projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'tpmdd-next-20160902' into next
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
86
87 #include "avc.h"
88 #include "objsec.h"
89 #include "netif.h"
90 #include "netnode.h"
91 #include "netport.h"
92 #include "xfrm.h"
93 #include "netlabel.h"
94 #include "audit.h"
95 #include "avc_ss.h"
96
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102
103 static int __init enforcing_setup(char *str)
104 {
105 unsigned long enforcing;
106 if (!kstrtoul(str, 0, &enforcing))
107 selinux_enforcing = enforcing ? 1 : 0;
108 return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116 static int __init selinux_enabled_setup(char *str)
117 {
118 unsigned long enabled;
119 if (!kstrtoul(str, 0, &enabled))
120 selinux_enabled = enabled ? 1 : 0;
121 return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127
128 static struct kmem_cache *sel_inode_cache;
129 static struct kmem_cache *file_security_cache;
130
131 /**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
140 *
141 */
142 static int selinux_secmark_enabled(void)
143 {
144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
145 }
146
147 /**
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
149 *
150 * Description:
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
155 *
156 */
157 static int selinux_peerlbl_enabled(void)
158 {
159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
160 }
161
162 static int selinux_netcache_avc_callback(u32 event)
163 {
164 if (event == AVC_CALLBACK_RESET) {
165 sel_netif_flush();
166 sel_netnode_flush();
167 sel_netport_flush();
168 synchronize_net();
169 }
170 return 0;
171 }
172
173 /*
174 * initialise the security for the init task
175 */
176 static void cred_init_security(void)
177 {
178 struct cred *cred = (struct cred *) current->real_cred;
179 struct task_security_struct *tsec;
180
181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
182 if (!tsec)
183 panic("SELinux: Failed to initialize initial task.\n");
184
185 tsec->osid = tsec->sid = SECINITSID_KERNEL;
186 cred->security = tsec;
187 }
188
189 /*
190 * get the security ID of a set of credentials
191 */
192 static inline u32 cred_sid(const struct cred *cred)
193 {
194 const struct task_security_struct *tsec;
195
196 tsec = cred->security;
197 return tsec->sid;
198 }
199
200 /*
201 * get the objective security ID of a task
202 */
203 static inline u32 task_sid(const struct task_struct *task)
204 {
205 u32 sid;
206
207 rcu_read_lock();
208 sid = cred_sid(__task_cred(task));
209 rcu_read_unlock();
210 return sid;
211 }
212
213 /*
214 * get the subjective security ID of the current task
215 */
216 static inline u32 current_sid(void)
217 {
218 const struct task_security_struct *tsec = current_security();
219
220 return tsec->sid;
221 }
222
223 /* Allocate and free functions for each kind of security blob. */
224
225 static int inode_alloc_security(struct inode *inode)
226 {
227 struct inode_security_struct *isec;
228 u32 sid = current_sid();
229
230 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
231 if (!isec)
232 return -ENOMEM;
233
234 mutex_init(&isec->lock);
235 INIT_LIST_HEAD(&isec->list);
236 isec->inode = inode;
237 isec->sid = SECINITSID_UNLABELED;
238 isec->sclass = SECCLASS_FILE;
239 isec->task_sid = sid;
240 inode->i_security = isec;
241
242 return 0;
243 }
244
245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
246
247 /*
248 * Try reloading inode security labels that have been marked as invalid. The
249 * @may_sleep parameter indicates when sleeping and thus reloading labels is
250 * allowed; when set to false, returns ERR_PTR(-ECHILD) when the label is
251 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
252 * when no dentry is available, set it to NULL instead.
253 */
254 static int __inode_security_revalidate(struct inode *inode,
255 struct dentry *opt_dentry,
256 bool may_sleep)
257 {
258 struct inode_security_struct *isec = inode->i_security;
259
260 might_sleep_if(may_sleep);
261
262 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
263 if (!may_sleep)
264 return -ECHILD;
265
266 /*
267 * Try reloading the inode security label. This will fail if
268 * @opt_dentry is NULL and no dentry for this inode can be
269 * found; in that case, continue using the old label.
270 */
271 inode_doinit_with_dentry(inode, opt_dentry);
272 }
273 return 0;
274 }
275
276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
277 {
278 return inode->i_security;
279 }
280
281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
282 {
283 int error;
284
285 error = __inode_security_revalidate(inode, NULL, !rcu);
286 if (error)
287 return ERR_PTR(error);
288 return inode->i_security;
289 }
290
291 /*
292 * Get the security label of an inode.
293 */
294 static struct inode_security_struct *inode_security(struct inode *inode)
295 {
296 __inode_security_revalidate(inode, NULL, true);
297 return inode->i_security;
298 }
299
300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
301 {
302 struct inode *inode = d_backing_inode(dentry);
303
304 return inode->i_security;
305 }
306
307 /*
308 * Get the security label of a dentry's backing inode.
309 */
310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
311 {
312 struct inode *inode = d_backing_inode(dentry);
313
314 __inode_security_revalidate(inode, dentry, true);
315 return inode->i_security;
316 }
317
318 static void inode_free_rcu(struct rcu_head *head)
319 {
320 struct inode_security_struct *isec;
321
322 isec = container_of(head, struct inode_security_struct, rcu);
323 kmem_cache_free(sel_inode_cache, isec);
324 }
325
326 static void inode_free_security(struct inode *inode)
327 {
328 struct inode_security_struct *isec = inode->i_security;
329 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
330
331 /*
332 * As not all inode security structures are in a list, we check for
333 * empty list outside of the lock to make sure that we won't waste
334 * time taking a lock doing nothing.
335 *
336 * The list_del_init() function can be safely called more than once.
337 * It should not be possible for this function to be called with
338 * concurrent list_add(), but for better safety against future changes
339 * in the code, we use list_empty_careful() here.
340 */
341 if (!list_empty_careful(&isec->list)) {
342 spin_lock(&sbsec->isec_lock);
343 list_del_init(&isec->list);
344 spin_unlock(&sbsec->isec_lock);
345 }
346
347 /*
348 * The inode may still be referenced in a path walk and
349 * a call to selinux_inode_permission() can be made
350 * after inode_free_security() is called. Ideally, the VFS
351 * wouldn't do this, but fixing that is a much harder
352 * job. For now, simply free the i_security via RCU, and
353 * leave the current inode->i_security pointer intact.
354 * The inode will be freed after the RCU grace period too.
355 */
356 call_rcu(&isec->rcu, inode_free_rcu);
357 }
358
359 static int file_alloc_security(struct file *file)
360 {
361 struct file_security_struct *fsec;
362 u32 sid = current_sid();
363
364 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
365 if (!fsec)
366 return -ENOMEM;
367
368 fsec->sid = sid;
369 fsec->fown_sid = sid;
370 file->f_security = fsec;
371
372 return 0;
373 }
374
375 static void file_free_security(struct file *file)
376 {
377 struct file_security_struct *fsec = file->f_security;
378 file->f_security = NULL;
379 kmem_cache_free(file_security_cache, fsec);
380 }
381
382 static int superblock_alloc_security(struct super_block *sb)
383 {
384 struct superblock_security_struct *sbsec;
385
386 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
387 if (!sbsec)
388 return -ENOMEM;
389
390 mutex_init(&sbsec->lock);
391 INIT_LIST_HEAD(&sbsec->isec_head);
392 spin_lock_init(&sbsec->isec_lock);
393 sbsec->sb = sb;
394 sbsec->sid = SECINITSID_UNLABELED;
395 sbsec->def_sid = SECINITSID_FILE;
396 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
397 sb->s_security = sbsec;
398
399 return 0;
400 }
401
402 static void superblock_free_security(struct super_block *sb)
403 {
404 struct superblock_security_struct *sbsec = sb->s_security;
405 sb->s_security = NULL;
406 kfree(sbsec);
407 }
408
409 /* The file system's label must be initialized prior to use. */
410
411 static const char *labeling_behaviors[7] = {
412 "uses xattr",
413 "uses transition SIDs",
414 "uses task SIDs",
415 "uses genfs_contexts",
416 "not configured for labeling",
417 "uses mountpoint labeling",
418 "uses native labeling",
419 };
420
421 static inline int inode_doinit(struct inode *inode)
422 {
423 return inode_doinit_with_dentry(inode, NULL);
424 }
425
426 enum {
427 Opt_error = -1,
428 Opt_context = 1,
429 Opt_fscontext = 2,
430 Opt_defcontext = 3,
431 Opt_rootcontext = 4,
432 Opt_labelsupport = 5,
433 Opt_nextmntopt = 6,
434 };
435
436 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
437
438 static const match_table_t tokens = {
439 {Opt_context, CONTEXT_STR "%s"},
440 {Opt_fscontext, FSCONTEXT_STR "%s"},
441 {Opt_defcontext, DEFCONTEXT_STR "%s"},
442 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
443 {Opt_labelsupport, LABELSUPP_STR},
444 {Opt_error, NULL},
445 };
446
447 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
448
449 static int may_context_mount_sb_relabel(u32 sid,
450 struct superblock_security_struct *sbsec,
451 const struct cred *cred)
452 {
453 const struct task_security_struct *tsec = cred->security;
454 int rc;
455
456 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
457 FILESYSTEM__RELABELFROM, NULL);
458 if (rc)
459 return rc;
460
461 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
462 FILESYSTEM__RELABELTO, NULL);
463 return rc;
464 }
465
466 static int may_context_mount_inode_relabel(u32 sid,
467 struct superblock_security_struct *sbsec,
468 const struct cred *cred)
469 {
470 const struct task_security_struct *tsec = cred->security;
471 int rc;
472 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
473 FILESYSTEM__RELABELFROM, NULL);
474 if (rc)
475 return rc;
476
477 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
478 FILESYSTEM__ASSOCIATE, NULL);
479 return rc;
480 }
481
482 static int selinux_is_sblabel_mnt(struct super_block *sb)
483 {
484 struct superblock_security_struct *sbsec = sb->s_security;
485
486 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
487 sbsec->behavior == SECURITY_FS_USE_TRANS ||
488 sbsec->behavior == SECURITY_FS_USE_TASK ||
489 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
490 /* Special handling. Genfs but also in-core setxattr handler */
491 !strcmp(sb->s_type->name, "sysfs") ||
492 !strcmp(sb->s_type->name, "pstore") ||
493 !strcmp(sb->s_type->name, "debugfs") ||
494 !strcmp(sb->s_type->name, "rootfs");
495 }
496
497 static int sb_finish_set_opts(struct super_block *sb)
498 {
499 struct superblock_security_struct *sbsec = sb->s_security;
500 struct dentry *root = sb->s_root;
501 struct inode *root_inode = d_backing_inode(root);
502 int rc = 0;
503
504 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
505 /* Make sure that the xattr handler exists and that no
506 error other than -ENODATA is returned by getxattr on
507 the root directory. -ENODATA is ok, as this may be
508 the first boot of the SELinux kernel before we have
509 assigned xattr values to the filesystem. */
510 if (!root_inode->i_op->getxattr) {
511 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
512 "xattr support\n", sb->s_id, sb->s_type->name);
513 rc = -EOPNOTSUPP;
514 goto out;
515 }
516 rc = root_inode->i_op->getxattr(root, root_inode,
517 XATTR_NAME_SELINUX, NULL, 0);
518 if (rc < 0 && rc != -ENODATA) {
519 if (rc == -EOPNOTSUPP)
520 printk(KERN_WARNING "SELinux: (dev %s, type "
521 "%s) has no security xattr handler\n",
522 sb->s_id, sb->s_type->name);
523 else
524 printk(KERN_WARNING "SELinux: (dev %s, type "
525 "%s) getxattr errno %d\n", sb->s_id,
526 sb->s_type->name, -rc);
527 goto out;
528 }
529 }
530
531 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
532 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
533 sb->s_id, sb->s_type->name);
534
535 sbsec->flags |= SE_SBINITIALIZED;
536 if (selinux_is_sblabel_mnt(sb))
537 sbsec->flags |= SBLABEL_MNT;
538
539 /* Initialize the root inode. */
540 rc = inode_doinit_with_dentry(root_inode, root);
541
542 /* Initialize any other inodes associated with the superblock, e.g.
543 inodes created prior to initial policy load or inodes created
544 during get_sb by a pseudo filesystem that directly
545 populates itself. */
546 spin_lock(&sbsec->isec_lock);
547 next_inode:
548 if (!list_empty(&sbsec->isec_head)) {
549 struct inode_security_struct *isec =
550 list_entry(sbsec->isec_head.next,
551 struct inode_security_struct, list);
552 struct inode *inode = isec->inode;
553 list_del_init(&isec->list);
554 spin_unlock(&sbsec->isec_lock);
555 inode = igrab(inode);
556 if (inode) {
557 if (!IS_PRIVATE(inode))
558 inode_doinit(inode);
559 iput(inode);
560 }
561 spin_lock(&sbsec->isec_lock);
562 goto next_inode;
563 }
564 spin_unlock(&sbsec->isec_lock);
565 out:
566 return rc;
567 }
568
569 /*
570 * This function should allow an FS to ask what it's mount security
571 * options were so it can use those later for submounts, displaying
572 * mount options, or whatever.
573 */
574 static int selinux_get_mnt_opts(const struct super_block *sb,
575 struct security_mnt_opts *opts)
576 {
577 int rc = 0, i;
578 struct superblock_security_struct *sbsec = sb->s_security;
579 char *context = NULL;
580 u32 len;
581 char tmp;
582
583 security_init_mnt_opts(opts);
584
585 if (!(sbsec->flags & SE_SBINITIALIZED))
586 return -EINVAL;
587
588 if (!ss_initialized)
589 return -EINVAL;
590
591 /* make sure we always check enough bits to cover the mask */
592 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
593
594 tmp = sbsec->flags & SE_MNTMASK;
595 /* count the number of mount options for this sb */
596 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
597 if (tmp & 0x01)
598 opts->num_mnt_opts++;
599 tmp >>= 1;
600 }
601 /* Check if the Label support flag is set */
602 if (sbsec->flags & SBLABEL_MNT)
603 opts->num_mnt_opts++;
604
605 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
606 if (!opts->mnt_opts) {
607 rc = -ENOMEM;
608 goto out_free;
609 }
610
611 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
612 if (!opts->mnt_opts_flags) {
613 rc = -ENOMEM;
614 goto out_free;
615 }
616
617 i = 0;
618 if (sbsec->flags & FSCONTEXT_MNT) {
619 rc = security_sid_to_context(sbsec->sid, &context, &len);
620 if (rc)
621 goto out_free;
622 opts->mnt_opts[i] = context;
623 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
624 }
625 if (sbsec->flags & CONTEXT_MNT) {
626 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
627 if (rc)
628 goto out_free;
629 opts->mnt_opts[i] = context;
630 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
631 }
632 if (sbsec->flags & DEFCONTEXT_MNT) {
633 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
634 if (rc)
635 goto out_free;
636 opts->mnt_opts[i] = context;
637 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
638 }
639 if (sbsec->flags & ROOTCONTEXT_MNT) {
640 struct dentry *root = sbsec->sb->s_root;
641 struct inode_security_struct *isec = backing_inode_security(root);
642
643 rc = security_sid_to_context(isec->sid, &context, &len);
644 if (rc)
645 goto out_free;
646 opts->mnt_opts[i] = context;
647 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
648 }
649 if (sbsec->flags & SBLABEL_MNT) {
650 opts->mnt_opts[i] = NULL;
651 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
652 }
653
654 BUG_ON(i != opts->num_mnt_opts);
655
656 return 0;
657
658 out_free:
659 security_free_mnt_opts(opts);
660 return rc;
661 }
662
663 static int bad_option(struct superblock_security_struct *sbsec, char flag,
664 u32 old_sid, u32 new_sid)
665 {
666 char mnt_flags = sbsec->flags & SE_MNTMASK;
667
668 /* check if the old mount command had the same options */
669 if (sbsec->flags & SE_SBINITIALIZED)
670 if (!(sbsec->flags & flag) ||
671 (old_sid != new_sid))
672 return 1;
673
674 /* check if we were passed the same options twice,
675 * aka someone passed context=a,context=b
676 */
677 if (!(sbsec->flags & SE_SBINITIALIZED))
678 if (mnt_flags & flag)
679 return 1;
680 return 0;
681 }
682
683 /*
684 * Allow filesystems with binary mount data to explicitly set mount point
685 * labeling information.
686 */
687 static int selinux_set_mnt_opts(struct super_block *sb,
688 struct security_mnt_opts *opts,
689 unsigned long kern_flags,
690 unsigned long *set_kern_flags)
691 {
692 const struct cred *cred = current_cred();
693 int rc = 0, i;
694 struct superblock_security_struct *sbsec = sb->s_security;
695 const char *name = sb->s_type->name;
696 struct dentry *root = sbsec->sb->s_root;
697 struct inode_security_struct *root_isec;
698 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
699 u32 defcontext_sid = 0;
700 char **mount_options = opts->mnt_opts;
701 int *flags = opts->mnt_opts_flags;
702 int num_opts = opts->num_mnt_opts;
703
704 mutex_lock(&sbsec->lock);
705
706 if (!ss_initialized) {
707 if (!num_opts) {
708 /* Defer initialization until selinux_complete_init,
709 after the initial policy is loaded and the security
710 server is ready to handle calls. */
711 goto out;
712 }
713 rc = -EINVAL;
714 printk(KERN_WARNING "SELinux: Unable to set superblock options "
715 "before the security server is initialized\n");
716 goto out;
717 }
718 if (kern_flags && !set_kern_flags) {
719 /* Specifying internal flags without providing a place to
720 * place the results is not allowed */
721 rc = -EINVAL;
722 goto out;
723 }
724
725 /*
726 * Binary mount data FS will come through this function twice. Once
727 * from an explicit call and once from the generic calls from the vfs.
728 * Since the generic VFS calls will not contain any security mount data
729 * we need to skip the double mount verification.
730 *
731 * This does open a hole in which we will not notice if the first
732 * mount using this sb set explict options and a second mount using
733 * this sb does not set any security options. (The first options
734 * will be used for both mounts)
735 */
736 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
737 && (num_opts == 0))
738 goto out;
739
740 root_isec = backing_inode_security_novalidate(root);
741
742 /*
743 * parse the mount options, check if they are valid sids.
744 * also check if someone is trying to mount the same sb more
745 * than once with different security options.
746 */
747 for (i = 0; i < num_opts; i++) {
748 u32 sid;
749
750 if (flags[i] == SBLABEL_MNT)
751 continue;
752 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
753 if (rc) {
754 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
755 "(%s) failed for (dev %s, type %s) errno=%d\n",
756 mount_options[i], sb->s_id, name, rc);
757 goto out;
758 }
759 switch (flags[i]) {
760 case FSCONTEXT_MNT:
761 fscontext_sid = sid;
762
763 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
764 fscontext_sid))
765 goto out_double_mount;
766
767 sbsec->flags |= FSCONTEXT_MNT;
768 break;
769 case CONTEXT_MNT:
770 context_sid = sid;
771
772 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
773 context_sid))
774 goto out_double_mount;
775
776 sbsec->flags |= CONTEXT_MNT;
777 break;
778 case ROOTCONTEXT_MNT:
779 rootcontext_sid = sid;
780
781 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
782 rootcontext_sid))
783 goto out_double_mount;
784
785 sbsec->flags |= ROOTCONTEXT_MNT;
786
787 break;
788 case DEFCONTEXT_MNT:
789 defcontext_sid = sid;
790
791 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
792 defcontext_sid))
793 goto out_double_mount;
794
795 sbsec->flags |= DEFCONTEXT_MNT;
796
797 break;
798 default:
799 rc = -EINVAL;
800 goto out;
801 }
802 }
803
804 if (sbsec->flags & SE_SBINITIALIZED) {
805 /* previously mounted with options, but not on this attempt? */
806 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
807 goto out_double_mount;
808 rc = 0;
809 goto out;
810 }
811
812 if (strcmp(sb->s_type->name, "proc") == 0)
813 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
814
815 if (!strcmp(sb->s_type->name, "debugfs") ||
816 !strcmp(sb->s_type->name, "sysfs") ||
817 !strcmp(sb->s_type->name, "pstore"))
818 sbsec->flags |= SE_SBGENFS;
819
820 if (!sbsec->behavior) {
821 /*
822 * Determine the labeling behavior to use for this
823 * filesystem type.
824 */
825 rc = security_fs_use(sb);
826 if (rc) {
827 printk(KERN_WARNING
828 "%s: security_fs_use(%s) returned %d\n",
829 __func__, sb->s_type->name, rc);
830 goto out;
831 }
832 }
833
834 /*
835 * If this is a user namespace mount, no contexts are allowed
836 * on the command line and security labels must be ignored.
837 */
838 if (sb->s_user_ns != &init_user_ns) {
839 if (context_sid || fscontext_sid || rootcontext_sid ||
840 defcontext_sid) {
841 rc = -EACCES;
842 goto out;
843 }
844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 rc = security_transition_sid(current_sid(), current_sid(),
847 SECCLASS_FILE, NULL,
848 &sbsec->mntpoint_sid);
849 if (rc)
850 goto out;
851 }
852 goto out_set_opts;
853 }
854
855 /* sets the context of the superblock for the fs being mounted. */
856 if (fscontext_sid) {
857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
858 if (rc)
859 goto out;
860
861 sbsec->sid = fscontext_sid;
862 }
863
864 /*
865 * Switch to using mount point labeling behavior.
866 * sets the label used on all file below the mountpoint, and will set
867 * the superblock context if not already set.
868 */
869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
872 }
873
874 if (context_sid) {
875 if (!fscontext_sid) {
876 rc = may_context_mount_sb_relabel(context_sid, sbsec,
877 cred);
878 if (rc)
879 goto out;
880 sbsec->sid = context_sid;
881 } else {
882 rc = may_context_mount_inode_relabel(context_sid, sbsec,
883 cred);
884 if (rc)
885 goto out;
886 }
887 if (!rootcontext_sid)
888 rootcontext_sid = context_sid;
889
890 sbsec->mntpoint_sid = context_sid;
891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
892 }
893
894 if (rootcontext_sid) {
895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
896 cred);
897 if (rc)
898 goto out;
899
900 root_isec->sid = rootcontext_sid;
901 root_isec->initialized = LABEL_INITIALIZED;
902 }
903
904 if (defcontext_sid) {
905 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
907 rc = -EINVAL;
908 printk(KERN_WARNING "SELinux: defcontext option is "
909 "invalid for this filesystem type\n");
910 goto out;
911 }
912
913 if (defcontext_sid != sbsec->def_sid) {
914 rc = may_context_mount_inode_relabel(defcontext_sid,
915 sbsec, cred);
916 if (rc)
917 goto out;
918 }
919
920 sbsec->def_sid = defcontext_sid;
921 }
922
923 out_set_opts:
924 rc = sb_finish_set_opts(sb);
925 out:
926 mutex_unlock(&sbsec->lock);
927 return rc;
928 out_double_mount:
929 rc = -EINVAL;
930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
931 "security settings for (dev %s, type %s)\n", sb->s_id, name);
932 goto out;
933 }
934
935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 const struct super_block *newsb)
937 {
938 struct superblock_security_struct *old = oldsb->s_security;
939 struct superblock_security_struct *new = newsb->s_security;
940 char oldflags = old->flags & SE_MNTMASK;
941 char newflags = new->flags & SE_MNTMASK;
942
943 if (oldflags != newflags)
944 goto mismatch;
945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
946 goto mismatch;
947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
948 goto mismatch;
949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
950 goto mismatch;
951 if (oldflags & ROOTCONTEXT_MNT) {
952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
954 if (oldroot->sid != newroot->sid)
955 goto mismatch;
956 }
957 return 0;
958 mismatch:
959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
960 "different security settings for (dev %s, "
961 "type %s)\n", newsb->s_id, newsb->s_type->name);
962 return -EBUSY;
963 }
964
965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
966 struct super_block *newsb)
967 {
968 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 struct superblock_security_struct *newsbsec = newsb->s_security;
970
971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
972 int set_context = (oldsbsec->flags & CONTEXT_MNT);
973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
974
975 /*
976 * if the parent was able to be mounted it clearly had no special lsm
977 * mount options. thus we can safely deal with this superblock later
978 */
979 if (!ss_initialized)
980 return 0;
981
982 /* how can we clone if the old one wasn't set up?? */
983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
984
985 /* if fs is reusing a sb, make sure that the contexts match */
986 if (newsbsec->flags & SE_SBINITIALIZED)
987 return selinux_cmp_sb_context(oldsb, newsb);
988
989 mutex_lock(&newsbsec->lock);
990
991 newsbsec->flags = oldsbsec->flags;
992
993 newsbsec->sid = oldsbsec->sid;
994 newsbsec->def_sid = oldsbsec->def_sid;
995 newsbsec->behavior = oldsbsec->behavior;
996
997 if (set_context) {
998 u32 sid = oldsbsec->mntpoint_sid;
999
1000 if (!set_fscontext)
1001 newsbsec->sid = sid;
1002 if (!set_rootcontext) {
1003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004 newisec->sid = sid;
1005 }
1006 newsbsec->mntpoint_sid = sid;
1007 }
1008 if (set_rootcontext) {
1009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012 newisec->sid = oldisec->sid;
1013 }
1014
1015 sb_finish_set_opts(newsb);
1016 mutex_unlock(&newsbsec->lock);
1017 return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021 struct security_mnt_opts *opts)
1022 {
1023 char *p;
1024 char *context = NULL, *defcontext = NULL;
1025 char *fscontext = NULL, *rootcontext = NULL;
1026 int rc, num_mnt_opts = 0;
1027
1028 opts->num_mnt_opts = 0;
1029
1030 /* Standard string-based options. */
1031 while ((p = strsep(&options, "|")) != NULL) {
1032 int token;
1033 substring_t args[MAX_OPT_ARGS];
1034
1035 if (!*p)
1036 continue;
1037
1038 token = match_token(p, tokens, args);
1039
1040 switch (token) {
1041 case Opt_context:
1042 if (context || defcontext) {
1043 rc = -EINVAL;
1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045 goto out_err;
1046 }
1047 context = match_strdup(&args[0]);
1048 if (!context) {
1049 rc = -ENOMEM;
1050 goto out_err;
1051 }
1052 break;
1053
1054 case Opt_fscontext:
1055 if (fscontext) {
1056 rc = -EINVAL;
1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058 goto out_err;
1059 }
1060 fscontext = match_strdup(&args[0]);
1061 if (!fscontext) {
1062 rc = -ENOMEM;
1063 goto out_err;
1064 }
1065 break;
1066
1067 case Opt_rootcontext:
1068 if (rootcontext) {
1069 rc = -EINVAL;
1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071 goto out_err;
1072 }
1073 rootcontext = match_strdup(&args[0]);
1074 if (!rootcontext) {
1075 rc = -ENOMEM;
1076 goto out_err;
1077 }
1078 break;
1079
1080 case Opt_defcontext:
1081 if (context || defcontext) {
1082 rc = -EINVAL;
1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084 goto out_err;
1085 }
1086 defcontext = match_strdup(&args[0]);
1087 if (!defcontext) {
1088 rc = -ENOMEM;
1089 goto out_err;
1090 }
1091 break;
1092 case Opt_labelsupport:
1093 break;
1094 default:
1095 rc = -EINVAL;
1096 printk(KERN_WARNING "SELinux: unknown mount option\n");
1097 goto out_err;
1098
1099 }
1100 }
1101
1102 rc = -ENOMEM;
1103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1104 if (!opts->mnt_opts)
1105 goto out_err;
1106
1107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1108 if (!opts->mnt_opts_flags) {
1109 kfree(opts->mnt_opts);
1110 goto out_err;
1111 }
1112
1113 if (fscontext) {
1114 opts->mnt_opts[num_mnt_opts] = fscontext;
1115 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1116 }
1117 if (context) {
1118 opts->mnt_opts[num_mnt_opts] = context;
1119 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1120 }
1121 if (rootcontext) {
1122 opts->mnt_opts[num_mnt_opts] = rootcontext;
1123 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1124 }
1125 if (defcontext) {
1126 opts->mnt_opts[num_mnt_opts] = defcontext;
1127 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1128 }
1129
1130 opts->num_mnt_opts = num_mnt_opts;
1131 return 0;
1132
1133 out_err:
1134 kfree(context);
1135 kfree(defcontext);
1136 kfree(fscontext);
1137 kfree(rootcontext);
1138 return rc;
1139 }
1140 /*
1141 * string mount options parsing and call set the sbsec
1142 */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145 int rc = 0;
1146 char *options = data;
1147 struct security_mnt_opts opts;
1148
1149 security_init_mnt_opts(&opts);
1150
1151 if (!data)
1152 goto out;
1153
1154 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156 rc = selinux_parse_opts_str(options, &opts);
1157 if (rc)
1158 goto out_err;
1159
1160 out:
1161 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164 security_free_mnt_opts(&opts);
1165 return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169 struct security_mnt_opts *opts)
1170 {
1171 int i;
1172 char *prefix;
1173
1174 for (i = 0; i < opts->num_mnt_opts; i++) {
1175 char *has_comma;
1176
1177 if (opts->mnt_opts[i])
1178 has_comma = strchr(opts->mnt_opts[i], ',');
1179 else
1180 has_comma = NULL;
1181
1182 switch (opts->mnt_opts_flags[i]) {
1183 case CONTEXT_MNT:
1184 prefix = CONTEXT_STR;
1185 break;
1186 case FSCONTEXT_MNT:
1187 prefix = FSCONTEXT_STR;
1188 break;
1189 case ROOTCONTEXT_MNT:
1190 prefix = ROOTCONTEXT_STR;
1191 break;
1192 case DEFCONTEXT_MNT:
1193 prefix = DEFCONTEXT_STR;
1194 break;
1195 case SBLABEL_MNT:
1196 seq_putc(m, ',');
1197 seq_puts(m, LABELSUPP_STR);
1198 continue;
1199 default:
1200 BUG();
1201 return;
1202 };
1203 /* we need a comma before each option */
1204 seq_putc(m, ',');
1205 seq_puts(m, prefix);
1206 if (has_comma)
1207 seq_putc(m, '\"');
1208 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209 if (has_comma)
1210 seq_putc(m, '\"');
1211 }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216 struct security_mnt_opts opts;
1217 int rc;
1218
1219 rc = selinux_get_mnt_opts(sb, &opts);
1220 if (rc) {
1221 /* before policy load we may get EINVAL, don't show anything */
1222 if (rc == -EINVAL)
1223 rc = 0;
1224 return rc;
1225 }
1226
1227 selinux_write_opts(m, &opts);
1228
1229 security_free_mnt_opts(&opts);
1230
1231 return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236 switch (mode & S_IFMT) {
1237 case S_IFSOCK:
1238 return SECCLASS_SOCK_FILE;
1239 case S_IFLNK:
1240 return SECCLASS_LNK_FILE;
1241 case S_IFREG:
1242 return SECCLASS_FILE;
1243 case S_IFBLK:
1244 return SECCLASS_BLK_FILE;
1245 case S_IFDIR:
1246 return SECCLASS_DIR;
1247 case S_IFCHR:
1248 return SECCLASS_CHR_FILE;
1249 case S_IFIFO:
1250 return SECCLASS_FIFO_FILE;
1251
1252 }
1253
1254 return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269 switch (family) {
1270 case PF_UNIX:
1271 switch (type) {
1272 case SOCK_STREAM:
1273 case SOCK_SEQPACKET:
1274 return SECCLASS_UNIX_STREAM_SOCKET;
1275 case SOCK_DGRAM:
1276 return SECCLASS_UNIX_DGRAM_SOCKET;
1277 }
1278 break;
1279 case PF_INET:
1280 case PF_INET6:
1281 switch (type) {
1282 case SOCK_STREAM:
1283 if (default_protocol_stream(protocol))
1284 return SECCLASS_TCP_SOCKET;
1285 else
1286 return SECCLASS_RAWIP_SOCKET;
1287 case SOCK_DGRAM:
1288 if (default_protocol_dgram(protocol))
1289 return SECCLASS_UDP_SOCKET;
1290 else
1291 return SECCLASS_RAWIP_SOCKET;
1292 case SOCK_DCCP:
1293 return SECCLASS_DCCP_SOCKET;
1294 default:
1295 return SECCLASS_RAWIP_SOCKET;
1296 }
1297 break;
1298 case PF_NETLINK:
1299 switch (protocol) {
1300 case NETLINK_ROUTE:
1301 return SECCLASS_NETLINK_ROUTE_SOCKET;
1302 case NETLINK_SOCK_DIAG:
1303 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1304 case NETLINK_NFLOG:
1305 return SECCLASS_NETLINK_NFLOG_SOCKET;
1306 case NETLINK_XFRM:
1307 return SECCLASS_NETLINK_XFRM_SOCKET;
1308 case NETLINK_SELINUX:
1309 return SECCLASS_NETLINK_SELINUX_SOCKET;
1310 case NETLINK_ISCSI:
1311 return SECCLASS_NETLINK_ISCSI_SOCKET;
1312 case NETLINK_AUDIT:
1313 return SECCLASS_NETLINK_AUDIT_SOCKET;
1314 case NETLINK_FIB_LOOKUP:
1315 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1316 case NETLINK_CONNECTOR:
1317 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1318 case NETLINK_NETFILTER:
1319 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1320 case NETLINK_DNRTMSG:
1321 return SECCLASS_NETLINK_DNRT_SOCKET;
1322 case NETLINK_KOBJECT_UEVENT:
1323 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1324 case NETLINK_GENERIC:
1325 return SECCLASS_NETLINK_GENERIC_SOCKET;
1326 case NETLINK_SCSITRANSPORT:
1327 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1328 case NETLINK_RDMA:
1329 return SECCLASS_NETLINK_RDMA_SOCKET;
1330 case NETLINK_CRYPTO:
1331 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1332 default:
1333 return SECCLASS_NETLINK_SOCKET;
1334 }
1335 case PF_PACKET:
1336 return SECCLASS_PACKET_SOCKET;
1337 case PF_KEY:
1338 return SECCLASS_KEY_SOCKET;
1339 case PF_APPLETALK:
1340 return SECCLASS_APPLETALK_SOCKET;
1341 }
1342
1343 return SECCLASS_SOCKET;
1344 }
1345
1346 static int selinux_genfs_get_sid(struct dentry *dentry,
1347 u16 tclass,
1348 u16 flags,
1349 u32 *sid)
1350 {
1351 int rc;
1352 struct super_block *sb = dentry->d_sb;
1353 char *buffer, *path;
1354
1355 buffer = (char *)__get_free_page(GFP_KERNEL);
1356 if (!buffer)
1357 return -ENOMEM;
1358
1359 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1360 if (IS_ERR(path))
1361 rc = PTR_ERR(path);
1362 else {
1363 if (flags & SE_SBPROC) {
1364 /* each process gets a /proc/PID/ entry. Strip off the
1365 * PID part to get a valid selinux labeling.
1366 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1367 while (path[1] >= '0' && path[1] <= '9') {
1368 path[1] = '/';
1369 path++;
1370 }
1371 }
1372 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1373 }
1374 free_page((unsigned long)buffer);
1375 return rc;
1376 }
1377
1378 /* The inode's security attributes must be initialized before first use. */
1379 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1380 {
1381 struct superblock_security_struct *sbsec = NULL;
1382 struct inode_security_struct *isec = inode->i_security;
1383 u32 sid;
1384 struct dentry *dentry;
1385 #define INITCONTEXTLEN 255
1386 char *context = NULL;
1387 unsigned len = 0;
1388 int rc = 0;
1389
1390 if (isec->initialized == LABEL_INITIALIZED)
1391 goto out;
1392
1393 mutex_lock(&isec->lock);
1394 if (isec->initialized == LABEL_INITIALIZED)
1395 goto out_unlock;
1396
1397 sbsec = inode->i_sb->s_security;
1398 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1399 /* Defer initialization until selinux_complete_init,
1400 after the initial policy is loaded and the security
1401 server is ready to handle calls. */
1402 spin_lock(&sbsec->isec_lock);
1403 if (list_empty(&isec->list))
1404 list_add(&isec->list, &sbsec->isec_head);
1405 spin_unlock(&sbsec->isec_lock);
1406 goto out_unlock;
1407 }
1408
1409 switch (sbsec->behavior) {
1410 case SECURITY_FS_USE_NATIVE:
1411 break;
1412 case SECURITY_FS_USE_XATTR:
1413 if (!inode->i_op->getxattr) {
1414 isec->sid = sbsec->def_sid;
1415 break;
1416 }
1417
1418 /* Need a dentry, since the xattr API requires one.
1419 Life would be simpler if we could just pass the inode. */
1420 if (opt_dentry) {
1421 /* Called from d_instantiate or d_splice_alias. */
1422 dentry = dget(opt_dentry);
1423 } else {
1424 /* Called from selinux_complete_init, try to find a dentry. */
1425 dentry = d_find_alias(inode);
1426 }
1427 if (!dentry) {
1428 /*
1429 * this is can be hit on boot when a file is accessed
1430 * before the policy is loaded. When we load policy we
1431 * may find inodes that have no dentry on the
1432 * sbsec->isec_head list. No reason to complain as these
1433 * will get fixed up the next time we go through
1434 * inode_doinit with a dentry, before these inodes could
1435 * be used again by userspace.
1436 */
1437 goto out_unlock;
1438 }
1439
1440 len = INITCONTEXTLEN;
1441 context = kmalloc(len+1, GFP_NOFS);
1442 if (!context) {
1443 rc = -ENOMEM;
1444 dput(dentry);
1445 goto out_unlock;
1446 }
1447 context[len] = '\0';
1448 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1449 context, len);
1450 if (rc == -ERANGE) {
1451 kfree(context);
1452
1453 /* Need a larger buffer. Query for the right size. */
1454 rc = inode->i_op->getxattr(dentry, inode, XATTR_NAME_SELINUX,
1455 NULL, 0);
1456 if (rc < 0) {
1457 dput(dentry);
1458 goto out_unlock;
1459 }
1460 len = rc;
1461 context = kmalloc(len+1, GFP_NOFS);
1462 if (!context) {
1463 rc = -ENOMEM;
1464 dput(dentry);
1465 goto out_unlock;
1466 }
1467 context[len] = '\0';
1468 rc = inode->i_op->getxattr(dentry, inode,
1469 XATTR_NAME_SELINUX,
1470 context, len);
1471 }
1472 dput(dentry);
1473 if (rc < 0) {
1474 if (rc != -ENODATA) {
1475 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1476 "%d for dev=%s ino=%ld\n", __func__,
1477 -rc, inode->i_sb->s_id, inode->i_ino);
1478 kfree(context);
1479 goto out_unlock;
1480 }
1481 /* Map ENODATA to the default file SID */
1482 sid = sbsec->def_sid;
1483 rc = 0;
1484 } else {
1485 rc = security_context_to_sid_default(context, rc, &sid,
1486 sbsec->def_sid,
1487 GFP_NOFS);
1488 if (rc) {
1489 char *dev = inode->i_sb->s_id;
1490 unsigned long ino = inode->i_ino;
1491
1492 if (rc == -EINVAL) {
1493 if (printk_ratelimit())
1494 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1495 "context=%s. This indicates you may need to relabel the inode or the "
1496 "filesystem in question.\n", ino, dev, context);
1497 } else {
1498 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1499 "returned %d for dev=%s ino=%ld\n",
1500 __func__, context, -rc, dev, ino);
1501 }
1502 kfree(context);
1503 /* Leave with the unlabeled SID */
1504 rc = 0;
1505 break;
1506 }
1507 }
1508 kfree(context);
1509 isec->sid = sid;
1510 break;
1511 case SECURITY_FS_USE_TASK:
1512 isec->sid = isec->task_sid;
1513 break;
1514 case SECURITY_FS_USE_TRANS:
1515 /* Default to the fs SID. */
1516 isec->sid = sbsec->sid;
1517
1518 /* Try to obtain a transition SID. */
1519 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1520 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1521 isec->sclass, NULL, &sid);
1522 if (rc)
1523 goto out_unlock;
1524 isec->sid = sid;
1525 break;
1526 case SECURITY_FS_USE_MNTPOINT:
1527 isec->sid = sbsec->mntpoint_sid;
1528 break;
1529 default:
1530 /* Default to the fs superblock SID. */
1531 isec->sid = sbsec->sid;
1532
1533 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1534 /* We must have a dentry to determine the label on
1535 * procfs inodes */
1536 if (opt_dentry)
1537 /* Called from d_instantiate or
1538 * d_splice_alias. */
1539 dentry = dget(opt_dentry);
1540 else
1541 /* Called from selinux_complete_init, try to
1542 * find a dentry. */
1543 dentry = d_find_alias(inode);
1544 /*
1545 * This can be hit on boot when a file is accessed
1546 * before the policy is loaded. When we load policy we
1547 * may find inodes that have no dentry on the
1548 * sbsec->isec_head list. No reason to complain as
1549 * these will get fixed up the next time we go through
1550 * inode_doinit() with a dentry, before these inodes
1551 * could be used again by userspace.
1552 */
1553 if (!dentry)
1554 goto out_unlock;
1555 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1556 rc = selinux_genfs_get_sid(dentry, isec->sclass,
1557 sbsec->flags, &sid);
1558 dput(dentry);
1559 if (rc)
1560 goto out_unlock;
1561 isec->sid = sid;
1562 }
1563 break;
1564 }
1565
1566 isec->initialized = LABEL_INITIALIZED;
1567
1568 out_unlock:
1569 mutex_unlock(&isec->lock);
1570 out:
1571 if (isec->sclass == SECCLASS_FILE)
1572 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1573 return rc;
1574 }
1575
1576 /* Convert a Linux signal to an access vector. */
1577 static inline u32 signal_to_av(int sig)
1578 {
1579 u32 perm = 0;
1580
1581 switch (sig) {
1582 case SIGCHLD:
1583 /* Commonly granted from child to parent. */
1584 perm = PROCESS__SIGCHLD;
1585 break;
1586 case SIGKILL:
1587 /* Cannot be caught or ignored */
1588 perm = PROCESS__SIGKILL;
1589 break;
1590 case SIGSTOP:
1591 /* Cannot be caught or ignored */
1592 perm = PROCESS__SIGSTOP;
1593 break;
1594 default:
1595 /* All other signals. */
1596 perm = PROCESS__SIGNAL;
1597 break;
1598 }
1599
1600 return perm;
1601 }
1602
1603 /*
1604 * Check permission between a pair of credentials
1605 * fork check, ptrace check, etc.
1606 */
1607 static int cred_has_perm(const struct cred *actor,
1608 const struct cred *target,
1609 u32 perms)
1610 {
1611 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1612
1613 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1614 }
1615
1616 /*
1617 * Check permission between a pair of tasks, e.g. signal checks,
1618 * fork check, ptrace check, etc.
1619 * tsk1 is the actor and tsk2 is the target
1620 * - this uses the default subjective creds of tsk1
1621 */
1622 static int task_has_perm(const struct task_struct *tsk1,
1623 const struct task_struct *tsk2,
1624 u32 perms)
1625 {
1626 const struct task_security_struct *__tsec1, *__tsec2;
1627 u32 sid1, sid2;
1628
1629 rcu_read_lock();
1630 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1631 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1632 rcu_read_unlock();
1633 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1634 }
1635
1636 /*
1637 * Check permission between current and another task, e.g. signal checks,
1638 * fork check, ptrace check, etc.
1639 * current is the actor and tsk2 is the target
1640 * - this uses current's subjective creds
1641 */
1642 static int current_has_perm(const struct task_struct *tsk,
1643 u32 perms)
1644 {
1645 u32 sid, tsid;
1646
1647 sid = current_sid();
1648 tsid = task_sid(tsk);
1649 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1650 }
1651
1652 #if CAP_LAST_CAP > 63
1653 #error Fix SELinux to handle capabilities > 63.
1654 #endif
1655
1656 /* Check whether a task is allowed to use a capability. */
1657 static int cred_has_capability(const struct cred *cred,
1658 int cap, int audit, bool initns)
1659 {
1660 struct common_audit_data ad;
1661 struct av_decision avd;
1662 u16 sclass;
1663 u32 sid = cred_sid(cred);
1664 u32 av = CAP_TO_MASK(cap);
1665 int rc;
1666
1667 ad.type = LSM_AUDIT_DATA_CAP;
1668 ad.u.cap = cap;
1669
1670 switch (CAP_TO_INDEX(cap)) {
1671 case 0:
1672 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1673 break;
1674 case 1:
1675 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1676 break;
1677 default:
1678 printk(KERN_ERR
1679 "SELinux: out of range capability %d\n", cap);
1680 BUG();
1681 return -EINVAL;
1682 }
1683
1684 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1685 if (audit == SECURITY_CAP_AUDIT) {
1686 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1687 if (rc2)
1688 return rc2;
1689 }
1690 return rc;
1691 }
1692
1693 /* Check whether a task is allowed to use a system operation. */
1694 static int task_has_system(struct task_struct *tsk,
1695 u32 perms)
1696 {
1697 u32 sid = task_sid(tsk);
1698
1699 return avc_has_perm(sid, SECINITSID_KERNEL,
1700 SECCLASS_SYSTEM, perms, NULL);
1701 }
1702
1703 /* Check whether a task has a particular permission to an inode.
1704 The 'adp' parameter is optional and allows other audit
1705 data to be passed (e.g. the dentry). */
1706 static int inode_has_perm(const struct cred *cred,
1707 struct inode *inode,
1708 u32 perms,
1709 struct common_audit_data *adp)
1710 {
1711 struct inode_security_struct *isec;
1712 u32 sid;
1713
1714 validate_creds(cred);
1715
1716 if (unlikely(IS_PRIVATE(inode)))
1717 return 0;
1718
1719 sid = cred_sid(cred);
1720 isec = inode->i_security;
1721
1722 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1723 }
1724
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726 the dentry to help the auditing code to more easily generate the
1727 pathname if needed. */
1728 static inline int dentry_has_perm(const struct cred *cred,
1729 struct dentry *dentry,
1730 u32 av)
1731 {
1732 struct inode *inode = d_backing_inode(dentry);
1733 struct common_audit_data ad;
1734
1735 ad.type = LSM_AUDIT_DATA_DENTRY;
1736 ad.u.dentry = dentry;
1737 __inode_security_revalidate(inode, dentry, true);
1738 return inode_has_perm(cred, inode, av, &ad);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742 the path to help the auditing code to more easily generate the
1743 pathname if needed. */
1744 static inline int path_has_perm(const struct cred *cred,
1745 const struct path *path,
1746 u32 av)
1747 {
1748 struct inode *inode = d_backing_inode(path->dentry);
1749 struct common_audit_data ad;
1750
1751 ad.type = LSM_AUDIT_DATA_PATH;
1752 ad.u.path = *path;
1753 __inode_security_revalidate(inode, path->dentry, true);
1754 return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as path_has_perm, but uses the inode from the file struct. */
1758 static inline int file_path_has_perm(const struct cred *cred,
1759 struct file *file,
1760 u32 av)
1761 {
1762 struct common_audit_data ad;
1763
1764 ad.type = LSM_AUDIT_DATA_PATH;
1765 ad.u.path = file->f_path;
1766 return inode_has_perm(cred, file_inode(file), av, &ad);
1767 }
1768
1769 /* Check whether a task can use an open file descriptor to
1770 access an inode in a given way. Check access to the
1771 descriptor itself, and then use dentry_has_perm to
1772 check a particular permission to the file.
1773 Access to the descriptor is implicitly granted if it
1774 has the same SID as the process. If av is zero, then
1775 access to the file is not checked, e.g. for cases
1776 where only the descriptor is affected like seek. */
1777 static int file_has_perm(const struct cred *cred,
1778 struct file *file,
1779 u32 av)
1780 {
1781 struct file_security_struct *fsec = file->f_security;
1782 struct inode *inode = file_inode(file);
1783 struct common_audit_data ad;
1784 u32 sid = cred_sid(cred);
1785 int rc;
1786
1787 ad.type = LSM_AUDIT_DATA_PATH;
1788 ad.u.path = file->f_path;
1789
1790 if (sid != fsec->sid) {
1791 rc = avc_has_perm(sid, fsec->sid,
1792 SECCLASS_FD,
1793 FD__USE,
1794 &ad);
1795 if (rc)
1796 goto out;
1797 }
1798
1799 /* av is zero if only checking access to the descriptor. */
1800 rc = 0;
1801 if (av)
1802 rc = inode_has_perm(cred, inode, av, &ad);
1803
1804 out:
1805 return rc;
1806 }
1807
1808 /*
1809 * Determine the label for an inode that might be unioned.
1810 */
1811 static int selinux_determine_inode_label(struct inode *dir,
1812 const struct qstr *name,
1813 u16 tclass,
1814 u32 *_new_isid)
1815 {
1816 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1817 const struct task_security_struct *tsec = current_security();
1818
1819 if ((sbsec->flags & SE_SBINITIALIZED) &&
1820 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1821 *_new_isid = sbsec->mntpoint_sid;
1822 } else if ((sbsec->flags & SBLABEL_MNT) &&
1823 tsec->create_sid) {
1824 *_new_isid = tsec->create_sid;
1825 } else {
1826 const struct inode_security_struct *dsec = inode_security(dir);
1827 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1828 name, _new_isid);
1829 }
1830
1831 return 0;
1832 }
1833
1834 /* Check whether a task can create a file. */
1835 static int may_create(struct inode *dir,
1836 struct dentry *dentry,
1837 u16 tclass)
1838 {
1839 const struct task_security_struct *tsec = current_security();
1840 struct inode_security_struct *dsec;
1841 struct superblock_security_struct *sbsec;
1842 u32 sid, newsid;
1843 struct common_audit_data ad;
1844 int rc;
1845
1846 dsec = inode_security(dir);
1847 sbsec = dir->i_sb->s_security;
1848
1849 sid = tsec->sid;
1850
1851 ad.type = LSM_AUDIT_DATA_DENTRY;
1852 ad.u.dentry = dentry;
1853
1854 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1855 DIR__ADD_NAME | DIR__SEARCH,
1856 &ad);
1857 if (rc)
1858 return rc;
1859
1860 rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1861 &newsid);
1862 if (rc)
1863 return rc;
1864
1865 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1866 if (rc)
1867 return rc;
1868
1869 return avc_has_perm(newsid, sbsec->sid,
1870 SECCLASS_FILESYSTEM,
1871 FILESYSTEM__ASSOCIATE, &ad);
1872 }
1873
1874 /* Check whether a task can create a key. */
1875 static int may_create_key(u32 ksid,
1876 struct task_struct *ctx)
1877 {
1878 u32 sid = task_sid(ctx);
1879
1880 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1881 }
1882
1883 #define MAY_LINK 0
1884 #define MAY_UNLINK 1
1885 #define MAY_RMDIR 2
1886
1887 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1888 static int may_link(struct inode *dir,
1889 struct dentry *dentry,
1890 int kind)
1891
1892 {
1893 struct inode_security_struct *dsec, *isec;
1894 struct common_audit_data ad;
1895 u32 sid = current_sid();
1896 u32 av;
1897 int rc;
1898
1899 dsec = inode_security(dir);
1900 isec = backing_inode_security(dentry);
1901
1902 ad.type = LSM_AUDIT_DATA_DENTRY;
1903 ad.u.dentry = dentry;
1904
1905 av = DIR__SEARCH;
1906 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1907 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1908 if (rc)
1909 return rc;
1910
1911 switch (kind) {
1912 case MAY_LINK:
1913 av = FILE__LINK;
1914 break;
1915 case MAY_UNLINK:
1916 av = FILE__UNLINK;
1917 break;
1918 case MAY_RMDIR:
1919 av = DIR__RMDIR;
1920 break;
1921 default:
1922 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1923 __func__, kind);
1924 return 0;
1925 }
1926
1927 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1928 return rc;
1929 }
1930
1931 static inline int may_rename(struct inode *old_dir,
1932 struct dentry *old_dentry,
1933 struct inode *new_dir,
1934 struct dentry *new_dentry)
1935 {
1936 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1937 struct common_audit_data ad;
1938 u32 sid = current_sid();
1939 u32 av;
1940 int old_is_dir, new_is_dir;
1941 int rc;
1942
1943 old_dsec = inode_security(old_dir);
1944 old_isec = backing_inode_security(old_dentry);
1945 old_is_dir = d_is_dir(old_dentry);
1946 new_dsec = inode_security(new_dir);
1947
1948 ad.type = LSM_AUDIT_DATA_DENTRY;
1949
1950 ad.u.dentry = old_dentry;
1951 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1952 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1953 if (rc)
1954 return rc;
1955 rc = avc_has_perm(sid, old_isec->sid,
1956 old_isec->sclass, FILE__RENAME, &ad);
1957 if (rc)
1958 return rc;
1959 if (old_is_dir && new_dir != old_dir) {
1960 rc = avc_has_perm(sid, old_isec->sid,
1961 old_isec->sclass, DIR__REPARENT, &ad);
1962 if (rc)
1963 return rc;
1964 }
1965
1966 ad.u.dentry = new_dentry;
1967 av = DIR__ADD_NAME | DIR__SEARCH;
1968 if (d_is_positive(new_dentry))
1969 av |= DIR__REMOVE_NAME;
1970 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1971 if (rc)
1972 return rc;
1973 if (d_is_positive(new_dentry)) {
1974 new_isec = backing_inode_security(new_dentry);
1975 new_is_dir = d_is_dir(new_dentry);
1976 rc = avc_has_perm(sid, new_isec->sid,
1977 new_isec->sclass,
1978 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979 if (rc)
1980 return rc;
1981 }
1982
1983 return 0;
1984 }
1985
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988 struct super_block *sb,
1989 u32 perms,
1990 struct common_audit_data *ad)
1991 {
1992 struct superblock_security_struct *sbsec;
1993 u32 sid = cred_sid(cred);
1994
1995 sbsec = sb->s_security;
1996 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1997 }
1998
1999 /* Convert a Linux mode and permission mask to an access vector. */
2000 static inline u32 file_mask_to_av(int mode, int mask)
2001 {
2002 u32 av = 0;
2003
2004 if (!S_ISDIR(mode)) {
2005 if (mask & MAY_EXEC)
2006 av |= FILE__EXECUTE;
2007 if (mask & MAY_READ)
2008 av |= FILE__READ;
2009
2010 if (mask & MAY_APPEND)
2011 av |= FILE__APPEND;
2012 else if (mask & MAY_WRITE)
2013 av |= FILE__WRITE;
2014
2015 } else {
2016 if (mask & MAY_EXEC)
2017 av |= DIR__SEARCH;
2018 if (mask & MAY_WRITE)
2019 av |= DIR__WRITE;
2020 if (mask & MAY_READ)
2021 av |= DIR__READ;
2022 }
2023
2024 return av;
2025 }
2026
2027 /* Convert a Linux file to an access vector. */
2028 static inline u32 file_to_av(struct file *file)
2029 {
2030 u32 av = 0;
2031
2032 if (file->f_mode & FMODE_READ)
2033 av |= FILE__READ;
2034 if (file->f_mode & FMODE_WRITE) {
2035 if (file->f_flags & O_APPEND)
2036 av |= FILE__APPEND;
2037 else
2038 av |= FILE__WRITE;
2039 }
2040 if (!av) {
2041 /*
2042 * Special file opened with flags 3 for ioctl-only use.
2043 */
2044 av = FILE__IOCTL;
2045 }
2046
2047 return av;
2048 }
2049
2050 /*
2051 * Convert a file to an access vector and include the correct open
2052 * open permission.
2053 */
2054 static inline u32 open_file_to_av(struct file *file)
2055 {
2056 u32 av = file_to_av(file);
2057
2058 if (selinux_policycap_openperm)
2059 av |= FILE__OPEN;
2060
2061 return av;
2062 }
2063
2064 /* Hook functions begin here. */
2065
2066 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2067 {
2068 u32 mysid = current_sid();
2069 u32 mgrsid = task_sid(mgr);
2070
2071 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2072 BINDER__SET_CONTEXT_MGR, NULL);
2073 }
2074
2075 static int selinux_binder_transaction(struct task_struct *from,
2076 struct task_struct *to)
2077 {
2078 u32 mysid = current_sid();
2079 u32 fromsid = task_sid(from);
2080 u32 tosid = task_sid(to);
2081 int rc;
2082
2083 if (mysid != fromsid) {
2084 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2085 BINDER__IMPERSONATE, NULL);
2086 if (rc)
2087 return rc;
2088 }
2089
2090 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2091 NULL);
2092 }
2093
2094 static int selinux_binder_transfer_binder(struct task_struct *from,
2095 struct task_struct *to)
2096 {
2097 u32 fromsid = task_sid(from);
2098 u32 tosid = task_sid(to);
2099
2100 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2101 NULL);
2102 }
2103
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105 struct task_struct *to,
2106 struct file *file)
2107 {
2108 u32 sid = task_sid(to);
2109 struct file_security_struct *fsec = file->f_security;
2110 struct dentry *dentry = file->f_path.dentry;
2111 struct inode_security_struct *isec;
2112 struct common_audit_data ad;
2113 int rc;
2114
2115 ad.type = LSM_AUDIT_DATA_PATH;
2116 ad.u.path = file->f_path;
2117
2118 if (sid != fsec->sid) {
2119 rc = avc_has_perm(sid, fsec->sid,
2120 SECCLASS_FD,
2121 FD__USE,
2122 &ad);
2123 if (rc)
2124 return rc;
2125 }
2126
2127 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2128 return 0;
2129
2130 isec = backing_inode_security(dentry);
2131 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2132 &ad);
2133 }
2134
2135 static int selinux_ptrace_access_check(struct task_struct *child,
2136 unsigned int mode)
2137 {
2138 if (mode & PTRACE_MODE_READ) {
2139 u32 sid = current_sid();
2140 u32 csid = task_sid(child);
2141 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2142 }
2143
2144 return current_has_perm(child, PROCESS__PTRACE);
2145 }
2146
2147 static int selinux_ptrace_traceme(struct task_struct *parent)
2148 {
2149 return task_has_perm(parent, current, PROCESS__PTRACE);
2150 }
2151
2152 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2153 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2154 {
2155 return current_has_perm(target, PROCESS__GETCAP);
2156 }
2157
2158 static int selinux_capset(struct cred *new, const struct cred *old,
2159 const kernel_cap_t *effective,
2160 const kernel_cap_t *inheritable,
2161 const kernel_cap_t *permitted)
2162 {
2163 return cred_has_perm(old, new, PROCESS__SETCAP);
2164 }
2165
2166 /*
2167 * (This comment used to live with the selinux_task_setuid hook,
2168 * which was removed).
2169 *
2170 * Since setuid only affects the current process, and since the SELinux
2171 * controls are not based on the Linux identity attributes, SELinux does not
2172 * need to control this operation. However, SELinux does control the use of
2173 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2174 */
2175
2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2177 int cap, int audit)
2178 {
2179 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2180 }
2181
2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2183 {
2184 const struct cred *cred = current_cred();
2185 int rc = 0;
2186
2187 if (!sb)
2188 return 0;
2189
2190 switch (cmds) {
2191 case Q_SYNC:
2192 case Q_QUOTAON:
2193 case Q_QUOTAOFF:
2194 case Q_SETINFO:
2195 case Q_SETQUOTA:
2196 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2197 break;
2198 case Q_GETFMT:
2199 case Q_GETINFO:
2200 case Q_GETQUOTA:
2201 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2202 break;
2203 default:
2204 rc = 0; /* let the kernel handle invalid cmds */
2205 break;
2206 }
2207 return rc;
2208 }
2209
2210 static int selinux_quota_on(struct dentry *dentry)
2211 {
2212 const struct cred *cred = current_cred();
2213
2214 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2215 }
2216
2217 static int selinux_syslog(int type)
2218 {
2219 int rc;
2220
2221 switch (type) {
2222 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2223 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2224 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2225 break;
2226 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2227 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2228 /* Set level of messages printed to console */
2229 case SYSLOG_ACTION_CONSOLE_LEVEL:
2230 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2231 break;
2232 case SYSLOG_ACTION_CLOSE: /* Close log */
2233 case SYSLOG_ACTION_OPEN: /* Open log */
2234 case SYSLOG_ACTION_READ: /* Read from log */
2235 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2236 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2237 default:
2238 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2239 break;
2240 }
2241 return rc;
2242 }
2243
2244 /*
2245 * Check that a process has enough memory to allocate a new virtual
2246 * mapping. 0 means there is enough memory for the allocation to
2247 * succeed and -ENOMEM implies there is not.
2248 *
2249 * Do not audit the selinux permission check, as this is applied to all
2250 * processes that allocate mappings.
2251 */
2252 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2253 {
2254 int rc, cap_sys_admin = 0;
2255
2256 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2257 SECURITY_CAP_NOAUDIT, true);
2258 if (rc == 0)
2259 cap_sys_admin = 1;
2260
2261 return cap_sys_admin;
2262 }
2263
2264 /* binprm security operations */
2265
2266 static u32 ptrace_parent_sid(struct task_struct *task)
2267 {
2268 u32 sid = 0;
2269 struct task_struct *tracer;
2270
2271 rcu_read_lock();
2272 tracer = ptrace_parent(task);
2273 if (tracer)
2274 sid = task_sid(tracer);
2275 rcu_read_unlock();
2276
2277 return sid;
2278 }
2279
2280 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2281 const struct task_security_struct *old_tsec,
2282 const struct task_security_struct *new_tsec)
2283 {
2284 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2285 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2286 int rc;
2287
2288 if (!nnp && !nosuid)
2289 return 0; /* neither NNP nor nosuid */
2290
2291 if (new_tsec->sid == old_tsec->sid)
2292 return 0; /* No change in credentials */
2293
2294 /*
2295 * The only transitions we permit under NNP or nosuid
2296 * are transitions to bounded SIDs, i.e. SIDs that are
2297 * guaranteed to only be allowed a subset of the permissions
2298 * of the current SID.
2299 */
2300 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2301 if (rc) {
2302 /*
2303 * On failure, preserve the errno values for NNP vs nosuid.
2304 * NNP: Operation not permitted for caller.
2305 * nosuid: Permission denied to file.
2306 */
2307 if (nnp)
2308 return -EPERM;
2309 else
2310 return -EACCES;
2311 }
2312 return 0;
2313 }
2314
2315 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2316 {
2317 const struct task_security_struct *old_tsec;
2318 struct task_security_struct *new_tsec;
2319 struct inode_security_struct *isec;
2320 struct common_audit_data ad;
2321 struct inode *inode = file_inode(bprm->file);
2322 int rc;
2323
2324 /* SELinux context only depends on initial program or script and not
2325 * the script interpreter */
2326 if (bprm->cred_prepared)
2327 return 0;
2328
2329 old_tsec = current_security();
2330 new_tsec = bprm->cred->security;
2331 isec = inode_security(inode);
2332
2333 /* Default to the current task SID. */
2334 new_tsec->sid = old_tsec->sid;
2335 new_tsec->osid = old_tsec->sid;
2336
2337 /* Reset fs, key, and sock SIDs on execve. */
2338 new_tsec->create_sid = 0;
2339 new_tsec->keycreate_sid = 0;
2340 new_tsec->sockcreate_sid = 0;
2341
2342 if (old_tsec->exec_sid) {
2343 new_tsec->sid = old_tsec->exec_sid;
2344 /* Reset exec SID on execve. */
2345 new_tsec->exec_sid = 0;
2346
2347 /* Fail on NNP or nosuid if not an allowed transition. */
2348 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2349 if (rc)
2350 return rc;
2351 } else {
2352 /* Check for a default transition on this program. */
2353 rc = security_transition_sid(old_tsec->sid, isec->sid,
2354 SECCLASS_PROCESS, NULL,
2355 &new_tsec->sid);
2356 if (rc)
2357 return rc;
2358
2359 /*
2360 * Fallback to old SID on NNP or nosuid if not an allowed
2361 * transition.
2362 */
2363 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2364 if (rc)
2365 new_tsec->sid = old_tsec->sid;
2366 }
2367
2368 ad.type = LSM_AUDIT_DATA_PATH;
2369 ad.u.path = bprm->file->f_path;
2370
2371 if (new_tsec->sid == old_tsec->sid) {
2372 rc = avc_has_perm(old_tsec->sid, isec->sid,
2373 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2374 if (rc)
2375 return rc;
2376 } else {
2377 /* Check permissions for the transition. */
2378 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2379 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2380 if (rc)
2381 return rc;
2382
2383 rc = avc_has_perm(new_tsec->sid, isec->sid,
2384 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2385 if (rc)
2386 return rc;
2387
2388 /* Check for shared state */
2389 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2390 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2391 SECCLASS_PROCESS, PROCESS__SHARE,
2392 NULL);
2393 if (rc)
2394 return -EPERM;
2395 }
2396
2397 /* Make sure that anyone attempting to ptrace over a task that
2398 * changes its SID has the appropriate permit */
2399 if (bprm->unsafe &
2400 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2401 u32 ptsid = ptrace_parent_sid(current);
2402 if (ptsid != 0) {
2403 rc = avc_has_perm(ptsid, new_tsec->sid,
2404 SECCLASS_PROCESS,
2405 PROCESS__PTRACE, NULL);
2406 if (rc)
2407 return -EPERM;
2408 }
2409 }
2410
2411 /* Clear any possibly unsafe personality bits on exec: */
2412 bprm->per_clear |= PER_CLEAR_ON_SETID;
2413 }
2414
2415 return 0;
2416 }
2417
2418 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2419 {
2420 const struct task_security_struct *tsec = current_security();
2421 u32 sid, osid;
2422 int atsecure = 0;
2423
2424 sid = tsec->sid;
2425 osid = tsec->osid;
2426
2427 if (osid != sid) {
2428 /* Enable secure mode for SIDs transitions unless
2429 the noatsecure permission is granted between
2430 the two SIDs, i.e. ahp returns 0. */
2431 atsecure = avc_has_perm(osid, sid,
2432 SECCLASS_PROCESS,
2433 PROCESS__NOATSECURE, NULL);
2434 }
2435
2436 return !!atsecure;
2437 }
2438
2439 static int match_file(const void *p, struct file *file, unsigned fd)
2440 {
2441 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2442 }
2443
2444 /* Derived from fs/exec.c:flush_old_files. */
2445 static inline void flush_unauthorized_files(const struct cred *cred,
2446 struct files_struct *files)
2447 {
2448 struct file *file, *devnull = NULL;
2449 struct tty_struct *tty;
2450 int drop_tty = 0;
2451 unsigned n;
2452
2453 tty = get_current_tty();
2454 if (tty) {
2455 spin_lock(&tty->files_lock);
2456 if (!list_empty(&tty->tty_files)) {
2457 struct tty_file_private *file_priv;
2458
2459 /* Revalidate access to controlling tty.
2460 Use file_path_has_perm on the tty path directly
2461 rather than using file_has_perm, as this particular
2462 open file may belong to another process and we are
2463 only interested in the inode-based check here. */
2464 file_priv = list_first_entry(&tty->tty_files,
2465 struct tty_file_private, list);
2466 file = file_priv->file;
2467 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2468 drop_tty = 1;
2469 }
2470 spin_unlock(&tty->files_lock);
2471 tty_kref_put(tty);
2472 }
2473 /* Reset controlling tty. */
2474 if (drop_tty)
2475 no_tty();
2476
2477 /* Revalidate access to inherited open files. */
2478 n = iterate_fd(files, 0, match_file, cred);
2479 if (!n) /* none found? */
2480 return;
2481
2482 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2483 if (IS_ERR(devnull))
2484 devnull = NULL;
2485 /* replace all the matching ones with this */
2486 do {
2487 replace_fd(n - 1, devnull, 0);
2488 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2489 if (devnull)
2490 fput(devnull);
2491 }
2492
2493 /*
2494 * Prepare a process for imminent new credential changes due to exec
2495 */
2496 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2497 {
2498 struct task_security_struct *new_tsec;
2499 struct rlimit *rlim, *initrlim;
2500 int rc, i;
2501
2502 new_tsec = bprm->cred->security;
2503 if (new_tsec->sid == new_tsec->osid)
2504 return;
2505
2506 /* Close files for which the new task SID is not authorized. */
2507 flush_unauthorized_files(bprm->cred, current->files);
2508
2509 /* Always clear parent death signal on SID transitions. */
2510 current->pdeath_signal = 0;
2511
2512 /* Check whether the new SID can inherit resource limits from the old
2513 * SID. If not, reset all soft limits to the lower of the current
2514 * task's hard limit and the init task's soft limit.
2515 *
2516 * Note that the setting of hard limits (even to lower them) can be
2517 * controlled by the setrlimit check. The inclusion of the init task's
2518 * soft limit into the computation is to avoid resetting soft limits
2519 * higher than the default soft limit for cases where the default is
2520 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2521 */
2522 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2523 PROCESS__RLIMITINH, NULL);
2524 if (rc) {
2525 /* protect against do_prlimit() */
2526 task_lock(current);
2527 for (i = 0; i < RLIM_NLIMITS; i++) {
2528 rlim = current->signal->rlim + i;
2529 initrlim = init_task.signal->rlim + i;
2530 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2531 }
2532 task_unlock(current);
2533 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534 }
2535 }
2536
2537 /*
2538 * Clean up the process immediately after the installation of new credentials
2539 * due to exec
2540 */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543 const struct task_security_struct *tsec = current_security();
2544 struct itimerval itimer;
2545 u32 osid, sid;
2546 int rc, i;
2547
2548 osid = tsec->osid;
2549 sid = tsec->sid;
2550
2551 if (sid == osid)
2552 return;
2553
2554 /* Check whether the new SID can inherit signal state from the old SID.
2555 * If not, clear itimers to avoid subsequent signal generation and
2556 * flush and unblock signals.
2557 *
2558 * This must occur _after_ the task SID has been updated so that any
2559 * kill done after the flush will be checked against the new SID.
2560 */
2561 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2562 if (rc) {
2563 memset(&itimer, 0, sizeof itimer);
2564 for (i = 0; i < 3; i++)
2565 do_setitimer(i, &itimer, NULL);
2566 spin_lock_irq(&current->sighand->siglock);
2567 if (!fatal_signal_pending(current)) {
2568 flush_sigqueue(&current->pending);
2569 flush_sigqueue(&current->signal->shared_pending);
2570 flush_signal_handlers(current, 1);
2571 sigemptyset(&current->blocked);
2572 recalc_sigpending();
2573 }
2574 spin_unlock_irq(&current->sighand->siglock);
2575 }
2576
2577 /* Wake up the parent if it is waiting so that it can recheck
2578 * wait permission to the new task SID. */
2579 read_lock(&tasklist_lock);
2580 __wake_up_parent(current, current->real_parent);
2581 read_unlock(&tasklist_lock);
2582 }
2583
2584 /* superblock security operations */
2585
2586 static int selinux_sb_alloc_security(struct super_block *sb)
2587 {
2588 return superblock_alloc_security(sb);
2589 }
2590
2591 static void selinux_sb_free_security(struct super_block *sb)
2592 {
2593 superblock_free_security(sb);
2594 }
2595
2596 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2597 {
2598 if (plen > olen)
2599 return 0;
2600
2601 return !memcmp(prefix, option, plen);
2602 }
2603
2604 static inline int selinux_option(char *option, int len)
2605 {
2606 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2607 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2608 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2609 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2610 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2611 }
2612
2613 static inline void take_option(char **to, char *from, int *first, int len)
2614 {
2615 if (!*first) {
2616 **to = ',';
2617 *to += 1;
2618 } else
2619 *first = 0;
2620 memcpy(*to, from, len);
2621 *to += len;
2622 }
2623
2624 static inline void take_selinux_option(char **to, char *from, int *first,
2625 int len)
2626 {
2627 int current_size = 0;
2628
2629 if (!*first) {
2630 **to = '|';
2631 *to += 1;
2632 } else
2633 *first = 0;
2634
2635 while (current_size < len) {
2636 if (*from != '"') {
2637 **to = *from;
2638 *to += 1;
2639 }
2640 from += 1;
2641 current_size += 1;
2642 }
2643 }
2644
2645 static int selinux_sb_copy_data(char *orig, char *copy)
2646 {
2647 int fnosec, fsec, rc = 0;
2648 char *in_save, *in_curr, *in_end;
2649 char *sec_curr, *nosec_save, *nosec;
2650 int open_quote = 0;
2651
2652 in_curr = orig;
2653 sec_curr = copy;
2654
2655 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2656 if (!nosec) {
2657 rc = -ENOMEM;
2658 goto out;
2659 }
2660
2661 nosec_save = nosec;
2662 fnosec = fsec = 1;
2663 in_save = in_end = orig;
2664
2665 do {
2666 if (*in_end == '"')
2667 open_quote = !open_quote;
2668 if ((*in_end == ',' && open_quote == 0) ||
2669 *in_end == '\0') {
2670 int len = in_end - in_curr;
2671
2672 if (selinux_option(in_curr, len))
2673 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2674 else
2675 take_option(&nosec, in_curr, &fnosec, len);
2676
2677 in_curr = in_end + 1;
2678 }
2679 } while (*in_end++);
2680
2681 strcpy(in_save, nosec_save);
2682 free_page((unsigned long)nosec_save);
2683 out:
2684 return rc;
2685 }
2686
2687 static int selinux_sb_remount(struct super_block *sb, void *data)
2688 {
2689 int rc, i, *flags;
2690 struct security_mnt_opts opts;
2691 char *secdata, **mount_options;
2692 struct superblock_security_struct *sbsec = sb->s_security;
2693
2694 if (!(sbsec->flags & SE_SBINITIALIZED))
2695 return 0;
2696
2697 if (!data)
2698 return 0;
2699
2700 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2701 return 0;
2702
2703 security_init_mnt_opts(&opts);
2704 secdata = alloc_secdata();
2705 if (!secdata)
2706 return -ENOMEM;
2707 rc = selinux_sb_copy_data(data, secdata);
2708 if (rc)
2709 goto out_free_secdata;
2710
2711 rc = selinux_parse_opts_str(secdata, &opts);
2712 if (rc)
2713 goto out_free_secdata;
2714
2715 mount_options = opts.mnt_opts;
2716 flags = opts.mnt_opts_flags;
2717
2718 for (i = 0; i < opts.num_mnt_opts; i++) {
2719 u32 sid;
2720
2721 if (flags[i] == SBLABEL_MNT)
2722 continue;
2723 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2724 if (rc) {
2725 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2726 "(%s) failed for (dev %s, type %s) errno=%d\n",
2727 mount_options[i], sb->s_id, sb->s_type->name, rc);
2728 goto out_free_opts;
2729 }
2730 rc = -EINVAL;
2731 switch (flags[i]) {
2732 case FSCONTEXT_MNT:
2733 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2734 goto out_bad_option;
2735 break;
2736 case CONTEXT_MNT:
2737 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2738 goto out_bad_option;
2739 break;
2740 case ROOTCONTEXT_MNT: {
2741 struct inode_security_struct *root_isec;
2742 root_isec = backing_inode_security(sb->s_root);
2743
2744 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2745 goto out_bad_option;
2746 break;
2747 }
2748 case DEFCONTEXT_MNT:
2749 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2750 goto out_bad_option;
2751 break;
2752 default:
2753 goto out_free_opts;
2754 }
2755 }
2756
2757 rc = 0;
2758 out_free_opts:
2759 security_free_mnt_opts(&opts);
2760 out_free_secdata:
2761 free_secdata(secdata);
2762 return rc;
2763 out_bad_option:
2764 printk(KERN_WARNING "SELinux: unable to change security options "
2765 "during remount (dev %s, type=%s)\n", sb->s_id,
2766 sb->s_type->name);
2767 goto out_free_opts;
2768 }
2769
2770 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2771 {
2772 const struct cred *cred = current_cred();
2773 struct common_audit_data ad;
2774 int rc;
2775
2776 rc = superblock_doinit(sb, data);
2777 if (rc)
2778 return rc;
2779
2780 /* Allow all mounts performed by the kernel */
2781 if (flags & MS_KERNMOUNT)
2782 return 0;
2783
2784 ad.type = LSM_AUDIT_DATA_DENTRY;
2785 ad.u.dentry = sb->s_root;
2786 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2787 }
2788
2789 static int selinux_sb_statfs(struct dentry *dentry)
2790 {
2791 const struct cred *cred = current_cred();
2792 struct common_audit_data ad;
2793
2794 ad.type = LSM_AUDIT_DATA_DENTRY;
2795 ad.u.dentry = dentry->d_sb->s_root;
2796 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2797 }
2798
2799 static int selinux_mount(const char *dev_name,
2800 const struct path *path,
2801 const char *type,
2802 unsigned long flags,
2803 void *data)
2804 {
2805 const struct cred *cred = current_cred();
2806
2807 if (flags & MS_REMOUNT)
2808 return superblock_has_perm(cred, path->dentry->d_sb,
2809 FILESYSTEM__REMOUNT, NULL);
2810 else
2811 return path_has_perm(cred, path, FILE__MOUNTON);
2812 }
2813
2814 static int selinux_umount(struct vfsmount *mnt, int flags)
2815 {
2816 const struct cred *cred = current_cred();
2817
2818 return superblock_has_perm(cred, mnt->mnt_sb,
2819 FILESYSTEM__UNMOUNT, NULL);
2820 }
2821
2822 /* inode security operations */
2823
2824 static int selinux_inode_alloc_security(struct inode *inode)
2825 {
2826 return inode_alloc_security(inode);
2827 }
2828
2829 static void selinux_inode_free_security(struct inode *inode)
2830 {
2831 inode_free_security(inode);
2832 }
2833
2834 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2835 const struct qstr *name, void **ctx,
2836 u32 *ctxlen)
2837 {
2838 u32 newsid;
2839 int rc;
2840
2841 rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2842 inode_mode_to_security_class(mode),
2843 &newsid);
2844 if (rc)
2845 return rc;
2846
2847 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2848 }
2849
2850 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2851 const struct qstr *qstr,
2852 const char **name,
2853 void **value, size_t *len)
2854 {
2855 const struct task_security_struct *tsec = current_security();
2856 struct superblock_security_struct *sbsec;
2857 u32 sid, newsid, clen;
2858 int rc;
2859 char *context;
2860
2861 sbsec = dir->i_sb->s_security;
2862
2863 sid = tsec->sid;
2864 newsid = tsec->create_sid;
2865
2866 rc = selinux_determine_inode_label(
2867 dir, qstr,
2868 inode_mode_to_security_class(inode->i_mode),
2869 &newsid);
2870 if (rc)
2871 return rc;
2872
2873 /* Possibly defer initialization to selinux_complete_init. */
2874 if (sbsec->flags & SE_SBINITIALIZED) {
2875 struct inode_security_struct *isec = inode->i_security;
2876 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2877 isec->sid = newsid;
2878 isec->initialized = LABEL_INITIALIZED;
2879 }
2880
2881 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2882 return -EOPNOTSUPP;
2883
2884 if (name)
2885 *name = XATTR_SELINUX_SUFFIX;
2886
2887 if (value && len) {
2888 rc = security_sid_to_context_force(newsid, &context, &clen);
2889 if (rc)
2890 return rc;
2891 *value = context;
2892 *len = clen;
2893 }
2894
2895 return 0;
2896 }
2897
2898 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2899 {
2900 return may_create(dir, dentry, SECCLASS_FILE);
2901 }
2902
2903 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2904 {
2905 return may_link(dir, old_dentry, MAY_LINK);
2906 }
2907
2908 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2909 {
2910 return may_link(dir, dentry, MAY_UNLINK);
2911 }
2912
2913 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2914 {
2915 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2916 }
2917
2918 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2919 {
2920 return may_create(dir, dentry, SECCLASS_DIR);
2921 }
2922
2923 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2924 {
2925 return may_link(dir, dentry, MAY_RMDIR);
2926 }
2927
2928 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2929 {
2930 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2931 }
2932
2933 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2934 struct inode *new_inode, struct dentry *new_dentry)
2935 {
2936 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2937 }
2938
2939 static int selinux_inode_readlink(struct dentry *dentry)
2940 {
2941 const struct cred *cred = current_cred();
2942
2943 return dentry_has_perm(cred, dentry, FILE__READ);
2944 }
2945
2946 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2947 bool rcu)
2948 {
2949 const struct cred *cred = current_cred();
2950 struct common_audit_data ad;
2951 struct inode_security_struct *isec;
2952 u32 sid;
2953
2954 validate_creds(cred);
2955
2956 ad.type = LSM_AUDIT_DATA_DENTRY;
2957 ad.u.dentry = dentry;
2958 sid = cred_sid(cred);
2959 isec = inode_security_rcu(inode, rcu);
2960 if (IS_ERR(isec))
2961 return PTR_ERR(isec);
2962
2963 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2964 rcu ? MAY_NOT_BLOCK : 0);
2965 }
2966
2967 static noinline int audit_inode_permission(struct inode *inode,
2968 u32 perms, u32 audited, u32 denied,
2969 int result,
2970 unsigned flags)
2971 {
2972 struct common_audit_data ad;
2973 struct inode_security_struct *isec = inode->i_security;
2974 int rc;
2975
2976 ad.type = LSM_AUDIT_DATA_INODE;
2977 ad.u.inode = inode;
2978
2979 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2980 audited, denied, result, &ad, flags);
2981 if (rc)
2982 return rc;
2983 return 0;
2984 }
2985
2986 static int selinux_inode_permission(struct inode *inode, int mask)
2987 {
2988 const struct cred *cred = current_cred();
2989 u32 perms;
2990 bool from_access;
2991 unsigned flags = mask & MAY_NOT_BLOCK;
2992 struct inode_security_struct *isec;
2993 u32 sid;
2994 struct av_decision avd;
2995 int rc, rc2;
2996 u32 audited, denied;
2997
2998 from_access = mask & MAY_ACCESS;
2999 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3000
3001 /* No permission to check. Existence test. */
3002 if (!mask)
3003 return 0;
3004
3005 validate_creds(cred);
3006
3007 if (unlikely(IS_PRIVATE(inode)))
3008 return 0;
3009
3010 perms = file_mask_to_av(inode->i_mode, mask);
3011
3012 sid = cred_sid(cred);
3013 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3014 if (IS_ERR(isec))
3015 return PTR_ERR(isec);
3016
3017 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3018 audited = avc_audit_required(perms, &avd, rc,
3019 from_access ? FILE__AUDIT_ACCESS : 0,
3020 &denied);
3021 if (likely(!audited))
3022 return rc;
3023
3024 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3025 if (rc2)
3026 return rc2;
3027 return rc;
3028 }
3029
3030 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3031 {
3032 const struct cred *cred = current_cred();
3033 unsigned int ia_valid = iattr->ia_valid;
3034 __u32 av = FILE__WRITE;
3035
3036 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3037 if (ia_valid & ATTR_FORCE) {
3038 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3039 ATTR_FORCE);
3040 if (!ia_valid)
3041 return 0;
3042 }
3043
3044 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3045 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3046 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3047
3048 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3049 && !(ia_valid & ATTR_FILE))
3050 av |= FILE__OPEN;
3051
3052 return dentry_has_perm(cred, dentry, av);
3053 }
3054
3055 static int selinux_inode_getattr(const struct path *path)
3056 {
3057 return path_has_perm(current_cred(), path, FILE__GETATTR);
3058 }
3059
3060 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3061 {
3062 const struct cred *cred = current_cred();
3063
3064 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3065 sizeof XATTR_SECURITY_PREFIX - 1)) {
3066 if (!strcmp(name, XATTR_NAME_CAPS)) {
3067 if (!capable(CAP_SETFCAP))
3068 return -EPERM;
3069 } else if (!capable(CAP_SYS_ADMIN)) {
3070 /* A different attribute in the security namespace.
3071 Restrict to administrator. */
3072 return -EPERM;
3073 }
3074 }
3075
3076 /* Not an attribute we recognize, so just check the
3077 ordinary setattr permission. */
3078 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3079 }
3080
3081 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3082 const void *value, size_t size, int flags)
3083 {
3084 struct inode *inode = d_backing_inode(dentry);
3085 struct inode_security_struct *isec;
3086 struct superblock_security_struct *sbsec;
3087 struct common_audit_data ad;
3088 u32 newsid, sid = current_sid();
3089 int rc = 0;
3090
3091 if (strcmp(name, XATTR_NAME_SELINUX))
3092 return selinux_inode_setotherxattr(dentry, name);
3093
3094 sbsec = inode->i_sb->s_security;
3095 if (!(sbsec->flags & SBLABEL_MNT))
3096 return -EOPNOTSUPP;
3097
3098 if (!inode_owner_or_capable(inode))
3099 return -EPERM;
3100
3101 ad.type = LSM_AUDIT_DATA_DENTRY;
3102 ad.u.dentry = dentry;
3103
3104 isec = backing_inode_security(dentry);
3105 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3106 FILE__RELABELFROM, &ad);
3107 if (rc)
3108 return rc;
3109
3110 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3111 if (rc == -EINVAL) {
3112 if (!capable(CAP_MAC_ADMIN)) {
3113 struct audit_buffer *ab;
3114 size_t audit_size;
3115 const char *str;
3116
3117 /* We strip a nul only if it is at the end, otherwise the
3118 * context contains a nul and we should audit that */
3119 if (value) {
3120 str = value;
3121 if (str[size - 1] == '\0')
3122 audit_size = size - 1;
3123 else
3124 audit_size = size;
3125 } else {
3126 str = "";
3127 audit_size = 0;
3128 }
3129 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3130 audit_log_format(ab, "op=setxattr invalid_context=");
3131 audit_log_n_untrustedstring(ab, value, audit_size);
3132 audit_log_end(ab);
3133
3134 return rc;
3135 }
3136 rc = security_context_to_sid_force(value, size, &newsid);
3137 }
3138 if (rc)
3139 return rc;
3140
3141 rc = avc_has_perm(sid, newsid, isec->sclass,
3142 FILE__RELABELTO, &ad);
3143 if (rc)
3144 return rc;
3145
3146 rc = security_validate_transition(isec->sid, newsid, sid,
3147 isec->sclass);
3148 if (rc)
3149 return rc;
3150
3151 return avc_has_perm(newsid,
3152 sbsec->sid,
3153 SECCLASS_FILESYSTEM,
3154 FILESYSTEM__ASSOCIATE,
3155 &ad);
3156 }
3157
3158 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3159 const void *value, size_t size,
3160 int flags)
3161 {
3162 struct inode *inode = d_backing_inode(dentry);
3163 struct inode_security_struct *isec;
3164 u32 newsid;
3165 int rc;
3166
3167 if (strcmp(name, XATTR_NAME_SELINUX)) {
3168 /* Not an attribute we recognize, so nothing to do. */
3169 return;
3170 }
3171
3172 rc = security_context_to_sid_force(value, size, &newsid);
3173 if (rc) {
3174 printk(KERN_ERR "SELinux: unable to map context to SID"
3175 "for (%s, %lu), rc=%d\n",
3176 inode->i_sb->s_id, inode->i_ino, -rc);
3177 return;
3178 }
3179
3180 isec = backing_inode_security(dentry);
3181 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3182 isec->sid = newsid;
3183 isec->initialized = LABEL_INITIALIZED;
3184
3185 return;
3186 }
3187
3188 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3189 {
3190 const struct cred *cred = current_cred();
3191
3192 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3193 }
3194
3195 static int selinux_inode_listxattr(struct dentry *dentry)
3196 {
3197 const struct cred *cred = current_cred();
3198
3199 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3200 }
3201
3202 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3203 {
3204 if (strcmp(name, XATTR_NAME_SELINUX))
3205 return selinux_inode_setotherxattr(dentry, name);
3206
3207 /* No one is allowed to remove a SELinux security label.
3208 You can change the label, but all data must be labeled. */
3209 return -EACCES;
3210 }
3211
3212 /*
3213 * Copy the inode security context value to the user.
3214 *
3215 * Permission check is handled by selinux_inode_getxattr hook.
3216 */
3217 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3218 {
3219 u32 size;
3220 int error;
3221 char *context = NULL;
3222 struct inode_security_struct *isec;
3223
3224 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3225 return -EOPNOTSUPP;
3226
3227 /*
3228 * If the caller has CAP_MAC_ADMIN, then get the raw context
3229 * value even if it is not defined by current policy; otherwise,
3230 * use the in-core value under current policy.
3231 * Use the non-auditing forms of the permission checks since
3232 * getxattr may be called by unprivileged processes commonly
3233 * and lack of permission just means that we fall back to the
3234 * in-core context value, not a denial.
3235 */
3236 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3237 SECURITY_CAP_NOAUDIT);
3238 if (!error)
3239 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3240 SECURITY_CAP_NOAUDIT, true);
3241 isec = inode_security(inode);
3242 if (!error)
3243 error = security_sid_to_context_force(isec->sid, &context,
3244 &size);
3245 else
3246 error = security_sid_to_context(isec->sid, &context, &size);
3247 if (error)
3248 return error;
3249 error = size;
3250 if (alloc) {
3251 *buffer = context;
3252 goto out_nofree;
3253 }
3254 kfree(context);
3255 out_nofree:
3256 return error;
3257 }
3258
3259 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3260 const void *value, size_t size, int flags)
3261 {
3262 struct inode_security_struct *isec = inode_security_novalidate(inode);
3263 u32 newsid;
3264 int rc;
3265
3266 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3267 return -EOPNOTSUPP;
3268
3269 if (!value || !size)
3270 return -EACCES;
3271
3272 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3273 if (rc)
3274 return rc;
3275
3276 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3277 isec->sid = newsid;
3278 isec->initialized = LABEL_INITIALIZED;
3279 return 0;
3280 }
3281
3282 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3283 {
3284 const int len = sizeof(XATTR_NAME_SELINUX);
3285 if (buffer && len <= buffer_size)
3286 memcpy(buffer, XATTR_NAME_SELINUX, len);
3287 return len;
3288 }
3289
3290 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3291 {
3292 struct inode_security_struct *isec = inode_security_novalidate(inode);
3293 *secid = isec->sid;
3294 }
3295
3296 /* file security operations */
3297
3298 static int selinux_revalidate_file_permission(struct file *file, int mask)
3299 {
3300 const struct cred *cred = current_cred();
3301 struct inode *inode = file_inode(file);
3302
3303 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3304 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3305 mask |= MAY_APPEND;
3306
3307 return file_has_perm(cred, file,
3308 file_mask_to_av(inode->i_mode, mask));
3309 }
3310
3311 static int selinux_file_permission(struct file *file, int mask)
3312 {
3313 struct inode *inode = file_inode(file);
3314 struct file_security_struct *fsec = file->f_security;
3315 struct inode_security_struct *isec;
3316 u32 sid = current_sid();
3317
3318 if (!mask)
3319 /* No permission to check. Existence test. */
3320 return 0;
3321
3322 isec = inode_security(inode);
3323 if (sid == fsec->sid && fsec->isid == isec->sid &&
3324 fsec->pseqno == avc_policy_seqno())
3325 /* No change since file_open check. */
3326 return 0;
3327
3328 return selinux_revalidate_file_permission(file, mask);
3329 }
3330
3331 static int selinux_file_alloc_security(struct file *file)
3332 {
3333 return file_alloc_security(file);
3334 }
3335
3336 static void selinux_file_free_security(struct file *file)
3337 {
3338 file_free_security(file);
3339 }
3340
3341 /*
3342 * Check whether a task has the ioctl permission and cmd
3343 * operation to an inode.
3344 */
3345 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3346 u32 requested, u16 cmd)
3347 {
3348 struct common_audit_data ad;
3349 struct file_security_struct *fsec = file->f_security;
3350 struct inode *inode = file_inode(file);
3351 struct inode_security_struct *isec;
3352 struct lsm_ioctlop_audit ioctl;
3353 u32 ssid = cred_sid(cred);
3354 int rc;
3355 u8 driver = cmd >> 8;
3356 u8 xperm = cmd & 0xff;
3357
3358 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3359 ad.u.op = &ioctl;
3360 ad.u.op->cmd = cmd;
3361 ad.u.op->path = file->f_path;
3362
3363 if (ssid != fsec->sid) {
3364 rc = avc_has_perm(ssid, fsec->sid,
3365 SECCLASS_FD,
3366 FD__USE,
3367 &ad);
3368 if (rc)
3369 goto out;
3370 }
3371
3372 if (unlikely(IS_PRIVATE(inode)))
3373 return 0;
3374
3375 isec = inode_security(inode);
3376 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3377 requested, driver, xperm, &ad);
3378 out:
3379 return rc;
3380 }
3381
3382 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3383 unsigned long arg)
3384 {
3385 const struct cred *cred = current_cred();
3386 int error = 0;
3387
3388 switch (cmd) {
3389 case FIONREAD:
3390 /* fall through */
3391 case FIBMAP:
3392 /* fall through */
3393 case FIGETBSZ:
3394 /* fall through */
3395 case FS_IOC_GETFLAGS:
3396 /* fall through */
3397 case FS_IOC_GETVERSION:
3398 error = file_has_perm(cred, file, FILE__GETATTR);
3399 break;
3400
3401 case FS_IOC_SETFLAGS:
3402 /* fall through */
3403 case FS_IOC_SETVERSION:
3404 error = file_has_perm(cred, file, FILE__SETATTR);
3405 break;
3406
3407 /* sys_ioctl() checks */
3408 case FIONBIO:
3409 /* fall through */
3410 case FIOASYNC:
3411 error = file_has_perm(cred, file, 0);
3412 break;
3413
3414 case KDSKBENT:
3415 case KDSKBSENT:
3416 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3417 SECURITY_CAP_AUDIT, true);
3418 break;
3419
3420 /* default case assumes that the command will go
3421 * to the file's ioctl() function.
3422 */
3423 default:
3424 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3425 }
3426 return error;
3427 }
3428
3429 static int default_noexec;
3430
3431 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3432 {
3433 const struct cred *cred = current_cred();
3434 int rc = 0;
3435
3436 if (default_noexec &&
3437 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3438 (!shared && (prot & PROT_WRITE)))) {
3439 /*
3440 * We are making executable an anonymous mapping or a
3441 * private file mapping that will also be writable.
3442 * This has an additional check.
3443 */
3444 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3445 if (rc)
3446 goto error;
3447 }
3448
3449 if (file) {
3450 /* read access is always possible with a mapping */
3451 u32 av = FILE__READ;
3452
3453 /* write access only matters if the mapping is shared */
3454 if (shared && (prot & PROT_WRITE))
3455 av |= FILE__WRITE;
3456
3457 if (prot & PROT_EXEC)
3458 av |= FILE__EXECUTE;
3459
3460 return file_has_perm(cred, file, av);
3461 }
3462
3463 error:
3464 return rc;
3465 }
3466
3467 static int selinux_mmap_addr(unsigned long addr)
3468 {
3469 int rc = 0;
3470
3471 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3472 u32 sid = current_sid();
3473 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3474 MEMPROTECT__MMAP_ZERO, NULL);
3475 }
3476
3477 return rc;
3478 }
3479
3480 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3481 unsigned long prot, unsigned long flags)
3482 {
3483 if (selinux_checkreqprot)
3484 prot = reqprot;
3485
3486 return file_map_prot_check(file, prot,
3487 (flags & MAP_TYPE) == MAP_SHARED);
3488 }
3489
3490 static int selinux_file_mprotect(struct vm_area_struct *vma,
3491 unsigned long reqprot,
3492 unsigned long prot)
3493 {
3494 const struct cred *cred = current_cred();
3495
3496 if (selinux_checkreqprot)
3497 prot = reqprot;
3498
3499 if (default_noexec &&
3500 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3501 int rc = 0;
3502 if (vma->vm_start >= vma->vm_mm->start_brk &&
3503 vma->vm_end <= vma->vm_mm->brk) {
3504 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3505 } else if (!vma->vm_file &&
3506 ((vma->vm_start <= vma->vm_mm->start_stack &&
3507 vma->vm_end >= vma->vm_mm->start_stack) ||
3508 vma_is_stack_for_task(vma, current))) {
3509 rc = current_has_perm(current, PROCESS__EXECSTACK);
3510 } else if (vma->vm_file && vma->anon_vma) {
3511 /*
3512 * We are making executable a file mapping that has
3513 * had some COW done. Since pages might have been
3514 * written, check ability to execute the possibly
3515 * modified content. This typically should only
3516 * occur for text relocations.
3517 */
3518 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3519 }
3520 if (rc)
3521 return rc;
3522 }
3523
3524 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3525 }
3526
3527 static int selinux_file_lock(struct file *file, unsigned int cmd)
3528 {
3529 const struct cred *cred = current_cred();
3530
3531 return file_has_perm(cred, file, FILE__LOCK);
3532 }
3533
3534 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3535 unsigned long arg)
3536 {
3537 const struct cred *cred = current_cred();
3538 int err = 0;
3539
3540 switch (cmd) {
3541 case F_SETFL:
3542 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3543 err = file_has_perm(cred, file, FILE__WRITE);
3544 break;
3545 }
3546 /* fall through */
3547 case F_SETOWN:
3548 case F_SETSIG:
3549 case F_GETFL:
3550 case F_GETOWN:
3551 case F_GETSIG:
3552 case F_GETOWNER_UIDS:
3553 /* Just check FD__USE permission */
3554 err = file_has_perm(cred, file, 0);
3555 break;
3556 case F_GETLK:
3557 case F_SETLK:
3558 case F_SETLKW:
3559 case F_OFD_GETLK:
3560 case F_OFD_SETLK:
3561 case F_OFD_SETLKW:
3562 #if BITS_PER_LONG == 32
3563 case F_GETLK64:
3564 case F_SETLK64:
3565 case F_SETLKW64:
3566 #endif
3567 err = file_has_perm(cred, file, FILE__LOCK);
3568 break;
3569 }
3570
3571 return err;
3572 }
3573
3574 static void selinux_file_set_fowner(struct file *file)
3575 {
3576 struct file_security_struct *fsec;
3577
3578 fsec = file->f_security;
3579 fsec->fown_sid = current_sid();
3580 }
3581
3582 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3583 struct fown_struct *fown, int signum)
3584 {
3585 struct file *file;
3586 u32 sid = task_sid(tsk);
3587 u32 perm;
3588 struct file_security_struct *fsec;
3589
3590 /* struct fown_struct is never outside the context of a struct file */
3591 file = container_of(fown, struct file, f_owner);
3592
3593 fsec = file->f_security;
3594
3595 if (!signum)
3596 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3597 else
3598 perm = signal_to_av(signum);
3599
3600 return avc_has_perm(fsec->fown_sid, sid,
3601 SECCLASS_PROCESS, perm, NULL);
3602 }
3603
3604 static int selinux_file_receive(struct file *file)
3605 {
3606 const struct cred *cred = current_cred();
3607
3608 return file_has_perm(cred, file, file_to_av(file));
3609 }
3610
3611 static int selinux_file_open(struct file *file, const struct cred *cred)
3612 {
3613 struct file_security_struct *fsec;
3614 struct inode_security_struct *isec;
3615
3616 fsec = file->f_security;
3617 isec = inode_security(file_inode(file));
3618 /*
3619 * Save inode label and policy sequence number
3620 * at open-time so that selinux_file_permission
3621 * can determine whether revalidation is necessary.
3622 * Task label is already saved in the file security
3623 * struct as its SID.
3624 */
3625 fsec->isid = isec->sid;
3626 fsec->pseqno = avc_policy_seqno();
3627 /*
3628 * Since the inode label or policy seqno may have changed
3629 * between the selinux_inode_permission check and the saving
3630 * of state above, recheck that access is still permitted.
3631 * Otherwise, access might never be revalidated against the
3632 * new inode label or new policy.
3633 * This check is not redundant - do not remove.
3634 */
3635 return file_path_has_perm(cred, file, open_file_to_av(file));
3636 }
3637
3638 /* task security operations */
3639
3640 static int selinux_task_create(unsigned long clone_flags)
3641 {
3642 return current_has_perm(current, PROCESS__FORK);
3643 }
3644
3645 /*
3646 * allocate the SELinux part of blank credentials
3647 */
3648 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3649 {
3650 struct task_security_struct *tsec;
3651
3652 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3653 if (!tsec)
3654 return -ENOMEM;
3655
3656 cred->security = tsec;
3657 return 0;
3658 }
3659
3660 /*
3661 * detach and free the LSM part of a set of credentials
3662 */
3663 static void selinux_cred_free(struct cred *cred)
3664 {
3665 struct task_security_struct *tsec = cred->security;
3666
3667 /*
3668 * cred->security == NULL if security_cred_alloc_blank() or
3669 * security_prepare_creds() returned an error.
3670 */
3671 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3672 cred->security = (void *) 0x7UL;
3673 kfree(tsec);
3674 }
3675
3676 /*
3677 * prepare a new set of credentials for modification
3678 */
3679 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3680 gfp_t gfp)
3681 {
3682 const struct task_security_struct *old_tsec;
3683 struct task_security_struct *tsec;
3684
3685 old_tsec = old->security;
3686
3687 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3688 if (!tsec)
3689 return -ENOMEM;
3690
3691 new->security = tsec;
3692 return 0;
3693 }
3694
3695 /*
3696 * transfer the SELinux data to a blank set of creds
3697 */
3698 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3699 {
3700 const struct task_security_struct *old_tsec = old->security;
3701 struct task_security_struct *tsec = new->security;
3702
3703 *tsec = *old_tsec;
3704 }
3705
3706 /*
3707 * set the security data for a kernel service
3708 * - all the creation contexts are set to unlabelled
3709 */
3710 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3711 {
3712 struct task_security_struct *tsec = new->security;
3713 u32 sid = current_sid();
3714 int ret;
3715
3716 ret = avc_has_perm(sid, secid,
3717 SECCLASS_KERNEL_SERVICE,
3718 KERNEL_SERVICE__USE_AS_OVERRIDE,
3719 NULL);
3720 if (ret == 0) {
3721 tsec->sid = secid;
3722 tsec->create_sid = 0;
3723 tsec->keycreate_sid = 0;
3724 tsec->sockcreate_sid = 0;
3725 }
3726 return ret;
3727 }
3728
3729 /*
3730 * set the file creation context in a security record to the same as the
3731 * objective context of the specified inode
3732 */
3733 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3734 {
3735 struct inode_security_struct *isec = inode_security(inode);
3736 struct task_security_struct *tsec = new->security;
3737 u32 sid = current_sid();
3738 int ret;
3739
3740 ret = avc_has_perm(sid, isec->sid,
3741 SECCLASS_KERNEL_SERVICE,
3742 KERNEL_SERVICE__CREATE_FILES_AS,
3743 NULL);
3744
3745 if (ret == 0)
3746 tsec->create_sid = isec->sid;
3747 return ret;
3748 }
3749
3750 static int selinux_kernel_module_request(char *kmod_name)
3751 {
3752 u32 sid;
3753 struct common_audit_data ad;
3754
3755 sid = task_sid(current);
3756
3757 ad.type = LSM_AUDIT_DATA_KMOD;
3758 ad.u.kmod_name = kmod_name;
3759
3760 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3761 SYSTEM__MODULE_REQUEST, &ad);
3762 }
3763
3764 static int selinux_kernel_module_from_file(struct file *file)
3765 {
3766 struct common_audit_data ad;
3767 struct inode_security_struct *isec;
3768 struct file_security_struct *fsec;
3769 u32 sid = current_sid();
3770 int rc;
3771
3772 /* init_module */
3773 if (file == NULL)
3774 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3775 SYSTEM__MODULE_LOAD, NULL);
3776
3777 /* finit_module */
3778
3779 ad.type = LSM_AUDIT_DATA_PATH;
3780 ad.u.path = file->f_path;
3781
3782 fsec = file->f_security;
3783 if (sid != fsec->sid) {
3784 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3785 if (rc)
3786 return rc;
3787 }
3788
3789 isec = inode_security(file_inode(file));
3790 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3791 SYSTEM__MODULE_LOAD, &ad);
3792 }
3793
3794 static int selinux_kernel_read_file(struct file *file,
3795 enum kernel_read_file_id id)
3796 {
3797 int rc = 0;
3798
3799 switch (id) {
3800 case READING_MODULE:
3801 rc = selinux_kernel_module_from_file(file);
3802 break;
3803 default:
3804 break;
3805 }
3806
3807 return rc;
3808 }
3809
3810 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3811 {
3812 return current_has_perm(p, PROCESS__SETPGID);
3813 }
3814
3815 static int selinux_task_getpgid(struct task_struct *p)
3816 {
3817 return current_has_perm(p, PROCESS__GETPGID);
3818 }
3819
3820 static int selinux_task_getsid(struct task_struct *p)
3821 {
3822 return current_has_perm(p, PROCESS__GETSESSION);
3823 }
3824
3825 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3826 {
3827 *secid = task_sid(p);
3828 }
3829
3830 static int selinux_task_setnice(struct task_struct *p, int nice)
3831 {
3832 return current_has_perm(p, PROCESS__SETSCHED);
3833 }
3834
3835 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3836 {
3837 return current_has_perm(p, PROCESS__SETSCHED);
3838 }
3839
3840 static int selinux_task_getioprio(struct task_struct *p)
3841 {
3842 return current_has_perm(p, PROCESS__GETSCHED);
3843 }
3844
3845 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3846 struct rlimit *new_rlim)
3847 {
3848 struct rlimit *old_rlim = p->signal->rlim + resource;
3849
3850 /* Control the ability to change the hard limit (whether
3851 lowering or raising it), so that the hard limit can
3852 later be used as a safe reset point for the soft limit
3853 upon context transitions. See selinux_bprm_committing_creds. */
3854 if (old_rlim->rlim_max != new_rlim->rlim_max)
3855 return current_has_perm(p, PROCESS__SETRLIMIT);
3856
3857 return 0;
3858 }
3859
3860 static int selinux_task_setscheduler(struct task_struct *p)
3861 {
3862 return current_has_perm(p, PROCESS__SETSCHED);
3863 }
3864
3865 static int selinux_task_getscheduler(struct task_struct *p)
3866 {
3867 return current_has_perm(p, PROCESS__GETSCHED);
3868 }
3869
3870 static int selinux_task_movememory(struct task_struct *p)
3871 {
3872 return current_has_perm(p, PROCESS__SETSCHED);
3873 }
3874
3875 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3876 int sig, u32 secid)
3877 {
3878 u32 perm;
3879 int rc;
3880
3881 if (!sig)
3882 perm = PROCESS__SIGNULL; /* null signal; existence test */
3883 else
3884 perm = signal_to_av(sig);
3885 if (secid)
3886 rc = avc_has_perm(secid, task_sid(p),
3887 SECCLASS_PROCESS, perm, NULL);
3888 else
3889 rc = current_has_perm(p, perm);
3890 return rc;
3891 }
3892
3893 static int selinux_task_wait(struct task_struct *p)
3894 {
3895 return task_has_perm(p, current, PROCESS__SIGCHLD);
3896 }
3897
3898 static void selinux_task_to_inode(struct task_struct *p,
3899 struct inode *inode)
3900 {
3901 struct inode_security_struct *isec = inode->i_security;
3902 u32 sid = task_sid(p);
3903
3904 isec->sid = sid;
3905 isec->initialized = LABEL_INITIALIZED;
3906 }
3907
3908 /* Returns error only if unable to parse addresses */
3909 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3910 struct common_audit_data *ad, u8 *proto)
3911 {
3912 int offset, ihlen, ret = -EINVAL;
3913 struct iphdr _iph, *ih;
3914
3915 offset = skb_network_offset(skb);
3916 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3917 if (ih == NULL)
3918 goto out;
3919
3920 ihlen = ih->ihl * 4;
3921 if (ihlen < sizeof(_iph))
3922 goto out;
3923
3924 ad->u.net->v4info.saddr = ih->saddr;
3925 ad->u.net->v4info.daddr = ih->daddr;
3926 ret = 0;
3927
3928 if (proto)
3929 *proto = ih->protocol;
3930
3931 switch (ih->protocol) {
3932 case IPPROTO_TCP: {
3933 struct tcphdr _tcph, *th;
3934
3935 if (ntohs(ih->frag_off) & IP_OFFSET)
3936 break;
3937
3938 offset += ihlen;
3939 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3940 if (th == NULL)
3941 break;
3942
3943 ad->u.net->sport = th->source;
3944 ad->u.net->dport = th->dest;
3945 break;
3946 }
3947
3948 case IPPROTO_UDP: {
3949 struct udphdr _udph, *uh;
3950
3951 if (ntohs(ih->frag_off) & IP_OFFSET)
3952 break;
3953
3954 offset += ihlen;
3955 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3956 if (uh == NULL)
3957 break;
3958
3959 ad->u.net->sport = uh->source;
3960 ad->u.net->dport = uh->dest;
3961 break;
3962 }
3963
3964 case IPPROTO_DCCP: {
3965 struct dccp_hdr _dccph, *dh;
3966
3967 if (ntohs(ih->frag_off) & IP_OFFSET)
3968 break;
3969
3970 offset += ihlen;
3971 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3972 if (dh == NULL)
3973 break;
3974
3975 ad->u.net->sport = dh->dccph_sport;
3976 ad->u.net->dport = dh->dccph_dport;
3977 break;
3978 }
3979
3980 default:
3981 break;
3982 }
3983 out:
3984 return ret;
3985 }
3986
3987 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3988
3989 /* Returns error only if unable to parse addresses */
3990 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3991 struct common_audit_data *ad, u8 *proto)
3992 {
3993 u8 nexthdr;
3994 int ret = -EINVAL, offset;
3995 struct ipv6hdr _ipv6h, *ip6;
3996 __be16 frag_off;
3997
3998 offset = skb_network_offset(skb);
3999 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4000 if (ip6 == NULL)
4001 goto out;
4002
4003 ad->u.net->v6info.saddr = ip6->saddr;
4004 ad->u.net->v6info.daddr = ip6->daddr;
4005 ret = 0;
4006
4007 nexthdr = ip6->nexthdr;
4008 offset += sizeof(_ipv6h);
4009 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4010 if (offset < 0)
4011 goto out;
4012
4013 if (proto)
4014 *proto = nexthdr;
4015
4016 switch (nexthdr) {
4017 case IPPROTO_TCP: {
4018 struct tcphdr _tcph, *th;
4019
4020 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4021 if (th == NULL)
4022 break;
4023
4024 ad->u.net->sport = th->source;
4025 ad->u.net->dport = th->dest;
4026 break;
4027 }
4028
4029 case IPPROTO_UDP: {
4030 struct udphdr _udph, *uh;
4031
4032 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4033 if (uh == NULL)
4034 break;
4035
4036 ad->u.net->sport = uh->source;
4037 ad->u.net->dport = uh->dest;
4038 break;
4039 }
4040
4041 case IPPROTO_DCCP: {
4042 struct dccp_hdr _dccph, *dh;
4043
4044 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4045 if (dh == NULL)
4046 break;
4047
4048 ad->u.net->sport = dh->dccph_sport;
4049 ad->u.net->dport = dh->dccph_dport;
4050 break;
4051 }
4052
4053 /* includes fragments */
4054 default:
4055 break;
4056 }
4057 out:
4058 return ret;
4059 }
4060
4061 #endif /* IPV6 */
4062
4063 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4064 char **_addrp, int src, u8 *proto)
4065 {
4066 char *addrp;
4067 int ret;
4068
4069 switch (ad->u.net->family) {
4070 case PF_INET:
4071 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4072 if (ret)
4073 goto parse_error;
4074 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4075 &ad->u.net->v4info.daddr);
4076 goto okay;
4077
4078 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4079 case PF_INET6:
4080 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4081 if (ret)
4082 goto parse_error;
4083 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4084 &ad->u.net->v6info.daddr);
4085 goto okay;
4086 #endif /* IPV6 */
4087 default:
4088 addrp = NULL;
4089 goto okay;
4090 }
4091
4092 parse_error:
4093 printk(KERN_WARNING
4094 "SELinux: failure in selinux_parse_skb(),"
4095 " unable to parse packet\n");
4096 return ret;
4097
4098 okay:
4099 if (_addrp)
4100 *_addrp = addrp;
4101 return 0;
4102 }
4103
4104 /**
4105 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4106 * @skb: the packet
4107 * @family: protocol family
4108 * @sid: the packet's peer label SID
4109 *
4110 * Description:
4111 * Check the various different forms of network peer labeling and determine
4112 * the peer label/SID for the packet; most of the magic actually occurs in
4113 * the security server function security_net_peersid_cmp(). The function
4114 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4115 * or -EACCES if @sid is invalid due to inconsistencies with the different
4116 * peer labels.
4117 *
4118 */
4119 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4120 {
4121 int err;
4122 u32 xfrm_sid;
4123 u32 nlbl_sid;
4124 u32 nlbl_type;
4125
4126 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4127 if (unlikely(err))
4128 return -EACCES;
4129 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4130 if (unlikely(err))
4131 return -EACCES;
4132
4133 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4134 if (unlikely(err)) {
4135 printk(KERN_WARNING
4136 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4137 " unable to determine packet's peer label\n");
4138 return -EACCES;
4139 }
4140
4141 return 0;
4142 }
4143
4144 /**
4145 * selinux_conn_sid - Determine the child socket label for a connection
4146 * @sk_sid: the parent socket's SID
4147 * @skb_sid: the packet's SID
4148 * @conn_sid: the resulting connection SID
4149 *
4150 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4151 * combined with the MLS information from @skb_sid in order to create
4152 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4153 * of @sk_sid. Returns zero on success, negative values on failure.
4154 *
4155 */
4156 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4157 {
4158 int err = 0;
4159
4160 if (skb_sid != SECSID_NULL)
4161 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4162 else
4163 *conn_sid = sk_sid;
4164
4165 return err;
4166 }
4167
4168 /* socket security operations */
4169
4170 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4171 u16 secclass, u32 *socksid)
4172 {
4173 if (tsec->sockcreate_sid > SECSID_NULL) {
4174 *socksid = tsec->sockcreate_sid;
4175 return 0;
4176 }
4177
4178 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4179 socksid);
4180 }
4181
4182 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4183 {
4184 struct sk_security_struct *sksec = sk->sk_security;
4185 struct common_audit_data ad;
4186 struct lsm_network_audit net = {0,};
4187 u32 tsid = task_sid(task);
4188
4189 if (sksec->sid == SECINITSID_KERNEL)
4190 return 0;
4191
4192 ad.type = LSM_AUDIT_DATA_NET;
4193 ad.u.net = &net;
4194 ad.u.net->sk = sk;
4195
4196 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4197 }
4198
4199 static int selinux_socket_create(int family, int type,
4200 int protocol, int kern)
4201 {
4202 const struct task_security_struct *tsec = current_security();
4203 u32 newsid;
4204 u16 secclass;
4205 int rc;
4206
4207 if (kern)
4208 return 0;
4209
4210 secclass = socket_type_to_security_class(family, type, protocol);
4211 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4212 if (rc)
4213 return rc;
4214
4215 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4216 }
4217
4218 static int selinux_socket_post_create(struct socket *sock, int family,
4219 int type, int protocol, int kern)
4220 {
4221 const struct task_security_struct *tsec = current_security();
4222 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4223 struct sk_security_struct *sksec;
4224 int err = 0;
4225
4226 isec->sclass = socket_type_to_security_class(family, type, protocol);
4227
4228 if (kern)
4229 isec->sid = SECINITSID_KERNEL;
4230 else {
4231 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4232 if (err)
4233 return err;
4234 }
4235
4236 isec->initialized = LABEL_INITIALIZED;
4237
4238 if (sock->sk) {
4239 sksec = sock->sk->sk_security;
4240 sksec->sid = isec->sid;
4241 sksec->sclass = isec->sclass;
4242 err = selinux_netlbl_socket_post_create(sock->sk, family);
4243 }
4244
4245 return err;
4246 }
4247
4248 /* Range of port numbers used to automatically bind.
4249 Need to determine whether we should perform a name_bind
4250 permission check between the socket and the port number. */
4251
4252 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4253 {
4254 struct sock *sk = sock->sk;
4255 u16 family;
4256 int err;
4257
4258 err = sock_has_perm(current, sk, SOCKET__BIND);
4259 if (err)
4260 goto out;
4261
4262 /*
4263 * If PF_INET or PF_INET6, check name_bind permission for the port.
4264 * Multiple address binding for SCTP is not supported yet: we just
4265 * check the first address now.
4266 */
4267 family = sk->sk_family;
4268 if (family == PF_INET || family == PF_INET6) {
4269 char *addrp;
4270 struct sk_security_struct *sksec = sk->sk_security;
4271 struct common_audit_data ad;
4272 struct lsm_network_audit net = {0,};
4273 struct sockaddr_in *addr4 = NULL;
4274 struct sockaddr_in6 *addr6 = NULL;
4275 unsigned short snum;
4276 u32 sid, node_perm;
4277
4278 if (family == PF_INET) {
4279 addr4 = (struct sockaddr_in *)address;
4280 snum = ntohs(addr4->sin_port);
4281 addrp = (char *)&addr4->sin_addr.s_addr;
4282 } else {
4283 addr6 = (struct sockaddr_in6 *)address;
4284 snum = ntohs(addr6->sin6_port);
4285 addrp = (char *)&addr6->sin6_addr.s6_addr;
4286 }
4287
4288 if (snum) {
4289 int low, high;
4290
4291 inet_get_local_port_range(sock_net(sk), &low, &high);
4292
4293 if (snum < max(PROT_SOCK, low) || snum > high) {
4294 err = sel_netport_sid(sk->sk_protocol,
4295 snum, &sid);
4296 if (err)
4297 goto out;
4298 ad.type = LSM_AUDIT_DATA_NET;
4299 ad.u.net = &net;
4300 ad.u.net->sport = htons(snum);
4301 ad.u.net->family = family;
4302 err = avc_has_perm(sksec->sid, sid,
4303 sksec->sclass,
4304 SOCKET__NAME_BIND, &ad);
4305 if (err)
4306 goto out;
4307 }
4308 }
4309
4310 switch (sksec->sclass) {
4311 case SECCLASS_TCP_SOCKET:
4312 node_perm = TCP_SOCKET__NODE_BIND;
4313 break;
4314
4315 case SECCLASS_UDP_SOCKET:
4316 node_perm = UDP_SOCKET__NODE_BIND;
4317 break;
4318
4319 case SECCLASS_DCCP_SOCKET:
4320 node_perm = DCCP_SOCKET__NODE_BIND;
4321 break;
4322
4323 default:
4324 node_perm = RAWIP_SOCKET__NODE_BIND;
4325 break;
4326 }
4327
4328 err = sel_netnode_sid(addrp, family, &sid);
4329 if (err)
4330 goto out;
4331
4332 ad.type = LSM_AUDIT_DATA_NET;
4333 ad.u.net = &net;
4334 ad.u.net->sport = htons(snum);
4335 ad.u.net->family = family;
4336
4337 if (family == PF_INET)
4338 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4339 else
4340 ad.u.net->v6info.saddr = addr6->sin6_addr;
4341
4342 err = avc_has_perm(sksec->sid, sid,
4343 sksec->sclass, node_perm, &ad);
4344 if (err)
4345 goto out;
4346 }
4347 out:
4348 return err;
4349 }
4350
4351 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4352 {
4353 struct sock *sk = sock->sk;
4354 struct sk_security_struct *sksec = sk->sk_security;
4355 int err;
4356
4357 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4358 if (err)
4359 return err;
4360
4361 /*
4362 * If a TCP or DCCP socket, check name_connect permission for the port.
4363 */
4364 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4365 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4366 struct common_audit_data ad;
4367 struct lsm_network_audit net = {0,};
4368 struct sockaddr_in *addr4 = NULL;
4369 struct sockaddr_in6 *addr6 = NULL;
4370 unsigned short snum;
4371 u32 sid, perm;
4372
4373 if (sk->sk_family == PF_INET) {
4374 addr4 = (struct sockaddr_in *)address;
4375 if (addrlen < sizeof(struct sockaddr_in))
4376 return -EINVAL;
4377 snum = ntohs(addr4->sin_port);
4378 } else {
4379 addr6 = (struct sockaddr_in6 *)address;
4380 if (addrlen < SIN6_LEN_RFC2133)
4381 return -EINVAL;
4382 snum = ntohs(addr6->sin6_port);
4383 }
4384
4385 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4386 if (err)
4387 goto out;
4388
4389 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4390 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4391
4392 ad.type = LSM_AUDIT_DATA_NET;
4393 ad.u.net = &net;
4394 ad.u.net->dport = htons(snum);
4395 ad.u.net->family = sk->sk_family;
4396 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4397 if (err)
4398 goto out;
4399 }
4400
4401 err = selinux_netlbl_socket_connect(sk, address);
4402
4403 out:
4404 return err;
4405 }
4406
4407 static int selinux_socket_listen(struct socket *sock, int backlog)
4408 {
4409 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4410 }
4411
4412 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4413 {
4414 int err;
4415 struct inode_security_struct *isec;
4416 struct inode_security_struct *newisec;
4417
4418 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4419 if (err)
4420 return err;
4421
4422 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4423
4424 isec = inode_security_novalidate(SOCK_INODE(sock));
4425 newisec->sclass = isec->sclass;
4426 newisec->sid = isec->sid;
4427 newisec->initialized = LABEL_INITIALIZED;
4428
4429 return 0;
4430 }
4431
4432 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4433 int size)
4434 {
4435 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4436 }
4437
4438 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4439 int size, int flags)
4440 {
4441 return sock_has_perm(current, sock->sk, SOCKET__READ);
4442 }
4443
4444 static int selinux_socket_getsockname(struct socket *sock)
4445 {
4446 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4447 }
4448
4449 static int selinux_socket_getpeername(struct socket *sock)
4450 {
4451 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4452 }
4453
4454 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4455 {
4456 int err;
4457
4458 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4459 if (err)
4460 return err;
4461
4462 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4463 }
4464
4465 static int selinux_socket_getsockopt(struct socket *sock, int level,
4466 int optname)
4467 {
4468 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4469 }
4470
4471 static int selinux_socket_shutdown(struct socket *sock, int how)
4472 {
4473 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4474 }
4475
4476 static int selinux_socket_unix_stream_connect(struct sock *sock,
4477 struct sock *other,
4478 struct sock *newsk)
4479 {
4480 struct sk_security_struct *sksec_sock = sock->sk_security;
4481 struct sk_security_struct *sksec_other = other->sk_security;
4482 struct sk_security_struct *sksec_new = newsk->sk_security;
4483 struct common_audit_data ad;
4484 struct lsm_network_audit net = {0,};
4485 int err;
4486
4487 ad.type = LSM_AUDIT_DATA_NET;
4488 ad.u.net = &net;
4489 ad.u.net->sk = other;
4490
4491 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4492 sksec_other->sclass,
4493 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4494 if (err)
4495 return err;
4496
4497 /* server child socket */
4498 sksec_new->peer_sid = sksec_sock->sid;
4499 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4500 &sksec_new->sid);
4501 if (err)
4502 return err;
4503
4504 /* connecting socket */
4505 sksec_sock->peer_sid = sksec_new->sid;
4506
4507 return 0;
4508 }
4509
4510 static int selinux_socket_unix_may_send(struct socket *sock,
4511 struct socket *other)
4512 {
4513 struct sk_security_struct *ssec = sock->sk->sk_security;
4514 struct sk_security_struct *osec = other->sk->sk_security;
4515 struct common_audit_data ad;
4516 struct lsm_network_audit net = {0,};
4517
4518 ad.type = LSM_AUDIT_DATA_NET;
4519 ad.u.net = &net;
4520 ad.u.net->sk = other->sk;
4521
4522 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4523 &ad);
4524 }
4525
4526 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4527 char *addrp, u16 family, u32 peer_sid,
4528 struct common_audit_data *ad)
4529 {
4530 int err;
4531 u32 if_sid;
4532 u32 node_sid;
4533
4534 err = sel_netif_sid(ns, ifindex, &if_sid);
4535 if (err)
4536 return err;
4537 err = avc_has_perm(peer_sid, if_sid,
4538 SECCLASS_NETIF, NETIF__INGRESS, ad);
4539 if (err)
4540 return err;
4541
4542 err = sel_netnode_sid(addrp, family, &node_sid);
4543 if (err)
4544 return err;
4545 return avc_has_perm(peer_sid, node_sid,
4546 SECCLASS_NODE, NODE__RECVFROM, ad);
4547 }
4548
4549 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4550 u16 family)
4551 {
4552 int err = 0;
4553 struct sk_security_struct *sksec = sk->sk_security;
4554 u32 sk_sid = sksec->sid;
4555 struct common_audit_data ad;
4556 struct lsm_network_audit net = {0,};
4557 char *addrp;
4558
4559 ad.type = LSM_AUDIT_DATA_NET;
4560 ad.u.net = &net;
4561 ad.u.net->netif = skb->skb_iif;
4562 ad.u.net->family = family;
4563 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4564 if (err)
4565 return err;
4566
4567 if (selinux_secmark_enabled()) {
4568 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4569 PACKET__RECV, &ad);
4570 if (err)
4571 return err;
4572 }
4573
4574 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4575 if (err)
4576 return err;
4577 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4578
4579 return err;
4580 }
4581
4582 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4583 {
4584 int err;
4585 struct sk_security_struct *sksec = sk->sk_security;
4586 u16 family = sk->sk_family;
4587 u32 sk_sid = sksec->sid;
4588 struct common_audit_data ad;
4589 struct lsm_network_audit net = {0,};
4590 char *addrp;
4591 u8 secmark_active;
4592 u8 peerlbl_active;
4593
4594 if (family != PF_INET && family != PF_INET6)
4595 return 0;
4596
4597 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4598 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4599 family = PF_INET;
4600
4601 /* If any sort of compatibility mode is enabled then handoff processing
4602 * to the selinux_sock_rcv_skb_compat() function to deal with the
4603 * special handling. We do this in an attempt to keep this function
4604 * as fast and as clean as possible. */
4605 if (!selinux_policycap_netpeer)
4606 return selinux_sock_rcv_skb_compat(sk, skb, family);
4607
4608 secmark_active = selinux_secmark_enabled();
4609 peerlbl_active = selinux_peerlbl_enabled();
4610 if (!secmark_active && !peerlbl_active)
4611 return 0;
4612
4613 ad.type = LSM_AUDIT_DATA_NET;
4614 ad.u.net = &net;
4615 ad.u.net->netif = skb->skb_iif;
4616 ad.u.net->family = family;
4617 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4618 if (err)
4619 return err;
4620
4621 if (peerlbl_active) {
4622 u32 peer_sid;
4623
4624 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4625 if (err)
4626 return err;
4627 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4628 addrp, family, peer_sid, &ad);
4629 if (err) {
4630 selinux_netlbl_err(skb, family, err, 0);
4631 return err;
4632 }
4633 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4634 PEER__RECV, &ad);
4635 if (err) {
4636 selinux_netlbl_err(skb, family, err, 0);
4637 return err;
4638 }
4639 }
4640
4641 if (secmark_active) {
4642 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4643 PACKET__RECV, &ad);
4644 if (err)
4645 return err;
4646 }
4647
4648 return err;
4649 }
4650
4651 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4652 int __user *optlen, unsigned len)
4653 {
4654 int err = 0;
4655 char *scontext;
4656 u32 scontext_len;
4657 struct sk_security_struct *sksec = sock->sk->sk_security;
4658 u32 peer_sid = SECSID_NULL;
4659
4660 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4661 sksec->sclass == SECCLASS_TCP_SOCKET)
4662 peer_sid = sksec->peer_sid;
4663 if (peer_sid == SECSID_NULL)
4664 return -ENOPROTOOPT;
4665
4666 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4667 if (err)
4668 return err;
4669
4670 if (scontext_len > len) {
4671 err = -ERANGE;
4672 goto out_len;
4673 }
4674
4675 if (copy_to_user(optval, scontext, scontext_len))
4676 err = -EFAULT;
4677
4678 out_len:
4679 if (put_user(scontext_len, optlen))
4680 err = -EFAULT;
4681 kfree(scontext);
4682 return err;
4683 }
4684
4685 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4686 {
4687 u32 peer_secid = SECSID_NULL;
4688 u16 family;
4689 struct inode_security_struct *isec;
4690
4691 if (skb && skb->protocol == htons(ETH_P_IP))
4692 family = PF_INET;
4693 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4694 family = PF_INET6;
4695 else if (sock)
4696 family = sock->sk->sk_family;
4697 else
4698 goto out;
4699
4700 if (sock && family == PF_UNIX) {
4701 isec = inode_security_novalidate(SOCK_INODE(sock));
4702 peer_secid = isec->sid;
4703 } else if (skb)
4704 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4705
4706 out:
4707 *secid = peer_secid;
4708 if (peer_secid == SECSID_NULL)
4709 return -EINVAL;
4710 return 0;
4711 }
4712
4713 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4714 {
4715 struct sk_security_struct *sksec;
4716
4717 sksec = kzalloc(sizeof(*sksec), priority);
4718 if (!sksec)
4719 return -ENOMEM;
4720
4721 sksec->peer_sid = SECINITSID_UNLABELED;
4722 sksec->sid = SECINITSID_UNLABELED;
4723 sksec->sclass = SECCLASS_SOCKET;
4724 selinux_netlbl_sk_security_reset(sksec);
4725 sk->sk_security = sksec;
4726
4727 return 0;
4728 }
4729
4730 static void selinux_sk_free_security(struct sock *sk)
4731 {
4732 struct sk_security_struct *sksec = sk->sk_security;
4733
4734 sk->sk_security = NULL;
4735 selinux_netlbl_sk_security_free(sksec);
4736 kfree(sksec);
4737 }
4738
4739 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4740 {
4741 struct sk_security_struct *sksec = sk->sk_security;
4742 struct sk_security_struct *newsksec = newsk->sk_security;
4743
4744 newsksec->sid = sksec->sid;
4745 newsksec->peer_sid = sksec->peer_sid;
4746 newsksec->sclass = sksec->sclass;
4747
4748 selinux_netlbl_sk_security_reset(newsksec);
4749 }
4750
4751 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4752 {
4753 if (!sk)
4754 *secid = SECINITSID_ANY_SOCKET;
4755 else {
4756 struct sk_security_struct *sksec = sk->sk_security;
4757
4758 *secid = sksec->sid;
4759 }
4760 }
4761
4762 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4763 {
4764 struct inode_security_struct *isec =
4765 inode_security_novalidate(SOCK_INODE(parent));
4766 struct sk_security_struct *sksec = sk->sk_security;
4767
4768 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4769 sk->sk_family == PF_UNIX)
4770 isec->sid = sksec->sid;
4771 sksec->sclass = isec->sclass;
4772 }
4773
4774 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4775 struct request_sock *req)
4776 {
4777 struct sk_security_struct *sksec = sk->sk_security;
4778 int err;
4779 u16 family = req->rsk_ops->family;
4780 u32 connsid;
4781 u32 peersid;
4782
4783 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4784 if (err)
4785 return err;
4786 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4787 if (err)
4788 return err;
4789 req->secid = connsid;
4790 req->peer_secid = peersid;
4791
4792 return selinux_netlbl_inet_conn_request(req, family);
4793 }
4794
4795 static void selinux_inet_csk_clone(struct sock *newsk,
4796 const struct request_sock *req)
4797 {
4798 struct sk_security_struct *newsksec = newsk->sk_security;
4799
4800 newsksec->sid = req->secid;
4801 newsksec->peer_sid = req->peer_secid;
4802 /* NOTE: Ideally, we should also get the isec->sid for the
4803 new socket in sync, but we don't have the isec available yet.
4804 So we will wait until sock_graft to do it, by which
4805 time it will have been created and available. */
4806
4807 /* We don't need to take any sort of lock here as we are the only
4808 * thread with access to newsksec */
4809 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4810 }
4811
4812 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4813 {
4814 u16 family = sk->sk_family;
4815 struct sk_security_struct *sksec = sk->sk_security;
4816
4817 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4818 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4819 family = PF_INET;
4820
4821 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4822 }
4823
4824 static int selinux_secmark_relabel_packet(u32 sid)
4825 {
4826 const struct task_security_struct *__tsec;
4827 u32 tsid;
4828
4829 __tsec = current_security();
4830 tsid = __tsec->sid;
4831
4832 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4833 }
4834
4835 static void selinux_secmark_refcount_inc(void)
4836 {
4837 atomic_inc(&selinux_secmark_refcount);
4838 }
4839
4840 static void selinux_secmark_refcount_dec(void)
4841 {
4842 atomic_dec(&selinux_secmark_refcount);
4843 }
4844
4845 static void selinux_req_classify_flow(const struct request_sock *req,
4846 struct flowi *fl)
4847 {
4848 fl->flowi_secid = req->secid;
4849 }
4850
4851 static int selinux_tun_dev_alloc_security(void **security)
4852 {
4853 struct tun_security_struct *tunsec;
4854
4855 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4856 if (!tunsec)
4857 return -ENOMEM;
4858 tunsec->sid = current_sid();
4859
4860 *security = tunsec;
4861 return 0;
4862 }
4863
4864 static void selinux_tun_dev_free_security(void *security)
4865 {
4866 kfree(security);
4867 }
4868
4869 static int selinux_tun_dev_create(void)
4870 {
4871 u32 sid = current_sid();
4872
4873 /* we aren't taking into account the "sockcreate" SID since the socket
4874 * that is being created here is not a socket in the traditional sense,
4875 * instead it is a private sock, accessible only to the kernel, and
4876 * representing a wide range of network traffic spanning multiple
4877 * connections unlike traditional sockets - check the TUN driver to
4878 * get a better understanding of why this socket is special */
4879
4880 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4881 NULL);
4882 }
4883
4884 static int selinux_tun_dev_attach_queue(void *security)
4885 {
4886 struct tun_security_struct *tunsec = security;
4887
4888 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4889 TUN_SOCKET__ATTACH_QUEUE, NULL);
4890 }
4891
4892 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4893 {
4894 struct tun_security_struct *tunsec = security;
4895 struct sk_security_struct *sksec = sk->sk_security;
4896
4897 /* we don't currently perform any NetLabel based labeling here and it
4898 * isn't clear that we would want to do so anyway; while we could apply
4899 * labeling without the support of the TUN user the resulting labeled
4900 * traffic from the other end of the connection would almost certainly
4901 * cause confusion to the TUN user that had no idea network labeling
4902 * protocols were being used */
4903
4904 sksec->sid = tunsec->sid;
4905 sksec->sclass = SECCLASS_TUN_SOCKET;
4906
4907 return 0;
4908 }
4909
4910 static int selinux_tun_dev_open(void *security)
4911 {
4912 struct tun_security_struct *tunsec = security;
4913 u32 sid = current_sid();
4914 int err;
4915
4916 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4917 TUN_SOCKET__RELABELFROM, NULL);
4918 if (err)
4919 return err;
4920 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4921 TUN_SOCKET__RELABELTO, NULL);
4922 if (err)
4923 return err;
4924 tunsec->sid = sid;
4925
4926 return 0;
4927 }
4928
4929 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4930 {
4931 int err = 0;
4932 u32 perm;
4933 struct nlmsghdr *nlh;
4934 struct sk_security_struct *sksec = sk->sk_security;
4935
4936 if (skb->len < NLMSG_HDRLEN) {
4937 err = -EINVAL;
4938 goto out;
4939 }
4940 nlh = nlmsg_hdr(skb);
4941
4942 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4943 if (err) {
4944 if (err == -EINVAL) {
4945 pr_warn_ratelimited("SELinux: unrecognized netlink"
4946 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
4947 " pig=%d comm=%s\n",
4948 sk->sk_protocol, nlh->nlmsg_type,
4949 secclass_map[sksec->sclass - 1].name,
4950 task_pid_nr(current), current->comm);
4951 if (!selinux_enforcing || security_get_allow_unknown())
4952 err = 0;
4953 }
4954
4955 /* Ignore */
4956 if (err == -ENOENT)
4957 err = 0;
4958 goto out;
4959 }
4960
4961 err = sock_has_perm(current, sk, perm);
4962 out:
4963 return err;
4964 }
4965
4966 #ifdef CONFIG_NETFILTER
4967
4968 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4969 const struct net_device *indev,
4970 u16 family)
4971 {
4972 int err;
4973 char *addrp;
4974 u32 peer_sid;
4975 struct common_audit_data ad;
4976 struct lsm_network_audit net = {0,};
4977 u8 secmark_active;
4978 u8 netlbl_active;
4979 u8 peerlbl_active;
4980
4981 if (!selinux_policycap_netpeer)
4982 return NF_ACCEPT;
4983
4984 secmark_active = selinux_secmark_enabled();
4985 netlbl_active = netlbl_enabled();
4986 peerlbl_active = selinux_peerlbl_enabled();
4987 if (!secmark_active && !peerlbl_active)
4988 return NF_ACCEPT;
4989
4990 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4991 return NF_DROP;
4992
4993 ad.type = LSM_AUDIT_DATA_NET;
4994 ad.u.net = &net;
4995 ad.u.net->netif = indev->ifindex;
4996 ad.u.net->family = family;
4997 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4998 return NF_DROP;
4999
5000 if (peerlbl_active) {
5001 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5002 addrp, family, peer_sid, &ad);
5003 if (err) {
5004 selinux_netlbl_err(skb, family, err, 1);
5005 return NF_DROP;
5006 }
5007 }
5008
5009 if (secmark_active)
5010 if (avc_has_perm(peer_sid, skb->secmark,
5011 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5012 return NF_DROP;
5013
5014 if (netlbl_active)
5015 /* we do this in the FORWARD path and not the POST_ROUTING
5016 * path because we want to make sure we apply the necessary
5017 * labeling before IPsec is applied so we can leverage AH
5018 * protection */
5019 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5020 return NF_DROP;
5021
5022 return NF_ACCEPT;
5023 }
5024
5025 static unsigned int selinux_ipv4_forward(void *priv,
5026 struct sk_buff *skb,
5027 const struct nf_hook_state *state)
5028 {
5029 return selinux_ip_forward(skb, state->in, PF_INET);
5030 }
5031
5032 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5033 static unsigned int selinux_ipv6_forward(void *priv,
5034 struct sk_buff *skb,
5035 const struct nf_hook_state *state)
5036 {
5037 return selinux_ip_forward(skb, state->in, PF_INET6);
5038 }
5039 #endif /* IPV6 */
5040
5041 static unsigned int selinux_ip_output(struct sk_buff *skb,
5042 u16 family)
5043 {
5044 struct sock *sk;
5045 u32 sid;
5046
5047 if (!netlbl_enabled())
5048 return NF_ACCEPT;
5049
5050 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5051 * because we want to make sure we apply the necessary labeling
5052 * before IPsec is applied so we can leverage AH protection */
5053 sk = skb->sk;
5054 if (sk) {
5055 struct sk_security_struct *sksec;
5056
5057 if (sk_listener(sk))
5058 /* if the socket is the listening state then this
5059 * packet is a SYN-ACK packet which means it needs to
5060 * be labeled based on the connection/request_sock and
5061 * not the parent socket. unfortunately, we can't
5062 * lookup the request_sock yet as it isn't queued on
5063 * the parent socket until after the SYN-ACK is sent.
5064 * the "solution" is to simply pass the packet as-is
5065 * as any IP option based labeling should be copied
5066 * from the initial connection request (in the IP
5067 * layer). it is far from ideal, but until we get a
5068 * security label in the packet itself this is the
5069 * best we can do. */
5070 return NF_ACCEPT;
5071
5072 /* standard practice, label using the parent socket */
5073 sksec = sk->sk_security;
5074 sid = sksec->sid;
5075 } else
5076 sid = SECINITSID_KERNEL;
5077 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5078 return NF_DROP;
5079
5080 return NF_ACCEPT;
5081 }
5082
5083 static unsigned int selinux_ipv4_output(void *priv,
5084 struct sk_buff *skb,
5085 const struct nf_hook_state *state)
5086 {
5087 return selinux_ip_output(skb, PF_INET);
5088 }
5089
5090 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5091 static unsigned int selinux_ipv6_output(void *priv,
5092 struct sk_buff *skb,
5093 const struct nf_hook_state *state)
5094 {
5095 return selinux_ip_output(skb, PF_INET6);
5096 }
5097 #endif /* IPV6 */
5098
5099 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5100 int ifindex,
5101 u16 family)
5102 {
5103 struct sock *sk = skb_to_full_sk(skb);
5104 struct sk_security_struct *sksec;
5105 struct common_audit_data ad;
5106 struct lsm_network_audit net = {0,};
5107 char *addrp;
5108 u8 proto;
5109
5110 if (sk == NULL)
5111 return NF_ACCEPT;
5112 sksec = sk->sk_security;
5113
5114 ad.type = LSM_AUDIT_DATA_NET;
5115 ad.u.net = &net;
5116 ad.u.net->netif = ifindex;
5117 ad.u.net->family = family;
5118 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5119 return NF_DROP;
5120
5121 if (selinux_secmark_enabled())
5122 if (avc_has_perm(sksec->sid, skb->secmark,
5123 SECCLASS_PACKET, PACKET__SEND, &ad))
5124 return NF_DROP_ERR(-ECONNREFUSED);
5125
5126 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5127 return NF_DROP_ERR(-ECONNREFUSED);
5128
5129 return NF_ACCEPT;
5130 }
5131
5132 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5133 const struct net_device *outdev,
5134 u16 family)
5135 {
5136 u32 secmark_perm;
5137 u32 peer_sid;
5138 int ifindex = outdev->ifindex;
5139 struct sock *sk;
5140 struct common_audit_data ad;
5141 struct lsm_network_audit net = {0,};
5142 char *addrp;
5143 u8 secmark_active;
5144 u8 peerlbl_active;
5145
5146 /* If any sort of compatibility mode is enabled then handoff processing
5147 * to the selinux_ip_postroute_compat() function to deal with the
5148 * special handling. We do this in an attempt to keep this function
5149 * as fast and as clean as possible. */
5150 if (!selinux_policycap_netpeer)
5151 return selinux_ip_postroute_compat(skb, ifindex, family);
5152
5153 secmark_active = selinux_secmark_enabled();
5154 peerlbl_active = selinux_peerlbl_enabled();
5155 if (!secmark_active && !peerlbl_active)
5156 return NF_ACCEPT;
5157
5158 sk = skb_to_full_sk(skb);
5159
5160 #ifdef CONFIG_XFRM
5161 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5162 * packet transformation so allow the packet to pass without any checks
5163 * since we'll have another chance to perform access control checks
5164 * when the packet is on it's final way out.
5165 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5166 * is NULL, in this case go ahead and apply access control.
5167 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5168 * TCP listening state we cannot wait until the XFRM processing
5169 * is done as we will miss out on the SA label if we do;
5170 * unfortunately, this means more work, but it is only once per
5171 * connection. */
5172 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5173 !(sk && sk_listener(sk)))
5174 return NF_ACCEPT;
5175 #endif
5176
5177 if (sk == NULL) {
5178 /* Without an associated socket the packet is either coming
5179 * from the kernel or it is being forwarded; check the packet
5180 * to determine which and if the packet is being forwarded
5181 * query the packet directly to determine the security label. */
5182 if (skb->skb_iif) {
5183 secmark_perm = PACKET__FORWARD_OUT;
5184 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5185 return NF_DROP;
5186 } else {
5187 secmark_perm = PACKET__SEND;
5188 peer_sid = SECINITSID_KERNEL;
5189 }
5190 } else if (sk_listener(sk)) {
5191 /* Locally generated packet but the associated socket is in the
5192 * listening state which means this is a SYN-ACK packet. In
5193 * this particular case the correct security label is assigned
5194 * to the connection/request_sock but unfortunately we can't
5195 * query the request_sock as it isn't queued on the parent
5196 * socket until after the SYN-ACK packet is sent; the only
5197 * viable choice is to regenerate the label like we do in
5198 * selinux_inet_conn_request(). See also selinux_ip_output()
5199 * for similar problems. */
5200 u32 skb_sid;
5201 struct sk_security_struct *sksec;
5202
5203 sksec = sk->sk_security;
5204 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5205 return NF_DROP;
5206 /* At this point, if the returned skb peerlbl is SECSID_NULL
5207 * and the packet has been through at least one XFRM
5208 * transformation then we must be dealing with the "final"
5209 * form of labeled IPsec packet; since we've already applied
5210 * all of our access controls on this packet we can safely
5211 * pass the packet. */
5212 if (skb_sid == SECSID_NULL) {
5213 switch (family) {
5214 case PF_INET:
5215 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5216 return NF_ACCEPT;
5217 break;
5218 case PF_INET6:
5219 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5220 return NF_ACCEPT;
5221 break;
5222 default:
5223 return NF_DROP_ERR(-ECONNREFUSED);
5224 }
5225 }
5226 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5227 return NF_DROP;
5228 secmark_perm = PACKET__SEND;
5229 } else {
5230 /* Locally generated packet, fetch the security label from the
5231 * associated socket. */
5232 struct sk_security_struct *sksec = sk->sk_security;
5233 peer_sid = sksec->sid;
5234 secmark_perm = PACKET__SEND;
5235 }
5236
5237 ad.type = LSM_AUDIT_DATA_NET;
5238 ad.u.net = &net;
5239 ad.u.net->netif = ifindex;
5240 ad.u.net->family = family;
5241 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5242 return NF_DROP;
5243
5244 if (secmark_active)
5245 if (avc_has_perm(peer_sid, skb->secmark,
5246 SECCLASS_PACKET, secmark_perm, &ad))
5247 return NF_DROP_ERR(-ECONNREFUSED);
5248
5249 if (peerlbl_active) {
5250 u32 if_sid;
5251 u32 node_sid;
5252
5253 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5254 return NF_DROP;
5255 if (avc_has_perm(peer_sid, if_sid,
5256 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5257 return NF_DROP_ERR(-ECONNREFUSED);
5258
5259 if (sel_netnode_sid(addrp, family, &node_sid))
5260 return NF_DROP;
5261 if (avc_has_perm(peer_sid, node_sid,
5262 SECCLASS_NODE, NODE__SENDTO, &ad))
5263 return NF_DROP_ERR(-ECONNREFUSED);
5264 }
5265
5266 return NF_ACCEPT;
5267 }
5268
5269 static unsigned int selinux_ipv4_postroute(void *priv,
5270 struct sk_buff *skb,
5271 const struct nf_hook_state *state)
5272 {
5273 return selinux_ip_postroute(skb, state->out, PF_INET);
5274 }
5275
5276 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5277 static unsigned int selinux_ipv6_postroute(void *priv,
5278 struct sk_buff *skb,
5279 const struct nf_hook_state *state)
5280 {
5281 return selinux_ip_postroute(skb, state->out, PF_INET6);
5282 }
5283 #endif /* IPV6 */
5284
5285 #endif /* CONFIG_NETFILTER */
5286
5287 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5288 {
5289 return selinux_nlmsg_perm(sk, skb);
5290 }
5291
5292 static int ipc_alloc_security(struct task_struct *task,
5293 struct kern_ipc_perm *perm,
5294 u16 sclass)
5295 {
5296 struct ipc_security_struct *isec;
5297 u32 sid;
5298
5299 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5300 if (!isec)
5301 return -ENOMEM;
5302
5303 sid = task_sid(task);
5304 isec->sclass = sclass;
5305 isec->sid = sid;
5306 perm->security = isec;
5307
5308 return 0;
5309 }
5310
5311 static void ipc_free_security(struct kern_ipc_perm *perm)
5312 {
5313 struct ipc_security_struct *isec = perm->security;
5314 perm->security = NULL;
5315 kfree(isec);
5316 }
5317
5318 static int msg_msg_alloc_security(struct msg_msg *msg)
5319 {
5320 struct msg_security_struct *msec;
5321
5322 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5323 if (!msec)
5324 return -ENOMEM;
5325
5326 msec->sid = SECINITSID_UNLABELED;
5327 msg->security = msec;
5328
5329 return 0;
5330 }
5331
5332 static void msg_msg_free_security(struct msg_msg *msg)
5333 {
5334 struct msg_security_struct *msec = msg->security;
5335
5336 msg->security = NULL;
5337 kfree(msec);
5338 }
5339
5340 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5341 u32 perms)
5342 {
5343 struct ipc_security_struct *isec;
5344 struct common_audit_data ad;
5345 u32 sid = current_sid();
5346
5347 isec = ipc_perms->security;
5348
5349 ad.type = LSM_AUDIT_DATA_IPC;
5350 ad.u.ipc_id = ipc_perms->key;
5351
5352 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5353 }
5354
5355 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5356 {
5357 return msg_msg_alloc_security(msg);
5358 }
5359
5360 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5361 {
5362 msg_msg_free_security(msg);
5363 }
5364
5365 /* message queue security operations */
5366 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5367 {
5368 struct ipc_security_struct *isec;
5369 struct common_audit_data ad;
5370 u32 sid = current_sid();
5371 int rc;
5372
5373 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5374 if (rc)
5375 return rc;
5376
5377 isec = msq->q_perm.security;
5378
5379 ad.type = LSM_AUDIT_DATA_IPC;
5380 ad.u.ipc_id = msq->q_perm.key;
5381
5382 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5383 MSGQ__CREATE, &ad);
5384 if (rc) {
5385 ipc_free_security(&msq->q_perm);
5386 return rc;
5387 }
5388 return 0;
5389 }
5390
5391 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5392 {
5393 ipc_free_security(&msq->q_perm);
5394 }
5395
5396 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5397 {
5398 struct ipc_security_struct *isec;
5399 struct common_audit_data ad;
5400 u32 sid = current_sid();
5401
5402 isec = msq->q_perm.security;
5403
5404 ad.type = LSM_AUDIT_DATA_IPC;
5405 ad.u.ipc_id = msq->q_perm.key;
5406
5407 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5408 MSGQ__ASSOCIATE, &ad);
5409 }
5410
5411 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5412 {
5413 int err;
5414 int perms;
5415
5416 switch (cmd) {
5417 case IPC_INFO:
5418 case MSG_INFO:
5419 /* No specific object, just general system-wide information. */
5420 return task_has_system(current, SYSTEM__IPC_INFO);
5421 case IPC_STAT:
5422 case MSG_STAT:
5423 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5424 break;
5425 case IPC_SET:
5426 perms = MSGQ__SETATTR;
5427 break;
5428 case IPC_RMID:
5429 perms = MSGQ__DESTROY;
5430 break;
5431 default:
5432 return 0;
5433 }
5434
5435 err = ipc_has_perm(&msq->q_perm, perms);
5436 return err;
5437 }
5438
5439 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5440 {
5441 struct ipc_security_struct *isec;
5442 struct msg_security_struct *msec;
5443 struct common_audit_data ad;
5444 u32 sid = current_sid();
5445 int rc;
5446
5447 isec = msq->q_perm.security;
5448 msec = msg->security;
5449
5450 /*
5451 * First time through, need to assign label to the message
5452 */
5453 if (msec->sid == SECINITSID_UNLABELED) {
5454 /*
5455 * Compute new sid based on current process and
5456 * message queue this message will be stored in
5457 */
5458 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5459 NULL, &msec->sid);
5460 if (rc)
5461 return rc;
5462 }
5463
5464 ad.type = LSM_AUDIT_DATA_IPC;
5465 ad.u.ipc_id = msq->q_perm.key;
5466
5467 /* Can this process write to the queue? */
5468 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5469 MSGQ__WRITE, &ad);
5470 if (!rc)
5471 /* Can this process send the message */
5472 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5473 MSG__SEND, &ad);
5474 if (!rc)
5475 /* Can the message be put in the queue? */
5476 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5477 MSGQ__ENQUEUE, &ad);
5478
5479 return rc;
5480 }
5481
5482 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5483 struct task_struct *target,
5484 long type, int mode)
5485 {
5486 struct ipc_security_struct *isec;
5487 struct msg_security_struct *msec;
5488 struct common_audit_data ad;
5489 u32 sid = task_sid(target);
5490 int rc;
5491
5492 isec = msq->q_perm.security;
5493 msec = msg->security;
5494
5495 ad.type = LSM_AUDIT_DATA_IPC;
5496 ad.u.ipc_id = msq->q_perm.key;
5497
5498 rc = avc_has_perm(sid, isec->sid,
5499 SECCLASS_MSGQ, MSGQ__READ, &ad);
5500 if (!rc)
5501 rc = avc_has_perm(sid, msec->sid,
5502 SECCLASS_MSG, MSG__RECEIVE, &ad);
5503 return rc;
5504 }
5505
5506 /* Shared Memory security operations */
5507 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5508 {
5509 struct ipc_security_struct *isec;
5510 struct common_audit_data ad;
5511 u32 sid = current_sid();
5512 int rc;
5513
5514 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5515 if (rc)
5516 return rc;
5517
5518 isec = shp->shm_perm.security;
5519
5520 ad.type = LSM_AUDIT_DATA_IPC;
5521 ad.u.ipc_id = shp->shm_perm.key;
5522
5523 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5524 SHM__CREATE, &ad);
5525 if (rc) {
5526 ipc_free_security(&shp->shm_perm);
5527 return rc;
5528 }
5529 return 0;
5530 }
5531
5532 static void selinux_shm_free_security(struct shmid_kernel *shp)
5533 {
5534 ipc_free_security(&shp->shm_perm);
5535 }
5536
5537 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5538 {
5539 struct ipc_security_struct *isec;
5540 struct common_audit_data ad;
5541 u32 sid = current_sid();
5542
5543 isec = shp->shm_perm.security;
5544
5545 ad.type = LSM_AUDIT_DATA_IPC;
5546 ad.u.ipc_id = shp->shm_perm.key;
5547
5548 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5549 SHM__ASSOCIATE, &ad);
5550 }
5551
5552 /* Note, at this point, shp is locked down */
5553 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5554 {
5555 int perms;
5556 int err;
5557
5558 switch (cmd) {
5559 case IPC_INFO:
5560 case SHM_INFO:
5561 /* No specific object, just general system-wide information. */
5562 return task_has_system(current, SYSTEM__IPC_INFO);
5563 case IPC_STAT:
5564 case SHM_STAT:
5565 perms = SHM__GETATTR | SHM__ASSOCIATE;
5566 break;
5567 case IPC_SET:
5568 perms = SHM__SETATTR;
5569 break;
5570 case SHM_LOCK:
5571 case SHM_UNLOCK:
5572 perms = SHM__LOCK;
5573 break;
5574 case IPC_RMID:
5575 perms = SHM__DESTROY;
5576 break;
5577 default:
5578 return 0;
5579 }
5580
5581 err = ipc_has_perm(&shp->shm_perm, perms);
5582 return err;
5583 }
5584
5585 static int selinux_shm_shmat(struct shmid_kernel *shp,
5586 char __user *shmaddr, int shmflg)
5587 {
5588 u32 perms;
5589
5590 if (shmflg & SHM_RDONLY)
5591 perms = SHM__READ;
5592 else
5593 perms = SHM__READ | SHM__WRITE;
5594
5595 return ipc_has_perm(&shp->shm_perm, perms);
5596 }
5597
5598 /* Semaphore security operations */
5599 static int selinux_sem_alloc_security(struct sem_array *sma)
5600 {
5601 struct ipc_security_struct *isec;
5602 struct common_audit_data ad;
5603 u32 sid = current_sid();
5604 int rc;
5605
5606 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5607 if (rc)
5608 return rc;
5609
5610 isec = sma->sem_perm.security;
5611
5612 ad.type = LSM_AUDIT_DATA_IPC;
5613 ad.u.ipc_id = sma->sem_perm.key;
5614
5615 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5616 SEM__CREATE, &ad);
5617 if (rc) {
5618 ipc_free_security(&sma->sem_perm);
5619 return rc;
5620 }
5621 return 0;
5622 }
5623
5624 static void selinux_sem_free_security(struct sem_array *sma)
5625 {
5626 ipc_free_security(&sma->sem_perm);
5627 }
5628
5629 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5630 {
5631 struct ipc_security_struct *isec;
5632 struct common_audit_data ad;
5633 u32 sid = current_sid();
5634
5635 isec = sma->sem_perm.security;
5636
5637 ad.type = LSM_AUDIT_DATA_IPC;
5638 ad.u.ipc_id = sma->sem_perm.key;
5639
5640 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5641 SEM__ASSOCIATE, &ad);
5642 }
5643
5644 /* Note, at this point, sma is locked down */
5645 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5646 {
5647 int err;
5648 u32 perms;
5649
5650 switch (cmd) {
5651 case IPC_INFO:
5652 case SEM_INFO:
5653 /* No specific object, just general system-wide information. */
5654 return task_has_system(current, SYSTEM__IPC_INFO);
5655 case GETPID:
5656 case GETNCNT:
5657 case GETZCNT:
5658 perms = SEM__GETATTR;
5659 break;
5660 case GETVAL:
5661 case GETALL:
5662 perms = SEM__READ;
5663 break;
5664 case SETVAL:
5665 case SETALL:
5666 perms = SEM__WRITE;
5667 break;
5668 case IPC_RMID:
5669 perms = SEM__DESTROY;
5670 break;
5671 case IPC_SET:
5672 perms = SEM__SETATTR;
5673 break;
5674 case IPC_STAT:
5675 case SEM_STAT:
5676 perms = SEM__GETATTR | SEM__ASSOCIATE;
5677 break;
5678 default:
5679 return 0;
5680 }
5681
5682 err = ipc_has_perm(&sma->sem_perm, perms);
5683 return err;
5684 }
5685
5686 static int selinux_sem_semop(struct sem_array *sma,
5687 struct sembuf *sops, unsigned nsops, int alter)
5688 {
5689 u32 perms;
5690
5691 if (alter)
5692 perms = SEM__READ | SEM__WRITE;
5693 else
5694 perms = SEM__READ;
5695
5696 return ipc_has_perm(&sma->sem_perm, perms);
5697 }
5698
5699 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5700 {
5701 u32 av = 0;
5702
5703 av = 0;
5704 if (flag & S_IRUGO)
5705 av |= IPC__UNIX_READ;
5706 if (flag & S_IWUGO)
5707 av |= IPC__UNIX_WRITE;
5708
5709 if (av == 0)
5710 return 0;
5711
5712 return ipc_has_perm(ipcp, av);
5713 }
5714
5715 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5716 {
5717 struct ipc_security_struct *isec = ipcp->security;
5718 *secid = isec->sid;
5719 }
5720
5721 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5722 {
5723 if (inode)
5724 inode_doinit_with_dentry(inode, dentry);
5725 }
5726
5727 static int selinux_getprocattr(struct task_struct *p,
5728 char *name, char **value)
5729 {
5730 const struct task_security_struct *__tsec;
5731 u32 sid;
5732 int error;
5733 unsigned len;
5734
5735 if (current != p) {
5736 error = current_has_perm(p, PROCESS__GETATTR);
5737 if (error)
5738 return error;
5739 }
5740
5741 rcu_read_lock();
5742 __tsec = __task_cred(p)->security;
5743
5744 if (!strcmp(name, "current"))
5745 sid = __tsec->sid;
5746 else if (!strcmp(name, "prev"))
5747 sid = __tsec->osid;
5748 else if (!strcmp(name, "exec"))
5749 sid = __tsec->exec_sid;
5750 else if (!strcmp(name, "fscreate"))
5751 sid = __tsec->create_sid;
5752 else if (!strcmp(name, "keycreate"))
5753 sid = __tsec->keycreate_sid;
5754 else if (!strcmp(name, "sockcreate"))
5755 sid = __tsec->sockcreate_sid;
5756 else
5757 goto invalid;
5758 rcu_read_unlock();
5759
5760 if (!sid)
5761 return 0;
5762
5763 error = security_sid_to_context(sid, value, &len);
5764 if (error)
5765 return error;
5766 return len;
5767
5768 invalid:
5769 rcu_read_unlock();
5770 return -EINVAL;
5771 }
5772
5773 static int selinux_setprocattr(struct task_struct *p,
5774 char *name, void *value, size_t size)
5775 {
5776 struct task_security_struct *tsec;
5777 struct cred *new;
5778 u32 sid = 0, ptsid;
5779 int error;
5780 char *str = value;
5781
5782 if (current != p) {
5783 /* SELinux only allows a process to change its own
5784 security attributes. */
5785 return -EACCES;
5786 }
5787
5788 /*
5789 * Basic control over ability to set these attributes at all.
5790 * current == p, but we'll pass them separately in case the
5791 * above restriction is ever removed.
5792 */
5793 if (!strcmp(name, "exec"))
5794 error = current_has_perm(p, PROCESS__SETEXEC);
5795 else if (!strcmp(name, "fscreate"))
5796 error = current_has_perm(p, PROCESS__SETFSCREATE);
5797 else if (!strcmp(name, "keycreate"))
5798 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5799 else if (!strcmp(name, "sockcreate"))
5800 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5801 else if (!strcmp(name, "current"))
5802 error = current_has_perm(p, PROCESS__SETCURRENT);
5803 else
5804 error = -EINVAL;
5805 if (error)
5806 return error;
5807
5808 /* Obtain a SID for the context, if one was specified. */
5809 if (size && str[1] && str[1] != '\n') {
5810 if (str[size-1] == '\n') {
5811 str[size-1] = 0;
5812 size--;
5813 }
5814 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5815 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5816 if (!capable(CAP_MAC_ADMIN)) {
5817 struct audit_buffer *ab;
5818 size_t audit_size;
5819
5820 /* We strip a nul only if it is at the end, otherwise the
5821 * context contains a nul and we should audit that */
5822 if (str[size - 1] == '\0')
5823 audit_size = size - 1;
5824 else
5825 audit_size = size;
5826 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5827 audit_log_format(ab, "op=fscreate invalid_context=");
5828 audit_log_n_untrustedstring(ab, value, audit_size);
5829 audit_log_end(ab);
5830
5831 return error;
5832 }
5833 error = security_context_to_sid_force(value, size,
5834 &sid);
5835 }
5836 if (error)
5837 return error;
5838 }
5839
5840 new = prepare_creds();
5841 if (!new)
5842 return -ENOMEM;
5843
5844 /* Permission checking based on the specified context is
5845 performed during the actual operation (execve,
5846 open/mkdir/...), when we know the full context of the
5847 operation. See selinux_bprm_set_creds for the execve
5848 checks and may_create for the file creation checks. The
5849 operation will then fail if the context is not permitted. */
5850 tsec = new->security;
5851 if (!strcmp(name, "exec")) {
5852 tsec->exec_sid = sid;
5853 } else if (!strcmp(name, "fscreate")) {
5854 tsec->create_sid = sid;
5855 } else if (!strcmp(name, "keycreate")) {
5856 error = may_create_key(sid, p);
5857 if (error)
5858 goto abort_change;
5859 tsec->keycreate_sid = sid;
5860 } else if (!strcmp(name, "sockcreate")) {
5861 tsec->sockcreate_sid = sid;
5862 } else if (!strcmp(name, "current")) {
5863 error = -EINVAL;
5864 if (sid == 0)
5865 goto abort_change;
5866
5867 /* Only allow single threaded processes to change context */
5868 error = -EPERM;
5869 if (!current_is_single_threaded()) {
5870 error = security_bounded_transition(tsec->sid, sid);
5871 if (error)
5872 goto abort_change;
5873 }
5874
5875 /* Check permissions for the transition. */
5876 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5877 PROCESS__DYNTRANSITION, NULL);
5878 if (error)
5879 goto abort_change;
5880
5881 /* Check for ptracing, and update the task SID if ok.
5882 Otherwise, leave SID unchanged and fail. */
5883 ptsid = ptrace_parent_sid(p);
5884 if (ptsid != 0) {
5885 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5886 PROCESS__PTRACE, NULL);
5887 if (error)
5888 goto abort_change;
5889 }
5890
5891 tsec->sid = sid;
5892 } else {
5893 error = -EINVAL;
5894 goto abort_change;
5895 }
5896
5897 commit_creds(new);
5898 return size;
5899
5900 abort_change:
5901 abort_creds(new);
5902 return error;
5903 }
5904
5905 static int selinux_ismaclabel(const char *name)
5906 {
5907 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5908 }
5909
5910 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5911 {
5912 return security_sid_to_context(secid, secdata, seclen);
5913 }
5914
5915 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5916 {
5917 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5918 }
5919
5920 static void selinux_release_secctx(char *secdata, u32 seclen)
5921 {
5922 kfree(secdata);
5923 }
5924
5925 static void selinux_inode_invalidate_secctx(struct inode *inode)
5926 {
5927 struct inode_security_struct *isec = inode->i_security;
5928
5929 mutex_lock(&isec->lock);
5930 isec->initialized = LABEL_INVALID;
5931 mutex_unlock(&isec->lock);
5932 }
5933
5934 /*
5935 * called with inode->i_mutex locked
5936 */
5937 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5938 {
5939 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5940 }
5941
5942 /*
5943 * called with inode->i_mutex locked
5944 */
5945 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5946 {
5947 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5948 }
5949
5950 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5951 {
5952 int len = 0;
5953 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5954 ctx, true);
5955 if (len < 0)
5956 return len;
5957 *ctxlen = len;
5958 return 0;
5959 }
5960 #ifdef CONFIG_KEYS
5961
5962 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5963 unsigned long flags)
5964 {
5965 const struct task_security_struct *tsec;
5966 struct key_security_struct *ksec;
5967
5968 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5969 if (!ksec)
5970 return -ENOMEM;
5971
5972 tsec = cred->security;
5973 if (tsec->keycreate_sid)
5974 ksec->sid = tsec->keycreate_sid;
5975 else
5976 ksec->sid = tsec->sid;
5977
5978 k->security = ksec;
5979 return 0;
5980 }
5981
5982 static void selinux_key_free(struct key *k)
5983 {
5984 struct key_security_struct *ksec = k->security;
5985
5986 k->security = NULL;
5987 kfree(ksec);
5988 }
5989
5990 static int selinux_key_permission(key_ref_t key_ref,
5991 const struct cred *cred,
5992 unsigned perm)
5993 {
5994 struct key *key;
5995 struct key_security_struct *ksec;
5996 u32 sid;
5997
5998 /* if no specific permissions are requested, we skip the
5999 permission check. No serious, additional covert channels
6000 appear to be created. */
6001 if (perm == 0)
6002 return 0;
6003
6004 sid = cred_sid(cred);
6005
6006 key = key_ref_to_ptr(key_ref);
6007 ksec = key->security;
6008
6009 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6010 }
6011
6012 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6013 {
6014 struct key_security_struct *ksec = key->security;
6015 char *context = NULL;
6016 unsigned len;
6017 int rc;
6018
6019 rc = security_sid_to_context(ksec->sid, &context, &len);
6020 if (!rc)
6021 rc = len;
6022 *_buffer = context;
6023 return rc;
6024 }
6025
6026 #endif
6027
6028 static struct security_hook_list selinux_hooks[] = {
6029 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6030 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6031 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6032 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6033
6034 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6035 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6036 LSM_HOOK_INIT(capget, selinux_capget),
6037 LSM_HOOK_INIT(capset, selinux_capset),
6038 LSM_HOOK_INIT(capable, selinux_capable),
6039 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6040 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6041 LSM_HOOK_INIT(syslog, selinux_syslog),
6042 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6043
6044 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6045
6046 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6047 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6048 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6049 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6050
6051 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6052 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6053 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6054 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6055 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6056 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6057 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6058 LSM_HOOK_INIT(sb_mount, selinux_mount),
6059 LSM_HOOK_INIT(sb_umount, selinux_umount),
6060 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6061 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6062 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6063
6064 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6065
6066 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6067 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6068 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6069 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6070 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6071 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6072 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6073 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6074 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6075 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6076 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6077 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6078 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6079 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6080 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6081 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6082 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6083 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6084 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6085 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6086 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6087 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6088 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6089 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6090 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6091
6092 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6093 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6094 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6095 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6096 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6097 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6098 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6099 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6100 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6101 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6102 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6103 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6104
6105 LSM_HOOK_INIT(file_open, selinux_file_open),
6106
6107 LSM_HOOK_INIT(task_create, selinux_task_create),
6108 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6109 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6110 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6111 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6112 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6113 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6114 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6115 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6116 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6117 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6118 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6119 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6120 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6121 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6122 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6123 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6124 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6125 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6126 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6127 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6128 LSM_HOOK_INIT(task_wait, selinux_task_wait),
6129 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6130
6131 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6132 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6133
6134 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6135 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6136
6137 LSM_HOOK_INIT(msg_queue_alloc_security,
6138 selinux_msg_queue_alloc_security),
6139 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6140 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6141 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6142 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6143 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6144
6145 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6146 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6147 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6148 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6149 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6150
6151 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6152 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6153 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6154 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6155 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6156
6157 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6158
6159 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6160 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6161
6162 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6163 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6164 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6165 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6166 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6167 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6168 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6169 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6170
6171 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6172 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6173
6174 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6175 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6176 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6177 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6178 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6179 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6180 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6181 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6182 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6183 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6184 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6185 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6186 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6187 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6188 LSM_HOOK_INIT(socket_getpeersec_stream,
6189 selinux_socket_getpeersec_stream),
6190 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6191 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6192 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6193 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6194 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6195 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6196 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6197 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6198 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6199 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6200 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6201 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6202 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6203 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6204 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6205 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6206 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6207 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6208 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6209
6210 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6211 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6212 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6213 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6214 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6215 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6216 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6217 selinux_xfrm_state_alloc_acquire),
6218 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6219 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6220 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6221 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6222 selinux_xfrm_state_pol_flow_match),
6223 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6224 #endif
6225
6226 #ifdef CONFIG_KEYS
6227 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6228 LSM_HOOK_INIT(key_free, selinux_key_free),
6229 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6230 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6231 #endif
6232
6233 #ifdef CONFIG_AUDIT
6234 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6235 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6236 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6237 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6238 #endif
6239 };
6240
6241 static __init int selinux_init(void)
6242 {
6243 if (!security_module_enable("selinux")) {
6244 selinux_enabled = 0;
6245 return 0;
6246 }
6247
6248 if (!selinux_enabled) {
6249 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6250 return 0;
6251 }
6252
6253 printk(KERN_INFO "SELinux: Initializing.\n");
6254
6255 /* Set the security state for the initial task. */
6256 cred_init_security();
6257
6258 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6259
6260 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6261 sizeof(struct inode_security_struct),
6262 0, SLAB_PANIC, NULL);
6263 file_security_cache = kmem_cache_create("selinux_file_security",
6264 sizeof(struct file_security_struct),
6265 0, SLAB_PANIC, NULL);
6266 avc_init();
6267
6268 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6269
6270 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6271 panic("SELinux: Unable to register AVC netcache callback\n");
6272
6273 if (selinux_enforcing)
6274 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6275 else
6276 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6277
6278 return 0;
6279 }
6280
6281 static void delayed_superblock_init(struct super_block *sb, void *unused)
6282 {
6283 superblock_doinit(sb, NULL);
6284 }
6285
6286 void selinux_complete_init(void)
6287 {
6288 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6289
6290 /* Set up any superblocks initialized prior to the policy load. */
6291 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6292 iterate_supers(delayed_superblock_init, NULL);
6293 }
6294
6295 /* SELinux requires early initialization in order to label
6296 all processes and objects when they are created. */
6297 security_initcall(selinux_init);
6298
6299 #if defined(CONFIG_NETFILTER)
6300
6301 static struct nf_hook_ops selinux_nf_ops[] = {
6302 {
6303 .hook = selinux_ipv4_postroute,
6304 .pf = NFPROTO_IPV4,
6305 .hooknum = NF_INET_POST_ROUTING,
6306 .priority = NF_IP_PRI_SELINUX_LAST,
6307 },
6308 {
6309 .hook = selinux_ipv4_forward,
6310 .pf = NFPROTO_IPV4,
6311 .hooknum = NF_INET_FORWARD,
6312 .priority = NF_IP_PRI_SELINUX_FIRST,
6313 },
6314 {
6315 .hook = selinux_ipv4_output,
6316 .pf = NFPROTO_IPV4,
6317 .hooknum = NF_INET_LOCAL_OUT,
6318 .priority = NF_IP_PRI_SELINUX_FIRST,
6319 },
6320 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6321 {
6322 .hook = selinux_ipv6_postroute,
6323 .pf = NFPROTO_IPV6,
6324 .hooknum = NF_INET_POST_ROUTING,
6325 .priority = NF_IP6_PRI_SELINUX_LAST,
6326 },
6327 {
6328 .hook = selinux_ipv6_forward,
6329 .pf = NFPROTO_IPV6,
6330 .hooknum = NF_INET_FORWARD,
6331 .priority = NF_IP6_PRI_SELINUX_FIRST,
6332 },
6333 {
6334 .hook = selinux_ipv6_output,
6335 .pf = NFPROTO_IPV6,
6336 .hooknum = NF_INET_LOCAL_OUT,
6337 .priority = NF_IP6_PRI_SELINUX_FIRST,
6338 },
6339 #endif /* IPV6 */
6340 };
6341
6342 static int __init selinux_nf_ip_init(void)
6343 {
6344 int err;
6345
6346 if (!selinux_enabled)
6347 return 0;
6348
6349 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6350
6351 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6352 if (err)
6353 panic("SELinux: nf_register_hooks: error %d\n", err);
6354
6355 return 0;
6356 }
6357
6358 __initcall(selinux_nf_ip_init);
6359
6360 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6361 static void selinux_nf_ip_exit(void)
6362 {
6363 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6364
6365 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6366 }
6367 #endif
6368
6369 #else /* CONFIG_NETFILTER */
6370
6371 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6372 #define selinux_nf_ip_exit()
6373 #endif
6374
6375 #endif /* CONFIG_NETFILTER */
6376
6377 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6378 static int selinux_disabled;
6379
6380 int selinux_disable(void)
6381 {
6382 if (ss_initialized) {
6383 /* Not permitted after initial policy load. */
6384 return -EINVAL;
6385 }
6386
6387 if (selinux_disabled) {
6388 /* Only do this once. */
6389 return -EINVAL;
6390 }
6391
6392 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6393
6394 selinux_disabled = 1;
6395 selinux_enabled = 0;
6396
6397 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6398
6399 /* Try to destroy the avc node cache */
6400 avc_disable();
6401
6402 /* Unregister netfilter hooks. */
6403 selinux_nf_ip_exit();
6404
6405 /* Unregister selinuxfs. */
6406 exit_sel_fs();
6407
6408 return 0;
6409 }
6410 #endif
Linux kernel - Deliverables
This page took 0.183546 seconds and 5 git commands to generate.