projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/ptrace.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
70 #include <net/ipv6.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78
79 #include "avc.h"
80 #include "objsec.h"
81 #include "netif.h"
82 #include "netnode.h"
83 #include "netport.h"
84 #include "xfrm.h"
85 #include "netlabel.h"
86 #include "audit.h"
87
88 #define XATTR_SELINUX_SUFFIX "selinux"
89 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
90
91 #define NUM_SEL_MNT_OPTS 4
92
93 extern unsigned int policydb_loaded_version;
94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
95 extern int selinux_compat_net;
96 extern struct security_operations *security_ops;
97
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
103
104 static int __init enforcing_setup(char *str)
105 {
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
109 return 1;
110 }
111 __setup("enforcing=", enforcing_setup);
112 #endif
113
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117 static int __init selinux_enabled_setup(char *str)
118 {
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
122 return 1;
123 }
124 __setup("selinux=", selinux_enabled_setup);
125 #else
126 int selinux_enabled = 1;
127 #endif
128
129
130 /*
131 * Minimal support for a secondary security module,
132 * just to allow the use of the capability module.
133 */
134 static struct security_operations *secondary_ops;
135
136 /* Lists of inode and superblock security structures initialized
137 before the policy was loaded. */
138 static LIST_HEAD(superblock_security_head);
139 static DEFINE_SPINLOCK(sb_security_lock);
140
141 static struct kmem_cache *sel_inode_cache;
142
143 /**
144 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
145 *
146 * Description:
147 * This function checks the SECMARK reference counter to see if any SECMARK
148 * targets are currently configured, if the reference counter is greater than
149 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
150 * enabled, false (0) if SECMARK is disabled.
151 *
152 */
153 static int selinux_secmark_enabled(void)
154 {
155 return (atomic_read(&selinux_secmark_refcount) > 0);
156 }
157
158 /* Allocate and free functions for each kind of security blob. */
159
160 static int task_alloc_security(struct task_struct *task)
161 {
162 struct task_security_struct *tsec;
163
164 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
165 if (!tsec)
166 return -ENOMEM;
167
168 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
169 task->security = tsec;
170
171 return 0;
172 }
173
174 static void task_free_security(struct task_struct *task)
175 {
176 struct task_security_struct *tsec = task->security;
177 task->security = NULL;
178 kfree(tsec);
179 }
180
181 static int inode_alloc_security(struct inode *inode)
182 {
183 struct task_security_struct *tsec = current->security;
184 struct inode_security_struct *isec;
185
186 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
187 if (!isec)
188 return -ENOMEM;
189
190 mutex_init(&isec->lock);
191 INIT_LIST_HEAD(&isec->list);
192 isec->inode = inode;
193 isec->sid = SECINITSID_UNLABELED;
194 isec->sclass = SECCLASS_FILE;
195 isec->task_sid = tsec->sid;
196 inode->i_security = isec;
197
198 return 0;
199 }
200
201 static void inode_free_security(struct inode *inode)
202 {
203 struct inode_security_struct *isec = inode->i_security;
204 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
205
206 spin_lock(&sbsec->isec_lock);
207 if (!list_empty(&isec->list))
208 list_del_init(&isec->list);
209 spin_unlock(&sbsec->isec_lock);
210
211 inode->i_security = NULL;
212 kmem_cache_free(sel_inode_cache, isec);
213 }
214
215 static int file_alloc_security(struct file *file)
216 {
217 struct task_security_struct *tsec = current->security;
218 struct file_security_struct *fsec;
219
220 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
221 if (!fsec)
222 return -ENOMEM;
223
224 fsec->sid = tsec->sid;
225 fsec->fown_sid = tsec->sid;
226 file->f_security = fsec;
227
228 return 0;
229 }
230
231 static void file_free_security(struct file *file)
232 {
233 struct file_security_struct *fsec = file->f_security;
234 file->f_security = NULL;
235 kfree(fsec);
236 }
237
238 static int superblock_alloc_security(struct super_block *sb)
239 {
240 struct superblock_security_struct *sbsec;
241
242 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
243 if (!sbsec)
244 return -ENOMEM;
245
246 mutex_init(&sbsec->lock);
247 INIT_LIST_HEAD(&sbsec->list);
248 INIT_LIST_HEAD(&sbsec->isec_head);
249 spin_lock_init(&sbsec->isec_lock);
250 sbsec->sb = sb;
251 sbsec->sid = SECINITSID_UNLABELED;
252 sbsec->def_sid = SECINITSID_FILE;
253 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
254 sb->s_security = sbsec;
255
256 return 0;
257 }
258
259 static void superblock_free_security(struct super_block *sb)
260 {
261 struct superblock_security_struct *sbsec = sb->s_security;
262
263 spin_lock(&sb_security_lock);
264 if (!list_empty(&sbsec->list))
265 list_del_init(&sbsec->list);
266 spin_unlock(&sb_security_lock);
267
268 sb->s_security = NULL;
269 kfree(sbsec);
270 }
271
272 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
273 {
274 struct sk_security_struct *ssec;
275
276 ssec = kzalloc(sizeof(*ssec), priority);
277 if (!ssec)
278 return -ENOMEM;
279
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
283
284 selinux_netlbl_sk_security_reset(ssec, family);
285
286 return 0;
287 }
288
289 static void sk_free_security(struct sock *sk)
290 {
291 struct sk_security_struct *ssec = sk->sk_security;
292
293 sk->sk_security = NULL;
294 kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_error = -1,
321 Opt_context = 1,
322 Opt_fscontext = 2,
323 Opt_defcontext = 3,
324 Opt_rootcontext = 4,
325 };
326
327 static match_table_t tokens = {
328 {Opt_context, CONTEXT_STR "%s"},
329 {Opt_fscontext, FSCONTEXT_STR "%s"},
330 {Opt_defcontext, DEFCONTEXT_STR "%s"},
331 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
332 {Opt_error, NULL},
333 };
334
335 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
336
337 static int may_context_mount_sb_relabel(u32 sid,
338 struct superblock_security_struct *sbsec,
339 struct task_security_struct *tsec)
340 {
341 int rc;
342
343 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
344 FILESYSTEM__RELABELFROM, NULL);
345 if (rc)
346 return rc;
347
348 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
349 FILESYSTEM__RELABELTO, NULL);
350 return rc;
351 }
352
353 static int may_context_mount_inode_relabel(u32 sid,
354 struct superblock_security_struct *sbsec,
355 struct task_security_struct *tsec)
356 {
357 int rc;
358 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
359 FILESYSTEM__RELABELFROM, NULL);
360 if (rc)
361 return rc;
362
363 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
364 FILESYSTEM__ASSOCIATE, NULL);
365 return rc;
366 }
367
368 static int sb_finish_set_opts(struct super_block *sb)
369 {
370 struct superblock_security_struct *sbsec = sb->s_security;
371 struct dentry *root = sb->s_root;
372 struct inode *root_inode = root->d_inode;
373 int rc = 0;
374
375 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
376 /* Make sure that the xattr handler exists and that no
377 error other than -ENODATA is returned by getxattr on
378 the root directory. -ENODATA is ok, as this may be
379 the first boot of the SELinux kernel before we have
380 assigned xattr values to the filesystem. */
381 if (!root_inode->i_op->getxattr) {
382 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
383 "xattr support\n", sb->s_id, sb->s_type->name);
384 rc = -EOPNOTSUPP;
385 goto out;
386 }
387 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
388 if (rc < 0 && rc != -ENODATA) {
389 if (rc == -EOPNOTSUPP)
390 printk(KERN_WARNING "SELinux: (dev %s, type "
391 "%s) has no security xattr handler\n",
392 sb->s_id, sb->s_type->name);
393 else
394 printk(KERN_WARNING "SELinux: (dev %s, type "
395 "%s) getxattr errno %d\n", sb->s_id,
396 sb->s_type->name, -rc);
397 goto out;
398 }
399 }
400
401 sbsec->initialized = 1;
402
403 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
404 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
405 sb->s_id, sb->s_type->name);
406 else
407 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
408 sb->s_id, sb->s_type->name,
409 labeling_behaviors[sbsec->behavior-1]);
410
411 /* Initialize the root inode. */
412 rc = inode_doinit_with_dentry(root_inode, root);
413
414 /* Initialize any other inodes associated with the superblock, e.g.
415 inodes created prior to initial policy load or inodes created
416 during get_sb by a pseudo filesystem that directly
417 populates itself. */
418 spin_lock(&sbsec->isec_lock);
419 next_inode:
420 if (!list_empty(&sbsec->isec_head)) {
421 struct inode_security_struct *isec =
422 list_entry(sbsec->isec_head.next,
423 struct inode_security_struct, list);
424 struct inode *inode = isec->inode;
425 spin_unlock(&sbsec->isec_lock);
426 inode = igrab(inode);
427 if (inode) {
428 if (!IS_PRIVATE(inode))
429 inode_doinit(inode);
430 iput(inode);
431 }
432 spin_lock(&sbsec->isec_lock);
433 list_del_init(&isec->list);
434 goto next_inode;
435 }
436 spin_unlock(&sbsec->isec_lock);
437 out:
438 return rc;
439 }
440
441 /*
442 * This function should allow an FS to ask what it's mount security
443 * options were so it can use those later for submounts, displaying
444 * mount options, or whatever.
445 */
446 static int selinux_get_mnt_opts(const struct super_block *sb,
447 struct security_mnt_opts *opts)
448 {
449 int rc = 0, i;
450 struct superblock_security_struct *sbsec = sb->s_security;
451 char *context = NULL;
452 u32 len;
453 char tmp;
454
455 security_init_mnt_opts(opts);
456
457 if (!sbsec->initialized)
458 return -EINVAL;
459
460 if (!ss_initialized)
461 return -EINVAL;
462
463 /*
464 * if we ever use sbsec flags for anything other than tracking mount
465 * settings this is going to need a mask
466 */
467 tmp = sbsec->flags;
468 /* count the number of mount options for this sb */
469 for (i = 0; i < 8; i++) {
470 if (tmp & 0x01)
471 opts->num_mnt_opts++;
472 tmp >>= 1;
473 }
474
475 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
476 if (!opts->mnt_opts) {
477 rc = -ENOMEM;
478 goto out_free;
479 }
480
481 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
482 if (!opts->mnt_opts_flags) {
483 rc = -ENOMEM;
484 goto out_free;
485 }
486
487 i = 0;
488 if (sbsec->flags & FSCONTEXT_MNT) {
489 rc = security_sid_to_context(sbsec->sid, &context, &len);
490 if (rc)
491 goto out_free;
492 opts->mnt_opts[i] = context;
493 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
494 }
495 if (sbsec->flags & CONTEXT_MNT) {
496 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
497 if (rc)
498 goto out_free;
499 opts->mnt_opts[i] = context;
500 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
501 }
502 if (sbsec->flags & DEFCONTEXT_MNT) {
503 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
504 if (rc)
505 goto out_free;
506 opts->mnt_opts[i] = context;
507 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
508 }
509 if (sbsec->flags & ROOTCONTEXT_MNT) {
510 struct inode *root = sbsec->sb->s_root->d_inode;
511 struct inode_security_struct *isec = root->i_security;
512
513 rc = security_sid_to_context(isec->sid, &context, &len);
514 if (rc)
515 goto out_free;
516 opts->mnt_opts[i] = context;
517 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
518 }
519
520 BUG_ON(i != opts->num_mnt_opts);
521
522 return 0;
523
524 out_free:
525 security_free_mnt_opts(opts);
526 return rc;
527 }
528
529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
530 u32 old_sid, u32 new_sid)
531 {
532 /* check if the old mount command had the same options */
533 if (sbsec->initialized)
534 if (!(sbsec->flags & flag) ||
535 (old_sid != new_sid))
536 return 1;
537
538 /* check if we were passed the same options twice,
539 * aka someone passed context=a,context=b
540 */
541 if (!sbsec->initialized)
542 if (sbsec->flags & flag)
543 return 1;
544 return 0;
545 }
546
547 /*
548 * Allow filesystems with binary mount data to explicitly set mount point
549 * labeling information.
550 */
551 static int selinux_set_mnt_opts(struct super_block *sb,
552 struct security_mnt_opts *opts)
553 {
554 int rc = 0, i;
555 struct task_security_struct *tsec = current->security;
556 struct superblock_security_struct *sbsec = sb->s_security;
557 const char *name = sb->s_type->name;
558 struct inode *inode = sbsec->sb->s_root->d_inode;
559 struct inode_security_struct *root_isec = inode->i_security;
560 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
561 u32 defcontext_sid = 0;
562 char **mount_options = opts->mnt_opts;
563 int *flags = opts->mnt_opts_flags;
564 int num_opts = opts->num_mnt_opts;
565
566 mutex_lock(&sbsec->lock);
567
568 if (!ss_initialized) {
569 if (!num_opts) {
570 /* Defer initialization until selinux_complete_init,
571 after the initial policy is loaded and the security
572 server is ready to handle calls. */
573 spin_lock(&sb_security_lock);
574 if (list_empty(&sbsec->list))
575 list_add(&sbsec->list, &superblock_security_head);
576 spin_unlock(&sb_security_lock);
577 goto out;
578 }
579 rc = -EINVAL;
580 printk(KERN_WARNING "SELinux: Unable to set superblock options "
581 "before the security server is initialized\n");
582 goto out;
583 }
584
585 /*
586 * Binary mount data FS will come through this function twice. Once
587 * from an explicit call and once from the generic calls from the vfs.
588 * Since the generic VFS calls will not contain any security mount data
589 * we need to skip the double mount verification.
590 *
591 * This does open a hole in which we will not notice if the first
592 * mount using this sb set explict options and a second mount using
593 * this sb does not set any security options. (The first options
594 * will be used for both mounts)
595 */
596 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
597 && (num_opts == 0))
598 goto out;
599
600 /*
601 * parse the mount options, check if they are valid sids.
602 * also check if someone is trying to mount the same sb more
603 * than once with different security options.
604 */
605 for (i = 0; i < num_opts; i++) {
606 u32 sid;
607 rc = security_context_to_sid(mount_options[i],
608 strlen(mount_options[i]), &sid);
609 if (rc) {
610 printk(KERN_WARNING "SELinux: security_context_to_sid"
611 "(%s) failed for (dev %s, type %s) errno=%d\n",
612 mount_options[i], sb->s_id, name, rc);
613 goto out;
614 }
615 switch (flags[i]) {
616 case FSCONTEXT_MNT:
617 fscontext_sid = sid;
618
619 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
620 fscontext_sid))
621 goto out_double_mount;
622
623 sbsec->flags |= FSCONTEXT_MNT;
624 break;
625 case CONTEXT_MNT:
626 context_sid = sid;
627
628 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
629 context_sid))
630 goto out_double_mount;
631
632 sbsec->flags |= CONTEXT_MNT;
633 break;
634 case ROOTCONTEXT_MNT:
635 rootcontext_sid = sid;
636
637 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
638 rootcontext_sid))
639 goto out_double_mount;
640
641 sbsec->flags |= ROOTCONTEXT_MNT;
642
643 break;
644 case DEFCONTEXT_MNT:
645 defcontext_sid = sid;
646
647 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
648 defcontext_sid))
649 goto out_double_mount;
650
651 sbsec->flags |= DEFCONTEXT_MNT;
652
653 break;
654 default:
655 rc = -EINVAL;
656 goto out;
657 }
658 }
659
660 if (sbsec->initialized) {
661 /* previously mounted with options, but not on this attempt? */
662 if (sbsec->flags && !num_opts)
663 goto out_double_mount;
664 rc = 0;
665 goto out;
666 }
667
668 if (strcmp(sb->s_type->name, "proc") == 0)
669 sbsec->proc = 1;
670
671 /* Determine the labeling behavior to use for this filesystem type. */
672 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
673 if (rc) {
674 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
675 __func__, sb->s_type->name, rc);
676 goto out;
677 }
678
679 /* sets the context of the superblock for the fs being mounted. */
680 if (fscontext_sid) {
681
682 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
683 if (rc)
684 goto out;
685
686 sbsec->sid = fscontext_sid;
687 }
688
689 /*
690 * Switch to using mount point labeling behavior.
691 * sets the label used on all file below the mountpoint, and will set
692 * the superblock context if not already set.
693 */
694 if (context_sid) {
695 if (!fscontext_sid) {
696 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
697 if (rc)
698 goto out;
699 sbsec->sid = context_sid;
700 } else {
701 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
702 if (rc)
703 goto out;
704 }
705 if (!rootcontext_sid)
706 rootcontext_sid = context_sid;
707
708 sbsec->mntpoint_sid = context_sid;
709 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
710 }
711
712 if (rootcontext_sid) {
713 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
714 if (rc)
715 goto out;
716
717 root_isec->sid = rootcontext_sid;
718 root_isec->initialized = 1;
719 }
720
721 if (defcontext_sid) {
722 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
723 rc = -EINVAL;
724 printk(KERN_WARNING "SELinux: defcontext option is "
725 "invalid for this filesystem type\n");
726 goto out;
727 }
728
729 if (defcontext_sid != sbsec->def_sid) {
730 rc = may_context_mount_inode_relabel(defcontext_sid,
731 sbsec, tsec);
732 if (rc)
733 goto out;
734 }
735
736 sbsec->def_sid = defcontext_sid;
737 }
738
739 rc = sb_finish_set_opts(sb);
740 out:
741 mutex_unlock(&sbsec->lock);
742 return rc;
743 out_double_mount:
744 rc = -EINVAL;
745 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
746 "security settings for (dev %s, type %s)\n", sb->s_id, name);
747 goto out;
748 }
749
750 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
751 struct super_block *newsb)
752 {
753 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
754 struct superblock_security_struct *newsbsec = newsb->s_security;
755
756 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
757 int set_context = (oldsbsec->flags & CONTEXT_MNT);
758 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
759
760 /*
761 * if the parent was able to be mounted it clearly had no special lsm
762 * mount options. thus we can safely put this sb on the list and deal
763 * with it later
764 */
765 if (!ss_initialized) {
766 spin_lock(&sb_security_lock);
767 if (list_empty(&newsbsec->list))
768 list_add(&newsbsec->list, &superblock_security_head);
769 spin_unlock(&sb_security_lock);
770 return;
771 }
772
773 /* how can we clone if the old one wasn't set up?? */
774 BUG_ON(!oldsbsec->initialized);
775
776 /* if fs is reusing a sb, just let its options stand... */
777 if (newsbsec->initialized)
778 return;
779
780 mutex_lock(&newsbsec->lock);
781
782 newsbsec->flags = oldsbsec->flags;
783
784 newsbsec->sid = oldsbsec->sid;
785 newsbsec->def_sid = oldsbsec->def_sid;
786 newsbsec->behavior = oldsbsec->behavior;
787
788 if (set_context) {
789 u32 sid = oldsbsec->mntpoint_sid;
790
791 if (!set_fscontext)
792 newsbsec->sid = sid;
793 if (!set_rootcontext) {
794 struct inode *newinode = newsb->s_root->d_inode;
795 struct inode_security_struct *newisec = newinode->i_security;
796 newisec->sid = sid;
797 }
798 newsbsec->mntpoint_sid = sid;
799 }
800 if (set_rootcontext) {
801 const struct inode *oldinode = oldsb->s_root->d_inode;
802 const struct inode_security_struct *oldisec = oldinode->i_security;
803 struct inode *newinode = newsb->s_root->d_inode;
804 struct inode_security_struct *newisec = newinode->i_security;
805
806 newisec->sid = oldisec->sid;
807 }
808
809 sb_finish_set_opts(newsb);
810 mutex_unlock(&newsbsec->lock);
811 }
812
813 static int selinux_parse_opts_str(char *options,
814 struct security_mnt_opts *opts)
815 {
816 char *p;
817 char *context = NULL, *defcontext = NULL;
818 char *fscontext = NULL, *rootcontext = NULL;
819 int rc, num_mnt_opts = 0;
820
821 opts->num_mnt_opts = 0;
822
823 /* Standard string-based options. */
824 while ((p = strsep(&options, "|")) != NULL) {
825 int token;
826 substring_t args[MAX_OPT_ARGS];
827
828 if (!*p)
829 continue;
830
831 token = match_token(p, tokens, args);
832
833 switch (token) {
834 case Opt_context:
835 if (context || defcontext) {
836 rc = -EINVAL;
837 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
838 goto out_err;
839 }
840 context = match_strdup(&args[0]);
841 if (!context) {
842 rc = -ENOMEM;
843 goto out_err;
844 }
845 break;
846
847 case Opt_fscontext:
848 if (fscontext) {
849 rc = -EINVAL;
850 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
851 goto out_err;
852 }
853 fscontext = match_strdup(&args[0]);
854 if (!fscontext) {
855 rc = -ENOMEM;
856 goto out_err;
857 }
858 break;
859
860 case Opt_rootcontext:
861 if (rootcontext) {
862 rc = -EINVAL;
863 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
864 goto out_err;
865 }
866 rootcontext = match_strdup(&args[0]);
867 if (!rootcontext) {
868 rc = -ENOMEM;
869 goto out_err;
870 }
871 break;
872
873 case Opt_defcontext:
874 if (context || defcontext) {
875 rc = -EINVAL;
876 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
877 goto out_err;
878 }
879 defcontext = match_strdup(&args[0]);
880 if (!defcontext) {
881 rc = -ENOMEM;
882 goto out_err;
883 }
884 break;
885
886 default:
887 rc = -EINVAL;
888 printk(KERN_WARNING "SELinux: unknown mount option\n");
889 goto out_err;
890
891 }
892 }
893
894 rc = -ENOMEM;
895 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
896 if (!opts->mnt_opts)
897 goto out_err;
898
899 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
900 if (!opts->mnt_opts_flags) {
901 kfree(opts->mnt_opts);
902 goto out_err;
903 }
904
905 if (fscontext) {
906 opts->mnt_opts[num_mnt_opts] = fscontext;
907 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
908 }
909 if (context) {
910 opts->mnt_opts[num_mnt_opts] = context;
911 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
912 }
913 if (rootcontext) {
914 opts->mnt_opts[num_mnt_opts] = rootcontext;
915 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
916 }
917 if (defcontext) {
918 opts->mnt_opts[num_mnt_opts] = defcontext;
919 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
920 }
921
922 opts->num_mnt_opts = num_mnt_opts;
923 return 0;
924
925 out_err:
926 kfree(context);
927 kfree(defcontext);
928 kfree(fscontext);
929 kfree(rootcontext);
930 return rc;
931 }
932 /*
933 * string mount options parsing and call set the sbsec
934 */
935 static int superblock_doinit(struct super_block *sb, void *data)
936 {
937 int rc = 0;
938 char *options = data;
939 struct security_mnt_opts opts;
940
941 security_init_mnt_opts(&opts);
942
943 if (!data)
944 goto out;
945
946 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
947
948 rc = selinux_parse_opts_str(options, &opts);
949 if (rc)
950 goto out_err;
951
952 out:
953 rc = selinux_set_mnt_opts(sb, &opts);
954
955 out_err:
956 security_free_mnt_opts(&opts);
957 return rc;
958 }
959
960 void selinux_write_opts(struct seq_file *m, struct security_mnt_opts *opts)
961 {
962 int i;
963 char *prefix;
964
965 for (i = 0; i < opts->num_mnt_opts; i++) {
966 char *has_comma = strchr(opts->mnt_opts[i], ',');
967
968 switch (opts->mnt_opts_flags[i]) {
969 case CONTEXT_MNT:
970 prefix = CONTEXT_STR;
971 break;
972 case FSCONTEXT_MNT:
973 prefix = FSCONTEXT_STR;
974 break;
975 case ROOTCONTEXT_MNT:
976 prefix = ROOTCONTEXT_STR;
977 break;
978 case DEFCONTEXT_MNT:
979 prefix = DEFCONTEXT_STR;
980 break;
981 default:
982 BUG();
983 };
984 /* we need a comma before each option */
985 seq_putc(m, ',');
986 seq_puts(m, prefix);
987 if (has_comma)
988 seq_putc(m, '\"');
989 seq_puts(m, opts->mnt_opts[i]);
990 if (has_comma)
991 seq_putc(m, '\"');
992 }
993 }
994
995 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
996 {
997 struct security_mnt_opts opts;
998 int rc;
999
1000 rc = selinux_get_mnt_opts(sb, &opts);
1001 if (rc)
1002 return rc;
1003
1004 selinux_write_opts(m, &opts);
1005
1006 security_free_mnt_opts(&opts);
1007
1008 return rc;
1009 }
1010
1011 static inline u16 inode_mode_to_security_class(umode_t mode)
1012 {
1013 switch (mode & S_IFMT) {
1014 case S_IFSOCK:
1015 return SECCLASS_SOCK_FILE;
1016 case S_IFLNK:
1017 return SECCLASS_LNK_FILE;
1018 case S_IFREG:
1019 return SECCLASS_FILE;
1020 case S_IFBLK:
1021 return SECCLASS_BLK_FILE;
1022 case S_IFDIR:
1023 return SECCLASS_DIR;
1024 case S_IFCHR:
1025 return SECCLASS_CHR_FILE;
1026 case S_IFIFO:
1027 return SECCLASS_FIFO_FILE;
1028
1029 }
1030
1031 return SECCLASS_FILE;
1032 }
1033
1034 static inline int default_protocol_stream(int protocol)
1035 {
1036 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1037 }
1038
1039 static inline int default_protocol_dgram(int protocol)
1040 {
1041 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1042 }
1043
1044 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1045 {
1046 switch (family) {
1047 case PF_UNIX:
1048 switch (type) {
1049 case SOCK_STREAM:
1050 case SOCK_SEQPACKET:
1051 return SECCLASS_UNIX_STREAM_SOCKET;
1052 case SOCK_DGRAM:
1053 return SECCLASS_UNIX_DGRAM_SOCKET;
1054 }
1055 break;
1056 case PF_INET:
1057 case PF_INET6:
1058 switch (type) {
1059 case SOCK_STREAM:
1060 if (default_protocol_stream(protocol))
1061 return SECCLASS_TCP_SOCKET;
1062 else
1063 return SECCLASS_RAWIP_SOCKET;
1064 case SOCK_DGRAM:
1065 if (default_protocol_dgram(protocol))
1066 return SECCLASS_UDP_SOCKET;
1067 else
1068 return SECCLASS_RAWIP_SOCKET;
1069 case SOCK_DCCP:
1070 return SECCLASS_DCCP_SOCKET;
1071 default:
1072 return SECCLASS_RAWIP_SOCKET;
1073 }
1074 break;
1075 case PF_NETLINK:
1076 switch (protocol) {
1077 case NETLINK_ROUTE:
1078 return SECCLASS_NETLINK_ROUTE_SOCKET;
1079 case NETLINK_FIREWALL:
1080 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1081 case NETLINK_INET_DIAG:
1082 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1083 case NETLINK_NFLOG:
1084 return SECCLASS_NETLINK_NFLOG_SOCKET;
1085 case NETLINK_XFRM:
1086 return SECCLASS_NETLINK_XFRM_SOCKET;
1087 case NETLINK_SELINUX:
1088 return SECCLASS_NETLINK_SELINUX_SOCKET;
1089 case NETLINK_AUDIT:
1090 return SECCLASS_NETLINK_AUDIT_SOCKET;
1091 case NETLINK_IP6_FW:
1092 return SECCLASS_NETLINK_IP6FW_SOCKET;
1093 case NETLINK_DNRTMSG:
1094 return SECCLASS_NETLINK_DNRT_SOCKET;
1095 case NETLINK_KOBJECT_UEVENT:
1096 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1097 default:
1098 return SECCLASS_NETLINK_SOCKET;
1099 }
1100 case PF_PACKET:
1101 return SECCLASS_PACKET_SOCKET;
1102 case PF_KEY:
1103 return SECCLASS_KEY_SOCKET;
1104 case PF_APPLETALK:
1105 return SECCLASS_APPLETALK_SOCKET;
1106 }
1107
1108 return SECCLASS_SOCKET;
1109 }
1110
1111 #ifdef CONFIG_PROC_FS
1112 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1113 u16 tclass,
1114 u32 *sid)
1115 {
1116 int buflen, rc;
1117 char *buffer, *path, *end;
1118
1119 buffer = (char *)__get_free_page(GFP_KERNEL);
1120 if (!buffer)
1121 return -ENOMEM;
1122
1123 buflen = PAGE_SIZE;
1124 end = buffer+buflen;
1125 *--end = '\0';
1126 buflen--;
1127 path = end-1;
1128 *path = '/';
1129 while (de && de != de->parent) {
1130 buflen -= de->namelen + 1;
1131 if (buflen < 0)
1132 break;
1133 end -= de->namelen;
1134 memcpy(end, de->name, de->namelen);
1135 *--end = '/';
1136 path = end;
1137 de = de->parent;
1138 }
1139 rc = security_genfs_sid("proc", path, tclass, sid);
1140 free_page((unsigned long)buffer);
1141 return rc;
1142 }
1143 #else
1144 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1145 u16 tclass,
1146 u32 *sid)
1147 {
1148 return -EINVAL;
1149 }
1150 #endif
1151
1152 /* The inode's security attributes must be initialized before first use. */
1153 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1154 {
1155 struct superblock_security_struct *sbsec = NULL;
1156 struct inode_security_struct *isec = inode->i_security;
1157 u32 sid;
1158 struct dentry *dentry;
1159 #define INITCONTEXTLEN 255
1160 char *context = NULL;
1161 unsigned len = 0;
1162 int rc = 0;
1163
1164 if (isec->initialized)
1165 goto out;
1166
1167 mutex_lock(&isec->lock);
1168 if (isec->initialized)
1169 goto out_unlock;
1170
1171 sbsec = inode->i_sb->s_security;
1172 if (!sbsec->initialized) {
1173 /* Defer initialization until selinux_complete_init,
1174 after the initial policy is loaded and the security
1175 server is ready to handle calls. */
1176 spin_lock(&sbsec->isec_lock);
1177 if (list_empty(&isec->list))
1178 list_add(&isec->list, &sbsec->isec_head);
1179 spin_unlock(&sbsec->isec_lock);
1180 goto out_unlock;
1181 }
1182
1183 switch (sbsec->behavior) {
1184 case SECURITY_FS_USE_XATTR:
1185 if (!inode->i_op->getxattr) {
1186 isec->sid = sbsec->def_sid;
1187 break;
1188 }
1189
1190 /* Need a dentry, since the xattr API requires one.
1191 Life would be simpler if we could just pass the inode. */
1192 if (opt_dentry) {
1193 /* Called from d_instantiate or d_splice_alias. */
1194 dentry = dget(opt_dentry);
1195 } else {
1196 /* Called from selinux_complete_init, try to find a dentry. */
1197 dentry = d_find_alias(inode);
1198 }
1199 if (!dentry) {
1200 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
1201 "ino=%ld\n", __func__, inode->i_sb->s_id,
1202 inode->i_ino);
1203 goto out_unlock;
1204 }
1205
1206 len = INITCONTEXTLEN;
1207 context = kmalloc(len, GFP_NOFS);
1208 if (!context) {
1209 rc = -ENOMEM;
1210 dput(dentry);
1211 goto out_unlock;
1212 }
1213 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1214 context, len);
1215 if (rc == -ERANGE) {
1216 /* Need a larger buffer. Query for the right size. */
1217 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1218 NULL, 0);
1219 if (rc < 0) {
1220 dput(dentry);
1221 goto out_unlock;
1222 }
1223 kfree(context);
1224 len = rc;
1225 context = kmalloc(len, GFP_NOFS);
1226 if (!context) {
1227 rc = -ENOMEM;
1228 dput(dentry);
1229 goto out_unlock;
1230 }
1231 rc = inode->i_op->getxattr(dentry,
1232 XATTR_NAME_SELINUX,
1233 context, len);
1234 }
1235 dput(dentry);
1236 if (rc < 0) {
1237 if (rc != -ENODATA) {
1238 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1239 "%d for dev=%s ino=%ld\n", __func__,
1240 -rc, inode->i_sb->s_id, inode->i_ino);
1241 kfree(context);
1242 goto out_unlock;
1243 }
1244 /* Map ENODATA to the default file SID */
1245 sid = sbsec->def_sid;
1246 rc = 0;
1247 } else {
1248 rc = security_context_to_sid_default(context, rc, &sid,
1249 sbsec->def_sid,
1250 GFP_NOFS);
1251 if (rc) {
1252 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1253 "returned %d for dev=%s ino=%ld\n",
1254 __func__, context, -rc,
1255 inode->i_sb->s_id, inode->i_ino);
1256 kfree(context);
1257 /* Leave with the unlabeled SID */
1258 rc = 0;
1259 break;
1260 }
1261 }
1262 kfree(context);
1263 isec->sid = sid;
1264 break;
1265 case SECURITY_FS_USE_TASK:
1266 isec->sid = isec->task_sid;
1267 break;
1268 case SECURITY_FS_USE_TRANS:
1269 /* Default to the fs SID. */
1270 isec->sid = sbsec->sid;
1271
1272 /* Try to obtain a transition SID. */
1273 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1274 rc = security_transition_sid(isec->task_sid,
1275 sbsec->sid,
1276 isec->sclass,
1277 &sid);
1278 if (rc)
1279 goto out_unlock;
1280 isec->sid = sid;
1281 break;
1282 case SECURITY_FS_USE_MNTPOINT:
1283 isec->sid = sbsec->mntpoint_sid;
1284 break;
1285 default:
1286 /* Default to the fs superblock SID. */
1287 isec->sid = sbsec->sid;
1288
1289 if (sbsec->proc) {
1290 struct proc_inode *proci = PROC_I(inode);
1291 if (proci->pde) {
1292 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1293 rc = selinux_proc_get_sid(proci->pde,
1294 isec->sclass,
1295 &sid);
1296 if (rc)
1297 goto out_unlock;
1298 isec->sid = sid;
1299 }
1300 }
1301 break;
1302 }
1303
1304 isec->initialized = 1;
1305
1306 out_unlock:
1307 mutex_unlock(&isec->lock);
1308 out:
1309 if (isec->sclass == SECCLASS_FILE)
1310 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1311 return rc;
1312 }
1313
1314 /* Convert a Linux signal to an access vector. */
1315 static inline u32 signal_to_av(int sig)
1316 {
1317 u32 perm = 0;
1318
1319 switch (sig) {
1320 case SIGCHLD:
1321 /* Commonly granted from child to parent. */
1322 perm = PROCESS__SIGCHLD;
1323 break;
1324 case SIGKILL:
1325 /* Cannot be caught or ignored */
1326 perm = PROCESS__SIGKILL;
1327 break;
1328 case SIGSTOP:
1329 /* Cannot be caught or ignored */
1330 perm = PROCESS__SIGSTOP;
1331 break;
1332 default:
1333 /* All other signals. */
1334 perm = PROCESS__SIGNAL;
1335 break;
1336 }
1337
1338 return perm;
1339 }
1340
1341 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1342 fork check, ptrace check, etc. */
1343 static int task_has_perm(struct task_struct *tsk1,
1344 struct task_struct *tsk2,
1345 u32 perms)
1346 {
1347 struct task_security_struct *tsec1, *tsec2;
1348
1349 tsec1 = tsk1->security;
1350 tsec2 = tsk2->security;
1351 return avc_has_perm(tsec1->sid, tsec2->sid,
1352 SECCLASS_PROCESS, perms, NULL);
1353 }
1354
1355 #if CAP_LAST_CAP > 63
1356 #error Fix SELinux to handle capabilities > 63.
1357 #endif
1358
1359 /* Check whether a task is allowed to use a capability. */
1360 static int task_has_capability(struct task_struct *tsk,
1361 int cap)
1362 {
1363 struct task_security_struct *tsec;
1364 struct avc_audit_data ad;
1365 u16 sclass;
1366 u32 av = CAP_TO_MASK(cap);
1367
1368 tsec = tsk->security;
1369
1370 AVC_AUDIT_DATA_INIT(&ad, CAP);
1371 ad.tsk = tsk;
1372 ad.u.cap = cap;
1373
1374 switch (CAP_TO_INDEX(cap)) {
1375 case 0:
1376 sclass = SECCLASS_CAPABILITY;
1377 break;
1378 case 1:
1379 sclass = SECCLASS_CAPABILITY2;
1380 break;
1381 default:
1382 printk(KERN_ERR
1383 "SELinux: out of range capability %d\n", cap);
1384 BUG();
1385 }
1386 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1387 }
1388
1389 /* Check whether a task is allowed to use a system operation. */
1390 static int task_has_system(struct task_struct *tsk,
1391 u32 perms)
1392 {
1393 struct task_security_struct *tsec;
1394
1395 tsec = tsk->security;
1396
1397 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1398 SECCLASS_SYSTEM, perms, NULL);
1399 }
1400
1401 /* Check whether a task has a particular permission to an inode.
1402 The 'adp' parameter is optional and allows other audit
1403 data to be passed (e.g. the dentry). */
1404 static int inode_has_perm(struct task_struct *tsk,
1405 struct inode *inode,
1406 u32 perms,
1407 struct avc_audit_data *adp)
1408 {
1409 struct task_security_struct *tsec;
1410 struct inode_security_struct *isec;
1411 struct avc_audit_data ad;
1412
1413 if (unlikely(IS_PRIVATE(inode)))
1414 return 0;
1415
1416 tsec = tsk->security;
1417 isec = inode->i_security;
1418
1419 if (!adp) {
1420 adp = &ad;
1421 AVC_AUDIT_DATA_INIT(&ad, FS);
1422 ad.u.fs.inode = inode;
1423 }
1424
1425 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1426 }
1427
1428 /* Same as inode_has_perm, but pass explicit audit data containing
1429 the dentry to help the auditing code to more easily generate the
1430 pathname if needed. */
1431 static inline int dentry_has_perm(struct task_struct *tsk,
1432 struct vfsmount *mnt,
1433 struct dentry *dentry,
1434 u32 av)
1435 {
1436 struct inode *inode = dentry->d_inode;
1437 struct avc_audit_data ad;
1438 AVC_AUDIT_DATA_INIT(&ad, FS);
1439 ad.u.fs.path.mnt = mnt;
1440 ad.u.fs.path.dentry = dentry;
1441 return inode_has_perm(tsk, inode, av, &ad);
1442 }
1443
1444 /* Check whether a task can use an open file descriptor to
1445 access an inode in a given way. Check access to the
1446 descriptor itself, and then use dentry_has_perm to
1447 check a particular permission to the file.
1448 Access to the descriptor is implicitly granted if it
1449 has the same SID as the process. If av is zero, then
1450 access to the file is not checked, e.g. for cases
1451 where only the descriptor is affected like seek. */
1452 static int file_has_perm(struct task_struct *tsk,
1453 struct file *file,
1454 u32 av)
1455 {
1456 struct task_security_struct *tsec = tsk->security;
1457 struct file_security_struct *fsec = file->f_security;
1458 struct inode *inode = file->f_path.dentry->d_inode;
1459 struct avc_audit_data ad;
1460 int rc;
1461
1462 AVC_AUDIT_DATA_INIT(&ad, FS);
1463 ad.u.fs.path = file->f_path;
1464
1465 if (tsec->sid != fsec->sid) {
1466 rc = avc_has_perm(tsec->sid, fsec->sid,
1467 SECCLASS_FD,
1468 FD__USE,
1469 &ad);
1470 if (rc)
1471 return rc;
1472 }
1473
1474 /* av is zero if only checking access to the descriptor. */
1475 if (av)
1476 return inode_has_perm(tsk, inode, av, &ad);
1477
1478 return 0;
1479 }
1480
1481 /* Check whether a task can create a file. */
1482 static int may_create(struct inode *dir,
1483 struct dentry *dentry,
1484 u16 tclass)
1485 {
1486 struct task_security_struct *tsec;
1487 struct inode_security_struct *dsec;
1488 struct superblock_security_struct *sbsec;
1489 u32 newsid;
1490 struct avc_audit_data ad;
1491 int rc;
1492
1493 tsec = current->security;
1494 dsec = dir->i_security;
1495 sbsec = dir->i_sb->s_security;
1496
1497 AVC_AUDIT_DATA_INIT(&ad, FS);
1498 ad.u.fs.path.dentry = dentry;
1499
1500 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1501 DIR__ADD_NAME | DIR__SEARCH,
1502 &ad);
1503 if (rc)
1504 return rc;
1505
1506 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1507 newsid = tsec->create_sid;
1508 } else {
1509 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1510 &newsid);
1511 if (rc)
1512 return rc;
1513 }
1514
1515 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1516 if (rc)
1517 return rc;
1518
1519 return avc_has_perm(newsid, sbsec->sid,
1520 SECCLASS_FILESYSTEM,
1521 FILESYSTEM__ASSOCIATE, &ad);
1522 }
1523
1524 /* Check whether a task can create a key. */
1525 static int may_create_key(u32 ksid,
1526 struct task_struct *ctx)
1527 {
1528 struct task_security_struct *tsec;
1529
1530 tsec = ctx->security;
1531
1532 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1533 }
1534
1535 #define MAY_LINK 0
1536 #define MAY_UNLINK 1
1537 #define MAY_RMDIR 2
1538
1539 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1540 static int may_link(struct inode *dir,
1541 struct dentry *dentry,
1542 int kind)
1543
1544 {
1545 struct task_security_struct *tsec;
1546 struct inode_security_struct *dsec, *isec;
1547 struct avc_audit_data ad;
1548 u32 av;
1549 int rc;
1550
1551 tsec = current->security;
1552 dsec = dir->i_security;
1553 isec = dentry->d_inode->i_security;
1554
1555 AVC_AUDIT_DATA_INIT(&ad, FS);
1556 ad.u.fs.path.dentry = dentry;
1557
1558 av = DIR__SEARCH;
1559 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1560 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1561 if (rc)
1562 return rc;
1563
1564 switch (kind) {
1565 case MAY_LINK:
1566 av = FILE__LINK;
1567 break;
1568 case MAY_UNLINK:
1569 av = FILE__UNLINK;
1570 break;
1571 case MAY_RMDIR:
1572 av = DIR__RMDIR;
1573 break;
1574 default:
1575 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1576 __func__, kind);
1577 return 0;
1578 }
1579
1580 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1581 return rc;
1582 }
1583
1584 static inline int may_rename(struct inode *old_dir,
1585 struct dentry *old_dentry,
1586 struct inode *new_dir,
1587 struct dentry *new_dentry)
1588 {
1589 struct task_security_struct *tsec;
1590 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1591 struct avc_audit_data ad;
1592 u32 av;
1593 int old_is_dir, new_is_dir;
1594 int rc;
1595
1596 tsec = current->security;
1597 old_dsec = old_dir->i_security;
1598 old_isec = old_dentry->d_inode->i_security;
1599 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1600 new_dsec = new_dir->i_security;
1601
1602 AVC_AUDIT_DATA_INIT(&ad, FS);
1603
1604 ad.u.fs.path.dentry = old_dentry;
1605 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1606 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1607 if (rc)
1608 return rc;
1609 rc = avc_has_perm(tsec->sid, old_isec->sid,
1610 old_isec->sclass, FILE__RENAME, &ad);
1611 if (rc)
1612 return rc;
1613 if (old_is_dir && new_dir != old_dir) {
1614 rc = avc_has_perm(tsec->sid, old_isec->sid,
1615 old_isec->sclass, DIR__REPARENT, &ad);
1616 if (rc)
1617 return rc;
1618 }
1619
1620 ad.u.fs.path.dentry = new_dentry;
1621 av = DIR__ADD_NAME | DIR__SEARCH;
1622 if (new_dentry->d_inode)
1623 av |= DIR__REMOVE_NAME;
1624 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1625 if (rc)
1626 return rc;
1627 if (new_dentry->d_inode) {
1628 new_isec = new_dentry->d_inode->i_security;
1629 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1630 rc = avc_has_perm(tsec->sid, new_isec->sid,
1631 new_isec->sclass,
1632 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1633 if (rc)
1634 return rc;
1635 }
1636
1637 return 0;
1638 }
1639
1640 /* Check whether a task can perform a filesystem operation. */
1641 static int superblock_has_perm(struct task_struct *tsk,
1642 struct super_block *sb,
1643 u32 perms,
1644 struct avc_audit_data *ad)
1645 {
1646 struct task_security_struct *tsec;
1647 struct superblock_security_struct *sbsec;
1648
1649 tsec = tsk->security;
1650 sbsec = sb->s_security;
1651 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1652 perms, ad);
1653 }
1654
1655 /* Convert a Linux mode and permission mask to an access vector. */
1656 static inline u32 file_mask_to_av(int mode, int mask)
1657 {
1658 u32 av = 0;
1659
1660 if ((mode & S_IFMT) != S_IFDIR) {
1661 if (mask & MAY_EXEC)
1662 av |= FILE__EXECUTE;
1663 if (mask & MAY_READ)
1664 av |= FILE__READ;
1665
1666 if (mask & MAY_APPEND)
1667 av |= FILE__APPEND;
1668 else if (mask & MAY_WRITE)
1669 av |= FILE__WRITE;
1670
1671 } else {
1672 if (mask & MAY_EXEC)
1673 av |= DIR__SEARCH;
1674 if (mask & MAY_WRITE)
1675 av |= DIR__WRITE;
1676 if (mask & MAY_READ)
1677 av |= DIR__READ;
1678 }
1679
1680 return av;
1681 }
1682
1683 /*
1684 * Convert a file mask to an access vector and include the correct open
1685 * open permission.
1686 */
1687 static inline u32 open_file_mask_to_av(int mode, int mask)
1688 {
1689 u32 av = file_mask_to_av(mode, mask);
1690
1691 if (selinux_policycap_openperm) {
1692 /*
1693 * lnk files and socks do not really have an 'open'
1694 */
1695 if (S_ISREG(mode))
1696 av |= FILE__OPEN;
1697 else if (S_ISCHR(mode))
1698 av |= CHR_FILE__OPEN;
1699 else if (S_ISBLK(mode))
1700 av |= BLK_FILE__OPEN;
1701 else if (S_ISFIFO(mode))
1702 av |= FIFO_FILE__OPEN;
1703 else if (S_ISDIR(mode))
1704 av |= DIR__OPEN;
1705 else
1706 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1707 "unknown mode:%x\n", __func__, mode);
1708 }
1709 return av;
1710 }
1711
1712 /* Convert a Linux file to an access vector. */
1713 static inline u32 file_to_av(struct file *file)
1714 {
1715 u32 av = 0;
1716
1717 if (file->f_mode & FMODE_READ)
1718 av |= FILE__READ;
1719 if (file->f_mode & FMODE_WRITE) {
1720 if (file->f_flags & O_APPEND)
1721 av |= FILE__APPEND;
1722 else
1723 av |= FILE__WRITE;
1724 }
1725 if (!av) {
1726 /*
1727 * Special file opened with flags 3 for ioctl-only use.
1728 */
1729 av = FILE__IOCTL;
1730 }
1731
1732 return av;
1733 }
1734
1735 /* Hook functions begin here. */
1736
1737 static int selinux_ptrace(struct task_struct *parent,
1738 struct task_struct *child,
1739 unsigned int mode)
1740 {
1741 int rc;
1742
1743 rc = secondary_ops->ptrace(parent, child, mode);
1744 if (rc)
1745 return rc;
1746
1747 if (mode == PTRACE_MODE_READ) {
1748 struct task_security_struct *tsec = parent->security;
1749 struct task_security_struct *csec = child->security;
1750 return avc_has_perm(tsec->sid, csec->sid,
1751 SECCLASS_FILE, FILE__READ, NULL);
1752 }
1753
1754 return task_has_perm(parent, child, PROCESS__PTRACE);
1755 }
1756
1757 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1758 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1759 {
1760 int error;
1761
1762 error = task_has_perm(current, target, PROCESS__GETCAP);
1763 if (error)
1764 return error;
1765
1766 return secondary_ops->capget(target, effective, inheritable, permitted);
1767 }
1768
1769 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1770 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1771 {
1772 int error;
1773
1774 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1775 if (error)
1776 return error;
1777
1778 return task_has_perm(current, target, PROCESS__SETCAP);
1779 }
1780
1781 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1782 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1783 {
1784 secondary_ops->capset_set(target, effective, inheritable, permitted);
1785 }
1786
1787 static int selinux_capable(struct task_struct *tsk, int cap)
1788 {
1789 int rc;
1790
1791 rc = secondary_ops->capable(tsk, cap);
1792 if (rc)
1793 return rc;
1794
1795 return task_has_capability(tsk, cap);
1796 }
1797
1798 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1799 {
1800 int buflen, rc;
1801 char *buffer, *path, *end;
1802
1803 rc = -ENOMEM;
1804 buffer = (char *)__get_free_page(GFP_KERNEL);
1805 if (!buffer)
1806 goto out;
1807
1808 buflen = PAGE_SIZE;
1809 end = buffer+buflen;
1810 *--end = '\0';
1811 buflen--;
1812 path = end-1;
1813 *path = '/';
1814 while (table) {
1815 const char *name = table->procname;
1816 size_t namelen = strlen(name);
1817 buflen -= namelen + 1;
1818 if (buflen < 0)
1819 goto out_free;
1820 end -= namelen;
1821 memcpy(end, name, namelen);
1822 *--end = '/';
1823 path = end;
1824 table = table->parent;
1825 }
1826 buflen -= 4;
1827 if (buflen < 0)
1828 goto out_free;
1829 end -= 4;
1830 memcpy(end, "/sys", 4);
1831 path = end;
1832 rc = security_genfs_sid("proc", path, tclass, sid);
1833 out_free:
1834 free_page((unsigned long)buffer);
1835 out:
1836 return rc;
1837 }
1838
1839 static int selinux_sysctl(ctl_table *table, int op)
1840 {
1841 int error = 0;
1842 u32 av;
1843 struct task_security_struct *tsec;
1844 u32 tsid;
1845 int rc;
1846
1847 rc = secondary_ops->sysctl(table, op);
1848 if (rc)
1849 return rc;
1850
1851 tsec = current->security;
1852
1853 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1854 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1855 if (rc) {
1856 /* Default to the well-defined sysctl SID. */
1857 tsid = SECINITSID_SYSCTL;
1858 }
1859
1860 /* The op values are "defined" in sysctl.c, thereby creating
1861 * a bad coupling between this module and sysctl.c */
1862 if (op == 001) {
1863 error = avc_has_perm(tsec->sid, tsid,
1864 SECCLASS_DIR, DIR__SEARCH, NULL);
1865 } else {
1866 av = 0;
1867 if (op & 004)
1868 av |= FILE__READ;
1869 if (op & 002)
1870 av |= FILE__WRITE;
1871 if (av)
1872 error = avc_has_perm(tsec->sid, tsid,
1873 SECCLASS_FILE, av, NULL);
1874 }
1875
1876 return error;
1877 }
1878
1879 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1880 {
1881 int rc = 0;
1882
1883 if (!sb)
1884 return 0;
1885
1886 switch (cmds) {
1887 case Q_SYNC:
1888 case Q_QUOTAON:
1889 case Q_QUOTAOFF:
1890 case Q_SETINFO:
1891 case Q_SETQUOTA:
1892 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1893 NULL);
1894 break;
1895 case Q_GETFMT:
1896 case Q_GETINFO:
1897 case Q_GETQUOTA:
1898 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1899 NULL);
1900 break;
1901 default:
1902 rc = 0; /* let the kernel handle invalid cmds */
1903 break;
1904 }
1905 return rc;
1906 }
1907
1908 static int selinux_quota_on(struct dentry *dentry)
1909 {
1910 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1911 }
1912
1913 static int selinux_syslog(int type)
1914 {
1915 int rc;
1916
1917 rc = secondary_ops->syslog(type);
1918 if (rc)
1919 return rc;
1920
1921 switch (type) {
1922 case 3: /* Read last kernel messages */
1923 case 10: /* Return size of the log buffer */
1924 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1925 break;
1926 case 6: /* Disable logging to console */
1927 case 7: /* Enable logging to console */
1928 case 8: /* Set level of messages printed to console */
1929 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1930 break;
1931 case 0: /* Close log */
1932 case 1: /* Open log */
1933 case 2: /* Read from log */
1934 case 4: /* Read/clear last kernel messages */
1935 case 5: /* Clear ring buffer */
1936 default:
1937 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1938 break;
1939 }
1940 return rc;
1941 }
1942
1943 /*
1944 * Check that a process has enough memory to allocate a new virtual
1945 * mapping. 0 means there is enough memory for the allocation to
1946 * succeed and -ENOMEM implies there is not.
1947 *
1948 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1949 * if the capability is granted, but __vm_enough_memory requires 1 if
1950 * the capability is granted.
1951 *
1952 * Do not audit the selinux permission check, as this is applied to all
1953 * processes that allocate mappings.
1954 */
1955 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1956 {
1957 int rc, cap_sys_admin = 0;
1958 struct task_security_struct *tsec = current->security;
1959
1960 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1961 if (rc == 0)
1962 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1963 SECCLASS_CAPABILITY,
1964 CAP_TO_MASK(CAP_SYS_ADMIN),
1965 0,
1966 NULL);
1967
1968 if (rc == 0)
1969 cap_sys_admin = 1;
1970
1971 return __vm_enough_memory(mm, pages, cap_sys_admin);
1972 }
1973
1974 /**
1975 * task_tracer_task - return the task that is tracing the given task
1976 * @task: task to consider
1977 *
1978 * Returns NULL if noone is tracing @task, or the &struct task_struct
1979 * pointer to its tracer.
1980 *
1981 * Must be called under rcu_read_lock().
1982 */
1983 static struct task_struct *task_tracer_task(struct task_struct *task)
1984 {
1985 if (task->ptrace & PT_PTRACED)
1986 return rcu_dereference(task->parent);
1987 return NULL;
1988 }
1989
1990 /* binprm security operations */
1991
1992 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1993 {
1994 struct bprm_security_struct *bsec;
1995
1996 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1997 if (!bsec)
1998 return -ENOMEM;
1999
2000 bsec->sid = SECINITSID_UNLABELED;
2001 bsec->set = 0;
2002
2003 bprm->security = bsec;
2004 return 0;
2005 }
2006
2007 static int selinux_bprm_set_security(struct linux_binprm *bprm)
2008 {
2009 struct task_security_struct *tsec;
2010 struct inode *inode = bprm->file->f_path.dentry->d_inode;
2011 struct inode_security_struct *isec;
2012 struct bprm_security_struct *bsec;
2013 u32 newsid;
2014 struct avc_audit_data ad;
2015 int rc;
2016
2017 rc = secondary_ops->bprm_set_security(bprm);
2018 if (rc)
2019 return rc;
2020
2021 bsec = bprm->security;
2022
2023 if (bsec->set)
2024 return 0;
2025
2026 tsec = current->security;
2027 isec = inode->i_security;
2028
2029 /* Default to the current task SID. */
2030 bsec->sid = tsec->sid;
2031
2032 /* Reset fs, key, and sock SIDs on execve. */
2033 tsec->create_sid = 0;
2034 tsec->keycreate_sid = 0;
2035 tsec->sockcreate_sid = 0;
2036
2037 if (tsec->exec_sid) {
2038 newsid = tsec->exec_sid;
2039 /* Reset exec SID on execve. */
2040 tsec->exec_sid = 0;
2041 } else {
2042 /* Check for a default transition on this program. */
2043 rc = security_transition_sid(tsec->sid, isec->sid,
2044 SECCLASS_PROCESS, &newsid);
2045 if (rc)
2046 return rc;
2047 }
2048
2049 AVC_AUDIT_DATA_INIT(&ad, FS);
2050 ad.u.fs.path = bprm->file->f_path;
2051
2052 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2053 newsid = tsec->sid;
2054
2055 if (tsec->sid == newsid) {
2056 rc = avc_has_perm(tsec->sid, isec->sid,
2057 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2058 if (rc)
2059 return rc;
2060 } else {
2061 /* Check permissions for the transition. */
2062 rc = avc_has_perm(tsec->sid, newsid,
2063 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2064 if (rc)
2065 return rc;
2066
2067 rc = avc_has_perm(newsid, isec->sid,
2068 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2069 if (rc)
2070 return rc;
2071
2072 /* Clear any possibly unsafe personality bits on exec: */
2073 current->personality &= ~PER_CLEAR_ON_SETID;
2074
2075 /* Set the security field to the new SID. */
2076 bsec->sid = newsid;
2077 }
2078
2079 bsec->set = 1;
2080 return 0;
2081 }
2082
2083 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2084 {
2085 return secondary_ops->bprm_check_security(bprm);
2086 }
2087
2088
2089 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2090 {
2091 struct task_security_struct *tsec = current->security;
2092 int atsecure = 0;
2093
2094 if (tsec->osid != tsec->sid) {
2095 /* Enable secure mode for SIDs transitions unless
2096 the noatsecure permission is granted between
2097 the two SIDs, i.e. ahp returns 0. */
2098 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2099 SECCLASS_PROCESS,
2100 PROCESS__NOATSECURE, NULL);
2101 }
2102
2103 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2104 }
2105
2106 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2107 {
2108 kfree(bprm->security);
2109 bprm->security = NULL;
2110 }
2111
2112 extern struct vfsmount *selinuxfs_mount;
2113 extern struct dentry *selinux_null;
2114
2115 /* Derived from fs/exec.c:flush_old_files. */
2116 static inline void flush_unauthorized_files(struct files_struct *files)
2117 {
2118 struct avc_audit_data ad;
2119 struct file *file, *devnull = NULL;
2120 struct tty_struct *tty;
2121 struct fdtable *fdt;
2122 long j = -1;
2123 int drop_tty = 0;
2124
2125 mutex_lock(&tty_mutex);
2126 tty = get_current_tty();
2127 if (tty) {
2128 file_list_lock();
2129 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2130 if (file) {
2131 /* Revalidate access to controlling tty.
2132 Use inode_has_perm on the tty inode directly rather
2133 than using file_has_perm, as this particular open
2134 file may belong to another process and we are only
2135 interested in the inode-based check here. */
2136 struct inode *inode = file->f_path.dentry->d_inode;
2137 if (inode_has_perm(current, inode,
2138 FILE__READ | FILE__WRITE, NULL)) {
2139 drop_tty = 1;
2140 }
2141 }
2142 file_list_unlock();
2143 }
2144 mutex_unlock(&tty_mutex);
2145 /* Reset controlling tty. */
2146 if (drop_tty)
2147 no_tty();
2148
2149 /* Revalidate access to inherited open files. */
2150
2151 AVC_AUDIT_DATA_INIT(&ad, FS);
2152
2153 spin_lock(&files->file_lock);
2154 for (;;) {
2155 unsigned long set, i;
2156 int fd;
2157
2158 j++;
2159 i = j * __NFDBITS;
2160 fdt = files_fdtable(files);
2161 if (i >= fdt->max_fds)
2162 break;
2163 set = fdt->open_fds->fds_bits[j];
2164 if (!set)
2165 continue;
2166 spin_unlock(&files->file_lock);
2167 for ( ; set ; i++, set >>= 1) {
2168 if (set & 1) {
2169 file = fget(i);
2170 if (!file)
2171 continue;
2172 if (file_has_perm(current,
2173 file,
2174 file_to_av(file))) {
2175 sys_close(i);
2176 fd = get_unused_fd();
2177 if (fd != i) {
2178 if (fd >= 0)
2179 put_unused_fd(fd);
2180 fput(file);
2181 continue;
2182 }
2183 if (devnull) {
2184 get_file(devnull);
2185 } else {
2186 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2187 if (IS_ERR(devnull)) {
2188 devnull = NULL;
2189 put_unused_fd(fd);
2190 fput(file);
2191 continue;
2192 }
2193 }
2194 fd_install(fd, devnull);
2195 }
2196 fput(file);
2197 }
2198 }
2199 spin_lock(&files->file_lock);
2200
2201 }
2202 spin_unlock(&files->file_lock);
2203 }
2204
2205 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2206 {
2207 struct task_security_struct *tsec;
2208 struct bprm_security_struct *bsec;
2209 u32 sid;
2210 int rc;
2211
2212 secondary_ops->bprm_apply_creds(bprm, unsafe);
2213
2214 tsec = current->security;
2215
2216 bsec = bprm->security;
2217 sid = bsec->sid;
2218
2219 tsec->osid = tsec->sid;
2220 bsec->unsafe = 0;
2221 if (tsec->sid != sid) {
2222 /* Check for shared state. If not ok, leave SID
2223 unchanged and kill. */
2224 if (unsafe & LSM_UNSAFE_SHARE) {
2225 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2226 PROCESS__SHARE, NULL);
2227 if (rc) {
2228 bsec->unsafe = 1;
2229 return;
2230 }
2231 }
2232
2233 /* Check for ptracing, and update the task SID if ok.
2234 Otherwise, leave SID unchanged and kill. */
2235 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2236 struct task_struct *tracer;
2237 struct task_security_struct *sec;
2238 u32 ptsid = 0;
2239
2240 rcu_read_lock();
2241 tracer = task_tracer_task(current);
2242 if (likely(tracer != NULL)) {
2243 sec = tracer->security;
2244 ptsid = sec->sid;
2245 }
2246 rcu_read_unlock();
2247
2248 if (ptsid != 0) {
2249 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2250 PROCESS__PTRACE, NULL);
2251 if (rc) {
2252 bsec->unsafe = 1;
2253 return;
2254 }
2255 }
2256 }
2257 tsec->sid = sid;
2258 }
2259 }
2260
2261 /*
2262 * called after apply_creds without the task lock held
2263 */
2264 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2265 {
2266 struct task_security_struct *tsec;
2267 struct rlimit *rlim, *initrlim;
2268 struct itimerval itimer;
2269 struct bprm_security_struct *bsec;
2270 int rc, i;
2271
2272 tsec = current->security;
2273 bsec = bprm->security;
2274
2275 if (bsec->unsafe) {
2276 force_sig_specific(SIGKILL, current);
2277 return;
2278 }
2279 if (tsec->osid == tsec->sid)
2280 return;
2281
2282 /* Close files for which the new task SID is not authorized. */
2283 flush_unauthorized_files(current->files);
2284
2285 /* Check whether the new SID can inherit signal state
2286 from the old SID. If not, clear itimers to avoid
2287 subsequent signal generation and flush and unblock
2288 signals. This must occur _after_ the task SID has
2289 been updated so that any kill done after the flush
2290 will be checked against the new SID. */
2291 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2292 PROCESS__SIGINH, NULL);
2293 if (rc) {
2294 memset(&itimer, 0, sizeof itimer);
2295 for (i = 0; i < 3; i++)
2296 do_setitimer(i, &itimer, NULL);
2297 flush_signals(current);
2298 spin_lock_irq(&current->sighand->siglock);
2299 flush_signal_handlers(current, 1);
2300 sigemptyset(&current->blocked);
2301 recalc_sigpending();
2302 spin_unlock_irq(&current->sighand->siglock);
2303 }
2304
2305 /* Always clear parent death signal on SID transitions. */
2306 current->pdeath_signal = 0;
2307
2308 /* Check whether the new SID can inherit resource limits
2309 from the old SID. If not, reset all soft limits to
2310 the lower of the current task's hard limit and the init
2311 task's soft limit. Note that the setting of hard limits
2312 (even to lower them) can be controlled by the setrlimit
2313 check. The inclusion of the init task's soft limit into
2314 the computation is to avoid resetting soft limits higher
2315 than the default soft limit for cases where the default
2316 is lower than the hard limit, e.g. RLIMIT_CORE or
2317 RLIMIT_STACK.*/
2318 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2319 PROCESS__RLIMITINH, NULL);
2320 if (rc) {
2321 for (i = 0; i < RLIM_NLIMITS; i++) {
2322 rlim = current->signal->rlim + i;
2323 initrlim = init_task.signal->rlim+i;
2324 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2325 }
2326 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2327 /*
2328 * This will cause RLIMIT_CPU calculations
2329 * to be refigured.
2330 */
2331 current->it_prof_expires = jiffies_to_cputime(1);
2332 }
2333 }
2334
2335 /* Wake up the parent if it is waiting so that it can
2336 recheck wait permission to the new task SID. */
2337 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2338 }
2339
2340 /* superblock security operations */
2341
2342 static int selinux_sb_alloc_security(struct super_block *sb)
2343 {
2344 return superblock_alloc_security(sb);
2345 }
2346
2347 static void selinux_sb_free_security(struct super_block *sb)
2348 {
2349 superblock_free_security(sb);
2350 }
2351
2352 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2353 {
2354 if (plen > olen)
2355 return 0;
2356
2357 return !memcmp(prefix, option, plen);
2358 }
2359
2360 static inline int selinux_option(char *option, int len)
2361 {
2362 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2363 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2364 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2365 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2366 }
2367
2368 static inline void take_option(char **to, char *from, int *first, int len)
2369 {
2370 if (!*first) {
2371 **to = ',';
2372 *to += 1;
2373 } else
2374 *first = 0;
2375 memcpy(*to, from, len);
2376 *to += len;
2377 }
2378
2379 static inline void take_selinux_option(char **to, char *from, int *first,
2380 int len)
2381 {
2382 int current_size = 0;
2383
2384 if (!*first) {
2385 **to = '|';
2386 *to += 1;
2387 } else
2388 *first = 0;
2389
2390 while (current_size < len) {
2391 if (*from != '"') {
2392 **to = *from;
2393 *to += 1;
2394 }
2395 from += 1;
2396 current_size += 1;
2397 }
2398 }
2399
2400 static int selinux_sb_copy_data(char *orig, char *copy)
2401 {
2402 int fnosec, fsec, rc = 0;
2403 char *in_save, *in_curr, *in_end;
2404 char *sec_curr, *nosec_save, *nosec;
2405 int open_quote = 0;
2406
2407 in_curr = orig;
2408 sec_curr = copy;
2409
2410 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2411 if (!nosec) {
2412 rc = -ENOMEM;
2413 goto out;
2414 }
2415
2416 nosec_save = nosec;
2417 fnosec = fsec = 1;
2418 in_save = in_end = orig;
2419
2420 do {
2421 if (*in_end == '"')
2422 open_quote = !open_quote;
2423 if ((*in_end == ',' && open_quote == 0) ||
2424 *in_end == '\0') {
2425 int len = in_end - in_curr;
2426
2427 if (selinux_option(in_curr, len))
2428 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2429 else
2430 take_option(&nosec, in_curr, &fnosec, len);
2431
2432 in_curr = in_end + 1;
2433 }
2434 } while (*in_end++);
2435
2436 strcpy(in_save, nosec_save);
2437 free_page((unsigned long)nosec_save);
2438 out:
2439 return rc;
2440 }
2441
2442 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2443 {
2444 struct avc_audit_data ad;
2445 int rc;
2446
2447 rc = superblock_doinit(sb, data);
2448 if (rc)
2449 return rc;
2450
2451 AVC_AUDIT_DATA_INIT(&ad, FS);
2452 ad.u.fs.path.dentry = sb->s_root;
2453 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2454 }
2455
2456 static int selinux_sb_statfs(struct dentry *dentry)
2457 {
2458 struct avc_audit_data ad;
2459
2460 AVC_AUDIT_DATA_INIT(&ad, FS);
2461 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2462 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2463 }
2464
2465 static int selinux_mount(char *dev_name,
2466 struct path *path,
2467 char *type,
2468 unsigned long flags,
2469 void *data)
2470 {
2471 int rc;
2472
2473 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2474 if (rc)
2475 return rc;
2476
2477 if (flags & MS_REMOUNT)
2478 return superblock_has_perm(current, path->mnt->mnt_sb,
2479 FILESYSTEM__REMOUNT, NULL);
2480 else
2481 return dentry_has_perm(current, path->mnt, path->dentry,
2482 FILE__MOUNTON);
2483 }
2484
2485 static int selinux_umount(struct vfsmount *mnt, int flags)
2486 {
2487 int rc;
2488
2489 rc = secondary_ops->sb_umount(mnt, flags);
2490 if (rc)
2491 return rc;
2492
2493 return superblock_has_perm(current, mnt->mnt_sb,
2494 FILESYSTEM__UNMOUNT, NULL);
2495 }
2496
2497 /* inode security operations */
2498
2499 static int selinux_inode_alloc_security(struct inode *inode)
2500 {
2501 return inode_alloc_security(inode);
2502 }
2503
2504 static void selinux_inode_free_security(struct inode *inode)
2505 {
2506 inode_free_security(inode);
2507 }
2508
2509 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2510 char **name, void **value,
2511 size_t *len)
2512 {
2513 struct task_security_struct *tsec;
2514 struct inode_security_struct *dsec;
2515 struct superblock_security_struct *sbsec;
2516 u32 newsid, clen;
2517 int rc;
2518 char *namep = NULL, *context;
2519
2520 tsec = current->security;
2521 dsec = dir->i_security;
2522 sbsec = dir->i_sb->s_security;
2523
2524 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2525 newsid = tsec->create_sid;
2526 } else {
2527 rc = security_transition_sid(tsec->sid, dsec->sid,
2528 inode_mode_to_security_class(inode->i_mode),
2529 &newsid);
2530 if (rc) {
2531 printk(KERN_WARNING "%s: "
2532 "security_transition_sid failed, rc=%d (dev=%s "
2533 "ino=%ld)\n",
2534 __func__,
2535 -rc, inode->i_sb->s_id, inode->i_ino);
2536 return rc;
2537 }
2538 }
2539
2540 /* Possibly defer initialization to selinux_complete_init. */
2541 if (sbsec->initialized) {
2542 struct inode_security_struct *isec = inode->i_security;
2543 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2544 isec->sid = newsid;
2545 isec->initialized = 1;
2546 }
2547
2548 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2549 return -EOPNOTSUPP;
2550
2551 if (name) {
2552 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2553 if (!namep)
2554 return -ENOMEM;
2555 *name = namep;
2556 }
2557
2558 if (value && len) {
2559 rc = security_sid_to_context_force(newsid, &context, &clen);
2560 if (rc) {
2561 kfree(namep);
2562 return rc;
2563 }
2564 *value = context;
2565 *len = clen;
2566 }
2567
2568 return 0;
2569 }
2570
2571 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2572 {
2573 return may_create(dir, dentry, SECCLASS_FILE);
2574 }
2575
2576 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2577 {
2578 int rc;
2579
2580 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2581 if (rc)
2582 return rc;
2583 return may_link(dir, old_dentry, MAY_LINK);
2584 }
2585
2586 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2587 {
2588 int rc;
2589
2590 rc = secondary_ops->inode_unlink(dir, dentry);
2591 if (rc)
2592 return rc;
2593 return may_link(dir, dentry, MAY_UNLINK);
2594 }
2595
2596 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2597 {
2598 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2599 }
2600
2601 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2602 {
2603 return may_create(dir, dentry, SECCLASS_DIR);
2604 }
2605
2606 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2607 {
2608 return may_link(dir, dentry, MAY_RMDIR);
2609 }
2610
2611 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2612 {
2613 int rc;
2614
2615 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2616 if (rc)
2617 return rc;
2618
2619 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2620 }
2621
2622 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2623 struct inode *new_inode, struct dentry *new_dentry)
2624 {
2625 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2626 }
2627
2628 static int selinux_inode_readlink(struct dentry *dentry)
2629 {
2630 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2631 }
2632
2633 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2634 {
2635 int rc;
2636
2637 rc = secondary_ops->inode_follow_link(dentry, nameidata);
2638 if (rc)
2639 return rc;
2640 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2641 }
2642
2643 static int selinux_inode_permission(struct inode *inode, int mask,
2644 struct nameidata *nd)
2645 {
2646 int rc;
2647
2648 rc = secondary_ops->inode_permission(inode, mask, nd);
2649 if (rc)
2650 return rc;
2651
2652 if (!mask) {
2653 /* No permission to check. Existence test. */
2654 return 0;
2655 }
2656
2657 return inode_has_perm(current, inode,
2658 open_file_mask_to_av(inode->i_mode, mask), NULL);
2659 }
2660
2661 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2662 {
2663 int rc;
2664
2665 rc = secondary_ops->inode_setattr(dentry, iattr);
2666 if (rc)
2667 return rc;
2668
2669 if (iattr->ia_valid & ATTR_FORCE)
2670 return 0;
2671
2672 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2673 ATTR_ATIME_SET | ATTR_MTIME_SET))
2674 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2675
2676 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2677 }
2678
2679 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2680 {
2681 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2682 }
2683
2684 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2685 {
2686 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2687 sizeof XATTR_SECURITY_PREFIX - 1)) {
2688 if (!strcmp(name, XATTR_NAME_CAPS)) {
2689 if (!capable(CAP_SETFCAP))
2690 return -EPERM;
2691 } else if (!capable(CAP_SYS_ADMIN)) {
2692 /* A different attribute in the security namespace.
2693 Restrict to administrator. */
2694 return -EPERM;
2695 }
2696 }
2697
2698 /* Not an attribute we recognize, so just check the
2699 ordinary setattr permission. */
2700 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2701 }
2702
2703 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2704 const void *value, size_t size, int flags)
2705 {
2706 struct task_security_struct *tsec = current->security;
2707 struct inode *inode = dentry->d_inode;
2708 struct inode_security_struct *isec = inode->i_security;
2709 struct superblock_security_struct *sbsec;
2710 struct avc_audit_data ad;
2711 u32 newsid;
2712 int rc = 0;
2713
2714 if (strcmp(name, XATTR_NAME_SELINUX))
2715 return selinux_inode_setotherxattr(dentry, name);
2716
2717 sbsec = inode->i_sb->s_security;
2718 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2719 return -EOPNOTSUPP;
2720
2721 if (!is_owner_or_cap(inode))
2722 return -EPERM;
2723
2724 AVC_AUDIT_DATA_INIT(&ad, FS);
2725 ad.u.fs.path.dentry = dentry;
2726
2727 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2728 FILE__RELABELFROM, &ad);
2729 if (rc)
2730 return rc;
2731
2732 rc = security_context_to_sid(value, size, &newsid);
2733 if (rc == -EINVAL) {
2734 if (!capable(CAP_MAC_ADMIN))
2735 return rc;
2736 rc = security_context_to_sid_force(value, size, &newsid);
2737 }
2738 if (rc)
2739 return rc;
2740
2741 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2742 FILE__RELABELTO, &ad);
2743 if (rc)
2744 return rc;
2745
2746 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2747 isec->sclass);
2748 if (rc)
2749 return rc;
2750
2751 return avc_has_perm(newsid,
2752 sbsec->sid,
2753 SECCLASS_FILESYSTEM,
2754 FILESYSTEM__ASSOCIATE,
2755 &ad);
2756 }
2757
2758 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2759 const void *value, size_t size,
2760 int flags)
2761 {
2762 struct inode *inode = dentry->d_inode;
2763 struct inode_security_struct *isec = inode->i_security;
2764 u32 newsid;
2765 int rc;
2766
2767 if (strcmp(name, XATTR_NAME_SELINUX)) {
2768 /* Not an attribute we recognize, so nothing to do. */
2769 return;
2770 }
2771
2772 rc = security_context_to_sid_force(value, size, &newsid);
2773 if (rc) {
2774 printk(KERN_ERR "SELinux: unable to map context to SID"
2775 "for (%s, %lu), rc=%d\n",
2776 inode->i_sb->s_id, inode->i_ino, -rc);
2777 return;
2778 }
2779
2780 isec->sid = newsid;
2781 return;
2782 }
2783
2784 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2785 {
2786 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2787 }
2788
2789 static int selinux_inode_listxattr(struct dentry *dentry)
2790 {
2791 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2792 }
2793
2794 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2795 {
2796 if (strcmp(name, XATTR_NAME_SELINUX))
2797 return selinux_inode_setotherxattr(dentry, name);
2798
2799 /* No one is allowed to remove a SELinux security label.
2800 You can change the label, but all data must be labeled. */
2801 return -EACCES;
2802 }
2803
2804 /*
2805 * Copy the inode security context value to the user.
2806 *
2807 * Permission check is handled by selinux_inode_getxattr hook.
2808 */
2809 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2810 {
2811 u32 size;
2812 int error;
2813 char *context = NULL;
2814 struct task_security_struct *tsec = current->security;
2815 struct inode_security_struct *isec = inode->i_security;
2816
2817 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2818 return -EOPNOTSUPP;
2819
2820 /*
2821 * If the caller has CAP_MAC_ADMIN, then get the raw context
2822 * value even if it is not defined by current policy; otherwise,
2823 * use the in-core value under current policy.
2824 * Use the non-auditing forms of the permission checks since
2825 * getxattr may be called by unprivileged processes commonly
2826 * and lack of permission just means that we fall back to the
2827 * in-core context value, not a denial.
2828 */
2829 error = secondary_ops->capable(current, CAP_MAC_ADMIN);
2830 if (!error)
2831 error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2832 SECCLASS_CAPABILITY2,
2833 CAPABILITY2__MAC_ADMIN,
2834 0,
2835 NULL);
2836 if (!error)
2837 error = security_sid_to_context_force(isec->sid, &context,
2838 &size);
2839 else
2840 error = security_sid_to_context(isec->sid, &context, &size);
2841 if (error)
2842 return error;
2843 error = size;
2844 if (alloc) {
2845 *buffer = context;
2846 goto out_nofree;
2847 }
2848 kfree(context);
2849 out_nofree:
2850 return error;
2851 }
2852
2853 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2854 const void *value, size_t size, int flags)
2855 {
2856 struct inode_security_struct *isec = inode->i_security;
2857 u32 newsid;
2858 int rc;
2859
2860 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2861 return -EOPNOTSUPP;
2862
2863 if (!value || !size)
2864 return -EACCES;
2865
2866 rc = security_context_to_sid((void *)value, size, &newsid);
2867 if (rc)
2868 return rc;
2869
2870 isec->sid = newsid;
2871 return 0;
2872 }
2873
2874 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2875 {
2876 const int len = sizeof(XATTR_NAME_SELINUX);
2877 if (buffer && len <= buffer_size)
2878 memcpy(buffer, XATTR_NAME_SELINUX, len);
2879 return len;
2880 }
2881
2882 static int selinux_inode_need_killpriv(struct dentry *dentry)
2883 {
2884 return secondary_ops->inode_need_killpriv(dentry);
2885 }
2886
2887 static int selinux_inode_killpriv(struct dentry *dentry)
2888 {
2889 return secondary_ops->inode_killpriv(dentry);
2890 }
2891
2892 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2893 {
2894 struct inode_security_struct *isec = inode->i_security;
2895 *secid = isec->sid;
2896 }
2897
2898 /* file security operations */
2899
2900 static int selinux_revalidate_file_permission(struct file *file, int mask)
2901 {
2902 int rc;
2903 struct inode *inode = file->f_path.dentry->d_inode;
2904
2905 if (!mask) {
2906 /* No permission to check. Existence test. */
2907 return 0;
2908 }
2909
2910 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2911 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2912 mask |= MAY_APPEND;
2913
2914 rc = file_has_perm(current, file,
2915 file_mask_to_av(inode->i_mode, mask));
2916 if (rc)
2917 return rc;
2918
2919 return selinux_netlbl_inode_permission(inode, mask);
2920 }
2921
2922 static int selinux_file_permission(struct file *file, int mask)
2923 {
2924 struct inode *inode = file->f_path.dentry->d_inode;
2925 struct task_security_struct *tsec = current->security;
2926 struct file_security_struct *fsec = file->f_security;
2927 struct inode_security_struct *isec = inode->i_security;
2928
2929 if (!mask) {
2930 /* No permission to check. Existence test. */
2931 return 0;
2932 }
2933
2934 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2935 && fsec->pseqno == avc_policy_seqno())
2936 return selinux_netlbl_inode_permission(inode, mask);
2937
2938 return selinux_revalidate_file_permission(file, mask);
2939 }
2940
2941 static int selinux_file_alloc_security(struct file *file)
2942 {
2943 return file_alloc_security(file);
2944 }
2945
2946 static void selinux_file_free_security(struct file *file)
2947 {
2948 file_free_security(file);
2949 }
2950
2951 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2952 unsigned long arg)
2953 {
2954 u32 av = 0;
2955
2956 if (_IOC_DIR(cmd) & _IOC_WRITE)
2957 av |= FILE__WRITE;
2958 if (_IOC_DIR(cmd) & _IOC_READ)
2959 av |= FILE__READ;
2960 if (!av)
2961 av = FILE__IOCTL;
2962
2963 return file_has_perm(current, file, av);
2964 }
2965
2966 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2967 {
2968 #ifndef CONFIG_PPC32
2969 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2970 /*
2971 * We are making executable an anonymous mapping or a
2972 * private file mapping that will also be writable.
2973 * This has an additional check.
2974 */
2975 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2976 if (rc)
2977 return rc;
2978 }
2979 #endif
2980
2981 if (file) {
2982 /* read access is always possible with a mapping */
2983 u32 av = FILE__READ;
2984
2985 /* write access only matters if the mapping is shared */
2986 if (shared && (prot & PROT_WRITE))
2987 av |= FILE__WRITE;
2988
2989 if (prot & PROT_EXEC)
2990 av |= FILE__EXECUTE;
2991
2992 return file_has_perm(current, file, av);
2993 }
2994 return 0;
2995 }
2996
2997 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2998 unsigned long prot, unsigned long flags,
2999 unsigned long addr, unsigned long addr_only)
3000 {
3001 int rc = 0;
3002 u32 sid = ((struct task_security_struct *)(current->security))->sid;
3003
3004 if (addr < mmap_min_addr)
3005 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3006 MEMPROTECT__MMAP_ZERO, NULL);
3007 if (rc || addr_only)
3008 return rc;
3009
3010 if (selinux_checkreqprot)
3011 prot = reqprot;
3012
3013 return file_map_prot_check(file, prot,
3014 (flags & MAP_TYPE) == MAP_SHARED);
3015 }
3016
3017 static int selinux_file_mprotect(struct vm_area_struct *vma,
3018 unsigned long reqprot,
3019 unsigned long prot)
3020 {
3021 int rc;
3022
3023 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
3024 if (rc)
3025 return rc;
3026
3027 if (selinux_checkreqprot)
3028 prot = reqprot;
3029
3030 #ifndef CONFIG_PPC32
3031 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3032 rc = 0;
3033 if (vma->vm_start >= vma->vm_mm->start_brk &&
3034 vma->vm_end <= vma->vm_mm->brk) {
3035 rc = task_has_perm(current, current,
3036 PROCESS__EXECHEAP);
3037 } else if (!vma->vm_file &&
3038 vma->vm_start <= vma->vm_mm->start_stack &&
3039 vma->vm_end >= vma->vm_mm->start_stack) {
3040 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3041 } else if (vma->vm_file && vma->anon_vma) {
3042 /*
3043 * We are making executable a file mapping that has
3044 * had some COW done. Since pages might have been
3045 * written, check ability to execute the possibly
3046 * modified content. This typically should only
3047 * occur for text relocations.
3048 */
3049 rc = file_has_perm(current, vma->vm_file,
3050 FILE__EXECMOD);
3051 }
3052 if (rc)
3053 return rc;
3054 }
3055 #endif
3056
3057 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3058 }
3059
3060 static int selinux_file_lock(struct file *file, unsigned int cmd)
3061 {
3062 return file_has_perm(current, file, FILE__LOCK);
3063 }
3064
3065 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3066 unsigned long arg)
3067 {
3068 int err = 0;
3069
3070 switch (cmd) {
3071 case F_SETFL:
3072 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3073 err = -EINVAL;
3074 break;
3075 }
3076
3077 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3078 err = file_has_perm(current, file, FILE__WRITE);
3079 break;
3080 }
3081 /* fall through */
3082 case F_SETOWN:
3083 case F_SETSIG:
3084 case F_GETFL:
3085 case F_GETOWN:
3086 case F_GETSIG:
3087 /* Just check FD__USE permission */
3088 err = file_has_perm(current, file, 0);
3089 break;
3090 case F_GETLK:
3091 case F_SETLK:
3092 case F_SETLKW:
3093 #if BITS_PER_LONG == 32
3094 case F_GETLK64:
3095 case F_SETLK64:
3096 case F_SETLKW64:
3097 #endif
3098 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3099 err = -EINVAL;
3100 break;
3101 }
3102 err = file_has_perm(current, file, FILE__LOCK);
3103 break;
3104 }
3105
3106 return err;
3107 }
3108
3109 static int selinux_file_set_fowner(struct file *file)
3110 {
3111 struct task_security_struct *tsec;
3112 struct file_security_struct *fsec;
3113
3114 tsec = current->security;
3115 fsec = file->f_security;
3116 fsec->fown_sid = tsec->sid;
3117
3118 return 0;
3119 }
3120
3121 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3122 struct fown_struct *fown, int signum)
3123 {
3124 struct file *file;
3125 u32 perm;
3126 struct task_security_struct *tsec;
3127 struct file_security_struct *fsec;
3128
3129 /* struct fown_struct is never outside the context of a struct file */
3130 file = container_of(fown, struct file, f_owner);
3131
3132 tsec = tsk->security;
3133 fsec = file->f_security;
3134
3135 if (!signum)
3136 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3137 else
3138 perm = signal_to_av(signum);
3139
3140 return avc_has_perm(fsec->fown_sid, tsec->sid,
3141 SECCLASS_PROCESS, perm, NULL);
3142 }
3143
3144 static int selinux_file_receive(struct file *file)
3145 {
3146 return file_has_perm(current, file, file_to_av(file));
3147 }
3148
3149 static int selinux_dentry_open(struct file *file)
3150 {
3151 struct file_security_struct *fsec;
3152 struct inode *inode;
3153 struct inode_security_struct *isec;
3154 inode = file->f_path.dentry->d_inode;
3155 fsec = file->f_security;
3156 isec = inode->i_security;
3157 /*
3158 * Save inode label and policy sequence number
3159 * at open-time so that selinux_file_permission
3160 * can determine whether revalidation is necessary.
3161 * Task label is already saved in the file security
3162 * struct as its SID.
3163 */
3164 fsec->isid = isec->sid;
3165 fsec->pseqno = avc_policy_seqno();
3166 /*
3167 * Since the inode label or policy seqno may have changed
3168 * between the selinux_inode_permission check and the saving
3169 * of state above, recheck that access is still permitted.
3170 * Otherwise, access might never be revalidated against the
3171 * new inode label or new policy.
3172 * This check is not redundant - do not remove.
3173 */
3174 return inode_has_perm(current, inode, file_to_av(file), NULL);
3175 }
3176
3177 /* task security operations */
3178
3179 static int selinux_task_create(unsigned long clone_flags)
3180 {
3181 int rc;
3182
3183 rc = secondary_ops->task_create(clone_flags);
3184 if (rc)
3185 return rc;
3186
3187 return task_has_perm(current, current, PROCESS__FORK);
3188 }
3189
3190 static int selinux_task_alloc_security(struct task_struct *tsk)
3191 {
3192 struct task_security_struct *tsec1, *tsec2;
3193 int rc;
3194
3195 tsec1 = current->security;
3196
3197 rc = task_alloc_security(tsk);
3198 if (rc)
3199 return rc;
3200 tsec2 = tsk->security;
3201
3202 tsec2->osid = tsec1->osid;
3203 tsec2->sid = tsec1->sid;
3204
3205 /* Retain the exec, fs, key, and sock SIDs across fork */
3206 tsec2->exec_sid = tsec1->exec_sid;
3207 tsec2->create_sid = tsec1->create_sid;
3208 tsec2->keycreate_sid = tsec1->keycreate_sid;
3209 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3210
3211 return 0;
3212 }
3213
3214 static void selinux_task_free_security(struct task_struct *tsk)
3215 {
3216 task_free_security(tsk);
3217 }
3218
3219 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3220 {
3221 /* Since setuid only affects the current process, and
3222 since the SELinux controls are not based on the Linux
3223 identity attributes, SELinux does not need to control
3224 this operation. However, SELinux does control the use
3225 of the CAP_SETUID and CAP_SETGID capabilities using the
3226 capable hook. */
3227 return 0;
3228 }
3229
3230 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3231 {
3232 return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3233 }
3234
3235 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3236 {
3237 /* See the comment for setuid above. */
3238 return 0;
3239 }
3240
3241 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3242 {
3243 return task_has_perm(current, p, PROCESS__SETPGID);
3244 }
3245
3246 static int selinux_task_getpgid(struct task_struct *p)
3247 {
3248 return task_has_perm(current, p, PROCESS__GETPGID);
3249 }
3250
3251 static int selinux_task_getsid(struct task_struct *p)
3252 {
3253 return task_has_perm(current, p, PROCESS__GETSESSION);
3254 }
3255
3256 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3257 {
3258 struct task_security_struct *tsec = p->security;
3259 *secid = tsec->sid;
3260 }
3261
3262 static int selinux_task_setgroups(struct group_info *group_info)
3263 {
3264 /* See the comment for setuid above. */
3265 return 0;
3266 }
3267
3268 static int selinux_task_setnice(struct task_struct *p, int nice)
3269 {
3270 int rc;
3271
3272 rc = secondary_ops->task_setnice(p, nice);
3273 if (rc)
3274 return rc;
3275
3276 return task_has_perm(current, p, PROCESS__SETSCHED);
3277 }
3278
3279 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3280 {
3281 int rc;
3282
3283 rc = secondary_ops->task_setioprio(p, ioprio);
3284 if (rc)
3285 return rc;
3286
3287 return task_has_perm(current, p, PROCESS__SETSCHED);
3288 }
3289
3290 static int selinux_task_getioprio(struct task_struct *p)
3291 {
3292 return task_has_perm(current, p, PROCESS__GETSCHED);
3293 }
3294
3295 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3296 {
3297 struct rlimit *old_rlim = current->signal->rlim + resource;
3298 int rc;
3299
3300 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3301 if (rc)
3302 return rc;
3303
3304 /* Control the ability to change the hard limit (whether
3305 lowering or raising it), so that the hard limit can
3306 later be used as a safe reset point for the soft limit
3307 upon context transitions. See selinux_bprm_apply_creds. */
3308 if (old_rlim->rlim_max != new_rlim->rlim_max)
3309 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3310
3311 return 0;
3312 }
3313
3314 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3315 {
3316 int rc;
3317
3318 rc = secondary_ops->task_setscheduler(p, policy, lp);
3319 if (rc)
3320 return rc;
3321
3322 return task_has_perm(current, p, PROCESS__SETSCHED);
3323 }
3324
3325 static int selinux_task_getscheduler(struct task_struct *p)
3326 {
3327 return task_has_perm(current, p, PROCESS__GETSCHED);
3328 }
3329
3330 static int selinux_task_movememory(struct task_struct *p)
3331 {
3332 return task_has_perm(current, p, PROCESS__SETSCHED);
3333 }
3334
3335 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3336 int sig, u32 secid)
3337 {
3338 u32 perm;
3339 int rc;
3340 struct task_security_struct *tsec;
3341
3342 rc = secondary_ops->task_kill(p, info, sig, secid);
3343 if (rc)
3344 return rc;
3345
3346 if (!sig)
3347 perm = PROCESS__SIGNULL; /* null signal; existence test */
3348 else
3349 perm = signal_to_av(sig);
3350 tsec = p->security;
3351 if (secid)
3352 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3353 else
3354 rc = task_has_perm(current, p, perm);
3355 return rc;
3356 }
3357
3358 static int selinux_task_prctl(int option,
3359 unsigned long arg2,
3360 unsigned long arg3,
3361 unsigned long arg4,
3362 unsigned long arg5,
3363 long *rc_p)
3364 {
3365 /* The current prctl operations do not appear to require
3366 any SELinux controls since they merely observe or modify
3367 the state of the current process. */
3368 return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3369 }
3370
3371 static int selinux_task_wait(struct task_struct *p)
3372 {
3373 return task_has_perm(p, current, PROCESS__SIGCHLD);
3374 }
3375
3376 static void selinux_task_reparent_to_init(struct task_struct *p)
3377 {
3378 struct task_security_struct *tsec;
3379
3380 secondary_ops->task_reparent_to_init(p);
3381
3382 tsec = p->security;
3383 tsec->osid = tsec->sid;
3384 tsec->sid = SECINITSID_KERNEL;
3385 return;
3386 }
3387
3388 static void selinux_task_to_inode(struct task_struct *p,
3389 struct inode *inode)
3390 {
3391 struct task_security_struct *tsec = p->security;
3392 struct inode_security_struct *isec = inode->i_security;
3393
3394 isec->sid = tsec->sid;
3395 isec->initialized = 1;
3396 return;
3397 }
3398
3399 /* Returns error only if unable to parse addresses */
3400 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3401 struct avc_audit_data *ad, u8 *proto)
3402 {
3403 int offset, ihlen, ret = -EINVAL;
3404 struct iphdr _iph, *ih;
3405
3406 offset = skb_network_offset(skb);
3407 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3408 if (ih == NULL)
3409 goto out;
3410
3411 ihlen = ih->ihl * 4;
3412 if (ihlen < sizeof(_iph))
3413 goto out;
3414
3415 ad->u.net.v4info.saddr = ih->saddr;
3416 ad->u.net.v4info.daddr = ih->daddr;
3417 ret = 0;
3418
3419 if (proto)
3420 *proto = ih->protocol;
3421
3422 switch (ih->protocol) {
3423 case IPPROTO_TCP: {
3424 struct tcphdr _tcph, *th;
3425
3426 if (ntohs(ih->frag_off) & IP_OFFSET)
3427 break;
3428
3429 offset += ihlen;
3430 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3431 if (th == NULL)
3432 break;
3433
3434 ad->u.net.sport = th->source;
3435 ad->u.net.dport = th->dest;
3436 break;
3437 }
3438
3439 case IPPROTO_UDP: {
3440 struct udphdr _udph, *uh;
3441
3442 if (ntohs(ih->frag_off) & IP_OFFSET)
3443 break;
3444
3445 offset += ihlen;
3446 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3447 if (uh == NULL)
3448 break;
3449
3450 ad->u.net.sport = uh->source;
3451 ad->u.net.dport = uh->dest;
3452 break;
3453 }
3454
3455 case IPPROTO_DCCP: {
3456 struct dccp_hdr _dccph, *dh;
3457
3458 if (ntohs(ih->frag_off) & IP_OFFSET)
3459 break;
3460
3461 offset += ihlen;
3462 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3463 if (dh == NULL)
3464 break;
3465
3466 ad->u.net.sport = dh->dccph_sport;
3467 ad->u.net.dport = dh->dccph_dport;
3468 break;
3469 }
3470
3471 default:
3472 break;
3473 }
3474 out:
3475 return ret;
3476 }
3477
3478 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3479
3480 /* Returns error only if unable to parse addresses */
3481 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3482 struct avc_audit_data *ad, u8 *proto)
3483 {
3484 u8 nexthdr;
3485 int ret = -EINVAL, offset;
3486 struct ipv6hdr _ipv6h, *ip6;
3487
3488 offset = skb_network_offset(skb);
3489 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3490 if (ip6 == NULL)
3491 goto out;
3492
3493 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3494 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3495 ret = 0;
3496
3497 nexthdr = ip6->nexthdr;
3498 offset += sizeof(_ipv6h);
3499 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3500 if (offset < 0)
3501 goto out;
3502
3503 if (proto)
3504 *proto = nexthdr;
3505
3506 switch (nexthdr) {
3507 case IPPROTO_TCP: {
3508 struct tcphdr _tcph, *th;
3509
3510 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3511 if (th == NULL)
3512 break;
3513
3514 ad->u.net.sport = th->source;
3515 ad->u.net.dport = th->dest;
3516 break;
3517 }
3518
3519 case IPPROTO_UDP: {
3520 struct udphdr _udph, *uh;
3521
3522 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3523 if (uh == NULL)
3524 break;
3525
3526 ad->u.net.sport = uh->source;
3527 ad->u.net.dport = uh->dest;
3528 break;
3529 }
3530
3531 case IPPROTO_DCCP: {
3532 struct dccp_hdr _dccph, *dh;
3533
3534 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3535 if (dh == NULL)
3536 break;
3537
3538 ad->u.net.sport = dh->dccph_sport;
3539 ad->u.net.dport = dh->dccph_dport;
3540 break;
3541 }
3542
3543 /* includes fragments */
3544 default:
3545 break;
3546 }
3547 out:
3548 return ret;
3549 }
3550
3551 #endif /* IPV6 */
3552
3553 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3554 char **addrp, int src, u8 *proto)
3555 {
3556 int ret = 0;
3557
3558 switch (ad->u.net.family) {
3559 case PF_INET:
3560 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3561 if (ret || !addrp)
3562 break;
3563 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3564 &ad->u.net.v4info.daddr);
3565 break;
3566
3567 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3568 case PF_INET6:
3569 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3570 if (ret || !addrp)
3571 break;
3572 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3573 &ad->u.net.v6info.daddr);
3574 break;
3575 #endif /* IPV6 */
3576 default:
3577 break;
3578 }
3579
3580 if (unlikely(ret))
3581 printk(KERN_WARNING
3582 "SELinux: failure in selinux_parse_skb(),"
3583 " unable to parse packet\n");
3584
3585 return ret;
3586 }
3587
3588 /**
3589 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3590 * @skb: the packet
3591 * @family: protocol family
3592 * @sid: the packet's peer label SID
3593 *
3594 * Description:
3595 * Check the various different forms of network peer labeling and determine
3596 * the peer label/SID for the packet; most of the magic actually occurs in
3597 * the security server function security_net_peersid_cmp(). The function
3598 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3599 * or -EACCES if @sid is invalid due to inconsistencies with the different
3600 * peer labels.
3601 *
3602 */
3603 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3604 {
3605 int err;
3606 u32 xfrm_sid;
3607 u32 nlbl_sid;
3608 u32 nlbl_type;
3609
3610 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3611 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3612
3613 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3614 if (unlikely(err)) {
3615 printk(KERN_WARNING
3616 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3617 " unable to determine packet's peer label\n");
3618 return -EACCES;
3619 }
3620
3621 return 0;
3622 }
3623
3624 /* socket security operations */
3625 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3626 u32 perms)
3627 {
3628 struct inode_security_struct *isec;
3629 struct task_security_struct *tsec;
3630 struct avc_audit_data ad;
3631 int err = 0;
3632
3633 tsec = task->security;
3634 isec = SOCK_INODE(sock)->i_security;
3635
3636 if (isec->sid == SECINITSID_KERNEL)
3637 goto out;
3638
3639 AVC_AUDIT_DATA_INIT(&ad, NET);
3640 ad.u.net.sk = sock->sk;
3641 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3642
3643 out:
3644 return err;
3645 }
3646
3647 static int selinux_socket_create(int family, int type,
3648 int protocol, int kern)
3649 {
3650 int err = 0;
3651 struct task_security_struct *tsec;
3652 u32 newsid;
3653
3654 if (kern)
3655 goto out;
3656
3657 tsec = current->security;
3658 newsid = tsec->sockcreate_sid ? : tsec->sid;
3659 err = avc_has_perm(tsec->sid, newsid,
3660 socket_type_to_security_class(family, type,
3661 protocol), SOCKET__CREATE, NULL);
3662
3663 out:
3664 return err;
3665 }
3666
3667 static int selinux_socket_post_create(struct socket *sock, int family,
3668 int type, int protocol, int kern)
3669 {
3670 int err = 0;
3671 struct inode_security_struct *isec;
3672 struct task_security_struct *tsec;
3673 struct sk_security_struct *sksec;
3674 u32 newsid;
3675
3676 isec = SOCK_INODE(sock)->i_security;
3677
3678 tsec = current->security;
3679 newsid = tsec->sockcreate_sid ? : tsec->sid;
3680 isec->sclass = socket_type_to_security_class(family, type, protocol);
3681 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3682 isec->initialized = 1;
3683
3684 if (sock->sk) {
3685 sksec = sock->sk->sk_security;
3686 sksec->sid = isec->sid;
3687 sksec->sclass = isec->sclass;
3688 err = selinux_netlbl_socket_post_create(sock);
3689 }
3690
3691 return err;
3692 }
3693
3694 /* Range of port numbers used to automatically bind.
3695 Need to determine whether we should perform a name_bind
3696 permission check between the socket and the port number. */
3697
3698 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3699 {
3700 u16 family;
3701 int err;
3702
3703 err = socket_has_perm(current, sock, SOCKET__BIND);
3704 if (err)
3705 goto out;
3706
3707 /*
3708 * If PF_INET or PF_INET6, check name_bind permission for the port.
3709 * Multiple address binding for SCTP is not supported yet: we just
3710 * check the first address now.
3711 */
3712 family = sock->sk->sk_family;
3713 if (family == PF_INET || family == PF_INET6) {
3714 char *addrp;
3715 struct inode_security_struct *isec;
3716 struct task_security_struct *tsec;
3717 struct avc_audit_data ad;
3718 struct sockaddr_in *addr4 = NULL;
3719 struct sockaddr_in6 *addr6 = NULL;
3720 unsigned short snum;
3721 struct sock *sk = sock->sk;
3722 u32 sid, node_perm;
3723
3724 tsec = current->security;
3725 isec = SOCK_INODE(sock)->i_security;
3726
3727 if (family == PF_INET) {
3728 addr4 = (struct sockaddr_in *)address;
3729 snum = ntohs(addr4->sin_port);
3730 addrp = (char *)&addr4->sin_addr.s_addr;
3731 } else {
3732 addr6 = (struct sockaddr_in6 *)address;
3733 snum = ntohs(addr6->sin6_port);
3734 addrp = (char *)&addr6->sin6_addr.s6_addr;
3735 }
3736
3737 if (snum) {
3738 int low, high;
3739
3740 inet_get_local_port_range(&low, &high);
3741
3742 if (snum < max(PROT_SOCK, low) || snum > high) {
3743 err = sel_netport_sid(sk->sk_protocol,
3744 snum, &sid);
3745 if (err)
3746 goto out;
3747 AVC_AUDIT_DATA_INIT(&ad, NET);
3748 ad.u.net.sport = htons(snum);
3749 ad.u.net.family = family;
3750 err = avc_has_perm(isec->sid, sid,
3751 isec->sclass,
3752 SOCKET__NAME_BIND, &ad);
3753 if (err)
3754 goto out;
3755 }
3756 }
3757
3758 switch (isec->sclass) {
3759 case SECCLASS_TCP_SOCKET:
3760 node_perm = TCP_SOCKET__NODE_BIND;
3761 break;
3762
3763 case SECCLASS_UDP_SOCKET:
3764 node_perm = UDP_SOCKET__NODE_BIND;
3765 break;
3766
3767 case SECCLASS_DCCP_SOCKET:
3768 node_perm = DCCP_SOCKET__NODE_BIND;
3769 break;
3770
3771 default:
3772 node_perm = RAWIP_SOCKET__NODE_BIND;
3773 break;
3774 }
3775
3776 err = sel_netnode_sid(addrp, family, &sid);
3777 if (err)
3778 goto out;
3779
3780 AVC_AUDIT_DATA_INIT(&ad, NET);
3781 ad.u.net.sport = htons(snum);
3782 ad.u.net.family = family;
3783
3784 if (family == PF_INET)
3785 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3786 else
3787 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3788
3789 err = avc_has_perm(isec->sid, sid,
3790 isec->sclass, node_perm, &ad);
3791 if (err)
3792 goto out;
3793 }
3794 out:
3795 return err;
3796 }
3797
3798 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3799 {
3800 struct inode_security_struct *isec;
3801 int err;
3802
3803 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3804 if (err)
3805 return err;
3806
3807 /*
3808 * If a TCP or DCCP socket, check name_connect permission for the port.
3809 */
3810 isec = SOCK_INODE(sock)->i_security;
3811 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3812 isec->sclass == SECCLASS_DCCP_SOCKET) {
3813 struct sock *sk = sock->sk;
3814 struct avc_audit_data ad;
3815 struct sockaddr_in *addr4 = NULL;
3816 struct sockaddr_in6 *addr6 = NULL;
3817 unsigned short snum;
3818 u32 sid, perm;
3819
3820 if (sk->sk_family == PF_INET) {
3821 addr4 = (struct sockaddr_in *)address;
3822 if (addrlen < sizeof(struct sockaddr_in))
3823 return -EINVAL;
3824 snum = ntohs(addr4->sin_port);
3825 } else {
3826 addr6 = (struct sockaddr_in6 *)address;
3827 if (addrlen < SIN6_LEN_RFC2133)
3828 return -EINVAL;
3829 snum = ntohs(addr6->sin6_port);
3830 }
3831
3832 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3833 if (err)
3834 goto out;
3835
3836 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3837 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3838
3839 AVC_AUDIT_DATA_INIT(&ad, NET);
3840 ad.u.net.dport = htons(snum);
3841 ad.u.net.family = sk->sk_family;
3842 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3843 if (err)
3844 goto out;
3845 }
3846
3847 out:
3848 return err;
3849 }
3850
3851 static int selinux_socket_listen(struct socket *sock, int backlog)
3852 {
3853 return socket_has_perm(current, sock, SOCKET__LISTEN);
3854 }
3855
3856 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3857 {
3858 int err;
3859 struct inode_security_struct *isec;
3860 struct inode_security_struct *newisec;
3861
3862 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3863 if (err)
3864 return err;
3865
3866 newisec = SOCK_INODE(newsock)->i_security;
3867
3868 isec = SOCK_INODE(sock)->i_security;
3869 newisec->sclass = isec->sclass;
3870 newisec->sid = isec->sid;
3871 newisec->initialized = 1;
3872
3873 return 0;
3874 }
3875
3876 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3877 int size)
3878 {
3879 int rc;
3880
3881 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3882 if (rc)
3883 return rc;
3884
3885 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3886 }
3887
3888 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3889 int size, int flags)
3890 {
3891 return socket_has_perm(current, sock, SOCKET__READ);
3892 }
3893
3894 static int selinux_socket_getsockname(struct socket *sock)
3895 {
3896 return socket_has_perm(current, sock, SOCKET__GETATTR);
3897 }
3898
3899 static int selinux_socket_getpeername(struct socket *sock)
3900 {
3901 return socket_has_perm(current, sock, SOCKET__GETATTR);
3902 }
3903
3904 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3905 {
3906 int err;
3907
3908 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3909 if (err)
3910 return err;
3911
3912 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3913 }
3914
3915 static int selinux_socket_getsockopt(struct socket *sock, int level,
3916 int optname)
3917 {
3918 return socket_has_perm(current, sock, SOCKET__GETOPT);
3919 }
3920
3921 static int selinux_socket_shutdown(struct socket *sock, int how)
3922 {
3923 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3924 }
3925
3926 static int selinux_socket_unix_stream_connect(struct socket *sock,
3927 struct socket *other,
3928 struct sock *newsk)
3929 {
3930 struct sk_security_struct *ssec;
3931 struct inode_security_struct *isec;
3932 struct inode_security_struct *other_isec;
3933 struct avc_audit_data ad;
3934 int err;
3935
3936 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3937 if (err)
3938 return err;
3939
3940 isec = SOCK_INODE(sock)->i_security;
3941 other_isec = SOCK_INODE(other)->i_security;
3942
3943 AVC_AUDIT_DATA_INIT(&ad, NET);
3944 ad.u.net.sk = other->sk;
3945
3946 err = avc_has_perm(isec->sid, other_isec->sid,
3947 isec->sclass,
3948 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3949 if (err)
3950 return err;
3951
3952 /* connecting socket */
3953 ssec = sock->sk->sk_security;
3954 ssec->peer_sid = other_isec->sid;
3955
3956 /* server child socket */
3957 ssec = newsk->sk_security;
3958 ssec->peer_sid = isec->sid;
3959 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3960
3961 return err;
3962 }
3963
3964 static int selinux_socket_unix_may_send(struct socket *sock,
3965 struct socket *other)
3966 {
3967 struct inode_security_struct *isec;
3968 struct inode_security_struct *other_isec;
3969 struct avc_audit_data ad;
3970 int err;
3971
3972 isec = SOCK_INODE(sock)->i_security;
3973 other_isec = SOCK_INODE(other)->i_security;
3974
3975 AVC_AUDIT_DATA_INIT(&ad, NET);
3976 ad.u.net.sk = other->sk;
3977
3978 err = avc_has_perm(isec->sid, other_isec->sid,
3979 isec->sclass, SOCKET__SENDTO, &ad);
3980 if (err)
3981 return err;
3982
3983 return 0;
3984 }
3985
3986 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3987 u32 peer_sid,
3988 struct avc_audit_data *ad)
3989 {
3990 int err;
3991 u32 if_sid;
3992 u32 node_sid;
3993
3994 err = sel_netif_sid(ifindex, &if_sid);
3995 if (err)
3996 return err;
3997 err = avc_has_perm(peer_sid, if_sid,
3998 SECCLASS_NETIF, NETIF__INGRESS, ad);
3999 if (err)
4000 return err;
4001
4002 err = sel_netnode_sid(addrp, family, &node_sid);
4003 if (err)
4004 return err;
4005 return avc_has_perm(peer_sid, node_sid,
4006 SECCLASS_NODE, NODE__RECVFROM, ad);
4007 }
4008
4009 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
4010 struct sk_buff *skb,
4011 struct avc_audit_data *ad,
4012 u16 family,
4013 char *addrp)
4014 {
4015 int err;
4016 struct sk_security_struct *sksec = sk->sk_security;
4017 u16 sk_class;
4018 u32 netif_perm, node_perm, recv_perm;
4019 u32 port_sid, node_sid, if_sid, sk_sid;
4020
4021 sk_sid = sksec->sid;
4022 sk_class = sksec->sclass;
4023
4024 switch (sk_class) {
4025 case SECCLASS_UDP_SOCKET:
4026 netif_perm = NETIF__UDP_RECV;
4027 node_perm = NODE__UDP_RECV;
4028 recv_perm = UDP_SOCKET__RECV_MSG;
4029 break;
4030 case SECCLASS_TCP_SOCKET:
4031 netif_perm = NETIF__TCP_RECV;
4032 node_perm = NODE__TCP_RECV;
4033 recv_perm = TCP_SOCKET__RECV_MSG;
4034 break;
4035 case SECCLASS_DCCP_SOCKET:
4036 netif_perm = NETIF__DCCP_RECV;
4037 node_perm = NODE__DCCP_RECV;
4038 recv_perm = DCCP_SOCKET__RECV_MSG;
4039 break;
4040 default:
4041 netif_perm = NETIF__RAWIP_RECV;
4042 node_perm = NODE__RAWIP_RECV;
4043 recv_perm = 0;
4044 break;
4045 }
4046
4047 err = sel_netif_sid(skb->iif, &if_sid);
4048 if (err)
4049 return err;
4050 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4051 if (err)
4052 return err;
4053
4054 err = sel_netnode_sid(addrp, family, &node_sid);
4055 if (err)
4056 return err;
4057 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4058 if (err)
4059 return err;
4060
4061 if (!recv_perm)
4062 return 0;
4063 err = sel_netport_sid(sk->sk_protocol,
4064 ntohs(ad->u.net.sport), &port_sid);
4065 if (unlikely(err)) {
4066 printk(KERN_WARNING
4067 "SELinux: failure in"
4068 " selinux_sock_rcv_skb_iptables_compat(),"
4069 " network port label not found\n");
4070 return err;
4071 }
4072 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4073 }
4074
4075 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4076 struct avc_audit_data *ad,
4077 u16 family, char *addrp)
4078 {
4079 int err;
4080 struct sk_security_struct *sksec = sk->sk_security;
4081 u32 peer_sid;
4082 u32 sk_sid = sksec->sid;
4083
4084 if (selinux_compat_net)
4085 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4086 family, addrp);
4087 else
4088 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4089 PACKET__RECV, ad);
4090 if (err)
4091 return err;
4092
4093 if (selinux_policycap_netpeer) {
4094 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4095 if (err)
4096 return err;
4097 err = avc_has_perm(sk_sid, peer_sid,
4098 SECCLASS_PEER, PEER__RECV, ad);
4099 } else {
4100 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4101 if (err)
4102 return err;
4103 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4104 }
4105
4106 return err;
4107 }
4108
4109 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4110 {
4111 int err;
4112 struct sk_security_struct *sksec = sk->sk_security;
4113 u16 family = sk->sk_family;
4114 u32 sk_sid = sksec->sid;
4115 struct avc_audit_data ad;
4116 char *addrp;
4117
4118 if (family != PF_INET && family != PF_INET6)
4119 return 0;
4120
4121 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4122 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4123 family = PF_INET;
4124
4125 AVC_AUDIT_DATA_INIT(&ad, NET);
4126 ad.u.net.netif = skb->iif;
4127 ad.u.net.family = family;
4128 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4129 if (err)
4130 return err;
4131
4132 /* If any sort of compatibility mode is enabled then handoff processing
4133 * to the selinux_sock_rcv_skb_compat() function to deal with the
4134 * special handling. We do this in an attempt to keep this function
4135 * as fast and as clean as possible. */
4136 if (selinux_compat_net || !selinux_policycap_netpeer)
4137 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4138 family, addrp);
4139
4140 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4141 u32 peer_sid;
4142
4143 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4144 if (err)
4145 return err;
4146 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4147 peer_sid, &ad);
4148 if (err)
4149 return err;
4150 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4151 PEER__RECV, &ad);
4152 }
4153
4154 if (selinux_secmark_enabled()) {
4155 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4156 PACKET__RECV, &ad);
4157 if (err)
4158 return err;
4159 }
4160
4161 return err;
4162 }
4163
4164 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4165 int __user *optlen, unsigned len)
4166 {
4167 int err = 0;
4168 char *scontext;
4169 u32 scontext_len;
4170 struct sk_security_struct *ssec;
4171 struct inode_security_struct *isec;
4172 u32 peer_sid = SECSID_NULL;
4173
4174 isec = SOCK_INODE(sock)->i_security;
4175
4176 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4177 isec->sclass == SECCLASS_TCP_SOCKET) {
4178 ssec = sock->sk->sk_security;
4179 peer_sid = ssec->peer_sid;
4180 }
4181 if (peer_sid == SECSID_NULL) {
4182 err = -ENOPROTOOPT;
4183 goto out;
4184 }
4185
4186 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4187
4188 if (err)
4189 goto out;
4190
4191 if (scontext_len > len) {
4192 err = -ERANGE;
4193 goto out_len;
4194 }
4195
4196 if (copy_to_user(optval, scontext, scontext_len))
4197 err = -EFAULT;
4198
4199 out_len:
4200 if (put_user(scontext_len, optlen))
4201 err = -EFAULT;
4202
4203 kfree(scontext);
4204 out:
4205 return err;
4206 }
4207
4208 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4209 {
4210 u32 peer_secid = SECSID_NULL;
4211 u16 family;
4212
4213 if (sock)
4214 family = sock->sk->sk_family;
4215 else if (skb && skb->sk)
4216 family = skb->sk->sk_family;
4217 else
4218 goto out;
4219
4220 if (sock && family == PF_UNIX)
4221 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4222 else if (skb)
4223 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4224
4225 out:
4226 *secid = peer_secid;
4227 if (peer_secid == SECSID_NULL)
4228 return -EINVAL;
4229 return 0;
4230 }
4231
4232 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4233 {
4234 return sk_alloc_security(sk, family, priority);
4235 }
4236
4237 static void selinux_sk_free_security(struct sock *sk)
4238 {
4239 sk_free_security(sk);
4240 }
4241
4242 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4243 {
4244 struct sk_security_struct *ssec = sk->sk_security;
4245 struct sk_security_struct *newssec = newsk->sk_security;
4246
4247 newssec->sid = ssec->sid;
4248 newssec->peer_sid = ssec->peer_sid;
4249 newssec->sclass = ssec->sclass;
4250
4251 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4252 }
4253
4254 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4255 {
4256 if (!sk)
4257 *secid = SECINITSID_ANY_SOCKET;
4258 else {
4259 struct sk_security_struct *sksec = sk->sk_security;
4260
4261 *secid = sksec->sid;
4262 }
4263 }
4264
4265 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4266 {
4267 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4268 struct sk_security_struct *sksec = sk->sk_security;
4269
4270 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4271 sk->sk_family == PF_UNIX)
4272 isec->sid = sksec->sid;
4273 sksec->sclass = isec->sclass;
4274
4275 selinux_netlbl_sock_graft(sk, parent);
4276 }
4277
4278 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4279 struct request_sock *req)
4280 {
4281 struct sk_security_struct *sksec = sk->sk_security;
4282 int err;
4283 u32 newsid;
4284 u32 peersid;
4285
4286 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4287 if (err)
4288 return err;
4289 if (peersid == SECSID_NULL) {
4290 req->secid = sksec->sid;
4291 req->peer_secid = SECSID_NULL;
4292 return 0;
4293 }
4294
4295 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4296 if (err)
4297 return err;
4298
4299 req->secid = newsid;
4300 req->peer_secid = peersid;
4301 return 0;
4302 }
4303
4304 static void selinux_inet_csk_clone(struct sock *newsk,
4305 const struct request_sock *req)
4306 {
4307 struct sk_security_struct *newsksec = newsk->sk_security;
4308
4309 newsksec->sid = req->secid;
4310 newsksec->peer_sid = req->peer_secid;
4311 /* NOTE: Ideally, we should also get the isec->sid for the
4312 new socket in sync, but we don't have the isec available yet.
4313 So we will wait until sock_graft to do it, by which
4314 time it will have been created and available. */
4315
4316 /* We don't need to take any sort of lock here as we are the only
4317 * thread with access to newsksec */
4318 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4319 }
4320
4321 static void selinux_inet_conn_established(struct sock *sk,
4322 struct sk_buff *skb)
4323 {
4324 struct sk_security_struct *sksec = sk->sk_security;
4325
4326 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4327 }
4328
4329 static void selinux_req_classify_flow(const struct request_sock *req,
4330 struct flowi *fl)
4331 {
4332 fl->secid = req->secid;
4333 }
4334
4335 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4336 {
4337 int err = 0;
4338 u32 perm;
4339 struct nlmsghdr *nlh;
4340 struct socket *sock = sk->sk_socket;
4341 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4342
4343 if (skb->len < NLMSG_SPACE(0)) {
4344 err = -EINVAL;
4345 goto out;
4346 }
4347 nlh = nlmsg_hdr(skb);
4348
4349 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4350 if (err) {
4351 if (err == -EINVAL) {
4352 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4353 "SELinux: unrecognized netlink message"
4354 " type=%hu for sclass=%hu\n",
4355 nlh->nlmsg_type, isec->sclass);
4356 if (!selinux_enforcing)
4357 err = 0;
4358 }
4359
4360 /* Ignore */
4361 if (err == -ENOENT)
4362 err = 0;
4363 goto out;
4364 }
4365
4366 err = socket_has_perm(current, sock, perm);
4367 out:
4368 return err;
4369 }
4370
4371 #ifdef CONFIG_NETFILTER
4372
4373 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4374 u16 family)
4375 {
4376 char *addrp;
4377 u32 peer_sid;
4378 struct avc_audit_data ad;
4379 u8 secmark_active;
4380 u8 peerlbl_active;
4381
4382 if (!selinux_policycap_netpeer)
4383 return NF_ACCEPT;
4384
4385 secmark_active = selinux_secmark_enabled();
4386 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4387 if (!secmark_active && !peerlbl_active)
4388 return NF_ACCEPT;
4389
4390 AVC_AUDIT_DATA_INIT(&ad, NET);
4391 ad.u.net.netif = ifindex;
4392 ad.u.net.family = family;
4393 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4394 return NF_DROP;
4395
4396 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4397 return NF_DROP;
4398
4399 if (peerlbl_active)
4400 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4401 peer_sid, &ad) != 0)
4402 return NF_DROP;
4403
4404 if (secmark_active)
4405 if (avc_has_perm(peer_sid, skb->secmark,
4406 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4407 return NF_DROP;
4408
4409 return NF_ACCEPT;
4410 }
4411
4412 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4413 struct sk_buff *skb,
4414 const struct net_device *in,
4415 const struct net_device *out,
4416 int (*okfn)(struct sk_buff *))
4417 {
4418 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4419 }
4420
4421 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4422 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4423 struct sk_buff *skb,
4424 const struct net_device *in,
4425 const struct net_device *out,
4426 int (*okfn)(struct sk_buff *))
4427 {
4428 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4429 }
4430 #endif /* IPV6 */
4431
4432 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4433 int ifindex,
4434 struct avc_audit_data *ad,
4435 u16 family, char *addrp)
4436 {
4437 int err;
4438 struct sk_security_struct *sksec = sk->sk_security;
4439 u16 sk_class;
4440 u32 netif_perm, node_perm, send_perm;
4441 u32 port_sid, node_sid, if_sid, sk_sid;
4442
4443 sk_sid = sksec->sid;
4444 sk_class = sksec->sclass;
4445
4446 switch (sk_class) {
4447 case SECCLASS_UDP_SOCKET:
4448 netif_perm = NETIF__UDP_SEND;
4449 node_perm = NODE__UDP_SEND;
4450 send_perm = UDP_SOCKET__SEND_MSG;
4451 break;
4452 case SECCLASS_TCP_SOCKET:
4453 netif_perm = NETIF__TCP_SEND;
4454 node_perm = NODE__TCP_SEND;
4455 send_perm = TCP_SOCKET__SEND_MSG;
4456 break;
4457 case SECCLASS_DCCP_SOCKET:
4458 netif_perm = NETIF__DCCP_SEND;
4459 node_perm = NODE__DCCP_SEND;
4460 send_perm = DCCP_SOCKET__SEND_MSG;
4461 break;
4462 default:
4463 netif_perm = NETIF__RAWIP_SEND;
4464 node_perm = NODE__RAWIP_SEND;
4465 send_perm = 0;
4466 break;
4467 }
4468
4469 err = sel_netif_sid(ifindex, &if_sid);
4470 if (err)
4471 return err;
4472 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4473 return err;
4474
4475 err = sel_netnode_sid(addrp, family, &node_sid);
4476 if (err)
4477 return err;
4478 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4479 if (err)
4480 return err;
4481
4482 if (send_perm != 0)
4483 return 0;
4484
4485 err = sel_netport_sid(sk->sk_protocol,
4486 ntohs(ad->u.net.dport), &port_sid);
4487 if (unlikely(err)) {
4488 printk(KERN_WARNING
4489 "SELinux: failure in"
4490 " selinux_ip_postroute_iptables_compat(),"
4491 " network port label not found\n");
4492 return err;
4493 }
4494 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4495 }
4496
4497 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4498 int ifindex,
4499 struct avc_audit_data *ad,
4500 u16 family,
4501 char *addrp,
4502 u8 proto)
4503 {
4504 struct sock *sk = skb->sk;
4505 struct sk_security_struct *sksec;
4506
4507 if (sk == NULL)
4508 return NF_ACCEPT;
4509 sksec = sk->sk_security;
4510
4511 if (selinux_compat_net) {
4512 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4513 ad, family, addrp))
4514 return NF_DROP;
4515 } else {
4516 if (avc_has_perm(sksec->sid, skb->secmark,
4517 SECCLASS_PACKET, PACKET__SEND, ad))
4518 return NF_DROP;
4519 }
4520
4521 if (selinux_policycap_netpeer)
4522 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4523 return NF_DROP;
4524
4525 return NF_ACCEPT;
4526 }
4527
4528 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4529 u16 family)
4530 {
4531 u32 secmark_perm;
4532 u32 peer_sid;
4533 struct sock *sk;
4534 struct avc_audit_data ad;
4535 char *addrp;
4536 u8 proto;
4537 u8 secmark_active;
4538 u8 peerlbl_active;
4539
4540 AVC_AUDIT_DATA_INIT(&ad, NET);
4541 ad.u.net.netif = ifindex;
4542 ad.u.net.family = family;
4543 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4544 return NF_DROP;
4545
4546 /* If any sort of compatibility mode is enabled then handoff processing
4547 * to the selinux_ip_postroute_compat() function to deal with the
4548 * special handling. We do this in an attempt to keep this function
4549 * as fast and as clean as possible. */
4550 if (selinux_compat_net || !selinux_policycap_netpeer)
4551 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4552 family, addrp, proto);
4553
4554 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4555 * packet transformation so allow the packet to pass without any checks
4556 * since we'll have another chance to perform access control checks
4557 * when the packet is on it's final way out.
4558 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4559 * is NULL, in this case go ahead and apply access control. */
4560 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4561 return NF_ACCEPT;
4562
4563 secmark_active = selinux_secmark_enabled();
4564 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4565 if (!secmark_active && !peerlbl_active)
4566 return NF_ACCEPT;
4567
4568 /* if the packet is locally generated (skb->sk != NULL) then use the
4569 * socket's label as the peer label, otherwise the packet is being
4570 * forwarded through this system and we need to fetch the peer label
4571 * directly from the packet */
4572 sk = skb->sk;
4573 if (sk) {
4574 struct sk_security_struct *sksec = sk->sk_security;
4575 peer_sid = sksec->sid;
4576 secmark_perm = PACKET__SEND;
4577 } else {
4578 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4579 return NF_DROP;
4580 secmark_perm = PACKET__FORWARD_OUT;
4581 }
4582
4583 if (secmark_active)
4584 if (avc_has_perm(peer_sid, skb->secmark,
4585 SECCLASS_PACKET, secmark_perm, &ad))
4586 return NF_DROP;
4587
4588 if (peerlbl_active) {
4589 u32 if_sid;
4590 u32 node_sid;
4591
4592 if (sel_netif_sid(ifindex, &if_sid))
4593 return NF_DROP;
4594 if (avc_has_perm(peer_sid, if_sid,
4595 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4596 return NF_DROP;
4597
4598 if (sel_netnode_sid(addrp, family, &node_sid))
4599 return NF_DROP;
4600 if (avc_has_perm(peer_sid, node_sid,
4601 SECCLASS_NODE, NODE__SENDTO, &ad))
4602 return NF_DROP;
4603 }
4604
4605 return NF_ACCEPT;
4606 }
4607
4608 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4609 struct sk_buff *skb,
4610 const struct net_device *in,
4611 const struct net_device *out,
4612 int (*okfn)(struct sk_buff *))
4613 {
4614 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4615 }
4616
4617 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4618 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4619 struct sk_buff *skb,
4620 const struct net_device *in,
4621 const struct net_device *out,
4622 int (*okfn)(struct sk_buff *))
4623 {
4624 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4625 }
4626 #endif /* IPV6 */
4627
4628 #endif /* CONFIG_NETFILTER */
4629
4630 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4631 {
4632 int err;
4633
4634 err = secondary_ops->netlink_send(sk, skb);
4635 if (err)
4636 return err;
4637
4638 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4639 err = selinux_nlmsg_perm(sk, skb);
4640
4641 return err;
4642 }
4643
4644 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4645 {
4646 int err;
4647 struct avc_audit_data ad;
4648
4649 err = secondary_ops->netlink_recv(skb, capability);
4650 if (err)
4651 return err;
4652
4653 AVC_AUDIT_DATA_INIT(&ad, CAP);
4654 ad.u.cap = capability;
4655
4656 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4657 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4658 }
4659
4660 static int ipc_alloc_security(struct task_struct *task,
4661 struct kern_ipc_perm *perm,
4662 u16 sclass)
4663 {
4664 struct task_security_struct *tsec = task->security;
4665 struct ipc_security_struct *isec;
4666
4667 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4668 if (!isec)
4669 return -ENOMEM;
4670
4671 isec->sclass = sclass;
4672 isec->sid = tsec->sid;
4673 perm->security = isec;
4674
4675 return 0;
4676 }
4677
4678 static void ipc_free_security(struct kern_ipc_perm *perm)
4679 {
4680 struct ipc_security_struct *isec = perm->security;
4681 perm->security = NULL;
4682 kfree(isec);
4683 }
4684
4685 static int msg_msg_alloc_security(struct msg_msg *msg)
4686 {
4687 struct msg_security_struct *msec;
4688
4689 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4690 if (!msec)
4691 return -ENOMEM;
4692
4693 msec->sid = SECINITSID_UNLABELED;
4694 msg->security = msec;
4695
4696 return 0;
4697 }
4698
4699 static void msg_msg_free_security(struct msg_msg *msg)
4700 {
4701 struct msg_security_struct *msec = msg->security;
4702
4703 msg->security = NULL;
4704 kfree(msec);
4705 }
4706
4707 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4708 u32 perms)
4709 {
4710 struct task_security_struct *tsec;
4711 struct ipc_security_struct *isec;
4712 struct avc_audit_data ad;
4713
4714 tsec = current->security;
4715 isec = ipc_perms->security;
4716
4717 AVC_AUDIT_DATA_INIT(&ad, IPC);
4718 ad.u.ipc_id = ipc_perms->key;
4719
4720 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4721 }
4722
4723 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4724 {
4725 return msg_msg_alloc_security(msg);
4726 }
4727
4728 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4729 {
4730 msg_msg_free_security(msg);
4731 }
4732
4733 /* message queue security operations */
4734 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4735 {
4736 struct task_security_struct *tsec;
4737 struct ipc_security_struct *isec;
4738 struct avc_audit_data ad;
4739 int rc;
4740
4741 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4742 if (rc)
4743 return rc;
4744
4745 tsec = current->security;
4746 isec = msq->q_perm.security;
4747
4748 AVC_AUDIT_DATA_INIT(&ad, IPC);
4749 ad.u.ipc_id = msq->q_perm.key;
4750
4751 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4752 MSGQ__CREATE, &ad);
4753 if (rc) {
4754 ipc_free_security(&msq->q_perm);
4755 return rc;
4756 }
4757 return 0;
4758 }
4759
4760 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4761 {
4762 ipc_free_security(&msq->q_perm);
4763 }
4764
4765 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4766 {
4767 struct task_security_struct *tsec;
4768 struct ipc_security_struct *isec;
4769 struct avc_audit_data ad;
4770
4771 tsec = current->security;
4772 isec = msq->q_perm.security;
4773
4774 AVC_AUDIT_DATA_INIT(&ad, IPC);
4775 ad.u.ipc_id = msq->q_perm.key;
4776
4777 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4778 MSGQ__ASSOCIATE, &ad);
4779 }
4780
4781 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4782 {
4783 int err;
4784 int perms;
4785
4786 switch (cmd) {
4787 case IPC_INFO:
4788 case MSG_INFO:
4789 /* No specific object, just general system-wide information. */
4790 return task_has_system(current, SYSTEM__IPC_INFO);
4791 case IPC_STAT:
4792 case MSG_STAT:
4793 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4794 break;
4795 case IPC_SET:
4796 perms = MSGQ__SETATTR;
4797 break;
4798 case IPC_RMID:
4799 perms = MSGQ__DESTROY;
4800 break;
4801 default:
4802 return 0;
4803 }
4804
4805 err = ipc_has_perm(&msq->q_perm, perms);
4806 return err;
4807 }
4808
4809 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4810 {
4811 struct task_security_struct *tsec;
4812 struct ipc_security_struct *isec;
4813 struct msg_security_struct *msec;
4814 struct avc_audit_data ad;
4815 int rc;
4816
4817 tsec = current->security;
4818 isec = msq->q_perm.security;
4819 msec = msg->security;
4820
4821 /*
4822 * First time through, need to assign label to the message
4823 */
4824 if (msec->sid == SECINITSID_UNLABELED) {
4825 /*
4826 * Compute new sid based on current process and
4827 * message queue this message will be stored in
4828 */
4829 rc = security_transition_sid(tsec->sid,
4830 isec->sid,
4831 SECCLASS_MSG,
4832 &msec->sid);
4833 if (rc)
4834 return rc;
4835 }
4836
4837 AVC_AUDIT_DATA_INIT(&ad, IPC);
4838 ad.u.ipc_id = msq->q_perm.key;
4839
4840 /* Can this process write to the queue? */
4841 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4842 MSGQ__WRITE, &ad);
4843 if (!rc)
4844 /* Can this process send the message */
4845 rc = avc_has_perm(tsec->sid, msec->sid,
4846 SECCLASS_MSG, MSG__SEND, &ad);
4847 if (!rc)
4848 /* Can the message be put in the queue? */
4849 rc = avc_has_perm(msec->sid, isec->sid,
4850 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4851
4852 return rc;
4853 }
4854
4855 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4856 struct task_struct *target,
4857 long type, int mode)
4858 {
4859 struct task_security_struct *tsec;
4860 struct ipc_security_struct *isec;
4861 struct msg_security_struct *msec;
4862 struct avc_audit_data ad;
4863 int rc;
4864
4865 tsec = target->security;
4866 isec = msq->q_perm.security;
4867 msec = msg->security;
4868
4869 AVC_AUDIT_DATA_INIT(&ad, IPC);
4870 ad.u.ipc_id = msq->q_perm.key;
4871
4872 rc = avc_has_perm(tsec->sid, isec->sid,
4873 SECCLASS_MSGQ, MSGQ__READ, &ad);
4874 if (!rc)
4875 rc = avc_has_perm(tsec->sid, msec->sid,
4876 SECCLASS_MSG, MSG__RECEIVE, &ad);
4877 return rc;
4878 }
4879
4880 /* Shared Memory security operations */
4881 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4882 {
4883 struct task_security_struct *tsec;
4884 struct ipc_security_struct *isec;
4885 struct avc_audit_data ad;
4886 int rc;
4887
4888 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4889 if (rc)
4890 return rc;
4891
4892 tsec = current->security;
4893 isec = shp->shm_perm.security;
4894
4895 AVC_AUDIT_DATA_INIT(&ad, IPC);
4896 ad.u.ipc_id = shp->shm_perm.key;
4897
4898 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4899 SHM__CREATE, &ad);
4900 if (rc) {
4901 ipc_free_security(&shp->shm_perm);
4902 return rc;
4903 }
4904 return 0;
4905 }
4906
4907 static void selinux_shm_free_security(struct shmid_kernel *shp)
4908 {
4909 ipc_free_security(&shp->shm_perm);
4910 }
4911
4912 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4913 {
4914 struct task_security_struct *tsec;
4915 struct ipc_security_struct *isec;
4916 struct avc_audit_data ad;
4917
4918 tsec = current->security;
4919 isec = shp->shm_perm.security;
4920
4921 AVC_AUDIT_DATA_INIT(&ad, IPC);
4922 ad.u.ipc_id = shp->shm_perm.key;
4923
4924 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4925 SHM__ASSOCIATE, &ad);
4926 }
4927
4928 /* Note, at this point, shp is locked down */
4929 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4930 {
4931 int perms;
4932 int err;
4933
4934 switch (cmd) {
4935 case IPC_INFO:
4936 case SHM_INFO:
4937 /* No specific object, just general system-wide information. */
4938 return task_has_system(current, SYSTEM__IPC_INFO);
4939 case IPC_STAT:
4940 case SHM_STAT:
4941 perms = SHM__GETATTR | SHM__ASSOCIATE;
4942 break;
4943 case IPC_SET:
4944 perms = SHM__SETATTR;
4945 break;
4946 case SHM_LOCK:
4947 case SHM_UNLOCK:
4948 perms = SHM__LOCK;
4949 break;
4950 case IPC_RMID:
4951 perms = SHM__DESTROY;
4952 break;
4953 default:
4954 return 0;
4955 }
4956
4957 err = ipc_has_perm(&shp->shm_perm, perms);
4958 return err;
4959 }
4960
4961 static int selinux_shm_shmat(struct shmid_kernel *shp,
4962 char __user *shmaddr, int shmflg)
4963 {
4964 u32 perms;
4965 int rc;
4966
4967 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4968 if (rc)
4969 return rc;
4970
4971 if (shmflg & SHM_RDONLY)
4972 perms = SHM__READ;
4973 else
4974 perms = SHM__READ | SHM__WRITE;
4975
4976 return ipc_has_perm(&shp->shm_perm, perms);
4977 }
4978
4979 /* Semaphore security operations */
4980 static int selinux_sem_alloc_security(struct sem_array *sma)
4981 {
4982 struct task_security_struct *tsec;
4983 struct ipc_security_struct *isec;
4984 struct avc_audit_data ad;
4985 int rc;
4986
4987 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4988 if (rc)
4989 return rc;
4990
4991 tsec = current->security;
4992 isec = sma->sem_perm.security;
4993
4994 AVC_AUDIT_DATA_INIT(&ad, IPC);
4995 ad.u.ipc_id = sma->sem_perm.key;
4996
4997 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4998 SEM__CREATE, &ad);
4999 if (rc) {
5000 ipc_free_security(&sma->sem_perm);
5001 return rc;
5002 }
5003 return 0;
5004 }
5005
5006 static void selinux_sem_free_security(struct sem_array *sma)
5007 {
5008 ipc_free_security(&sma->sem_perm);
5009 }
5010
5011 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5012 {
5013 struct task_security_struct *tsec;
5014 struct ipc_security_struct *isec;
5015 struct avc_audit_data ad;
5016
5017 tsec = current->security;
5018 isec = sma->sem_perm.security;
5019
5020 AVC_AUDIT_DATA_INIT(&ad, IPC);
5021 ad.u.ipc_id = sma->sem_perm.key;
5022
5023 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5024 SEM__ASSOCIATE, &ad);
5025 }
5026
5027 /* Note, at this point, sma is locked down */
5028 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5029 {
5030 int err;
5031 u32 perms;
5032
5033 switch (cmd) {
5034 case IPC_INFO:
5035 case SEM_INFO:
5036 /* No specific object, just general system-wide information. */
5037 return task_has_system(current, SYSTEM__IPC_INFO);
5038 case GETPID:
5039 case GETNCNT:
5040 case GETZCNT:
5041 perms = SEM__GETATTR;
5042 break;
5043 case GETVAL:
5044 case GETALL:
5045 perms = SEM__READ;
5046 break;
5047 case SETVAL:
5048 case SETALL:
5049 perms = SEM__WRITE;
5050 break;
5051 case IPC_RMID:
5052 perms = SEM__DESTROY;
5053 break;
5054 case IPC_SET:
5055 perms = SEM__SETATTR;
5056 break;
5057 case IPC_STAT:
5058 case SEM_STAT:
5059 perms = SEM__GETATTR | SEM__ASSOCIATE;
5060 break;
5061 default:
5062 return 0;
5063 }
5064
5065 err = ipc_has_perm(&sma->sem_perm, perms);
5066 return err;
5067 }
5068
5069 static int selinux_sem_semop(struct sem_array *sma,
5070 struct sembuf *sops, unsigned nsops, int alter)
5071 {
5072 u32 perms;
5073
5074 if (alter)
5075 perms = SEM__READ | SEM__WRITE;
5076 else
5077 perms = SEM__READ;
5078
5079 return ipc_has_perm(&sma->sem_perm, perms);
5080 }
5081
5082 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5083 {
5084 u32 av = 0;
5085
5086 av = 0;
5087 if (flag & S_IRUGO)
5088 av |= IPC__UNIX_READ;
5089 if (flag & S_IWUGO)
5090 av |= IPC__UNIX_WRITE;
5091
5092 if (av == 0)
5093 return 0;
5094
5095 return ipc_has_perm(ipcp, av);
5096 }
5097
5098 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5099 {
5100 struct ipc_security_struct *isec = ipcp->security;
5101 *secid = isec->sid;
5102 }
5103
5104 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5105 {
5106 if (inode)
5107 inode_doinit_with_dentry(inode, dentry);
5108 }
5109
5110 static int selinux_getprocattr(struct task_struct *p,
5111 char *name, char **value)
5112 {
5113 struct task_security_struct *tsec;
5114 u32 sid;
5115 int error;
5116 unsigned len;
5117
5118 if (current != p) {
5119 error = task_has_perm(current, p, PROCESS__GETATTR);
5120 if (error)
5121 return error;
5122 }
5123
5124 tsec = p->security;
5125
5126 if (!strcmp(name, "current"))
5127 sid = tsec->sid;
5128 else if (!strcmp(name, "prev"))
5129 sid = tsec->osid;
5130 else if (!strcmp(name, "exec"))
5131 sid = tsec->exec_sid;
5132 else if (!strcmp(name, "fscreate"))
5133 sid = tsec->create_sid;
5134 else if (!strcmp(name, "keycreate"))
5135 sid = tsec->keycreate_sid;
5136 else if (!strcmp(name, "sockcreate"))
5137 sid = tsec->sockcreate_sid;
5138 else
5139 return -EINVAL;
5140
5141 if (!sid)
5142 return 0;
5143
5144 error = security_sid_to_context(sid, value, &len);
5145 if (error)
5146 return error;
5147 return len;
5148 }
5149
5150 static int selinux_setprocattr(struct task_struct *p,
5151 char *name, void *value, size_t size)
5152 {
5153 struct task_security_struct *tsec;
5154 struct task_struct *tracer;
5155 u32 sid = 0;
5156 int error;
5157 char *str = value;
5158
5159 if (current != p) {
5160 /* SELinux only allows a process to change its own
5161 security attributes. */
5162 return -EACCES;
5163 }
5164
5165 /*
5166 * Basic control over ability to set these attributes at all.
5167 * current == p, but we'll pass them separately in case the
5168 * above restriction is ever removed.
5169 */
5170 if (!strcmp(name, "exec"))
5171 error = task_has_perm(current, p, PROCESS__SETEXEC);
5172 else if (!strcmp(name, "fscreate"))
5173 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5174 else if (!strcmp(name, "keycreate"))
5175 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5176 else if (!strcmp(name, "sockcreate"))
5177 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5178 else if (!strcmp(name, "current"))
5179 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5180 else
5181 error = -EINVAL;
5182 if (error)
5183 return error;
5184
5185 /* Obtain a SID for the context, if one was specified. */
5186 if (size && str[1] && str[1] != '\n') {
5187 if (str[size-1] == '\n') {
5188 str[size-1] = 0;
5189 size--;
5190 }
5191 error = security_context_to_sid(value, size, &sid);
5192 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5193 if (!capable(CAP_MAC_ADMIN))
5194 return error;
5195 error = security_context_to_sid_force(value, size,
5196 &sid);
5197 }
5198 if (error)
5199 return error;
5200 }
5201
5202 /* Permission checking based on the specified context is
5203 performed during the actual operation (execve,
5204 open/mkdir/...), when we know the full context of the
5205 operation. See selinux_bprm_set_security for the execve
5206 checks and may_create for the file creation checks. The
5207 operation will then fail if the context is not permitted. */
5208 tsec = p->security;
5209 if (!strcmp(name, "exec"))
5210 tsec->exec_sid = sid;
5211 else if (!strcmp(name, "fscreate"))
5212 tsec->create_sid = sid;
5213 else if (!strcmp(name, "keycreate")) {
5214 error = may_create_key(sid, p);
5215 if (error)
5216 return error;
5217 tsec->keycreate_sid = sid;
5218 } else if (!strcmp(name, "sockcreate"))
5219 tsec->sockcreate_sid = sid;
5220 else if (!strcmp(name, "current")) {
5221 struct av_decision avd;
5222
5223 if (sid == 0)
5224 return -EINVAL;
5225
5226 /* Only allow single threaded processes to change context */
5227 if (atomic_read(&p->mm->mm_users) != 1) {
5228 struct task_struct *g, *t;
5229 struct mm_struct *mm = p->mm;
5230 read_lock(&tasklist_lock);
5231 do_each_thread(g, t) {
5232 if (t->mm == mm && t != p) {
5233 read_unlock(&tasklist_lock);
5234 return -EPERM;
5235 }
5236 } while_each_thread(g, t);
5237 read_unlock(&tasklist_lock);
5238 }
5239
5240 /* Check permissions for the transition. */
5241 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5242 PROCESS__DYNTRANSITION, NULL);
5243 if (error)
5244 return error;
5245
5246 /* Check for ptracing, and update the task SID if ok.
5247 Otherwise, leave SID unchanged and fail. */
5248 task_lock(p);
5249 rcu_read_lock();
5250 tracer = task_tracer_task(p);
5251 if (tracer != NULL) {
5252 struct task_security_struct *ptsec = tracer->security;
5253 u32 ptsid = ptsec->sid;
5254 rcu_read_unlock();
5255 error = avc_has_perm_noaudit(ptsid, sid,
5256 SECCLASS_PROCESS,
5257 PROCESS__PTRACE, 0, &avd);
5258 if (!error)
5259 tsec->sid = sid;
5260 task_unlock(p);
5261 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5262 PROCESS__PTRACE, &avd, error, NULL);
5263 if (error)
5264 return error;
5265 } else {
5266 rcu_read_unlock();
5267 tsec->sid = sid;
5268 task_unlock(p);
5269 }
5270 } else
5271 return -EINVAL;
5272
5273 return size;
5274 }
5275
5276 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5277 {
5278 return security_sid_to_context(secid, secdata, seclen);
5279 }
5280
5281 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5282 {
5283 return security_context_to_sid(secdata, seclen, secid);
5284 }
5285
5286 static void selinux_release_secctx(char *secdata, u32 seclen)
5287 {
5288 kfree(secdata);
5289 }
5290
5291 #ifdef CONFIG_KEYS
5292
5293 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5294 unsigned long flags)
5295 {
5296 struct task_security_struct *tsec = tsk->security;
5297 struct key_security_struct *ksec;
5298
5299 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5300 if (!ksec)
5301 return -ENOMEM;
5302
5303 if (tsec->keycreate_sid)
5304 ksec->sid = tsec->keycreate_sid;
5305 else
5306 ksec->sid = tsec->sid;
5307 k->security = ksec;
5308
5309 return 0;
5310 }
5311
5312 static void selinux_key_free(struct key *k)
5313 {
5314 struct key_security_struct *ksec = k->security;
5315
5316 k->security = NULL;
5317 kfree(ksec);
5318 }
5319
5320 static int selinux_key_permission(key_ref_t key_ref,
5321 struct task_struct *ctx,
5322 key_perm_t perm)
5323 {
5324 struct key *key;
5325 struct task_security_struct *tsec;
5326 struct key_security_struct *ksec;
5327
5328 key = key_ref_to_ptr(key_ref);
5329
5330 tsec = ctx->security;
5331 ksec = key->security;
5332
5333 /* if no specific permissions are requested, we skip the
5334 permission check. No serious, additional covert channels
5335 appear to be created. */
5336 if (perm == 0)
5337 return 0;
5338
5339 return avc_has_perm(tsec->sid, ksec->sid,
5340 SECCLASS_KEY, perm, NULL);
5341 }
5342
5343 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5344 {
5345 struct key_security_struct *ksec = key->security;
5346 char *context = NULL;
5347 unsigned len;
5348 int rc;
5349
5350 rc = security_sid_to_context(ksec->sid, &context, &len);
5351 if (!rc)
5352 rc = len;
5353 *_buffer = context;
5354 return rc;
5355 }
5356
5357 #endif
5358
5359 static struct security_operations selinux_ops = {
5360 .name = "selinux",
5361
5362 .ptrace = selinux_ptrace,
5363 .capget = selinux_capget,
5364 .capset_check = selinux_capset_check,
5365 .capset_set = selinux_capset_set,
5366 .sysctl = selinux_sysctl,
5367 .capable = selinux_capable,
5368 .quotactl = selinux_quotactl,
5369 .quota_on = selinux_quota_on,
5370 .syslog = selinux_syslog,
5371 .vm_enough_memory = selinux_vm_enough_memory,
5372
5373 .netlink_send = selinux_netlink_send,
5374 .netlink_recv = selinux_netlink_recv,
5375
5376 .bprm_alloc_security = selinux_bprm_alloc_security,
5377 .bprm_free_security = selinux_bprm_free_security,
5378 .bprm_apply_creds = selinux_bprm_apply_creds,
5379 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5380 .bprm_set_security = selinux_bprm_set_security,
5381 .bprm_check_security = selinux_bprm_check_security,
5382 .bprm_secureexec = selinux_bprm_secureexec,
5383
5384 .sb_alloc_security = selinux_sb_alloc_security,
5385 .sb_free_security = selinux_sb_free_security,
5386 .sb_copy_data = selinux_sb_copy_data,
5387 .sb_kern_mount = selinux_sb_kern_mount,
5388 .sb_show_options = selinux_sb_show_options,
5389 .sb_statfs = selinux_sb_statfs,
5390 .sb_mount = selinux_mount,
5391 .sb_umount = selinux_umount,
5392 .sb_set_mnt_opts = selinux_set_mnt_opts,
5393 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5394 .sb_parse_opts_str = selinux_parse_opts_str,
5395
5396
5397 .inode_alloc_security = selinux_inode_alloc_security,
5398 .inode_free_security = selinux_inode_free_security,
5399 .inode_init_security = selinux_inode_init_security,
5400 .inode_create = selinux_inode_create,
5401 .inode_link = selinux_inode_link,
5402 .inode_unlink = selinux_inode_unlink,
5403 .inode_symlink = selinux_inode_symlink,
5404 .inode_mkdir = selinux_inode_mkdir,
5405 .inode_rmdir = selinux_inode_rmdir,
5406 .inode_mknod = selinux_inode_mknod,
5407 .inode_rename = selinux_inode_rename,
5408 .inode_readlink = selinux_inode_readlink,
5409 .inode_follow_link = selinux_inode_follow_link,
5410 .inode_permission = selinux_inode_permission,
5411 .inode_setattr = selinux_inode_setattr,
5412 .inode_getattr = selinux_inode_getattr,
5413 .inode_setxattr = selinux_inode_setxattr,
5414 .inode_post_setxattr = selinux_inode_post_setxattr,
5415 .inode_getxattr = selinux_inode_getxattr,
5416 .inode_listxattr = selinux_inode_listxattr,
5417 .inode_removexattr = selinux_inode_removexattr,
5418 .inode_getsecurity = selinux_inode_getsecurity,
5419 .inode_setsecurity = selinux_inode_setsecurity,
5420 .inode_listsecurity = selinux_inode_listsecurity,
5421 .inode_need_killpriv = selinux_inode_need_killpriv,
5422 .inode_killpriv = selinux_inode_killpriv,
5423 .inode_getsecid = selinux_inode_getsecid,
5424
5425 .file_permission = selinux_file_permission,
5426 .file_alloc_security = selinux_file_alloc_security,
5427 .file_free_security = selinux_file_free_security,
5428 .file_ioctl = selinux_file_ioctl,
5429 .file_mmap = selinux_file_mmap,
5430 .file_mprotect = selinux_file_mprotect,
5431 .file_lock = selinux_file_lock,
5432 .file_fcntl = selinux_file_fcntl,
5433 .file_set_fowner = selinux_file_set_fowner,
5434 .file_send_sigiotask = selinux_file_send_sigiotask,
5435 .file_receive = selinux_file_receive,
5436
5437 .dentry_open = selinux_dentry_open,
5438
5439 .task_create = selinux_task_create,
5440 .task_alloc_security = selinux_task_alloc_security,
5441 .task_free_security = selinux_task_free_security,
5442 .task_setuid = selinux_task_setuid,
5443 .task_post_setuid = selinux_task_post_setuid,
5444 .task_setgid = selinux_task_setgid,
5445 .task_setpgid = selinux_task_setpgid,
5446 .task_getpgid = selinux_task_getpgid,
5447 .task_getsid = selinux_task_getsid,
5448 .task_getsecid = selinux_task_getsecid,
5449 .task_setgroups = selinux_task_setgroups,
5450 .task_setnice = selinux_task_setnice,
5451 .task_setioprio = selinux_task_setioprio,
5452 .task_getioprio = selinux_task_getioprio,
5453 .task_setrlimit = selinux_task_setrlimit,
5454 .task_setscheduler = selinux_task_setscheduler,
5455 .task_getscheduler = selinux_task_getscheduler,
5456 .task_movememory = selinux_task_movememory,
5457 .task_kill = selinux_task_kill,
5458 .task_wait = selinux_task_wait,
5459 .task_prctl = selinux_task_prctl,
5460 .task_reparent_to_init = selinux_task_reparent_to_init,
5461 .task_to_inode = selinux_task_to_inode,
5462
5463 .ipc_permission = selinux_ipc_permission,
5464 .ipc_getsecid = selinux_ipc_getsecid,
5465
5466 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5467 .msg_msg_free_security = selinux_msg_msg_free_security,
5468
5469 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5470 .msg_queue_free_security = selinux_msg_queue_free_security,
5471 .msg_queue_associate = selinux_msg_queue_associate,
5472 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5473 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5474 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5475
5476 .shm_alloc_security = selinux_shm_alloc_security,
5477 .shm_free_security = selinux_shm_free_security,
5478 .shm_associate = selinux_shm_associate,
5479 .shm_shmctl = selinux_shm_shmctl,
5480 .shm_shmat = selinux_shm_shmat,
5481
5482 .sem_alloc_security = selinux_sem_alloc_security,
5483 .sem_free_security = selinux_sem_free_security,
5484 .sem_associate = selinux_sem_associate,
5485 .sem_semctl = selinux_sem_semctl,
5486 .sem_semop = selinux_sem_semop,
5487
5488 .d_instantiate = selinux_d_instantiate,
5489
5490 .getprocattr = selinux_getprocattr,
5491 .setprocattr = selinux_setprocattr,
5492
5493 .secid_to_secctx = selinux_secid_to_secctx,
5494 .secctx_to_secid = selinux_secctx_to_secid,
5495 .release_secctx = selinux_release_secctx,
5496
5497 .unix_stream_connect = selinux_socket_unix_stream_connect,
5498 .unix_may_send = selinux_socket_unix_may_send,
5499
5500 .socket_create = selinux_socket_create,
5501 .socket_post_create = selinux_socket_post_create,
5502 .socket_bind = selinux_socket_bind,
5503 .socket_connect = selinux_socket_connect,
5504 .socket_listen = selinux_socket_listen,
5505 .socket_accept = selinux_socket_accept,
5506 .socket_sendmsg = selinux_socket_sendmsg,
5507 .socket_recvmsg = selinux_socket_recvmsg,
5508 .socket_getsockname = selinux_socket_getsockname,
5509 .socket_getpeername = selinux_socket_getpeername,
5510 .socket_getsockopt = selinux_socket_getsockopt,
5511 .socket_setsockopt = selinux_socket_setsockopt,
5512 .socket_shutdown = selinux_socket_shutdown,
5513 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5514 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5515 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5516 .sk_alloc_security = selinux_sk_alloc_security,
5517 .sk_free_security = selinux_sk_free_security,
5518 .sk_clone_security = selinux_sk_clone_security,
5519 .sk_getsecid = selinux_sk_getsecid,
5520 .sock_graft = selinux_sock_graft,
5521 .inet_conn_request = selinux_inet_conn_request,
5522 .inet_csk_clone = selinux_inet_csk_clone,
5523 .inet_conn_established = selinux_inet_conn_established,
5524 .req_classify_flow = selinux_req_classify_flow,
5525
5526 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5527 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5528 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5529 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5530 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5531 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5532 .xfrm_state_free_security = selinux_xfrm_state_free,
5533 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5534 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5535 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5536 .xfrm_decode_session = selinux_xfrm_decode_session,
5537 #endif
5538
5539 #ifdef CONFIG_KEYS
5540 .key_alloc = selinux_key_alloc,
5541 .key_free = selinux_key_free,
5542 .key_permission = selinux_key_permission,
5543 .key_getsecurity = selinux_key_getsecurity,
5544 #endif
5545
5546 #ifdef CONFIG_AUDIT
5547 .audit_rule_init = selinux_audit_rule_init,
5548 .audit_rule_known = selinux_audit_rule_known,
5549 .audit_rule_match = selinux_audit_rule_match,
5550 .audit_rule_free = selinux_audit_rule_free,
5551 #endif
5552 };
5553
5554 static __init int selinux_init(void)
5555 {
5556 struct task_security_struct *tsec;
5557
5558 if (!security_module_enable(&selinux_ops)) {
5559 selinux_enabled = 0;
5560 return 0;
5561 }
5562
5563 if (!selinux_enabled) {
5564 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5565 return 0;
5566 }
5567
5568 printk(KERN_INFO "SELinux: Initializing.\n");
5569
5570 /* Set the security state for the initial task. */
5571 if (task_alloc_security(current))
5572 panic("SELinux: Failed to initialize initial task.\n");
5573 tsec = current->security;
5574 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5575
5576 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5577 sizeof(struct inode_security_struct),
5578 0, SLAB_PANIC, NULL);
5579 avc_init();
5580
5581 secondary_ops = security_ops;
5582 if (!secondary_ops)
5583 panic("SELinux: No initial security operations\n");
5584 if (register_security(&selinux_ops))
5585 panic("SELinux: Unable to register with kernel.\n");
5586
5587 if (selinux_enforcing)
5588 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5589 else
5590 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5591
5592 return 0;
5593 }
5594
5595 void selinux_complete_init(void)
5596 {
5597 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5598
5599 /* Set up any superblocks initialized prior to the policy load. */
5600 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5601 spin_lock(&sb_lock);
5602 spin_lock(&sb_security_lock);
5603 next_sb:
5604 if (!list_empty(&superblock_security_head)) {
5605 struct superblock_security_struct *sbsec =
5606 list_entry(superblock_security_head.next,
5607 struct superblock_security_struct,
5608 list);
5609 struct super_block *sb = sbsec->sb;
5610 sb->s_count++;
5611 spin_unlock(&sb_security_lock);
5612 spin_unlock(&sb_lock);
5613 down_read(&sb->s_umount);
5614 if (sb->s_root)
5615 superblock_doinit(sb, NULL);
5616 drop_super(sb);
5617 spin_lock(&sb_lock);
5618 spin_lock(&sb_security_lock);
5619 list_del_init(&sbsec->list);
5620 goto next_sb;
5621 }
5622 spin_unlock(&sb_security_lock);
5623 spin_unlock(&sb_lock);
5624 }
5625
5626 /* SELinux requires early initialization in order to label
5627 all processes and objects when they are created. */
5628 security_initcall(selinux_init);
5629
5630 #if defined(CONFIG_NETFILTER)
5631
5632 static struct nf_hook_ops selinux_ipv4_ops[] = {
5633 {
5634 .hook = selinux_ipv4_postroute,
5635 .owner = THIS_MODULE,
5636 .pf = PF_INET,
5637 .hooknum = NF_INET_POST_ROUTING,
5638 .priority = NF_IP_PRI_SELINUX_LAST,
5639 },
5640 {
5641 .hook = selinux_ipv4_forward,
5642 .owner = THIS_MODULE,
5643 .pf = PF_INET,
5644 .hooknum = NF_INET_FORWARD,
5645 .priority = NF_IP_PRI_SELINUX_FIRST,
5646 }
5647 };
5648
5649 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5650
5651 static struct nf_hook_ops selinux_ipv6_ops[] = {
5652 {
5653 .hook = selinux_ipv6_postroute,
5654 .owner = THIS_MODULE,
5655 .pf = PF_INET6,
5656 .hooknum = NF_INET_POST_ROUTING,
5657 .priority = NF_IP6_PRI_SELINUX_LAST,
5658 },
5659 {
5660 .hook = selinux_ipv6_forward,
5661 .owner = THIS_MODULE,
5662 .pf = PF_INET6,
5663 .hooknum = NF_INET_FORWARD,
5664 .priority = NF_IP6_PRI_SELINUX_FIRST,
5665 }
5666 };
5667
5668 #endif /* IPV6 */
5669
5670 static int __init selinux_nf_ip_init(void)
5671 {
5672 int err = 0;
5673 u32 iter;
5674
5675 if (!selinux_enabled)
5676 goto out;
5677
5678 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5679
5680 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5681 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5682 if (err)
5683 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5684 err);
5685 }
5686
5687 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5688 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5689 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5690 if (err)
5691 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5692 err);
5693 }
5694 #endif /* IPV6 */
5695
5696 out:
5697 return err;
5698 }
5699
5700 __initcall(selinux_nf_ip_init);
5701
5702 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5703 static void selinux_nf_ip_exit(void)
5704 {
5705 u32 iter;
5706
5707 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5708
5709 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5710 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5711 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5712 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5713 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5714 #endif /* IPV6 */
5715 }
5716 #endif
5717
5718 #else /* CONFIG_NETFILTER */
5719
5720 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5721 #define selinux_nf_ip_exit()
5722 #endif
5723
5724 #endif /* CONFIG_NETFILTER */
5725
5726 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5727 static int selinux_disabled;
5728
5729 int selinux_disable(void)
5730 {
5731 extern void exit_sel_fs(void);
5732
5733 if (ss_initialized) {
5734 /* Not permitted after initial policy load. */
5735 return -EINVAL;
5736 }
5737
5738 if (selinux_disabled) {
5739 /* Only do this once. */
5740 return -EINVAL;
5741 }
5742
5743 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5744
5745 selinux_disabled = 1;
5746 selinux_enabled = 0;
5747
5748 /* Reset security_ops to the secondary module, dummy or capability. */
5749 security_ops = secondary_ops;
5750
5751 /* Unregister netfilter hooks. */
5752 selinux_nf_ip_exit();
5753
5754 /* Unregister selinuxfs. */
5755 exit_sel_fs();
5756
5757 return 0;
5758 }
5759 #endif
Linux kernel - Deliverables
This page took 0.145966 seconds and 6 git commands to generate.