projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'pci-v3.15-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaa...
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 extern struct security_operations *security_ops;
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!strict_strtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!strict_strtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132
133 /**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled. If the always_check_network
141 * policy capability is enabled, SECMARK is always considered enabled.
142 *
143 */
144 static int selinux_secmark_enabled(void)
145 {
146 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
147 }
148
149 /**
150 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 *
152 * Description:
153 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
154 * (1) if any are enabled or false (0) if neither are enabled. If the
155 * always_check_network policy capability is enabled, peer labeling
156 * is always considered enabled.
157 *
158 */
159 static int selinux_peerlbl_enabled(void)
160 {
161 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
162 }
163
164 /*
165 * initialise the security for the init task
166 */
167 static void cred_init_security(void)
168 {
169 struct cred *cred = (struct cred *) current->real_cred;
170 struct task_security_struct *tsec;
171
172 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
173 if (!tsec)
174 panic("SELinux: Failed to initialize initial task.\n");
175
176 tsec->osid = tsec->sid = SECINITSID_KERNEL;
177 cred->security = tsec;
178 }
179
180 /*
181 * get the security ID of a set of credentials
182 */
183 static inline u32 cred_sid(const struct cred *cred)
184 {
185 const struct task_security_struct *tsec;
186
187 tsec = cred->security;
188 return tsec->sid;
189 }
190
191 /*
192 * get the objective security ID of a task
193 */
194 static inline u32 task_sid(const struct task_struct *task)
195 {
196 u32 sid;
197
198 rcu_read_lock();
199 sid = cred_sid(__task_cred(task));
200 rcu_read_unlock();
201 return sid;
202 }
203
204 /*
205 * get the subjective security ID of the current task
206 */
207 static inline u32 current_sid(void)
208 {
209 const struct task_security_struct *tsec = current_security();
210
211 return tsec->sid;
212 }
213
214 /* Allocate and free functions for each kind of security blob. */
215
216 static int inode_alloc_security(struct inode *inode)
217 {
218 struct inode_security_struct *isec;
219 u32 sid = current_sid();
220
221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
222 if (!isec)
223 return -ENOMEM;
224
225 mutex_init(&isec->lock);
226 INIT_LIST_HEAD(&isec->list);
227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
230 isec->task_sid = sid;
231 inode->i_security = isec;
232
233 return 0;
234 }
235
236 static void inode_free_rcu(struct rcu_head *head)
237 {
238 struct inode_security_struct *isec;
239
240 isec = container_of(head, struct inode_security_struct, rcu);
241 kmem_cache_free(sel_inode_cache, isec);
242 }
243
244 static void inode_free_security(struct inode *inode)
245 {
246 struct inode_security_struct *isec = inode->i_security;
247 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
248
249 spin_lock(&sbsec->isec_lock);
250 if (!list_empty(&isec->list))
251 list_del_init(&isec->list);
252 spin_unlock(&sbsec->isec_lock);
253
254 /*
255 * The inode may still be referenced in a path walk and
256 * a call to selinux_inode_permission() can be made
257 * after inode_free_security() is called. Ideally, the VFS
258 * wouldn't do this, but fixing that is a much harder
259 * job. For now, simply free the i_security via RCU, and
260 * leave the current inode->i_security pointer intact.
261 * The inode will be freed after the RCU grace period too.
262 */
263 call_rcu(&isec->rcu, inode_free_rcu);
264 }
265
266 static int file_alloc_security(struct file *file)
267 {
268 struct file_security_struct *fsec;
269 u32 sid = current_sid();
270
271 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
272 if (!fsec)
273 return -ENOMEM;
274
275 fsec->sid = sid;
276 fsec->fown_sid = sid;
277 file->f_security = fsec;
278
279 return 0;
280 }
281
282 static void file_free_security(struct file *file)
283 {
284 struct file_security_struct *fsec = file->f_security;
285 file->f_security = NULL;
286 kfree(fsec);
287 }
288
289 static int superblock_alloc_security(struct super_block *sb)
290 {
291 struct superblock_security_struct *sbsec;
292
293 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
294 if (!sbsec)
295 return -ENOMEM;
296
297 mutex_init(&sbsec->lock);
298 INIT_LIST_HEAD(&sbsec->isec_head);
299 spin_lock_init(&sbsec->isec_lock);
300 sbsec->sb = sb;
301 sbsec->sid = SECINITSID_UNLABELED;
302 sbsec->def_sid = SECINITSID_FILE;
303 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
304 sb->s_security = sbsec;
305
306 return 0;
307 }
308
309 static void superblock_free_security(struct super_block *sb)
310 {
311 struct superblock_security_struct *sbsec = sb->s_security;
312 sb->s_security = NULL;
313 kfree(sbsec);
314 }
315
316 /* The file system's label must be initialized prior to use. */
317
318 static const char *labeling_behaviors[7] = {
319 "uses xattr",
320 "uses transition SIDs",
321 "uses task SIDs",
322 "uses genfs_contexts",
323 "not configured for labeling",
324 "uses mountpoint labeling",
325 "uses native labeling",
326 };
327
328 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
329
330 static inline int inode_doinit(struct inode *inode)
331 {
332 return inode_doinit_with_dentry(inode, NULL);
333 }
334
335 enum {
336 Opt_error = -1,
337 Opt_context = 1,
338 Opt_fscontext = 2,
339 Opt_defcontext = 3,
340 Opt_rootcontext = 4,
341 Opt_labelsupport = 5,
342 Opt_nextmntopt = 6,
343 };
344
345 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
346
347 static const match_table_t tokens = {
348 {Opt_context, CONTEXT_STR "%s"},
349 {Opt_fscontext, FSCONTEXT_STR "%s"},
350 {Opt_defcontext, DEFCONTEXT_STR "%s"},
351 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
352 {Opt_labelsupport, LABELSUPP_STR},
353 {Opt_error, NULL},
354 };
355
356 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
357
358 static int may_context_mount_sb_relabel(u32 sid,
359 struct superblock_security_struct *sbsec,
360 const struct cred *cred)
361 {
362 const struct task_security_struct *tsec = cred->security;
363 int rc;
364
365 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
366 FILESYSTEM__RELABELFROM, NULL);
367 if (rc)
368 return rc;
369
370 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
371 FILESYSTEM__RELABELTO, NULL);
372 return rc;
373 }
374
375 static int may_context_mount_inode_relabel(u32 sid,
376 struct superblock_security_struct *sbsec,
377 const struct cred *cred)
378 {
379 const struct task_security_struct *tsec = cred->security;
380 int rc;
381 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
382 FILESYSTEM__RELABELFROM, NULL);
383 if (rc)
384 return rc;
385
386 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
387 FILESYSTEM__ASSOCIATE, NULL);
388 return rc;
389 }
390
391 static int selinux_is_sblabel_mnt(struct super_block *sb)
392 {
393 struct superblock_security_struct *sbsec = sb->s_security;
394
395 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
396 sbsec->behavior == SECURITY_FS_USE_TRANS ||
397 sbsec->behavior == SECURITY_FS_USE_TASK)
398 return 1;
399
400 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
401 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
402 return 1;
403
404 /*
405 * Special handling for rootfs. Is genfs but supports
406 * setting SELinux context on in-core inodes.
407 */
408 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
409 return 1;
410
411 return 0;
412 }
413
414 static int sb_finish_set_opts(struct super_block *sb)
415 {
416 struct superblock_security_struct *sbsec = sb->s_security;
417 struct dentry *root = sb->s_root;
418 struct inode *root_inode = root->d_inode;
419 int rc = 0;
420
421 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
422 /* Make sure that the xattr handler exists and that no
423 error other than -ENODATA is returned by getxattr on
424 the root directory. -ENODATA is ok, as this may be
425 the first boot of the SELinux kernel before we have
426 assigned xattr values to the filesystem. */
427 if (!root_inode->i_op->getxattr) {
428 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
429 "xattr support\n", sb->s_id, sb->s_type->name);
430 rc = -EOPNOTSUPP;
431 goto out;
432 }
433 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
434 if (rc < 0 && rc != -ENODATA) {
435 if (rc == -EOPNOTSUPP)
436 printk(KERN_WARNING "SELinux: (dev %s, type "
437 "%s) has no security xattr handler\n",
438 sb->s_id, sb->s_type->name);
439 else
440 printk(KERN_WARNING "SELinux: (dev %s, type "
441 "%s) getxattr errno %d\n", sb->s_id,
442 sb->s_type->name, -rc);
443 goto out;
444 }
445 }
446
447 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
448 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
449 sb->s_id, sb->s_type->name);
450 else
451 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
452 sb->s_id, sb->s_type->name,
453 labeling_behaviors[sbsec->behavior-1]);
454
455 sbsec->flags |= SE_SBINITIALIZED;
456 if (selinux_is_sblabel_mnt(sb))
457 sbsec->flags |= SBLABEL_MNT;
458
459 /* Initialize the root inode. */
460 rc = inode_doinit_with_dentry(root_inode, root);
461
462 /* Initialize any other inodes associated with the superblock, e.g.
463 inodes created prior to initial policy load or inodes created
464 during get_sb by a pseudo filesystem that directly
465 populates itself. */
466 spin_lock(&sbsec->isec_lock);
467 next_inode:
468 if (!list_empty(&sbsec->isec_head)) {
469 struct inode_security_struct *isec =
470 list_entry(sbsec->isec_head.next,
471 struct inode_security_struct, list);
472 struct inode *inode = isec->inode;
473 spin_unlock(&sbsec->isec_lock);
474 inode = igrab(inode);
475 if (inode) {
476 if (!IS_PRIVATE(inode))
477 inode_doinit(inode);
478 iput(inode);
479 }
480 spin_lock(&sbsec->isec_lock);
481 list_del_init(&isec->list);
482 goto next_inode;
483 }
484 spin_unlock(&sbsec->isec_lock);
485 out:
486 return rc;
487 }
488
489 /*
490 * This function should allow an FS to ask what it's mount security
491 * options were so it can use those later for submounts, displaying
492 * mount options, or whatever.
493 */
494 static int selinux_get_mnt_opts(const struct super_block *sb,
495 struct security_mnt_opts *opts)
496 {
497 int rc = 0, i;
498 struct superblock_security_struct *sbsec = sb->s_security;
499 char *context = NULL;
500 u32 len;
501 char tmp;
502
503 security_init_mnt_opts(opts);
504
505 if (!(sbsec->flags & SE_SBINITIALIZED))
506 return -EINVAL;
507
508 if (!ss_initialized)
509 return -EINVAL;
510
511 /* make sure we always check enough bits to cover the mask */
512 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
513
514 tmp = sbsec->flags & SE_MNTMASK;
515 /* count the number of mount options for this sb */
516 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
517 if (tmp & 0x01)
518 opts->num_mnt_opts++;
519 tmp >>= 1;
520 }
521 /* Check if the Label support flag is set */
522 if (sbsec->flags & SBLABEL_MNT)
523 opts->num_mnt_opts++;
524
525 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
526 if (!opts->mnt_opts) {
527 rc = -ENOMEM;
528 goto out_free;
529 }
530
531 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
532 if (!opts->mnt_opts_flags) {
533 rc = -ENOMEM;
534 goto out_free;
535 }
536
537 i = 0;
538 if (sbsec->flags & FSCONTEXT_MNT) {
539 rc = security_sid_to_context(sbsec->sid, &context, &len);
540 if (rc)
541 goto out_free;
542 opts->mnt_opts[i] = context;
543 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
544 }
545 if (sbsec->flags & CONTEXT_MNT) {
546 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
547 if (rc)
548 goto out_free;
549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
551 }
552 if (sbsec->flags & DEFCONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
554 if (rc)
555 goto out_free;
556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
558 }
559 if (sbsec->flags & ROOTCONTEXT_MNT) {
560 struct inode *root = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *isec = root->i_security;
562
563 rc = security_sid_to_context(isec->sid, &context, &len);
564 if (rc)
565 goto out_free;
566 opts->mnt_opts[i] = context;
567 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
568 }
569 if (sbsec->flags & SBLABEL_MNT) {
570 opts->mnt_opts[i] = NULL;
571 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
572 }
573
574 BUG_ON(i != opts->num_mnt_opts);
575
576 return 0;
577
578 out_free:
579 security_free_mnt_opts(opts);
580 return rc;
581 }
582
583 static int bad_option(struct superblock_security_struct *sbsec, char flag,
584 u32 old_sid, u32 new_sid)
585 {
586 char mnt_flags = sbsec->flags & SE_MNTMASK;
587
588 /* check if the old mount command had the same options */
589 if (sbsec->flags & SE_SBINITIALIZED)
590 if (!(sbsec->flags & flag) ||
591 (old_sid != new_sid))
592 return 1;
593
594 /* check if we were passed the same options twice,
595 * aka someone passed context=a,context=b
596 */
597 if (!(sbsec->flags & SE_SBINITIALIZED))
598 if (mnt_flags & flag)
599 return 1;
600 return 0;
601 }
602
603 /*
604 * Allow filesystems with binary mount data to explicitly set mount point
605 * labeling information.
606 */
607 static int selinux_set_mnt_opts(struct super_block *sb,
608 struct security_mnt_opts *opts,
609 unsigned long kern_flags,
610 unsigned long *set_kern_flags)
611 {
612 const struct cred *cred = current_cred();
613 int rc = 0, i;
614 struct superblock_security_struct *sbsec = sb->s_security;
615 const char *name = sb->s_type->name;
616 struct inode *inode = sbsec->sb->s_root->d_inode;
617 struct inode_security_struct *root_isec = inode->i_security;
618 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
619 u32 defcontext_sid = 0;
620 char **mount_options = opts->mnt_opts;
621 int *flags = opts->mnt_opts_flags;
622 int num_opts = opts->num_mnt_opts;
623
624 mutex_lock(&sbsec->lock);
625
626 if (!ss_initialized) {
627 if (!num_opts) {
628 /* Defer initialization until selinux_complete_init,
629 after the initial policy is loaded and the security
630 server is ready to handle calls. */
631 goto out;
632 }
633 rc = -EINVAL;
634 printk(KERN_WARNING "SELinux: Unable to set superblock options "
635 "before the security server is initialized\n");
636 goto out;
637 }
638 if (kern_flags && !set_kern_flags) {
639 /* Specifying internal flags without providing a place to
640 * place the results is not allowed */
641 rc = -EINVAL;
642 goto out;
643 }
644
645 /*
646 * Binary mount data FS will come through this function twice. Once
647 * from an explicit call and once from the generic calls from the vfs.
648 * Since the generic VFS calls will not contain any security mount data
649 * we need to skip the double mount verification.
650 *
651 * This does open a hole in which we will not notice if the first
652 * mount using this sb set explict options and a second mount using
653 * this sb does not set any security options. (The first options
654 * will be used for both mounts)
655 */
656 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
657 && (num_opts == 0))
658 goto out;
659
660 /*
661 * parse the mount options, check if they are valid sids.
662 * also check if someone is trying to mount the same sb more
663 * than once with different security options.
664 */
665 for (i = 0; i < num_opts; i++) {
666 u32 sid;
667
668 if (flags[i] == SBLABEL_MNT)
669 continue;
670 rc = security_context_to_sid(mount_options[i],
671 strlen(mount_options[i]), &sid, GFP_KERNEL);
672 if (rc) {
673 printk(KERN_WARNING "SELinux: security_context_to_sid"
674 "(%s) failed for (dev %s, type %s) errno=%d\n",
675 mount_options[i], sb->s_id, name, rc);
676 goto out;
677 }
678 switch (flags[i]) {
679 case FSCONTEXT_MNT:
680 fscontext_sid = sid;
681
682 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
683 fscontext_sid))
684 goto out_double_mount;
685
686 sbsec->flags |= FSCONTEXT_MNT;
687 break;
688 case CONTEXT_MNT:
689 context_sid = sid;
690
691 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
692 context_sid))
693 goto out_double_mount;
694
695 sbsec->flags |= CONTEXT_MNT;
696 break;
697 case ROOTCONTEXT_MNT:
698 rootcontext_sid = sid;
699
700 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
701 rootcontext_sid))
702 goto out_double_mount;
703
704 sbsec->flags |= ROOTCONTEXT_MNT;
705
706 break;
707 case DEFCONTEXT_MNT:
708 defcontext_sid = sid;
709
710 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 defcontext_sid))
712 goto out_double_mount;
713
714 sbsec->flags |= DEFCONTEXT_MNT;
715
716 break;
717 default:
718 rc = -EINVAL;
719 goto out;
720 }
721 }
722
723 if (sbsec->flags & SE_SBINITIALIZED) {
724 /* previously mounted with options, but not on this attempt? */
725 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
726 goto out_double_mount;
727 rc = 0;
728 goto out;
729 }
730
731 if (strcmp(sb->s_type->name, "proc") == 0)
732 sbsec->flags |= SE_SBPROC;
733
734 if (!sbsec->behavior) {
735 /*
736 * Determine the labeling behavior to use for this
737 * filesystem type.
738 */
739 rc = security_fs_use(sb);
740 if (rc) {
741 printk(KERN_WARNING
742 "%s: security_fs_use(%s) returned %d\n",
743 __func__, sb->s_type->name, rc);
744 goto out;
745 }
746 }
747 /* sets the context of the superblock for the fs being mounted. */
748 if (fscontext_sid) {
749 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
750 if (rc)
751 goto out;
752
753 sbsec->sid = fscontext_sid;
754 }
755
756 /*
757 * Switch to using mount point labeling behavior.
758 * sets the label used on all file below the mountpoint, and will set
759 * the superblock context if not already set.
760 */
761 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
762 sbsec->behavior = SECURITY_FS_USE_NATIVE;
763 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
764 }
765
766 if (context_sid) {
767 if (!fscontext_sid) {
768 rc = may_context_mount_sb_relabel(context_sid, sbsec,
769 cred);
770 if (rc)
771 goto out;
772 sbsec->sid = context_sid;
773 } else {
774 rc = may_context_mount_inode_relabel(context_sid, sbsec,
775 cred);
776 if (rc)
777 goto out;
778 }
779 if (!rootcontext_sid)
780 rootcontext_sid = context_sid;
781
782 sbsec->mntpoint_sid = context_sid;
783 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
784 }
785
786 if (rootcontext_sid) {
787 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
788 cred);
789 if (rc)
790 goto out;
791
792 root_isec->sid = rootcontext_sid;
793 root_isec->initialized = 1;
794 }
795
796 if (defcontext_sid) {
797 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
798 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
799 rc = -EINVAL;
800 printk(KERN_WARNING "SELinux: defcontext option is "
801 "invalid for this filesystem type\n");
802 goto out;
803 }
804
805 if (defcontext_sid != sbsec->def_sid) {
806 rc = may_context_mount_inode_relabel(defcontext_sid,
807 sbsec, cred);
808 if (rc)
809 goto out;
810 }
811
812 sbsec->def_sid = defcontext_sid;
813 }
814
815 rc = sb_finish_set_opts(sb);
816 out:
817 mutex_unlock(&sbsec->lock);
818 return rc;
819 out_double_mount:
820 rc = -EINVAL;
821 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
822 "security settings for (dev %s, type %s)\n", sb->s_id, name);
823 goto out;
824 }
825
826 static int selinux_cmp_sb_context(const struct super_block *oldsb,
827 const struct super_block *newsb)
828 {
829 struct superblock_security_struct *old = oldsb->s_security;
830 struct superblock_security_struct *new = newsb->s_security;
831 char oldflags = old->flags & SE_MNTMASK;
832 char newflags = new->flags & SE_MNTMASK;
833
834 if (oldflags != newflags)
835 goto mismatch;
836 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
837 goto mismatch;
838 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
839 goto mismatch;
840 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
841 goto mismatch;
842 if (oldflags & ROOTCONTEXT_MNT) {
843 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
844 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
845 if (oldroot->sid != newroot->sid)
846 goto mismatch;
847 }
848 return 0;
849 mismatch:
850 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
851 "different security settings for (dev %s, "
852 "type %s)\n", newsb->s_id, newsb->s_type->name);
853 return -EBUSY;
854 }
855
856 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
857 struct super_block *newsb)
858 {
859 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
860 struct superblock_security_struct *newsbsec = newsb->s_security;
861
862 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
863 int set_context = (oldsbsec->flags & CONTEXT_MNT);
864 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
865
866 /*
867 * if the parent was able to be mounted it clearly had no special lsm
868 * mount options. thus we can safely deal with this superblock later
869 */
870 if (!ss_initialized)
871 return 0;
872
873 /* how can we clone if the old one wasn't set up?? */
874 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
875
876 /* if fs is reusing a sb, make sure that the contexts match */
877 if (newsbsec->flags & SE_SBINITIALIZED)
878 return selinux_cmp_sb_context(oldsb, newsb);
879
880 mutex_lock(&newsbsec->lock);
881
882 newsbsec->flags = oldsbsec->flags;
883
884 newsbsec->sid = oldsbsec->sid;
885 newsbsec->def_sid = oldsbsec->def_sid;
886 newsbsec->behavior = oldsbsec->behavior;
887
888 if (set_context) {
889 u32 sid = oldsbsec->mntpoint_sid;
890
891 if (!set_fscontext)
892 newsbsec->sid = sid;
893 if (!set_rootcontext) {
894 struct inode *newinode = newsb->s_root->d_inode;
895 struct inode_security_struct *newisec = newinode->i_security;
896 newisec->sid = sid;
897 }
898 newsbsec->mntpoint_sid = sid;
899 }
900 if (set_rootcontext) {
901 const struct inode *oldinode = oldsb->s_root->d_inode;
902 const struct inode_security_struct *oldisec = oldinode->i_security;
903 struct inode *newinode = newsb->s_root->d_inode;
904 struct inode_security_struct *newisec = newinode->i_security;
905
906 newisec->sid = oldisec->sid;
907 }
908
909 sb_finish_set_opts(newsb);
910 mutex_unlock(&newsbsec->lock);
911 return 0;
912 }
913
914 static int selinux_parse_opts_str(char *options,
915 struct security_mnt_opts *opts)
916 {
917 char *p;
918 char *context = NULL, *defcontext = NULL;
919 char *fscontext = NULL, *rootcontext = NULL;
920 int rc, num_mnt_opts = 0;
921
922 opts->num_mnt_opts = 0;
923
924 /* Standard string-based options. */
925 while ((p = strsep(&options, "|")) != NULL) {
926 int token;
927 substring_t args[MAX_OPT_ARGS];
928
929 if (!*p)
930 continue;
931
932 token = match_token(p, tokens, args);
933
934 switch (token) {
935 case Opt_context:
936 if (context || defcontext) {
937 rc = -EINVAL;
938 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
939 goto out_err;
940 }
941 context = match_strdup(&args[0]);
942 if (!context) {
943 rc = -ENOMEM;
944 goto out_err;
945 }
946 break;
947
948 case Opt_fscontext:
949 if (fscontext) {
950 rc = -EINVAL;
951 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
952 goto out_err;
953 }
954 fscontext = match_strdup(&args[0]);
955 if (!fscontext) {
956 rc = -ENOMEM;
957 goto out_err;
958 }
959 break;
960
961 case Opt_rootcontext:
962 if (rootcontext) {
963 rc = -EINVAL;
964 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
965 goto out_err;
966 }
967 rootcontext = match_strdup(&args[0]);
968 if (!rootcontext) {
969 rc = -ENOMEM;
970 goto out_err;
971 }
972 break;
973
974 case Opt_defcontext:
975 if (context || defcontext) {
976 rc = -EINVAL;
977 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
978 goto out_err;
979 }
980 defcontext = match_strdup(&args[0]);
981 if (!defcontext) {
982 rc = -ENOMEM;
983 goto out_err;
984 }
985 break;
986 case Opt_labelsupport:
987 break;
988 default:
989 rc = -EINVAL;
990 printk(KERN_WARNING "SELinux: unknown mount option\n");
991 goto out_err;
992
993 }
994 }
995
996 rc = -ENOMEM;
997 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
998 if (!opts->mnt_opts)
999 goto out_err;
1000
1001 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002 if (!opts->mnt_opts_flags) {
1003 kfree(opts->mnt_opts);
1004 goto out_err;
1005 }
1006
1007 if (fscontext) {
1008 opts->mnt_opts[num_mnt_opts] = fscontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1010 }
1011 if (context) {
1012 opts->mnt_opts[num_mnt_opts] = context;
1013 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1014 }
1015 if (rootcontext) {
1016 opts->mnt_opts[num_mnt_opts] = rootcontext;
1017 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1018 }
1019 if (defcontext) {
1020 opts->mnt_opts[num_mnt_opts] = defcontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1022 }
1023
1024 opts->num_mnt_opts = num_mnt_opts;
1025 return 0;
1026
1027 out_err:
1028 kfree(context);
1029 kfree(defcontext);
1030 kfree(fscontext);
1031 kfree(rootcontext);
1032 return rc;
1033 }
1034 /*
1035 * string mount options parsing and call set the sbsec
1036 */
1037 static int superblock_doinit(struct super_block *sb, void *data)
1038 {
1039 int rc = 0;
1040 char *options = data;
1041 struct security_mnt_opts opts;
1042
1043 security_init_mnt_opts(&opts);
1044
1045 if (!data)
1046 goto out;
1047
1048 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050 rc = selinux_parse_opts_str(options, &opts);
1051 if (rc)
1052 goto out_err;
1053
1054 out:
1055 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1056
1057 out_err:
1058 security_free_mnt_opts(&opts);
1059 return rc;
1060 }
1061
1062 static void selinux_write_opts(struct seq_file *m,
1063 struct security_mnt_opts *opts)
1064 {
1065 int i;
1066 char *prefix;
1067
1068 for (i = 0; i < opts->num_mnt_opts; i++) {
1069 char *has_comma;
1070
1071 if (opts->mnt_opts[i])
1072 has_comma = strchr(opts->mnt_opts[i], ',');
1073 else
1074 has_comma = NULL;
1075
1076 switch (opts->mnt_opts_flags[i]) {
1077 case CONTEXT_MNT:
1078 prefix = CONTEXT_STR;
1079 break;
1080 case FSCONTEXT_MNT:
1081 prefix = FSCONTEXT_STR;
1082 break;
1083 case ROOTCONTEXT_MNT:
1084 prefix = ROOTCONTEXT_STR;
1085 break;
1086 case DEFCONTEXT_MNT:
1087 prefix = DEFCONTEXT_STR;
1088 break;
1089 case SBLABEL_MNT:
1090 seq_putc(m, ',');
1091 seq_puts(m, LABELSUPP_STR);
1092 continue;
1093 default:
1094 BUG();
1095 return;
1096 };
1097 /* we need a comma before each option */
1098 seq_putc(m, ',');
1099 seq_puts(m, prefix);
1100 if (has_comma)
1101 seq_putc(m, '\"');
1102 seq_puts(m, opts->mnt_opts[i]);
1103 if (has_comma)
1104 seq_putc(m, '\"');
1105 }
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110 struct security_mnt_opts opts;
1111 int rc;
1112
1113 rc = selinux_get_mnt_opts(sb, &opts);
1114 if (rc) {
1115 /* before policy load we may get EINVAL, don't show anything */
1116 if (rc == -EINVAL)
1117 rc = 0;
1118 return rc;
1119 }
1120
1121 selinux_write_opts(m, &opts);
1122
1123 security_free_mnt_opts(&opts);
1124
1125 return rc;
1126 }
1127
1128 static inline u16 inode_mode_to_security_class(umode_t mode)
1129 {
1130 switch (mode & S_IFMT) {
1131 case S_IFSOCK:
1132 return SECCLASS_SOCK_FILE;
1133 case S_IFLNK:
1134 return SECCLASS_LNK_FILE;
1135 case S_IFREG:
1136 return SECCLASS_FILE;
1137 case S_IFBLK:
1138 return SECCLASS_BLK_FILE;
1139 case S_IFDIR:
1140 return SECCLASS_DIR;
1141 case S_IFCHR:
1142 return SECCLASS_CHR_FILE;
1143 case S_IFIFO:
1144 return SECCLASS_FIFO_FILE;
1145
1146 }
1147
1148 return SECCLASS_FILE;
1149 }
1150
1151 static inline int default_protocol_stream(int protocol)
1152 {
1153 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154 }
1155
1156 static inline int default_protocol_dgram(int protocol)
1157 {
1158 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159 }
1160
1161 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162 {
1163 switch (family) {
1164 case PF_UNIX:
1165 switch (type) {
1166 case SOCK_STREAM:
1167 case SOCK_SEQPACKET:
1168 return SECCLASS_UNIX_STREAM_SOCKET;
1169 case SOCK_DGRAM:
1170 return SECCLASS_UNIX_DGRAM_SOCKET;
1171 }
1172 break;
1173 case PF_INET:
1174 case PF_INET6:
1175 switch (type) {
1176 case SOCK_STREAM:
1177 if (default_protocol_stream(protocol))
1178 return SECCLASS_TCP_SOCKET;
1179 else
1180 return SECCLASS_RAWIP_SOCKET;
1181 case SOCK_DGRAM:
1182 if (default_protocol_dgram(protocol))
1183 return SECCLASS_UDP_SOCKET;
1184 else
1185 return SECCLASS_RAWIP_SOCKET;
1186 case SOCK_DCCP:
1187 return SECCLASS_DCCP_SOCKET;
1188 default:
1189 return SECCLASS_RAWIP_SOCKET;
1190 }
1191 break;
1192 case PF_NETLINK:
1193 switch (protocol) {
1194 case NETLINK_ROUTE:
1195 return SECCLASS_NETLINK_ROUTE_SOCKET;
1196 case NETLINK_FIREWALL:
1197 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1198 case NETLINK_SOCK_DIAG:
1199 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200 case NETLINK_NFLOG:
1201 return SECCLASS_NETLINK_NFLOG_SOCKET;
1202 case NETLINK_XFRM:
1203 return SECCLASS_NETLINK_XFRM_SOCKET;
1204 case NETLINK_SELINUX:
1205 return SECCLASS_NETLINK_SELINUX_SOCKET;
1206 case NETLINK_AUDIT:
1207 return SECCLASS_NETLINK_AUDIT_SOCKET;
1208 case NETLINK_IP6_FW:
1209 return SECCLASS_NETLINK_IP6FW_SOCKET;
1210 case NETLINK_DNRTMSG:
1211 return SECCLASS_NETLINK_DNRT_SOCKET;
1212 case NETLINK_KOBJECT_UEVENT:
1213 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1214 default:
1215 return SECCLASS_NETLINK_SOCKET;
1216 }
1217 case PF_PACKET:
1218 return SECCLASS_PACKET_SOCKET;
1219 case PF_KEY:
1220 return SECCLASS_KEY_SOCKET;
1221 case PF_APPLETALK:
1222 return SECCLASS_APPLETALK_SOCKET;
1223 }
1224
1225 return SECCLASS_SOCKET;
1226 }
1227
1228 #ifdef CONFIG_PROC_FS
1229 static int selinux_proc_get_sid(struct dentry *dentry,
1230 u16 tclass,
1231 u32 *sid)
1232 {
1233 int rc;
1234 char *buffer, *path;
1235
1236 buffer = (char *)__get_free_page(GFP_KERNEL);
1237 if (!buffer)
1238 return -ENOMEM;
1239
1240 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241 if (IS_ERR(path))
1242 rc = PTR_ERR(path);
1243 else {
1244 /* each process gets a /proc/PID/ entry. Strip off the
1245 * PID part to get a valid selinux labeling.
1246 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247 while (path[1] >= '0' && path[1] <= '9') {
1248 path[1] = '/';
1249 path++;
1250 }
1251 rc = security_genfs_sid("proc", path, tclass, sid);
1252 }
1253 free_page((unsigned long)buffer);
1254 return rc;
1255 }
1256 #else
1257 static int selinux_proc_get_sid(struct dentry *dentry,
1258 u16 tclass,
1259 u32 *sid)
1260 {
1261 return -EINVAL;
1262 }
1263 #endif
1264
1265 /* The inode's security attributes must be initialized before first use. */
1266 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267 {
1268 struct superblock_security_struct *sbsec = NULL;
1269 struct inode_security_struct *isec = inode->i_security;
1270 u32 sid;
1271 struct dentry *dentry;
1272 #define INITCONTEXTLEN 255
1273 char *context = NULL;
1274 unsigned len = 0;
1275 int rc = 0;
1276
1277 if (isec->initialized)
1278 goto out;
1279
1280 mutex_lock(&isec->lock);
1281 if (isec->initialized)
1282 goto out_unlock;
1283
1284 sbsec = inode->i_sb->s_security;
1285 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1286 /* Defer initialization until selinux_complete_init,
1287 after the initial policy is loaded and the security
1288 server is ready to handle calls. */
1289 spin_lock(&sbsec->isec_lock);
1290 if (list_empty(&isec->list))
1291 list_add(&isec->list, &sbsec->isec_head);
1292 spin_unlock(&sbsec->isec_lock);
1293 goto out_unlock;
1294 }
1295
1296 switch (sbsec->behavior) {
1297 case SECURITY_FS_USE_NATIVE:
1298 break;
1299 case SECURITY_FS_USE_XATTR:
1300 if (!inode->i_op->getxattr) {
1301 isec->sid = sbsec->def_sid;
1302 break;
1303 }
1304
1305 /* Need a dentry, since the xattr API requires one.
1306 Life would be simpler if we could just pass the inode. */
1307 if (opt_dentry) {
1308 /* Called from d_instantiate or d_splice_alias. */
1309 dentry = dget(opt_dentry);
1310 } else {
1311 /* Called from selinux_complete_init, try to find a dentry. */
1312 dentry = d_find_alias(inode);
1313 }
1314 if (!dentry) {
1315 /*
1316 * this is can be hit on boot when a file is accessed
1317 * before the policy is loaded. When we load policy we
1318 * may find inodes that have no dentry on the
1319 * sbsec->isec_head list. No reason to complain as these
1320 * will get fixed up the next time we go through
1321 * inode_doinit with a dentry, before these inodes could
1322 * be used again by userspace.
1323 */
1324 goto out_unlock;
1325 }
1326
1327 len = INITCONTEXTLEN;
1328 context = kmalloc(len+1, GFP_NOFS);
1329 if (!context) {
1330 rc = -ENOMEM;
1331 dput(dentry);
1332 goto out_unlock;
1333 }
1334 context[len] = '\0';
1335 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336 context, len);
1337 if (rc == -ERANGE) {
1338 kfree(context);
1339
1340 /* Need a larger buffer. Query for the right size. */
1341 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342 NULL, 0);
1343 if (rc < 0) {
1344 dput(dentry);
1345 goto out_unlock;
1346 }
1347 len = rc;
1348 context = kmalloc(len+1, GFP_NOFS);
1349 if (!context) {
1350 rc = -ENOMEM;
1351 dput(dentry);
1352 goto out_unlock;
1353 }
1354 context[len] = '\0';
1355 rc = inode->i_op->getxattr(dentry,
1356 XATTR_NAME_SELINUX,
1357 context, len);
1358 }
1359 dput(dentry);
1360 if (rc < 0) {
1361 if (rc != -ENODATA) {
1362 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1363 "%d for dev=%s ino=%ld\n", __func__,
1364 -rc, inode->i_sb->s_id, inode->i_ino);
1365 kfree(context);
1366 goto out_unlock;
1367 }
1368 /* Map ENODATA to the default file SID */
1369 sid = sbsec->def_sid;
1370 rc = 0;
1371 } else {
1372 rc = security_context_to_sid_default(context, rc, &sid,
1373 sbsec->def_sid,
1374 GFP_NOFS);
1375 if (rc) {
1376 char *dev = inode->i_sb->s_id;
1377 unsigned long ino = inode->i_ino;
1378
1379 if (rc == -EINVAL) {
1380 if (printk_ratelimit())
1381 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382 "context=%s. This indicates you may need to relabel the inode or the "
1383 "filesystem in question.\n", ino, dev, context);
1384 } else {
1385 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1386 "returned %d for dev=%s ino=%ld\n",
1387 __func__, context, -rc, dev, ino);
1388 }
1389 kfree(context);
1390 /* Leave with the unlabeled SID */
1391 rc = 0;
1392 break;
1393 }
1394 }
1395 kfree(context);
1396 isec->sid = sid;
1397 break;
1398 case SECURITY_FS_USE_TASK:
1399 isec->sid = isec->task_sid;
1400 break;
1401 case SECURITY_FS_USE_TRANS:
1402 /* Default to the fs SID. */
1403 isec->sid = sbsec->sid;
1404
1405 /* Try to obtain a transition SID. */
1406 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408 isec->sclass, NULL, &sid);
1409 if (rc)
1410 goto out_unlock;
1411 isec->sid = sid;
1412 break;
1413 case SECURITY_FS_USE_MNTPOINT:
1414 isec->sid = sbsec->mntpoint_sid;
1415 break;
1416 default:
1417 /* Default to the fs superblock SID. */
1418 isec->sid = sbsec->sid;
1419
1420 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1421 if (opt_dentry) {
1422 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1423 rc = selinux_proc_get_sid(opt_dentry,
1424 isec->sclass,
1425 &sid);
1426 if (rc)
1427 goto out_unlock;
1428 isec->sid = sid;
1429 }
1430 }
1431 break;
1432 }
1433
1434 isec->initialized = 1;
1435
1436 out_unlock:
1437 mutex_unlock(&isec->lock);
1438 out:
1439 if (isec->sclass == SECCLASS_FILE)
1440 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441 return rc;
1442 }
1443
1444 /* Convert a Linux signal to an access vector. */
1445 static inline u32 signal_to_av(int sig)
1446 {
1447 u32 perm = 0;
1448
1449 switch (sig) {
1450 case SIGCHLD:
1451 /* Commonly granted from child to parent. */
1452 perm = PROCESS__SIGCHLD;
1453 break;
1454 case SIGKILL:
1455 /* Cannot be caught or ignored */
1456 perm = PROCESS__SIGKILL;
1457 break;
1458 case SIGSTOP:
1459 /* Cannot be caught or ignored */
1460 perm = PROCESS__SIGSTOP;
1461 break;
1462 default:
1463 /* All other signals. */
1464 perm = PROCESS__SIGNAL;
1465 break;
1466 }
1467
1468 return perm;
1469 }
1470
1471 /*
1472 * Check permission between a pair of credentials
1473 * fork check, ptrace check, etc.
1474 */
1475 static int cred_has_perm(const struct cred *actor,
1476 const struct cred *target,
1477 u32 perms)
1478 {
1479 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1480
1481 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1482 }
1483
1484 /*
1485 * Check permission between a pair of tasks, e.g. signal checks,
1486 * fork check, ptrace check, etc.
1487 * tsk1 is the actor and tsk2 is the target
1488 * - this uses the default subjective creds of tsk1
1489 */
1490 static int task_has_perm(const struct task_struct *tsk1,
1491 const struct task_struct *tsk2,
1492 u32 perms)
1493 {
1494 const struct task_security_struct *__tsec1, *__tsec2;
1495 u32 sid1, sid2;
1496
1497 rcu_read_lock();
1498 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1499 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1500 rcu_read_unlock();
1501 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1502 }
1503
1504 /*
1505 * Check permission between current and another task, e.g. signal checks,
1506 * fork check, ptrace check, etc.
1507 * current is the actor and tsk2 is the target
1508 * - this uses current's subjective creds
1509 */
1510 static int current_has_perm(const struct task_struct *tsk,
1511 u32 perms)
1512 {
1513 u32 sid, tsid;
1514
1515 sid = current_sid();
1516 tsid = task_sid(tsk);
1517 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1518 }
1519
1520 #if CAP_LAST_CAP > 63
1521 #error Fix SELinux to handle capabilities > 63.
1522 #endif
1523
1524 /* Check whether a task is allowed to use a capability. */
1525 static int cred_has_capability(const struct cred *cred,
1526 int cap, int audit)
1527 {
1528 struct common_audit_data ad;
1529 struct av_decision avd;
1530 u16 sclass;
1531 u32 sid = cred_sid(cred);
1532 u32 av = CAP_TO_MASK(cap);
1533 int rc;
1534
1535 ad.type = LSM_AUDIT_DATA_CAP;
1536 ad.u.cap = cap;
1537
1538 switch (CAP_TO_INDEX(cap)) {
1539 case 0:
1540 sclass = SECCLASS_CAPABILITY;
1541 break;
1542 case 1:
1543 sclass = SECCLASS_CAPABILITY2;
1544 break;
1545 default:
1546 printk(KERN_ERR
1547 "SELinux: out of range capability %d\n", cap);
1548 BUG();
1549 return -EINVAL;
1550 }
1551
1552 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1553 if (audit == SECURITY_CAP_AUDIT) {
1554 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1555 if (rc2)
1556 return rc2;
1557 }
1558 return rc;
1559 }
1560
1561 /* Check whether a task is allowed to use a system operation. */
1562 static int task_has_system(struct task_struct *tsk,
1563 u32 perms)
1564 {
1565 u32 sid = task_sid(tsk);
1566
1567 return avc_has_perm(sid, SECINITSID_KERNEL,
1568 SECCLASS_SYSTEM, perms, NULL);
1569 }
1570
1571 /* Check whether a task has a particular permission to an inode.
1572 The 'adp' parameter is optional and allows other audit
1573 data to be passed (e.g. the dentry). */
1574 static int inode_has_perm(const struct cred *cred,
1575 struct inode *inode,
1576 u32 perms,
1577 struct common_audit_data *adp)
1578 {
1579 struct inode_security_struct *isec;
1580 u32 sid;
1581
1582 validate_creds(cred);
1583
1584 if (unlikely(IS_PRIVATE(inode)))
1585 return 0;
1586
1587 sid = cred_sid(cred);
1588 isec = inode->i_security;
1589
1590 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1591 }
1592
1593 /* Same as inode_has_perm, but pass explicit audit data containing
1594 the dentry to help the auditing code to more easily generate the
1595 pathname if needed. */
1596 static inline int dentry_has_perm(const struct cred *cred,
1597 struct dentry *dentry,
1598 u32 av)
1599 {
1600 struct inode *inode = dentry->d_inode;
1601 struct common_audit_data ad;
1602
1603 ad.type = LSM_AUDIT_DATA_DENTRY;
1604 ad.u.dentry = dentry;
1605 return inode_has_perm(cred, inode, av, &ad);
1606 }
1607
1608 /* Same as inode_has_perm, but pass explicit audit data containing
1609 the path to help the auditing code to more easily generate the
1610 pathname if needed. */
1611 static inline int path_has_perm(const struct cred *cred,
1612 struct path *path,
1613 u32 av)
1614 {
1615 struct inode *inode = path->dentry->d_inode;
1616 struct common_audit_data ad;
1617
1618 ad.type = LSM_AUDIT_DATA_PATH;
1619 ad.u.path = *path;
1620 return inode_has_perm(cred, inode, av, &ad);
1621 }
1622
1623 /* Same as path_has_perm, but uses the inode from the file struct. */
1624 static inline int file_path_has_perm(const struct cred *cred,
1625 struct file *file,
1626 u32 av)
1627 {
1628 struct common_audit_data ad;
1629
1630 ad.type = LSM_AUDIT_DATA_PATH;
1631 ad.u.path = file->f_path;
1632 return inode_has_perm(cred, file_inode(file), av, &ad);
1633 }
1634
1635 /* Check whether a task can use an open file descriptor to
1636 access an inode in a given way. Check access to the
1637 descriptor itself, and then use dentry_has_perm to
1638 check a particular permission to the file.
1639 Access to the descriptor is implicitly granted if it
1640 has the same SID as the process. If av is zero, then
1641 access to the file is not checked, e.g. for cases
1642 where only the descriptor is affected like seek. */
1643 static int file_has_perm(const struct cred *cred,
1644 struct file *file,
1645 u32 av)
1646 {
1647 struct file_security_struct *fsec = file->f_security;
1648 struct inode *inode = file_inode(file);
1649 struct common_audit_data ad;
1650 u32 sid = cred_sid(cred);
1651 int rc;
1652
1653 ad.type = LSM_AUDIT_DATA_PATH;
1654 ad.u.path = file->f_path;
1655
1656 if (sid != fsec->sid) {
1657 rc = avc_has_perm(sid, fsec->sid,
1658 SECCLASS_FD,
1659 FD__USE,
1660 &ad);
1661 if (rc)
1662 goto out;
1663 }
1664
1665 /* av is zero if only checking access to the descriptor. */
1666 rc = 0;
1667 if (av)
1668 rc = inode_has_perm(cred, inode, av, &ad);
1669
1670 out:
1671 return rc;
1672 }
1673
1674 /* Check whether a task can create a file. */
1675 static int may_create(struct inode *dir,
1676 struct dentry *dentry,
1677 u16 tclass)
1678 {
1679 const struct task_security_struct *tsec = current_security();
1680 struct inode_security_struct *dsec;
1681 struct superblock_security_struct *sbsec;
1682 u32 sid, newsid;
1683 struct common_audit_data ad;
1684 int rc;
1685
1686 dsec = dir->i_security;
1687 sbsec = dir->i_sb->s_security;
1688
1689 sid = tsec->sid;
1690 newsid = tsec->create_sid;
1691
1692 ad.type = LSM_AUDIT_DATA_DENTRY;
1693 ad.u.dentry = dentry;
1694
1695 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1696 DIR__ADD_NAME | DIR__SEARCH,
1697 &ad);
1698 if (rc)
1699 return rc;
1700
1701 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1702 rc = security_transition_sid(sid, dsec->sid, tclass,
1703 &dentry->d_name, &newsid);
1704 if (rc)
1705 return rc;
1706 }
1707
1708 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1709 if (rc)
1710 return rc;
1711
1712 return avc_has_perm(newsid, sbsec->sid,
1713 SECCLASS_FILESYSTEM,
1714 FILESYSTEM__ASSOCIATE, &ad);
1715 }
1716
1717 /* Check whether a task can create a key. */
1718 static int may_create_key(u32 ksid,
1719 struct task_struct *ctx)
1720 {
1721 u32 sid = task_sid(ctx);
1722
1723 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1724 }
1725
1726 #define MAY_LINK 0
1727 #define MAY_UNLINK 1
1728 #define MAY_RMDIR 2
1729
1730 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1731 static int may_link(struct inode *dir,
1732 struct dentry *dentry,
1733 int kind)
1734
1735 {
1736 struct inode_security_struct *dsec, *isec;
1737 struct common_audit_data ad;
1738 u32 sid = current_sid();
1739 u32 av;
1740 int rc;
1741
1742 dsec = dir->i_security;
1743 isec = dentry->d_inode->i_security;
1744
1745 ad.type = LSM_AUDIT_DATA_DENTRY;
1746 ad.u.dentry = dentry;
1747
1748 av = DIR__SEARCH;
1749 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1750 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1751 if (rc)
1752 return rc;
1753
1754 switch (kind) {
1755 case MAY_LINK:
1756 av = FILE__LINK;
1757 break;
1758 case MAY_UNLINK:
1759 av = FILE__UNLINK;
1760 break;
1761 case MAY_RMDIR:
1762 av = DIR__RMDIR;
1763 break;
1764 default:
1765 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1766 __func__, kind);
1767 return 0;
1768 }
1769
1770 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1771 return rc;
1772 }
1773
1774 static inline int may_rename(struct inode *old_dir,
1775 struct dentry *old_dentry,
1776 struct inode *new_dir,
1777 struct dentry *new_dentry)
1778 {
1779 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1780 struct common_audit_data ad;
1781 u32 sid = current_sid();
1782 u32 av;
1783 int old_is_dir, new_is_dir;
1784 int rc;
1785
1786 old_dsec = old_dir->i_security;
1787 old_isec = old_dentry->d_inode->i_security;
1788 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1789 new_dsec = new_dir->i_security;
1790
1791 ad.type = LSM_AUDIT_DATA_DENTRY;
1792
1793 ad.u.dentry = old_dentry;
1794 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1795 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1796 if (rc)
1797 return rc;
1798 rc = avc_has_perm(sid, old_isec->sid,
1799 old_isec->sclass, FILE__RENAME, &ad);
1800 if (rc)
1801 return rc;
1802 if (old_is_dir && new_dir != old_dir) {
1803 rc = avc_has_perm(sid, old_isec->sid,
1804 old_isec->sclass, DIR__REPARENT, &ad);
1805 if (rc)
1806 return rc;
1807 }
1808
1809 ad.u.dentry = new_dentry;
1810 av = DIR__ADD_NAME | DIR__SEARCH;
1811 if (new_dentry->d_inode)
1812 av |= DIR__REMOVE_NAME;
1813 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1814 if (rc)
1815 return rc;
1816 if (new_dentry->d_inode) {
1817 new_isec = new_dentry->d_inode->i_security;
1818 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1819 rc = avc_has_perm(sid, new_isec->sid,
1820 new_isec->sclass,
1821 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1822 if (rc)
1823 return rc;
1824 }
1825
1826 return 0;
1827 }
1828
1829 /* Check whether a task can perform a filesystem operation. */
1830 static int superblock_has_perm(const struct cred *cred,
1831 struct super_block *sb,
1832 u32 perms,
1833 struct common_audit_data *ad)
1834 {
1835 struct superblock_security_struct *sbsec;
1836 u32 sid = cred_sid(cred);
1837
1838 sbsec = sb->s_security;
1839 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1840 }
1841
1842 /* Convert a Linux mode and permission mask to an access vector. */
1843 static inline u32 file_mask_to_av(int mode, int mask)
1844 {
1845 u32 av = 0;
1846
1847 if (!S_ISDIR(mode)) {
1848 if (mask & MAY_EXEC)
1849 av |= FILE__EXECUTE;
1850 if (mask & MAY_READ)
1851 av |= FILE__READ;
1852
1853 if (mask & MAY_APPEND)
1854 av |= FILE__APPEND;
1855 else if (mask & MAY_WRITE)
1856 av |= FILE__WRITE;
1857
1858 } else {
1859 if (mask & MAY_EXEC)
1860 av |= DIR__SEARCH;
1861 if (mask & MAY_WRITE)
1862 av |= DIR__WRITE;
1863 if (mask & MAY_READ)
1864 av |= DIR__READ;
1865 }
1866
1867 return av;
1868 }
1869
1870 /* Convert a Linux file to an access vector. */
1871 static inline u32 file_to_av(struct file *file)
1872 {
1873 u32 av = 0;
1874
1875 if (file->f_mode & FMODE_READ)
1876 av |= FILE__READ;
1877 if (file->f_mode & FMODE_WRITE) {
1878 if (file->f_flags & O_APPEND)
1879 av |= FILE__APPEND;
1880 else
1881 av |= FILE__WRITE;
1882 }
1883 if (!av) {
1884 /*
1885 * Special file opened with flags 3 for ioctl-only use.
1886 */
1887 av = FILE__IOCTL;
1888 }
1889
1890 return av;
1891 }
1892
1893 /*
1894 * Convert a file to an access vector and include the correct open
1895 * open permission.
1896 */
1897 static inline u32 open_file_to_av(struct file *file)
1898 {
1899 u32 av = file_to_av(file);
1900
1901 if (selinux_policycap_openperm)
1902 av |= FILE__OPEN;
1903
1904 return av;
1905 }
1906
1907 /* Hook functions begin here. */
1908
1909 static int selinux_ptrace_access_check(struct task_struct *child,
1910 unsigned int mode)
1911 {
1912 int rc;
1913
1914 rc = cap_ptrace_access_check(child, mode);
1915 if (rc)
1916 return rc;
1917
1918 if (mode & PTRACE_MODE_READ) {
1919 u32 sid = current_sid();
1920 u32 csid = task_sid(child);
1921 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1922 }
1923
1924 return current_has_perm(child, PROCESS__PTRACE);
1925 }
1926
1927 static int selinux_ptrace_traceme(struct task_struct *parent)
1928 {
1929 int rc;
1930
1931 rc = cap_ptrace_traceme(parent);
1932 if (rc)
1933 return rc;
1934
1935 return task_has_perm(parent, current, PROCESS__PTRACE);
1936 }
1937
1938 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1939 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1940 {
1941 int error;
1942
1943 error = current_has_perm(target, PROCESS__GETCAP);
1944 if (error)
1945 return error;
1946
1947 return cap_capget(target, effective, inheritable, permitted);
1948 }
1949
1950 static int selinux_capset(struct cred *new, const struct cred *old,
1951 const kernel_cap_t *effective,
1952 const kernel_cap_t *inheritable,
1953 const kernel_cap_t *permitted)
1954 {
1955 int error;
1956
1957 error = cap_capset(new, old,
1958 effective, inheritable, permitted);
1959 if (error)
1960 return error;
1961
1962 return cred_has_perm(old, new, PROCESS__SETCAP);
1963 }
1964
1965 /*
1966 * (This comment used to live with the selinux_task_setuid hook,
1967 * which was removed).
1968 *
1969 * Since setuid only affects the current process, and since the SELinux
1970 * controls are not based on the Linux identity attributes, SELinux does not
1971 * need to control this operation. However, SELinux does control the use of
1972 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1973 */
1974
1975 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1976 int cap, int audit)
1977 {
1978 int rc;
1979
1980 rc = cap_capable(cred, ns, cap, audit);
1981 if (rc)
1982 return rc;
1983
1984 return cred_has_capability(cred, cap, audit);
1985 }
1986
1987 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1988 {
1989 const struct cred *cred = current_cred();
1990 int rc = 0;
1991
1992 if (!sb)
1993 return 0;
1994
1995 switch (cmds) {
1996 case Q_SYNC:
1997 case Q_QUOTAON:
1998 case Q_QUOTAOFF:
1999 case Q_SETINFO:
2000 case Q_SETQUOTA:
2001 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2002 break;
2003 case Q_GETFMT:
2004 case Q_GETINFO:
2005 case Q_GETQUOTA:
2006 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2007 break;
2008 default:
2009 rc = 0; /* let the kernel handle invalid cmds */
2010 break;
2011 }
2012 return rc;
2013 }
2014
2015 static int selinux_quota_on(struct dentry *dentry)
2016 {
2017 const struct cred *cred = current_cred();
2018
2019 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2020 }
2021
2022 static int selinux_syslog(int type)
2023 {
2024 int rc;
2025
2026 switch (type) {
2027 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2028 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2029 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2030 break;
2031 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2032 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2033 /* Set level of messages printed to console */
2034 case SYSLOG_ACTION_CONSOLE_LEVEL:
2035 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2036 break;
2037 case SYSLOG_ACTION_CLOSE: /* Close log */
2038 case SYSLOG_ACTION_OPEN: /* Open log */
2039 case SYSLOG_ACTION_READ: /* Read from log */
2040 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2041 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2042 default:
2043 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2044 break;
2045 }
2046 return rc;
2047 }
2048
2049 /*
2050 * Check that a process has enough memory to allocate a new virtual
2051 * mapping. 0 means there is enough memory for the allocation to
2052 * succeed and -ENOMEM implies there is not.
2053 *
2054 * Do not audit the selinux permission check, as this is applied to all
2055 * processes that allocate mappings.
2056 */
2057 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2058 {
2059 int rc, cap_sys_admin = 0;
2060
2061 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2062 SECURITY_CAP_NOAUDIT);
2063 if (rc == 0)
2064 cap_sys_admin = 1;
2065
2066 return __vm_enough_memory(mm, pages, cap_sys_admin);
2067 }
2068
2069 /* binprm security operations */
2070
2071 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2072 {
2073 const struct task_security_struct *old_tsec;
2074 struct task_security_struct *new_tsec;
2075 struct inode_security_struct *isec;
2076 struct common_audit_data ad;
2077 struct inode *inode = file_inode(bprm->file);
2078 int rc;
2079
2080 rc = cap_bprm_set_creds(bprm);
2081 if (rc)
2082 return rc;
2083
2084 /* SELinux context only depends on initial program or script and not
2085 * the script interpreter */
2086 if (bprm->cred_prepared)
2087 return 0;
2088
2089 old_tsec = current_security();
2090 new_tsec = bprm->cred->security;
2091 isec = inode->i_security;
2092
2093 /* Default to the current task SID. */
2094 new_tsec->sid = old_tsec->sid;
2095 new_tsec->osid = old_tsec->sid;
2096
2097 /* Reset fs, key, and sock SIDs on execve. */
2098 new_tsec->create_sid = 0;
2099 new_tsec->keycreate_sid = 0;
2100 new_tsec->sockcreate_sid = 0;
2101
2102 if (old_tsec->exec_sid) {
2103 new_tsec->sid = old_tsec->exec_sid;
2104 /* Reset exec SID on execve. */
2105 new_tsec->exec_sid = 0;
2106
2107 /*
2108 * Minimize confusion: if no_new_privs and a transition is
2109 * explicitly requested, then fail the exec.
2110 */
2111 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2112 return -EPERM;
2113 } else {
2114 /* Check for a default transition on this program. */
2115 rc = security_transition_sid(old_tsec->sid, isec->sid,
2116 SECCLASS_PROCESS, NULL,
2117 &new_tsec->sid);
2118 if (rc)
2119 return rc;
2120 }
2121
2122 ad.type = LSM_AUDIT_DATA_PATH;
2123 ad.u.path = bprm->file->f_path;
2124
2125 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2126 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2127 new_tsec->sid = old_tsec->sid;
2128
2129 if (new_tsec->sid == old_tsec->sid) {
2130 rc = avc_has_perm(old_tsec->sid, isec->sid,
2131 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2132 if (rc)
2133 return rc;
2134 } else {
2135 /* Check permissions for the transition. */
2136 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2137 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2138 if (rc)
2139 return rc;
2140
2141 rc = avc_has_perm(new_tsec->sid, isec->sid,
2142 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2143 if (rc)
2144 return rc;
2145
2146 /* Check for shared state */
2147 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2148 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2149 SECCLASS_PROCESS, PROCESS__SHARE,
2150 NULL);
2151 if (rc)
2152 return -EPERM;
2153 }
2154
2155 /* Make sure that anyone attempting to ptrace over a task that
2156 * changes its SID has the appropriate permit */
2157 if (bprm->unsafe &
2158 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2159 struct task_struct *tracer;
2160 struct task_security_struct *sec;
2161 u32 ptsid = 0;
2162
2163 rcu_read_lock();
2164 tracer = ptrace_parent(current);
2165 if (likely(tracer != NULL)) {
2166 sec = __task_cred(tracer)->security;
2167 ptsid = sec->sid;
2168 }
2169 rcu_read_unlock();
2170
2171 if (ptsid != 0) {
2172 rc = avc_has_perm(ptsid, new_tsec->sid,
2173 SECCLASS_PROCESS,
2174 PROCESS__PTRACE, NULL);
2175 if (rc)
2176 return -EPERM;
2177 }
2178 }
2179
2180 /* Clear any possibly unsafe personality bits on exec: */
2181 bprm->per_clear |= PER_CLEAR_ON_SETID;
2182 }
2183
2184 return 0;
2185 }
2186
2187 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2188 {
2189 const struct task_security_struct *tsec = current_security();
2190 u32 sid, osid;
2191 int atsecure = 0;
2192
2193 sid = tsec->sid;
2194 osid = tsec->osid;
2195
2196 if (osid != sid) {
2197 /* Enable secure mode for SIDs transitions unless
2198 the noatsecure permission is granted between
2199 the two SIDs, i.e. ahp returns 0. */
2200 atsecure = avc_has_perm(osid, sid,
2201 SECCLASS_PROCESS,
2202 PROCESS__NOATSECURE, NULL);
2203 }
2204
2205 return (atsecure || cap_bprm_secureexec(bprm));
2206 }
2207
2208 static int match_file(const void *p, struct file *file, unsigned fd)
2209 {
2210 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2211 }
2212
2213 /* Derived from fs/exec.c:flush_old_files. */
2214 static inline void flush_unauthorized_files(const struct cred *cred,
2215 struct files_struct *files)
2216 {
2217 struct file *file, *devnull = NULL;
2218 struct tty_struct *tty;
2219 int drop_tty = 0;
2220 unsigned n;
2221
2222 tty = get_current_tty();
2223 if (tty) {
2224 spin_lock(&tty_files_lock);
2225 if (!list_empty(&tty->tty_files)) {
2226 struct tty_file_private *file_priv;
2227
2228 /* Revalidate access to controlling tty.
2229 Use file_path_has_perm on the tty path directly
2230 rather than using file_has_perm, as this particular
2231 open file may belong to another process and we are
2232 only interested in the inode-based check here. */
2233 file_priv = list_first_entry(&tty->tty_files,
2234 struct tty_file_private, list);
2235 file = file_priv->file;
2236 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2237 drop_tty = 1;
2238 }
2239 spin_unlock(&tty_files_lock);
2240 tty_kref_put(tty);
2241 }
2242 /* Reset controlling tty. */
2243 if (drop_tty)
2244 no_tty();
2245
2246 /* Revalidate access to inherited open files. */
2247 n = iterate_fd(files, 0, match_file, cred);
2248 if (!n) /* none found? */
2249 return;
2250
2251 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2252 if (IS_ERR(devnull))
2253 devnull = NULL;
2254 /* replace all the matching ones with this */
2255 do {
2256 replace_fd(n - 1, devnull, 0);
2257 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2258 if (devnull)
2259 fput(devnull);
2260 }
2261
2262 /*
2263 * Prepare a process for imminent new credential changes due to exec
2264 */
2265 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2266 {
2267 struct task_security_struct *new_tsec;
2268 struct rlimit *rlim, *initrlim;
2269 int rc, i;
2270
2271 new_tsec = bprm->cred->security;
2272 if (new_tsec->sid == new_tsec->osid)
2273 return;
2274
2275 /* Close files for which the new task SID is not authorized. */
2276 flush_unauthorized_files(bprm->cred, current->files);
2277
2278 /* Always clear parent death signal on SID transitions. */
2279 current->pdeath_signal = 0;
2280
2281 /* Check whether the new SID can inherit resource limits from the old
2282 * SID. If not, reset all soft limits to the lower of the current
2283 * task's hard limit and the init task's soft limit.
2284 *
2285 * Note that the setting of hard limits (even to lower them) can be
2286 * controlled by the setrlimit check. The inclusion of the init task's
2287 * soft limit into the computation is to avoid resetting soft limits
2288 * higher than the default soft limit for cases where the default is
2289 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2290 */
2291 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2292 PROCESS__RLIMITINH, NULL);
2293 if (rc) {
2294 /* protect against do_prlimit() */
2295 task_lock(current);
2296 for (i = 0; i < RLIM_NLIMITS; i++) {
2297 rlim = current->signal->rlim + i;
2298 initrlim = init_task.signal->rlim + i;
2299 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2300 }
2301 task_unlock(current);
2302 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2303 }
2304 }
2305
2306 /*
2307 * Clean up the process immediately after the installation of new credentials
2308 * due to exec
2309 */
2310 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2311 {
2312 const struct task_security_struct *tsec = current_security();
2313 struct itimerval itimer;
2314 u32 osid, sid;
2315 int rc, i;
2316
2317 osid = tsec->osid;
2318 sid = tsec->sid;
2319
2320 if (sid == osid)
2321 return;
2322
2323 /* Check whether the new SID can inherit signal state from the old SID.
2324 * If not, clear itimers to avoid subsequent signal generation and
2325 * flush and unblock signals.
2326 *
2327 * This must occur _after_ the task SID has been updated so that any
2328 * kill done after the flush will be checked against the new SID.
2329 */
2330 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2331 if (rc) {
2332 memset(&itimer, 0, sizeof itimer);
2333 for (i = 0; i < 3; i++)
2334 do_setitimer(i, &itimer, NULL);
2335 spin_lock_irq(&current->sighand->siglock);
2336 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2337 __flush_signals(current);
2338 flush_signal_handlers(current, 1);
2339 sigemptyset(&current->blocked);
2340 }
2341 spin_unlock_irq(&current->sighand->siglock);
2342 }
2343
2344 /* Wake up the parent if it is waiting so that it can recheck
2345 * wait permission to the new task SID. */
2346 read_lock(&tasklist_lock);
2347 __wake_up_parent(current, current->real_parent);
2348 read_unlock(&tasklist_lock);
2349 }
2350
2351 /* superblock security operations */
2352
2353 static int selinux_sb_alloc_security(struct super_block *sb)
2354 {
2355 return superblock_alloc_security(sb);
2356 }
2357
2358 static void selinux_sb_free_security(struct super_block *sb)
2359 {
2360 superblock_free_security(sb);
2361 }
2362
2363 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2364 {
2365 if (plen > olen)
2366 return 0;
2367
2368 return !memcmp(prefix, option, plen);
2369 }
2370
2371 static inline int selinux_option(char *option, int len)
2372 {
2373 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2374 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2375 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2376 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2377 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2378 }
2379
2380 static inline void take_option(char **to, char *from, int *first, int len)
2381 {
2382 if (!*first) {
2383 **to = ',';
2384 *to += 1;
2385 } else
2386 *first = 0;
2387 memcpy(*to, from, len);
2388 *to += len;
2389 }
2390
2391 static inline void take_selinux_option(char **to, char *from, int *first,
2392 int len)
2393 {
2394 int current_size = 0;
2395
2396 if (!*first) {
2397 **to = '|';
2398 *to += 1;
2399 } else
2400 *first = 0;
2401
2402 while (current_size < len) {
2403 if (*from != '"') {
2404 **to = *from;
2405 *to += 1;
2406 }
2407 from += 1;
2408 current_size += 1;
2409 }
2410 }
2411
2412 static int selinux_sb_copy_data(char *orig, char *copy)
2413 {
2414 int fnosec, fsec, rc = 0;
2415 char *in_save, *in_curr, *in_end;
2416 char *sec_curr, *nosec_save, *nosec;
2417 int open_quote = 0;
2418
2419 in_curr = orig;
2420 sec_curr = copy;
2421
2422 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2423 if (!nosec) {
2424 rc = -ENOMEM;
2425 goto out;
2426 }
2427
2428 nosec_save = nosec;
2429 fnosec = fsec = 1;
2430 in_save = in_end = orig;
2431
2432 do {
2433 if (*in_end == '"')
2434 open_quote = !open_quote;
2435 if ((*in_end == ',' && open_quote == 0) ||
2436 *in_end == '\0') {
2437 int len = in_end - in_curr;
2438
2439 if (selinux_option(in_curr, len))
2440 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2441 else
2442 take_option(&nosec, in_curr, &fnosec, len);
2443
2444 in_curr = in_end + 1;
2445 }
2446 } while (*in_end++);
2447
2448 strcpy(in_save, nosec_save);
2449 free_page((unsigned long)nosec_save);
2450 out:
2451 return rc;
2452 }
2453
2454 static int selinux_sb_remount(struct super_block *sb, void *data)
2455 {
2456 int rc, i, *flags;
2457 struct security_mnt_opts opts;
2458 char *secdata, **mount_options;
2459 struct superblock_security_struct *sbsec = sb->s_security;
2460
2461 if (!(sbsec->flags & SE_SBINITIALIZED))
2462 return 0;
2463
2464 if (!data)
2465 return 0;
2466
2467 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2468 return 0;
2469
2470 security_init_mnt_opts(&opts);
2471 secdata = alloc_secdata();
2472 if (!secdata)
2473 return -ENOMEM;
2474 rc = selinux_sb_copy_data(data, secdata);
2475 if (rc)
2476 goto out_free_secdata;
2477
2478 rc = selinux_parse_opts_str(secdata, &opts);
2479 if (rc)
2480 goto out_free_secdata;
2481
2482 mount_options = opts.mnt_opts;
2483 flags = opts.mnt_opts_flags;
2484
2485 for (i = 0; i < opts.num_mnt_opts; i++) {
2486 u32 sid;
2487 size_t len;
2488
2489 if (flags[i] == SBLABEL_MNT)
2490 continue;
2491 len = strlen(mount_options[i]);
2492 rc = security_context_to_sid(mount_options[i], len, &sid,
2493 GFP_KERNEL);
2494 if (rc) {
2495 printk(KERN_WARNING "SELinux: security_context_to_sid"
2496 "(%s) failed for (dev %s, type %s) errno=%d\n",
2497 mount_options[i], sb->s_id, sb->s_type->name, rc);
2498 goto out_free_opts;
2499 }
2500 rc = -EINVAL;
2501 switch (flags[i]) {
2502 case FSCONTEXT_MNT:
2503 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2504 goto out_bad_option;
2505 break;
2506 case CONTEXT_MNT:
2507 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2508 goto out_bad_option;
2509 break;
2510 case ROOTCONTEXT_MNT: {
2511 struct inode_security_struct *root_isec;
2512 root_isec = sb->s_root->d_inode->i_security;
2513
2514 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2515 goto out_bad_option;
2516 break;
2517 }
2518 case DEFCONTEXT_MNT:
2519 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2520 goto out_bad_option;
2521 break;
2522 default:
2523 goto out_free_opts;
2524 }
2525 }
2526
2527 rc = 0;
2528 out_free_opts:
2529 security_free_mnt_opts(&opts);
2530 out_free_secdata:
2531 free_secdata(secdata);
2532 return rc;
2533 out_bad_option:
2534 printk(KERN_WARNING "SELinux: unable to change security options "
2535 "during remount (dev %s, type=%s)\n", sb->s_id,
2536 sb->s_type->name);
2537 goto out_free_opts;
2538 }
2539
2540 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2541 {
2542 const struct cred *cred = current_cred();
2543 struct common_audit_data ad;
2544 int rc;
2545
2546 rc = superblock_doinit(sb, data);
2547 if (rc)
2548 return rc;
2549
2550 /* Allow all mounts performed by the kernel */
2551 if (flags & MS_KERNMOUNT)
2552 return 0;
2553
2554 ad.type = LSM_AUDIT_DATA_DENTRY;
2555 ad.u.dentry = sb->s_root;
2556 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2557 }
2558
2559 static int selinux_sb_statfs(struct dentry *dentry)
2560 {
2561 const struct cred *cred = current_cred();
2562 struct common_audit_data ad;
2563
2564 ad.type = LSM_AUDIT_DATA_DENTRY;
2565 ad.u.dentry = dentry->d_sb->s_root;
2566 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2567 }
2568
2569 static int selinux_mount(const char *dev_name,
2570 struct path *path,
2571 const char *type,
2572 unsigned long flags,
2573 void *data)
2574 {
2575 const struct cred *cred = current_cred();
2576
2577 if (flags & MS_REMOUNT)
2578 return superblock_has_perm(cred, path->dentry->d_sb,
2579 FILESYSTEM__REMOUNT, NULL);
2580 else
2581 return path_has_perm(cred, path, FILE__MOUNTON);
2582 }
2583
2584 static int selinux_umount(struct vfsmount *mnt, int flags)
2585 {
2586 const struct cred *cred = current_cred();
2587
2588 return superblock_has_perm(cred, mnt->mnt_sb,
2589 FILESYSTEM__UNMOUNT, NULL);
2590 }
2591
2592 /* inode security operations */
2593
2594 static int selinux_inode_alloc_security(struct inode *inode)
2595 {
2596 return inode_alloc_security(inode);
2597 }
2598
2599 static void selinux_inode_free_security(struct inode *inode)
2600 {
2601 inode_free_security(inode);
2602 }
2603
2604 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2605 struct qstr *name, void **ctx,
2606 u32 *ctxlen)
2607 {
2608 const struct cred *cred = current_cred();
2609 struct task_security_struct *tsec;
2610 struct inode_security_struct *dsec;
2611 struct superblock_security_struct *sbsec;
2612 struct inode *dir = dentry->d_parent->d_inode;
2613 u32 newsid;
2614 int rc;
2615
2616 tsec = cred->security;
2617 dsec = dir->i_security;
2618 sbsec = dir->i_sb->s_security;
2619
2620 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2621 newsid = tsec->create_sid;
2622 } else {
2623 rc = security_transition_sid(tsec->sid, dsec->sid,
2624 inode_mode_to_security_class(mode),
2625 name,
2626 &newsid);
2627 if (rc) {
2628 printk(KERN_WARNING
2629 "%s: security_transition_sid failed, rc=%d\n",
2630 __func__, -rc);
2631 return rc;
2632 }
2633 }
2634
2635 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2636 }
2637
2638 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2639 const struct qstr *qstr,
2640 const char **name,
2641 void **value, size_t *len)
2642 {
2643 const struct task_security_struct *tsec = current_security();
2644 struct inode_security_struct *dsec;
2645 struct superblock_security_struct *sbsec;
2646 u32 sid, newsid, clen;
2647 int rc;
2648 char *context;
2649
2650 dsec = dir->i_security;
2651 sbsec = dir->i_sb->s_security;
2652
2653 sid = tsec->sid;
2654 newsid = tsec->create_sid;
2655
2656 if ((sbsec->flags & SE_SBINITIALIZED) &&
2657 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2658 newsid = sbsec->mntpoint_sid;
2659 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2660 rc = security_transition_sid(sid, dsec->sid,
2661 inode_mode_to_security_class(inode->i_mode),
2662 qstr, &newsid);
2663 if (rc) {
2664 printk(KERN_WARNING "%s: "
2665 "security_transition_sid failed, rc=%d (dev=%s "
2666 "ino=%ld)\n",
2667 __func__,
2668 -rc, inode->i_sb->s_id, inode->i_ino);
2669 return rc;
2670 }
2671 }
2672
2673 /* Possibly defer initialization to selinux_complete_init. */
2674 if (sbsec->flags & SE_SBINITIALIZED) {
2675 struct inode_security_struct *isec = inode->i_security;
2676 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2677 isec->sid = newsid;
2678 isec->initialized = 1;
2679 }
2680
2681 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2682 return -EOPNOTSUPP;
2683
2684 if (name)
2685 *name = XATTR_SELINUX_SUFFIX;
2686
2687 if (value && len) {
2688 rc = security_sid_to_context_force(newsid, &context, &clen);
2689 if (rc)
2690 return rc;
2691 *value = context;
2692 *len = clen;
2693 }
2694
2695 return 0;
2696 }
2697
2698 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2699 {
2700 return may_create(dir, dentry, SECCLASS_FILE);
2701 }
2702
2703 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2704 {
2705 return may_link(dir, old_dentry, MAY_LINK);
2706 }
2707
2708 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2709 {
2710 return may_link(dir, dentry, MAY_UNLINK);
2711 }
2712
2713 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2714 {
2715 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2716 }
2717
2718 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2719 {
2720 return may_create(dir, dentry, SECCLASS_DIR);
2721 }
2722
2723 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2724 {
2725 return may_link(dir, dentry, MAY_RMDIR);
2726 }
2727
2728 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2729 {
2730 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2731 }
2732
2733 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2734 struct inode *new_inode, struct dentry *new_dentry)
2735 {
2736 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2737 }
2738
2739 static int selinux_inode_readlink(struct dentry *dentry)
2740 {
2741 const struct cred *cred = current_cred();
2742
2743 return dentry_has_perm(cred, dentry, FILE__READ);
2744 }
2745
2746 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2747 {
2748 const struct cred *cred = current_cred();
2749
2750 return dentry_has_perm(cred, dentry, FILE__READ);
2751 }
2752
2753 static noinline int audit_inode_permission(struct inode *inode,
2754 u32 perms, u32 audited, u32 denied,
2755 unsigned flags)
2756 {
2757 struct common_audit_data ad;
2758 struct inode_security_struct *isec = inode->i_security;
2759 int rc;
2760
2761 ad.type = LSM_AUDIT_DATA_INODE;
2762 ad.u.inode = inode;
2763
2764 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2765 audited, denied, &ad, flags);
2766 if (rc)
2767 return rc;
2768 return 0;
2769 }
2770
2771 static int selinux_inode_permission(struct inode *inode, int mask)
2772 {
2773 const struct cred *cred = current_cred();
2774 u32 perms;
2775 bool from_access;
2776 unsigned flags = mask & MAY_NOT_BLOCK;
2777 struct inode_security_struct *isec;
2778 u32 sid;
2779 struct av_decision avd;
2780 int rc, rc2;
2781 u32 audited, denied;
2782
2783 from_access = mask & MAY_ACCESS;
2784 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2785
2786 /* No permission to check. Existence test. */
2787 if (!mask)
2788 return 0;
2789
2790 validate_creds(cred);
2791
2792 if (unlikely(IS_PRIVATE(inode)))
2793 return 0;
2794
2795 perms = file_mask_to_av(inode->i_mode, mask);
2796
2797 sid = cred_sid(cred);
2798 isec = inode->i_security;
2799
2800 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2801 audited = avc_audit_required(perms, &avd, rc,
2802 from_access ? FILE__AUDIT_ACCESS : 0,
2803 &denied);
2804 if (likely(!audited))
2805 return rc;
2806
2807 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2808 if (rc2)
2809 return rc2;
2810 return rc;
2811 }
2812
2813 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2814 {
2815 const struct cred *cred = current_cred();
2816 unsigned int ia_valid = iattr->ia_valid;
2817 __u32 av = FILE__WRITE;
2818
2819 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2820 if (ia_valid & ATTR_FORCE) {
2821 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2822 ATTR_FORCE);
2823 if (!ia_valid)
2824 return 0;
2825 }
2826
2827 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2828 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2829 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2830
2831 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2832 av |= FILE__OPEN;
2833
2834 return dentry_has_perm(cred, dentry, av);
2835 }
2836
2837 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2838 {
2839 const struct cred *cred = current_cred();
2840 struct path path;
2841
2842 path.dentry = dentry;
2843 path.mnt = mnt;
2844
2845 return path_has_perm(cred, &path, FILE__GETATTR);
2846 }
2847
2848 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2849 {
2850 const struct cred *cred = current_cred();
2851
2852 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2853 sizeof XATTR_SECURITY_PREFIX - 1)) {
2854 if (!strcmp(name, XATTR_NAME_CAPS)) {
2855 if (!capable(CAP_SETFCAP))
2856 return -EPERM;
2857 } else if (!capable(CAP_SYS_ADMIN)) {
2858 /* A different attribute in the security namespace.
2859 Restrict to administrator. */
2860 return -EPERM;
2861 }
2862 }
2863
2864 /* Not an attribute we recognize, so just check the
2865 ordinary setattr permission. */
2866 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2867 }
2868
2869 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2870 const void *value, size_t size, int flags)
2871 {
2872 struct inode *inode = dentry->d_inode;
2873 struct inode_security_struct *isec = inode->i_security;
2874 struct superblock_security_struct *sbsec;
2875 struct common_audit_data ad;
2876 u32 newsid, sid = current_sid();
2877 int rc = 0;
2878
2879 if (strcmp(name, XATTR_NAME_SELINUX))
2880 return selinux_inode_setotherxattr(dentry, name);
2881
2882 sbsec = inode->i_sb->s_security;
2883 if (!(sbsec->flags & SBLABEL_MNT))
2884 return -EOPNOTSUPP;
2885
2886 if (!inode_owner_or_capable(inode))
2887 return -EPERM;
2888
2889 ad.type = LSM_AUDIT_DATA_DENTRY;
2890 ad.u.dentry = dentry;
2891
2892 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2893 FILE__RELABELFROM, &ad);
2894 if (rc)
2895 return rc;
2896
2897 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2898 if (rc == -EINVAL) {
2899 if (!capable(CAP_MAC_ADMIN)) {
2900 struct audit_buffer *ab;
2901 size_t audit_size;
2902 const char *str;
2903
2904 /* We strip a nul only if it is at the end, otherwise the
2905 * context contains a nul and we should audit that */
2906 if (value) {
2907 str = value;
2908 if (str[size - 1] == '\0')
2909 audit_size = size - 1;
2910 else
2911 audit_size = size;
2912 } else {
2913 str = "";
2914 audit_size = 0;
2915 }
2916 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2917 audit_log_format(ab, "op=setxattr invalid_context=");
2918 audit_log_n_untrustedstring(ab, value, audit_size);
2919 audit_log_end(ab);
2920
2921 return rc;
2922 }
2923 rc = security_context_to_sid_force(value, size, &newsid);
2924 }
2925 if (rc)
2926 return rc;
2927
2928 rc = avc_has_perm(sid, newsid, isec->sclass,
2929 FILE__RELABELTO, &ad);
2930 if (rc)
2931 return rc;
2932
2933 rc = security_validate_transition(isec->sid, newsid, sid,
2934 isec->sclass);
2935 if (rc)
2936 return rc;
2937
2938 return avc_has_perm(newsid,
2939 sbsec->sid,
2940 SECCLASS_FILESYSTEM,
2941 FILESYSTEM__ASSOCIATE,
2942 &ad);
2943 }
2944
2945 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2946 const void *value, size_t size,
2947 int flags)
2948 {
2949 struct inode *inode = dentry->d_inode;
2950 struct inode_security_struct *isec = inode->i_security;
2951 u32 newsid;
2952 int rc;
2953
2954 if (strcmp(name, XATTR_NAME_SELINUX)) {
2955 /* Not an attribute we recognize, so nothing to do. */
2956 return;
2957 }
2958
2959 rc = security_context_to_sid_force(value, size, &newsid);
2960 if (rc) {
2961 printk(KERN_ERR "SELinux: unable to map context to SID"
2962 "for (%s, %lu), rc=%d\n",
2963 inode->i_sb->s_id, inode->i_ino, -rc);
2964 return;
2965 }
2966
2967 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2968 isec->sid = newsid;
2969 isec->initialized = 1;
2970
2971 return;
2972 }
2973
2974 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2975 {
2976 const struct cred *cred = current_cred();
2977
2978 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2979 }
2980
2981 static int selinux_inode_listxattr(struct dentry *dentry)
2982 {
2983 const struct cred *cred = current_cred();
2984
2985 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2986 }
2987
2988 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2989 {
2990 if (strcmp(name, XATTR_NAME_SELINUX))
2991 return selinux_inode_setotherxattr(dentry, name);
2992
2993 /* No one is allowed to remove a SELinux security label.
2994 You can change the label, but all data must be labeled. */
2995 return -EACCES;
2996 }
2997
2998 /*
2999 * Copy the inode security context value to the user.
3000 *
3001 * Permission check is handled by selinux_inode_getxattr hook.
3002 */
3003 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3004 {
3005 u32 size;
3006 int error;
3007 char *context = NULL;
3008 struct inode_security_struct *isec = inode->i_security;
3009
3010 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3011 return -EOPNOTSUPP;
3012
3013 /*
3014 * If the caller has CAP_MAC_ADMIN, then get the raw context
3015 * value even if it is not defined by current policy; otherwise,
3016 * use the in-core value under current policy.
3017 * Use the non-auditing forms of the permission checks since
3018 * getxattr may be called by unprivileged processes commonly
3019 * and lack of permission just means that we fall back to the
3020 * in-core context value, not a denial.
3021 */
3022 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3023 SECURITY_CAP_NOAUDIT);
3024 if (!error)
3025 error = security_sid_to_context_force(isec->sid, &context,
3026 &size);
3027 else
3028 error = security_sid_to_context(isec->sid, &context, &size);
3029 if (error)
3030 return error;
3031 error = size;
3032 if (alloc) {
3033 *buffer = context;
3034 goto out_nofree;
3035 }
3036 kfree(context);
3037 out_nofree:
3038 return error;
3039 }
3040
3041 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3042 const void *value, size_t size, int flags)
3043 {
3044 struct inode_security_struct *isec = inode->i_security;
3045 u32 newsid;
3046 int rc;
3047
3048 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3049 return -EOPNOTSUPP;
3050
3051 if (!value || !size)
3052 return -EACCES;
3053
3054 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3055 if (rc)
3056 return rc;
3057
3058 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3059 isec->sid = newsid;
3060 isec->initialized = 1;
3061 return 0;
3062 }
3063
3064 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3065 {
3066 const int len = sizeof(XATTR_NAME_SELINUX);
3067 if (buffer && len <= buffer_size)
3068 memcpy(buffer, XATTR_NAME_SELINUX, len);
3069 return len;
3070 }
3071
3072 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3073 {
3074 struct inode_security_struct *isec = inode->i_security;
3075 *secid = isec->sid;
3076 }
3077
3078 /* file security operations */
3079
3080 static int selinux_revalidate_file_permission(struct file *file, int mask)
3081 {
3082 const struct cred *cred = current_cred();
3083 struct inode *inode = file_inode(file);
3084
3085 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3086 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3087 mask |= MAY_APPEND;
3088
3089 return file_has_perm(cred, file,
3090 file_mask_to_av(inode->i_mode, mask));
3091 }
3092
3093 static int selinux_file_permission(struct file *file, int mask)
3094 {
3095 struct inode *inode = file_inode(file);
3096 struct file_security_struct *fsec = file->f_security;
3097 struct inode_security_struct *isec = inode->i_security;
3098 u32 sid = current_sid();
3099
3100 if (!mask)
3101 /* No permission to check. Existence test. */
3102 return 0;
3103
3104 if (sid == fsec->sid && fsec->isid == isec->sid &&
3105 fsec->pseqno == avc_policy_seqno())
3106 /* No change since file_open check. */
3107 return 0;
3108
3109 return selinux_revalidate_file_permission(file, mask);
3110 }
3111
3112 static int selinux_file_alloc_security(struct file *file)
3113 {
3114 return file_alloc_security(file);
3115 }
3116
3117 static void selinux_file_free_security(struct file *file)
3118 {
3119 file_free_security(file);
3120 }
3121
3122 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3123 unsigned long arg)
3124 {
3125 const struct cred *cred = current_cred();
3126 int error = 0;
3127
3128 switch (cmd) {
3129 case FIONREAD:
3130 /* fall through */
3131 case FIBMAP:
3132 /* fall through */
3133 case FIGETBSZ:
3134 /* fall through */
3135 case FS_IOC_GETFLAGS:
3136 /* fall through */
3137 case FS_IOC_GETVERSION:
3138 error = file_has_perm(cred, file, FILE__GETATTR);
3139 break;
3140
3141 case FS_IOC_SETFLAGS:
3142 /* fall through */
3143 case FS_IOC_SETVERSION:
3144 error = file_has_perm(cred, file, FILE__SETATTR);
3145 break;
3146
3147 /* sys_ioctl() checks */
3148 case FIONBIO:
3149 /* fall through */
3150 case FIOASYNC:
3151 error = file_has_perm(cred, file, 0);
3152 break;
3153
3154 case KDSKBENT:
3155 case KDSKBSENT:
3156 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3157 SECURITY_CAP_AUDIT);
3158 break;
3159
3160 /* default case assumes that the command will go
3161 * to the file's ioctl() function.
3162 */
3163 default:
3164 error = file_has_perm(cred, file, FILE__IOCTL);
3165 }
3166 return error;
3167 }
3168
3169 static int default_noexec;
3170
3171 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3172 {
3173 const struct cred *cred = current_cred();
3174 int rc = 0;
3175
3176 if (default_noexec &&
3177 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3178 /*
3179 * We are making executable an anonymous mapping or a
3180 * private file mapping that will also be writable.
3181 * This has an additional check.
3182 */
3183 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3184 if (rc)
3185 goto error;
3186 }
3187
3188 if (file) {
3189 /* read access is always possible with a mapping */
3190 u32 av = FILE__READ;
3191
3192 /* write access only matters if the mapping is shared */
3193 if (shared && (prot & PROT_WRITE))
3194 av |= FILE__WRITE;
3195
3196 if (prot & PROT_EXEC)
3197 av |= FILE__EXECUTE;
3198
3199 return file_has_perm(cred, file, av);
3200 }
3201
3202 error:
3203 return rc;
3204 }
3205
3206 static int selinux_mmap_addr(unsigned long addr)
3207 {
3208 int rc = 0;
3209 u32 sid = current_sid();
3210
3211 /*
3212 * notice that we are intentionally putting the SELinux check before
3213 * the secondary cap_file_mmap check. This is such a likely attempt
3214 * at bad behaviour/exploit that we always want to get the AVC, even
3215 * if DAC would have also denied the operation.
3216 */
3217 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3218 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3219 MEMPROTECT__MMAP_ZERO, NULL);
3220 if (rc)
3221 return rc;
3222 }
3223
3224 /* do DAC check on address space usage */
3225 return cap_mmap_addr(addr);
3226 }
3227
3228 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3229 unsigned long prot, unsigned long flags)
3230 {
3231 if (selinux_checkreqprot)
3232 prot = reqprot;
3233
3234 return file_map_prot_check(file, prot,
3235 (flags & MAP_TYPE) == MAP_SHARED);
3236 }
3237
3238 static int selinux_file_mprotect(struct vm_area_struct *vma,
3239 unsigned long reqprot,
3240 unsigned long prot)
3241 {
3242 const struct cred *cred = current_cred();
3243
3244 if (selinux_checkreqprot)
3245 prot = reqprot;
3246
3247 if (default_noexec &&
3248 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3249 int rc = 0;
3250 if (vma->vm_start >= vma->vm_mm->start_brk &&
3251 vma->vm_end <= vma->vm_mm->brk) {
3252 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3253 } else if (!vma->vm_file &&
3254 vma->vm_start <= vma->vm_mm->start_stack &&
3255 vma->vm_end >= vma->vm_mm->start_stack) {
3256 rc = current_has_perm(current, PROCESS__EXECSTACK);
3257 } else if (vma->vm_file && vma->anon_vma) {
3258 /*
3259 * We are making executable a file mapping that has
3260 * had some COW done. Since pages might have been
3261 * written, check ability to execute the possibly
3262 * modified content. This typically should only
3263 * occur for text relocations.
3264 */
3265 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3266 }
3267 if (rc)
3268 return rc;
3269 }
3270
3271 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3272 }
3273
3274 static int selinux_file_lock(struct file *file, unsigned int cmd)
3275 {
3276 const struct cred *cred = current_cred();
3277
3278 return file_has_perm(cred, file, FILE__LOCK);
3279 }
3280
3281 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3282 unsigned long arg)
3283 {
3284 const struct cred *cred = current_cred();
3285 int err = 0;
3286
3287 switch (cmd) {
3288 case F_SETFL:
3289 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3290 err = file_has_perm(cred, file, FILE__WRITE);
3291 break;
3292 }
3293 /* fall through */
3294 case F_SETOWN:
3295 case F_SETSIG:
3296 case F_GETFL:
3297 case F_GETOWN:
3298 case F_GETSIG:
3299 case F_GETOWNER_UIDS:
3300 /* Just check FD__USE permission */
3301 err = file_has_perm(cred, file, 0);
3302 break;
3303 case F_GETLK:
3304 case F_SETLK:
3305 case F_SETLKW:
3306 #if BITS_PER_LONG == 32
3307 case F_GETLK64:
3308 case F_SETLK64:
3309 case F_SETLKW64:
3310 #endif
3311 err = file_has_perm(cred, file, FILE__LOCK);
3312 break;
3313 }
3314
3315 return err;
3316 }
3317
3318 static int selinux_file_set_fowner(struct file *file)
3319 {
3320 struct file_security_struct *fsec;
3321
3322 fsec = file->f_security;
3323 fsec->fown_sid = current_sid();
3324
3325 return 0;
3326 }
3327
3328 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3329 struct fown_struct *fown, int signum)
3330 {
3331 struct file *file;
3332 u32 sid = task_sid(tsk);
3333 u32 perm;
3334 struct file_security_struct *fsec;
3335
3336 /* struct fown_struct is never outside the context of a struct file */
3337 file = container_of(fown, struct file, f_owner);
3338
3339 fsec = file->f_security;
3340
3341 if (!signum)
3342 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3343 else
3344 perm = signal_to_av(signum);
3345
3346 return avc_has_perm(fsec->fown_sid, sid,
3347 SECCLASS_PROCESS, perm, NULL);
3348 }
3349
3350 static int selinux_file_receive(struct file *file)
3351 {
3352 const struct cred *cred = current_cred();
3353
3354 return file_has_perm(cred, file, file_to_av(file));
3355 }
3356
3357 static int selinux_file_open(struct file *file, const struct cred *cred)
3358 {
3359 struct file_security_struct *fsec;
3360 struct inode_security_struct *isec;
3361
3362 fsec = file->f_security;
3363 isec = file_inode(file)->i_security;
3364 /*
3365 * Save inode label and policy sequence number
3366 * at open-time so that selinux_file_permission
3367 * can determine whether revalidation is necessary.
3368 * Task label is already saved in the file security
3369 * struct as its SID.
3370 */
3371 fsec->isid = isec->sid;
3372 fsec->pseqno = avc_policy_seqno();
3373 /*
3374 * Since the inode label or policy seqno may have changed
3375 * between the selinux_inode_permission check and the saving
3376 * of state above, recheck that access is still permitted.
3377 * Otherwise, access might never be revalidated against the
3378 * new inode label or new policy.
3379 * This check is not redundant - do not remove.
3380 */
3381 return file_path_has_perm(cred, file, open_file_to_av(file));
3382 }
3383
3384 /* task security operations */
3385
3386 static int selinux_task_create(unsigned long clone_flags)
3387 {
3388 return current_has_perm(current, PROCESS__FORK);
3389 }
3390
3391 /*
3392 * allocate the SELinux part of blank credentials
3393 */
3394 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3395 {
3396 struct task_security_struct *tsec;
3397
3398 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3399 if (!tsec)
3400 return -ENOMEM;
3401
3402 cred->security = tsec;
3403 return 0;
3404 }
3405
3406 /*
3407 * detach and free the LSM part of a set of credentials
3408 */
3409 static void selinux_cred_free(struct cred *cred)
3410 {
3411 struct task_security_struct *tsec = cred->security;
3412
3413 /*
3414 * cred->security == NULL if security_cred_alloc_blank() or
3415 * security_prepare_creds() returned an error.
3416 */
3417 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3418 cred->security = (void *) 0x7UL;
3419 kfree(tsec);
3420 }
3421
3422 /*
3423 * prepare a new set of credentials for modification
3424 */
3425 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3426 gfp_t gfp)
3427 {
3428 const struct task_security_struct *old_tsec;
3429 struct task_security_struct *tsec;
3430
3431 old_tsec = old->security;
3432
3433 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3434 if (!tsec)
3435 return -ENOMEM;
3436
3437 new->security = tsec;
3438 return 0;
3439 }
3440
3441 /*
3442 * transfer the SELinux data to a blank set of creds
3443 */
3444 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3445 {
3446 const struct task_security_struct *old_tsec = old->security;
3447 struct task_security_struct *tsec = new->security;
3448
3449 *tsec = *old_tsec;
3450 }
3451
3452 /*
3453 * set the security data for a kernel service
3454 * - all the creation contexts are set to unlabelled
3455 */
3456 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3457 {
3458 struct task_security_struct *tsec = new->security;
3459 u32 sid = current_sid();
3460 int ret;
3461
3462 ret = avc_has_perm(sid, secid,
3463 SECCLASS_KERNEL_SERVICE,
3464 KERNEL_SERVICE__USE_AS_OVERRIDE,
3465 NULL);
3466 if (ret == 0) {
3467 tsec->sid = secid;
3468 tsec->create_sid = 0;
3469 tsec->keycreate_sid = 0;
3470 tsec->sockcreate_sid = 0;
3471 }
3472 return ret;
3473 }
3474
3475 /*
3476 * set the file creation context in a security record to the same as the
3477 * objective context of the specified inode
3478 */
3479 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3480 {
3481 struct inode_security_struct *isec = inode->i_security;
3482 struct task_security_struct *tsec = new->security;
3483 u32 sid = current_sid();
3484 int ret;
3485
3486 ret = avc_has_perm(sid, isec->sid,
3487 SECCLASS_KERNEL_SERVICE,
3488 KERNEL_SERVICE__CREATE_FILES_AS,
3489 NULL);
3490
3491 if (ret == 0)
3492 tsec->create_sid = isec->sid;
3493 return ret;
3494 }
3495
3496 static int selinux_kernel_module_request(char *kmod_name)
3497 {
3498 u32 sid;
3499 struct common_audit_data ad;
3500
3501 sid = task_sid(current);
3502
3503 ad.type = LSM_AUDIT_DATA_KMOD;
3504 ad.u.kmod_name = kmod_name;
3505
3506 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3507 SYSTEM__MODULE_REQUEST, &ad);
3508 }
3509
3510 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3511 {
3512 return current_has_perm(p, PROCESS__SETPGID);
3513 }
3514
3515 static int selinux_task_getpgid(struct task_struct *p)
3516 {
3517 return current_has_perm(p, PROCESS__GETPGID);
3518 }
3519
3520 static int selinux_task_getsid(struct task_struct *p)
3521 {
3522 return current_has_perm(p, PROCESS__GETSESSION);
3523 }
3524
3525 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3526 {
3527 *secid = task_sid(p);
3528 }
3529
3530 static int selinux_task_setnice(struct task_struct *p, int nice)
3531 {
3532 int rc;
3533
3534 rc = cap_task_setnice(p, nice);
3535 if (rc)
3536 return rc;
3537
3538 return current_has_perm(p, PROCESS__SETSCHED);
3539 }
3540
3541 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3542 {
3543 int rc;
3544
3545 rc = cap_task_setioprio(p, ioprio);
3546 if (rc)
3547 return rc;
3548
3549 return current_has_perm(p, PROCESS__SETSCHED);
3550 }
3551
3552 static int selinux_task_getioprio(struct task_struct *p)
3553 {
3554 return current_has_perm(p, PROCESS__GETSCHED);
3555 }
3556
3557 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3558 struct rlimit *new_rlim)
3559 {
3560 struct rlimit *old_rlim = p->signal->rlim + resource;
3561
3562 /* Control the ability to change the hard limit (whether
3563 lowering or raising it), so that the hard limit can
3564 later be used as a safe reset point for the soft limit
3565 upon context transitions. See selinux_bprm_committing_creds. */
3566 if (old_rlim->rlim_max != new_rlim->rlim_max)
3567 return current_has_perm(p, PROCESS__SETRLIMIT);
3568
3569 return 0;
3570 }
3571
3572 static int selinux_task_setscheduler(struct task_struct *p)
3573 {
3574 int rc;
3575
3576 rc = cap_task_setscheduler(p);
3577 if (rc)
3578 return rc;
3579
3580 return current_has_perm(p, PROCESS__SETSCHED);
3581 }
3582
3583 static int selinux_task_getscheduler(struct task_struct *p)
3584 {
3585 return current_has_perm(p, PROCESS__GETSCHED);
3586 }
3587
3588 static int selinux_task_movememory(struct task_struct *p)
3589 {
3590 return current_has_perm(p, PROCESS__SETSCHED);
3591 }
3592
3593 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3594 int sig, u32 secid)
3595 {
3596 u32 perm;
3597 int rc;
3598
3599 if (!sig)
3600 perm = PROCESS__SIGNULL; /* null signal; existence test */
3601 else
3602 perm = signal_to_av(sig);
3603 if (secid)
3604 rc = avc_has_perm(secid, task_sid(p),
3605 SECCLASS_PROCESS, perm, NULL);
3606 else
3607 rc = current_has_perm(p, perm);
3608 return rc;
3609 }
3610
3611 static int selinux_task_wait(struct task_struct *p)
3612 {
3613 return task_has_perm(p, current, PROCESS__SIGCHLD);
3614 }
3615
3616 static void selinux_task_to_inode(struct task_struct *p,
3617 struct inode *inode)
3618 {
3619 struct inode_security_struct *isec = inode->i_security;
3620 u32 sid = task_sid(p);
3621
3622 isec->sid = sid;
3623 isec->initialized = 1;
3624 }
3625
3626 /* Returns error only if unable to parse addresses */
3627 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3628 struct common_audit_data *ad, u8 *proto)
3629 {
3630 int offset, ihlen, ret = -EINVAL;
3631 struct iphdr _iph, *ih;
3632
3633 offset = skb_network_offset(skb);
3634 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3635 if (ih == NULL)
3636 goto out;
3637
3638 ihlen = ih->ihl * 4;
3639 if (ihlen < sizeof(_iph))
3640 goto out;
3641
3642 ad->u.net->v4info.saddr = ih->saddr;
3643 ad->u.net->v4info.daddr = ih->daddr;
3644 ret = 0;
3645
3646 if (proto)
3647 *proto = ih->protocol;
3648
3649 switch (ih->protocol) {
3650 case IPPROTO_TCP: {
3651 struct tcphdr _tcph, *th;
3652
3653 if (ntohs(ih->frag_off) & IP_OFFSET)
3654 break;
3655
3656 offset += ihlen;
3657 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3658 if (th == NULL)
3659 break;
3660
3661 ad->u.net->sport = th->source;
3662 ad->u.net->dport = th->dest;
3663 break;
3664 }
3665
3666 case IPPROTO_UDP: {
3667 struct udphdr _udph, *uh;
3668
3669 if (ntohs(ih->frag_off) & IP_OFFSET)
3670 break;
3671
3672 offset += ihlen;
3673 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3674 if (uh == NULL)
3675 break;
3676
3677 ad->u.net->sport = uh->source;
3678 ad->u.net->dport = uh->dest;
3679 break;
3680 }
3681
3682 case IPPROTO_DCCP: {
3683 struct dccp_hdr _dccph, *dh;
3684
3685 if (ntohs(ih->frag_off) & IP_OFFSET)
3686 break;
3687
3688 offset += ihlen;
3689 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3690 if (dh == NULL)
3691 break;
3692
3693 ad->u.net->sport = dh->dccph_sport;
3694 ad->u.net->dport = dh->dccph_dport;
3695 break;
3696 }
3697
3698 default:
3699 break;
3700 }
3701 out:
3702 return ret;
3703 }
3704
3705 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3706
3707 /* Returns error only if unable to parse addresses */
3708 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3709 struct common_audit_data *ad, u8 *proto)
3710 {
3711 u8 nexthdr;
3712 int ret = -EINVAL, offset;
3713 struct ipv6hdr _ipv6h, *ip6;
3714 __be16 frag_off;
3715
3716 offset = skb_network_offset(skb);
3717 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3718 if (ip6 == NULL)
3719 goto out;
3720
3721 ad->u.net->v6info.saddr = ip6->saddr;
3722 ad->u.net->v6info.daddr = ip6->daddr;
3723 ret = 0;
3724
3725 nexthdr = ip6->nexthdr;
3726 offset += sizeof(_ipv6h);
3727 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3728 if (offset < 0)
3729 goto out;
3730
3731 if (proto)
3732 *proto = nexthdr;
3733
3734 switch (nexthdr) {
3735 case IPPROTO_TCP: {
3736 struct tcphdr _tcph, *th;
3737
3738 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3739 if (th == NULL)
3740 break;
3741
3742 ad->u.net->sport = th->source;
3743 ad->u.net->dport = th->dest;
3744 break;
3745 }
3746
3747 case IPPROTO_UDP: {
3748 struct udphdr _udph, *uh;
3749
3750 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3751 if (uh == NULL)
3752 break;
3753
3754 ad->u.net->sport = uh->source;
3755 ad->u.net->dport = uh->dest;
3756 break;
3757 }
3758
3759 case IPPROTO_DCCP: {
3760 struct dccp_hdr _dccph, *dh;
3761
3762 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3763 if (dh == NULL)
3764 break;
3765
3766 ad->u.net->sport = dh->dccph_sport;
3767 ad->u.net->dport = dh->dccph_dport;
3768 break;
3769 }
3770
3771 /* includes fragments */
3772 default:
3773 break;
3774 }
3775 out:
3776 return ret;
3777 }
3778
3779 #endif /* IPV6 */
3780
3781 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3782 char **_addrp, int src, u8 *proto)
3783 {
3784 char *addrp;
3785 int ret;
3786
3787 switch (ad->u.net->family) {
3788 case PF_INET:
3789 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3790 if (ret)
3791 goto parse_error;
3792 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3793 &ad->u.net->v4info.daddr);
3794 goto okay;
3795
3796 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3797 case PF_INET6:
3798 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3799 if (ret)
3800 goto parse_error;
3801 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3802 &ad->u.net->v6info.daddr);
3803 goto okay;
3804 #endif /* IPV6 */
3805 default:
3806 addrp = NULL;
3807 goto okay;
3808 }
3809
3810 parse_error:
3811 printk(KERN_WARNING
3812 "SELinux: failure in selinux_parse_skb(),"
3813 " unable to parse packet\n");
3814 return ret;
3815
3816 okay:
3817 if (_addrp)
3818 *_addrp = addrp;
3819 return 0;
3820 }
3821
3822 /**
3823 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3824 * @skb: the packet
3825 * @family: protocol family
3826 * @sid: the packet's peer label SID
3827 *
3828 * Description:
3829 * Check the various different forms of network peer labeling and determine
3830 * the peer label/SID for the packet; most of the magic actually occurs in
3831 * the security server function security_net_peersid_cmp(). The function
3832 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3833 * or -EACCES if @sid is invalid due to inconsistencies with the different
3834 * peer labels.
3835 *
3836 */
3837 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3838 {
3839 int err;
3840 u32 xfrm_sid;
3841 u32 nlbl_sid;
3842 u32 nlbl_type;
3843
3844 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3845 if (unlikely(err))
3846 return -EACCES;
3847 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3848 if (unlikely(err))
3849 return -EACCES;
3850
3851 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3852 if (unlikely(err)) {
3853 printk(KERN_WARNING
3854 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3855 " unable to determine packet's peer label\n");
3856 return -EACCES;
3857 }
3858
3859 return 0;
3860 }
3861
3862 /**
3863 * selinux_conn_sid - Determine the child socket label for a connection
3864 * @sk_sid: the parent socket's SID
3865 * @skb_sid: the packet's SID
3866 * @conn_sid: the resulting connection SID
3867 *
3868 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3869 * combined with the MLS information from @skb_sid in order to create
3870 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3871 * of @sk_sid. Returns zero on success, negative values on failure.
3872 *
3873 */
3874 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3875 {
3876 int err = 0;
3877
3878 if (skb_sid != SECSID_NULL)
3879 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3880 else
3881 *conn_sid = sk_sid;
3882
3883 return err;
3884 }
3885
3886 /* socket security operations */
3887
3888 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3889 u16 secclass, u32 *socksid)
3890 {
3891 if (tsec->sockcreate_sid > SECSID_NULL) {
3892 *socksid = tsec->sockcreate_sid;
3893 return 0;
3894 }
3895
3896 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3897 socksid);
3898 }
3899
3900 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3901 {
3902 struct sk_security_struct *sksec = sk->sk_security;
3903 struct common_audit_data ad;
3904 struct lsm_network_audit net = {0,};
3905 u32 tsid = task_sid(task);
3906
3907 if (sksec->sid == SECINITSID_KERNEL)
3908 return 0;
3909
3910 ad.type = LSM_AUDIT_DATA_NET;
3911 ad.u.net = &net;
3912 ad.u.net->sk = sk;
3913
3914 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3915 }
3916
3917 static int selinux_socket_create(int family, int type,
3918 int protocol, int kern)
3919 {
3920 const struct task_security_struct *tsec = current_security();
3921 u32 newsid;
3922 u16 secclass;
3923 int rc;
3924
3925 if (kern)
3926 return 0;
3927
3928 secclass = socket_type_to_security_class(family, type, protocol);
3929 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3930 if (rc)
3931 return rc;
3932
3933 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3934 }
3935
3936 static int selinux_socket_post_create(struct socket *sock, int family,
3937 int type, int protocol, int kern)
3938 {
3939 const struct task_security_struct *tsec = current_security();
3940 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3941 struct sk_security_struct *sksec;
3942 int err = 0;
3943
3944 isec->sclass = socket_type_to_security_class(family, type, protocol);
3945
3946 if (kern)
3947 isec->sid = SECINITSID_KERNEL;
3948 else {
3949 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3950 if (err)
3951 return err;
3952 }
3953
3954 isec->initialized = 1;
3955
3956 if (sock->sk) {
3957 sksec = sock->sk->sk_security;
3958 sksec->sid = isec->sid;
3959 sksec->sclass = isec->sclass;
3960 err = selinux_netlbl_socket_post_create(sock->sk, family);
3961 }
3962
3963 return err;
3964 }
3965
3966 /* Range of port numbers used to automatically bind.
3967 Need to determine whether we should perform a name_bind
3968 permission check between the socket and the port number. */
3969
3970 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3971 {
3972 struct sock *sk = sock->sk;
3973 u16 family;
3974 int err;
3975
3976 err = sock_has_perm(current, sk, SOCKET__BIND);
3977 if (err)
3978 goto out;
3979
3980 /*
3981 * If PF_INET or PF_INET6, check name_bind permission for the port.
3982 * Multiple address binding for SCTP is not supported yet: we just
3983 * check the first address now.
3984 */
3985 family = sk->sk_family;
3986 if (family == PF_INET || family == PF_INET6) {
3987 char *addrp;
3988 struct sk_security_struct *sksec = sk->sk_security;
3989 struct common_audit_data ad;
3990 struct lsm_network_audit net = {0,};
3991 struct sockaddr_in *addr4 = NULL;
3992 struct sockaddr_in6 *addr6 = NULL;
3993 unsigned short snum;
3994 u32 sid, node_perm;
3995
3996 if (family == PF_INET) {
3997 addr4 = (struct sockaddr_in *)address;
3998 snum = ntohs(addr4->sin_port);
3999 addrp = (char *)&addr4->sin_addr.s_addr;
4000 } else {
4001 addr6 = (struct sockaddr_in6 *)address;
4002 snum = ntohs(addr6->sin6_port);
4003 addrp = (char *)&addr6->sin6_addr.s6_addr;
4004 }
4005
4006 if (snum) {
4007 int low, high;
4008
4009 inet_get_local_port_range(sock_net(sk), &low, &high);
4010
4011 if (snum < max(PROT_SOCK, low) || snum > high) {
4012 err = sel_netport_sid(sk->sk_protocol,
4013 snum, &sid);
4014 if (err)
4015 goto out;
4016 ad.type = LSM_AUDIT_DATA_NET;
4017 ad.u.net = &net;
4018 ad.u.net->sport = htons(snum);
4019 ad.u.net->family = family;
4020 err = avc_has_perm(sksec->sid, sid,
4021 sksec->sclass,
4022 SOCKET__NAME_BIND, &ad);
4023 if (err)
4024 goto out;
4025 }
4026 }
4027
4028 switch (sksec->sclass) {
4029 case SECCLASS_TCP_SOCKET:
4030 node_perm = TCP_SOCKET__NODE_BIND;
4031 break;
4032
4033 case SECCLASS_UDP_SOCKET:
4034 node_perm = UDP_SOCKET__NODE_BIND;
4035 break;
4036
4037 case SECCLASS_DCCP_SOCKET:
4038 node_perm = DCCP_SOCKET__NODE_BIND;
4039 break;
4040
4041 default:
4042 node_perm = RAWIP_SOCKET__NODE_BIND;
4043 break;
4044 }
4045
4046 err = sel_netnode_sid(addrp, family, &sid);
4047 if (err)
4048 goto out;
4049
4050 ad.type = LSM_AUDIT_DATA_NET;
4051 ad.u.net = &net;
4052 ad.u.net->sport = htons(snum);
4053 ad.u.net->family = family;
4054
4055 if (family == PF_INET)
4056 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4057 else
4058 ad.u.net->v6info.saddr = addr6->sin6_addr;
4059
4060 err = avc_has_perm(sksec->sid, sid,
4061 sksec->sclass, node_perm, &ad);
4062 if (err)
4063 goto out;
4064 }
4065 out:
4066 return err;
4067 }
4068
4069 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4070 {
4071 struct sock *sk = sock->sk;
4072 struct sk_security_struct *sksec = sk->sk_security;
4073 int err;
4074
4075 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4076 if (err)
4077 return err;
4078
4079 /*
4080 * If a TCP or DCCP socket, check name_connect permission for the port.
4081 */
4082 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4083 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4084 struct common_audit_data ad;
4085 struct lsm_network_audit net = {0,};
4086 struct sockaddr_in *addr4 = NULL;
4087 struct sockaddr_in6 *addr6 = NULL;
4088 unsigned short snum;
4089 u32 sid, perm;
4090
4091 if (sk->sk_family == PF_INET) {
4092 addr4 = (struct sockaddr_in *)address;
4093 if (addrlen < sizeof(struct sockaddr_in))
4094 return -EINVAL;
4095 snum = ntohs(addr4->sin_port);
4096 } else {
4097 addr6 = (struct sockaddr_in6 *)address;
4098 if (addrlen < SIN6_LEN_RFC2133)
4099 return -EINVAL;
4100 snum = ntohs(addr6->sin6_port);
4101 }
4102
4103 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4104 if (err)
4105 goto out;
4106
4107 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4108 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4109
4110 ad.type = LSM_AUDIT_DATA_NET;
4111 ad.u.net = &net;
4112 ad.u.net->dport = htons(snum);
4113 ad.u.net->family = sk->sk_family;
4114 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4115 if (err)
4116 goto out;
4117 }
4118
4119 err = selinux_netlbl_socket_connect(sk, address);
4120
4121 out:
4122 return err;
4123 }
4124
4125 static int selinux_socket_listen(struct socket *sock, int backlog)
4126 {
4127 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4128 }
4129
4130 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4131 {
4132 int err;
4133 struct inode_security_struct *isec;
4134 struct inode_security_struct *newisec;
4135
4136 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4137 if (err)
4138 return err;
4139
4140 newisec = SOCK_INODE(newsock)->i_security;
4141
4142 isec = SOCK_INODE(sock)->i_security;
4143 newisec->sclass = isec->sclass;
4144 newisec->sid = isec->sid;
4145 newisec->initialized = 1;
4146
4147 return 0;
4148 }
4149
4150 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4151 int size)
4152 {
4153 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4154 }
4155
4156 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4157 int size, int flags)
4158 {
4159 return sock_has_perm(current, sock->sk, SOCKET__READ);
4160 }
4161
4162 static int selinux_socket_getsockname(struct socket *sock)
4163 {
4164 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4165 }
4166
4167 static int selinux_socket_getpeername(struct socket *sock)
4168 {
4169 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4170 }
4171
4172 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4173 {
4174 int err;
4175
4176 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4177 if (err)
4178 return err;
4179
4180 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4181 }
4182
4183 static int selinux_socket_getsockopt(struct socket *sock, int level,
4184 int optname)
4185 {
4186 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4187 }
4188
4189 static int selinux_socket_shutdown(struct socket *sock, int how)
4190 {
4191 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4192 }
4193
4194 static int selinux_socket_unix_stream_connect(struct sock *sock,
4195 struct sock *other,
4196 struct sock *newsk)
4197 {
4198 struct sk_security_struct *sksec_sock = sock->sk_security;
4199 struct sk_security_struct *sksec_other = other->sk_security;
4200 struct sk_security_struct *sksec_new = newsk->sk_security;
4201 struct common_audit_data ad;
4202 struct lsm_network_audit net = {0,};
4203 int err;
4204
4205 ad.type = LSM_AUDIT_DATA_NET;
4206 ad.u.net = &net;
4207 ad.u.net->sk = other;
4208
4209 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4210 sksec_other->sclass,
4211 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4212 if (err)
4213 return err;
4214
4215 /* server child socket */
4216 sksec_new->peer_sid = sksec_sock->sid;
4217 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4218 &sksec_new->sid);
4219 if (err)
4220 return err;
4221
4222 /* connecting socket */
4223 sksec_sock->peer_sid = sksec_new->sid;
4224
4225 return 0;
4226 }
4227
4228 static int selinux_socket_unix_may_send(struct socket *sock,
4229 struct socket *other)
4230 {
4231 struct sk_security_struct *ssec = sock->sk->sk_security;
4232 struct sk_security_struct *osec = other->sk->sk_security;
4233 struct common_audit_data ad;
4234 struct lsm_network_audit net = {0,};
4235
4236 ad.type = LSM_AUDIT_DATA_NET;
4237 ad.u.net = &net;
4238 ad.u.net->sk = other->sk;
4239
4240 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4241 &ad);
4242 }
4243
4244 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4245 u32 peer_sid,
4246 struct common_audit_data *ad)
4247 {
4248 int err;
4249 u32 if_sid;
4250 u32 node_sid;
4251
4252 err = sel_netif_sid(ifindex, &if_sid);
4253 if (err)
4254 return err;
4255 err = avc_has_perm(peer_sid, if_sid,
4256 SECCLASS_NETIF, NETIF__INGRESS, ad);
4257 if (err)
4258 return err;
4259
4260 err = sel_netnode_sid(addrp, family, &node_sid);
4261 if (err)
4262 return err;
4263 return avc_has_perm(peer_sid, node_sid,
4264 SECCLASS_NODE, NODE__RECVFROM, ad);
4265 }
4266
4267 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4268 u16 family)
4269 {
4270 int err = 0;
4271 struct sk_security_struct *sksec = sk->sk_security;
4272 u32 sk_sid = sksec->sid;
4273 struct common_audit_data ad;
4274 struct lsm_network_audit net = {0,};
4275 char *addrp;
4276
4277 ad.type = LSM_AUDIT_DATA_NET;
4278 ad.u.net = &net;
4279 ad.u.net->netif = skb->skb_iif;
4280 ad.u.net->family = family;
4281 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4282 if (err)
4283 return err;
4284
4285 if (selinux_secmark_enabled()) {
4286 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4287 PACKET__RECV, &ad);
4288 if (err)
4289 return err;
4290 }
4291
4292 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4293 if (err)
4294 return err;
4295 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4296
4297 return err;
4298 }
4299
4300 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4301 {
4302 int err;
4303 struct sk_security_struct *sksec = sk->sk_security;
4304 u16 family = sk->sk_family;
4305 u32 sk_sid = sksec->sid;
4306 struct common_audit_data ad;
4307 struct lsm_network_audit net = {0,};
4308 char *addrp;
4309 u8 secmark_active;
4310 u8 peerlbl_active;
4311
4312 if (family != PF_INET && family != PF_INET6)
4313 return 0;
4314
4315 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4316 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4317 family = PF_INET;
4318
4319 /* If any sort of compatibility mode is enabled then handoff processing
4320 * to the selinux_sock_rcv_skb_compat() function to deal with the
4321 * special handling. We do this in an attempt to keep this function
4322 * as fast and as clean as possible. */
4323 if (!selinux_policycap_netpeer)
4324 return selinux_sock_rcv_skb_compat(sk, skb, family);
4325
4326 secmark_active = selinux_secmark_enabled();
4327 peerlbl_active = selinux_peerlbl_enabled();
4328 if (!secmark_active && !peerlbl_active)
4329 return 0;
4330
4331 ad.type = LSM_AUDIT_DATA_NET;
4332 ad.u.net = &net;
4333 ad.u.net->netif = skb->skb_iif;
4334 ad.u.net->family = family;
4335 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4336 if (err)
4337 return err;
4338
4339 if (peerlbl_active) {
4340 u32 peer_sid;
4341
4342 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4343 if (err)
4344 return err;
4345 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4346 peer_sid, &ad);
4347 if (err) {
4348 selinux_netlbl_err(skb, err, 0);
4349 return err;
4350 }
4351 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4352 PEER__RECV, &ad);
4353 if (err) {
4354 selinux_netlbl_err(skb, err, 0);
4355 return err;
4356 }
4357 }
4358
4359 if (secmark_active) {
4360 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4361 PACKET__RECV, &ad);
4362 if (err)
4363 return err;
4364 }
4365
4366 return err;
4367 }
4368
4369 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4370 int __user *optlen, unsigned len)
4371 {
4372 int err = 0;
4373 char *scontext;
4374 u32 scontext_len;
4375 struct sk_security_struct *sksec = sock->sk->sk_security;
4376 u32 peer_sid = SECSID_NULL;
4377
4378 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4379 sksec->sclass == SECCLASS_TCP_SOCKET)
4380 peer_sid = sksec->peer_sid;
4381 if (peer_sid == SECSID_NULL)
4382 return -ENOPROTOOPT;
4383
4384 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4385 if (err)
4386 return err;
4387
4388 if (scontext_len > len) {
4389 err = -ERANGE;
4390 goto out_len;
4391 }
4392
4393 if (copy_to_user(optval, scontext, scontext_len))
4394 err = -EFAULT;
4395
4396 out_len:
4397 if (put_user(scontext_len, optlen))
4398 err = -EFAULT;
4399 kfree(scontext);
4400 return err;
4401 }
4402
4403 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4404 {
4405 u32 peer_secid = SECSID_NULL;
4406 u16 family;
4407
4408 if (skb && skb->protocol == htons(ETH_P_IP))
4409 family = PF_INET;
4410 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4411 family = PF_INET6;
4412 else if (sock)
4413 family = sock->sk->sk_family;
4414 else
4415 goto out;
4416
4417 if (sock && family == PF_UNIX)
4418 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4419 else if (skb)
4420 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4421
4422 out:
4423 *secid = peer_secid;
4424 if (peer_secid == SECSID_NULL)
4425 return -EINVAL;
4426 return 0;
4427 }
4428
4429 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4430 {
4431 struct sk_security_struct *sksec;
4432
4433 sksec = kzalloc(sizeof(*sksec), priority);
4434 if (!sksec)
4435 return -ENOMEM;
4436
4437 sksec->peer_sid = SECINITSID_UNLABELED;
4438 sksec->sid = SECINITSID_UNLABELED;
4439 selinux_netlbl_sk_security_reset(sksec);
4440 sk->sk_security = sksec;
4441
4442 return 0;
4443 }
4444
4445 static void selinux_sk_free_security(struct sock *sk)
4446 {
4447 struct sk_security_struct *sksec = sk->sk_security;
4448
4449 sk->sk_security = NULL;
4450 selinux_netlbl_sk_security_free(sksec);
4451 kfree(sksec);
4452 }
4453
4454 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4455 {
4456 struct sk_security_struct *sksec = sk->sk_security;
4457 struct sk_security_struct *newsksec = newsk->sk_security;
4458
4459 newsksec->sid = sksec->sid;
4460 newsksec->peer_sid = sksec->peer_sid;
4461 newsksec->sclass = sksec->sclass;
4462
4463 selinux_netlbl_sk_security_reset(newsksec);
4464 }
4465
4466 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4467 {
4468 if (!sk)
4469 *secid = SECINITSID_ANY_SOCKET;
4470 else {
4471 struct sk_security_struct *sksec = sk->sk_security;
4472
4473 *secid = sksec->sid;
4474 }
4475 }
4476
4477 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4478 {
4479 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4480 struct sk_security_struct *sksec = sk->sk_security;
4481
4482 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4483 sk->sk_family == PF_UNIX)
4484 isec->sid = sksec->sid;
4485 sksec->sclass = isec->sclass;
4486 }
4487
4488 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4489 struct request_sock *req)
4490 {
4491 struct sk_security_struct *sksec = sk->sk_security;
4492 int err;
4493 u16 family = req->rsk_ops->family;
4494 u32 connsid;
4495 u32 peersid;
4496
4497 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4498 if (err)
4499 return err;
4500 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4501 if (err)
4502 return err;
4503 req->secid = connsid;
4504 req->peer_secid = peersid;
4505
4506 return selinux_netlbl_inet_conn_request(req, family);
4507 }
4508
4509 static void selinux_inet_csk_clone(struct sock *newsk,
4510 const struct request_sock *req)
4511 {
4512 struct sk_security_struct *newsksec = newsk->sk_security;
4513
4514 newsksec->sid = req->secid;
4515 newsksec->peer_sid = req->peer_secid;
4516 /* NOTE: Ideally, we should also get the isec->sid for the
4517 new socket in sync, but we don't have the isec available yet.
4518 So we will wait until sock_graft to do it, by which
4519 time it will have been created and available. */
4520
4521 /* We don't need to take any sort of lock here as we are the only
4522 * thread with access to newsksec */
4523 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4524 }
4525
4526 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4527 {
4528 u16 family = sk->sk_family;
4529 struct sk_security_struct *sksec = sk->sk_security;
4530
4531 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4532 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4533 family = PF_INET;
4534
4535 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4536 }
4537
4538 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4539 {
4540 skb_set_owner_w(skb, sk);
4541 }
4542
4543 static int selinux_secmark_relabel_packet(u32 sid)
4544 {
4545 const struct task_security_struct *__tsec;
4546 u32 tsid;
4547
4548 __tsec = current_security();
4549 tsid = __tsec->sid;
4550
4551 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4552 }
4553
4554 static void selinux_secmark_refcount_inc(void)
4555 {
4556 atomic_inc(&selinux_secmark_refcount);
4557 }
4558
4559 static void selinux_secmark_refcount_dec(void)
4560 {
4561 atomic_dec(&selinux_secmark_refcount);
4562 }
4563
4564 static void selinux_req_classify_flow(const struct request_sock *req,
4565 struct flowi *fl)
4566 {
4567 fl->flowi_secid = req->secid;
4568 }
4569
4570 static int selinux_tun_dev_alloc_security(void **security)
4571 {
4572 struct tun_security_struct *tunsec;
4573
4574 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4575 if (!tunsec)
4576 return -ENOMEM;
4577 tunsec->sid = current_sid();
4578
4579 *security = tunsec;
4580 return 0;
4581 }
4582
4583 static void selinux_tun_dev_free_security(void *security)
4584 {
4585 kfree(security);
4586 }
4587
4588 static int selinux_tun_dev_create(void)
4589 {
4590 u32 sid = current_sid();
4591
4592 /* we aren't taking into account the "sockcreate" SID since the socket
4593 * that is being created here is not a socket in the traditional sense,
4594 * instead it is a private sock, accessible only to the kernel, and
4595 * representing a wide range of network traffic spanning multiple
4596 * connections unlike traditional sockets - check the TUN driver to
4597 * get a better understanding of why this socket is special */
4598
4599 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4600 NULL);
4601 }
4602
4603 static int selinux_tun_dev_attach_queue(void *security)
4604 {
4605 struct tun_security_struct *tunsec = security;
4606
4607 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4608 TUN_SOCKET__ATTACH_QUEUE, NULL);
4609 }
4610
4611 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4612 {
4613 struct tun_security_struct *tunsec = security;
4614 struct sk_security_struct *sksec = sk->sk_security;
4615
4616 /* we don't currently perform any NetLabel based labeling here and it
4617 * isn't clear that we would want to do so anyway; while we could apply
4618 * labeling without the support of the TUN user the resulting labeled
4619 * traffic from the other end of the connection would almost certainly
4620 * cause confusion to the TUN user that had no idea network labeling
4621 * protocols were being used */
4622
4623 sksec->sid = tunsec->sid;
4624 sksec->sclass = SECCLASS_TUN_SOCKET;
4625
4626 return 0;
4627 }
4628
4629 static int selinux_tun_dev_open(void *security)
4630 {
4631 struct tun_security_struct *tunsec = security;
4632 u32 sid = current_sid();
4633 int err;
4634
4635 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4636 TUN_SOCKET__RELABELFROM, NULL);
4637 if (err)
4638 return err;
4639 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4640 TUN_SOCKET__RELABELTO, NULL);
4641 if (err)
4642 return err;
4643 tunsec->sid = sid;
4644
4645 return 0;
4646 }
4647
4648 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4649 {
4650 int err = 0;
4651 u32 perm;
4652 struct nlmsghdr *nlh;
4653 struct sk_security_struct *sksec = sk->sk_security;
4654
4655 if (skb->len < NLMSG_HDRLEN) {
4656 err = -EINVAL;
4657 goto out;
4658 }
4659 nlh = nlmsg_hdr(skb);
4660
4661 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4662 if (err) {
4663 if (err == -EINVAL) {
4664 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4665 "SELinux: unrecognized netlink message"
4666 " type=%hu for sclass=%hu\n",
4667 nlh->nlmsg_type, sksec->sclass);
4668 if (!selinux_enforcing || security_get_allow_unknown())
4669 err = 0;
4670 }
4671
4672 /* Ignore */
4673 if (err == -ENOENT)
4674 err = 0;
4675 goto out;
4676 }
4677
4678 err = sock_has_perm(current, sk, perm);
4679 out:
4680 return err;
4681 }
4682
4683 #ifdef CONFIG_NETFILTER
4684
4685 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4686 u16 family)
4687 {
4688 int err;
4689 char *addrp;
4690 u32 peer_sid;
4691 struct common_audit_data ad;
4692 struct lsm_network_audit net = {0,};
4693 u8 secmark_active;
4694 u8 netlbl_active;
4695 u8 peerlbl_active;
4696
4697 if (!selinux_policycap_netpeer)
4698 return NF_ACCEPT;
4699
4700 secmark_active = selinux_secmark_enabled();
4701 netlbl_active = netlbl_enabled();
4702 peerlbl_active = selinux_peerlbl_enabled();
4703 if (!secmark_active && !peerlbl_active)
4704 return NF_ACCEPT;
4705
4706 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4707 return NF_DROP;
4708
4709 ad.type = LSM_AUDIT_DATA_NET;
4710 ad.u.net = &net;
4711 ad.u.net->netif = ifindex;
4712 ad.u.net->family = family;
4713 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4714 return NF_DROP;
4715
4716 if (peerlbl_active) {
4717 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4718 peer_sid, &ad);
4719 if (err) {
4720 selinux_netlbl_err(skb, err, 1);
4721 return NF_DROP;
4722 }
4723 }
4724
4725 if (secmark_active)
4726 if (avc_has_perm(peer_sid, skb->secmark,
4727 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4728 return NF_DROP;
4729
4730 if (netlbl_active)
4731 /* we do this in the FORWARD path and not the POST_ROUTING
4732 * path because we want to make sure we apply the necessary
4733 * labeling before IPsec is applied so we can leverage AH
4734 * protection */
4735 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4736 return NF_DROP;
4737
4738 return NF_ACCEPT;
4739 }
4740
4741 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4742 struct sk_buff *skb,
4743 const struct net_device *in,
4744 const struct net_device *out,
4745 int (*okfn)(struct sk_buff *))
4746 {
4747 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4748 }
4749
4750 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4751 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4752 struct sk_buff *skb,
4753 const struct net_device *in,
4754 const struct net_device *out,
4755 int (*okfn)(struct sk_buff *))
4756 {
4757 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4758 }
4759 #endif /* IPV6 */
4760
4761 static unsigned int selinux_ip_output(struct sk_buff *skb,
4762 u16 family)
4763 {
4764 struct sock *sk;
4765 u32 sid;
4766
4767 if (!netlbl_enabled())
4768 return NF_ACCEPT;
4769
4770 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4771 * because we want to make sure we apply the necessary labeling
4772 * before IPsec is applied so we can leverage AH protection */
4773 sk = skb->sk;
4774 if (sk) {
4775 struct sk_security_struct *sksec;
4776
4777 if (sk->sk_state == TCP_LISTEN)
4778 /* if the socket is the listening state then this
4779 * packet is a SYN-ACK packet which means it needs to
4780 * be labeled based on the connection/request_sock and
4781 * not the parent socket. unfortunately, we can't
4782 * lookup the request_sock yet as it isn't queued on
4783 * the parent socket until after the SYN-ACK is sent.
4784 * the "solution" is to simply pass the packet as-is
4785 * as any IP option based labeling should be copied
4786 * from the initial connection request (in the IP
4787 * layer). it is far from ideal, but until we get a
4788 * security label in the packet itself this is the
4789 * best we can do. */
4790 return NF_ACCEPT;
4791
4792 /* standard practice, label using the parent socket */
4793 sksec = sk->sk_security;
4794 sid = sksec->sid;
4795 } else
4796 sid = SECINITSID_KERNEL;
4797 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4798 return NF_DROP;
4799
4800 return NF_ACCEPT;
4801 }
4802
4803 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4804 struct sk_buff *skb,
4805 const struct net_device *in,
4806 const struct net_device *out,
4807 int (*okfn)(struct sk_buff *))
4808 {
4809 return selinux_ip_output(skb, PF_INET);
4810 }
4811
4812 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4813 int ifindex,
4814 u16 family)
4815 {
4816 struct sock *sk = skb->sk;
4817 struct sk_security_struct *sksec;
4818 struct common_audit_data ad;
4819 struct lsm_network_audit net = {0,};
4820 char *addrp;
4821 u8 proto;
4822
4823 if (sk == NULL)
4824 return NF_ACCEPT;
4825 sksec = sk->sk_security;
4826
4827 ad.type = LSM_AUDIT_DATA_NET;
4828 ad.u.net = &net;
4829 ad.u.net->netif = ifindex;
4830 ad.u.net->family = family;
4831 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4832 return NF_DROP;
4833
4834 if (selinux_secmark_enabled())
4835 if (avc_has_perm(sksec->sid, skb->secmark,
4836 SECCLASS_PACKET, PACKET__SEND, &ad))
4837 return NF_DROP_ERR(-ECONNREFUSED);
4838
4839 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4840 return NF_DROP_ERR(-ECONNREFUSED);
4841
4842 return NF_ACCEPT;
4843 }
4844
4845 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4846 u16 family)
4847 {
4848 u32 secmark_perm;
4849 u32 peer_sid;
4850 struct sock *sk;
4851 struct common_audit_data ad;
4852 struct lsm_network_audit net = {0,};
4853 char *addrp;
4854 u8 secmark_active;
4855 u8 peerlbl_active;
4856
4857 /* If any sort of compatibility mode is enabled then handoff processing
4858 * to the selinux_ip_postroute_compat() function to deal with the
4859 * special handling. We do this in an attempt to keep this function
4860 * as fast and as clean as possible. */
4861 if (!selinux_policycap_netpeer)
4862 return selinux_ip_postroute_compat(skb, ifindex, family);
4863
4864 secmark_active = selinux_secmark_enabled();
4865 peerlbl_active = selinux_peerlbl_enabled();
4866 if (!secmark_active && !peerlbl_active)
4867 return NF_ACCEPT;
4868
4869 sk = skb->sk;
4870
4871 #ifdef CONFIG_XFRM
4872 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4873 * packet transformation so allow the packet to pass without any checks
4874 * since we'll have another chance to perform access control checks
4875 * when the packet is on it's final way out.
4876 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4877 * is NULL, in this case go ahead and apply access control.
4878 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4879 * TCP listening state we cannot wait until the XFRM processing
4880 * is done as we will miss out on the SA label if we do;
4881 * unfortunately, this means more work, but it is only once per
4882 * connection. */
4883 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4884 !(sk != NULL && sk->sk_state == TCP_LISTEN))
4885 return NF_ACCEPT;
4886 #endif
4887
4888 if (sk == NULL) {
4889 /* Without an associated socket the packet is either coming
4890 * from the kernel or it is being forwarded; check the packet
4891 * to determine which and if the packet is being forwarded
4892 * query the packet directly to determine the security label. */
4893 if (skb->skb_iif) {
4894 secmark_perm = PACKET__FORWARD_OUT;
4895 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4896 return NF_DROP;
4897 } else {
4898 secmark_perm = PACKET__SEND;
4899 peer_sid = SECINITSID_KERNEL;
4900 }
4901 } else if (sk->sk_state == TCP_LISTEN) {
4902 /* Locally generated packet but the associated socket is in the
4903 * listening state which means this is a SYN-ACK packet. In
4904 * this particular case the correct security label is assigned
4905 * to the connection/request_sock but unfortunately we can't
4906 * query the request_sock as it isn't queued on the parent
4907 * socket until after the SYN-ACK packet is sent; the only
4908 * viable choice is to regenerate the label like we do in
4909 * selinux_inet_conn_request(). See also selinux_ip_output()
4910 * for similar problems. */
4911 u32 skb_sid;
4912 struct sk_security_struct *sksec = sk->sk_security;
4913 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4914 return NF_DROP;
4915 /* At this point, if the returned skb peerlbl is SECSID_NULL
4916 * and the packet has been through at least one XFRM
4917 * transformation then we must be dealing with the "final"
4918 * form of labeled IPsec packet; since we've already applied
4919 * all of our access controls on this packet we can safely
4920 * pass the packet. */
4921 if (skb_sid == SECSID_NULL) {
4922 switch (family) {
4923 case PF_INET:
4924 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4925 return NF_ACCEPT;
4926 break;
4927 case PF_INET6:
4928 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4929 return NF_ACCEPT;
4930 default:
4931 return NF_DROP_ERR(-ECONNREFUSED);
4932 }
4933 }
4934 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4935 return NF_DROP;
4936 secmark_perm = PACKET__SEND;
4937 } else {
4938 /* Locally generated packet, fetch the security label from the
4939 * associated socket. */
4940 struct sk_security_struct *sksec = sk->sk_security;
4941 peer_sid = sksec->sid;
4942 secmark_perm = PACKET__SEND;
4943 }
4944
4945 ad.type = LSM_AUDIT_DATA_NET;
4946 ad.u.net = &net;
4947 ad.u.net->netif = ifindex;
4948 ad.u.net->family = family;
4949 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4950 return NF_DROP;
4951
4952 if (secmark_active)
4953 if (avc_has_perm(peer_sid, skb->secmark,
4954 SECCLASS_PACKET, secmark_perm, &ad))
4955 return NF_DROP_ERR(-ECONNREFUSED);
4956
4957 if (peerlbl_active) {
4958 u32 if_sid;
4959 u32 node_sid;
4960
4961 if (sel_netif_sid(ifindex, &if_sid))
4962 return NF_DROP;
4963 if (avc_has_perm(peer_sid, if_sid,
4964 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4965 return NF_DROP_ERR(-ECONNREFUSED);
4966
4967 if (sel_netnode_sid(addrp, family, &node_sid))
4968 return NF_DROP;
4969 if (avc_has_perm(peer_sid, node_sid,
4970 SECCLASS_NODE, NODE__SENDTO, &ad))
4971 return NF_DROP_ERR(-ECONNREFUSED);
4972 }
4973
4974 return NF_ACCEPT;
4975 }
4976
4977 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4978 struct sk_buff *skb,
4979 const struct net_device *in,
4980 const struct net_device *out,
4981 int (*okfn)(struct sk_buff *))
4982 {
4983 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4984 }
4985
4986 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4987 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
4988 struct sk_buff *skb,
4989 const struct net_device *in,
4990 const struct net_device *out,
4991 int (*okfn)(struct sk_buff *))
4992 {
4993 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4994 }
4995 #endif /* IPV6 */
4996
4997 #endif /* CONFIG_NETFILTER */
4998
4999 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5000 {
5001 int err;
5002
5003 err = cap_netlink_send(sk, skb);
5004 if (err)
5005 return err;
5006
5007 return selinux_nlmsg_perm(sk, skb);
5008 }
5009
5010 static int ipc_alloc_security(struct task_struct *task,
5011 struct kern_ipc_perm *perm,
5012 u16 sclass)
5013 {
5014 struct ipc_security_struct *isec;
5015 u32 sid;
5016
5017 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5018 if (!isec)
5019 return -ENOMEM;
5020
5021 sid = task_sid(task);
5022 isec->sclass = sclass;
5023 isec->sid = sid;
5024 perm->security = isec;
5025
5026 return 0;
5027 }
5028
5029 static void ipc_free_security(struct kern_ipc_perm *perm)
5030 {
5031 struct ipc_security_struct *isec = perm->security;
5032 perm->security = NULL;
5033 kfree(isec);
5034 }
5035
5036 static int msg_msg_alloc_security(struct msg_msg *msg)
5037 {
5038 struct msg_security_struct *msec;
5039
5040 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5041 if (!msec)
5042 return -ENOMEM;
5043
5044 msec->sid = SECINITSID_UNLABELED;
5045 msg->security = msec;
5046
5047 return 0;
5048 }
5049
5050 static void msg_msg_free_security(struct msg_msg *msg)
5051 {
5052 struct msg_security_struct *msec = msg->security;
5053
5054 msg->security = NULL;
5055 kfree(msec);
5056 }
5057
5058 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5059 u32 perms)
5060 {
5061 struct ipc_security_struct *isec;
5062 struct common_audit_data ad;
5063 u32 sid = current_sid();
5064
5065 isec = ipc_perms->security;
5066
5067 ad.type = LSM_AUDIT_DATA_IPC;
5068 ad.u.ipc_id = ipc_perms->key;
5069
5070 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5071 }
5072
5073 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5074 {
5075 return msg_msg_alloc_security(msg);
5076 }
5077
5078 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5079 {
5080 msg_msg_free_security(msg);
5081 }
5082
5083 /* message queue security operations */
5084 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5085 {
5086 struct ipc_security_struct *isec;
5087 struct common_audit_data ad;
5088 u32 sid = current_sid();
5089 int rc;
5090
5091 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5092 if (rc)
5093 return rc;
5094
5095 isec = msq->q_perm.security;
5096
5097 ad.type = LSM_AUDIT_DATA_IPC;
5098 ad.u.ipc_id = msq->q_perm.key;
5099
5100 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5101 MSGQ__CREATE, &ad);
5102 if (rc) {
5103 ipc_free_security(&msq->q_perm);
5104 return rc;
5105 }
5106 return 0;
5107 }
5108
5109 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5110 {
5111 ipc_free_security(&msq->q_perm);
5112 }
5113
5114 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5115 {
5116 struct ipc_security_struct *isec;
5117 struct common_audit_data ad;
5118 u32 sid = current_sid();
5119
5120 isec = msq->q_perm.security;
5121
5122 ad.type = LSM_AUDIT_DATA_IPC;
5123 ad.u.ipc_id = msq->q_perm.key;
5124
5125 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5126 MSGQ__ASSOCIATE, &ad);
5127 }
5128
5129 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5130 {
5131 int err;
5132 int perms;
5133
5134 switch (cmd) {
5135 case IPC_INFO:
5136 case MSG_INFO:
5137 /* No specific object, just general system-wide information. */
5138 return task_has_system(current, SYSTEM__IPC_INFO);
5139 case IPC_STAT:
5140 case MSG_STAT:
5141 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5142 break;
5143 case IPC_SET:
5144 perms = MSGQ__SETATTR;
5145 break;
5146 case IPC_RMID:
5147 perms = MSGQ__DESTROY;
5148 break;
5149 default:
5150 return 0;
5151 }
5152
5153 err = ipc_has_perm(&msq->q_perm, perms);
5154 return err;
5155 }
5156
5157 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5158 {
5159 struct ipc_security_struct *isec;
5160 struct msg_security_struct *msec;
5161 struct common_audit_data ad;
5162 u32 sid = current_sid();
5163 int rc;
5164
5165 isec = msq->q_perm.security;
5166 msec = msg->security;
5167
5168 /*
5169 * First time through, need to assign label to the message
5170 */
5171 if (msec->sid == SECINITSID_UNLABELED) {
5172 /*
5173 * Compute new sid based on current process and
5174 * message queue this message will be stored in
5175 */
5176 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5177 NULL, &msec->sid);
5178 if (rc)
5179 return rc;
5180 }
5181
5182 ad.type = LSM_AUDIT_DATA_IPC;
5183 ad.u.ipc_id = msq->q_perm.key;
5184
5185 /* Can this process write to the queue? */
5186 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5187 MSGQ__WRITE, &ad);
5188 if (!rc)
5189 /* Can this process send the message */
5190 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5191 MSG__SEND, &ad);
5192 if (!rc)
5193 /* Can the message be put in the queue? */
5194 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5195 MSGQ__ENQUEUE, &ad);
5196
5197 return rc;
5198 }
5199
5200 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5201 struct task_struct *target,
5202 long type, int mode)
5203 {
5204 struct ipc_security_struct *isec;
5205 struct msg_security_struct *msec;
5206 struct common_audit_data ad;
5207 u32 sid = task_sid(target);
5208 int rc;
5209
5210 isec = msq->q_perm.security;
5211 msec = msg->security;
5212
5213 ad.type = LSM_AUDIT_DATA_IPC;
5214 ad.u.ipc_id = msq->q_perm.key;
5215
5216 rc = avc_has_perm(sid, isec->sid,
5217 SECCLASS_MSGQ, MSGQ__READ, &ad);
5218 if (!rc)
5219 rc = avc_has_perm(sid, msec->sid,
5220 SECCLASS_MSG, MSG__RECEIVE, &ad);
5221 return rc;
5222 }
5223
5224 /* Shared Memory security operations */
5225 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5226 {
5227 struct ipc_security_struct *isec;
5228 struct common_audit_data ad;
5229 u32 sid = current_sid();
5230 int rc;
5231
5232 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5233 if (rc)
5234 return rc;
5235
5236 isec = shp->shm_perm.security;
5237
5238 ad.type = LSM_AUDIT_DATA_IPC;
5239 ad.u.ipc_id = shp->shm_perm.key;
5240
5241 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5242 SHM__CREATE, &ad);
5243 if (rc) {
5244 ipc_free_security(&shp->shm_perm);
5245 return rc;
5246 }
5247 return 0;
5248 }
5249
5250 static void selinux_shm_free_security(struct shmid_kernel *shp)
5251 {
5252 ipc_free_security(&shp->shm_perm);
5253 }
5254
5255 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5256 {
5257 struct ipc_security_struct *isec;
5258 struct common_audit_data ad;
5259 u32 sid = current_sid();
5260
5261 isec = shp->shm_perm.security;
5262
5263 ad.type = LSM_AUDIT_DATA_IPC;
5264 ad.u.ipc_id = shp->shm_perm.key;
5265
5266 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5267 SHM__ASSOCIATE, &ad);
5268 }
5269
5270 /* Note, at this point, shp is locked down */
5271 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5272 {
5273 int perms;
5274 int err;
5275
5276 switch (cmd) {
5277 case IPC_INFO:
5278 case SHM_INFO:
5279 /* No specific object, just general system-wide information. */
5280 return task_has_system(current, SYSTEM__IPC_INFO);
5281 case IPC_STAT:
5282 case SHM_STAT:
5283 perms = SHM__GETATTR | SHM__ASSOCIATE;
5284 break;
5285 case IPC_SET:
5286 perms = SHM__SETATTR;
5287 break;
5288 case SHM_LOCK:
5289 case SHM_UNLOCK:
5290 perms = SHM__LOCK;
5291 break;
5292 case IPC_RMID:
5293 perms = SHM__DESTROY;
5294 break;
5295 default:
5296 return 0;
5297 }
5298
5299 err = ipc_has_perm(&shp->shm_perm, perms);
5300 return err;
5301 }
5302
5303 static int selinux_shm_shmat(struct shmid_kernel *shp,
5304 char __user *shmaddr, int shmflg)
5305 {
5306 u32 perms;
5307
5308 if (shmflg & SHM_RDONLY)
5309 perms = SHM__READ;
5310 else
5311 perms = SHM__READ | SHM__WRITE;
5312
5313 return ipc_has_perm(&shp->shm_perm, perms);
5314 }
5315
5316 /* Semaphore security operations */
5317 static int selinux_sem_alloc_security(struct sem_array *sma)
5318 {
5319 struct ipc_security_struct *isec;
5320 struct common_audit_data ad;
5321 u32 sid = current_sid();
5322 int rc;
5323
5324 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5325 if (rc)
5326 return rc;
5327
5328 isec = sma->sem_perm.security;
5329
5330 ad.type = LSM_AUDIT_DATA_IPC;
5331 ad.u.ipc_id = sma->sem_perm.key;
5332
5333 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5334 SEM__CREATE, &ad);
5335 if (rc) {
5336 ipc_free_security(&sma->sem_perm);
5337 return rc;
5338 }
5339 return 0;
5340 }
5341
5342 static void selinux_sem_free_security(struct sem_array *sma)
5343 {
5344 ipc_free_security(&sma->sem_perm);
5345 }
5346
5347 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5348 {
5349 struct ipc_security_struct *isec;
5350 struct common_audit_data ad;
5351 u32 sid = current_sid();
5352
5353 isec = sma->sem_perm.security;
5354
5355 ad.type = LSM_AUDIT_DATA_IPC;
5356 ad.u.ipc_id = sma->sem_perm.key;
5357
5358 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5359 SEM__ASSOCIATE, &ad);
5360 }
5361
5362 /* Note, at this point, sma is locked down */
5363 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5364 {
5365 int err;
5366 u32 perms;
5367
5368 switch (cmd) {
5369 case IPC_INFO:
5370 case SEM_INFO:
5371 /* No specific object, just general system-wide information. */
5372 return task_has_system(current, SYSTEM__IPC_INFO);
5373 case GETPID:
5374 case GETNCNT:
5375 case GETZCNT:
5376 perms = SEM__GETATTR;
5377 break;
5378 case GETVAL:
5379 case GETALL:
5380 perms = SEM__READ;
5381 break;
5382 case SETVAL:
5383 case SETALL:
5384 perms = SEM__WRITE;
5385 break;
5386 case IPC_RMID:
5387 perms = SEM__DESTROY;
5388 break;
5389 case IPC_SET:
5390 perms = SEM__SETATTR;
5391 break;
5392 case IPC_STAT:
5393 case SEM_STAT:
5394 perms = SEM__GETATTR | SEM__ASSOCIATE;
5395 break;
5396 default:
5397 return 0;
5398 }
5399
5400 err = ipc_has_perm(&sma->sem_perm, perms);
5401 return err;
5402 }
5403
5404 static int selinux_sem_semop(struct sem_array *sma,
5405 struct sembuf *sops, unsigned nsops, int alter)
5406 {
5407 u32 perms;
5408
5409 if (alter)
5410 perms = SEM__READ | SEM__WRITE;
5411 else
5412 perms = SEM__READ;
5413
5414 return ipc_has_perm(&sma->sem_perm, perms);
5415 }
5416
5417 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5418 {
5419 u32 av = 0;
5420
5421 av = 0;
5422 if (flag & S_IRUGO)
5423 av |= IPC__UNIX_READ;
5424 if (flag & S_IWUGO)
5425 av |= IPC__UNIX_WRITE;
5426
5427 if (av == 0)
5428 return 0;
5429
5430 return ipc_has_perm(ipcp, av);
5431 }
5432
5433 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5434 {
5435 struct ipc_security_struct *isec = ipcp->security;
5436 *secid = isec->sid;
5437 }
5438
5439 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5440 {
5441 if (inode)
5442 inode_doinit_with_dentry(inode, dentry);
5443 }
5444
5445 static int selinux_getprocattr(struct task_struct *p,
5446 char *name, char **value)
5447 {
5448 const struct task_security_struct *__tsec;
5449 u32 sid;
5450 int error;
5451 unsigned len;
5452
5453 if (current != p) {
5454 error = current_has_perm(p, PROCESS__GETATTR);
5455 if (error)
5456 return error;
5457 }
5458
5459 rcu_read_lock();
5460 __tsec = __task_cred(p)->security;
5461
5462 if (!strcmp(name, "current"))
5463 sid = __tsec->sid;
5464 else if (!strcmp(name, "prev"))
5465 sid = __tsec->osid;
5466 else if (!strcmp(name, "exec"))
5467 sid = __tsec->exec_sid;
5468 else if (!strcmp(name, "fscreate"))
5469 sid = __tsec->create_sid;
5470 else if (!strcmp(name, "keycreate"))
5471 sid = __tsec->keycreate_sid;
5472 else if (!strcmp(name, "sockcreate"))
5473 sid = __tsec->sockcreate_sid;
5474 else
5475 goto invalid;
5476 rcu_read_unlock();
5477
5478 if (!sid)
5479 return 0;
5480
5481 error = security_sid_to_context(sid, value, &len);
5482 if (error)
5483 return error;
5484 return len;
5485
5486 invalid:
5487 rcu_read_unlock();
5488 return -EINVAL;
5489 }
5490
5491 static int selinux_setprocattr(struct task_struct *p,
5492 char *name, void *value, size_t size)
5493 {
5494 struct task_security_struct *tsec;
5495 struct task_struct *tracer;
5496 struct cred *new;
5497 u32 sid = 0, ptsid;
5498 int error;
5499 char *str = value;
5500
5501 if (current != p) {
5502 /* SELinux only allows a process to change its own
5503 security attributes. */
5504 return -EACCES;
5505 }
5506
5507 /*
5508 * Basic control over ability to set these attributes at all.
5509 * current == p, but we'll pass them separately in case the
5510 * above restriction is ever removed.
5511 */
5512 if (!strcmp(name, "exec"))
5513 error = current_has_perm(p, PROCESS__SETEXEC);
5514 else if (!strcmp(name, "fscreate"))
5515 error = current_has_perm(p, PROCESS__SETFSCREATE);
5516 else if (!strcmp(name, "keycreate"))
5517 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5518 else if (!strcmp(name, "sockcreate"))
5519 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5520 else if (!strcmp(name, "current"))
5521 error = current_has_perm(p, PROCESS__SETCURRENT);
5522 else
5523 error = -EINVAL;
5524 if (error)
5525 return error;
5526
5527 /* Obtain a SID for the context, if one was specified. */
5528 if (size && str[1] && str[1] != '\n') {
5529 if (str[size-1] == '\n') {
5530 str[size-1] = 0;
5531 size--;
5532 }
5533 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5534 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5535 if (!capable(CAP_MAC_ADMIN)) {
5536 struct audit_buffer *ab;
5537 size_t audit_size;
5538
5539 /* We strip a nul only if it is at the end, otherwise the
5540 * context contains a nul and we should audit that */
5541 if (str[size - 1] == '\0')
5542 audit_size = size - 1;
5543 else
5544 audit_size = size;
5545 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5546 audit_log_format(ab, "op=fscreate invalid_context=");
5547 audit_log_n_untrustedstring(ab, value, audit_size);
5548 audit_log_end(ab);
5549
5550 return error;
5551 }
5552 error = security_context_to_sid_force(value, size,
5553 &sid);
5554 }
5555 if (error)
5556 return error;
5557 }
5558
5559 new = prepare_creds();
5560 if (!new)
5561 return -ENOMEM;
5562
5563 /* Permission checking based on the specified context is
5564 performed during the actual operation (execve,
5565 open/mkdir/...), when we know the full context of the
5566 operation. See selinux_bprm_set_creds for the execve
5567 checks and may_create for the file creation checks. The
5568 operation will then fail if the context is not permitted. */
5569 tsec = new->security;
5570 if (!strcmp(name, "exec")) {
5571 tsec->exec_sid = sid;
5572 } else if (!strcmp(name, "fscreate")) {
5573 tsec->create_sid = sid;
5574 } else if (!strcmp(name, "keycreate")) {
5575 error = may_create_key(sid, p);
5576 if (error)
5577 goto abort_change;
5578 tsec->keycreate_sid = sid;
5579 } else if (!strcmp(name, "sockcreate")) {
5580 tsec->sockcreate_sid = sid;
5581 } else if (!strcmp(name, "current")) {
5582 error = -EINVAL;
5583 if (sid == 0)
5584 goto abort_change;
5585
5586 /* Only allow single threaded processes to change context */
5587 error = -EPERM;
5588 if (!current_is_single_threaded()) {
5589 error = security_bounded_transition(tsec->sid, sid);
5590 if (error)
5591 goto abort_change;
5592 }
5593
5594 /* Check permissions for the transition. */
5595 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5596 PROCESS__DYNTRANSITION, NULL);
5597 if (error)
5598 goto abort_change;
5599
5600 /* Check for ptracing, and update the task SID if ok.
5601 Otherwise, leave SID unchanged and fail. */
5602 ptsid = 0;
5603 rcu_read_lock();
5604 tracer = ptrace_parent(p);
5605 if (tracer)
5606 ptsid = task_sid(tracer);
5607 rcu_read_unlock();
5608
5609 if (tracer) {
5610 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5611 PROCESS__PTRACE, NULL);
5612 if (error)
5613 goto abort_change;
5614 }
5615
5616 tsec->sid = sid;
5617 } else {
5618 error = -EINVAL;
5619 goto abort_change;
5620 }
5621
5622 commit_creds(new);
5623 return size;
5624
5625 abort_change:
5626 abort_creds(new);
5627 return error;
5628 }
5629
5630 static int selinux_ismaclabel(const char *name)
5631 {
5632 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5633 }
5634
5635 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5636 {
5637 return security_sid_to_context(secid, secdata, seclen);
5638 }
5639
5640 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5641 {
5642 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5643 }
5644
5645 static void selinux_release_secctx(char *secdata, u32 seclen)
5646 {
5647 kfree(secdata);
5648 }
5649
5650 /*
5651 * called with inode->i_mutex locked
5652 */
5653 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5654 {
5655 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5656 }
5657
5658 /*
5659 * called with inode->i_mutex locked
5660 */
5661 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5662 {
5663 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5664 }
5665
5666 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5667 {
5668 int len = 0;
5669 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5670 ctx, true);
5671 if (len < 0)
5672 return len;
5673 *ctxlen = len;
5674 return 0;
5675 }
5676 #ifdef CONFIG_KEYS
5677
5678 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5679 unsigned long flags)
5680 {
5681 const struct task_security_struct *tsec;
5682 struct key_security_struct *ksec;
5683
5684 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5685 if (!ksec)
5686 return -ENOMEM;
5687
5688 tsec = cred->security;
5689 if (tsec->keycreate_sid)
5690 ksec->sid = tsec->keycreate_sid;
5691 else
5692 ksec->sid = tsec->sid;
5693
5694 k->security = ksec;
5695 return 0;
5696 }
5697
5698 static void selinux_key_free(struct key *k)
5699 {
5700 struct key_security_struct *ksec = k->security;
5701
5702 k->security = NULL;
5703 kfree(ksec);
5704 }
5705
5706 static int selinux_key_permission(key_ref_t key_ref,
5707 const struct cred *cred,
5708 key_perm_t perm)
5709 {
5710 struct key *key;
5711 struct key_security_struct *ksec;
5712 u32 sid;
5713
5714 /* if no specific permissions are requested, we skip the
5715 permission check. No serious, additional covert channels
5716 appear to be created. */
5717 if (perm == 0)
5718 return 0;
5719
5720 sid = cred_sid(cred);
5721
5722 key = key_ref_to_ptr(key_ref);
5723 ksec = key->security;
5724
5725 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5726 }
5727
5728 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5729 {
5730 struct key_security_struct *ksec = key->security;
5731 char *context = NULL;
5732 unsigned len;
5733 int rc;
5734
5735 rc = security_sid_to_context(ksec->sid, &context, &len);
5736 if (!rc)
5737 rc = len;
5738 *_buffer = context;
5739 return rc;
5740 }
5741
5742 #endif
5743
5744 static struct security_operations selinux_ops = {
5745 .name = "selinux",
5746
5747 .ptrace_access_check = selinux_ptrace_access_check,
5748 .ptrace_traceme = selinux_ptrace_traceme,
5749 .capget = selinux_capget,
5750 .capset = selinux_capset,
5751 .capable = selinux_capable,
5752 .quotactl = selinux_quotactl,
5753 .quota_on = selinux_quota_on,
5754 .syslog = selinux_syslog,
5755 .vm_enough_memory = selinux_vm_enough_memory,
5756
5757 .netlink_send = selinux_netlink_send,
5758
5759 .bprm_set_creds = selinux_bprm_set_creds,
5760 .bprm_committing_creds = selinux_bprm_committing_creds,
5761 .bprm_committed_creds = selinux_bprm_committed_creds,
5762 .bprm_secureexec = selinux_bprm_secureexec,
5763
5764 .sb_alloc_security = selinux_sb_alloc_security,
5765 .sb_free_security = selinux_sb_free_security,
5766 .sb_copy_data = selinux_sb_copy_data,
5767 .sb_remount = selinux_sb_remount,
5768 .sb_kern_mount = selinux_sb_kern_mount,
5769 .sb_show_options = selinux_sb_show_options,
5770 .sb_statfs = selinux_sb_statfs,
5771 .sb_mount = selinux_mount,
5772 .sb_umount = selinux_umount,
5773 .sb_set_mnt_opts = selinux_set_mnt_opts,
5774 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5775 .sb_parse_opts_str = selinux_parse_opts_str,
5776
5777 .dentry_init_security = selinux_dentry_init_security,
5778
5779 .inode_alloc_security = selinux_inode_alloc_security,
5780 .inode_free_security = selinux_inode_free_security,
5781 .inode_init_security = selinux_inode_init_security,
5782 .inode_create = selinux_inode_create,
5783 .inode_link = selinux_inode_link,
5784 .inode_unlink = selinux_inode_unlink,
5785 .inode_symlink = selinux_inode_symlink,
5786 .inode_mkdir = selinux_inode_mkdir,
5787 .inode_rmdir = selinux_inode_rmdir,
5788 .inode_mknod = selinux_inode_mknod,
5789 .inode_rename = selinux_inode_rename,
5790 .inode_readlink = selinux_inode_readlink,
5791 .inode_follow_link = selinux_inode_follow_link,
5792 .inode_permission = selinux_inode_permission,
5793 .inode_setattr = selinux_inode_setattr,
5794 .inode_getattr = selinux_inode_getattr,
5795 .inode_setxattr = selinux_inode_setxattr,
5796 .inode_post_setxattr = selinux_inode_post_setxattr,
5797 .inode_getxattr = selinux_inode_getxattr,
5798 .inode_listxattr = selinux_inode_listxattr,
5799 .inode_removexattr = selinux_inode_removexattr,
5800 .inode_getsecurity = selinux_inode_getsecurity,
5801 .inode_setsecurity = selinux_inode_setsecurity,
5802 .inode_listsecurity = selinux_inode_listsecurity,
5803 .inode_getsecid = selinux_inode_getsecid,
5804
5805 .file_permission = selinux_file_permission,
5806 .file_alloc_security = selinux_file_alloc_security,
5807 .file_free_security = selinux_file_free_security,
5808 .file_ioctl = selinux_file_ioctl,
5809 .mmap_file = selinux_mmap_file,
5810 .mmap_addr = selinux_mmap_addr,
5811 .file_mprotect = selinux_file_mprotect,
5812 .file_lock = selinux_file_lock,
5813 .file_fcntl = selinux_file_fcntl,
5814 .file_set_fowner = selinux_file_set_fowner,
5815 .file_send_sigiotask = selinux_file_send_sigiotask,
5816 .file_receive = selinux_file_receive,
5817
5818 .file_open = selinux_file_open,
5819
5820 .task_create = selinux_task_create,
5821 .cred_alloc_blank = selinux_cred_alloc_blank,
5822 .cred_free = selinux_cred_free,
5823 .cred_prepare = selinux_cred_prepare,
5824 .cred_transfer = selinux_cred_transfer,
5825 .kernel_act_as = selinux_kernel_act_as,
5826 .kernel_create_files_as = selinux_kernel_create_files_as,
5827 .kernel_module_request = selinux_kernel_module_request,
5828 .task_setpgid = selinux_task_setpgid,
5829 .task_getpgid = selinux_task_getpgid,
5830 .task_getsid = selinux_task_getsid,
5831 .task_getsecid = selinux_task_getsecid,
5832 .task_setnice = selinux_task_setnice,
5833 .task_setioprio = selinux_task_setioprio,
5834 .task_getioprio = selinux_task_getioprio,
5835 .task_setrlimit = selinux_task_setrlimit,
5836 .task_setscheduler = selinux_task_setscheduler,
5837 .task_getscheduler = selinux_task_getscheduler,
5838 .task_movememory = selinux_task_movememory,
5839 .task_kill = selinux_task_kill,
5840 .task_wait = selinux_task_wait,
5841 .task_to_inode = selinux_task_to_inode,
5842
5843 .ipc_permission = selinux_ipc_permission,
5844 .ipc_getsecid = selinux_ipc_getsecid,
5845
5846 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5847 .msg_msg_free_security = selinux_msg_msg_free_security,
5848
5849 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5850 .msg_queue_free_security = selinux_msg_queue_free_security,
5851 .msg_queue_associate = selinux_msg_queue_associate,
5852 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5853 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5854 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5855
5856 .shm_alloc_security = selinux_shm_alloc_security,
5857 .shm_free_security = selinux_shm_free_security,
5858 .shm_associate = selinux_shm_associate,
5859 .shm_shmctl = selinux_shm_shmctl,
5860 .shm_shmat = selinux_shm_shmat,
5861
5862 .sem_alloc_security = selinux_sem_alloc_security,
5863 .sem_free_security = selinux_sem_free_security,
5864 .sem_associate = selinux_sem_associate,
5865 .sem_semctl = selinux_sem_semctl,
5866 .sem_semop = selinux_sem_semop,
5867
5868 .d_instantiate = selinux_d_instantiate,
5869
5870 .getprocattr = selinux_getprocattr,
5871 .setprocattr = selinux_setprocattr,
5872
5873 .ismaclabel = selinux_ismaclabel,
5874 .secid_to_secctx = selinux_secid_to_secctx,
5875 .secctx_to_secid = selinux_secctx_to_secid,
5876 .release_secctx = selinux_release_secctx,
5877 .inode_notifysecctx = selinux_inode_notifysecctx,
5878 .inode_setsecctx = selinux_inode_setsecctx,
5879 .inode_getsecctx = selinux_inode_getsecctx,
5880
5881 .unix_stream_connect = selinux_socket_unix_stream_connect,
5882 .unix_may_send = selinux_socket_unix_may_send,
5883
5884 .socket_create = selinux_socket_create,
5885 .socket_post_create = selinux_socket_post_create,
5886 .socket_bind = selinux_socket_bind,
5887 .socket_connect = selinux_socket_connect,
5888 .socket_listen = selinux_socket_listen,
5889 .socket_accept = selinux_socket_accept,
5890 .socket_sendmsg = selinux_socket_sendmsg,
5891 .socket_recvmsg = selinux_socket_recvmsg,
5892 .socket_getsockname = selinux_socket_getsockname,
5893 .socket_getpeername = selinux_socket_getpeername,
5894 .socket_getsockopt = selinux_socket_getsockopt,
5895 .socket_setsockopt = selinux_socket_setsockopt,
5896 .socket_shutdown = selinux_socket_shutdown,
5897 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5898 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5899 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5900 .sk_alloc_security = selinux_sk_alloc_security,
5901 .sk_free_security = selinux_sk_free_security,
5902 .sk_clone_security = selinux_sk_clone_security,
5903 .sk_getsecid = selinux_sk_getsecid,
5904 .sock_graft = selinux_sock_graft,
5905 .inet_conn_request = selinux_inet_conn_request,
5906 .inet_csk_clone = selinux_inet_csk_clone,
5907 .inet_conn_established = selinux_inet_conn_established,
5908 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5909 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5910 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5911 .req_classify_flow = selinux_req_classify_flow,
5912 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5913 .tun_dev_free_security = selinux_tun_dev_free_security,
5914 .tun_dev_create = selinux_tun_dev_create,
5915 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5916 .tun_dev_attach = selinux_tun_dev_attach,
5917 .tun_dev_open = selinux_tun_dev_open,
5918 .skb_owned_by = selinux_skb_owned_by,
5919
5920 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5921 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5922 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5923 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5924 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5925 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5926 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
5927 .xfrm_state_free_security = selinux_xfrm_state_free,
5928 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5929 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5930 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5931 .xfrm_decode_session = selinux_xfrm_decode_session,
5932 #endif
5933
5934 #ifdef CONFIG_KEYS
5935 .key_alloc = selinux_key_alloc,
5936 .key_free = selinux_key_free,
5937 .key_permission = selinux_key_permission,
5938 .key_getsecurity = selinux_key_getsecurity,
5939 #endif
5940
5941 #ifdef CONFIG_AUDIT
5942 .audit_rule_init = selinux_audit_rule_init,
5943 .audit_rule_known = selinux_audit_rule_known,
5944 .audit_rule_match = selinux_audit_rule_match,
5945 .audit_rule_free = selinux_audit_rule_free,
5946 #endif
5947 };
5948
5949 static __init int selinux_init(void)
5950 {
5951 if (!security_module_enable(&selinux_ops)) {
5952 selinux_enabled = 0;
5953 return 0;
5954 }
5955
5956 if (!selinux_enabled) {
5957 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5958 return 0;
5959 }
5960
5961 printk(KERN_INFO "SELinux: Initializing.\n");
5962
5963 /* Set the security state for the initial task. */
5964 cred_init_security();
5965
5966 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5967
5968 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5969 sizeof(struct inode_security_struct),
5970 0, SLAB_PANIC, NULL);
5971 avc_init();
5972
5973 if (register_security(&selinux_ops))
5974 panic("SELinux: Unable to register with kernel.\n");
5975
5976 if (selinux_enforcing)
5977 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5978 else
5979 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5980
5981 return 0;
5982 }
5983
5984 static void delayed_superblock_init(struct super_block *sb, void *unused)
5985 {
5986 superblock_doinit(sb, NULL);
5987 }
5988
5989 void selinux_complete_init(void)
5990 {
5991 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5992
5993 /* Set up any superblocks initialized prior to the policy load. */
5994 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5995 iterate_supers(delayed_superblock_init, NULL);
5996 }
5997
5998 /* SELinux requires early initialization in order to label
5999 all processes and objects when they are created. */
6000 security_initcall(selinux_init);
6001
6002 #if defined(CONFIG_NETFILTER)
6003
6004 static struct nf_hook_ops selinux_ipv4_ops[] = {
6005 {
6006 .hook = selinux_ipv4_postroute,
6007 .owner = THIS_MODULE,
6008 .pf = NFPROTO_IPV4,
6009 .hooknum = NF_INET_POST_ROUTING,
6010 .priority = NF_IP_PRI_SELINUX_LAST,
6011 },
6012 {
6013 .hook = selinux_ipv4_forward,
6014 .owner = THIS_MODULE,
6015 .pf = NFPROTO_IPV4,
6016 .hooknum = NF_INET_FORWARD,
6017 .priority = NF_IP_PRI_SELINUX_FIRST,
6018 },
6019 {
6020 .hook = selinux_ipv4_output,
6021 .owner = THIS_MODULE,
6022 .pf = NFPROTO_IPV4,
6023 .hooknum = NF_INET_LOCAL_OUT,
6024 .priority = NF_IP_PRI_SELINUX_FIRST,
6025 }
6026 };
6027
6028 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6029
6030 static struct nf_hook_ops selinux_ipv6_ops[] = {
6031 {
6032 .hook = selinux_ipv6_postroute,
6033 .owner = THIS_MODULE,
6034 .pf = NFPROTO_IPV6,
6035 .hooknum = NF_INET_POST_ROUTING,
6036 .priority = NF_IP6_PRI_SELINUX_LAST,
6037 },
6038 {
6039 .hook = selinux_ipv6_forward,
6040 .owner = THIS_MODULE,
6041 .pf = NFPROTO_IPV6,
6042 .hooknum = NF_INET_FORWARD,
6043 .priority = NF_IP6_PRI_SELINUX_FIRST,
6044 }
6045 };
6046
6047 #endif /* IPV6 */
6048
6049 static int __init selinux_nf_ip_init(void)
6050 {
6051 int err = 0;
6052
6053 if (!selinux_enabled)
6054 goto out;
6055
6056 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6057
6058 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6059 if (err)
6060 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6061
6062 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6063 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6064 if (err)
6065 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6066 #endif /* IPV6 */
6067
6068 out:
6069 return err;
6070 }
6071
6072 __initcall(selinux_nf_ip_init);
6073
6074 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6075 static void selinux_nf_ip_exit(void)
6076 {
6077 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6078
6079 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6080 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6081 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6082 #endif /* IPV6 */
6083 }
6084 #endif
6085
6086 #else /* CONFIG_NETFILTER */
6087
6088 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6089 #define selinux_nf_ip_exit()
6090 #endif
6091
6092 #endif /* CONFIG_NETFILTER */
6093
6094 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6095 static int selinux_disabled;
6096
6097 int selinux_disable(void)
6098 {
6099 if (ss_initialized) {
6100 /* Not permitted after initial policy load. */
6101 return -EINVAL;
6102 }
6103
6104 if (selinux_disabled) {
6105 /* Only do this once. */
6106 return -EINVAL;
6107 }
6108
6109 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6110
6111 selinux_disabled = 1;
6112 selinux_enabled = 0;
6113
6114 reset_security_ops();
6115
6116 /* Try to destroy the avc node cache */
6117 avc_disable();
6118
6119 /* Unregister netfilter hooks. */
6120 selinux_nf_ip_exit();
6121
6122 /* Unregister selinuxfs. */
6123 exit_sel_fs();
6124
6125 return 0;
6126 }
6127 #endif
Linux kernel - Deliverables
This page took 0.158994 seconds and 5 git commands to generate.