383
2384 do {
2385 if (*in_end == '"')
2386 open_quote = !open_quote;
2387 if ((*in_end == ',' && open_quote == 0) ||
2388 *in_end == '\0') {
2389 int len = in_end - in_curr;
2390
2391 if (selinux_option(in_curr, len))
2392 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2393 else
2394 take_option(&nosec, in_curr, &fnosec, len);
2395
2396 in_curr = in_end + 1;
2397 }
2398 } while (*in_end++);
2399
2400 strcpy(in_save, nosec_save);
2401 free_page((unsigned long)nosec_save);
2402 out:
2403 return rc;
2404 }
2405
2406 static int selinux_sb_remount(struct super_block *sb, void *data)
2407 {
2408 int rc, i, *flags;
2409 struct security_mnt_opts opts;
2410 char *secdata, **mount_options;
2411 struct superblock_security_struct *sbsec = sb->s_security;
2412
2413 if (!(sbsec->flags & SE_SBINITIALIZED))
2414 return 0;
2415
2416 if (!data)
2417 return 0;
2418
2419 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2420 return 0;
2421
2422 security_init_mnt_opts(&opts);
2423 secdata = alloc_secdata();
2424 if (!secdata)
2425 return -ENOMEM;
2426 rc = selinux_sb_copy_data(data, secdata);
2427 if (rc)
2428 goto out_free_secdata;
2429
2430 rc = selinux_parse_opts_str(secdata, &opts);
2431 if (rc)
2432 goto out_free_secdata;
2433
2434 mount_options = opts.mnt_opts;
2435 flags = opts.mnt_opts_flags;
2436
2437 for (i = 0; i < opts.num_mnt_opts; i++) {
2438 u32 sid;
2439 size_t len;
2440
2441 if (flags[i] == SE_SBLABELSUPP)
2442 continue;
2443 len = strlen(mount_options[i]);
2444 rc = security_context_to_sid(mount_options[i], len, &sid);
2445 if (rc) {
2446 printk(KERN_WARNING "SELinux: security_context_to_sid"
2447 "(%s) failed for (dev %s, type %s) errno=%d\n",
2448 mount_options[i], sb->s_id, sb->s_type->name, rc);
2449 goto out_free_opts;
2450 }
2451 rc = -EINVAL;
2452 switch (flags[i]) {
2453 case FSCONTEXT_MNT:
2454 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2455 goto out_bad_option;
2456 break;
2457 case CONTEXT_MNT:
2458 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2459 goto out_bad_option;
2460 break;
2461 case ROOTCONTEXT_MNT: {
2462 struct inode_security_struct *root_isec;
2463 root_isec = sb->s_root->d_inode->i_security;
2464
2465 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2466 goto out_bad_option;
2467 break;
2468 }
2469 case DEFCONTEXT_MNT:
2470 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2471 goto out_bad_option;
2472 break;
2473 default:
2474 goto out_free_opts;
2475 }
2476 }
2477
2478 rc = 0;
2479 out_free_opts:
2480 security_free_mnt_opts(&opts);
2481 out_free_secdata:
2482 free_secdata(secdata);
2483 return rc;
2484 out_bad_option:
2485 printk(KERN_WARNING "SELinux: unable to change security options "
2486 "during remount (dev %s, type=%s)\n", sb->s_id,
2487 sb->s_type->name);
2488 goto out_free_opts;
2489 }
2490
2491 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2492 {
2493 const struct cred *cred = current_cred();
2494 struct common_audit_data ad;
2495 int rc;
2496
2497 rc = superblock_doinit(sb, data);
2498 if (rc)
2499 return rc;
2500
2501 /* Allow all mounts performed by the kernel */
2502 if (flags & MS_KERNMOUNT)
2503 return 0;
2504
2505 ad.type = LSM_AUDIT_DATA_DENTRY;
2506 ad.u.dentry = sb->s_root;
2507 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2508 }
2509
2510 static int selinux_sb_statfs(struct dentry *dentry)
2511 {
2512 const struct cred *cred = current_cred();
2513 struct common_audit_data ad;
2514
2515 ad.type = LSM_AUDIT_DATA_DENTRY;
2516 ad.u.dentry = dentry->d_sb->s_root;
2517 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2518 }
2519
2520 static int selinux_mount(const char *dev_name,
2521 struct path *path,
2522 const char *type,
2523 unsigned long flags,
2524 void *data)
2525 {
2526 const struct cred *cred = current_cred();
2527
2528 if (flags & MS_REMOUNT)
2529 return superblock_has_perm(cred, path->dentry->d_sb,
2530 FILESYSTEM__REMOUNT, NULL);
2531 else
2532 return path_has_perm(cred, path, FILE__MOUNTON);
2533 }
2534
2535 static int selinux_umount(struct vfsmount *mnt, int flags)
2536 {
2537 const struct cred *cred = current_cred();
2538
2539 return superblock_has_perm(cred, mnt->mnt_sb,
2540 FILESYSTEM__UNMOUNT, NULL);
2541 }
2542
2543 /* inode security operations */
2544
2545 static int selinux_inode_alloc_security(struct inode *inode)
2546 {
2547 return inode_alloc_security(inode);
2548 }
2549
2550 static void selinux_inode_free_security(struct inode *inode)
2551 {
2552 inode_free_security(inode);
2553 }
2554
2555 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2556 struct qstr *name, void **ctx,
2557 u32 *ctxlen)
2558 {
2559 const struct cred *cred = current_cred();
2560 struct task_security_struct *tsec;
2561 struct inode_security_struct *dsec;
2562 struct superblock_security_struct *sbsec;
2563 struct inode *dir = dentry->d_parent->d_inode;
2564 u32 newsid;
2565 int rc;
2566
2567 tsec = cred->security;
2568 dsec = dir->i_security;
2569 sbsec = dir->i_sb->s_security;
2570
2571 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2572 newsid = tsec->create_sid;
2573 } else {
2574 rc = security_transition_sid(tsec->sid, dsec->sid,
2575 inode_mode_to_security_class(mode),
2576 name,
2577 &newsid);
2578 if (rc) {
2579 printk(KERN_WARNING
2580 "%s: security_transition_sid failed, rc=%d\n",
2581 __func__, -rc);
2582 return rc;
2583 }
2584 }
2585
2586 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2587 }
2588
2589 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2590 const struct qstr *qstr,
2591 const char **name,
2592 void **value, size_t *len)
2593 {
2594 const struct task_security_struct *tsec = current_security();
2595 struct inode_security_struct *dsec;
2596 struct superblock_security_struct *sbsec;
2597 u32 sid, newsid, clen;
2598 int rc;
2599 char *context;
2600
2601 dsec = dir->i_security;
2602 sbsec = dir->i_sb->s_security;
2603
2604 sid = tsec->sid;
2605 newsid = tsec->create_sid;
2606
2607 if ((sbsec->flags & SE_SBINITIALIZED) &&
2608 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2609 newsid = sbsec->mntpoint_sid;
2610 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2611 rc = security_transition_sid(sid, dsec->sid,
2612 inode_mode_to_security_class(inode->i_mode),
2613 qstr, &newsid);
2614 if (rc) {
2615 printk(KERN_WARNING "%s: "
2616 "security_transition_sid failed, rc=%d (dev=%s "
2617 "ino=%ld)\n",
2618 __func__,
2619 -rc, inode->i_sb->s_id, inode->i_ino);
2620 return rc;
2621 }
2622 }
2623
2624 /* Possibly defer initialization to selinux_complete_init. */
2625 if (sbsec->flags & SE_SBINITIALIZED) {
2626 struct inode_security_struct *isec = inode->i_security;
2627 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2628 isec->sid = newsid;
2629 isec->initialized = 1;
2630 }
2631
2632 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2633 return -EOPNOTSUPP;
2634
2635 if (name)
2636 *name = XATTR_SELINUX_SUFFIX;
2637
2638 if (value && len) {
2639 rc = security_sid_to_context_force(newsid, &context, &clen);
2640 if (rc)
2641 return rc;
2642 *value = context;
2643 *len = clen;
2644 }
2645
2646 return 0;
2647 }
2648
2649 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2650 {
2651 return may_create(dir, dentry, SECCLASS_FILE);
2652 }
2653
2654 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2655 {
2656 return may_link(dir, old_dentry, MAY_LINK);
2657 }
2658
2659 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2660 {
2661 return may_link(dir, dentry, MAY_UNLINK);
2662 }
2663
2664 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2665 {
2666 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2667 }
2668
2669 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2670 {
2671 return may_create(dir, dentry, SECCLASS_DIR);
2672 }
2673
2674 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2675 {
2676 return may_link(dir, dentry, MAY_RMDIR);
2677 }
2678
2679 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2680 {
2681 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2682 }
2683
2684 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2685 struct inode *new_inode, struct dentry *new_dentry)
2686 {
2687 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2688 }
2689
2690 static int selinux_inode_readlink(struct dentry *dentry)
2691 {
2692 const struct cred *cred = current_cred();
2693
2694 return dentry_has_perm(cred, dentry, FILE__READ);
2695 }
2696
2697 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2698 {
2699 const struct cred *cred = current_cred();
2700
2701 return dentry_has_perm(cred, dentry, FILE__READ);
2702 }
2703
2704 static noinline int audit_inode_permission(struct inode *inode,
2705 u32 perms, u32 audited, u32 denied,
2706 unsigned flags)
2707 {
2708 struct common_audit_data ad;
2709 struct inode_security_struct *isec = inode->i_security;
2710 int rc;
2711
2712 ad.type = LSM_AUDIT_DATA_INODE;
2713 ad.u.inode = inode;
2714
2715 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2716 audited, denied, &ad, flags);
2717 if (rc)
2718 return rc;
2719 return 0;
2720 }
2721
2722 static int selinux_inode_permission(struct inode *inode, int mask)
2723 {
2724 const struct cred *cred = current_cred();
2725 u32 perms;
2726 bool from_access;
2727 unsigned flags = mask & MAY_NOT_BLOCK;
2728 struct inode_security_struct *isec;
2729 u32 sid;
2730 struct av_decision avd;
2731 int rc, rc2;
2732 u32 audited, denied;
2733
2734 from_access = mask & MAY_ACCESS;
2735 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2736
2737 /* No permission to check. Existence test. */
2738 if (!mask)
2739 return 0;
2740
2741 validate_creds(cred);
2742
2743 if (unlikely(IS_PRIVATE(inode)))
2744 return 0;
2745
2746 perms = file_mask_to_av(inode->i_mode, mask);
2747
2748 sid = cred_sid(cred);
2749 isec = inode->i_security;
2750
2751 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2752 audited = avc_audit_required(perms, &avd, rc,
2753 from_access ? FILE__AUDIT_ACCESS : 0,
2754 &denied);
2755 if (likely(!audited))
2756 return rc;
2757
2758 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2759 if (rc2)
2760 return rc2;
2761 return rc;
2762 }
2763
2764 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2765 {
2766 const struct cred *cred = current_cred();
2767 unsigned int ia_valid = iattr->ia_valid;
2768 __u32 av = FILE__WRITE;
2769
2770 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2771 if (ia_valid & ATTR_FORCE) {
2772 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2773 ATTR_FORCE);
2774 if (!ia_valid)
2775 return 0;
2776 }
2777
2778 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2779 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2780 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2781
2782 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2783 av |= FILE__OPEN;
2784
2785 return dentry_has_perm(cred, dentry, av);
2786 }
2787
2788 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2789 {
2790 const struct cred *cred = current_cred();
2791 struct path path;
2792
2793 path.dentry = dentry;
2794 path.mnt = mnt;
2795
2796 return path_has_perm(cred, &path, FILE__GETATTR);
2797 }
2798
2799 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2800 {
2801 const struct cred *cred = current_cred();
2802
2803 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2804 sizeof XATTR_SECURITY_PREFIX - 1)) {
2805 if (!strcmp(name, XATTR_NAME_CAPS)) {
2806 if (!capable(CAP_SETFCAP))
2807 return -EPERM;
2808 } else if (!capable(CAP_SYS_ADMIN)) {
2809 /* A different attribute in the security namespace.
2810 Restrict to administrator. */
2811 return -EPERM;
2812 }
2813 }
2814
2815 /* Not an attribute we recognize, so just check the
2816 ordinary setattr permission. */
2817 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2818 }
2819
2820 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2821 const void *value, size_t size, int flags)
2822 {
2823 struct inode *inode = dentry->d_inode;
2824 struct inode_security_struct *isec = inode->i_security;
2825 struct superblock_security_struct *sbsec;
2826 struct common_audit_data ad;
2827 u32 newsid, sid = current_sid();
2828 int rc = 0;
2829
2830 if (strcmp(name, XATTR_NAME_SELINUX))
2831 return selinux_inode_setotherxattr(dentry, name);
2832
2833 sbsec = inode->i_sb->s_security;
2834 if (!(sbsec->flags & SE_SBLABELSUPP))
2835 return -EOPNOTSUPP;
2836
2837 if (!inode_owner_or_capable(inode))
2838 return -EPERM;
2839
2840 ad.type = LSM_AUDIT_DATA_DENTRY;
2841 ad.u.dentry = dentry;
2842
2843 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2844 FILE__RELABELFROM, &ad);
2845 if (rc)
2846 return rc;
2847
2848 rc = security_context_to_sid(value, size, &newsid);
2849 if (rc == -EINVAL) {
2850 if (!capable(CAP_MAC_ADMIN)) {
2851 struct audit_buffer *ab;
2852 size_t audit_size;
2853 const char *str;
2854
2855 /* We strip a nul only if it is at the end, otherwise the
2856 * context contains a nul and we should audit that */
2857 if (value) {
2858 str = value;
2859 if (str[size - 1] == '\0')
2860 audit_size = size - 1;
2861 else
2862 audit_size = size;
2863 } else {
2864 str = "";
2865 audit_size = 0;
2866 }
2867 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2868 audit_log_format(ab, "op=setxattr invalid_context=");
2869 audit_log_n_untrustedstring(ab, value, audit_size);
2870 audit_log_end(ab);
2871
2872 return rc;
2873 }
2874 rc = security_context_to_sid_force(value, size, &newsid);
2875 }
2876 if (rc)
2877 return rc;
2878
2879 rc = avc_has_perm(sid, newsid, isec->sclass,
2880 FILE__RELABELTO, &ad);
2881 if (rc)
2882 return rc;
2883
2884 rc = security_validate_transition(isec->sid, newsid, sid,
2885 isec->sclass);
2886 if (rc)
2887 return rc;
2888
2889 return avc_has_perm(newsid,
2890 sbsec->sid,
2891 SECCLASS_FILESYSTEM,
2892 FILESYSTEM__ASSOCIATE,
2893 &ad);
2894 }
2895
2896 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2897 const void *value, size_t size,
2898 int flags)
2899 {
2900 struct inode *inode = dentry->d_inode;
2901 struct inode_security_struct *isec = inode->i_security;
2902 u32 newsid;
2903 int rc;
2904
2905 if (strcmp(name, XATTR_NAME_SELINUX)) {
2906 /* Not an attribute we recognize, so nothing to do. */
2907 return;
2908 }
2909
2910 rc = security_context_to_sid_force(value, size, &newsid);
2911 if (rc) {
2912 printk(KERN_ERR "SELinux: unable to map context to SID"
2913 "for (%s, %lu), rc=%d\n",
2914 inode->i_sb->s_id, inode->i_ino, -rc);
2915 return;
2916 }
2917
2918 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2919 isec->sid = newsid;
2920 isec->initialized = 1;
2921
2922 return;
2923 }
2924
2925 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2926 {
2927 const struct cred *cred = current_cred();
2928
2929 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2930 }
2931
2932 static int selinux_inode_listxattr(struct dentry *dentry)
2933 {
2934 const struct cred *cred = current_cred();
2935
2936 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2937 }
2938
2939 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2940 {
2941 if (strcmp(name, XATTR_NAME_SELINUX))
2942 return selinux_inode_setotherxattr(dentry, name);
2943
2944 /* No one is allowed to remove a SELinux security label.
2945 You can change the label, but all data must be labeled. */
2946 return -EACCES;
2947 }
2948
2949 /*
2950 * Copy the inode security context value to the user.
2951 *
2952 * Permission check is handled by selinux_inode_getxattr hook.
2953 */
2954 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2955 {
2956 u32 size;
2957 int error;
2958 char *context = NULL;
2959 struct inode_security_struct *isec = inode->i_security;
2960
2961 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2962 return -EOPNOTSUPP;
2963
2964 /*
2965 * If the caller has CAP_MAC_ADMIN, then get the raw context
2966 * value even if it is not defined by current policy; otherwise,
2967 * use the in-core value under current policy.
2968 * Use the non-auditing forms of the permission checks since
2969 * getxattr may be called by unprivileged processes commonly
2970 * and lack of permission just means that we fall back to the
2971 * in-core context value, not a denial.
2972 */
2973 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2974 SECURITY_CAP_NOAUDIT);
2975 if (!error)
2976 error = security_sid_to_context_force(isec->sid, &context,
2977 &size);
2978 else
2979 error = security_sid_to_context(isec->sid, &context, &size);
2980 if (error)
2981 return error;
2982 error = size;
2983 if (alloc) {
2984 *buffer = context;
2985 goto out_nofree;
2986 }
2987 kfree(context);
2988 out_nofree:
2989 return error;
2990 }
2991
2992 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2993 const void *value, size_t size, int flags)
2994 {
2995 struct inode_security_struct *isec = inode->i_security;
2996 u32 newsid;
2997 int rc;
2998
2999 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3000 return -EOPNOTSUPP;
3001
3002 if (!value || !size)
3003 return -EACCES;
3004
3005 rc = security_context_to_sid((void *)value, size, &newsid);
3006 if (rc)
3007 return rc;
3008
3009 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3010 isec->sid = newsid;
3011 isec->initialized = 1;
3012 return 0;
3013 }
3014
3015 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3016 {
3017 const int len = sizeof(XATTR_NAME_SELINUX);
3018 if (buffer && len <= buffer_size)
3019 memcpy(buffer, XATTR_NAME_SELINUX, len);
3020 return len;
3021 }
3022
3023 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3024 {
3025 struct inode_security_struct *isec = inode->i_security;
3026 *secid = isec->sid;
3027 }
3028
3029 /* file security operations */
3030
3031 static int selinux_revalidate_file_permission(struct file *file, int mask)
3032 {
3033 const struct cred *cred = current_cred();
3034 struct inode *inode = file_inode(file);
3035
3036 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3037 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3038 mask |= MAY_APPEND;
3039
3040 return file_has_perm(cred, file,
3041 file_mask_to_av(inode->i_mode, mask));
3042 }
3043
3044 static int selinux_file_permission(struct file *file, int mask)
3045 {
3046 struct inode *inode = file_inode(file);
3047 struct file_security_struct *fsec = file->f_security;
3048 struct inode_security_struct *isec = inode->i_security;
3049 u32 sid = current_sid();
3050
3051 if (!mask)
3052 /* No permission to check. Existence test. */
3053 return 0;
3054
3055 if (sid == fsec->sid && fsec->isid == isec->sid &&
3056 fsec->pseqno == avc_policy_seqno())
3057 /* No change since file_open check. */
3058 return 0;
3059
3060 return selinux_revalidate_file_permission(file, mask);
3061 }
3062
3063 static int selinux_file_alloc_security(struct file *file)
3064 {
3065 return file_alloc_security(file);
3066 }
3067
3068 static void selinux_file_free_security(struct file *file)
3069 {
3070 file_free_security(file);
3071 }
3072
3073 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3074 unsigned long arg)
3075 {
3076 const struct cred *cred = current_cred();
3077 int error = 0;
3078
3079 switch (cmd) {
3080 case FIONREAD:
3081 /* fall through */
3082 case FIBMAP:
3083 /* fall through */
3084 case FIGETBSZ:
3085 /* fall through */
3086 case FS_IOC_GETFLAGS:
3087 /* fall through */
3088 case FS_IOC_GETVERSION:
3089 error = file_has_perm(cred, file, FILE__GETATTR);
3090 break;
3091
3092 case FS_IOC_SETFLAGS:
3093 /* fall through */
3094 case FS_IOC_SETVERSION:
3095 error = file_has_perm(cred, file, FILE__SETATTR);
3096 break;
3097
3098 /* sys_ioctl() checks */
3099 case FIONBIO:
3100 /* fall through */
3101 case FIOASYNC:
3102 error = file_has_perm(cred, file, 0);
3103 break;
3104
3105 case KDSKBENT:
3106 case KDSKBSENT:
3107 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3108 SECURITY_CAP_AUDIT);
3109 break;
3110
3111 /* default case assumes that the command will go
3112 * to the file's ioctl() function.
3113 */
3114 default:
3115 error = file_has_perm(cred, file, FILE__IOCTL);
3116 }
3117 return error;
3118 }
3119
3120 static int default_noexec;
3121
3122 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3123 {
3124 const struct cred *cred = current_cred();
3125 int rc = 0;
3126
3127 if (default_noexec &&
3128 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3129 /*
3130 * We are making executable an anonymous mapping or a
3131 * private file mapping that will also be writable.
3132 * This has an additional check.
3133 */
3134 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3135 if (rc)
3136 goto error;
3137 }
3138
3139 if (file) {
3140 /* read access is always possible with a mapping */
3141 u32 av = FILE__READ;
3142
3143 /* write access only matters if the mapping is shared */
3144 if (shared && (prot & PROT_WRITE))
3145 av |= FILE__WRITE;
3146
3147 if (prot & PROT_EXEC)
3148 av |= FILE__EXECUTE;
3149
3150 return file_has_perm(cred, file, av);
3151 }
3152
3153 error:
3154 return rc;
3155 }
3156
3157 static int selinux_mmap_addr(unsigned long addr)
3158 {
3159 int rc = 0;
3160 u32 sid = current_sid();
3161
3162 /*
3163 * notice that we are intentionally putting the SELinux check before
3164 * the secondary cap_file_mmap check. This is such a likely attempt
3165 * at bad behaviour/exploit that we always want to get the AVC, even
3166 * if DAC would have also denied the operation.
3167 */
3168 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3169 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3170 MEMPROTECT__MMAP_ZERO, NULL);
3171 if (rc)
3172 return rc;
3173 }
3174
3175 /* do DAC check on address space usage */
3176 return cap_mmap_addr(addr);
3177 }
3178
3179 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3180 unsigned long prot, unsigned long flags)
3181 {
3182 if (selinux_checkreqprot)
3183 prot = reqprot;
3184
3185 return file_map_prot_check(file, prot,
3186 (flags & MAP_TYPE) == MAP_SHARED);
3187 }
3188
3189 static int selinux_file_mprotect(struct vm_area_struct *vma,
3190 unsigned long reqprot,
3191 unsigned long prot)
3192 {
3193 const struct cred *cred = current_cred();
3194
3195 if (selinux_checkreqprot)
3196 prot = reqprot;
3197
3198 if (default_noexec &&
3199 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3200 int rc = 0;
3201 if (vma->vm_start >= vma->vm_mm->start_brk &&
3202 vma->vm_end <= vma->vm_mm->brk) {
3203 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3204 } else if (!vma->vm_file &&
3205 vma->vm_start <= vma->vm_mm->start_stack &&
3206 vma->vm_end >= vma->vm_mm->start_stack) {
3207 rc = current_has_perm(current, PROCESS__EXECSTACK);
3208 } else if (vma->vm_file && vma->anon_vma) {
3209 /*
3210 * We are making executable a file mapping that has
3211 * had some COW done. Since pages might have been
3212 * written, check ability to execute the possibly
3213 * modified content. This typically should only
3214 * occur for text relocations.
3215 */
3216 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3217 }
3218 if (rc)
3219 return rc;
3220 }
3221
3222 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3223 }
3224
3225 static int selinux_file_lock(struct file *file, unsigned int cmd)
3226 {
3227 const struct cred *cred = current_cred();
3228
3229 return file_has_perm(cred, file, FILE__LOCK);
3230 }
3231
3232 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3233 unsigned long arg)
3234 {
3235 const struct cred *cred = current_cred();
3236 int err = 0;
3237
3238 switch (cmd) {
3239 case F_SETFL:
3240 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3241 err = file_has_perm(cred, file, FILE__WRITE);
3242 break;
3243 }
3244 /* fall through */
3245 case F_SETOWN:
3246 case F_SETSIG:
3247 case F_GETFL:
3248 case F_GETOWN:
3249 case F_GETSIG:
3250 case F_GETOWNER_UIDS:
3251 /* Just check FD__USE permission */
3252 err = file_has_perm(cred, file, 0);
3253 break;
3254 case F_GETLK:
3255 case F_SETLK:
3256 case F_SETLKW:
3257 #if BITS_PER_LONG == 32
3258 case F_GETLK64:
3259 case F_SETLK64:
3260 case F_SETLKW64:
3261 #endif
3262 err = file_has_perm(cred, file, FILE__LOCK);
3263 break;
3264 }
3265
3266 return err;
3267 }
3268
3269 static int selinux_file_set_fowner(struct file *file)
3270 {
3271 struct file_security_struct *fsec;
3272
3273 fsec = file->f_security;
3274 fsec->fown_sid = current_sid();
3275
3276 return 0;
3277 }
3278
3279 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3280 struct fown_struct *fown, int signum)
3281 {
3282 struct file *file;
3283 u32 sid = task_sid(tsk);
3284 u32 perm;
3285 struct file_security_struct *fsec;
3286
3287 /* struct fown_struct is never outside the context of a struct file */
3288 file = container_of(fown, struct file, f_owner);
3289
3290 fsec = file->f_security;
3291
3292 if (!signum)
3293 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3294 else
3295 perm = signal_to_av(signum);
3296
3297 return avc_has_perm(fsec->fown_sid, sid,
3298 SECCLASS_PROCESS, perm, NULL);
3299 }
3300
3301 static int selinux_file_receive(struct file *file)
3302 {
3303 const struct cred *cred = current_cred();
3304
3305 return file_has_perm(cred, file, file_to_av(file));
3306 }
3307
3308 static int selinux_file_open(struct file *file, const struct cred *cred)
3309 {
3310 struct file_security_struct *fsec;
3311 struct inode_security_struct *isec;
3312
3313 fsec = file->f_security;
3314 isec = file_inode(file)->i_security;
3315 /*
3316 * Save inode label and policy sequence number
3317 * at open-time so that selinux_file_permission
3318 * can determine whether revalidation is necessary.
3319 * Task label is already saved in the file security
3320 * struct as its SID.
3321 */
3322 fsec->isid = isec->sid;
3323 fsec->pseqno = avc_policy_seqno();
3324 /*
3325 * Since the inode label or policy seqno may have changed
3326 * between the selinux_inode_permission check and the saving
3327 * of state above, recheck that access is still permitted.
3328 * Otherwise, access might never be revalidated against the
3329 * new inode label or new policy.
3330 * This check is not redundant - do not remove.
3331 */
3332 return file_path_has_perm(cred, file, open_file_to_av(file));
3333 }
3334
3335 /* task security operations */
3336
3337 static int selinux_task_create(unsigned long clone_flags)
3338 {
3339 return current_has_perm(current, PROCESS__FORK);
3340 }
3341
3342 /*
3343 * allocate the SELinux part of blank credentials
3344 */
3345 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3346 {
3347 struct task_security_struct *tsec;
3348
3349 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3350 if (!tsec)
3351 return -ENOMEM;
3352
3353 cred->security = tsec;
3354 return 0;
3355 }
3356
3357 /*
3358 * detach and free the LSM part of a set of credentials
3359 */
3360 static void selinux_cred_free(struct cred *cred)
3361 {
3362 struct task_security_struct *tsec = cred->security;
3363
3364 /*
3365 * cred->security == NULL if security_cred_alloc_blank() or
3366 * security_prepare_creds() returned an error.
3367 */
3368 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3369 cred->security = (void *) 0x7UL;
3370 kfree(tsec);
3371 }
3372
3373 /*
3374 * prepare a new set of credentials for modification
3375 */
3376 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3377 gfp_t gfp)
3378 {
3379 const struct task_security_struct *old_tsec;
3380 struct task_security_struct *tsec;
3381
3382 old_tsec = old->security;
3383
3384 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3385 if (!tsec)
3386 return -ENOMEM;
3387
3388 new->security = tsec;
3389 return 0;
3390 }
3391
3392 /*
3393 * transfer the SELinux data to a blank set of creds
3394 */
3395 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3396 {
3397 const struct task_security_struct *old_tsec = old->security;
3398 struct task_security_struct *tsec = new->security;
3399
3400 *tsec = *old_tsec;
3401 }
3402
3403 /*
3404 * set the security data for a kernel service
3405 * - all the creation contexts are set to unlabelled
3406 */
3407 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3408 {
3409 struct task_security_struct *tsec = new->security;
3410 u32 sid = current_sid();
3411 int ret;
3412
3413 ret = avc_has_perm(sid, secid,
3414 SECCLASS_KERNEL_SERVICE,
3415 KERNEL_SERVICE__USE_AS_OVERRIDE,
3416 NULL);
3417 if (ret == 0) {
3418 tsec->sid = secid;
3419 tsec->create_sid = 0;
3420 tsec->keycreate_sid = 0;
3421 tsec->sockcreate_sid = 0;
3422 }
3423 return ret;
3424 }
3425
3426 /*
3427 * set the file creation context in a security record to the same as the
3428 * objective context of the specified inode
3429 */
3430 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3431 {
3432 struct inode_security_struct *isec = inode->i_security;
3433 struct task_security_struct *tsec = new->security;
3434 u32 sid = current_sid();
3435 int ret;
3436
3437 ret = avc_has_perm(sid, isec->sid,
3438 SECCLASS_KERNEL_SERVICE,
3439 KERNEL_SERVICE__CREATE_FILES_AS,
3440 NULL);
3441
3442 if (ret == 0)
3443 tsec->create_sid = isec->sid;
3444 return ret;
3445 }
3446
3447 static int selinux_kernel_module_request(char *kmod_name)
3448 {
3449 u32 sid;
3450 struct common_audit_data ad;
3451
3452 sid = task_sid(current);
3453
3454 ad.type = LSM_AUDIT_DATA_KMOD;
3455 ad.u.kmod_name = kmod_name;
3456
3457 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3458 SYSTEM__MODULE_REQUEST, &ad);
3459 }
3460
3461 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3462 {
3463 return current_has_perm(p, PROCESS__SETPGID);
3464 }
3465
3466 static int selinux_task_getpgid(struct task_struct *p)
3467 {
3468 return current_has_perm(p, PROCESS__GETPGID);
3469 }
3470
3471 static int selinux_task_getsid(struct task_struct *p)
3472 {
3473 return current_has_perm(p, PROCESS__GETSESSION);
3474 }
3475
3476 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3477 {
3478 *secid = task_sid(p);
3479 }
3480
3481 static int selinux_task_setnice(struct task_struct *p, int nice)
3482 {
3483 int rc;
3484
3485 rc = cap_task_setnice(p, nice);
3486 if (rc)
3487 return rc;
3488
3489 return current_has_perm(p, PROCESS__SETSCHED);
3490 }
3491
3492 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3493 {
3494 int rc;
3495
3496 rc = cap_task_setioprio(p, ioprio);
3497 if (rc)
3498 return rc;
3499
3500 return current_has_perm(p, PROCESS__SETSCHED);
3501 }
3502
3503 static int selinux_task_getioprio(struct task_struct *p)
3504 {
3505 return current_has_perm(p, PROCESS__GETSCHED);
3506 }
3507
3508 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3509 struct rlimit *new_rlim)
3510 {
3511 struct rlimit *old_rlim = p->signal->rlim + resource;
3512
3513 /* Control the ability to change the hard limit (whether
3514 lowering or raising it), so that the hard limit can
3515 later be used as a safe reset point for the soft limit
3516 upon context transitions. See selinux_bprm_committing_creds. */
3517 if (old_rlim->rlim_max != new_rlim->rlim_max)
3518 return current_has_perm(p, PROCESS__SETRLIMIT);
3519
3520 return 0;
3521 }
3522
3523 static int selinux_task_setscheduler(struct task_struct *p)
3524 {
3525 int rc;
3526
3527 rc = cap_task_setscheduler(p);
3528 if (rc)
3529 return rc;
3530
3531 return current_has_perm(p, PROCESS__SETSCHED);
3532 }
3533
3534 static int selinux_task_getscheduler(struct task_struct *p)
3535 {
3536 return current_has_perm(p, PROCESS__GETSCHED);
3537 }
3538
3539 static int selinux_task_movememory(struct task_struct *p)
3540 {
3541 return current_has_perm(p, PROCESS__SETSCHED);
3542 }
3543
3544 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3545 int sig, u32 secid)
3546 {
3547 u32 perm;
3548 int rc;
3549
3550 if (!sig)
3551 perm = PROCESS__SIGNULL; /* null signal; existence test */
3552 else
3553 perm = signal_to_av(sig);
3554 if (secid)
3555 rc = avc_has_perm(secid, task_sid(p),
3556 SECCLASS_PROCESS, perm, NULL);
3557 else
3558 rc = current_has_perm(p, perm);
3559 return rc;
3560 }
3561
3562 static int selinux_task_wait(struct task_struct *p)
3563 {
3564 return task_has_perm(p, current, PROCESS__SIGCHLD);
3565 }
3566
3567 static void selinux_task_to_inode(struct task_struct *p,
3568 struct inode *inode)
3569 {
3570 struct inode_security_struct *isec = inode->i_security;
3571 u32 sid = task_sid(p);
3572
3573 isec->sid = sid;
3574 isec->initialized = 1;
3575 }
3576
3577 /* Returns error only if unable to parse addresses */
3578 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3579 struct common_audit_data *ad, u8 *proto)
3580 {
3581 int offset, ihlen, ret = -EINVAL;
3582 struct iphdr _iph, *ih;
3583
3584 offset = skb_network_offset(skb);
3585 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3586 if (ih == NULL)
3587 goto out;
3588
3589 ihlen = ih->ihl * 4;
3590 if (ihlen < sizeof(_iph))
3591 goto out;
3592
3593 ad->u.net->v4info.saddr = ih->saddr;
3594 ad->u.net->v4info.daddr = ih->daddr;
3595 ret = 0;
3596
3597 if (proto)
3598 *proto = ih->protocol;
3599
3600 switch (ih->protocol) {
3601 case IPPROTO_TCP: {
3602 struct tcphdr _tcph, *th;
3603
3604 if (ntohs(ih->frag_off) & IP_OFFSET)
3605 break;
3606
3607 offset += ihlen;
3608 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3609 if (th == NULL)
3610 break;
3611
3612 ad->u.net->sport = th->source;
3613 ad->u.net->dport = th->dest;
3614 break;
3615 }
3616
3617 case IPPROTO_UDP: {
3618 struct udphdr _udph, *uh;
3619
3620 if (ntohs(ih->frag_off) & IP_OFFSET)
3621 break;
3622
3623 offset += ihlen;
3624 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3625 if (uh == NULL)
3626 break;
3627
3628 ad->u.net->sport = uh->source;
3629 ad->u.net->dport = uh->dest;
3630 break;
3631 }
3632
3633 case IPPROTO_DCCP: {
3634 struct dccp_hdr _dccph, *dh;
3635
3636 if (ntohs(ih->frag_off) & IP_OFFSET)
3637 break;
3638
3639 offset += ihlen;
3640 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3641 if (dh == NULL)
3642 break;
3643
3644 ad->u.net->sport = dh->dccph_sport;
3645 ad->u.net->dport = dh->dccph_dport;
3646 break;
3647 }
3648
3649 default:
3650 break;
3651 }
3652 out:
3653 return ret;
3654 }
3655
3656 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3657
3658 /* Returns error only if unable to parse addresses */
3659 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3660 struct common_audit_data *ad, u8 *proto)
3661 {
3662 u8 nexthdr;
3663 int ret = -EINVAL, offset;
3664 struct ipv6hdr _ipv6h, *ip6;
3665 __be16 frag_off;
3666
3667 offset = skb_network_offset(skb);
3668 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3669 if (ip6 == NULL)
3670 goto out;
3671
3672 ad->u.net->v6info.saddr = ip6->saddr;
3673 ad->u.net->v6info.daddr = ip6->daddr;
3674 ret = 0;
3675
3676 nexthdr = ip6->nexthdr;
3677 offset += sizeof(_ipv6h);
3678 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3679 if (offset < 0)
3680 goto out;
3681
3682 if (proto)
3683 *proto = nexthdr;
3684
3685 switch (nexthdr) {
3686 case IPPROTO_TCP: {
3687 struct tcphdr _tcph, *th;
3688
3689 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3690 if (th == NULL)
3691 break;
3692
3693 ad->u.net->sport = th->source;
3694 ad->u.net->dport = th->dest;
3695 break;
3696 }
3697
3698 case IPPROTO_UDP: {
3699 struct udphdr _udph, *uh;
3700
3701 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3702 if (uh == NULL)
3703 break;
3704
3705 ad->u.net->sport = uh->source;
3706 ad->u.net->dport = uh->dest;
3707 break;
3708 }
3709
3710 case IPPROTO_DCCP: {
3711 struct dccp_hdr _dccph, *dh;
3712
3713 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3714 if (dh == NULL)
3715 break;
3716
3717 ad->u.net->sport = dh->dccph_sport;
3718 ad->u.net->dport = dh->dccph_dport;
3719 break;
3720 }
3721
3722 /* includes fragments */
3723 default:
3724 break;
3725 }
3726 out:
3727 return ret;
3728 }
3729
3730 #endif /* IPV6 */
3731
3732 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3733 char **_addrp, int src, u8 *proto)
3734 {
3735 char *addrp;
3736 int ret;
3737
3738 switch (ad->u.net->family) {
3739 case PF_INET:
3740 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3741 if (ret)
3742 goto parse_error;
3743 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3744 &ad->u.net->v4info.daddr);
3745 goto okay;
3746
3747 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3748 case PF_INET6:
3749 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3750 if (ret)
3751 goto parse_error;
3752 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3753 &ad->u.net->v6info.daddr);
3754 goto okay;
3755 #endif /* IPV6 */
3756 default:
3757 addrp = NULL;
3758 goto okay;
3759 }
3760
3761 parse_error:
3762 printk(KERN_WARNING
3763 "SELinux: failure in selinux_parse_skb(),"
3764 " unable to parse packet\n");
3765 return ret;
3766
3767 okay:
3768 if (_addrp)
3769 *_addrp = addrp;
3770 return 0;
3771 }
3772
3773 /**
3774 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3775 * @skb: the packet
3776 * @family: protocol family
3777 * @sid: the packet's peer label SID
3778 *
3779 * Description:
3780 * Check the various different forms of network peer labeling and determine
3781 * the peer label/SID for the packet; most of the magic actually occurs in
3782 * the security server function security_net_peersid_cmp(). The function
3783 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3784 * or -EACCES if @sid is invalid due to inconsistencies with the different
3785 * peer labels.
3786 *
3787 */
3788 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3789 {
3790 int err;
3791 u32 xfrm_sid;
3792 u32 nlbl_sid;
3793 u32 nlbl_type;
3794
3795 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3796 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3797
3798 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3799 if (unlikely(err)) {
3800 printk(KERN_WARNING
3801 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3802 " unable to determine packet's peer label\n");
3803 return -EACCES;
3804 }
3805
3806 return 0;
3807 }
3808
3809 /* socket security operations */
3810
3811 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3812 u16 secclass, u32 *socksid)
3813 {
3814 if (tsec->sockcreate_sid > SECSID_NULL) {
3815 *socksid = tsec->sockcreate_sid;
3816 return 0;
3817 }
3818
3819 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3820 socksid);
3821 }
3822
3823 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3824 {
3825 struct sk_security_struct *sksec = sk->sk_security;
3826 struct common_audit_data ad;
3827 struct lsm_network_audit net = {0,};
3828 u32 tsid = task_sid(task);
3829
3830 if (sksec->sid == SECINITSID_KERNEL)
3831 return 0;
3832
3833 ad.type = LSM_AUDIT_DATA_NET;
3834 ad.u.net = &net;
3835 ad.u.net->sk = sk;
3836
3837 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3838 }
3839
3840 static int selinux_socket_create(int family, int type,
3841 int protocol, int kern)
3842 {
3843 const struct task_security_struct *tsec = current_security();
3844 u32 newsid;
3845 u16 secclass;
3846 int rc;
3847
3848 if (kern)
3849 return 0;
3850
3851 secclass = socket_type_to_security_class(family, type, protocol);
3852 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3853 if (rc)
3854 return rc;
3855
3856 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3857 }
3858
3859 static int selinux_socket_post_create(struct socket *sock, int family,
3860 int type, int protocol, int kern)
3861 {
3862 const struct task_security_struct *tsec = current_security();
3863 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3864 struct sk_security_struct *sksec;
3865 int err = 0;
3866
3867 isec->sclass = socket_type_to_security_class(family, type, protocol);
3868
3869 if (kern)
3870 isec->sid = SECINITSID_KERNEL;
3871 else {
3872 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3873 if (err)
3874 return err;
3875 }
3876
3877 isec->initialized = 1;
3878
3879 if (sock->sk) {
3880 sksec = sock->sk->sk_security;
3881 sksec->sid = isec->sid;
3882 sksec->sclass = isec->sclass;
3883 err = selinux_netlbl_socket_post_create(sock->sk, family);
3884 }
3885
3886 return err;
3887 }
3888
3889 /* Range of port numbers used to automatically bind.
3890 Need to determine whether we should perform a name_bind
3891 permission check between the socket and the port number. */
3892
3893 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3894 {
3895 struct sock *sk = sock->sk;
3896 u16 family;
3897 int err;
3898
3899 err = sock_has_perm(current, sk, SOCKET__BIND);
3900 if (err)
3901 goto out;
3902
3903 /*
3904 * If PF_INET or PF_INET6, check name_bind permission for the port.
3905 * Multiple address binding for SCTP is not supported yet: we just
3906 * check the first address now.
3907 */
3908 family = sk->sk_family;
3909 if (family == PF_INET || family == PF_INET6) {
3910 char *addrp;
3911 struct sk_security_struct *sksec = sk->sk_security;
3912 struct common_audit_data ad;
3913 struct lsm_network_audit net = {0,};
3914 struct sockaddr_in *addr4 = NULL;
3915 struct sockaddr_in6 *addr6 = NULL;
3916 unsigned short snum;
3917 u32 sid, node_perm;
3918
3919 if (family == PF_INET) {
3920 addr4 = (struct sockaddr_in *)address;
3921 snum = ntohs(addr4->sin_port);
3922 addrp = (char *)&addr4->sin_addr.s_addr;
3923 } else {
3924 addr6 = (struct sockaddr_in6 *)address;
3925 snum = ntohs(addr6->sin6_port);
3926 addrp = (char *)&addr6->sin6_addr.s6_addr;
3927 }
3928
3929 if (snum) {
3930 int low, high;
3931
3932 inet_get_local_port_range(&low, &high);
3933
3934 if (snum < max(PROT_SOCK, low) || snum > high) {
3935 err = sel_netport_sid(sk->sk_protocol,
3936 snum, &sid);
3937 if (err)
3938 goto out;
3939 ad.type = LSM_AUDIT_DATA_NET;
3940 ad.u.net = &net;
3941 ad.u.net->sport = htons(snum);
3942 ad.u.net->family = family;
3943 err = avc_has_perm(sksec->sid, sid,
3944 sksec->sclass,
3945 SOCKET__NAME_BIND, &ad);
3946 if (err)
3947 goto out;
3948 }
3949 }
3950
3951 switch (sksec->sclass) {
3952 case SECCLASS_TCP_SOCKET:
3953 node_perm = TCP_SOCKET__NODE_BIND;
3954 break;
3955
3956 case SECCLASS_UDP_SOCKET:
3957 node_perm = UDP_SOCKET__NODE_BIND;
3958 break;
3959
3960 case SECCLASS_DCCP_SOCKET:
3961 node_perm = DCCP_SOCKET__NODE_BIND;
3962 break;
3963
3964 default:
3965 node_perm = RAWIP_SOCKET__NODE_BIND;
3966 break;
3967 }
3968
3969 err = sel_netnode_sid(addrp, family, &sid);
3970 if (err)
3971 goto out;
3972
3973 ad.type = LSM_AUDIT_DATA_NET;
3974 ad.u.net = &net;
3975 ad.u.net->sport = htons(snum);
3976 ad.u.net->family = family;
3977
3978 if (family == PF_INET)
3979 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3980 else
3981 ad.u.net->v6info.saddr = addr6->sin6_addr;
3982
3983 err = avc_has_perm(sksec->sid, sid,
3984 sksec->sclass, node_perm, &ad);
3985 if (err)
3986 goto out;
3987 }
3988 out:
3989 return err;
3990 }
3991
3992 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3993 {
3994 struct sock *sk = sock->sk;
3995 struct sk_security_struct *sksec = sk->sk_security;
3996 int err;
3997
3998 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3999 if (err)
4000 return err;
4001
4002 /*
4003 * If a TCP or DCCP socket, check name_connect permission for the port.
4004 */
4005 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4006 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4007 struct common_audit_data ad;
4008 struct lsm_network_audit net = {0,};
4009 struct sockaddr_in *addr4 = NULL;
4010 struct sockaddr_in6 *addr6 = NULL;
4011 unsigned short snum;
4012 u32 sid, perm;
4013
4014 if (sk->sk_family == PF_INET) {
4015 addr4 = (struct sockaddr_in *)address;
4016 if (addrlen < sizeof(struct sockaddr_in))
4017 return -EINVAL;
4018 snum = ntohs(addr4->sin_port);
4019 } else {
4020 addr6 = (struct sockaddr_in6 *)address;
4021 if (addrlen < SIN6_LEN_RFC2133)
4022 return -EINVAL;
4023 snum = ntohs(addr6->sin6_port);
4024 }
4025
4026 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4027 if (err)
4028 goto out;
4029
4030 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4031 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4032
4033 ad.type = LSM_AUDIT_DATA_NET;
4034 ad.u.net = &net;
4035 ad.u.net->dport = htons(snum);
4036 ad.u.net->family = sk->sk_family;
4037 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4038 if (err)
4039 goto out;
4040 }
4041
4042 err = selinux_netlbl_socket_connect(sk, address);
4043
4044 out:
4045 return err;
4046 }
4047
4048 static int selinux_socket_listen(struct socket *sock, int backlog)
4049 {
4050 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4051 }
4052
4053 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4054 {
4055 int err;
4056 struct inode_security_struct *isec;
4057 struct inode_security_struct *newisec;
4058
4059 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4060 if (err)
4061 return err;
4062
4063 newisec = SOCK_INODE(newsock)->i_security;
4064
4065 isec = SOCK_INODE(sock)->i_security;
4066 newisec->sclass = isec->sclass;
4067 newisec->sid = isec->sid;
4068 newisec->initialized = 1;
4069
4070 return 0;
4071 }
4072
4073 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4074 int size)
4075 {
4076 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4077 }
4078
4079 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4080 int size, int flags)
4081 {
4082 return sock_has_perm(current, sock->sk, SOCKET__READ);
4083 }
4084
4085 static int selinux_socket_getsockname(struct socket *sock)
4086 {
4087 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4088 }
4089
4090 static int selinux_socket_getpeername(struct socket *sock)
4091 {
4092 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4093 }
4094
4095 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4096 {
4097 int err;
4098
4099 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4100 if (err)
4101 return err;
4102
4103 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4104 }
4105
4106 static int selinux_socket_getsockopt(struct socket *sock, int level,
4107 int optname)
4108 {
4109 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4110 }
4111
4112 static int selinux_socket_shutdown(struct socket *sock, int how)
4113 {
4114 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4115 }
4116
4117 static int selinux_socket_unix_stream_connect(struct sock *sock,
4118 struct sock *other,
4119 struct sock *newsk)
4120 {
4121 struct sk_security_struct *sksec_sock = sock->sk_security;
4122 struct sk_security_struct *sksec_other = other->sk_security;
4123 struct sk_security_struct *sksec_new = newsk->sk_security;
4124 struct common_audit_data ad;
4125 struct lsm_network_audit net = {0,};
4126 int err;
4127
4128 ad.type = LSM_AUDIT_DATA_NET;
4129 ad.u.net = &net;
4130 ad.u.net->sk = other;
4131
4132 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4133 sksec_other->sclass,
4134 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4135 if (err)
4136 return err;
4137
4138 /* server child socket */
4139 sksec_new->peer_sid = sksec_sock->sid;
4140 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4141 &sksec_new->sid);
4142 if (err)
4143 return err;
4144
4145 /* connecting socket */
4146 sksec_sock->peer_sid = sksec_new->sid;
4147
4148 return 0;
4149 }
4150
4151 static int selinux_socket_unix_may_send(struct socket *sock,
4152 struct socket *other)
4153 {
4154 struct sk_security_struct *ssec = sock->sk->sk_security;
4155 struct sk_security_struct *osec = other->sk->sk_security;
4156 struct common_audit_data ad;
4157 struct lsm_network_audit net = {0,};
4158
4159 ad.type = LSM_AUDIT_DATA_NET;
4160 ad.u.net = &net;
4161 ad.u.net->sk = other->sk;
4162
4163 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4164 &ad);
4165 }
4166
4167 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4168 u32 peer_sid,
4169 struct common_audit_data *ad)
4170 {
4171 int err;
4172 u32 if_sid;
4173 u32 node_sid;
4174
4175 err = sel_netif_sid(ifindex, &if_sid);
4176 if (err)
4177 return err;
4178 err = avc_has_perm(peer_sid, if_sid,
4179 SECCLASS_NETIF, NETIF__INGRESS, ad);
4180 if (err)
4181 return err;
4182
4183 err = sel_netnode_sid(addrp, family, &node_sid);
4184 if (err)
4185 return err;
4186 return avc_has_perm(peer_sid, node_sid,
4187 SECCLASS_NODE, NODE__RECVFROM, ad);
4188 }
4189
4190 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4191 u16 family)
4192 {
4193 int err = 0;
4194 struct sk_security_struct *sksec = sk->sk_security;
4195 u32 sk_sid = sksec->sid;
4196 struct common_audit_data ad;
4197 struct lsm_network_audit net = {0,};
4198 char *addrp;
4199
4200 ad.type = LSM_AUDIT_DATA_NET;
4201 ad.u.net = &net;
4202 ad.u.net->netif = skb->skb_iif;
4203 ad.u.net->family = family;
4204 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4205 if (err)
4206 return err;
4207
4208 if (selinux_secmark_enabled()) {
4209 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4210 PACKET__RECV, &ad);
4211 if (err)
4212 return err;
4213 }
4214
4215 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4216 if (err)
4217 return err;
4218 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4219
4220 return err;
4221 }
4222
4223 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4224 {
4225 int err;
4226 struct sk_security_struct *sksec = sk->sk_security;
4227 u16 family = sk->sk_family;
4228 u32 sk_sid = sksec->sid;
4229 struct common_audit_data ad;
4230 struct lsm_network_audit net = {0,};
4231 char *addrp;
4232 u8 secmark_active;
4233 u8 peerlbl_active;
4234
4235 if (family != PF_INET && family != PF_INET6)
4236 return 0;
4237
4238 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4239 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4240 family = PF_INET;
4241
4242 /* If any sort of compatibility mode is enabled then handoff processing
4243 * to the selinux_sock_rcv_skb_compat() function to deal with the
4244 * special handling. We do this in an attempt to keep this function
4245 * as fast and as clean as possible. */
4246 if (!selinux_policycap_netpeer)
4247 return selinux_sock_rcv_skb_compat(sk, skb, family);
4248
4249 secmark_active = selinux_secmark_enabled();
4250 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4251 if (!secmark_active && !peerlbl_active)
4252 return 0;
4253
4254 ad.type = LSM_AUDIT_DATA_NET;
4255 ad.u.net = &net;
4256 ad.u.net->netif = skb->skb_iif;
4257 ad.u.net->family = family;
4258 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4259 if (err)
4260 return err;
4261
4262 if (peerlbl_active) {
4263 u32 peer_sid;
4264
4265 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4266 if (err)
4267 return err;
4268 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4269 peer_sid, &ad);
4270 if (err) {
4271 selinux_netlbl_err(skb, err, 0);
4272 return err;
4273 }
4274 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4275 PEER__RECV, &ad);
4276 if (err)
4277 selinux_netlbl_err(skb, err, 0);
4278 }
4279
4280 if (secmark_active) {
4281 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4282 PACKET__RECV, &ad);
4283 if (err)
4284 return err;
4285 }
4286
4287 return err;
4288 }
4289
4290 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4291 int __user *optlen, unsigned len)
4292 {
4293 int err = 0;
4294 char *scontext;
4295 u32 scontext_len;
4296 struct sk_security_struct *sksec = sock->sk->sk_security;
4297 u32 peer_sid = SECSID_NULL;
4298
4299 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4300 sksec->sclass == SECCLASS_TCP_SOCKET)
4301 peer_sid = sksec->peer_sid;
4302 if (peer_sid == SECSID_NULL)
4303 return -ENOPROTOOPT;
4304
4305 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4306 if (err)
4307 return err;
4308
4309 if (scontext_len > len) {
4310 err = -ERANGE;
4311 goto out_len;
4312 }
4313
4314 if (copy_to_user(optval, scontext, scontext_len))
4315 err = -EFAULT;
4316
4317 out_len:
4318 if (put_user(scontext_len, optlen))
4319 err = -EFAULT;
4320 kfree(scontext);
4321 return err;
4322 }
4323
4324 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4325 {
4326 u32 peer_secid = SECSID_NULL;
4327 u16 family;
4328
4329 if (skb && skb->protocol == htons(ETH_P_IP))
4330 family = PF_INET;
4331 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4332 family = PF_INET6;
4333 else if (sock)
4334 family = sock->sk->sk_family;
4335 else
4336 goto out;
4337
4338 if (sock && family == PF_UNIX)
4339 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4340 else if (skb)
4341 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4342
4343 out:
4344 *secid = peer_secid;
4345 if (peer_secid == SECSID_NULL)
4346 return -EINVAL;
4347 return 0;
4348 }
4349
4350 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4351 {
4352 struct sk_security_struct *sksec;
4353
4354 sksec = kzalloc(sizeof(*sksec), priority);
4355 if (!sksec)
4356 return -ENOMEM;
4357
4358 sksec->peer_sid = SECINITSID_UNLABELED;
4359 sksec->sid = SECINITSID_UNLABELED;
4360 selinux_netlbl_sk_security_reset(sksec);
4361 sk->sk_security = sksec;
4362
4363 return 0;
4364 }
4365
4366 static void selinux_sk_free_security(struct sock *sk)
4367 {
4368 struct sk_security_struct *sksec = sk->sk_security;
4369
4370 sk->sk_security = NULL;
4371 selinux_netlbl_sk_security_free(sksec);
4372 kfree(sksec);
4373 }
4374
4375 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4376 {
4377 struct sk_security_struct *sksec = sk->sk_security;
4378 struct sk_security_struct *newsksec = newsk->sk_security;
4379
4380 newsksec->sid = sksec->sid;
4381 newsksec->peer_sid = sksec->peer_sid;
4382 newsksec->sclass = sksec->sclass;
4383
4384 selinux_netlbl_sk_security_reset(newsksec);
4385 }
4386
4387 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4388 {
4389 if (!sk)
4390 *secid = SECINITSID_ANY_SOCKET;
4391 else {
4392 struct sk_security_struct *sksec = sk->sk_security;
4393
4394 *secid = sksec->sid;
4395 }
4396 }
4397
4398 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4399 {
4400 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4401 struct sk_security_struct *sksec = sk->sk_security;
4402
4403 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4404 sk->sk_family == PF_UNIX)
4405 isec->sid = sksec->sid;
4406 sksec->sclass = isec->sclass;
4407 }
4408
4409 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4410 struct request_sock *req)
4411 {
4412 struct sk_security_struct *sksec = sk->sk_security;
4413 int err;
4414 u16 family = sk->sk_family;
4415 u32 newsid;
4416 u32 peersid;
4417
4418 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4419 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4420 family = PF_INET;
4421
4422 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4423 if (err)
4424 return err;
4425 if (peersid == SECSID_NULL) {
4426 req->secid = sksec->sid;
4427 req->peer_secid = SECSID_NULL;
4428 } else {
4429 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4430 if (err)
4431 return err;
4432 req->secid = newsid;
4433 req->peer_secid = peersid;
4434 }
4435
4436 return selinux_netlbl_inet_conn_request(req, family);
4437 }
4438
4439 static void selinux_inet_csk_clone(struct sock *newsk,
4440 const struct request_sock *req)
4441 {
4442 struct sk_security_struct *newsksec = newsk->sk_security;
4443
4444 newsksec->sid = req->secid;
4445 newsksec->peer_sid = req->peer_secid;
4446 /* NOTE: Ideally, we should also get the isec->sid for the
4447 new socket in sync, but we don't have the isec available yet.
4448 So we will wait until sock_graft to do it, by which
4449 time it will have been created and available. */
4450
4451 /* We don't need to take any sort of lock here as we are the only
4452 * thread with access to newsksec */
4453 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4454 }
4455
4456 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4457 {
4458 u16 family = sk->sk_family;
4459 struct sk_security_struct *sksec = sk->sk_security;
4460
4461 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4462 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4463 family = PF_INET;
4464
4465 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4466 }
4467
4468 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4469 {
4470 skb_set_owner_w(skb, sk);
4471 }
4472
4473 static int selinux_secmark_relabel_packet(u32 sid)
4474 {
4475 const struct task_security_struct *__tsec;
4476 u32 tsid;
4477
4478 __tsec = current_security();
4479 tsid = __tsec->sid;
4480
4481 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4482 }
4483
4484 static void selinux_secmark_refcount_inc(void)
4485 {
4486 atomic_inc(&selinux_secmark_refcount);
4487 }
4488
4489 static void selinux_secmark_refcount_dec(void)
4490 {
4491 atomic_dec(&selinux_secmark_refcount);
4492 }
4493
4494 static void selinux_req_classify_flow(const struct request_sock *req,
4495 struct flowi *fl)
4496 {
4497 fl->flowi_secid = req->secid;
4498 }
4499
4500 static int selinux_tun_dev_alloc_security(void **security)
4501 {
4502 struct tun_security_struct *tunsec;
4503
4504 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4505 if (!tunsec)
4506 return -ENOMEM;
4507 tunsec->sid = current_sid();
4508
4509 *security = tunsec;
4510 return 0;
4511 }
4512
4513 static void selinux_tun_dev_free_security(void *security)
4514 {
4515 kfree(security);
4516 }
4517
4518 static int selinux_tun_dev_create(void)
4519 {
4520 u32 sid = current_sid();
4521
4522 /* we aren't taking into account the "sockcreate" SID since the socket
4523 * that is being created here is not a socket in the traditional sense,
4524 * instead it is a private sock, accessible only to the kernel, and
4525 * representing a wide range of network traffic spanning multiple
4526 * connections unlike traditional sockets - check the TUN driver to
4527 * get a better understanding of why this socket is special */
4528
4529 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4530 NULL);
4531 }
4532
4533 static int selinux_tun_dev_attach_queue(void *security)
4534 {
4535 struct tun_security_struct *tunsec = security;
4536
4537 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4538 TUN_SOCKET__ATTACH_QUEUE, NULL);
4539 }
4540
4541 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4542 {
4543 struct tun_security_struct *tunsec = security;
4544 struct sk_security_struct *sksec = sk->sk_security;
4545
4546 /* we don't currently perform any NetLabel based labeling here and it
4547 * isn't clear that we would want to do so anyway; while we could apply
4548 * labeling without the support of the TUN user the resulting labeled
4549 * traffic from the other end of the connection would almost certainly
4550 * cause confusion to the TUN user that had no idea network labeling
4551 * protocols were being used */
4552
4553 sksec->sid = tunsec->sid;
4554 sksec->sclass = SECCLASS_TUN_SOCKET;
4555
4556 return 0;
4557 }
4558
4559 static int selinux_tun_dev_open(void *security)
4560 {
4561 struct tun_security_struct *tunsec = security;
4562 u32 sid = current_sid();
4563 int err;
4564
4565 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4566 TUN_SOCKET__RELABELFROM, NULL);
4567 if (err)
4568 return err;
4569 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4570 TUN_SOCKET__RELABELTO, NULL);
4571 if (err)
4572 return err;
4573 tunsec->sid = sid;
4574
4575 return 0;
4576 }
4577
4578 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4579 {
4580 int err = 0;
4581 u32 perm;
4582 struct nlmsghdr *nlh;
4583 struct sk_security_struct *sksec = sk->sk_security;
4584
4585 if (skb->len < NLMSG_HDRLEN) {
4586 err = -EINVAL;
4587 goto out;
4588 }
4589 nlh = nlmsg_hdr(skb);
4590
4591 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4592 if (err) {
4593 if (err == -EINVAL) {
4594 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4595 "SELinux: unrecognized netlink message"
4596 " type=%hu for sclass=%hu\n",
4597 nlh->nlmsg_type, sksec->sclass);
4598 if (!selinux_enforcing || security_get_allow_unknown())
4599 err = 0;
4600 }
4601
4602 /* Ignore */
4603 if (err == -ENOENT)
4604 err = 0;
4605 goto out;
4606 }
4607
4608 err = sock_has_perm(current, sk, perm);
4609 out:
4610 return err;
4611 }
4612
4613 #ifdef CONFIG_NETFILTER
4614
4615 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4616 u16 family)
4617 {
4618 int err;
4619 char *addrp;
4620 u32 peer_sid;
4621 struct common_audit_data ad;
4622 struct lsm_network_audit net = {0,};
4623 u8 secmark_active;
4624 u8 netlbl_active;
4625 u8 peerlbl_active;
4626
4627 if (!selinux_policycap_netpeer)
4628 return NF_ACCEPT;
4629
4630 secmark_active = selinux_secmark_enabled();
4631 netlbl_active = netlbl_enabled();
4632 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4633 if (!secmark_active && !peerlbl_active)
4634 return NF_ACCEPT;
4635
4636 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4637 return NF_DROP;
4638
4639 ad.type = LSM_AUDIT_DATA_NET;
4640 ad.u.net = &net;
4641 ad.u.net->netif = ifindex;
4642 ad.u.net->family = family;
4643 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4644 return NF_DROP;
4645
4646 if (peerlbl_active) {
4647 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4648 peer_sid, &ad);
4649 if (err) {
4650 selinux_netlbl_err(skb, err, 1);
4651 return NF_DROP;
4652 }
4653 }
4654
4655 if (secmark_active)
4656 if (avc_has_perm(peer_sid, skb->secmark,
4657 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4658 return NF_DROP;
4659
4660 if (netlbl_active)
4661 /* we do this in the FORWARD path and not the POST_ROUTING
4662 * path because we want to make sure we apply the necessary
4663 * labeling before IPsec is applied so we can leverage AH
4664 * protection */
4665 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4666 return NF_DROP;
4667
4668 return NF_ACCEPT;
4669 }
4670
4671 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4672 struct sk_buff *skb,
4673 const struct net_device *in,
4674 const struct net_device *out,
4675 int (*okfn)(struct sk_buff *))
4676 {
4677 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4678 }
4679
4680 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4681 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4682 struct sk_buff *skb,
4683 const struct net_device *in,
4684 const struct net_device *out,
4685 int (*okfn)(struct sk_buff *))
4686 {
4687 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4688 }
4689 #endif /* IPV6 */
4690
4691 static unsigned int selinux_ip_output(struct sk_buff *skb,
4692 u16 family)
4693 {
4694 u32 sid;
4695
4696 if (!netlbl_enabled())
4697 return NF_ACCEPT;
4698
4699 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4700 * because we want to make sure we apply the necessary labeling
4701 * before IPsec is applied so we can leverage AH protection */
4702 if (skb->sk) {
4703 struct sk_security_struct *sksec = skb->sk->sk_security;
4704 sid = sksec->sid;
4705 } else
4706 sid = SECINITSID_KERNEL;
4707 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4708 return NF_DROP;
4709
4710 return NF_ACCEPT;
4711 }
4712
4713 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4714 struct sk_buff *skb,
4715 const struct net_device *in,
4716 const struct net_device *out,
4717 int (*okfn)(struct sk_buff *))
4718 {
4719 return selinux_ip_output(skb, PF_INET);
4720 }
4721
4722 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4723 int ifindex,
4724 u16 family)
4725 {
4726 struct sock *sk = skb->sk;
4727 struct sk_security_struct *sksec;
4728 struct common_audit_data ad;
4729 struct lsm_network_audit net = {0,};
4730 char *addrp;
4731 u8 proto;
4732
4733 if (sk == NULL)
4734 return NF_ACCEPT;
4735 sksec = sk->sk_security;
4736
4737 ad.type = LSM_AUDIT_DATA_NET;
4738 ad.u.net = &net;
4739 ad.u.net->netif = ifindex;
4740 ad.u.net->family = family;
4741 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4742 return NF_DROP;
4743
4744 if (selinux_secmark_enabled())
4745 if (avc_has_perm(sksec->sid, skb->secmark,
4746 SECCLASS_PACKET, PACKET__SEND, &ad))
4747 return NF_DROP_ERR(-ECONNREFUSED);
4748
4749 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4750 return NF_DROP_ERR(-ECONNREFUSED);
4751
4752 return NF_ACCEPT;
4753 }
4754
4755 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4756 u16 family)
4757 {
4758 u32 secmark_perm;
4759 u32 peer_sid;
4760 struct sock *sk;
4761 struct common_audit_data ad;
4762 struct lsm_network_audit net = {0,};
4763 char *addrp;
4764 u8 secmark_active;
4765 u8 peerlbl_active;
4766
4767 /* If any sort of compatibility mode is enabled then handoff processing
4768 * to the selinux_ip_postroute_compat() function to deal with the
4769 * special handling. We do this in an attempt to keep this function
4770 * as fast and as clean as possible. */
4771 if (!selinux_policycap_netpeer)
4772 return selinux_ip_postroute_compat(skb, ifindex, family);
4773 #ifdef CONFIG_XFRM
4774 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4775 * packet transformation so allow the packet to pass without any checks
4776 * since we'll have another chance to perform access control checks
4777 * when the packet is on it's final way out.
4778 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4779 * is NULL, in this case go ahead and apply access control. */
4780 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4781 return NF_ACCEPT;
4782 #endif
4783 secmark_active = selinux_secmark_enabled();
4784 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4785 if (!secmark_active && !peerlbl_active)
4786 return NF_ACCEPT;
4787
4788 /* if the packet is being forwarded then get the peer label from the
4789 * packet itself; otherwise check to see if it is from a local
4790 * application or the kernel, if from an application get the peer label
4791 * from the sending socket, otherwise use the kernel's sid */
4792 sk = skb->sk;
4793 if (sk == NULL) {
4794 if (skb->skb_iif) {
4795 secmark_perm = PACKET__FORWARD_OUT;
4796 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4797 return NF_DROP;
4798 } else {
4799 secmark_perm = PACKET__SEND;
4800 peer_sid = SECINITSID_KERNEL;
4801 }
4802 } else {
4803 struct sk_security_struct *sksec = sk->sk_security;
4804 peer_sid = sksec->sid;
4805 secmark_perm = PACKET__SEND;
4806 }
4807
4808 ad.type = LSM_AUDIT_DATA_NET;
4809 ad.u.net = &net;
4810 ad.u.net->netif = ifindex;
4811 ad.u.net->family = family;
4812 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4813 return NF_DROP;
4814
4815 if (secmark_active)
4816 if (avc_has_perm(peer_sid, skb->secmark,
4817 SECCLASS_PACKET, secmark_perm, &ad))
4818 return NF_DROP_ERR(-ECONNREFUSED);
4819
4820 if (peerlbl_active) {
4821 u32 if_sid;
4822 u32 node_sid;
4823
4824 if (sel_netif_sid(ifindex, &if_sid))
4825 return NF_DROP;
4826 if (avc_has_perm(peer_sid, if_sid,
4827 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4828 return NF_DROP_ERR(-ECONNREFUSED);
4829
4830 if (sel_netnode_sid(addrp, family, &node_sid))
4831 return NF_DROP;
4832 if (avc_has_perm(peer_sid, node_sid,
4833 SECCLASS_NODE, NODE__SENDTO, &ad))
4834 return NF_DROP_ERR(-ECONNREFUSED);
4835 }
4836
4837 return NF_ACCEPT;
4838 }
4839
4840 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4841 struct sk_buff *skb,
4842 const struct net_device *in,
4843 const struct net_device *out,
4844 int (*okfn)(struct sk_buff *))
4845 {
4846 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4847 }
4848
4849 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4850 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4851 struct sk_buff *skb,
4852 const struct net_device *in,
4853 const struct net_device *out,
4854 int (*okfn)(struct sk_buff *))
4855 {
4856 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4857 }
4858 #endif /* IPV6 */
4859
4860 #endif /* CONFIG_NETFILTER */
4861
4862 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4863 {
4864 int err;
4865
4866 err = cap_netlink_send(sk, skb);
4867 if (err)
4868 return err;
4869
4870 return selinux_nlmsg_perm(sk, skb);
4871 }
4872
4873 static int ipc_alloc_security(struct task_struct *task,
4874 struct kern_ipc_perm *perm,
4875 u16 sclass)
4876 {
4877 struct ipc_security_struct *isec;
4878 u32 sid;
4879
4880 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4881 if (!isec)
4882 return -ENOMEM;
4883
4884 sid = task_sid(task);
4885 isec->sclass = sclass;
4886 isec->sid = sid;
4887 perm->security = isec;
4888
4889 return 0;
4890 }
4891
4892 static void ipc_free_security(struct kern_ipc_perm *perm)
4893 {
4894 struct ipc_security_struct *isec = perm->security;
4895 perm->security = NULL;
4896 kfree(isec);
4897 }
4898
4899 static int msg_msg_alloc_security(struct msg_msg *msg)
4900 {
4901 struct msg_security_struct *msec;
4902
4903 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4904 if (!msec)
4905 return -ENOMEM;
4906
4907 msec->sid = SECINITSID_UNLABELED;
4908 msg->security = msec;
4909
4910 return 0;
4911 }
4912
4913 static void msg_msg_free_security(struct msg_msg *msg)
4914 {
4915 struct msg_security_struct *msec = msg->security;
4916
4917 msg->security = NULL;
4918 kfree(msec);
4919 }
4920
4921 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4922 u32 perms)
4923 {
4924 struct ipc_security_struct *isec;
4925 struct common_audit_data ad;
4926 u32 sid = current_sid();
4927
4928 isec = ipc_perms->security;
4929
4930 ad.type = LSM_AUDIT_DATA_IPC;
4931 ad.u.ipc_id = ipc_perms->key;
4932
4933 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4934 }
4935
4936 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4937 {
4938 return msg_msg_alloc_security(msg);
4939 }
4940
4941 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4942 {
4943 msg_msg_free_security(msg);
4944 }
4945
4946 /* message queue security operations */
4947 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4948 {
4949 struct ipc_security_struct *isec;
4950 struct common_audit_data ad;
4951 u32 sid = current_sid();
4952 int rc;
4953
4954 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4955 if (rc)
4956 return rc;
4957
4958 isec = msq->q_perm.security;
4959
4960 ad.type = LSM_AUDIT_DATA_IPC;
4961 ad.u.ipc_id = msq->q_perm.key;
4962
4963 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4964 MSGQ__CREATE, &ad);
4965 if (rc) {
4966 ipc_free_security(&msq->q_perm);
4967 return rc;
4968 }
4969 return 0;
4970 }
4971
4972 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4973 {
4974 ipc_free_security(&msq->q_perm);
4975 }
4976
4977 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4978 {
4979 struct ipc_security_struct *isec;
4980 struct common_audit_data ad;
4981 u32 sid = current_sid();
4982
4983 isec = msq->q_perm.security;
4984
4985 ad.type = LSM_AUDIT_DATA_IPC;
4986 ad.u.ipc_id = msq->q_perm.key;
4987
4988 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4989 MSGQ__ASSOCIATE, &ad);
4990 }
4991
4992 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4993 {
4994 int err;
4995 int perms;
4996
4997 switch (cmd) {
4998 case IPC_INFO:
4999 case MSG_INFO:
5000 /* No specific object, just general system-wide information. */
5001 return task_has_system(current, SYSTEM__IPC_INFO);
5002 case IPC_STAT:
5003 case MSG_STAT:
5004 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5005 break;
5006 case IPC_SET:
5007 perms = MSGQ__SETATTR;
5008 break;
5009 case IPC_RMID:
5010 perms = MSGQ__DESTROY;
5011 break;
5012 default:
5013 return 0;
5014 }
5015
5016 err = ipc_has_perm(&msq->q_perm, perms);
5017 return err;
5018 }
5019
5020 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5021 {
5022 struct ipc_security_struct *isec;
5023 struct msg_security_struct *msec;
5024 struct common_audit_data ad;
5025 u32 sid = current_sid();
5026 int rc;
5027
5028 isec = msq->q_perm.security;
5029 msec = msg->security;
5030
5031 /*
5032 * First time through, need to assign label to the message
5033 */
5034 if (msec->sid == SECINITSID_UNLABELED) {
5035 /*
5036 * Compute new sid based on current process and
5037 * message queue this message will be stored in
5038 */
5039 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5040 NULL, &msec->sid);
5041 if (rc)
5042 return rc;
5043 }
5044
5045 ad.type = LSM_AUDIT_DATA_IPC;
5046 ad.u.ipc_id = msq->q_perm.key;
5047
5048 /* Can this process write to the queue? */
5049 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5050 MSGQ__WRITE, &ad);
5051 if (!rc)
5052 /* Can this process send the message */
5053 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5054 MSG__SEND, &ad);
5055 if (!rc)
5056 /* Can the message be put in the queue? */
5057 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5058 MSGQ__ENQUEUE, &ad);
5059
5060 return rc;
5061 }
5062
5063 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5064 struct task_struct *target,
5065 long type, int mode)
5066 {
5067 struct ipc_security_struct *isec;
5068 struct msg_security_struct *msec;
5069 struct common_audit_data ad;
5070 u32 sid = task_sid(target);
5071 int rc;
5072
5073 isec = msq->q_perm.security;
5074 msec = msg->security;
5075
5076 ad.type = LSM_AUDIT_DATA_IPC;
5077 ad.u.ipc_id = msq->q_perm.key;
5078
5079 rc = avc_has_perm(sid, isec->sid,
5080 SECCLASS_MSGQ, MSGQ__READ, &ad);
5081 if (!rc)
5082 rc = avc_has_perm(sid, msec->sid,
5083 SECCLASS_MSG, MSG__RECEIVE, &ad);
5084 return rc;
5085 }
5086
5087 /* Shared Memory security operations */
5088 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5089 {
5090 struct ipc_security_struct *isec;
5091 struct common_audit_data ad;
5092 u32 sid = current_sid();
5093 int rc;
5094
5095 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5096 if (rc)
5097 return rc;
5098
5099 isec = shp->shm_perm.security;
5100
5101 ad.type = LSM_AUDIT_DATA_IPC;
5102 ad.u.ipc_id = shp->shm_perm.key;
5103
5104 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5105 SHM__CREATE, &ad);
5106 if (rc) {
5107 ipc_free_security(&shp->shm_perm);
5108 return rc;
5109 }
5110 return 0;
5111 }
5112
5113 static void selinux_shm_free_security(struct shmid_kernel *shp)
5114 {
5115 ipc_free_security(&shp->shm_perm);
5116 }
5117
5118 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5119 {
5120 struct ipc_security_struct *isec;
5121 struct common_audit_data ad;
5122 u32 sid = current_sid();
5123
5124 isec = shp->shm_perm.security;
5125
5126 ad.type = LSM_AUDIT_DATA_IPC;
5127 ad.u.ipc_id = shp->shm_perm.key;
5128
5129 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5130 SHM__ASSOCIATE, &ad);
5131 }
5132
5133 /* Note, at this point, shp is locked down */
5134 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5135 {
5136 int perms;
5137 int err;
5138
5139 switch (cmd) {
5140 case IPC_INFO:
5141 case SHM_INFO:
5142 /* No specific object, just general system-wide information. */
5143 return task_has_system(current, SYSTEM__IPC_INFO);
5144 case IPC_STAT:
5145 case SHM_STAT:
5146 perms = SHM__GETATTR | SHM__ASSOCIATE;
5147 break;
5148 case IPC_SET:
5149 perms = SHM__SETATTR;
5150 break;
5151 case SHM_LOCK:
5152 case SHM_UNLOCK:
5153 perms = SHM__LOCK;
5154 break;
5155 case IPC_RMID:
5156 perms = SHM__DESTROY;
5157 break;
5158 default:
5159 return 0;
5160 }
5161
5162 err = ipc_has_perm(&shp->shm_perm, perms);
5163 return err;
5164 }
5165
5166 static int selinux_shm_shmat(struct shmid_kernel *shp,
5167 char __user *shmaddr, int shmflg)
5168 {
5169 u32 perms;
5170
5171 if (shmflg & SHM_RDONLY)
5172 perms = SHM__READ;
5173 else
5174 perms = SHM__READ | SHM__WRITE;
5175
5176 return ipc_has_perm(&shp->shm_perm, perms);
5177 }
5178
5179 /* Semaphore security operations */
5180 static int selinux_sem_alloc_security(struct sem_array *sma)
5181 {
5182 struct ipc_security_struct *isec;
5183 struct common_audit_data ad;
5184 u32 sid = current_sid();
5185 int rc;
5186
5187 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5188 if (rc)
5189 return rc;
5190
5191 isec = sma->sem_perm.security;
5192
5193 ad.type = LSM_AUDIT_DATA_IPC;
5194 ad.u.ipc_id = sma->sem_perm.key;
5195
5196 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5197 SEM__CREATE, &ad);
5198 if (rc) {
5199 ipc_free_security(&sma->sem_perm);
5200 return rc;
5201 }
5202 return 0;
5203 }
5204
5205 static void selinux_sem_free_security(struct sem_array *sma)
5206 {
5207 ipc_free_security(&sma->sem_perm);
5208 }
5209
5210 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5211 {
5212 struct ipc_security_struct *isec;
5213 struct common_audit_data ad;
5214 u32 sid = current_sid();
5215
5216 isec = sma->sem_perm.security;
5217
5218 ad.type = LSM_AUDIT_DATA_IPC;
5219 ad.u.ipc_id = sma->sem_perm.key;
5220
5221 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5222 SEM__ASSOCIATE, &ad);
5223 }
5224
5225 /* Note, at this point, sma is locked down */
5226 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5227 {
5228 int err;
5229 u32 perms;
5230
5231 switch (cmd) {
5232 case IPC_INFO:
5233 case SEM_INFO:
5234 /* No specific object, just general system-wide information. */
5235 return task_has_system(current, SYSTEM__IPC_INFO);
5236 case GETPID:
5237 case GETNCNT:
5238 case GETZCNT:
5239 perms = SEM__GETATTR;
5240 break;
5241 case GETVAL:
5242 case GETALL:
5243 perms = SEM__READ;
5244 break;
5245 case SETVAL:
5246 case SETALL:
5247 perms = SEM__WRITE;
5248 break;
5249 case IPC_RMID:
5250 perms = SEM__DESTROY;
5251 break;
5252 case IPC_SET:
5253 perms = SEM__SETATTR;
5254 break;
5255 case IPC_STAT:
5256 case SEM_STAT:
5257 perms = SEM__GETATTR | SEM__ASSOCIATE;
5258 break;
5259 default:
5260 return 0;
5261 }
5262
5263 err = ipc_has_perm(&sma->sem_perm, perms);
5264 return err;
5265 }
5266
5267 static int selinux_sem_semop(struct sem_array *sma,
5268 struct sembuf *sops, unsigned nsops, int alter)
5269 {
5270 u32 perms;
5271
5272 if (alter)
5273 perms = SEM__READ | SEM__WRITE;
5274 else
5275 perms = SEM__READ;
5276
5277 return ipc_has_perm(&sma->sem_perm, perms);
5278 }
5279
5280 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5281 {
5282 u32 av = 0;
5283
5284 av = 0;
5285 if (flag & S_IRUGO)
5286 av |= IPC__UNIX_READ;
5287 if (flag & S_IWUGO)
5288 av |= IPC__UNIX_WRITE;
5289
5290 if (av == 0)
5291 return 0;
5292
5293 return ipc_has_perm(ipcp, av);
5294 }
5295
5296 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5297 {
5298 struct ipc_security_struct *isec = ipcp->security;
5299 *secid = isec->sid;
5300 }
5301
5302 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5303 {
5304 if (inode)
5305 inode_doinit_with_dentry(inode, dentry);
5306 }
5307
5308 static int selinux_getprocattr(struct task_struct *p,
5309 char *name, char **value)
5310 {
5311 const struct task_security_struct *__tsec;
5312 u32 sid;
5313 int error;
5314 unsigned len;
5315
5316 if (current != p) {
5317 error = current_has_perm(p, PROCESS__GETATTR);
5318 if (error)
5319 return error;
5320 }
5321
5322 rcu_read_lock();
5323 __tsec = __task_cred(p)->security;
5324
5325 if (!strcmp(name, "current"))
5326 sid = __tsec->sid;
5327 else if (!strcmp(name, "prev"))
5328 sid = __tsec->osid;
5329 else if (!strcmp(name, "exec"))
5330 sid = __tsec->exec_sid;
5331 else if (!strcmp(name, "fscreate"))
5332 sid = __tsec->create_sid;
5333 else if (!strcmp(name, "keycreate"))
5334 sid = __tsec->keycreate_sid;
5335 else if (!strcmp(name, "sockcreate"))
5336 sid = __tsec->sockcreate_sid;
5337 else
5338 goto invalid;
5339 rcu_read_unlock();
5340
5341 if (!sid)
5342 return 0;
5343
5344 error = security_sid_to_context(sid, value, &len);
5345 if (error)
5346 return error;
5347 return len;
5348
5349 invalid:
5350 rcu_read_unlock();
5351 return -EINVAL;
5352 }
5353
5354 static int selinux_setprocattr(struct task_struct *p,
5355 char *name, void *value, size_t size)
5356 {
5357 struct task_security_struct *tsec;
5358 struct task_struct *tracer;
5359 struct cred *new;
5360 u32 sid = 0, ptsid;
5361 int error;
5362 char *str = value;
5363
5364 if (current != p) {
5365 /* SELinux only allows a process to change its own
5366 security attributes. */
5367 return -EACCES;
5368 }
5369
5370 /*
5371 * Basic control over ability to set these attributes at all.
5372 * current == p, but we'll pass them separately in case the
5373 * above restriction is ever removed.
5374 */
5375 if (!strcmp(name, "exec"))
5376 error = current_has_perm(p, PROCESS__SETEXEC);
5377 else if (!strcmp(name, "fscreate"))
5378 error = current_has_perm(p, PROCESS__SETFSCREATE);
5379 else if (!strcmp(name, "keycreate"))
5380 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5381 else if (!strcmp(name, "sockcreate"))
5382 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5383 else if (!strcmp(name, "current"))
5384 error = current_has_perm(p, PROCESS__SETCURRENT);
5385 else
5386 error = -EINVAL;
5387 if (error)
5388 return error;
5389
5390 /* Obtain a SID for the context, if one was specified. */
5391 if (size && str[1] && str[1] != '\n') {
5392 if (str[size-1] == '\n') {
5393 str[size-1] = 0;
5394 size--;
5395 }
5396 error = security_context_to_sid(value, size, &sid);
5397 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5398 if (!capable(CAP_MAC_ADMIN)) {
5399 struct audit_buffer *ab;
5400 size_t audit_size;
5401
5402 /* We strip a nul only if it is at the end, otherwise the
5403 * context contains a nul and we should audit that */
5404 if (str[size - 1] == '\0')
5405 audit_size = size - 1;
5406 else
5407 audit_size = size;
5408 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5409 audit_log_format(ab, "op=fscreate invalid_context=");
5410 audit_log_n_untrustedstring(ab, value, audit_size);
5411 audit_log_end(ab);
5412
5413 return error;
5414 }
5415 error = security_context_to_sid_force(value, size,
5416 &sid);
5417 }
5418 if (error)
5419 return error;
5420 }
5421
5422 new = prepare_creds();
5423 if (!new)
5424 return -ENOMEM;
5425
5426 /* Permission checking based on the specified context is
5427 performed during the actual operation (execve,
5428 open/mkdir/...), when we know the full context of the
5429 operation. See selinux_bprm_set_creds for the execve
5430 checks and may_create for the file creation checks. The
5431 operation will then fail if the context is not permitted. */
5432 tsec = new->security;
5433 if (!strcmp(name, "exec")) {
5434 tsec->exec_sid = sid;
5435 } else if (!strcmp(name, "fscreate")) {
5436 tsec->create_sid = sid;
5437 } else if (!strcmp(name, "keycreate")) {
5438 error = may_create_key(sid, p);
5439 if (error)
5440 goto abort_change;
5441 tsec->keycreate_sid = sid;
5442 } else if (!strcmp(name, "sockcreate")) {
5443 tsec->sockcreate_sid = sid;
5444 } else if (!strcmp(name, "current")) {
5445 error = -EINVAL;
5446 if (sid == 0)
5447 goto abort_change;
5448
5449 /* Only allow single threaded processes to change context */
5450 error = -EPERM;
5451 if (!current_is_single_threaded()) {
5452 error = security_bounded_transition(tsec->sid, sid);
5453 if (error)
5454 goto abort_change;
5455 }
5456
5457 /* Check permissions for the transition. */
5458 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5459 PROCESS__DYNTRANSITION, NULL);
5460 if (error)
5461 goto abort_change;
5462
5463 /* Check for ptracing, and update the task SID if ok.
5464 Otherwise, leave SID unchanged and fail. */
5465 ptsid = 0;
5466 task_lock(p);
5467 tracer = ptrace_parent(p);
5468 if (tracer)
5469 ptsid = task_sid(tracer);
5470 task_unlock(p);
5471
5472 if (tracer) {
5473 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5474 PROCESS__PTRACE, NULL);
5475 if (error)
5476 goto abort_change;
5477 }
5478
5479 tsec->sid = sid;
5480 } else {
5481 error = -EINVAL;
5482 goto abort_change;
5483 }
5484
5485 commit_creds(new);
5486 return size;
5487
5488 abort_change:
5489 abort_creds(new);
5490 return error;
5491 }
5492
5493 static int selinux_ismaclabel(const char *name)
5494 {
5495 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5496 }
5497
5498 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5499 {
5500 return security_sid_to_context(secid, secdata, seclen);
5501 }
5502
5503 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5504 {
5505 return security_context_to_sid(secdata, seclen, secid);
5506 }
5507
5508 static void selinux_release_secctx(char *secdata, u32 seclen)
5509 {
5510 kfree(secdata);
5511 }
5512
5513 /*
5514 * called with inode->i_mutex locked
5515 */
5516 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5517 {
5518 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5519 }
5520
5521 /*
5522 * called with inode->i_mutex locked
5523 */
5524 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5525 {
5526 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5527 }
5528
5529 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5530 {
5531 int len = 0;
5532 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5533 ctx, true);
5534 if (len < 0)
5535 return len;
5536 *ctxlen = len;
5537 return 0;
5538 }
5539 #ifdef CONFIG_KEYS
5540
5541 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5542 unsigned long flags)
5543 {
5544 const struct task_security_struct *tsec;
5545 struct key_security_struct *ksec;
5546
5547 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5548 if (!ksec)
5549 return -ENOMEM;
5550
5551 tsec = cred->security;
5552 if (tsec->keycreate_sid)
5553 ksec->sid = tsec->keycreate_sid;
5554 else
5555 ksec->sid = tsec->sid;
5556
5557 k->security = ksec;
5558 return 0;
5559 }
5560
5561 static void selinux_key_free(struct key *k)
5562 {
5563 struct key_security_struct *ksec = k->security;
5564
5565 k->security = NULL;
5566 kfree(ksec);
5567 }
5568
5569 static int selinux_key_permission(key_ref_t key_ref,
5570 const struct cred *cred,
5571 key_perm_t perm)
5572 {
5573 struct key *key;
5574 struct key_security_struct *ksec;
5575 u32 sid;
5576
5577 /* if no specific permissions are requested, we skip the
5578 permission check. No serious, additional covert channels
5579 appear to be created. */
5580 if (perm == 0)
5581 return 0;
5582
5583 sid = cred_sid(cred);
5584
5585 key = key_ref_to_ptr(key_ref);
5586 ksec = key->security;
5587
5588 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5589 }
5590
5591 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5592 {
5593 struct key_security_struct *ksec = key->security;
5594 char *context = NULL;
5595 unsigned len;
5596 int rc;
5597
5598 rc = security_sid_to_context(ksec->sid, &context, &len);
5599 if (!rc)
5600 rc = len;
5601 *_buffer = context;
5602 return rc;
5603 }
5604
5605 #endif
5606
5607 static struct security_operations selinux_ops = {
5608 .name = "selinux",
5609
5610 .ptrace_access_check = selinux_ptrace_access_check,
5611 .ptrace_traceme = selinux_ptrace_traceme,
5612 .capget = selinux_capget,
5613 .capset = selinux_capset,
5614 .capable = selinux_capable,
5615 .quotactl = selinux_quotactl,
5616 .quota_on = selinux_quota_on,
5617 .syslog = selinux_syslog,
5618 .vm_enough_memory = selinux_vm_enough_memory,
5619
5620 .netlink_send = selinux_netlink_send,
5621
5622 .bprm_set_creds = selinux_bprm_set_creds,
5623 .bprm_committing_creds = selinux_bprm_committing_creds,
5624 .bprm_committed_creds = selinux_bprm_committed_creds,
5625 .bprm_secureexec = selinux_bprm_secureexec,
5626
5627 .sb_alloc_security = selinux_sb_alloc_security,
5628 .sb_free_security = selinux_sb_free_security,
5629 .sb_copy_data = selinux_sb_copy_data,
5630 .sb_remount = selinux_sb_remount,
5631 .sb_kern_mount = selinux_sb_kern_mount,
5632 .sb_show_options = selinux_sb_show_options,
5633 .sb_statfs = selinux_sb_statfs,
5634 .sb_mount = selinux_mount,
5635 .sb_umount = selinux_umount,
5636 .sb_set_mnt_opts = selinux_set_mnt_opts,
5637 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5638 .sb_parse_opts_str = selinux_parse_opts_str,
5639
5640 .dentry_init_security = selinux_dentry_init_security,
5641
5642 .inode_alloc_security = selinux_inode_alloc_security,
5643 .inode_free_security = selinux_inode_free_security,
5644 .inode_init_security = selinux_inode_init_security,
5645 .inode_create = selinux_inode_create,
5646 .inode_link = selinux_inode_link,
5647 .inode_unlink = selinux_inode_unlink,
5648 .inode_symlink = selinux_inode_symlink,
5649 .inode_mkdir = selinux_inode_mkdir,
5650 .inode_rmdir = selinux_inode_rmdir,
5651 .inode_mknod = selinux_inode_mknod,
5652 .inode_rename = selinux_inode_rename,
5653 .inode_readlink = selinux_inode_readlink,
5654 .inode_follow_link = selinux_inode_follow_link,
5655 .inode_permission = selinux_inode_permission,
5656 .inode_setattr = selinux_inode_setattr,
5657 .inode_getattr = selinux_inode_getattr,
5658 .inode_setxattr = selinux_inode_setxattr,
5659 .inode_post_setxattr = selinux_inode_post_setxattr,
5660 .inode_getxattr = selinux_inode_getxattr,
5661 .inode_listxattr = selinux_inode_listxattr,
5662 .inode_removexattr = selinux_inode_removexattr,
5663 .inode_getsecurity = selinux_inode_getsecurity,
5664 .inode_setsecurity = selinux_inode_setsecurity,
5665 .inode_listsecurity = selinux_inode_listsecurity,
5666 .inode_getsecid = selinux_inode_getsecid,
5667
5668 .file_permission = selinux_file_permission,
5669 .file_alloc_security = selinux_file_alloc_security,
5670 .file_free_security = selinux_file_free_security,
5671 .file_ioctl = selinux_file_ioctl,
5672 .mmap_file = selinux_mmap_file,
5673 .mmap_addr = selinux_mmap_addr,
5674 .file_mprotect = selinux_file_mprotect,
5675 .file_lock = selinux_file_lock,
5676 .file_fcntl = selinux_file_fcntl,
5677 .file_set_fowner = selinux_file_set_fowner,
5678 .file_send_sigiotask = selinux_file_send_sigiotask,
5679 .file_receive = selinux_file_receive,
5680
5681 .file_open = selinux_file_open,
5682
5683 .task_create = selinux_task_create,
5684 .cred_alloc_blank = selinux_cred_alloc_blank,
5685 .cred_free = selinux_cred_free,
5686 .cred_prepare = selinux_cred_prepare,
5687 .cred_transfer = selinux_cred_transfer,
5688 .kernel_act_as = selinux_kernel_act_as,
5689 .kernel_create_files_as = selinux_kernel_create_files_as,
5690 .kernel_module_request = selinux_kernel_module_request,
5691 .task_setpgid = selinux_task_setpgid,
5692 .task_getpgid = selinux_task_getpgid,
5693 .task_getsid = selinux_task_getsid,
5694 .task_getsecid = selinux_task_getsecid,
5695 .task_setnice = selinux_task_setnice,
5696 .task_setioprio = selinux_task_setioprio,
5697 .task_getioprio = selinux_task_getioprio,
5698 .task_setrlimit = selinux_task_setrlimit,
5699 .task_setscheduler = selinux_task_setscheduler,
5700 .task_getscheduler = selinux_task_getscheduler,
5701 .task_movememory = selinux_task_movememory,
5702 .task_kill = selinux_task_kill,
5703 .task_wait = selinux_task_wait,
5704 .task_to_inode = selinux_task_to_inode,
5705
5706 .ipc_permission = selinux_ipc_permission,
5707 .ipc_getsecid = selinux_ipc_getsecid,
5708
5709 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5710 .msg_msg_free_security = selinux_msg_msg_free_security,
5711
5712 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5713 .msg_queue_free_security = selinux_msg_queue_free_security,
5714 .msg_queue_associate = selinux_msg_queue_associate,
5715 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5716 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5717 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5718
5719 .shm_alloc_security = selinux_shm_alloc_security,
5720 .shm_free_security = selinux_shm_free_security,
5721 .shm_associate = selinux_shm_associate,
5722 .shm_shmctl = selinux_shm_shmctl,
5723 .shm_shmat = selinux_shm_shmat,
5724
5725 .sem_alloc_security = selinux_sem_alloc_security,
5726 .sem_free_security = selinux_sem_free_security,
5727 .sem_associate = selinux_sem_associate,
5728 .sem_semctl = selinux_sem_semctl,
5729 .sem_semop = selinux_sem_semop,
5730
5731 .d_instantiate = selinux_d_instantiate,
5732
5733 .getprocattr = selinux_getprocattr,
5734 .setprocattr = selinux_setprocattr,
5735
5736 .ismaclabel = selinux_ismaclabel,
5737 .secid_to_secctx = selinux_secid_to_secctx,
5738 .secctx_to_secid = selinux_secctx_to_secid,
5739 .release_secctx = selinux_release_secctx,
5740 .inode_notifysecctx = selinux_inode_notifysecctx,
5741 .inode_setsecctx = selinux_inode_setsecctx,
5742 .inode_getsecctx = selinux_inode_getsecctx,
5743
5744 .unix_stream_connect = selinux_socket_unix_stream_connect,
5745 .unix_may_send = selinux_socket_unix_may_send,
5746
5747 .socket_create = selinux_socket_create,
5748 .socket_post_create = selinux_socket_post_create,
5749 .socket_bind = selinux_socket_bind,
5750 .socket_connect = selinux_socket_connect,
5751 .socket_listen = selinux_socket_listen,
5752 .socket_accept = selinux_socket_accept,
5753 .socket_sendmsg = selinux_socket_sendmsg,
5754 .socket_recvmsg = selinux_socket_recvmsg,
5755 .socket_getsockname = selinux_socket_getsockname,
5756 .socket_getpeername = selinux_socket_getpeername,
5757 .socket_getsockopt = selinux_socket_getsockopt,
5758 .socket_setsockopt = selinux_socket_setsockopt,
5759 .socket_shutdown = selinux_socket_shutdown,
5760 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5761 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5762 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5763 .sk_alloc_security = selinux_sk_alloc_security,
5764 .sk_free_security = selinux_sk_free_security,
5765 .sk_clone_security = selinux_sk_clone_security,
5766 .sk_getsecid = selinux_sk_getsecid,
5767 .sock_graft = selinux_sock_graft,
5768 .inet_conn_request = selinux_inet_conn_request,
5769 .inet_csk_clone = selinux_inet_csk_clone,
5770 .inet_conn_established = selinux_inet_conn_established,
5771 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5772 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5773 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5774 .req_classify_flow = selinux_req_classify_flow,
5775 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5776 .tun_dev_free_security = selinux_tun_dev_free_security,
5777 .tun_dev_create = selinux_tun_dev_create,
5778 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5779 .tun_dev_attach = selinux_tun_dev_attach,
5780 .tun_dev_open = selinux_tun_dev_open,
5781 .skb_owned_by = selinux_skb_owned_by,
5782
5783 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5784 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5785 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5786 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5787 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5788 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5789 .xfrm_state_free_security = selinux_xfrm_state_free,
5790 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5791 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5792 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5793 .xfrm_decode_session = selinux_xfrm_decode_session,
5794 #endif
5795
5796 #ifdef CONFIG_KEYS
5797 .key_alloc = selinux_key_alloc,
5798 .key_free = selinux_key_free,
5799 .key_permission = selinux_key_permission,
5800 .key_getsecurity = selinux_key_getsecurity,
5801 #endif
5802
5803 #ifdef CONFIG_AUDIT
5804 .audit_rule_init = selinux_audit_rule_init,
5805 .audit_rule_known = selinux_audit_rule_known,
5806 .audit_rule_match = selinux_audit_rule_match,
5807 .audit_rule_free = selinux_audit_rule_free,
5808 #endif
5809 };
5810
5811 static __init int selinux_init(void)
5812 {
5813 if (!security_module_enable(&selinux_ops)) {
5814 selinux_enabled = 0;
5815 return 0;
5816 }
5817
5818 if (!selinux_enabled) {
5819 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5820 return 0;
5821 }
5822
5823 printk(KERN_INFO "SELinux: Initializing.\n");
5824
5825 /* Set the security state for the initial task. */
5826 cred_init_security();
5827
5828 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5829
5830 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5831 sizeof(struct inode_security_struct),
5832 0, SLAB_PANIC, NULL);
5833 avc_init();
5834
5835 if (register_security(&selinux_ops))
5836 panic("SELinux: Unable to register with kernel.\n");
5837
5838 if (selinux_enforcing)
5839 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5840 else
5841 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5842
5843 return 0;
5844 }
5845
5846 static void delayed_superblock_init(struct super_block *sb, void *unused)
5847 {
5848 superblock_doinit(sb, NULL);
5849 }
5850
5851 void selinux_complete_init(void)
5852 {
5853 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5854
5855 /* Set up any superblocks initialized prior to the policy load. */
5856 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5857 iterate_supers(delayed_superblock_init, NULL);
5858 }
5859
5860 /* SELinux requires early initialization in order to label
5861 all processes and objects when they are created. */
5862 security_initcall(selinux_init);
5863
5864 #if defined(CONFIG_NETFILTER)
5865
5866 static struct nf_hook_ops selinux_ipv4_ops[] = {
5867 {
5868 .hook = selinux_ipv4_postroute,
5869 .owner = THIS_MODULE,
5870 .pf = NFPROTO_IPV4,
5871 .hooknum = NF_INET_POST_ROUTING,
5872 .priority = NF_IP_PRI_SELINUX_LAST,
5873 },
5874 {
5875 .hook = selinux_ipv4_forward,
5876 .owner = THIS_MODULE,
5877 .pf = NFPROTO_IPV4,
5878 .hooknum = NF_INET_FORWARD,
5879 .priority = NF_IP_PRI_SELINUX_FIRST,
5880 },
5881 {
5882 .hook = selinux_ipv4_output,
5883 .owner = THIS_MODULE,
5884 .pf = NFPROTO_IPV4,
5885 .hooknum = NF_INET_LOCAL_OUT,
5886 .priority = NF_IP_PRI_SELINUX_FIRST,
5887 }
5888 };
5889
5890 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5891
5892 static struct nf_hook_ops selinux_ipv6_ops[] = {
5893 {
5894 .hook = selinux_ipv6_postroute,
5895 .owner = THIS_MODULE,
5896 .pf = NFPROTO_IPV6,
5897 .hooknum = NF_INET_POST_ROUTING,
5898 .priority = NF_IP6_PRI_SELINUX_LAST,
5899 },
5900 {
5901 .hook = selinux_ipv6_forward,
5902 .owner = THIS_MODULE,
5903 .pf = NFPROTO_IPV6,
5904 .hooknum = NF_INET_FORWARD,
5905 .priority = NF_IP6_PRI_SELINUX_FIRST,
5906 }
5907 };
5908
5909 #endif /* IPV6 */
5910
5911 static int __init selinux_nf_ip_init(void)
5912 {
5913 int err = 0;
5914
5915 if (!selinux_enabled)
5916 goto out;
5917
5918 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5919
5920 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5921 if (err)
5922 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5923
5924 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5925 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5926 if (err)
5927 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5928 #endif /* IPV6 */
5929
5930 out:
5931 return err;
5932 }
5933
5934 __initcall(selinux_nf_ip_init);
5935
5936 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5937 static void selinux_nf_ip_exit(void)
5938 {
5939 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5940
5941 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5942 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5943 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5944 #endif /* IPV6 */
5945 }
5946 #endif
5947
5948 #else /* CONFIG_NETFILTER */
5949
5950 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5951 #define selinux_nf_ip_exit()
5952 #endif
5953
5954 #endif /* CONFIG_NETFILTER */
5955
5956 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5957 static int selinux_disabled;
5958
5959 int selinux_disable(void)
5960 {
5961 if (ss_initialized) {
5962 /* Not permitted after initial policy load. */
5963 return -EINVAL;
5964 }
5965
5966 if (selinux_disabled) {
5967 /* Only do this once. */
5968 return -EINVAL;
5969 }
5970
5971 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5972
5973 selinux_disabled = 1;
5974 selinux_enabled = 0;
5975
5976 reset_security_ops();
5977
5978 /* Try to destroy the avc node cache */
5979 avc_disable();
5980
5981 /* Unregister netfilter hooks. */
5982 selinux_nf_ip_exit();
5983
5984 /* Unregister selinuxfs. */
5985 exit_sel_fs();
5986
5987 return 0;
5988 }
5989 #endif
Linux kernel - Deliverables
This page took 0.166653 seconds and 5 git commands to generate.