projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge remote-tracking branch 'airlied/drm-next' into topic/vblank-rework
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 extern struct security_operations *security_ops;
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!kstrtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!kstrtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132
133 /**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled. If the always_check_network
141 * policy capability is enabled, SECMARK is always considered enabled.
142 *
143 */
144 static int selinux_secmark_enabled(void)
145 {
146 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
147 }
148
149 /**
150 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 *
152 * Description:
153 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
154 * (1) if any are enabled or false (0) if neither are enabled. If the
155 * always_check_network policy capability is enabled, peer labeling
156 * is always considered enabled.
157 *
158 */
159 static int selinux_peerlbl_enabled(void)
160 {
161 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
162 }
163
164 static int selinux_netcache_avc_callback(u32 event)
165 {
166 if (event == AVC_CALLBACK_RESET) {
167 sel_netif_flush();
168 sel_netnode_flush();
169 sel_netport_flush();
170 synchronize_net();
171 }
172 return 0;
173 }
174
175 /*
176 * initialise the security for the init task
177 */
178 static void cred_init_security(void)
179 {
180 struct cred *cred = (struct cred *) current->real_cred;
181 struct task_security_struct *tsec;
182
183 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
184 if (!tsec)
185 panic("SELinux: Failed to initialize initial task.\n");
186
187 tsec->osid = tsec->sid = SECINITSID_KERNEL;
188 cred->security = tsec;
189 }
190
191 /*
192 * get the security ID of a set of credentials
193 */
194 static inline u32 cred_sid(const struct cred *cred)
195 {
196 const struct task_security_struct *tsec;
197
198 tsec = cred->security;
199 return tsec->sid;
200 }
201
202 /*
203 * get the objective security ID of a task
204 */
205 static inline u32 task_sid(const struct task_struct *task)
206 {
207 u32 sid;
208
209 rcu_read_lock();
210 sid = cred_sid(__task_cred(task));
211 rcu_read_unlock();
212 return sid;
213 }
214
215 /*
216 * get the subjective security ID of the current task
217 */
218 static inline u32 current_sid(void)
219 {
220 const struct task_security_struct *tsec = current_security();
221
222 return tsec->sid;
223 }
224
225 /* Allocate and free functions for each kind of security blob. */
226
227 static int inode_alloc_security(struct inode *inode)
228 {
229 struct inode_security_struct *isec;
230 u32 sid = current_sid();
231
232 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
233 if (!isec)
234 return -ENOMEM;
235
236 mutex_init(&isec->lock);
237 INIT_LIST_HEAD(&isec->list);
238 isec->inode = inode;
239 isec->sid = SECINITSID_UNLABELED;
240 isec->sclass = SECCLASS_FILE;
241 isec->task_sid = sid;
242 inode->i_security = isec;
243
244 return 0;
245 }
246
247 static void inode_free_rcu(struct rcu_head *head)
248 {
249 struct inode_security_struct *isec;
250
251 isec = container_of(head, struct inode_security_struct, rcu);
252 kmem_cache_free(sel_inode_cache, isec);
253 }
254
255 static void inode_free_security(struct inode *inode)
256 {
257 struct inode_security_struct *isec = inode->i_security;
258 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
259
260 spin_lock(&sbsec->isec_lock);
261 if (!list_empty(&isec->list))
262 list_del_init(&isec->list);
263 spin_unlock(&sbsec->isec_lock);
264
265 /*
266 * The inode may still be referenced in a path walk and
267 * a call to selinux_inode_permission() can be made
268 * after inode_free_security() is called. Ideally, the VFS
269 * wouldn't do this, but fixing that is a much harder
270 * job. For now, simply free the i_security via RCU, and
271 * leave the current inode->i_security pointer intact.
272 * The inode will be freed after the RCU grace period too.
273 */
274 call_rcu(&isec->rcu, inode_free_rcu);
275 }
276
277 static int file_alloc_security(struct file *file)
278 {
279 struct file_security_struct *fsec;
280 u32 sid = current_sid();
281
282 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
283 if (!fsec)
284 return -ENOMEM;
285
286 fsec->sid = sid;
287 fsec->fown_sid = sid;
288 file->f_security = fsec;
289
290 return 0;
291 }
292
293 static void file_free_security(struct file *file)
294 {
295 struct file_security_struct *fsec = file->f_security;
296 file->f_security = NULL;
297 kfree(fsec);
298 }
299
300 static int superblock_alloc_security(struct super_block *sb)
301 {
302 struct superblock_security_struct *sbsec;
303
304 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
305 if (!sbsec)
306 return -ENOMEM;
307
308 mutex_init(&sbsec->lock);
309 INIT_LIST_HEAD(&sbsec->isec_head);
310 spin_lock_init(&sbsec->isec_lock);
311 sbsec->sb = sb;
312 sbsec->sid = SECINITSID_UNLABELED;
313 sbsec->def_sid = SECINITSID_FILE;
314 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
315 sb->s_security = sbsec;
316
317 return 0;
318 }
319
320 static void superblock_free_security(struct super_block *sb)
321 {
322 struct superblock_security_struct *sbsec = sb->s_security;
323 sb->s_security = NULL;
324 kfree(sbsec);
325 }
326
327 /* The file system's label must be initialized prior to use. */
328
329 static const char *labeling_behaviors[7] = {
330 "uses xattr",
331 "uses transition SIDs",
332 "uses task SIDs",
333 "uses genfs_contexts",
334 "not configured for labeling",
335 "uses mountpoint labeling",
336 "uses native labeling",
337 };
338
339 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
340
341 static inline int inode_doinit(struct inode *inode)
342 {
343 return inode_doinit_with_dentry(inode, NULL);
344 }
345
346 enum {
347 Opt_error = -1,
348 Opt_context = 1,
349 Opt_fscontext = 2,
350 Opt_defcontext = 3,
351 Opt_rootcontext = 4,
352 Opt_labelsupport = 5,
353 Opt_nextmntopt = 6,
354 };
355
356 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
357
358 static const match_table_t tokens = {
359 {Opt_context, CONTEXT_STR "%s"},
360 {Opt_fscontext, FSCONTEXT_STR "%s"},
361 {Opt_defcontext, DEFCONTEXT_STR "%s"},
362 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
363 {Opt_labelsupport, LABELSUPP_STR},
364 {Opt_error, NULL},
365 };
366
367 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
368
369 static int may_context_mount_sb_relabel(u32 sid,
370 struct superblock_security_struct *sbsec,
371 const struct cred *cred)
372 {
373 const struct task_security_struct *tsec = cred->security;
374 int rc;
375
376 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
377 FILESYSTEM__RELABELFROM, NULL);
378 if (rc)
379 return rc;
380
381 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
382 FILESYSTEM__RELABELTO, NULL);
383 return rc;
384 }
385
386 static int may_context_mount_inode_relabel(u32 sid,
387 struct superblock_security_struct *sbsec,
388 const struct cred *cred)
389 {
390 const struct task_security_struct *tsec = cred->security;
391 int rc;
392 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
393 FILESYSTEM__RELABELFROM, NULL);
394 if (rc)
395 return rc;
396
397 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
398 FILESYSTEM__ASSOCIATE, NULL);
399 return rc;
400 }
401
402 static int selinux_is_sblabel_mnt(struct super_block *sb)
403 {
404 struct superblock_security_struct *sbsec = sb->s_security;
405
406 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
407 sbsec->behavior == SECURITY_FS_USE_TRANS ||
408 sbsec->behavior == SECURITY_FS_USE_TASK)
409 return 1;
410
411 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
412 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
413 return 1;
414
415 /*
416 * Special handling for rootfs. Is genfs but supports
417 * setting SELinux context on in-core inodes.
418 */
419 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
420 return 1;
421
422 return 0;
423 }
424
425 static int sb_finish_set_opts(struct super_block *sb)
426 {
427 struct superblock_security_struct *sbsec = sb->s_security;
428 struct dentry *root = sb->s_root;
429 struct inode *root_inode = root->d_inode;
430 int rc = 0;
431
432 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
433 /* Make sure that the xattr handler exists and that no
434 error other than -ENODATA is returned by getxattr on
435 the root directory. -ENODATA is ok, as this may be
436 the first boot of the SELinux kernel before we have
437 assigned xattr values to the filesystem. */
438 if (!root_inode->i_op->getxattr) {
439 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
440 "xattr support\n", sb->s_id, sb->s_type->name);
441 rc = -EOPNOTSUPP;
442 goto out;
443 }
444 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
445 if (rc < 0 && rc != -ENODATA) {
446 if (rc == -EOPNOTSUPP)
447 printk(KERN_WARNING "SELinux: (dev %s, type "
448 "%s) has no security xattr handler\n",
449 sb->s_id, sb->s_type->name);
450 else
451 printk(KERN_WARNING "SELinux: (dev %s, type "
452 "%s) getxattr errno %d\n", sb->s_id,
453 sb->s_type->name, -rc);
454 goto out;
455 }
456 }
457
458 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
459 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
460 sb->s_id, sb->s_type->name);
461 else
462 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
463 sb->s_id, sb->s_type->name,
464 labeling_behaviors[sbsec->behavior-1]);
465
466 sbsec->flags |= SE_SBINITIALIZED;
467 if (selinux_is_sblabel_mnt(sb))
468 sbsec->flags |= SBLABEL_MNT;
469
470 /* Initialize the root inode. */
471 rc = inode_doinit_with_dentry(root_inode, root);
472
473 /* Initialize any other inodes associated with the superblock, e.g.
474 inodes created prior to initial policy load or inodes created
475 during get_sb by a pseudo filesystem that directly
476 populates itself. */
477 spin_lock(&sbsec->isec_lock);
478 next_inode:
479 if (!list_empty(&sbsec->isec_head)) {
480 struct inode_security_struct *isec =
481 list_entry(sbsec->isec_head.next,
482 struct inode_security_struct, list);
483 struct inode *inode = isec->inode;
484 spin_unlock(&sbsec->isec_lock);
485 inode = igrab(inode);
486 if (inode) {
487 if (!IS_PRIVATE(inode))
488 inode_doinit(inode);
489 iput(inode);
490 }
491 spin_lock(&sbsec->isec_lock);
492 list_del_init(&isec->list);
493 goto next_inode;
494 }
495 spin_unlock(&sbsec->isec_lock);
496 out:
497 return rc;
498 }
499
500 /*
501 * This function should allow an FS to ask what it's mount security
502 * options were so it can use those later for submounts, displaying
503 * mount options, or whatever.
504 */
505 static int selinux_get_mnt_opts(const struct super_block *sb,
506 struct security_mnt_opts *opts)
507 {
508 int rc = 0, i;
509 struct superblock_security_struct *sbsec = sb->s_security;
510 char *context = NULL;
511 u32 len;
512 char tmp;
513
514 security_init_mnt_opts(opts);
515
516 if (!(sbsec->flags & SE_SBINITIALIZED))
517 return -EINVAL;
518
519 if (!ss_initialized)
520 return -EINVAL;
521
522 /* make sure we always check enough bits to cover the mask */
523 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
524
525 tmp = sbsec->flags & SE_MNTMASK;
526 /* count the number of mount options for this sb */
527 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
528 if (tmp & 0x01)
529 opts->num_mnt_opts++;
530 tmp >>= 1;
531 }
532 /* Check if the Label support flag is set */
533 if (sbsec->flags & SBLABEL_MNT)
534 opts->num_mnt_opts++;
535
536 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
537 if (!opts->mnt_opts) {
538 rc = -ENOMEM;
539 goto out_free;
540 }
541
542 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
543 if (!opts->mnt_opts_flags) {
544 rc = -ENOMEM;
545 goto out_free;
546 }
547
548 i = 0;
549 if (sbsec->flags & FSCONTEXT_MNT) {
550 rc = security_sid_to_context(sbsec->sid, &context, &len);
551 if (rc)
552 goto out_free;
553 opts->mnt_opts[i] = context;
554 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
555 }
556 if (sbsec->flags & CONTEXT_MNT) {
557 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
558 if (rc)
559 goto out_free;
560 opts->mnt_opts[i] = context;
561 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
562 }
563 if (sbsec->flags & DEFCONTEXT_MNT) {
564 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
565 if (rc)
566 goto out_free;
567 opts->mnt_opts[i] = context;
568 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
569 }
570 if (sbsec->flags & ROOTCONTEXT_MNT) {
571 struct inode *root = sbsec->sb->s_root->d_inode;
572 struct inode_security_struct *isec = root->i_security;
573
574 rc = security_sid_to_context(isec->sid, &context, &len);
575 if (rc)
576 goto out_free;
577 opts->mnt_opts[i] = context;
578 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
579 }
580 if (sbsec->flags & SBLABEL_MNT) {
581 opts->mnt_opts[i] = NULL;
582 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
583 }
584
585 BUG_ON(i != opts->num_mnt_opts);
586
587 return 0;
588
589 out_free:
590 security_free_mnt_opts(opts);
591 return rc;
592 }
593
594 static int bad_option(struct superblock_security_struct *sbsec, char flag,
595 u32 old_sid, u32 new_sid)
596 {
597 char mnt_flags = sbsec->flags & SE_MNTMASK;
598
599 /* check if the old mount command had the same options */
600 if (sbsec->flags & SE_SBINITIALIZED)
601 if (!(sbsec->flags & flag) ||
602 (old_sid != new_sid))
603 return 1;
604
605 /* check if we were passed the same options twice,
606 * aka someone passed context=a,context=b
607 */
608 if (!(sbsec->flags & SE_SBINITIALIZED))
609 if (mnt_flags & flag)
610 return 1;
611 return 0;
612 }
613
614 /*
615 * Allow filesystems with binary mount data to explicitly set mount point
616 * labeling information.
617 */
618 static int selinux_set_mnt_opts(struct super_block *sb,
619 struct security_mnt_opts *opts,
620 unsigned long kern_flags,
621 unsigned long *set_kern_flags)
622 {
623 const struct cred *cred = current_cred();
624 int rc = 0, i;
625 struct superblock_security_struct *sbsec = sb->s_security;
626 const char *name = sb->s_type->name;
627 struct inode *inode = sbsec->sb->s_root->d_inode;
628 struct inode_security_struct *root_isec = inode->i_security;
629 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
630 u32 defcontext_sid = 0;
631 char **mount_options = opts->mnt_opts;
632 int *flags = opts->mnt_opts_flags;
633 int num_opts = opts->num_mnt_opts;
634
635 mutex_lock(&sbsec->lock);
636
637 if (!ss_initialized) {
638 if (!num_opts) {
639 /* Defer initialization until selinux_complete_init,
640 after the initial policy is loaded and the security
641 server is ready to handle calls. */
642 goto out;
643 }
644 rc = -EINVAL;
645 printk(KERN_WARNING "SELinux: Unable to set superblock options "
646 "before the security server is initialized\n");
647 goto out;
648 }
649 if (kern_flags && !set_kern_flags) {
650 /* Specifying internal flags without providing a place to
651 * place the results is not allowed */
652 rc = -EINVAL;
653 goto out;
654 }
655
656 /*
657 * Binary mount data FS will come through this function twice. Once
658 * from an explicit call and once from the generic calls from the vfs.
659 * Since the generic VFS calls will not contain any security mount data
660 * we need to skip the double mount verification.
661 *
662 * This does open a hole in which we will not notice if the first
663 * mount using this sb set explict options and a second mount using
664 * this sb does not set any security options. (The first options
665 * will be used for both mounts)
666 */
667 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
668 && (num_opts == 0))
669 goto out;
670
671 /*
672 * parse the mount options, check if they are valid sids.
673 * also check if someone is trying to mount the same sb more
674 * than once with different security options.
675 */
676 for (i = 0; i < num_opts; i++) {
677 u32 sid;
678
679 if (flags[i] == SBLABEL_MNT)
680 continue;
681 rc = security_context_to_sid(mount_options[i],
682 strlen(mount_options[i]), &sid, GFP_KERNEL);
683 if (rc) {
684 printk(KERN_WARNING "SELinux: security_context_to_sid"
685 "(%s) failed for (dev %s, type %s) errno=%d\n",
686 mount_options[i], sb->s_id, name, rc);
687 goto out;
688 }
689 switch (flags[i]) {
690 case FSCONTEXT_MNT:
691 fscontext_sid = sid;
692
693 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
694 fscontext_sid))
695 goto out_double_mount;
696
697 sbsec->flags |= FSCONTEXT_MNT;
698 break;
699 case CONTEXT_MNT:
700 context_sid = sid;
701
702 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
703 context_sid))
704 goto out_double_mount;
705
706 sbsec->flags |= CONTEXT_MNT;
707 break;
708 case ROOTCONTEXT_MNT:
709 rootcontext_sid = sid;
710
711 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
712 rootcontext_sid))
713 goto out_double_mount;
714
715 sbsec->flags |= ROOTCONTEXT_MNT;
716
717 break;
718 case DEFCONTEXT_MNT:
719 defcontext_sid = sid;
720
721 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
722 defcontext_sid))
723 goto out_double_mount;
724
725 sbsec->flags |= DEFCONTEXT_MNT;
726
727 break;
728 default:
729 rc = -EINVAL;
730 goto out;
731 }
732 }
733
734 if (sbsec->flags & SE_SBINITIALIZED) {
735 /* previously mounted with options, but not on this attempt? */
736 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
737 goto out_double_mount;
738 rc = 0;
739 goto out;
740 }
741
742 if (strcmp(sb->s_type->name, "proc") == 0)
743 sbsec->flags |= SE_SBPROC;
744
745 if (!sbsec->behavior) {
746 /*
747 * Determine the labeling behavior to use for this
748 * filesystem type.
749 */
750 rc = security_fs_use(sb);
751 if (rc) {
752 printk(KERN_WARNING
753 "%s: security_fs_use(%s) returned %d\n",
754 __func__, sb->s_type->name, rc);
755 goto out;
756 }
757 }
758 /* sets the context of the superblock for the fs being mounted. */
759 if (fscontext_sid) {
760 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
761 if (rc)
762 goto out;
763
764 sbsec->sid = fscontext_sid;
765 }
766
767 /*
768 * Switch to using mount point labeling behavior.
769 * sets the label used on all file below the mountpoint, and will set
770 * the superblock context if not already set.
771 */
772 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
773 sbsec->behavior = SECURITY_FS_USE_NATIVE;
774 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
775 }
776
777 if (context_sid) {
778 if (!fscontext_sid) {
779 rc = may_context_mount_sb_relabel(context_sid, sbsec,
780 cred);
781 if (rc)
782 goto out;
783 sbsec->sid = context_sid;
784 } else {
785 rc = may_context_mount_inode_relabel(context_sid, sbsec,
786 cred);
787 if (rc)
788 goto out;
789 }
790 if (!rootcontext_sid)
791 rootcontext_sid = context_sid;
792
793 sbsec->mntpoint_sid = context_sid;
794 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
795 }
796
797 if (rootcontext_sid) {
798 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
799 cred);
800 if (rc)
801 goto out;
802
803 root_isec->sid = rootcontext_sid;
804 root_isec->initialized = 1;
805 }
806
807 if (defcontext_sid) {
808 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
809 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
810 rc = -EINVAL;
811 printk(KERN_WARNING "SELinux: defcontext option is "
812 "invalid for this filesystem type\n");
813 goto out;
814 }
815
816 if (defcontext_sid != sbsec->def_sid) {
817 rc = may_context_mount_inode_relabel(defcontext_sid,
818 sbsec, cred);
819 if (rc)
820 goto out;
821 }
822
823 sbsec->def_sid = defcontext_sid;
824 }
825
826 rc = sb_finish_set_opts(sb);
827 out:
828 mutex_unlock(&sbsec->lock);
829 return rc;
830 out_double_mount:
831 rc = -EINVAL;
832 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
833 "security settings for (dev %s, type %s)\n", sb->s_id, name);
834 goto out;
835 }
836
837 static int selinux_cmp_sb_context(const struct super_block *oldsb,
838 const struct super_block *newsb)
839 {
840 struct superblock_security_struct *old = oldsb->s_security;
841 struct superblock_security_struct *new = newsb->s_security;
842 char oldflags = old->flags & SE_MNTMASK;
843 char newflags = new->flags & SE_MNTMASK;
844
845 if (oldflags != newflags)
846 goto mismatch;
847 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
848 goto mismatch;
849 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
850 goto mismatch;
851 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
852 goto mismatch;
853 if (oldflags & ROOTCONTEXT_MNT) {
854 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
855 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
856 if (oldroot->sid != newroot->sid)
857 goto mismatch;
858 }
859 return 0;
860 mismatch:
861 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
862 "different security settings for (dev %s, "
863 "type %s)\n", newsb->s_id, newsb->s_type->name);
864 return -EBUSY;
865 }
866
867 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
868 struct super_block *newsb)
869 {
870 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
871 struct superblock_security_struct *newsbsec = newsb->s_security;
872
873 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
874 int set_context = (oldsbsec->flags & CONTEXT_MNT);
875 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
876
877 /*
878 * if the parent was able to be mounted it clearly had no special lsm
879 * mount options. thus we can safely deal with this superblock later
880 */
881 if (!ss_initialized)
882 return 0;
883
884 /* how can we clone if the old one wasn't set up?? */
885 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
886
887 /* if fs is reusing a sb, make sure that the contexts match */
888 if (newsbsec->flags & SE_SBINITIALIZED)
889 return selinux_cmp_sb_context(oldsb, newsb);
890
891 mutex_lock(&newsbsec->lock);
892
893 newsbsec->flags = oldsbsec->flags;
894
895 newsbsec->sid = oldsbsec->sid;
896 newsbsec->def_sid = oldsbsec->def_sid;
897 newsbsec->behavior = oldsbsec->behavior;
898
899 if (set_context) {
900 u32 sid = oldsbsec->mntpoint_sid;
901
902 if (!set_fscontext)
903 newsbsec->sid = sid;
904 if (!set_rootcontext) {
905 struct inode *newinode = newsb->s_root->d_inode;
906 struct inode_security_struct *newisec = newinode->i_security;
907 newisec->sid = sid;
908 }
909 newsbsec->mntpoint_sid = sid;
910 }
911 if (set_rootcontext) {
912 const struct inode *oldinode = oldsb->s_root->d_inode;
913 const struct inode_security_struct *oldisec = oldinode->i_security;
914 struct inode *newinode = newsb->s_root->d_inode;
915 struct inode_security_struct *newisec = newinode->i_security;
916
917 newisec->sid = oldisec->sid;
918 }
919
920 sb_finish_set_opts(newsb);
921 mutex_unlock(&newsbsec->lock);
922 return 0;
923 }
924
925 static int selinux_parse_opts_str(char *options,
926 struct security_mnt_opts *opts)
927 {
928 char *p;
929 char *context = NULL, *defcontext = NULL;
930 char *fscontext = NULL, *rootcontext = NULL;
931 int rc, num_mnt_opts = 0;
932
933 opts->num_mnt_opts = 0;
934
935 /* Standard string-based options. */
936 while ((p = strsep(&options, "|")) != NULL) {
937 int token;
938 substring_t args[MAX_OPT_ARGS];
939
940 if (!*p)
941 continue;
942
943 token = match_token(p, tokens, args);
944
945 switch (token) {
946 case Opt_context:
947 if (context || defcontext) {
948 rc = -EINVAL;
949 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
950 goto out_err;
951 }
952 context = match_strdup(&args[0]);
953 if (!context) {
954 rc = -ENOMEM;
955 goto out_err;
956 }
957 break;
958
959 case Opt_fscontext:
960 if (fscontext) {
961 rc = -EINVAL;
962 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
963 goto out_err;
964 }
965 fscontext = match_strdup(&args[0]);
966 if (!fscontext) {
967 rc = -ENOMEM;
968 goto out_err;
969 }
970 break;
971
972 case Opt_rootcontext:
973 if (rootcontext) {
974 rc = -EINVAL;
975 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
976 goto out_err;
977 }
978 rootcontext = match_strdup(&args[0]);
979 if (!rootcontext) {
980 rc = -ENOMEM;
981 goto out_err;
982 }
983 break;
984
985 case Opt_defcontext:
986 if (context || defcontext) {
987 rc = -EINVAL;
988 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
989 goto out_err;
990 }
991 defcontext = match_strdup(&args[0]);
992 if (!defcontext) {
993 rc = -ENOMEM;
994 goto out_err;
995 }
996 break;
997 case Opt_labelsupport:
998 break;
999 default:
1000 rc = -EINVAL;
1001 printk(KERN_WARNING "SELinux: unknown mount option\n");
1002 goto out_err;
1003
1004 }
1005 }
1006
1007 rc = -ENOMEM;
1008 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1009 if (!opts->mnt_opts)
1010 goto out_err;
1011
1012 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1013 if (!opts->mnt_opts_flags) {
1014 kfree(opts->mnt_opts);
1015 goto out_err;
1016 }
1017
1018 if (fscontext) {
1019 opts->mnt_opts[num_mnt_opts] = fscontext;
1020 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1021 }
1022 if (context) {
1023 opts->mnt_opts[num_mnt_opts] = context;
1024 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1025 }
1026 if (rootcontext) {
1027 opts->mnt_opts[num_mnt_opts] = rootcontext;
1028 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1029 }
1030 if (defcontext) {
1031 opts->mnt_opts[num_mnt_opts] = defcontext;
1032 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1033 }
1034
1035 opts->num_mnt_opts = num_mnt_opts;
1036 return 0;
1037
1038 out_err:
1039 kfree(context);
1040 kfree(defcontext);
1041 kfree(fscontext);
1042 kfree(rootcontext);
1043 return rc;
1044 }
1045 /*
1046 * string mount options parsing and call set the sbsec
1047 */
1048 static int superblock_doinit(struct super_block *sb, void *data)
1049 {
1050 int rc = 0;
1051 char *options = data;
1052 struct security_mnt_opts opts;
1053
1054 security_init_mnt_opts(&opts);
1055
1056 if (!data)
1057 goto out;
1058
1059 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1060
1061 rc = selinux_parse_opts_str(options, &opts);
1062 if (rc)
1063 goto out_err;
1064
1065 out:
1066 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1067
1068 out_err:
1069 security_free_mnt_opts(&opts);
1070 return rc;
1071 }
1072
1073 static void selinux_write_opts(struct seq_file *m,
1074 struct security_mnt_opts *opts)
1075 {
1076 int i;
1077 char *prefix;
1078
1079 for (i = 0; i < opts->num_mnt_opts; i++) {
1080 char *has_comma;
1081
1082 if (opts->mnt_opts[i])
1083 has_comma = strchr(opts->mnt_opts[i], ',');
1084 else
1085 has_comma = NULL;
1086
1087 switch (opts->mnt_opts_flags[i]) {
1088 case CONTEXT_MNT:
1089 prefix = CONTEXT_STR;
1090 break;
1091 case FSCONTEXT_MNT:
1092 prefix = FSCONTEXT_STR;
1093 break;
1094 case ROOTCONTEXT_MNT:
1095 prefix = ROOTCONTEXT_STR;
1096 break;
1097 case DEFCONTEXT_MNT:
1098 prefix = DEFCONTEXT_STR;
1099 break;
1100 case SBLABEL_MNT:
1101 seq_putc(m, ',');
1102 seq_puts(m, LABELSUPP_STR);
1103 continue;
1104 default:
1105 BUG();
1106 return;
1107 };
1108 /* we need a comma before each option */
1109 seq_putc(m, ',');
1110 seq_puts(m, prefix);
1111 if (has_comma)
1112 seq_putc(m, '\"');
1113 seq_puts(m, opts->mnt_opts[i]);
1114 if (has_comma)
1115 seq_putc(m, '\"');
1116 }
1117 }
1118
1119 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1120 {
1121 struct security_mnt_opts opts;
1122 int rc;
1123
1124 rc = selinux_get_mnt_opts(sb, &opts);
1125 if (rc) {
1126 /* before policy load we may get EINVAL, don't show anything */
1127 if (rc == -EINVAL)
1128 rc = 0;
1129 return rc;
1130 }
1131
1132 selinux_write_opts(m, &opts);
1133
1134 security_free_mnt_opts(&opts);
1135
1136 return rc;
1137 }
1138
1139 static inline u16 inode_mode_to_security_class(umode_t mode)
1140 {
1141 switch (mode & S_IFMT) {
1142 case S_IFSOCK:
1143 return SECCLASS_SOCK_FILE;
1144 case S_IFLNK:
1145 return SECCLASS_LNK_FILE;
1146 case S_IFREG:
1147 return SECCLASS_FILE;
1148 case S_IFBLK:
1149 return SECCLASS_BLK_FILE;
1150 case S_IFDIR:
1151 return SECCLASS_DIR;
1152 case S_IFCHR:
1153 return SECCLASS_CHR_FILE;
1154 case S_IFIFO:
1155 return SECCLASS_FIFO_FILE;
1156
1157 }
1158
1159 return SECCLASS_FILE;
1160 }
1161
1162 static inline int default_protocol_stream(int protocol)
1163 {
1164 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1165 }
1166
1167 static inline int default_protocol_dgram(int protocol)
1168 {
1169 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1170 }
1171
1172 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1173 {
1174 switch (family) {
1175 case PF_UNIX:
1176 switch (type) {
1177 case SOCK_STREAM:
1178 case SOCK_SEQPACKET:
1179 return SECCLASS_UNIX_STREAM_SOCKET;
1180 case SOCK_DGRAM:
1181 return SECCLASS_UNIX_DGRAM_SOCKET;
1182 }
1183 break;
1184 case PF_INET:
1185 case PF_INET6:
1186 switch (type) {
1187 case SOCK_STREAM:
1188 if (default_protocol_stream(protocol))
1189 return SECCLASS_TCP_SOCKET;
1190 else
1191 return SECCLASS_RAWIP_SOCKET;
1192 case SOCK_DGRAM:
1193 if (default_protocol_dgram(protocol))
1194 return SECCLASS_UDP_SOCKET;
1195 else
1196 return SECCLASS_RAWIP_SOCKET;
1197 case SOCK_DCCP:
1198 return SECCLASS_DCCP_SOCKET;
1199 default:
1200 return SECCLASS_RAWIP_SOCKET;
1201 }
1202 break;
1203 case PF_NETLINK:
1204 switch (protocol) {
1205 case NETLINK_ROUTE:
1206 return SECCLASS_NETLINK_ROUTE_SOCKET;
1207 case NETLINK_FIREWALL:
1208 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1209 case NETLINK_SOCK_DIAG:
1210 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1211 case NETLINK_NFLOG:
1212 return SECCLASS_NETLINK_NFLOG_SOCKET;
1213 case NETLINK_XFRM:
1214 return SECCLASS_NETLINK_XFRM_SOCKET;
1215 case NETLINK_SELINUX:
1216 return SECCLASS_NETLINK_SELINUX_SOCKET;
1217 case NETLINK_AUDIT:
1218 return SECCLASS_NETLINK_AUDIT_SOCKET;
1219 case NETLINK_IP6_FW:
1220 return SECCLASS_NETLINK_IP6FW_SOCKET;
1221 case NETLINK_DNRTMSG:
1222 return SECCLASS_NETLINK_DNRT_SOCKET;
1223 case NETLINK_KOBJECT_UEVENT:
1224 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1225 default:
1226 return SECCLASS_NETLINK_SOCKET;
1227 }
1228 case PF_PACKET:
1229 return SECCLASS_PACKET_SOCKET;
1230 case PF_KEY:
1231 return SECCLASS_KEY_SOCKET;
1232 case PF_APPLETALK:
1233 return SECCLASS_APPLETALK_SOCKET;
1234 }
1235
1236 return SECCLASS_SOCKET;
1237 }
1238
1239 #ifdef CONFIG_PROC_FS
1240 static int selinux_proc_get_sid(struct dentry *dentry,
1241 u16 tclass,
1242 u32 *sid)
1243 {
1244 int rc;
1245 char *buffer, *path;
1246
1247 buffer = (char *)__get_free_page(GFP_KERNEL);
1248 if (!buffer)
1249 return -ENOMEM;
1250
1251 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1252 if (IS_ERR(path))
1253 rc = PTR_ERR(path);
1254 else {
1255 /* each process gets a /proc/PID/ entry. Strip off the
1256 * PID part to get a valid selinux labeling.
1257 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1258 while (path[1] >= '0' && path[1] <= '9') {
1259 path[1] = '/';
1260 path++;
1261 }
1262 rc = security_genfs_sid("proc", path, tclass, sid);
1263 }
1264 free_page((unsigned long)buffer);
1265 return rc;
1266 }
1267 #else
1268 static int selinux_proc_get_sid(struct dentry *dentry,
1269 u16 tclass,
1270 u32 *sid)
1271 {
1272 return -EINVAL;
1273 }
1274 #endif
1275
1276 /* The inode's security attributes must be initialized before first use. */
1277 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1278 {
1279 struct superblock_security_struct *sbsec = NULL;
1280 struct inode_security_struct *isec = inode->i_security;
1281 u32 sid;
1282 struct dentry *dentry;
1283 #define INITCONTEXTLEN 255
1284 char *context = NULL;
1285 unsigned len = 0;
1286 int rc = 0;
1287
1288 if (isec->initialized)
1289 goto out;
1290
1291 mutex_lock(&isec->lock);
1292 if (isec->initialized)
1293 goto out_unlock;
1294
1295 sbsec = inode->i_sb->s_security;
1296 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1297 /* Defer initialization until selinux_complete_init,
1298 after the initial policy is loaded and the security
1299 server is ready to handle calls. */
1300 spin_lock(&sbsec->isec_lock);
1301 if (list_empty(&isec->list))
1302 list_add(&isec->list, &sbsec->isec_head);
1303 spin_unlock(&sbsec->isec_lock);
1304 goto out_unlock;
1305 }
1306
1307 switch (sbsec->behavior) {
1308 case SECURITY_FS_USE_NATIVE:
1309 break;
1310 case SECURITY_FS_USE_XATTR:
1311 if (!inode->i_op->getxattr) {
1312 isec->sid = sbsec->def_sid;
1313 break;
1314 }
1315
1316 /* Need a dentry, since the xattr API requires one.
1317 Life would be simpler if we could just pass the inode. */
1318 if (opt_dentry) {
1319 /* Called from d_instantiate or d_splice_alias. */
1320 dentry = dget(opt_dentry);
1321 } else {
1322 /* Called from selinux_complete_init, try to find a dentry. */
1323 dentry = d_find_alias(inode);
1324 }
1325 if (!dentry) {
1326 /*
1327 * this is can be hit on boot when a file is accessed
1328 * before the policy is loaded. When we load policy we
1329 * may find inodes that have no dentry on the
1330 * sbsec->isec_head list. No reason to complain as these
1331 * will get fixed up the next time we go through
1332 * inode_doinit with a dentry, before these inodes could
1333 * be used again by userspace.
1334 */
1335 goto out_unlock;
1336 }
1337
1338 len = INITCONTEXTLEN;
1339 context = kmalloc(len+1, GFP_NOFS);
1340 if (!context) {
1341 rc = -ENOMEM;
1342 dput(dentry);
1343 goto out_unlock;
1344 }
1345 context[len] = '\0';
1346 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1347 context, len);
1348 if (rc == -ERANGE) {
1349 kfree(context);
1350
1351 /* Need a larger buffer. Query for the right size. */
1352 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1353 NULL, 0);
1354 if (rc < 0) {
1355 dput(dentry);
1356 goto out_unlock;
1357 }
1358 len = rc;
1359 context = kmalloc(len+1, GFP_NOFS);
1360 if (!context) {
1361 rc = -ENOMEM;
1362 dput(dentry);
1363 goto out_unlock;
1364 }
1365 context[len] = '\0';
1366 rc = inode->i_op->getxattr(dentry,
1367 XATTR_NAME_SELINUX,
1368 context, len);
1369 }
1370 dput(dentry);
1371 if (rc < 0) {
1372 if (rc != -ENODATA) {
1373 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1374 "%d for dev=%s ino=%ld\n", __func__,
1375 -rc, inode->i_sb->s_id, inode->i_ino);
1376 kfree(context);
1377 goto out_unlock;
1378 }
1379 /* Map ENODATA to the default file SID */
1380 sid = sbsec->def_sid;
1381 rc = 0;
1382 } else {
1383 rc = security_context_to_sid_default(context, rc, &sid,
1384 sbsec->def_sid,
1385 GFP_NOFS);
1386 if (rc) {
1387 char *dev = inode->i_sb->s_id;
1388 unsigned long ino = inode->i_ino;
1389
1390 if (rc == -EINVAL) {
1391 if (printk_ratelimit())
1392 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1393 "context=%s. This indicates you may need to relabel the inode or the "
1394 "filesystem in question.\n", ino, dev, context);
1395 } else {
1396 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1397 "returned %d for dev=%s ino=%ld\n",
1398 __func__, context, -rc, dev, ino);
1399 }
1400 kfree(context);
1401 /* Leave with the unlabeled SID */
1402 rc = 0;
1403 break;
1404 }
1405 }
1406 kfree(context);
1407 isec->sid = sid;
1408 break;
1409 case SECURITY_FS_USE_TASK:
1410 isec->sid = isec->task_sid;
1411 break;
1412 case SECURITY_FS_USE_TRANS:
1413 /* Default to the fs SID. */
1414 isec->sid = sbsec->sid;
1415
1416 /* Try to obtain a transition SID. */
1417 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1418 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1419 isec->sclass, NULL, &sid);
1420 if (rc)
1421 goto out_unlock;
1422 isec->sid = sid;
1423 break;
1424 case SECURITY_FS_USE_MNTPOINT:
1425 isec->sid = sbsec->mntpoint_sid;
1426 break;
1427 default:
1428 /* Default to the fs superblock SID. */
1429 isec->sid = sbsec->sid;
1430
1431 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1432 /* We must have a dentry to determine the label on
1433 * procfs inodes */
1434 if (opt_dentry)
1435 /* Called from d_instantiate or
1436 * d_splice_alias. */
1437 dentry = dget(opt_dentry);
1438 else
1439 /* Called from selinux_complete_init, try to
1440 * find a dentry. */
1441 dentry = d_find_alias(inode);
1442 /*
1443 * This can be hit on boot when a file is accessed
1444 * before the policy is loaded. When we load policy we
1445 * may find inodes that have no dentry on the
1446 * sbsec->isec_head list. No reason to complain as
1447 * these will get fixed up the next time we go through
1448 * inode_doinit() with a dentry, before these inodes
1449 * could be used again by userspace.
1450 */
1451 if (!dentry)
1452 goto out_unlock;
1453 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1454 rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1455 dput(dentry);
1456 if (rc)
1457 goto out_unlock;
1458 isec->sid = sid;
1459 }
1460 break;
1461 }
1462
1463 isec->initialized = 1;
1464
1465 out_unlock:
1466 mutex_unlock(&isec->lock);
1467 out:
1468 if (isec->sclass == SECCLASS_FILE)
1469 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1470 return rc;
1471 }
1472
1473 /* Convert a Linux signal to an access vector. */
1474 static inline u32 signal_to_av(int sig)
1475 {
1476 u32 perm = 0;
1477
1478 switch (sig) {
1479 case SIGCHLD:
1480 /* Commonly granted from child to parent. */
1481 perm = PROCESS__SIGCHLD;
1482 break;
1483 case SIGKILL:
1484 /* Cannot be caught or ignored */
1485 perm = PROCESS__SIGKILL;
1486 break;
1487 case SIGSTOP:
1488 /* Cannot be caught or ignored */
1489 perm = PROCESS__SIGSTOP;
1490 break;
1491 default:
1492 /* All other signals. */
1493 perm = PROCESS__SIGNAL;
1494 break;
1495 }
1496
1497 return perm;
1498 }
1499
1500 /*
1501 * Check permission between a pair of credentials
1502 * fork check, ptrace check, etc.
1503 */
1504 static int cred_has_perm(const struct cred *actor,
1505 const struct cred *target,
1506 u32 perms)
1507 {
1508 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1509
1510 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1511 }
1512
1513 /*
1514 * Check permission between a pair of tasks, e.g. signal checks,
1515 * fork check, ptrace check, etc.
1516 * tsk1 is the actor and tsk2 is the target
1517 * - this uses the default subjective creds of tsk1
1518 */
1519 static int task_has_perm(const struct task_struct *tsk1,
1520 const struct task_struct *tsk2,
1521 u32 perms)
1522 {
1523 const struct task_security_struct *__tsec1, *__tsec2;
1524 u32 sid1, sid2;
1525
1526 rcu_read_lock();
1527 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1528 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1529 rcu_read_unlock();
1530 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1531 }
1532
1533 /*
1534 * Check permission between current and another task, e.g. signal checks,
1535 * fork check, ptrace check, etc.
1536 * current is the actor and tsk2 is the target
1537 * - this uses current's subjective creds
1538 */
1539 static int current_has_perm(const struct task_struct *tsk,
1540 u32 perms)
1541 {
1542 u32 sid, tsid;
1543
1544 sid = current_sid();
1545 tsid = task_sid(tsk);
1546 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1547 }
1548
1549 #if CAP_LAST_CAP > 63
1550 #error Fix SELinux to handle capabilities > 63.
1551 #endif
1552
1553 /* Check whether a task is allowed to use a capability. */
1554 static int cred_has_capability(const struct cred *cred,
1555 int cap, int audit)
1556 {
1557 struct common_audit_data ad;
1558 struct av_decision avd;
1559 u16 sclass;
1560 u32 sid = cred_sid(cred);
1561 u32 av = CAP_TO_MASK(cap);
1562 int rc;
1563
1564 ad.type = LSM_AUDIT_DATA_CAP;
1565 ad.u.cap = cap;
1566
1567 switch (CAP_TO_INDEX(cap)) {
1568 case 0:
1569 sclass = SECCLASS_CAPABILITY;
1570 break;
1571 case 1:
1572 sclass = SECCLASS_CAPABILITY2;
1573 break;
1574 default:
1575 printk(KERN_ERR
1576 "SELinux: out of range capability %d\n", cap);
1577 BUG();
1578 return -EINVAL;
1579 }
1580
1581 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1582 if (audit == SECURITY_CAP_AUDIT) {
1583 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1584 if (rc2)
1585 return rc2;
1586 }
1587 return rc;
1588 }
1589
1590 /* Check whether a task is allowed to use a system operation. */
1591 static int task_has_system(struct task_struct *tsk,
1592 u32 perms)
1593 {
1594 u32 sid = task_sid(tsk);
1595
1596 return avc_has_perm(sid, SECINITSID_KERNEL,
1597 SECCLASS_SYSTEM, perms, NULL);
1598 }
1599
1600 /* Check whether a task has a particular permission to an inode.
1601 The 'adp' parameter is optional and allows other audit
1602 data to be passed (e.g. the dentry). */
1603 static int inode_has_perm(const struct cred *cred,
1604 struct inode *inode,
1605 u32 perms,
1606 struct common_audit_data *adp)
1607 {
1608 struct inode_security_struct *isec;
1609 u32 sid;
1610
1611 validate_creds(cred);
1612
1613 if (unlikely(IS_PRIVATE(inode)))
1614 return 0;
1615
1616 sid = cred_sid(cred);
1617 isec = inode->i_security;
1618
1619 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1620 }
1621
1622 /* Same as inode_has_perm, but pass explicit audit data containing
1623 the dentry to help the auditing code to more easily generate the
1624 pathname if needed. */
1625 static inline int dentry_has_perm(const struct cred *cred,
1626 struct dentry *dentry,
1627 u32 av)
1628 {
1629 struct inode *inode = dentry->d_inode;
1630 struct common_audit_data ad;
1631
1632 ad.type = LSM_AUDIT_DATA_DENTRY;
1633 ad.u.dentry = dentry;
1634 return inode_has_perm(cred, inode, av, &ad);
1635 }
1636
1637 /* Same as inode_has_perm, but pass explicit audit data containing
1638 the path to help the auditing code to more easily generate the
1639 pathname if needed. */
1640 static inline int path_has_perm(const struct cred *cred,
1641 struct path *path,
1642 u32 av)
1643 {
1644 struct inode *inode = path->dentry->d_inode;
1645 struct common_audit_data ad;
1646
1647 ad.type = LSM_AUDIT_DATA_PATH;
1648 ad.u.path = *path;
1649 return inode_has_perm(cred, inode, av, &ad);
1650 }
1651
1652 /* Same as path_has_perm, but uses the inode from the file struct. */
1653 static inline int file_path_has_perm(const struct cred *cred,
1654 struct file *file,
1655 u32 av)
1656 {
1657 struct common_audit_data ad;
1658
1659 ad.type = LSM_AUDIT_DATA_PATH;
1660 ad.u.path = file->f_path;
1661 return inode_has_perm(cred, file_inode(file), av, &ad);
1662 }
1663
1664 /* Check whether a task can use an open file descriptor to
1665 access an inode in a given way. Check access to the
1666 descriptor itself, and then use dentry_has_perm to
1667 check a particular permission to the file.
1668 Access to the descriptor is implicitly granted if it
1669 has the same SID as the process. If av is zero, then
1670 access to the file is not checked, e.g. for cases
1671 where only the descriptor is affected like seek. */
1672 static int file_has_perm(const struct cred *cred,
1673 struct file *file,
1674 u32 av)
1675 {
1676 struct file_security_struct *fsec = file->f_security;
1677 struct inode *inode = file_inode(file);
1678 struct common_audit_data ad;
1679 u32 sid = cred_sid(cred);
1680 int rc;
1681
1682 ad.type = LSM_AUDIT_DATA_PATH;
1683 ad.u.path = file->f_path;
1684
1685 if (sid != fsec->sid) {
1686 rc = avc_has_perm(sid, fsec->sid,
1687 SECCLASS_FD,
1688 FD__USE,
1689 &ad);
1690 if (rc)
1691 goto out;
1692 }
1693
1694 /* av is zero if only checking access to the descriptor. */
1695 rc = 0;
1696 if (av)
1697 rc = inode_has_perm(cred, inode, av, &ad);
1698
1699 out:
1700 return rc;
1701 }
1702
1703 /* Check whether a task can create a file. */
1704 static int may_create(struct inode *dir,
1705 struct dentry *dentry,
1706 u16 tclass)
1707 {
1708 const struct task_security_struct *tsec = current_security();
1709 struct inode_security_struct *dsec;
1710 struct superblock_security_struct *sbsec;
1711 u32 sid, newsid;
1712 struct common_audit_data ad;
1713 int rc;
1714
1715 dsec = dir->i_security;
1716 sbsec = dir->i_sb->s_security;
1717
1718 sid = tsec->sid;
1719 newsid = tsec->create_sid;
1720
1721 ad.type = LSM_AUDIT_DATA_DENTRY;
1722 ad.u.dentry = dentry;
1723
1724 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1725 DIR__ADD_NAME | DIR__SEARCH,
1726 &ad);
1727 if (rc)
1728 return rc;
1729
1730 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1731 rc = security_transition_sid(sid, dsec->sid, tclass,
1732 &dentry->d_name, &newsid);
1733 if (rc)
1734 return rc;
1735 }
1736
1737 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1738 if (rc)
1739 return rc;
1740
1741 return avc_has_perm(newsid, sbsec->sid,
1742 SECCLASS_FILESYSTEM,
1743 FILESYSTEM__ASSOCIATE, &ad);
1744 }
1745
1746 /* Check whether a task can create a key. */
1747 static int may_create_key(u32 ksid,
1748 struct task_struct *ctx)
1749 {
1750 u32 sid = task_sid(ctx);
1751
1752 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1753 }
1754
1755 #define MAY_LINK 0
1756 #define MAY_UNLINK 1
1757 #define MAY_RMDIR 2
1758
1759 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1760 static int may_link(struct inode *dir,
1761 struct dentry *dentry,
1762 int kind)
1763
1764 {
1765 struct inode_security_struct *dsec, *isec;
1766 struct common_audit_data ad;
1767 u32 sid = current_sid();
1768 u32 av;
1769 int rc;
1770
1771 dsec = dir->i_security;
1772 isec = dentry->d_inode->i_security;
1773
1774 ad.type = LSM_AUDIT_DATA_DENTRY;
1775 ad.u.dentry = dentry;
1776
1777 av = DIR__SEARCH;
1778 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1779 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1780 if (rc)
1781 return rc;
1782
1783 switch (kind) {
1784 case MAY_LINK:
1785 av = FILE__LINK;
1786 break;
1787 case MAY_UNLINK:
1788 av = FILE__UNLINK;
1789 break;
1790 case MAY_RMDIR:
1791 av = DIR__RMDIR;
1792 break;
1793 default:
1794 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1795 __func__, kind);
1796 return 0;
1797 }
1798
1799 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1800 return rc;
1801 }
1802
1803 static inline int may_rename(struct inode *old_dir,
1804 struct dentry *old_dentry,
1805 struct inode *new_dir,
1806 struct dentry *new_dentry)
1807 {
1808 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1809 struct common_audit_data ad;
1810 u32 sid = current_sid();
1811 u32 av;
1812 int old_is_dir, new_is_dir;
1813 int rc;
1814
1815 old_dsec = old_dir->i_security;
1816 old_isec = old_dentry->d_inode->i_security;
1817 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1818 new_dsec = new_dir->i_security;
1819
1820 ad.type = LSM_AUDIT_DATA_DENTRY;
1821
1822 ad.u.dentry = old_dentry;
1823 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1824 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1825 if (rc)
1826 return rc;
1827 rc = avc_has_perm(sid, old_isec->sid,
1828 old_isec->sclass, FILE__RENAME, &ad);
1829 if (rc)
1830 return rc;
1831 if (old_is_dir && new_dir != old_dir) {
1832 rc = avc_has_perm(sid, old_isec->sid,
1833 old_isec->sclass, DIR__REPARENT, &ad);
1834 if (rc)
1835 return rc;
1836 }
1837
1838 ad.u.dentry = new_dentry;
1839 av = DIR__ADD_NAME | DIR__SEARCH;
1840 if (new_dentry->d_inode)
1841 av |= DIR__REMOVE_NAME;
1842 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1843 if (rc)
1844 return rc;
1845 if (new_dentry->d_inode) {
1846 new_isec = new_dentry->d_inode->i_security;
1847 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1848 rc = avc_has_perm(sid, new_isec->sid,
1849 new_isec->sclass,
1850 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1851 if (rc)
1852 return rc;
1853 }
1854
1855 return 0;
1856 }
1857
1858 /* Check whether a task can perform a filesystem operation. */
1859 static int superblock_has_perm(const struct cred *cred,
1860 struct super_block *sb,
1861 u32 perms,
1862 struct common_audit_data *ad)
1863 {
1864 struct superblock_security_struct *sbsec;
1865 u32 sid = cred_sid(cred);
1866
1867 sbsec = sb->s_security;
1868 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1869 }
1870
1871 /* Convert a Linux mode and permission mask to an access vector. */
1872 static inline u32 file_mask_to_av(int mode, int mask)
1873 {
1874 u32 av = 0;
1875
1876 if (!S_ISDIR(mode)) {
1877 if (mask & MAY_EXEC)
1878 av |= FILE__EXECUTE;
1879 if (mask & MAY_READ)
1880 av |= FILE__READ;
1881
1882 if (mask & MAY_APPEND)
1883 av |= FILE__APPEND;
1884 else if (mask & MAY_WRITE)
1885 av |= FILE__WRITE;
1886
1887 } else {
1888 if (mask & MAY_EXEC)
1889 av |= DIR__SEARCH;
1890 if (mask & MAY_WRITE)
1891 av |= DIR__WRITE;
1892 if (mask & MAY_READ)
1893 av |= DIR__READ;
1894 }
1895
1896 return av;
1897 }
1898
1899 /* Convert a Linux file to an access vector. */
1900 static inline u32 file_to_av(struct file *file)
1901 {
1902 u32 av = 0;
1903
1904 if (file->f_mode & FMODE_READ)
1905 av |= FILE__READ;
1906 if (file->f_mode & FMODE_WRITE) {
1907 if (file->f_flags & O_APPEND)
1908 av |= FILE__APPEND;
1909 else
1910 av |= FILE__WRITE;
1911 }
1912 if (!av) {
1913 /*
1914 * Special file opened with flags 3 for ioctl-only use.
1915 */
1916 av = FILE__IOCTL;
1917 }
1918
1919 return av;
1920 }
1921
1922 /*
1923 * Convert a file to an access vector and include the correct open
1924 * open permission.
1925 */
1926 static inline u32 open_file_to_av(struct file *file)
1927 {
1928 u32 av = file_to_av(file);
1929
1930 if (selinux_policycap_openperm)
1931 av |= FILE__OPEN;
1932
1933 return av;
1934 }
1935
1936 /* Hook functions begin here. */
1937
1938 static int selinux_ptrace_access_check(struct task_struct *child,
1939 unsigned int mode)
1940 {
1941 int rc;
1942
1943 rc = cap_ptrace_access_check(child, mode);
1944 if (rc)
1945 return rc;
1946
1947 if (mode & PTRACE_MODE_READ) {
1948 u32 sid = current_sid();
1949 u32 csid = task_sid(child);
1950 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1951 }
1952
1953 return current_has_perm(child, PROCESS__PTRACE);
1954 }
1955
1956 static int selinux_ptrace_traceme(struct task_struct *parent)
1957 {
1958 int rc;
1959
1960 rc = cap_ptrace_traceme(parent);
1961 if (rc)
1962 return rc;
1963
1964 return task_has_perm(parent, current, PROCESS__PTRACE);
1965 }
1966
1967 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1968 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1969 {
1970 int error;
1971
1972 error = current_has_perm(target, PROCESS__GETCAP);
1973 if (error)
1974 return error;
1975
1976 return cap_capget(target, effective, inheritable, permitted);
1977 }
1978
1979 static int selinux_capset(struct cred *new, const struct cred *old,
1980 const kernel_cap_t *effective,
1981 const kernel_cap_t *inheritable,
1982 const kernel_cap_t *permitted)
1983 {
1984 int error;
1985
1986 error = cap_capset(new, old,
1987 effective, inheritable, permitted);
1988 if (error)
1989 return error;
1990
1991 return cred_has_perm(old, new, PROCESS__SETCAP);
1992 }
1993
1994 /*
1995 * (This comment used to live with the selinux_task_setuid hook,
1996 * which was removed).
1997 *
1998 * Since setuid only affects the current process, and since the SELinux
1999 * controls are not based on the Linux identity attributes, SELinux does not
2000 * need to control this operation. However, SELinux does control the use of
2001 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2002 */
2003
2004 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2005 int cap, int audit)
2006 {
2007 int rc;
2008
2009 rc = cap_capable(cred, ns, cap, audit);
2010 if (rc)
2011 return rc;
2012
2013 return cred_has_capability(cred, cap, audit);
2014 }
2015
2016 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2017 {
2018 const struct cred *cred = current_cred();
2019 int rc = 0;
2020
2021 if (!sb)
2022 return 0;
2023
2024 switch (cmds) {
2025 case Q_SYNC:
2026 case Q_QUOTAON:
2027 case Q_QUOTAOFF:
2028 case Q_SETINFO:
2029 case Q_SETQUOTA:
2030 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2031 break;
2032 case Q_GETFMT:
2033 case Q_GETINFO:
2034 case Q_GETQUOTA:
2035 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2036 break;
2037 default:
2038 rc = 0; /* let the kernel handle invalid cmds */
2039 break;
2040 }
2041 return rc;
2042 }
2043
2044 static int selinux_quota_on(struct dentry *dentry)
2045 {
2046 const struct cred *cred = current_cred();
2047
2048 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2049 }
2050
2051 static int selinux_syslog(int type)
2052 {
2053 int rc;
2054
2055 switch (type) {
2056 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2057 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2058 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2059 break;
2060 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2061 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2062 /* Set level of messages printed to console */
2063 case SYSLOG_ACTION_CONSOLE_LEVEL:
2064 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2065 break;
2066 case SYSLOG_ACTION_CLOSE: /* Close log */
2067 case SYSLOG_ACTION_OPEN: /* Open log */
2068 case SYSLOG_ACTION_READ: /* Read from log */
2069 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2070 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2071 default:
2072 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2073 break;
2074 }
2075 return rc;
2076 }
2077
2078 /*
2079 * Check that a process has enough memory to allocate a new virtual
2080 * mapping. 0 means there is enough memory for the allocation to
2081 * succeed and -ENOMEM implies there is not.
2082 *
2083 * Do not audit the selinux permission check, as this is applied to all
2084 * processes that allocate mappings.
2085 */
2086 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2087 {
2088 int rc, cap_sys_admin = 0;
2089
2090 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2091 SECURITY_CAP_NOAUDIT);
2092 if (rc == 0)
2093 cap_sys_admin = 1;
2094
2095 return __vm_enough_memory(mm, pages, cap_sys_admin);
2096 }
2097
2098 /* binprm security operations */
2099
2100 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2101 {
2102 const struct task_security_struct *old_tsec;
2103 struct task_security_struct *new_tsec;
2104 struct inode_security_struct *isec;
2105 struct common_audit_data ad;
2106 struct inode *inode = file_inode(bprm->file);
2107 int rc;
2108
2109 rc = cap_bprm_set_creds(bprm);
2110 if (rc)
2111 return rc;
2112
2113 /* SELinux context only depends on initial program or script and not
2114 * the script interpreter */
2115 if (bprm->cred_prepared)
2116 return 0;
2117
2118 old_tsec = current_security();
2119 new_tsec = bprm->cred->security;
2120 isec = inode->i_security;
2121
2122 /* Default to the current task SID. */
2123 new_tsec->sid = old_tsec->sid;
2124 new_tsec->osid = old_tsec->sid;
2125
2126 /* Reset fs, key, and sock SIDs on execve. */
2127 new_tsec->create_sid = 0;
2128 new_tsec->keycreate_sid = 0;
2129 new_tsec->sockcreate_sid = 0;
2130
2131 if (old_tsec->exec_sid) {
2132 new_tsec->sid = old_tsec->exec_sid;
2133 /* Reset exec SID on execve. */
2134 new_tsec->exec_sid = 0;
2135
2136 /*
2137 * Minimize confusion: if no_new_privs or nosuid and a
2138 * transition is explicitly requested, then fail the exec.
2139 */
2140 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2141 return -EPERM;
2142 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2143 return -EACCES;
2144 } else {
2145 /* Check for a default transition on this program. */
2146 rc = security_transition_sid(old_tsec->sid, isec->sid,
2147 SECCLASS_PROCESS, NULL,
2148 &new_tsec->sid);
2149 if (rc)
2150 return rc;
2151 }
2152
2153 ad.type = LSM_AUDIT_DATA_PATH;
2154 ad.u.path = bprm->file->f_path;
2155
2156 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2157 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2158 new_tsec->sid = old_tsec->sid;
2159
2160 if (new_tsec->sid == old_tsec->sid) {
2161 rc = avc_has_perm(old_tsec->sid, isec->sid,
2162 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2163 if (rc)
2164 return rc;
2165 } else {
2166 /* Check permissions for the transition. */
2167 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2168 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2169 if (rc)
2170 return rc;
2171
2172 rc = avc_has_perm(new_tsec->sid, isec->sid,
2173 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2174 if (rc)
2175 return rc;
2176
2177 /* Check for shared state */
2178 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2179 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2180 SECCLASS_PROCESS, PROCESS__SHARE,
2181 NULL);
2182 if (rc)
2183 return -EPERM;
2184 }
2185
2186 /* Make sure that anyone attempting to ptrace over a task that
2187 * changes its SID has the appropriate permit */
2188 if (bprm->unsafe &
2189 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2190 struct task_struct *tracer;
2191 struct task_security_struct *sec;
2192 u32 ptsid = 0;
2193
2194 rcu_read_lock();
2195 tracer = ptrace_parent(current);
2196 if (likely(tracer != NULL)) {
2197 sec = __task_cred(tracer)->security;
2198 ptsid = sec->sid;
2199 }
2200 rcu_read_unlock();
2201
2202 if (ptsid != 0) {
2203 rc = avc_has_perm(ptsid, new_tsec->sid,
2204 SECCLASS_PROCESS,
2205 PROCESS__PTRACE, NULL);
2206 if (rc)
2207 return -EPERM;
2208 }
2209 }
2210
2211 /* Clear any possibly unsafe personality bits on exec: */
2212 bprm->per_clear |= PER_CLEAR_ON_SETID;
2213 }
2214
2215 return 0;
2216 }
2217
2218 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2219 {
2220 const struct task_security_struct *tsec = current_security();
2221 u32 sid, osid;
2222 int atsecure = 0;
2223
2224 sid = tsec->sid;
2225 osid = tsec->osid;
2226
2227 if (osid != sid) {
2228 /* Enable secure mode for SIDs transitions unless
2229 the noatsecure permission is granted between
2230 the two SIDs, i.e. ahp returns 0. */
2231 atsecure = avc_has_perm(osid, sid,
2232 SECCLASS_PROCESS,
2233 PROCESS__NOATSECURE, NULL);
2234 }
2235
2236 return (atsecure || cap_bprm_secureexec(bprm));
2237 }
2238
2239 static int match_file(const void *p, struct file *file, unsigned fd)
2240 {
2241 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2242 }
2243
2244 /* Derived from fs/exec.c:flush_old_files. */
2245 static inline void flush_unauthorized_files(const struct cred *cred,
2246 struct files_struct *files)
2247 {
2248 struct file *file, *devnull = NULL;
2249 struct tty_struct *tty;
2250 int drop_tty = 0;
2251 unsigned n;
2252
2253 tty = get_current_tty();
2254 if (tty) {
2255 spin_lock(&tty_files_lock);
2256 if (!list_empty(&tty->tty_files)) {
2257 struct tty_file_private *file_priv;
2258
2259 /* Revalidate access to controlling tty.
2260 Use file_path_has_perm on the tty path directly
2261 rather than using file_has_perm, as this particular
2262 open file may belong to another process and we are
2263 only interested in the inode-based check here. */
2264 file_priv = list_first_entry(&tty->tty_files,
2265 struct tty_file_private, list);
2266 file = file_priv->file;
2267 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2268 drop_tty = 1;
2269 }
2270 spin_unlock(&tty_files_lock);
2271 tty_kref_put(tty);
2272 }
2273 /* Reset controlling tty. */
2274 if (drop_tty)
2275 no_tty();
2276
2277 /* Revalidate access to inherited open files. */
2278 n = iterate_fd(files, 0, match_file, cred);
2279 if (!n) /* none found? */
2280 return;
2281
2282 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2283 if (IS_ERR(devnull))
2284 devnull = NULL;
2285 /* replace all the matching ones with this */
2286 do {
2287 replace_fd(n - 1, devnull, 0);
2288 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2289 if (devnull)
2290 fput(devnull);
2291 }
2292
2293 /*
2294 * Prepare a process for imminent new credential changes due to exec
2295 */
2296 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2297 {
2298 struct task_security_struct *new_tsec;
2299 struct rlimit *rlim, *initrlim;
2300 int rc, i;
2301
2302 new_tsec = bprm->cred->security;
2303 if (new_tsec->sid == new_tsec->osid)
2304 return;
2305
2306 /* Close files for which the new task SID is not authorized. */
2307 flush_unauthorized_files(bprm->cred, current->files);
2308
2309 /* Always clear parent death signal on SID transitions. */
2310 current->pdeath_signal = 0;
2311
2312 /* Check whether the new SID can inherit resource limits from the old
2313 * SID. If not, reset all soft limits to the lower of the current
2314 * task's hard limit and the init task's soft limit.
2315 *
2316 * Note that the setting of hard limits (even to lower them) can be
2317 * controlled by the setrlimit check. The inclusion of the init task's
2318 * soft limit into the computation is to avoid resetting soft limits
2319 * higher than the default soft limit for cases where the default is
2320 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2321 */
2322 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2323 PROCESS__RLIMITINH, NULL);
2324 if (rc) {
2325 /* protect against do_prlimit() */
2326 task_lock(current);
2327 for (i = 0; i < RLIM_NLIMITS; i++) {
2328 rlim = current->signal->rlim + i;
2329 initrlim = init_task.signal->rlim + i;
2330 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2331 }
2332 task_unlock(current);
2333 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2334 }
2335 }
2336
2337 /*
2338 * Clean up the process immediately after the installation of new credentials
2339 * due to exec
2340 */
2341 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2342 {
2343 const struct task_security_struct *tsec = current_security();
2344 struct itimerval itimer;
2345 u32 osid, sid;
2346 int rc, i;
2347
2348 osid = tsec->osid;
2349 sid = tsec->sid;
2350
2351 if (sid == osid)
2352 return;
2353
2354 /* Check whether the new SID can inherit signal state from the old SID.
2355 * If not, clear itimers to avoid subsequent signal generation and
2356 * flush and unblock signals.
2357 *
2358 * This must occur _after_ the task SID has been updated so that any
2359 * kill done after the flush will be checked against the new SID.
2360 */
2361 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2362 if (rc) {
2363 memset(&itimer, 0, sizeof itimer);
2364 for (i = 0; i < 3; i++)
2365 do_setitimer(i, &itimer, NULL);
2366 spin_lock_irq(&current->sighand->siglock);
2367 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2368 __flush_signals(current);
2369 flush_signal_handlers(current, 1);
2370 sigemptyset(&current->blocked);
2371 }
2372 spin_unlock_irq(&current->sighand->siglock);
2373 }
2374
2375 /* Wake up the parent if it is waiting so that it can recheck
2376 * wait permission to the new task SID. */
2377 read_lock(&tasklist_lock);
2378 __wake_up_parent(current, current->real_parent);
2379 read_unlock(&tasklist_lock);
2380 }
2381
2382 /* superblock security operations */
2383
2384 static int selinux_sb_alloc_security(struct super_block *sb)
2385 {
2386 return superblock_alloc_security(sb);
2387 }
2388
2389 static void selinux_sb_free_security(struct super_block *sb)
2390 {
2391 superblock_free_security(sb);
2392 }
2393
2394 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2395 {
2396 if (plen > olen)
2397 return 0;
2398
2399 return !memcmp(prefix, option, plen);
2400 }
2401
2402 static inline int selinux_option(char *option, int len)
2403 {
2404 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2405 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2406 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2407 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2408 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2409 }
2410
2411 static inline void take_option(char **to, char *from, int *first, int len)
2412 {
2413 if (!*first) {
2414 **to = ',';
2415 *to += 1;
2416 } else
2417 *first = 0;
2418 memcpy(*to, from, len);
2419 *to += len;
2420 }
2421
2422 static inline void take_selinux_option(char **to, char *from, int *first,
2423 int len)
2424 {
2425 int current_size = 0;
2426
2427 if (!*first) {
2428 **to = '|';
2429 *to += 1;
2430 } else
2431 *first = 0;
2432
2433 while (current_size < len) {
2434 if (*from != '"') {
2435 **to = *from;
2436 *to += 1;
2437 }
2438 from += 1;
2439 current_size += 1;
2440 }
2441 }
2442
2443 static int selinux_sb_copy_data(char *orig, char *copy)
2444 {
2445 int fnosec, fsec, rc = 0;
2446 char *in_save, *in_curr, *in_end;
2447 char *sec_curr, *nosec_save, *nosec;
2448 int open_quote = 0;
2449
2450 in_curr = orig;
2451 sec_curr = copy;
2452
2453 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2454 if (!nosec) {
2455 rc = -ENOMEM;
2456 goto out;
2457 }
2458
2459 nosec_save = nosec;
2460 fnosec = fsec = 1;
2461 in_save = in_end = orig;
2462
2463 do {
2464 if (*in_end == '"')
2465 open_quote = !open_quote;
2466 if ((*in_end == ',' && open_quote == 0) ||
2467 *in_end == '\0') {
2468 int len = in_end - in_curr;
2469
2470 if (selinux_option(in_curr, len))
2471 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2472 else
2473 take_option(&nosec, in_curr, &fnosec, len);
2474
2475 in_curr = in_end + 1;
2476 }
2477 } while (*in_end++);
2478
2479 strcpy(in_save, nosec_save);
2480 free_page((unsigned long)nosec_save);
2481 out:
2482 return rc;
2483 }
2484
2485 static int selinux_sb_remount(struct super_block *sb, void *data)
2486 {
2487 int rc, i, *flags;
2488 struct security_mnt_opts opts;
2489 char *secdata, **mount_options;
2490 struct superblock_security_struct *sbsec = sb->s_security;
2491
2492 if (!(sbsec->flags & SE_SBINITIALIZED))
2493 return 0;
2494
2495 if (!data)
2496 return 0;
2497
2498 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2499 return 0;
2500
2501 security_init_mnt_opts(&opts);
2502 secdata = alloc_secdata();
2503 if (!secdata)
2504 return -ENOMEM;
2505 rc = selinux_sb_copy_data(data, secdata);
2506 if (rc)
2507 goto out_free_secdata;
2508
2509 rc = selinux_parse_opts_str(secdata, &opts);
2510 if (rc)
2511 goto out_free_secdata;
2512
2513 mount_options = opts.mnt_opts;
2514 flags = opts.mnt_opts_flags;
2515
2516 for (i = 0; i < opts.num_mnt_opts; i++) {
2517 u32 sid;
2518 size_t len;
2519
2520 if (flags[i] == SBLABEL_MNT)
2521 continue;
2522 len = strlen(mount_options[i]);
2523 rc = security_context_to_sid(mount_options[i], len, &sid,
2524 GFP_KERNEL);
2525 if (rc) {
2526 printk(KERN_WARNING "SELinux: security_context_to_sid"
2527 "(%s) failed for (dev %s, type %s) errno=%d\n",
2528 mount_options[i], sb->s_id, sb->s_type->name, rc);
2529 goto out_free_opts;
2530 }
2531 rc = -EINVAL;
2532 switch (flags[i]) {
2533 case FSCONTEXT_MNT:
2534 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2535 goto out_bad_option;
2536 break;
2537 case CONTEXT_MNT:
2538 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2539 goto out_bad_option;
2540 break;
2541 case ROOTCONTEXT_MNT: {
2542 struct inode_security_struct *root_isec;
2543 root_isec = sb->s_root->d_inode->i_security;
2544
2545 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2546 goto out_bad_option;
2547 break;
2548 }
2549 case DEFCONTEXT_MNT:
2550 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2551 goto out_bad_option;
2552 break;
2553 default:
2554 goto out_free_opts;
2555 }
2556 }
2557
2558 rc = 0;
2559 out_free_opts:
2560 security_free_mnt_opts(&opts);
2561 out_free_secdata:
2562 free_secdata(secdata);
2563 return rc;
2564 out_bad_option:
2565 printk(KERN_WARNING "SELinux: unable to change security options "
2566 "during remount (dev %s, type=%s)\n", sb->s_id,
2567 sb->s_type->name);
2568 goto out_free_opts;
2569 }
2570
2571 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2572 {
2573 const struct cred *cred = current_cred();
2574 struct common_audit_data ad;
2575 int rc;
2576
2577 rc = superblock_doinit(sb, data);
2578 if (rc)
2579 return rc;
2580
2581 /* Allow all mounts performed by the kernel */
2582 if (flags & MS_KERNMOUNT)
2583 return 0;
2584
2585 ad.type = LSM_AUDIT_DATA_DENTRY;
2586 ad.u.dentry = sb->s_root;
2587 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2588 }
2589
2590 static int selinux_sb_statfs(struct dentry *dentry)
2591 {
2592 const struct cred *cred = current_cred();
2593 struct common_audit_data ad;
2594
2595 ad.type = LSM_AUDIT_DATA_DENTRY;
2596 ad.u.dentry = dentry->d_sb->s_root;
2597 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2598 }
2599
2600 static int selinux_mount(const char *dev_name,
2601 struct path *path,
2602 const char *type,
2603 unsigned long flags,
2604 void *data)
2605 {
2606 const struct cred *cred = current_cred();
2607
2608 if (flags & MS_REMOUNT)
2609 return superblock_has_perm(cred, path->dentry->d_sb,
2610 FILESYSTEM__REMOUNT, NULL);
2611 else
2612 return path_has_perm(cred, path, FILE__MOUNTON);
2613 }
2614
2615 static int selinux_umount(struct vfsmount *mnt, int flags)
2616 {
2617 const struct cred *cred = current_cred();
2618
2619 return superblock_has_perm(cred, mnt->mnt_sb,
2620 FILESYSTEM__UNMOUNT, NULL);
2621 }
2622
2623 /* inode security operations */
2624
2625 static int selinux_inode_alloc_security(struct inode *inode)
2626 {
2627 return inode_alloc_security(inode);
2628 }
2629
2630 static void selinux_inode_free_security(struct inode *inode)
2631 {
2632 inode_free_security(inode);
2633 }
2634
2635 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2636 struct qstr *name, void **ctx,
2637 u32 *ctxlen)
2638 {
2639 const struct cred *cred = current_cred();
2640 struct task_security_struct *tsec;
2641 struct inode_security_struct *dsec;
2642 struct superblock_security_struct *sbsec;
2643 struct inode *dir = dentry->d_parent->d_inode;
2644 u32 newsid;
2645 int rc;
2646
2647 tsec = cred->security;
2648 dsec = dir->i_security;
2649 sbsec = dir->i_sb->s_security;
2650
2651 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2652 newsid = tsec->create_sid;
2653 } else {
2654 rc = security_transition_sid(tsec->sid, dsec->sid,
2655 inode_mode_to_security_class(mode),
2656 name,
2657 &newsid);
2658 if (rc) {
2659 printk(KERN_WARNING
2660 "%s: security_transition_sid failed, rc=%d\n",
2661 __func__, -rc);
2662 return rc;
2663 }
2664 }
2665
2666 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2667 }
2668
2669 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2670 const struct qstr *qstr,
2671 const char **name,
2672 void **value, size_t *len)
2673 {
2674 const struct task_security_struct *tsec = current_security();
2675 struct inode_security_struct *dsec;
2676 struct superblock_security_struct *sbsec;
2677 u32 sid, newsid, clen;
2678 int rc;
2679 char *context;
2680
2681 dsec = dir->i_security;
2682 sbsec = dir->i_sb->s_security;
2683
2684 sid = tsec->sid;
2685 newsid = tsec->create_sid;
2686
2687 if ((sbsec->flags & SE_SBINITIALIZED) &&
2688 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2689 newsid = sbsec->mntpoint_sid;
2690 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2691 rc = security_transition_sid(sid, dsec->sid,
2692 inode_mode_to_security_class(inode->i_mode),
2693 qstr, &newsid);
2694 if (rc) {
2695 printk(KERN_WARNING "%s: "
2696 "security_transition_sid failed, rc=%d (dev=%s "
2697 "ino=%ld)\n",
2698 __func__,
2699 -rc, inode->i_sb->s_id, inode->i_ino);
2700 return rc;
2701 }
2702 }
2703
2704 /* Possibly defer initialization to selinux_complete_init. */
2705 if (sbsec->flags & SE_SBINITIALIZED) {
2706 struct inode_security_struct *isec = inode->i_security;
2707 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2708 isec->sid = newsid;
2709 isec->initialized = 1;
2710 }
2711
2712 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2713 return -EOPNOTSUPP;
2714
2715 if (name)
2716 *name = XATTR_SELINUX_SUFFIX;
2717
2718 if (value && len) {
2719 rc = security_sid_to_context_force(newsid, &context, &clen);
2720 if (rc)
2721 return rc;
2722 *value = context;
2723 *len = clen;
2724 }
2725
2726 return 0;
2727 }
2728
2729 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2730 {
2731 return may_create(dir, dentry, SECCLASS_FILE);
2732 }
2733
2734 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2735 {
2736 return may_link(dir, old_dentry, MAY_LINK);
2737 }
2738
2739 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2740 {
2741 return may_link(dir, dentry, MAY_UNLINK);
2742 }
2743
2744 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2745 {
2746 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2747 }
2748
2749 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2750 {
2751 return may_create(dir, dentry, SECCLASS_DIR);
2752 }
2753
2754 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2755 {
2756 return may_link(dir, dentry, MAY_RMDIR);
2757 }
2758
2759 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2760 {
2761 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2762 }
2763
2764 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2765 struct inode *new_inode, struct dentry *new_dentry)
2766 {
2767 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2768 }
2769
2770 static int selinux_inode_readlink(struct dentry *dentry)
2771 {
2772 const struct cred *cred = current_cred();
2773
2774 return dentry_has_perm(cred, dentry, FILE__READ);
2775 }
2776
2777 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2778 {
2779 const struct cred *cred = current_cred();
2780
2781 return dentry_has_perm(cred, dentry, FILE__READ);
2782 }
2783
2784 static noinline int audit_inode_permission(struct inode *inode,
2785 u32 perms, u32 audited, u32 denied,
2786 int result,
2787 unsigned flags)
2788 {
2789 struct common_audit_data ad;
2790 struct inode_security_struct *isec = inode->i_security;
2791 int rc;
2792
2793 ad.type = LSM_AUDIT_DATA_INODE;
2794 ad.u.inode = inode;
2795
2796 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2797 audited, denied, result, &ad, flags);
2798 if (rc)
2799 return rc;
2800 return 0;
2801 }
2802
2803 static int selinux_inode_permission(struct inode *inode, int mask)
2804 {
2805 const struct cred *cred = current_cred();
2806 u32 perms;
2807 bool from_access;
2808 unsigned flags = mask & MAY_NOT_BLOCK;
2809 struct inode_security_struct *isec;
2810 u32 sid;
2811 struct av_decision avd;
2812 int rc, rc2;
2813 u32 audited, denied;
2814
2815 from_access = mask & MAY_ACCESS;
2816 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2817
2818 /* No permission to check. Existence test. */
2819 if (!mask)
2820 return 0;
2821
2822 validate_creds(cred);
2823
2824 if (unlikely(IS_PRIVATE(inode)))
2825 return 0;
2826
2827 perms = file_mask_to_av(inode->i_mode, mask);
2828
2829 sid = cred_sid(cred);
2830 isec = inode->i_security;
2831
2832 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2833 audited = avc_audit_required(perms, &avd, rc,
2834 from_access ? FILE__AUDIT_ACCESS : 0,
2835 &denied);
2836 if (likely(!audited))
2837 return rc;
2838
2839 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2840 if (rc2)
2841 return rc2;
2842 return rc;
2843 }
2844
2845 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2846 {
2847 const struct cred *cred = current_cred();
2848 unsigned int ia_valid = iattr->ia_valid;
2849 __u32 av = FILE__WRITE;
2850
2851 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2852 if (ia_valid & ATTR_FORCE) {
2853 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2854 ATTR_FORCE);
2855 if (!ia_valid)
2856 return 0;
2857 }
2858
2859 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2860 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2861 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2862
2863 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2864 av |= FILE__OPEN;
2865
2866 return dentry_has_perm(cred, dentry, av);
2867 }
2868
2869 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2870 {
2871 const struct cred *cred = current_cred();
2872 struct path path;
2873
2874 path.dentry = dentry;
2875 path.mnt = mnt;
2876
2877 return path_has_perm(cred, &path, FILE__GETATTR);
2878 }
2879
2880 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2881 {
2882 const struct cred *cred = current_cred();
2883
2884 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2885 sizeof XATTR_SECURITY_PREFIX - 1)) {
2886 if (!strcmp(name, XATTR_NAME_CAPS)) {
2887 if (!capable(CAP_SETFCAP))
2888 return -EPERM;
2889 } else if (!capable(CAP_SYS_ADMIN)) {
2890 /* A different attribute in the security namespace.
2891 Restrict to administrator. */
2892 return -EPERM;
2893 }
2894 }
2895
2896 /* Not an attribute we recognize, so just check the
2897 ordinary setattr permission. */
2898 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2899 }
2900
2901 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2902 const void *value, size_t size, int flags)
2903 {
2904 struct inode *inode = dentry->d_inode;
2905 struct inode_security_struct *isec = inode->i_security;
2906 struct superblock_security_struct *sbsec;
2907 struct common_audit_data ad;
2908 u32 newsid, sid = current_sid();
2909 int rc = 0;
2910
2911 if (strcmp(name, XATTR_NAME_SELINUX))
2912 return selinux_inode_setotherxattr(dentry, name);
2913
2914 sbsec = inode->i_sb->s_security;
2915 if (!(sbsec->flags & SBLABEL_MNT))
2916 return -EOPNOTSUPP;
2917
2918 if (!inode_owner_or_capable(inode))
2919 return -EPERM;
2920
2921 ad.type = LSM_AUDIT_DATA_DENTRY;
2922 ad.u.dentry = dentry;
2923
2924 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2925 FILE__RELABELFROM, &ad);
2926 if (rc)
2927 return rc;
2928
2929 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2930 if (rc == -EINVAL) {
2931 if (!capable(CAP_MAC_ADMIN)) {
2932 struct audit_buffer *ab;
2933 size_t audit_size;
2934 const char *str;
2935
2936 /* We strip a nul only if it is at the end, otherwise the
2937 * context contains a nul and we should audit that */
2938 if (value) {
2939 str = value;
2940 if (str[size - 1] == '\0')
2941 audit_size = size - 1;
2942 else
2943 audit_size = size;
2944 } else {
2945 str = "";
2946 audit_size = 0;
2947 }
2948 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2949 audit_log_format(ab, "op=setxattr invalid_context=");
2950 audit_log_n_untrustedstring(ab, value, audit_size);
2951 audit_log_end(ab);
2952
2953 return rc;
2954 }
2955 rc = security_context_to_sid_force(value, size, &newsid);
2956 }
2957 if (rc)
2958 return rc;
2959
2960 rc = avc_has_perm(sid, newsid, isec->sclass,
2961 FILE__RELABELTO, &ad);
2962 if (rc)
2963 return rc;
2964
2965 rc = security_validate_transition(isec->sid, newsid, sid,
2966 isec->sclass);
2967 if (rc)
2968 return rc;
2969
2970 return avc_has_perm(newsid,
2971 sbsec->sid,
2972 SECCLASS_FILESYSTEM,
2973 FILESYSTEM__ASSOCIATE,
2974 &ad);
2975 }
2976
2977 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2978 const void *value, size_t size,
2979 int flags)
2980 {
2981 struct inode *inode = dentry->d_inode;
2982 struct inode_security_struct *isec = inode->i_security;
2983 u32 newsid;
2984 int rc;
2985
2986 if (strcmp(name, XATTR_NAME_SELINUX)) {
2987 /* Not an attribute we recognize, so nothing to do. */
2988 return;
2989 }
2990
2991 rc = security_context_to_sid_force(value, size, &newsid);
2992 if (rc) {
2993 printk(KERN_ERR "SELinux: unable to map context to SID"
2994 "for (%s, %lu), rc=%d\n",
2995 inode->i_sb->s_id, inode->i_ino, -rc);
2996 return;
2997 }
2998
2999 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3000 isec->sid = newsid;
3001 isec->initialized = 1;
3002
3003 return;
3004 }
3005
3006 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3007 {
3008 const struct cred *cred = current_cred();
3009
3010 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3011 }
3012
3013 static int selinux_inode_listxattr(struct dentry *dentry)
3014 {
3015 const struct cred *cred = current_cred();
3016
3017 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3018 }
3019
3020 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3021 {
3022 if (strcmp(name, XATTR_NAME_SELINUX))
3023 return selinux_inode_setotherxattr(dentry, name);
3024
3025 /* No one is allowed to remove a SELinux security label.
3026 You can change the label, but all data must be labeled. */
3027 return -EACCES;
3028 }
3029
3030 /*
3031 * Copy the inode security context value to the user.
3032 *
3033 * Permission check is handled by selinux_inode_getxattr hook.
3034 */
3035 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3036 {
3037 u32 size;
3038 int error;
3039 char *context = NULL;
3040 struct inode_security_struct *isec = inode->i_security;
3041
3042 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3043 return -EOPNOTSUPP;
3044
3045 /*
3046 * If the caller has CAP_MAC_ADMIN, then get the raw context
3047 * value even if it is not defined by current policy; otherwise,
3048 * use the in-core value under current policy.
3049 * Use the non-auditing forms of the permission checks since
3050 * getxattr may be called by unprivileged processes commonly
3051 * and lack of permission just means that we fall back to the
3052 * in-core context value, not a denial.
3053 */
3054 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3055 SECURITY_CAP_NOAUDIT);
3056 if (!error)
3057 error = security_sid_to_context_force(isec->sid, &context,
3058 &size);
3059 else
3060 error = security_sid_to_context(isec->sid, &context, &size);
3061 if (error)
3062 return error;
3063 error = size;
3064 if (alloc) {
3065 *buffer = context;
3066 goto out_nofree;
3067 }
3068 kfree(context);
3069 out_nofree:
3070 return error;
3071 }
3072
3073 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3074 const void *value, size_t size, int flags)
3075 {
3076 struct inode_security_struct *isec = inode->i_security;
3077 u32 newsid;
3078 int rc;
3079
3080 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3081 return -EOPNOTSUPP;
3082
3083 if (!value || !size)
3084 return -EACCES;
3085
3086 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3087 if (rc)
3088 return rc;
3089
3090 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3091 isec->sid = newsid;
3092 isec->initialized = 1;
3093 return 0;
3094 }
3095
3096 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3097 {
3098 const int len = sizeof(XATTR_NAME_SELINUX);
3099 if (buffer && len <= buffer_size)
3100 memcpy(buffer, XATTR_NAME_SELINUX, len);
3101 return len;
3102 }
3103
3104 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3105 {
3106 struct inode_security_struct *isec = inode->i_security;
3107 *secid = isec->sid;
3108 }
3109
3110 /* file security operations */
3111
3112 static int selinux_revalidate_file_permission(struct file *file, int mask)
3113 {
3114 const struct cred *cred = current_cred();
3115 struct inode *inode = file_inode(file);
3116
3117 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3118 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3119 mask |= MAY_APPEND;
3120
3121 return file_has_perm(cred, file,
3122 file_mask_to_av(inode->i_mode, mask));
3123 }
3124
3125 static int selinux_file_permission(struct file *file, int mask)
3126 {
3127 struct inode *inode = file_inode(file);
3128 struct file_security_struct *fsec = file->f_security;
3129 struct inode_security_struct *isec = inode->i_security;
3130 u32 sid = current_sid();
3131
3132 if (!mask)
3133 /* No permission to check. Existence test. */
3134 return 0;
3135
3136 if (sid == fsec->sid && fsec->isid == isec->sid &&
3137 fsec->pseqno == avc_policy_seqno())
3138 /* No change since file_open check. */
3139 return 0;
3140
3141 return selinux_revalidate_file_permission(file, mask);
3142 }
3143
3144 static int selinux_file_alloc_security(struct file *file)
3145 {
3146 return file_alloc_security(file);
3147 }
3148
3149 static void selinux_file_free_security(struct file *file)
3150 {
3151 file_free_security(file);
3152 }
3153
3154 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3155 unsigned long arg)
3156 {
3157 const struct cred *cred = current_cred();
3158 int error = 0;
3159
3160 switch (cmd) {
3161 case FIONREAD:
3162 /* fall through */
3163 case FIBMAP:
3164 /* fall through */
3165 case FIGETBSZ:
3166 /* fall through */
3167 case FS_IOC_GETFLAGS:
3168 /* fall through */
3169 case FS_IOC_GETVERSION:
3170 error = file_has_perm(cred, file, FILE__GETATTR);
3171 break;
3172
3173 case FS_IOC_SETFLAGS:
3174 /* fall through */
3175 case FS_IOC_SETVERSION:
3176 error = file_has_perm(cred, file, FILE__SETATTR);
3177 break;
3178
3179 /* sys_ioctl() checks */
3180 case FIONBIO:
3181 /* fall through */
3182 case FIOASYNC:
3183 error = file_has_perm(cred, file, 0);
3184 break;
3185
3186 case KDSKBENT:
3187 case KDSKBSENT:
3188 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3189 SECURITY_CAP_AUDIT);
3190 break;
3191
3192 /* default case assumes that the command will go
3193 * to the file's ioctl() function.
3194 */
3195 default:
3196 error = file_has_perm(cred, file, FILE__IOCTL);
3197 }
3198 return error;
3199 }
3200
3201 static int default_noexec;
3202
3203 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3204 {
3205 const struct cred *cred = current_cred();
3206 int rc = 0;
3207
3208 if (default_noexec &&
3209 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3210 /*
3211 * We are making executable an anonymous mapping or a
3212 * private file mapping that will also be writable.
3213 * This has an additional check.
3214 */
3215 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3216 if (rc)
3217 goto error;
3218 }
3219
3220 if (file) {
3221 /* read access is always possible with a mapping */
3222 u32 av = FILE__READ;
3223
3224 /* write access only matters if the mapping is shared */
3225 if (shared && (prot & PROT_WRITE))
3226 av |= FILE__WRITE;
3227
3228 if (prot & PROT_EXEC)
3229 av |= FILE__EXECUTE;
3230
3231 return file_has_perm(cred, file, av);
3232 }
3233
3234 error:
3235 return rc;
3236 }
3237
3238 static int selinux_mmap_addr(unsigned long addr)
3239 {
3240 int rc;
3241
3242 /* do DAC check on address space usage */
3243 rc = cap_mmap_addr(addr);
3244 if (rc)
3245 return rc;
3246
3247 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3248 u32 sid = current_sid();
3249 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3250 MEMPROTECT__MMAP_ZERO, NULL);
3251 }
3252
3253 return rc;
3254 }
3255
3256 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3257 unsigned long prot, unsigned long flags)
3258 {
3259 if (selinux_checkreqprot)
3260 prot = reqprot;
3261
3262 return file_map_prot_check(file, prot,
3263 (flags & MAP_TYPE) == MAP_SHARED);
3264 }
3265
3266 static int selinux_file_mprotect(struct vm_area_struct *vma,
3267 unsigned long reqprot,
3268 unsigned long prot)
3269 {
3270 const struct cred *cred = current_cred();
3271
3272 if (selinux_checkreqprot)
3273 prot = reqprot;
3274
3275 if (default_noexec &&
3276 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3277 int rc = 0;
3278 if (vma->vm_start >= vma->vm_mm->start_brk &&
3279 vma->vm_end <= vma->vm_mm->brk) {
3280 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3281 } else if (!vma->vm_file &&
3282 vma->vm_start <= vma->vm_mm->start_stack &&
3283 vma->vm_end >= vma->vm_mm->start_stack) {
3284 rc = current_has_perm(current, PROCESS__EXECSTACK);
3285 } else if (vma->vm_file && vma->anon_vma) {
3286 /*
3287 * We are making executable a file mapping that has
3288 * had some COW done. Since pages might have been
3289 * written, check ability to execute the possibly
3290 * modified content. This typically should only
3291 * occur for text relocations.
3292 */
3293 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3294 }
3295 if (rc)
3296 return rc;
3297 }
3298
3299 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3300 }
3301
3302 static int selinux_file_lock(struct file *file, unsigned int cmd)
3303 {
3304 const struct cred *cred = current_cred();
3305
3306 return file_has_perm(cred, file, FILE__LOCK);
3307 }
3308
3309 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3310 unsigned long arg)
3311 {
3312 const struct cred *cred = current_cred();
3313 int err = 0;
3314
3315 switch (cmd) {
3316 case F_SETFL:
3317 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3318 err = file_has_perm(cred, file, FILE__WRITE);
3319 break;
3320 }
3321 /* fall through */
3322 case F_SETOWN:
3323 case F_SETSIG:
3324 case F_GETFL:
3325 case F_GETOWN:
3326 case F_GETSIG:
3327 case F_GETOWNER_UIDS:
3328 /* Just check FD__USE permission */
3329 err = file_has_perm(cred, file, 0);
3330 break;
3331 case F_GETLK:
3332 case F_SETLK:
3333 case F_SETLKW:
3334 case F_OFD_GETLK:
3335 case F_OFD_SETLK:
3336 case F_OFD_SETLKW:
3337 #if BITS_PER_LONG == 32
3338 case F_GETLK64:
3339 case F_SETLK64:
3340 case F_SETLKW64:
3341 #endif
3342 err = file_has_perm(cred, file, FILE__LOCK);
3343 break;
3344 }
3345
3346 return err;
3347 }
3348
3349 static int selinux_file_set_fowner(struct file *file)
3350 {
3351 struct file_security_struct *fsec;
3352
3353 fsec = file->f_security;
3354 fsec->fown_sid = current_sid();
3355
3356 return 0;
3357 }
3358
3359 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3360 struct fown_struct *fown, int signum)
3361 {
3362 struct file *file;
3363 u32 sid = task_sid(tsk);
3364 u32 perm;
3365 struct file_security_struct *fsec;
3366
3367 /* struct fown_struct is never outside the context of a struct file */
3368 file = container_of(fown, struct file, f_owner);
3369
3370 fsec = file->f_security;
3371
3372 if (!signum)
3373 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3374 else
3375 perm = signal_to_av(signum);
3376
3377 return avc_has_perm(fsec->fown_sid, sid,
3378 SECCLASS_PROCESS, perm, NULL);
3379 }
3380
3381 static int selinux_file_receive(struct file *file)
3382 {
3383 const struct cred *cred = current_cred();
3384
3385 return file_has_perm(cred, file, file_to_av(file));
3386 }
3387
3388 static int selinux_file_open(struct file *file, const struct cred *cred)
3389 {
3390 struct file_security_struct *fsec;
3391 struct inode_security_struct *isec;
3392
3393 fsec = file->f_security;
3394 isec = file_inode(file)->i_security;
3395 /*
3396 * Save inode label and policy sequence number
3397 * at open-time so that selinux_file_permission
3398 * can determine whether revalidation is necessary.
3399 * Task label is already saved in the file security
3400 * struct as its SID.
3401 */
3402 fsec->isid = isec->sid;
3403 fsec->pseqno = avc_policy_seqno();
3404 /*
3405 * Since the inode label or policy seqno may have changed
3406 * between the selinux_inode_permission check and the saving
3407 * of state above, recheck that access is still permitted.
3408 * Otherwise, access might never be revalidated against the
3409 * new inode label or new policy.
3410 * This check is not redundant - do not remove.
3411 */
3412 return file_path_has_perm(cred, file, open_file_to_av(file));
3413 }
3414
3415 /* task security operations */
3416
3417 static int selinux_task_create(unsigned long clone_flags)
3418 {
3419 return current_has_perm(current, PROCESS__FORK);
3420 }
3421
3422 /*
3423 * allocate the SELinux part of blank credentials
3424 */
3425 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3426 {
3427 struct task_security_struct *tsec;
3428
3429 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3430 if (!tsec)
3431 return -ENOMEM;
3432
3433 cred->security = tsec;
3434 return 0;
3435 }
3436
3437 /*
3438 * detach and free the LSM part of a set of credentials
3439 */
3440 static void selinux_cred_free(struct cred *cred)
3441 {
3442 struct task_security_struct *tsec = cred->security;
3443
3444 /*
3445 * cred->security == NULL if security_cred_alloc_blank() or
3446 * security_prepare_creds() returned an error.
3447 */
3448 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3449 cred->security = (void *) 0x7UL;
3450 kfree(tsec);
3451 }
3452
3453 /*
3454 * prepare a new set of credentials for modification
3455 */
3456 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3457 gfp_t gfp)
3458 {
3459 const struct task_security_struct *old_tsec;
3460 struct task_security_struct *tsec;
3461
3462 old_tsec = old->security;
3463
3464 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3465 if (!tsec)
3466 return -ENOMEM;
3467
3468 new->security = tsec;
3469 return 0;
3470 }
3471
3472 /*
3473 * transfer the SELinux data to a blank set of creds
3474 */
3475 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3476 {
3477 const struct task_security_struct *old_tsec = old->security;
3478 struct task_security_struct *tsec = new->security;
3479
3480 *tsec = *old_tsec;
3481 }
3482
3483 /*
3484 * set the security data for a kernel service
3485 * - all the creation contexts are set to unlabelled
3486 */
3487 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3488 {
3489 struct task_security_struct *tsec = new->security;
3490 u32 sid = current_sid();
3491 int ret;
3492
3493 ret = avc_has_perm(sid, secid,
3494 SECCLASS_KERNEL_SERVICE,
3495 KERNEL_SERVICE__USE_AS_OVERRIDE,
3496 NULL);
3497 if (ret == 0) {
3498 tsec->sid = secid;
3499 tsec->create_sid = 0;
3500 tsec->keycreate_sid = 0;
3501 tsec->sockcreate_sid = 0;
3502 }
3503 return ret;
3504 }
3505
3506 /*
3507 * set the file creation context in a security record to the same as the
3508 * objective context of the specified inode
3509 */
3510 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3511 {
3512 struct inode_security_struct *isec = inode->i_security;
3513 struct task_security_struct *tsec = new->security;
3514 u32 sid = current_sid();
3515 int ret;
3516
3517 ret = avc_has_perm(sid, isec->sid,
3518 SECCLASS_KERNEL_SERVICE,
3519 KERNEL_SERVICE__CREATE_FILES_AS,
3520 NULL);
3521
3522 if (ret == 0)
3523 tsec->create_sid = isec->sid;
3524 return ret;
3525 }
3526
3527 static int selinux_kernel_module_request(char *kmod_name)
3528 {
3529 u32 sid;
3530 struct common_audit_data ad;
3531
3532 sid = task_sid(current);
3533
3534 ad.type = LSM_AUDIT_DATA_KMOD;
3535 ad.u.kmod_name = kmod_name;
3536
3537 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3538 SYSTEM__MODULE_REQUEST, &ad);
3539 }
3540
3541 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3542 {
3543 return current_has_perm(p, PROCESS__SETPGID);
3544 }
3545
3546 static int selinux_task_getpgid(struct task_struct *p)
3547 {
3548 return current_has_perm(p, PROCESS__GETPGID);
3549 }
3550
3551 static int selinux_task_getsid(struct task_struct *p)
3552 {
3553 return current_has_perm(p, PROCESS__GETSESSION);
3554 }
3555
3556 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3557 {
3558 *secid = task_sid(p);
3559 }
3560
3561 static int selinux_task_setnice(struct task_struct *p, int nice)
3562 {
3563 int rc;
3564
3565 rc = cap_task_setnice(p, nice);
3566 if (rc)
3567 return rc;
3568
3569 return current_has_perm(p, PROCESS__SETSCHED);
3570 }
3571
3572 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3573 {
3574 int rc;
3575
3576 rc = cap_task_setioprio(p, ioprio);
3577 if (rc)
3578 return rc;
3579
3580 return current_has_perm(p, PROCESS__SETSCHED);
3581 }
3582
3583 static int selinux_task_getioprio(struct task_struct *p)
3584 {
3585 return current_has_perm(p, PROCESS__GETSCHED);
3586 }
3587
3588 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3589 struct rlimit *new_rlim)
3590 {
3591 struct rlimit *old_rlim = p->signal->rlim + resource;
3592
3593 /* Control the ability to change the hard limit (whether
3594 lowering or raising it), so that the hard limit can
3595 later be used as a safe reset point for the soft limit
3596 upon context transitions. See selinux_bprm_committing_creds. */
3597 if (old_rlim->rlim_max != new_rlim->rlim_max)
3598 return current_has_perm(p, PROCESS__SETRLIMIT);
3599
3600 return 0;
3601 }
3602
3603 static int selinux_task_setscheduler(struct task_struct *p)
3604 {
3605 int rc;
3606
3607 rc = cap_task_setscheduler(p);
3608 if (rc)
3609 return rc;
3610
3611 return current_has_perm(p, PROCESS__SETSCHED);
3612 }
3613
3614 static int selinux_task_getscheduler(struct task_struct *p)
3615 {
3616 return current_has_perm(p, PROCESS__GETSCHED);
3617 }
3618
3619 static int selinux_task_movememory(struct task_struct *p)
3620 {
3621 return current_has_perm(p, PROCESS__SETSCHED);
3622 }
3623
3624 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3625 int sig, u32 secid)
3626 {
3627 u32 perm;
3628 int rc;
3629
3630 if (!sig)
3631 perm = PROCESS__SIGNULL; /* null signal; existence test */
3632 else
3633 perm = signal_to_av(sig);
3634 if (secid)
3635 rc = avc_has_perm(secid, task_sid(p),
3636 SECCLASS_PROCESS, perm, NULL);
3637 else
3638 rc = current_has_perm(p, perm);
3639 return rc;
3640 }
3641
3642 static int selinux_task_wait(struct task_struct *p)
3643 {
3644 return task_has_perm(p, current, PROCESS__SIGCHLD);
3645 }
3646
3647 static void selinux_task_to_inode(struct task_struct *p,
3648 struct inode *inode)
3649 {
3650 struct inode_security_struct *isec = inode->i_security;
3651 u32 sid = task_sid(p);
3652
3653 isec->sid = sid;
3654 isec->initialized = 1;
3655 }
3656
3657 /* Returns error only if unable to parse addresses */
3658 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3659 struct common_audit_data *ad, u8 *proto)
3660 {
3661 int offset, ihlen, ret = -EINVAL;
3662 struct iphdr _iph, *ih;
3663
3664 offset = skb_network_offset(skb);
3665 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3666 if (ih == NULL)
3667 goto out;
3668
3669 ihlen = ih->ihl * 4;
3670 if (ihlen < sizeof(_iph))
3671 goto out;
3672
3673 ad->u.net->v4info.saddr = ih->saddr;
3674 ad->u.net->v4info.daddr = ih->daddr;
3675 ret = 0;
3676
3677 if (proto)
3678 *proto = ih->protocol;
3679
3680 switch (ih->protocol) {
3681 case IPPROTO_TCP: {
3682 struct tcphdr _tcph, *th;
3683
3684 if (ntohs(ih->frag_off) & IP_OFFSET)
3685 break;
3686
3687 offset += ihlen;
3688 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3689 if (th == NULL)
3690 break;
3691
3692 ad->u.net->sport = th->source;
3693 ad->u.net->dport = th->dest;
3694 break;
3695 }
3696
3697 case IPPROTO_UDP: {
3698 struct udphdr _udph, *uh;
3699
3700 if (ntohs(ih->frag_off) & IP_OFFSET)
3701 break;
3702
3703 offset += ihlen;
3704 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3705 if (uh == NULL)
3706 break;
3707
3708 ad->u.net->sport = uh->source;
3709 ad->u.net->dport = uh->dest;
3710 break;
3711 }
3712
3713 case IPPROTO_DCCP: {
3714 struct dccp_hdr _dccph, *dh;
3715
3716 if (ntohs(ih->frag_off) & IP_OFFSET)
3717 break;
3718
3719 offset += ihlen;
3720 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3721 if (dh == NULL)
3722 break;
3723
3724 ad->u.net->sport = dh->dccph_sport;
3725 ad->u.net->dport = dh->dccph_dport;
3726 break;
3727 }
3728
3729 default:
3730 break;
3731 }
3732 out:
3733 return ret;
3734 }
3735
3736 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3737
3738 /* Returns error only if unable to parse addresses */
3739 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3740 struct common_audit_data *ad, u8 *proto)
3741 {
3742 u8 nexthdr;
3743 int ret = -EINVAL, offset;
3744 struct ipv6hdr _ipv6h, *ip6;
3745 __be16 frag_off;
3746
3747 offset = skb_network_offset(skb);
3748 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3749 if (ip6 == NULL)
3750 goto out;
3751
3752 ad->u.net->v6info.saddr = ip6->saddr;
3753 ad->u.net->v6info.daddr = ip6->daddr;
3754 ret = 0;
3755
3756 nexthdr = ip6->nexthdr;
3757 offset += sizeof(_ipv6h);
3758 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3759 if (offset < 0)
3760 goto out;
3761
3762 if (proto)
3763 *proto = nexthdr;
3764
3765 switch (nexthdr) {
3766 case IPPROTO_TCP: {
3767 struct tcphdr _tcph, *th;
3768
3769 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3770 if (th == NULL)
3771 break;
3772
3773 ad->u.net->sport = th->source;
3774 ad->u.net->dport = th->dest;
3775 break;
3776 }
3777
3778 case IPPROTO_UDP: {
3779 struct udphdr _udph, *uh;
3780
3781 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3782 if (uh == NULL)
3783 break;
3784
3785 ad->u.net->sport = uh->source;
3786 ad->u.net->dport = uh->dest;
3787 break;
3788 }
3789
3790 case IPPROTO_DCCP: {
3791 struct dccp_hdr _dccph, *dh;
3792
3793 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3794 if (dh == NULL)
3795 break;
3796
3797 ad->u.net->sport = dh->dccph_sport;
3798 ad->u.net->dport = dh->dccph_dport;
3799 break;
3800 }
3801
3802 /* includes fragments */
3803 default:
3804 break;
3805 }
3806 out:
3807 return ret;
3808 }
3809
3810 #endif /* IPV6 */
3811
3812 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3813 char **_addrp, int src, u8 *proto)
3814 {
3815 char *addrp;
3816 int ret;
3817
3818 switch (ad->u.net->family) {
3819 case PF_INET:
3820 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3821 if (ret)
3822 goto parse_error;
3823 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3824 &ad->u.net->v4info.daddr);
3825 goto okay;
3826
3827 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3828 case PF_INET6:
3829 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3830 if (ret)
3831 goto parse_error;
3832 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3833 &ad->u.net->v6info.daddr);
3834 goto okay;
3835 #endif /* IPV6 */
3836 default:
3837 addrp = NULL;
3838 goto okay;
3839 }
3840
3841 parse_error:
3842 printk(KERN_WARNING
3843 "SELinux: failure in selinux_parse_skb(),"
3844 " unable to parse packet\n");
3845 return ret;
3846
3847 okay:
3848 if (_addrp)
3849 *_addrp = addrp;
3850 return 0;
3851 }
3852
3853 /**
3854 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3855 * @skb: the packet
3856 * @family: protocol family
3857 * @sid: the packet's peer label SID
3858 *
3859 * Description:
3860 * Check the various different forms of network peer labeling and determine
3861 * the peer label/SID for the packet; most of the magic actually occurs in
3862 * the security server function security_net_peersid_cmp(). The function
3863 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3864 * or -EACCES if @sid is invalid due to inconsistencies with the different
3865 * peer labels.
3866 *
3867 */
3868 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3869 {
3870 int err;
3871 u32 xfrm_sid;
3872 u32 nlbl_sid;
3873 u32 nlbl_type;
3874
3875 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3876 if (unlikely(err))
3877 return -EACCES;
3878 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3879 if (unlikely(err))
3880 return -EACCES;
3881
3882 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3883 if (unlikely(err)) {
3884 printk(KERN_WARNING
3885 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3886 " unable to determine packet's peer label\n");
3887 return -EACCES;
3888 }
3889
3890 return 0;
3891 }
3892
3893 /**
3894 * selinux_conn_sid - Determine the child socket label for a connection
3895 * @sk_sid: the parent socket's SID
3896 * @skb_sid: the packet's SID
3897 * @conn_sid: the resulting connection SID
3898 *
3899 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3900 * combined with the MLS information from @skb_sid in order to create
3901 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3902 * of @sk_sid. Returns zero on success, negative values on failure.
3903 *
3904 */
3905 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3906 {
3907 int err = 0;
3908
3909 if (skb_sid != SECSID_NULL)
3910 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3911 else
3912 *conn_sid = sk_sid;
3913
3914 return err;
3915 }
3916
3917 /* socket security operations */
3918
3919 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3920 u16 secclass, u32 *socksid)
3921 {
3922 if (tsec->sockcreate_sid > SECSID_NULL) {
3923 *socksid = tsec->sockcreate_sid;
3924 return 0;
3925 }
3926
3927 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3928 socksid);
3929 }
3930
3931 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3932 {
3933 struct sk_security_struct *sksec = sk->sk_security;
3934 struct common_audit_data ad;
3935 struct lsm_network_audit net = {0,};
3936 u32 tsid = task_sid(task);
3937
3938 if (sksec->sid == SECINITSID_KERNEL)
3939 return 0;
3940
3941 ad.type = LSM_AUDIT_DATA_NET;
3942 ad.u.net = &net;
3943 ad.u.net->sk = sk;
3944
3945 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3946 }
3947
3948 static int selinux_socket_create(int family, int type,
3949 int protocol, int kern)
3950 {
3951 const struct task_security_struct *tsec = current_security();
3952 u32 newsid;
3953 u16 secclass;
3954 int rc;
3955
3956 if (kern)
3957 return 0;
3958
3959 secclass = socket_type_to_security_class(family, type, protocol);
3960 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3961 if (rc)
3962 return rc;
3963
3964 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3965 }
3966
3967 static int selinux_socket_post_create(struct socket *sock, int family,
3968 int type, int protocol, int kern)
3969 {
3970 const struct task_security_struct *tsec = current_security();
3971 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3972 struct sk_security_struct *sksec;
3973 int err = 0;
3974
3975 isec->sclass = socket_type_to_security_class(family, type, protocol);
3976
3977 if (kern)
3978 isec->sid = SECINITSID_KERNEL;
3979 else {
3980 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3981 if (err)
3982 return err;
3983 }
3984
3985 isec->initialized = 1;
3986
3987 if (sock->sk) {
3988 sksec = sock->sk->sk_security;
3989 sksec->sid = isec->sid;
3990 sksec->sclass = isec->sclass;
3991 err = selinux_netlbl_socket_post_create(sock->sk, family);
3992 }
3993
3994 return err;
3995 }
3996
3997 /* Range of port numbers used to automatically bind.
3998 Need to determine whether we should perform a name_bind
3999 permission check between the socket and the port number. */
4000
4001 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4002 {
4003 struct sock *sk = sock->sk;
4004 u16 family;
4005 int err;
4006
4007 err = sock_has_perm(current, sk, SOCKET__BIND);
4008 if (err)
4009 goto out;
4010
4011 /*
4012 * If PF_INET or PF_INET6, check name_bind permission for the port.
4013 * Multiple address binding for SCTP is not supported yet: we just
4014 * check the first address now.
4015 */
4016 family = sk->sk_family;
4017 if (family == PF_INET || family == PF_INET6) {
4018 char *addrp;
4019 struct sk_security_struct *sksec = sk->sk_security;
4020 struct common_audit_data ad;
4021 struct lsm_network_audit net = {0,};
4022 struct sockaddr_in *addr4 = NULL;
4023 struct sockaddr_in6 *addr6 = NULL;
4024 unsigned short snum;
4025 u32 sid, node_perm;
4026
4027 if (family == PF_INET) {
4028 addr4 = (struct sockaddr_in *)address;
4029 snum = ntohs(addr4->sin_port);
4030 addrp = (char *)&addr4->sin_addr.s_addr;
4031 } else {
4032 addr6 = (struct sockaddr_in6 *)address;
4033 snum = ntohs(addr6->sin6_port);
4034 addrp = (char *)&addr6->sin6_addr.s6_addr;
4035 }
4036
4037 if (snum) {
4038 int low, high;
4039
4040 inet_get_local_port_range(sock_net(sk), &low, &high);
4041
4042 if (snum < max(PROT_SOCK, low) || snum > high) {
4043 err = sel_netport_sid(sk->sk_protocol,
4044 snum, &sid);
4045 if (err)
4046 goto out;
4047 ad.type = LSM_AUDIT_DATA_NET;
4048 ad.u.net = &net;
4049 ad.u.net->sport = htons(snum);
4050 ad.u.net->family = family;
4051 err = avc_has_perm(sksec->sid, sid,
4052 sksec->sclass,
4053 SOCKET__NAME_BIND, &ad);
4054 if (err)
4055 goto out;
4056 }
4057 }
4058
4059 switch (sksec->sclass) {
4060 case SECCLASS_TCP_SOCKET:
4061 node_perm = TCP_SOCKET__NODE_BIND;
4062 break;
4063
4064 case SECCLASS_UDP_SOCKET:
4065 node_perm = UDP_SOCKET__NODE_BIND;
4066 break;
4067
4068 case SECCLASS_DCCP_SOCKET:
4069 node_perm = DCCP_SOCKET__NODE_BIND;
4070 break;
4071
4072 default:
4073 node_perm = RAWIP_SOCKET__NODE_BIND;
4074 break;
4075 }
4076
4077 err = sel_netnode_sid(addrp, family, &sid);
4078 if (err)
4079 goto out;
4080
4081 ad.type = LSM_AUDIT_DATA_NET;
4082 ad.u.net = &net;
4083 ad.u.net->sport = htons(snum);
4084 ad.u.net->family = family;
4085
4086 if (family == PF_INET)
4087 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4088 else
4089 ad.u.net->v6info.saddr = addr6->sin6_addr;
4090
4091 err = avc_has_perm(sksec->sid, sid,
4092 sksec->sclass, node_perm, &ad);
4093 if (err)
4094 goto out;
4095 }
4096 out:
4097 return err;
4098 }
4099
4100 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4101 {
4102 struct sock *sk = sock->sk;
4103 struct sk_security_struct *sksec = sk->sk_security;
4104 int err;
4105
4106 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4107 if (err)
4108 return err;
4109
4110 /*
4111 * If a TCP or DCCP socket, check name_connect permission for the port.
4112 */
4113 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4114 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4115 struct common_audit_data ad;
4116 struct lsm_network_audit net = {0,};
4117 struct sockaddr_in *addr4 = NULL;
4118 struct sockaddr_in6 *addr6 = NULL;
4119 unsigned short snum;
4120 u32 sid, perm;
4121
4122 if (sk->sk_family == PF_INET) {
4123 addr4 = (struct sockaddr_in *)address;
4124 if (addrlen < sizeof(struct sockaddr_in))
4125 return -EINVAL;
4126 snum = ntohs(addr4->sin_port);
4127 } else {
4128 addr6 = (struct sockaddr_in6 *)address;
4129 if (addrlen < SIN6_LEN_RFC2133)
4130 return -EINVAL;
4131 snum = ntohs(addr6->sin6_port);
4132 }
4133
4134 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4135 if (err)
4136 goto out;
4137
4138 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4139 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4140
4141 ad.type = LSM_AUDIT_DATA_NET;
4142 ad.u.net = &net;
4143 ad.u.net->dport = htons(snum);
4144 ad.u.net->family = sk->sk_family;
4145 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4146 if (err)
4147 goto out;
4148 }
4149
4150 err = selinux_netlbl_socket_connect(sk, address);
4151
4152 out:
4153 return err;
4154 }
4155
4156 static int selinux_socket_listen(struct socket *sock, int backlog)
4157 {
4158 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4159 }
4160
4161 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4162 {
4163 int err;
4164 struct inode_security_struct *isec;
4165 struct inode_security_struct *newisec;
4166
4167 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4168 if (err)
4169 return err;
4170
4171 newisec = SOCK_INODE(newsock)->i_security;
4172
4173 isec = SOCK_INODE(sock)->i_security;
4174 newisec->sclass = isec->sclass;
4175 newisec->sid = isec->sid;
4176 newisec->initialized = 1;
4177
4178 return 0;
4179 }
4180
4181 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4182 int size)
4183 {
4184 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4185 }
4186
4187 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4188 int size, int flags)
4189 {
4190 return sock_has_perm(current, sock->sk, SOCKET__READ);
4191 }
4192
4193 static int selinux_socket_getsockname(struct socket *sock)
4194 {
4195 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4196 }
4197
4198 static int selinux_socket_getpeername(struct socket *sock)
4199 {
4200 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4201 }
4202
4203 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4204 {
4205 int err;
4206
4207 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4208 if (err)
4209 return err;
4210
4211 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4212 }
4213
4214 static int selinux_socket_getsockopt(struct socket *sock, int level,
4215 int optname)
4216 {
4217 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4218 }
4219
4220 static int selinux_socket_shutdown(struct socket *sock, int how)
4221 {
4222 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4223 }
4224
4225 static int selinux_socket_unix_stream_connect(struct sock *sock,
4226 struct sock *other,
4227 struct sock *newsk)
4228 {
4229 struct sk_security_struct *sksec_sock = sock->sk_security;
4230 struct sk_security_struct *sksec_other = other->sk_security;
4231 struct sk_security_struct *sksec_new = newsk->sk_security;
4232 struct common_audit_data ad;
4233 struct lsm_network_audit net = {0,};
4234 int err;
4235
4236 ad.type = LSM_AUDIT_DATA_NET;
4237 ad.u.net = &net;
4238 ad.u.net->sk = other;
4239
4240 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4241 sksec_other->sclass,
4242 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4243 if (err)
4244 return err;
4245
4246 /* server child socket */
4247 sksec_new->peer_sid = sksec_sock->sid;
4248 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4249 &sksec_new->sid);
4250 if (err)
4251 return err;
4252
4253 /* connecting socket */
4254 sksec_sock->peer_sid = sksec_new->sid;
4255
4256 return 0;
4257 }
4258
4259 static int selinux_socket_unix_may_send(struct socket *sock,
4260 struct socket *other)
4261 {
4262 struct sk_security_struct *ssec = sock->sk->sk_security;
4263 struct sk_security_struct *osec = other->sk->sk_security;
4264 struct common_audit_data ad;
4265 struct lsm_network_audit net = {0,};
4266
4267 ad.type = LSM_AUDIT_DATA_NET;
4268 ad.u.net = &net;
4269 ad.u.net->sk = other->sk;
4270
4271 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4272 &ad);
4273 }
4274
4275 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4276 u32 peer_sid,
4277 struct common_audit_data *ad)
4278 {
4279 int err;
4280 u32 if_sid;
4281 u32 node_sid;
4282
4283 err = sel_netif_sid(ifindex, &if_sid);
4284 if (err)
4285 return err;
4286 err = avc_has_perm(peer_sid, if_sid,
4287 SECCLASS_NETIF, NETIF__INGRESS, ad);
4288 if (err)
4289 return err;
4290
4291 err = sel_netnode_sid(addrp, family, &node_sid);
4292 if (err)
4293 return err;
4294 return avc_has_perm(peer_sid, node_sid,
4295 SECCLASS_NODE, NODE__RECVFROM, ad);
4296 }
4297
4298 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4299 u16 family)
4300 {
4301 int err = 0;
4302 struct sk_security_struct *sksec = sk->sk_security;
4303 u32 sk_sid = sksec->sid;
4304 struct common_audit_data ad;
4305 struct lsm_network_audit net = {0,};
4306 char *addrp;
4307
4308 ad.type = LSM_AUDIT_DATA_NET;
4309 ad.u.net = &net;
4310 ad.u.net->netif = skb->skb_iif;
4311 ad.u.net->family = family;
4312 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4313 if (err)
4314 return err;
4315
4316 if (selinux_secmark_enabled()) {
4317 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4318 PACKET__RECV, &ad);
4319 if (err)
4320 return err;
4321 }
4322
4323 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4324 if (err)
4325 return err;
4326 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4327
4328 return err;
4329 }
4330
4331 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4332 {
4333 int err;
4334 struct sk_security_struct *sksec = sk->sk_security;
4335 u16 family = sk->sk_family;
4336 u32 sk_sid = sksec->sid;
4337 struct common_audit_data ad;
4338 struct lsm_network_audit net = {0,};
4339 char *addrp;
4340 u8 secmark_active;
4341 u8 peerlbl_active;
4342
4343 if (family != PF_INET && family != PF_INET6)
4344 return 0;
4345
4346 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4347 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4348 family = PF_INET;
4349
4350 /* If any sort of compatibility mode is enabled then handoff processing
4351 * to the selinux_sock_rcv_skb_compat() function to deal with the
4352 * special handling. We do this in an attempt to keep this function
4353 * as fast and as clean as possible. */
4354 if (!selinux_policycap_netpeer)
4355 return selinux_sock_rcv_skb_compat(sk, skb, family);
4356
4357 secmark_active = selinux_secmark_enabled();
4358 peerlbl_active = selinux_peerlbl_enabled();
4359 if (!secmark_active && !peerlbl_active)
4360 return 0;
4361
4362 ad.type = LSM_AUDIT_DATA_NET;
4363 ad.u.net = &net;
4364 ad.u.net->netif = skb->skb_iif;
4365 ad.u.net->family = family;
4366 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4367 if (err)
4368 return err;
4369
4370 if (peerlbl_active) {
4371 u32 peer_sid;
4372
4373 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4374 if (err)
4375 return err;
4376 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4377 peer_sid, &ad);
4378 if (err) {
4379 selinux_netlbl_err(skb, err, 0);
4380 return err;
4381 }
4382 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4383 PEER__RECV, &ad);
4384 if (err) {
4385 selinux_netlbl_err(skb, err, 0);
4386 return err;
4387 }
4388 }
4389
4390 if (secmark_active) {
4391 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4392 PACKET__RECV, &ad);
4393 if (err)
4394 return err;
4395 }
4396
4397 return err;
4398 }
4399
4400 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4401 int __user *optlen, unsigned len)
4402 {
4403 int err = 0;
4404 char *scontext;
4405 u32 scontext_len;
4406 struct sk_security_struct *sksec = sock->sk->sk_security;
4407 u32 peer_sid = SECSID_NULL;
4408
4409 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4410 sksec->sclass == SECCLASS_TCP_SOCKET)
4411 peer_sid = sksec->peer_sid;
4412 if (peer_sid == SECSID_NULL)
4413 return -ENOPROTOOPT;
4414
4415 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4416 if (err)
4417 return err;
4418
4419 if (scontext_len > len) {
4420 err = -ERANGE;
4421 goto out_len;
4422 }
4423
4424 if (copy_to_user(optval, scontext, scontext_len))
4425 err = -EFAULT;
4426
4427 out_len:
4428 if (put_user(scontext_len, optlen))
4429 err = -EFAULT;
4430 kfree(scontext);
4431 return err;
4432 }
4433
4434 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4435 {
4436 u32 peer_secid = SECSID_NULL;
4437 u16 family;
4438
4439 if (skb && skb->protocol == htons(ETH_P_IP))
4440 family = PF_INET;
4441 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4442 family = PF_INET6;
4443 else if (sock)
4444 family = sock->sk->sk_family;
4445 else
4446 goto out;
4447
4448 if (sock && family == PF_UNIX)
4449 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4450 else if (skb)
4451 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4452
4453 out:
4454 *secid = peer_secid;
4455 if (peer_secid == SECSID_NULL)
4456 return -EINVAL;
4457 return 0;
4458 }
4459
4460 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4461 {
4462 struct sk_security_struct *sksec;
4463
4464 sksec = kzalloc(sizeof(*sksec), priority);
4465 if (!sksec)
4466 return -ENOMEM;
4467
4468 sksec->peer_sid = SECINITSID_UNLABELED;
4469 sksec->sid = SECINITSID_UNLABELED;
4470 selinux_netlbl_sk_security_reset(sksec);
4471 sk->sk_security = sksec;
4472
4473 return 0;
4474 }
4475
4476 static void selinux_sk_free_security(struct sock *sk)
4477 {
4478 struct sk_security_struct *sksec = sk->sk_security;
4479
4480 sk->sk_security = NULL;
4481 selinux_netlbl_sk_security_free(sksec);
4482 kfree(sksec);
4483 }
4484
4485 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4486 {
4487 struct sk_security_struct *sksec = sk->sk_security;
4488 struct sk_security_struct *newsksec = newsk->sk_security;
4489
4490 newsksec->sid = sksec->sid;
4491 newsksec->peer_sid = sksec->peer_sid;
4492 newsksec->sclass = sksec->sclass;
4493
4494 selinux_netlbl_sk_security_reset(newsksec);
4495 }
4496
4497 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4498 {
4499 if (!sk)
4500 *secid = SECINITSID_ANY_SOCKET;
4501 else {
4502 struct sk_security_struct *sksec = sk->sk_security;
4503
4504 *secid = sksec->sid;
4505 }
4506 }
4507
4508 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4509 {
4510 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4511 struct sk_security_struct *sksec = sk->sk_security;
4512
4513 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4514 sk->sk_family == PF_UNIX)
4515 isec->sid = sksec->sid;
4516 sksec->sclass = isec->sclass;
4517 }
4518
4519 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4520 struct request_sock *req)
4521 {
4522 struct sk_security_struct *sksec = sk->sk_security;
4523 int err;
4524 u16 family = req->rsk_ops->family;
4525 u32 connsid;
4526 u32 peersid;
4527
4528 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4529 if (err)
4530 return err;
4531 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4532 if (err)
4533 return err;
4534 req->secid = connsid;
4535 req->peer_secid = peersid;
4536
4537 return selinux_netlbl_inet_conn_request(req, family);
4538 }
4539
4540 static void selinux_inet_csk_clone(struct sock *newsk,
4541 const struct request_sock *req)
4542 {
4543 struct sk_security_struct *newsksec = newsk->sk_security;
4544
4545 newsksec->sid = req->secid;
4546 newsksec->peer_sid = req->peer_secid;
4547 /* NOTE: Ideally, we should also get the isec->sid for the
4548 new socket in sync, but we don't have the isec available yet.
4549 So we will wait until sock_graft to do it, by which
4550 time it will have been created and available. */
4551
4552 /* We don't need to take any sort of lock here as we are the only
4553 * thread with access to newsksec */
4554 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4555 }
4556
4557 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4558 {
4559 u16 family = sk->sk_family;
4560 struct sk_security_struct *sksec = sk->sk_security;
4561
4562 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4563 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4564 family = PF_INET;
4565
4566 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4567 }
4568
4569 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4570 {
4571 skb_set_owner_w(skb, sk);
4572 }
4573
4574 static int selinux_secmark_relabel_packet(u32 sid)
4575 {
4576 const struct task_security_struct *__tsec;
4577 u32 tsid;
4578
4579 __tsec = current_security();
4580 tsid = __tsec->sid;
4581
4582 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4583 }
4584
4585 static void selinux_secmark_refcount_inc(void)
4586 {
4587 atomic_inc(&selinux_secmark_refcount);
4588 }
4589
4590 static void selinux_secmark_refcount_dec(void)
4591 {
4592 atomic_dec(&selinux_secmark_refcount);
4593 }
4594
4595 static void selinux_req_classify_flow(const struct request_sock *req,
4596 struct flowi *fl)
4597 {
4598 fl->flowi_secid = req->secid;
4599 }
4600
4601 static int selinux_tun_dev_alloc_security(void **security)
4602 {
4603 struct tun_security_struct *tunsec;
4604
4605 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4606 if (!tunsec)
4607 return -ENOMEM;
4608 tunsec->sid = current_sid();
4609
4610 *security = tunsec;
4611 return 0;
4612 }
4613
4614 static void selinux_tun_dev_free_security(void *security)
4615 {
4616 kfree(security);
4617 }
4618
4619 static int selinux_tun_dev_create(void)
4620 {
4621 u32 sid = current_sid();
4622
4623 /* we aren't taking into account the "sockcreate" SID since the socket
4624 * that is being created here is not a socket in the traditional sense,
4625 * instead it is a private sock, accessible only to the kernel, and
4626 * representing a wide range of network traffic spanning multiple
4627 * connections unlike traditional sockets - check the TUN driver to
4628 * get a better understanding of why this socket is special */
4629
4630 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4631 NULL);
4632 }
4633
4634 static int selinux_tun_dev_attach_queue(void *security)
4635 {
4636 struct tun_security_struct *tunsec = security;
4637
4638 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4639 TUN_SOCKET__ATTACH_QUEUE, NULL);
4640 }
4641
4642 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4643 {
4644 struct tun_security_struct *tunsec = security;
4645 struct sk_security_struct *sksec = sk->sk_security;
4646
4647 /* we don't currently perform any NetLabel based labeling here and it
4648 * isn't clear that we would want to do so anyway; while we could apply
4649 * labeling without the support of the TUN user the resulting labeled
4650 * traffic from the other end of the connection would almost certainly
4651 * cause confusion to the TUN user that had no idea network labeling
4652 * protocols were being used */
4653
4654 sksec->sid = tunsec->sid;
4655 sksec->sclass = SECCLASS_TUN_SOCKET;
4656
4657 return 0;
4658 }
4659
4660 static int selinux_tun_dev_open(void *security)
4661 {
4662 struct tun_security_struct *tunsec = security;
4663 u32 sid = current_sid();
4664 int err;
4665
4666 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4667 TUN_SOCKET__RELABELFROM, NULL);
4668 if (err)
4669 return err;
4670 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4671 TUN_SOCKET__RELABELTO, NULL);
4672 if (err)
4673 return err;
4674 tunsec->sid = sid;
4675
4676 return 0;
4677 }
4678
4679 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4680 {
4681 int err = 0;
4682 u32 perm;
4683 struct nlmsghdr *nlh;
4684 struct sk_security_struct *sksec = sk->sk_security;
4685
4686 if (skb->len < NLMSG_HDRLEN) {
4687 err = -EINVAL;
4688 goto out;
4689 }
4690 nlh = nlmsg_hdr(skb);
4691
4692 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4693 if (err) {
4694 if (err == -EINVAL) {
4695 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4696 "SELinux: unrecognized netlink message"
4697 " type=%hu for sclass=%hu\n",
4698 nlh->nlmsg_type, sksec->sclass);
4699 if (!selinux_enforcing || security_get_allow_unknown())
4700 err = 0;
4701 }
4702
4703 /* Ignore */
4704 if (err == -ENOENT)
4705 err = 0;
4706 goto out;
4707 }
4708
4709 err = sock_has_perm(current, sk, perm);
4710 out:
4711 return err;
4712 }
4713
4714 #ifdef CONFIG_NETFILTER
4715
4716 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4717 u16 family)
4718 {
4719 int err;
4720 char *addrp;
4721 u32 peer_sid;
4722 struct common_audit_data ad;
4723 struct lsm_network_audit net = {0,};
4724 u8 secmark_active;
4725 u8 netlbl_active;
4726 u8 peerlbl_active;
4727
4728 if (!selinux_policycap_netpeer)
4729 return NF_ACCEPT;
4730
4731 secmark_active = selinux_secmark_enabled();
4732 netlbl_active = netlbl_enabled();
4733 peerlbl_active = selinux_peerlbl_enabled();
4734 if (!secmark_active && !peerlbl_active)
4735 return NF_ACCEPT;
4736
4737 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4738 return NF_DROP;
4739
4740 ad.type = LSM_AUDIT_DATA_NET;
4741 ad.u.net = &net;
4742 ad.u.net->netif = ifindex;
4743 ad.u.net->family = family;
4744 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4745 return NF_DROP;
4746
4747 if (peerlbl_active) {
4748 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4749 peer_sid, &ad);
4750 if (err) {
4751 selinux_netlbl_err(skb, err, 1);
4752 return NF_DROP;
4753 }
4754 }
4755
4756 if (secmark_active)
4757 if (avc_has_perm(peer_sid, skb->secmark,
4758 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4759 return NF_DROP;
4760
4761 if (netlbl_active)
4762 /* we do this in the FORWARD path and not the POST_ROUTING
4763 * path because we want to make sure we apply the necessary
4764 * labeling before IPsec is applied so we can leverage AH
4765 * protection */
4766 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4767 return NF_DROP;
4768
4769 return NF_ACCEPT;
4770 }
4771
4772 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4773 struct sk_buff *skb,
4774 const struct net_device *in,
4775 const struct net_device *out,
4776 int (*okfn)(struct sk_buff *))
4777 {
4778 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4779 }
4780
4781 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4782 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4783 struct sk_buff *skb,
4784 const struct net_device *in,
4785 const struct net_device *out,
4786 int (*okfn)(struct sk_buff *))
4787 {
4788 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4789 }
4790 #endif /* IPV6 */
4791
4792 static unsigned int selinux_ip_output(struct sk_buff *skb,
4793 u16 family)
4794 {
4795 struct sock *sk;
4796 u32 sid;
4797
4798 if (!netlbl_enabled())
4799 return NF_ACCEPT;
4800
4801 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4802 * because we want to make sure we apply the necessary labeling
4803 * before IPsec is applied so we can leverage AH protection */
4804 sk = skb->sk;
4805 if (sk) {
4806 struct sk_security_struct *sksec;
4807
4808 if (sk->sk_state == TCP_LISTEN)
4809 /* if the socket is the listening state then this
4810 * packet is a SYN-ACK packet which means it needs to
4811 * be labeled based on the connection/request_sock and
4812 * not the parent socket. unfortunately, we can't
4813 * lookup the request_sock yet as it isn't queued on
4814 * the parent socket until after the SYN-ACK is sent.
4815 * the "solution" is to simply pass the packet as-is
4816 * as any IP option based labeling should be copied
4817 * from the initial connection request (in the IP
4818 * layer). it is far from ideal, but until we get a
4819 * security label in the packet itself this is the
4820 * best we can do. */
4821 return NF_ACCEPT;
4822
4823 /* standard practice, label using the parent socket */
4824 sksec = sk->sk_security;
4825 sid = sksec->sid;
4826 } else
4827 sid = SECINITSID_KERNEL;
4828 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4829 return NF_DROP;
4830
4831 return NF_ACCEPT;
4832 }
4833
4834 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4835 struct sk_buff *skb,
4836 const struct net_device *in,
4837 const struct net_device *out,
4838 int (*okfn)(struct sk_buff *))
4839 {
4840 return selinux_ip_output(skb, PF_INET);
4841 }
4842
4843 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4844 int ifindex,
4845 u16 family)
4846 {
4847 struct sock *sk = skb->sk;
4848 struct sk_security_struct *sksec;
4849 struct common_audit_data ad;
4850 struct lsm_network_audit net = {0,};
4851 char *addrp;
4852 u8 proto;
4853
4854 if (sk == NULL)
4855 return NF_ACCEPT;
4856 sksec = sk->sk_security;
4857
4858 ad.type = LSM_AUDIT_DATA_NET;
4859 ad.u.net = &net;
4860 ad.u.net->netif = ifindex;
4861 ad.u.net->family = family;
4862 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4863 return NF_DROP;
4864
4865 if (selinux_secmark_enabled())
4866 if (avc_has_perm(sksec->sid, skb->secmark,
4867 SECCLASS_PACKET, PACKET__SEND, &ad))
4868 return NF_DROP_ERR(-ECONNREFUSED);
4869
4870 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4871 return NF_DROP_ERR(-ECONNREFUSED);
4872
4873 return NF_ACCEPT;
4874 }
4875
4876 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4877 u16 family)
4878 {
4879 u32 secmark_perm;
4880 u32 peer_sid;
4881 struct sock *sk;
4882 struct common_audit_data ad;
4883 struct lsm_network_audit net = {0,};
4884 char *addrp;
4885 u8 secmark_active;
4886 u8 peerlbl_active;
4887
4888 /* If any sort of compatibility mode is enabled then handoff processing
4889 * to the selinux_ip_postroute_compat() function to deal with the
4890 * special handling. We do this in an attempt to keep this function
4891 * as fast and as clean as possible. */
4892 if (!selinux_policycap_netpeer)
4893 return selinux_ip_postroute_compat(skb, ifindex, family);
4894
4895 secmark_active = selinux_secmark_enabled();
4896 peerlbl_active = selinux_peerlbl_enabled();
4897 if (!secmark_active && !peerlbl_active)
4898 return NF_ACCEPT;
4899
4900 sk = skb->sk;
4901
4902 #ifdef CONFIG_XFRM
4903 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4904 * packet transformation so allow the packet to pass without any checks
4905 * since we'll have another chance to perform access control checks
4906 * when the packet is on it's final way out.
4907 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4908 * is NULL, in this case go ahead and apply access control.
4909 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4910 * TCP listening state we cannot wait until the XFRM processing
4911 * is done as we will miss out on the SA label if we do;
4912 * unfortunately, this means more work, but it is only once per
4913 * connection. */
4914 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4915 !(sk != NULL && sk->sk_state == TCP_LISTEN))
4916 return NF_ACCEPT;
4917 #endif
4918
4919 if (sk == NULL) {
4920 /* Without an associated socket the packet is either coming
4921 * from the kernel or it is being forwarded; check the packet
4922 * to determine which and if the packet is being forwarded
4923 * query the packet directly to determine the security label. */
4924 if (skb->skb_iif) {
4925 secmark_perm = PACKET__FORWARD_OUT;
4926 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4927 return NF_DROP;
4928 } else {
4929 secmark_perm = PACKET__SEND;
4930 peer_sid = SECINITSID_KERNEL;
4931 }
4932 } else if (sk->sk_state == TCP_LISTEN) {
4933 /* Locally generated packet but the associated socket is in the
4934 * listening state which means this is a SYN-ACK packet. In
4935 * this particular case the correct security label is assigned
4936 * to the connection/request_sock but unfortunately we can't
4937 * query the request_sock as it isn't queued on the parent
4938 * socket until after the SYN-ACK packet is sent; the only
4939 * viable choice is to regenerate the label like we do in
4940 * selinux_inet_conn_request(). See also selinux_ip_output()
4941 * for similar problems. */
4942 u32 skb_sid;
4943 struct sk_security_struct *sksec = sk->sk_security;
4944 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4945 return NF_DROP;
4946 /* At this point, if the returned skb peerlbl is SECSID_NULL
4947 * and the packet has been through at least one XFRM
4948 * transformation then we must be dealing with the "final"
4949 * form of labeled IPsec packet; since we've already applied
4950 * all of our access controls on this packet we can safely
4951 * pass the packet. */
4952 if (skb_sid == SECSID_NULL) {
4953 switch (family) {
4954 case PF_INET:
4955 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4956 return NF_ACCEPT;
4957 break;
4958 case PF_INET6:
4959 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4960 return NF_ACCEPT;
4961 default:
4962 return NF_DROP_ERR(-ECONNREFUSED);
4963 }
4964 }
4965 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4966 return NF_DROP;
4967 secmark_perm = PACKET__SEND;
4968 } else {
4969 /* Locally generated packet, fetch the security label from the
4970 * associated socket. */
4971 struct sk_security_struct *sksec = sk->sk_security;
4972 peer_sid = sksec->sid;
4973 secmark_perm = PACKET__SEND;
4974 }
4975
4976 ad.type = LSM_AUDIT_DATA_NET;
4977 ad.u.net = &net;
4978 ad.u.net->netif = ifindex;
4979 ad.u.net->family = family;
4980 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4981 return NF_DROP;
4982
4983 if (secmark_active)
4984 if (avc_has_perm(peer_sid, skb->secmark,
4985 SECCLASS_PACKET, secmark_perm, &ad))
4986 return NF_DROP_ERR(-ECONNREFUSED);
4987
4988 if (peerlbl_active) {
4989 u32 if_sid;
4990 u32 node_sid;
4991
4992 if (sel_netif_sid(ifindex, &if_sid))
4993 return NF_DROP;
4994 if (avc_has_perm(peer_sid, if_sid,
4995 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4996 return NF_DROP_ERR(-ECONNREFUSED);
4997
4998 if (sel_netnode_sid(addrp, family, &node_sid))
4999 return NF_DROP;
5000 if (avc_has_perm(peer_sid, node_sid,
5001 SECCLASS_NODE, NODE__SENDTO, &ad))
5002 return NF_DROP_ERR(-ECONNREFUSED);
5003 }
5004
5005 return NF_ACCEPT;
5006 }
5007
5008 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5009 struct sk_buff *skb,
5010 const struct net_device *in,
5011 const struct net_device *out,
5012 int (*okfn)(struct sk_buff *))
5013 {
5014 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
5015 }
5016
5017 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5018 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5019 struct sk_buff *skb,
5020 const struct net_device *in,
5021 const struct net_device *out,
5022 int (*okfn)(struct sk_buff *))
5023 {
5024 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
5025 }
5026 #endif /* IPV6 */
5027
5028 #endif /* CONFIG_NETFILTER */
5029
5030 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5031 {
5032 int err;
5033
5034 err = cap_netlink_send(sk, skb);
5035 if (err)
5036 return err;
5037
5038 return selinux_nlmsg_perm(sk, skb);
5039 }
5040
5041 static int ipc_alloc_security(struct task_struct *task,
5042 struct kern_ipc_perm *perm,
5043 u16 sclass)
5044 {
5045 struct ipc_security_struct *isec;
5046 u32 sid;
5047
5048 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5049 if (!isec)
5050 return -ENOMEM;
5051
5052 sid = task_sid(task);
5053 isec->sclass = sclass;
5054 isec->sid = sid;
5055 perm->security = isec;
5056
5057 return 0;
5058 }
5059
5060 static void ipc_free_security(struct kern_ipc_perm *perm)
5061 {
5062 struct ipc_security_struct *isec = perm->security;
5063 perm->security = NULL;
5064 kfree(isec);
5065 }
5066
5067 static int msg_msg_alloc_security(struct msg_msg *msg)
5068 {
5069 struct msg_security_struct *msec;
5070
5071 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5072 if (!msec)
5073 return -ENOMEM;
5074
5075 msec->sid = SECINITSID_UNLABELED;
5076 msg->security = msec;
5077
5078 return 0;
5079 }
5080
5081 static void msg_msg_free_security(struct msg_msg *msg)
5082 {
5083 struct msg_security_struct *msec = msg->security;
5084
5085 msg->security = NULL;
5086 kfree(msec);
5087 }
5088
5089 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5090 u32 perms)
5091 {
5092 struct ipc_security_struct *isec;
5093 struct common_audit_data ad;
5094 u32 sid = current_sid();
5095
5096 isec = ipc_perms->security;
5097
5098 ad.type = LSM_AUDIT_DATA_IPC;
5099 ad.u.ipc_id = ipc_perms->key;
5100
5101 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5102 }
5103
5104 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5105 {
5106 return msg_msg_alloc_security(msg);
5107 }
5108
5109 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5110 {
5111 msg_msg_free_security(msg);
5112 }
5113
5114 /* message queue security operations */
5115 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5116 {
5117 struct ipc_security_struct *isec;
5118 struct common_audit_data ad;
5119 u32 sid = current_sid();
5120 int rc;
5121
5122 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5123 if (rc)
5124 return rc;
5125
5126 isec = msq->q_perm.security;
5127
5128 ad.type = LSM_AUDIT_DATA_IPC;
5129 ad.u.ipc_id = msq->q_perm.key;
5130
5131 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5132 MSGQ__CREATE, &ad);
5133 if (rc) {
5134 ipc_free_security(&msq->q_perm);
5135 return rc;
5136 }
5137 return 0;
5138 }
5139
5140 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5141 {
5142 ipc_free_security(&msq->q_perm);
5143 }
5144
5145 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5146 {
5147 struct ipc_security_struct *isec;
5148 struct common_audit_data ad;
5149 u32 sid = current_sid();
5150
5151 isec = msq->q_perm.security;
5152
5153 ad.type = LSM_AUDIT_DATA_IPC;
5154 ad.u.ipc_id = msq->q_perm.key;
5155
5156 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5157 MSGQ__ASSOCIATE, &ad);
5158 }
5159
5160 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5161 {
5162 int err;
5163 int perms;
5164
5165 switch (cmd) {
5166 case IPC_INFO:
5167 case MSG_INFO:
5168 /* No specific object, just general system-wide information. */
5169 return task_has_system(current, SYSTEM__IPC_INFO);
5170 case IPC_STAT:
5171 case MSG_STAT:
5172 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5173 break;
5174 case IPC_SET:
5175 perms = MSGQ__SETATTR;
5176 break;
5177 case IPC_RMID:
5178 perms = MSGQ__DESTROY;
5179 break;
5180 default:
5181 return 0;
5182 }
5183
5184 err = ipc_has_perm(&msq->q_perm, perms);
5185 return err;
5186 }
5187
5188 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5189 {
5190 struct ipc_security_struct *isec;
5191 struct msg_security_struct *msec;
5192 struct common_audit_data ad;
5193 u32 sid = current_sid();
5194 int rc;
5195
5196 isec = msq->q_perm.security;
5197 msec = msg->security;
5198
5199 /*
5200 * First time through, need to assign label to the message
5201 */
5202 if (msec->sid == SECINITSID_UNLABELED) {
5203 /*
5204 * Compute new sid based on current process and
5205 * message queue this message will be stored in
5206 */
5207 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5208 NULL, &msec->sid);
5209 if (rc)
5210 return rc;
5211 }
5212
5213 ad.type = LSM_AUDIT_DATA_IPC;
5214 ad.u.ipc_id = msq->q_perm.key;
5215
5216 /* Can this process write to the queue? */
5217 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5218 MSGQ__WRITE, &ad);
5219 if (!rc)
5220 /* Can this process send the message */
5221 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5222 MSG__SEND, &ad);
5223 if (!rc)
5224 /* Can the message be put in the queue? */
5225 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5226 MSGQ__ENQUEUE, &ad);
5227
5228 return rc;
5229 }
5230
5231 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5232 struct task_struct *target,
5233 long type, int mode)
5234 {
5235 struct ipc_security_struct *isec;
5236 struct msg_security_struct *msec;
5237 struct common_audit_data ad;
5238 u32 sid = task_sid(target);
5239 int rc;
5240
5241 isec = msq->q_perm.security;
5242 msec = msg->security;
5243
5244 ad.type = LSM_AUDIT_DATA_IPC;
5245 ad.u.ipc_id = msq->q_perm.key;
5246
5247 rc = avc_has_perm(sid, isec->sid,
5248 SECCLASS_MSGQ, MSGQ__READ, &ad);
5249 if (!rc)
5250 rc = avc_has_perm(sid, msec->sid,
5251 SECCLASS_MSG, MSG__RECEIVE, &ad);
5252 return rc;
5253 }
5254
5255 /* Shared Memory security operations */
5256 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5257 {
5258 struct ipc_security_struct *isec;
5259 struct common_audit_data ad;
5260 u32 sid = current_sid();
5261 int rc;
5262
5263 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5264 if (rc)
5265 return rc;
5266
5267 isec = shp->shm_perm.security;
5268
5269 ad.type = LSM_AUDIT_DATA_IPC;
5270 ad.u.ipc_id = shp->shm_perm.key;
5271
5272 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5273 SHM__CREATE, &ad);
5274 if (rc) {
5275 ipc_free_security(&shp->shm_perm);
5276 return rc;
5277 }
5278 return 0;
5279 }
5280
5281 static void selinux_shm_free_security(struct shmid_kernel *shp)
5282 {
5283 ipc_free_security(&shp->shm_perm);
5284 }
5285
5286 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5287 {
5288 struct ipc_security_struct *isec;
5289 struct common_audit_data ad;
5290 u32 sid = current_sid();
5291
5292 isec = shp->shm_perm.security;
5293
5294 ad.type = LSM_AUDIT_DATA_IPC;
5295 ad.u.ipc_id = shp->shm_perm.key;
5296
5297 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5298 SHM__ASSOCIATE, &ad);
5299 }
5300
5301 /* Note, at this point, shp is locked down */
5302 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5303 {
5304 int perms;
5305 int err;
5306
5307 switch (cmd) {
5308 case IPC_INFO:
5309 case SHM_INFO:
5310 /* No specific object, just general system-wide information. */
5311 return task_has_system(current, SYSTEM__IPC_INFO);
5312 case IPC_STAT:
5313 case SHM_STAT:
5314 perms = SHM__GETATTR | SHM__ASSOCIATE;
5315 break;
5316 case IPC_SET:
5317 perms = SHM__SETATTR;
5318 break;
5319 case SHM_LOCK:
5320 case SHM_UNLOCK:
5321 perms = SHM__LOCK;
5322 break;
5323 case IPC_RMID:
5324 perms = SHM__DESTROY;
5325 break;
5326 default:
5327 return 0;
5328 }
5329
5330 err = ipc_has_perm(&shp->shm_perm, perms);
5331 return err;
5332 }
5333
5334 static int selinux_shm_shmat(struct shmid_kernel *shp,
5335 char __user *shmaddr, int shmflg)
5336 {
5337 u32 perms;
5338
5339 if (shmflg & SHM_RDONLY)
5340 perms = SHM__READ;
5341 else
5342 perms = SHM__READ | SHM__WRITE;
5343
5344 return ipc_has_perm(&shp->shm_perm, perms);
5345 }
5346
5347 /* Semaphore security operations */
5348 static int selinux_sem_alloc_security(struct sem_array *sma)
5349 {
5350 struct ipc_security_struct *isec;
5351 struct common_audit_data ad;
5352 u32 sid = current_sid();
5353 int rc;
5354
5355 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5356 if (rc)
5357 return rc;
5358
5359 isec = sma->sem_perm.security;
5360
5361 ad.type = LSM_AUDIT_DATA_IPC;
5362 ad.u.ipc_id = sma->sem_perm.key;
5363
5364 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5365 SEM__CREATE, &ad);
5366 if (rc) {
5367 ipc_free_security(&sma->sem_perm);
5368 return rc;
5369 }
5370 return 0;
5371 }
5372
5373 static void selinux_sem_free_security(struct sem_array *sma)
5374 {
5375 ipc_free_security(&sma->sem_perm);
5376 }
5377
5378 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5379 {
5380 struct ipc_security_struct *isec;
5381 struct common_audit_data ad;
5382 u32 sid = current_sid();
5383
5384 isec = sma->sem_perm.security;
5385
5386 ad.type = LSM_AUDIT_DATA_IPC;
5387 ad.u.ipc_id = sma->sem_perm.key;
5388
5389 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5390 SEM__ASSOCIATE, &ad);
5391 }
5392
5393 /* Note, at this point, sma is locked down */
5394 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5395 {
5396 int err;
5397 u32 perms;
5398
5399 switch (cmd) {
5400 case IPC_INFO:
5401 case SEM_INFO:
5402 /* No specific object, just general system-wide information. */
5403 return task_has_system(current, SYSTEM__IPC_INFO);
5404 case GETPID:
5405 case GETNCNT:
5406 case GETZCNT:
5407 perms = SEM__GETATTR;
5408 break;
5409 case GETVAL:
5410 case GETALL:
5411 perms = SEM__READ;
5412 break;
5413 case SETVAL:
5414 case SETALL:
5415 perms = SEM__WRITE;
5416 break;
5417 case IPC_RMID:
5418 perms = SEM__DESTROY;
5419 break;
5420 case IPC_SET:
5421 perms = SEM__SETATTR;
5422 break;
5423 case IPC_STAT:
5424 case SEM_STAT:
5425 perms = SEM__GETATTR | SEM__ASSOCIATE;
5426 break;
5427 default:
5428 return 0;
5429 }
5430
5431 err = ipc_has_perm(&sma->sem_perm, perms);
5432 return err;
5433 }
5434
5435 static int selinux_sem_semop(struct sem_array *sma,
5436 struct sembuf *sops, unsigned nsops, int alter)
5437 {
5438 u32 perms;
5439
5440 if (alter)
5441 perms = SEM__READ | SEM__WRITE;
5442 else
5443 perms = SEM__READ;
5444
5445 return ipc_has_perm(&sma->sem_perm, perms);
5446 }
5447
5448 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5449 {
5450 u32 av = 0;
5451
5452 av = 0;
5453 if (flag & S_IRUGO)
5454 av |= IPC__UNIX_READ;
5455 if (flag & S_IWUGO)
5456 av |= IPC__UNIX_WRITE;
5457
5458 if (av == 0)
5459 return 0;
5460
5461 return ipc_has_perm(ipcp, av);
5462 }
5463
5464 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5465 {
5466 struct ipc_security_struct *isec = ipcp->security;
5467 *secid = isec->sid;
5468 }
5469
5470 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5471 {
5472 if (inode)
5473 inode_doinit_with_dentry(inode, dentry);
5474 }
5475
5476 static int selinux_getprocattr(struct task_struct *p,
5477 char *name, char **value)
5478 {
5479 const struct task_security_struct *__tsec;
5480 u32 sid;
5481 int error;
5482 unsigned len;
5483
5484 if (current != p) {
5485 error = current_has_perm(p, PROCESS__GETATTR);
5486 if (error)
5487 return error;
5488 }
5489
5490 rcu_read_lock();
5491 __tsec = __task_cred(p)->security;
5492
5493 if (!strcmp(name, "current"))
5494 sid = __tsec->sid;
5495 else if (!strcmp(name, "prev"))
5496 sid = __tsec->osid;
5497 else if (!strcmp(name, "exec"))
5498 sid = __tsec->exec_sid;
5499 else if (!strcmp(name, "fscreate"))
5500 sid = __tsec->create_sid;
5501 else if (!strcmp(name, "keycreate"))
5502 sid = __tsec->keycreate_sid;
5503 else if (!strcmp(name, "sockcreate"))
5504 sid = __tsec->sockcreate_sid;
5505 else
5506 goto invalid;
5507 rcu_read_unlock();
5508
5509 if (!sid)
5510 return 0;
5511
5512 error = security_sid_to_context(sid, value, &len);
5513 if (error)
5514 return error;
5515 return len;
5516
5517 invalid:
5518 rcu_read_unlock();
5519 return -EINVAL;
5520 }
5521
5522 static int selinux_setprocattr(struct task_struct *p,
5523 char *name, void *value, size_t size)
5524 {
5525 struct task_security_struct *tsec;
5526 struct task_struct *tracer;
5527 struct cred *new;
5528 u32 sid = 0, ptsid;
5529 int error;
5530 char *str = value;
5531
5532 if (current != p) {
5533 /* SELinux only allows a process to change its own
5534 security attributes. */
5535 return -EACCES;
5536 }
5537
5538 /*
5539 * Basic control over ability to set these attributes at all.
5540 * current == p, but we'll pass them separately in case the
5541 * above restriction is ever removed.
5542 */
5543 if (!strcmp(name, "exec"))
5544 error = current_has_perm(p, PROCESS__SETEXEC);
5545 else if (!strcmp(name, "fscreate"))
5546 error = current_has_perm(p, PROCESS__SETFSCREATE);
5547 else if (!strcmp(name, "keycreate"))
5548 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5549 else if (!strcmp(name, "sockcreate"))
5550 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5551 else if (!strcmp(name, "current"))
5552 error = current_has_perm(p, PROCESS__SETCURRENT);
5553 else
5554 error = -EINVAL;
5555 if (error)
5556 return error;
5557
5558 /* Obtain a SID for the context, if one was specified. */
5559 if (size && str[1] && str[1] != '\n') {
5560 if (str[size-1] == '\n') {
5561 str[size-1] = 0;
5562 size--;
5563 }
5564 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5565 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5566 if (!capable(CAP_MAC_ADMIN)) {
5567 struct audit_buffer *ab;
5568 size_t audit_size;
5569
5570 /* We strip a nul only if it is at the end, otherwise the
5571 * context contains a nul and we should audit that */
5572 if (str[size - 1] == '\0')
5573 audit_size = size - 1;
5574 else
5575 audit_size = size;
5576 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5577 audit_log_format(ab, "op=fscreate invalid_context=");
5578 audit_log_n_untrustedstring(ab, value, audit_size);
5579 audit_log_end(ab);
5580
5581 return error;
5582 }
5583 error = security_context_to_sid_force(value, size,
5584 &sid);
5585 }
5586 if (error)
5587 return error;
5588 }
5589
5590 new = prepare_creds();
5591 if (!new)
5592 return -ENOMEM;
5593
5594 /* Permission checking based on the specified context is
5595 performed during the actual operation (execve,
5596 open/mkdir/...), when we know the full context of the
5597 operation. See selinux_bprm_set_creds for the execve
5598 checks and may_create for the file creation checks. The
5599 operation will then fail if the context is not permitted. */
5600 tsec = new->security;
5601 if (!strcmp(name, "exec")) {
5602 tsec->exec_sid = sid;
5603 } else if (!strcmp(name, "fscreate")) {
5604 tsec->create_sid = sid;
5605 } else if (!strcmp(name, "keycreate")) {
5606 error = may_create_key(sid, p);
5607 if (error)
5608 goto abort_change;
5609 tsec->keycreate_sid = sid;
5610 } else if (!strcmp(name, "sockcreate")) {
5611 tsec->sockcreate_sid = sid;
5612 } else if (!strcmp(name, "current")) {
5613 error = -EINVAL;
5614 if (sid == 0)
5615 goto abort_change;
5616
5617 /* Only allow single threaded processes to change context */
5618 error = -EPERM;
5619 if (!current_is_single_threaded()) {
5620 error = security_bounded_transition(tsec->sid, sid);
5621 if (error)
5622 goto abort_change;
5623 }
5624
5625 /* Check permissions for the transition. */
5626 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5627 PROCESS__DYNTRANSITION, NULL);
5628 if (error)
5629 goto abort_change;
5630
5631 /* Check for ptracing, and update the task SID if ok.
5632 Otherwise, leave SID unchanged and fail. */
5633 ptsid = 0;
5634 rcu_read_lock();
5635 tracer = ptrace_parent(p);
5636 if (tracer)
5637 ptsid = task_sid(tracer);
5638 rcu_read_unlock();
5639
5640 if (tracer) {
5641 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5642 PROCESS__PTRACE, NULL);
5643 if (error)
5644 goto abort_change;
5645 }
5646
5647 tsec->sid = sid;
5648 } else {
5649 error = -EINVAL;
5650 goto abort_change;
5651 }
5652
5653 commit_creds(new);
5654 return size;
5655
5656 abort_change:
5657 abort_creds(new);
5658 return error;
5659 }
5660
5661 static int selinux_ismaclabel(const char *name)
5662 {
5663 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5664 }
5665
5666 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5667 {
5668 return security_sid_to_context(secid, secdata, seclen);
5669 }
5670
5671 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5672 {
5673 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5674 }
5675
5676 static void selinux_release_secctx(char *secdata, u32 seclen)
5677 {
5678 kfree(secdata);
5679 }
5680
5681 /*
5682 * called with inode->i_mutex locked
5683 */
5684 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5685 {
5686 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5687 }
5688
5689 /*
5690 * called with inode->i_mutex locked
5691 */
5692 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5693 {
5694 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5695 }
5696
5697 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5698 {
5699 int len = 0;
5700 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5701 ctx, true);
5702 if (len < 0)
5703 return len;
5704 *ctxlen = len;
5705 return 0;
5706 }
5707 #ifdef CONFIG_KEYS
5708
5709 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5710 unsigned long flags)
5711 {
5712 const struct task_security_struct *tsec;
5713 struct key_security_struct *ksec;
5714
5715 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5716 if (!ksec)
5717 return -ENOMEM;
5718
5719 tsec = cred->security;
5720 if (tsec->keycreate_sid)
5721 ksec->sid = tsec->keycreate_sid;
5722 else
5723 ksec->sid = tsec->sid;
5724
5725 k->security = ksec;
5726 return 0;
5727 }
5728
5729 static void selinux_key_free(struct key *k)
5730 {
5731 struct key_security_struct *ksec = k->security;
5732
5733 k->security = NULL;
5734 kfree(ksec);
5735 }
5736
5737 static int selinux_key_permission(key_ref_t key_ref,
5738 const struct cred *cred,
5739 unsigned perm)
5740 {
5741 struct key *key;
5742 struct key_security_struct *ksec;
5743 u32 sid;
5744
5745 /* if no specific permissions are requested, we skip the
5746 permission check. No serious, additional covert channels
5747 appear to be created. */
5748 if (perm == 0)
5749 return 0;
5750
5751 sid = cred_sid(cred);
5752
5753 key = key_ref_to_ptr(key_ref);
5754 ksec = key->security;
5755
5756 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5757 }
5758
5759 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5760 {
5761 struct key_security_struct *ksec = key->security;
5762 char *context = NULL;
5763 unsigned len;
5764 int rc;
5765
5766 rc = security_sid_to_context(ksec->sid, &context, &len);
5767 if (!rc)
5768 rc = len;
5769 *_buffer = context;
5770 return rc;
5771 }
5772
5773 #endif
5774
5775 static struct security_operations selinux_ops = {
5776 .name = "selinux",
5777
5778 .ptrace_access_check = selinux_ptrace_access_check,
5779 .ptrace_traceme = selinux_ptrace_traceme,
5780 .capget = selinux_capget,
5781 .capset = selinux_capset,
5782 .capable = selinux_capable,
5783 .quotactl = selinux_quotactl,
5784 .quota_on = selinux_quota_on,
5785 .syslog = selinux_syslog,
5786 .vm_enough_memory = selinux_vm_enough_memory,
5787
5788 .netlink_send = selinux_netlink_send,
5789
5790 .bprm_set_creds = selinux_bprm_set_creds,
5791 .bprm_committing_creds = selinux_bprm_committing_creds,
5792 .bprm_committed_creds = selinux_bprm_committed_creds,
5793 .bprm_secureexec = selinux_bprm_secureexec,
5794
5795 .sb_alloc_security = selinux_sb_alloc_security,
5796 .sb_free_security = selinux_sb_free_security,
5797 .sb_copy_data = selinux_sb_copy_data,
5798 .sb_remount = selinux_sb_remount,
5799 .sb_kern_mount = selinux_sb_kern_mount,
5800 .sb_show_options = selinux_sb_show_options,
5801 .sb_statfs = selinux_sb_statfs,
5802 .sb_mount = selinux_mount,
5803 .sb_umount = selinux_umount,
5804 .sb_set_mnt_opts = selinux_set_mnt_opts,
5805 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5806 .sb_parse_opts_str = selinux_parse_opts_str,
5807
5808 .dentry_init_security = selinux_dentry_init_security,
5809
5810 .inode_alloc_security = selinux_inode_alloc_security,
5811 .inode_free_security = selinux_inode_free_security,
5812 .inode_init_security = selinux_inode_init_security,
5813 .inode_create = selinux_inode_create,
5814 .inode_link = selinux_inode_link,
5815 .inode_unlink = selinux_inode_unlink,
5816 .inode_symlink = selinux_inode_symlink,
5817 .inode_mkdir = selinux_inode_mkdir,
5818 .inode_rmdir = selinux_inode_rmdir,
5819 .inode_mknod = selinux_inode_mknod,
5820 .inode_rename = selinux_inode_rename,
5821 .inode_readlink = selinux_inode_readlink,
5822 .inode_follow_link = selinux_inode_follow_link,
5823 .inode_permission = selinux_inode_permission,
5824 .inode_setattr = selinux_inode_setattr,
5825 .inode_getattr = selinux_inode_getattr,
5826 .inode_setxattr = selinux_inode_setxattr,
5827 .inode_post_setxattr = selinux_inode_post_setxattr,
5828 .inode_getxattr = selinux_inode_getxattr,
5829 .inode_listxattr = selinux_inode_listxattr,
5830 .inode_removexattr = selinux_inode_removexattr,
5831 .inode_getsecurity = selinux_inode_getsecurity,
5832 .inode_setsecurity = selinux_inode_setsecurity,
5833 .inode_listsecurity = selinux_inode_listsecurity,
5834 .inode_getsecid = selinux_inode_getsecid,
5835
5836 .file_permission = selinux_file_permission,
5837 .file_alloc_security = selinux_file_alloc_security,
5838 .file_free_security = selinux_file_free_security,
5839 .file_ioctl = selinux_file_ioctl,
5840 .mmap_file = selinux_mmap_file,
5841 .mmap_addr = selinux_mmap_addr,
5842 .file_mprotect = selinux_file_mprotect,
5843 .file_lock = selinux_file_lock,
5844 .file_fcntl = selinux_file_fcntl,
5845 .file_set_fowner = selinux_file_set_fowner,
5846 .file_send_sigiotask = selinux_file_send_sigiotask,
5847 .file_receive = selinux_file_receive,
5848
5849 .file_open = selinux_file_open,
5850
5851 .task_create = selinux_task_create,
5852 .cred_alloc_blank = selinux_cred_alloc_blank,
5853 .cred_free = selinux_cred_free,
5854 .cred_prepare = selinux_cred_prepare,
5855 .cred_transfer = selinux_cred_transfer,
5856 .kernel_act_as = selinux_kernel_act_as,
5857 .kernel_create_files_as = selinux_kernel_create_files_as,
5858 .kernel_module_request = selinux_kernel_module_request,
5859 .task_setpgid = selinux_task_setpgid,
5860 .task_getpgid = selinux_task_getpgid,
5861 .task_getsid = selinux_task_getsid,
5862 .task_getsecid = selinux_task_getsecid,
5863 .task_setnice = selinux_task_setnice,
5864 .task_setioprio = selinux_task_setioprio,
5865 .task_getioprio = selinux_task_getioprio,
5866 .task_setrlimit = selinux_task_setrlimit,
5867 .task_setscheduler = selinux_task_setscheduler,
5868 .task_getscheduler = selinux_task_getscheduler,
5869 .task_movememory = selinux_task_movememory,
5870 .task_kill = selinux_task_kill,
5871 .task_wait = selinux_task_wait,
5872 .task_to_inode = selinux_task_to_inode,
5873
5874 .ipc_permission = selinux_ipc_permission,
5875 .ipc_getsecid = selinux_ipc_getsecid,
5876
5877 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5878 .msg_msg_free_security = selinux_msg_msg_free_security,
5879
5880 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5881 .msg_queue_free_security = selinux_msg_queue_free_security,
5882 .msg_queue_associate = selinux_msg_queue_associate,
5883 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5884 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5885 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5886
5887 .shm_alloc_security = selinux_shm_alloc_security,
5888 .shm_free_security = selinux_shm_free_security,
5889 .shm_associate = selinux_shm_associate,
5890 .shm_shmctl = selinux_shm_shmctl,
5891 .shm_shmat = selinux_shm_shmat,
5892
5893 .sem_alloc_security = selinux_sem_alloc_security,
5894 .sem_free_security = selinux_sem_free_security,
5895 .sem_associate = selinux_sem_associate,
5896 .sem_semctl = selinux_sem_semctl,
5897 .sem_semop = selinux_sem_semop,
5898
5899 .d_instantiate = selinux_d_instantiate,
5900
5901 .getprocattr = selinux_getprocattr,
5902 .setprocattr = selinux_setprocattr,
5903
5904 .ismaclabel = selinux_ismaclabel,
5905 .secid_to_secctx = selinux_secid_to_secctx,
5906 .secctx_to_secid = selinux_secctx_to_secid,
5907 .release_secctx = selinux_release_secctx,
5908 .inode_notifysecctx = selinux_inode_notifysecctx,
5909 .inode_setsecctx = selinux_inode_setsecctx,
5910 .inode_getsecctx = selinux_inode_getsecctx,
5911
5912 .unix_stream_connect = selinux_socket_unix_stream_connect,
5913 .unix_may_send = selinux_socket_unix_may_send,
5914
5915 .socket_create = selinux_socket_create,
5916 .socket_post_create = selinux_socket_post_create,
5917 .socket_bind = selinux_socket_bind,
5918 .socket_connect = selinux_socket_connect,
5919 .socket_listen = selinux_socket_listen,
5920 .socket_accept = selinux_socket_accept,
5921 .socket_sendmsg = selinux_socket_sendmsg,
5922 .socket_recvmsg = selinux_socket_recvmsg,
5923 .socket_getsockname = selinux_socket_getsockname,
5924 .socket_getpeername = selinux_socket_getpeername,
5925 .socket_getsockopt = selinux_socket_getsockopt,
5926 .socket_setsockopt = selinux_socket_setsockopt,
5927 .socket_shutdown = selinux_socket_shutdown,
5928 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5929 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5930 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5931 .sk_alloc_security = selinux_sk_alloc_security,
5932 .sk_free_security = selinux_sk_free_security,
5933 .sk_clone_security = selinux_sk_clone_security,
5934 .sk_getsecid = selinux_sk_getsecid,
5935 .sock_graft = selinux_sock_graft,
5936 .inet_conn_request = selinux_inet_conn_request,
5937 .inet_csk_clone = selinux_inet_csk_clone,
5938 .inet_conn_established = selinux_inet_conn_established,
5939 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5940 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5941 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5942 .req_classify_flow = selinux_req_classify_flow,
5943 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5944 .tun_dev_free_security = selinux_tun_dev_free_security,
5945 .tun_dev_create = selinux_tun_dev_create,
5946 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5947 .tun_dev_attach = selinux_tun_dev_attach,
5948 .tun_dev_open = selinux_tun_dev_open,
5949 .skb_owned_by = selinux_skb_owned_by,
5950
5951 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5952 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5953 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5954 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5955 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5956 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5957 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
5958 .xfrm_state_free_security = selinux_xfrm_state_free,
5959 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5960 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5961 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5962 .xfrm_decode_session = selinux_xfrm_decode_session,
5963 #endif
5964
5965 #ifdef CONFIG_KEYS
5966 .key_alloc = selinux_key_alloc,
5967 .key_free = selinux_key_free,
5968 .key_permission = selinux_key_permission,
5969 .key_getsecurity = selinux_key_getsecurity,
5970 #endif
5971
5972 #ifdef CONFIG_AUDIT
5973 .audit_rule_init = selinux_audit_rule_init,
5974 .audit_rule_known = selinux_audit_rule_known,
5975 .audit_rule_match = selinux_audit_rule_match,
5976 .audit_rule_free = selinux_audit_rule_free,
5977 #endif
5978 };
5979
5980 static __init int selinux_init(void)
5981 {
5982 if (!security_module_enable(&selinux_ops)) {
5983 selinux_enabled = 0;
5984 return 0;
5985 }
5986
5987 if (!selinux_enabled) {
5988 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5989 return 0;
5990 }
5991
5992 printk(KERN_INFO "SELinux: Initializing.\n");
5993
5994 /* Set the security state for the initial task. */
5995 cred_init_security();
5996
5997 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5998
5999 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6000 sizeof(struct inode_security_struct),
6001 0, SLAB_PANIC, NULL);
6002 avc_init();
6003
6004 if (register_security(&selinux_ops))
6005 panic("SELinux: Unable to register with kernel.\n");
6006
6007 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6008 panic("SELinux: Unable to register AVC netcache callback\n");
6009
6010 if (selinux_enforcing)
6011 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6012 else
6013 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6014
6015 return 0;
6016 }
6017
6018 static void delayed_superblock_init(struct super_block *sb, void *unused)
6019 {
6020 superblock_doinit(sb, NULL);
6021 }
6022
6023 void selinux_complete_init(void)
6024 {
6025 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6026
6027 /* Set up any superblocks initialized prior to the policy load. */
6028 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6029 iterate_supers(delayed_superblock_init, NULL);
6030 }
6031
6032 /* SELinux requires early initialization in order to label
6033 all processes and objects when they are created. */
6034 security_initcall(selinux_init);
6035
6036 #if defined(CONFIG_NETFILTER)
6037
6038 static struct nf_hook_ops selinux_ipv4_ops[] = {
6039 {
6040 .hook = selinux_ipv4_postroute,
6041 .owner = THIS_MODULE,
6042 .pf = NFPROTO_IPV4,
6043 .hooknum = NF_INET_POST_ROUTING,
6044 .priority = NF_IP_PRI_SELINUX_LAST,
6045 },
6046 {
6047 .hook = selinux_ipv4_forward,
6048 .owner = THIS_MODULE,
6049 .pf = NFPROTO_IPV4,
6050 .hooknum = NF_INET_FORWARD,
6051 .priority = NF_IP_PRI_SELINUX_FIRST,
6052 },
6053 {
6054 .hook = selinux_ipv4_output,
6055 .owner = THIS_MODULE,
6056 .pf = NFPROTO_IPV4,
6057 .hooknum = NF_INET_LOCAL_OUT,
6058 .priority = NF_IP_PRI_SELINUX_FIRST,
6059 }
6060 };
6061
6062 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6063
6064 static struct nf_hook_ops selinux_ipv6_ops[] = {
6065 {
6066 .hook = selinux_ipv6_postroute,
6067 .owner = THIS_MODULE,
6068 .pf = NFPROTO_IPV6,
6069 .hooknum = NF_INET_POST_ROUTING,
6070 .priority = NF_IP6_PRI_SELINUX_LAST,
6071 },
6072 {
6073 .hook = selinux_ipv6_forward,
6074 .owner = THIS_MODULE,
6075 .pf = NFPROTO_IPV6,
6076 .hooknum = NF_INET_FORWARD,
6077 .priority = NF_IP6_PRI_SELINUX_FIRST,
6078 }
6079 };
6080
6081 #endif /* IPV6 */
6082
6083 static int __init selinux_nf_ip_init(void)
6084 {
6085 int err = 0;
6086
6087 if (!selinux_enabled)
6088 goto out;
6089
6090 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6091
6092 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6093 if (err)
6094 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6095
6096 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6097 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6098 if (err)
6099 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6100 #endif /* IPV6 */
6101
6102 out:
6103 return err;
6104 }
6105
6106 __initcall(selinux_nf_ip_init);
6107
6108 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6109 static void selinux_nf_ip_exit(void)
6110 {
6111 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6112
6113 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6114 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6115 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6116 #endif /* IPV6 */
6117 }
6118 #endif
6119
6120 #else /* CONFIG_NETFILTER */
6121
6122 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6123 #define selinux_nf_ip_exit()
6124 #endif
6125
6126 #endif /* CONFIG_NETFILTER */
6127
6128 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6129 static int selinux_disabled;
6130
6131 int selinux_disable(void)
6132 {
6133 if (ss_initialized) {
6134 /* Not permitted after initial policy load. */
6135 return -EINVAL;
6136 }
6137
6138 if (selinux_disabled) {
6139 /* Only do this once. */
6140 return -EINVAL;
6141 }
6142
6143 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6144
6145 selinux_disabled = 1;
6146 selinux_enabled = 0;
6147
6148 reset_security_ops();
6149
6150 /* Try to destroy the avc node cache */
6151 avc_disable();
6152
6153 /* Unregister netfilter hooks. */
6154 selinux_nf_ip_exit();
6155
6156 /* Unregister selinuxfs. */
6157 exit_sel_fs();
6158
6159 return 0;
6160 }
6161 #endif
Linux kernel - Deliverables
This page took 0.183996 seconds and 5 git commands to generate.