projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
selinux: introduce schedule points in policydb_destroy()
[deliverable/linux.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
7420ed23
VY		 15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
1da177e4
LT		 17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
1da177e4
LT		 23#include <linux/module.h>
24#include <linux/init.h>
25#include <linux/kernel.h>
26#include <linux/ptrace.h>
27#include <linux/errno.h>
28#include <linux/sched.h>
29#include <linux/security.h>
30#include <linux/xattr.h>
31#include <linux/capability.h>
32#include <linux/unistd.h>
33#include <linux/mm.h>
34#include <linux/mman.h>
35#include <linux/slab.h>
36#include <linux/pagemap.h>
37#include <linux/swap.h>
1da177e4
LT		 38#include <linux/spinlock.h>
39#include <linux/syscalls.h>
40#include <linux/file.h>
41#include <linux/namei.h>
42#include <linux/mount.h>
43#include <linux/ext2_fs.h>
44#include <linux/proc_fs.h>
45#include <linux/kd.h>
46#include <linux/netfilter_ipv4.h>
47#include <linux/netfilter_ipv6.h>
48#include <linux/tty.h>
49#include <net/icmp.h>
50#include <net/ip.h> /* for sysctl_local_port_range[] */
51#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52#include <asm/uaccess.h>
1da177e4
LT		 53#include <asm/ioctls.h>
54#include <linux/bitops.h>
55#include <linux/interrupt.h>
56#include <linux/netdevice.h> /* for network interface checks */
57#include <linux/netlink.h>
58#include <linux/tcp.h>
59#include <linux/udp.h>
2ee92d46 60#include <linux/dccp.h>
1da177e4
LT		 61#include <linux/quota.h>
62#include <linux/un.h> /* for Unix socket types */
63#include <net/af_unix.h> /* for Unix socket types */
64#include <linux/parser.h>
65#include <linux/nfs_mount.h>
66#include <net/ipv6.h>
67#include <linux/hugetlb.h>
68#include <linux/personality.h>
69#include <linux/sysctl.h>
70#include <linux/audit.h>
6931dfc9 71#include <linux/string.h>
877ce7c1 72#include <linux/selinux.h>
23970741 73#include <linux/mutex.h>
1da177e4
LT		 74
75#include "avc.h"
76#include "objsec.h"
77#include "netif.h"
d28d1e08 78#include "xfrm.h"
c60475bf 79#include "netlabel.h"
1da177e4
LT		 80
81#define XATTR_SELINUX_SUFFIX "selinux"
82#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
83
84extern unsigned int policydb_loaded_version;
85extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
4e5ab4cb 86extern int selinux_compat_net;
1da177e4
LT		 87
88#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89int selinux_enforcing = 0;
90
91static int __init enforcing_setup(char *str)
92{
93 selinux_enforcing = simple_strtol(str,NULL,0);
94 return 1;
95}
96__setup("enforcing=", enforcing_setup);
97#endif
98
99#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
101
102static int __init selinux_enabled_setup(char *str)
103{
104 selinux_enabled = simple_strtol(str, NULL, 0);
105 return 1;
106}
107__setup("selinux=", selinux_enabled_setup);
30d55280
SS		 108#else
109int selinux_enabled = 1;
1da177e4
LT		 110#endif
111
112/* Original (dummy) security module. */
113static struct security_operations *original_ops = NULL;
114
115/* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119static struct security_operations *secondary_ops = NULL;
120
121/* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123static LIST_HEAD(superblock_security_head);
124static DEFINE_SPINLOCK(sb_security_lock);
125
e18b890b 126static struct kmem_cache *sel_inode_cache;
7cae7e26 127
8c8570fb
DK		 128/* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
131{
132 char *context;
133 unsigned len;
134 int rc;
135
136 rc = security_sid_to_context(sid, &context, &len);
137 if (rc)
138 return rc;
139
140 if (!buffer || !size)
141 goto getsecurity_exit;
142
143 if (size < len) {
144 len = -ERANGE;
145 goto getsecurity_exit;
146 }
147 memcpy(buffer, context, len);
148
149getsecurity_exit:
150 kfree(context);
151 return len;
152}
153
1da177e4
LT		 154/* Allocate and free functions for each kind of security blob. */
155
156static int task_alloc_security(struct task_struct *task)
157{
158 struct task_security_struct *tsec;
159
89d155ef 160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4
LT		 161 if (!tsec)
162 return -ENOMEM;
163
1da177e4
LT		 164 tsec->task = task;
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
167
168 return 0;
169}
170
171static void task_free_security(struct task_struct *task)
172{
173 struct task_security_struct *tsec = task->security;
1da177e4
LT		 174 task->security = NULL;
175 kfree(tsec);
176}
177
178static int inode_alloc_security(struct inode *inode)
179{
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
182
c3762229 183 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
1da177e4
LT		 184 if (!isec)
185 return -ENOMEM;
186
23970741 187 mutex_init(&isec->lock);
1da177e4 188 INIT_LIST_HEAD(&isec->list);
1da177e4
LT		 189 isec->inode = inode;
190 isec->sid = SECINITSID_UNLABELED;
191 isec->sclass = SECCLASS_FILE;
9ac49d22 192 isec->task_sid = tsec->sid;
1da177e4
LT		 193 inode->i_security = isec;
194
195 return 0;
196}
197
198static void inode_free_security(struct inode *inode)
199{
200 struct inode_security_struct *isec = inode->i_security;
201 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202
1da177e4
LT		 203 spin_lock(&sbsec->isec_lock);
204 if (!list_empty(&isec->list))
205 list_del_init(&isec->list);
206 spin_unlock(&sbsec->isec_lock);
207
208 inode->i_security = NULL;
7cae7e26 209 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT		 210}
211
212static int file_alloc_security(struct file *file)
213{
214 struct task_security_struct *tsec = current->security;
215 struct file_security_struct *fsec;
216
26d2a4be 217 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT		 218 if (!fsec)
219 return -ENOMEM;
220
1da177e4 221 fsec->file = file;
9ac49d22
SS		 222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
1da177e4
LT		 224 file->f_security = fsec;
225
226 return 0;
227}
228
229static void file_free_security(struct file *file)
230{
231 struct file_security_struct *fsec = file->f_security;
1da177e4
LT		 232 file->f_security = NULL;
233 kfree(fsec);
234}
235
236static int superblock_alloc_security(struct super_block *sb)
237{
238 struct superblock_security_struct *sbsec;
239
89d155ef 240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT		 241 if (!sbsec)
242 return -ENOMEM;
243
bc7e982b 244 mutex_init(&sbsec->lock);
1da177e4
LT		 245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT		 248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
c312feb2 251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT		 252 sb->s_security = sbsec;
253
254 return 0;
255}
256
257static void superblock_free_security(struct super_block *sb)
258{
259 struct superblock_security_struct *sbsec = sb->s_security;
260
1da177e4
LT		 261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268}
269
7d877f3b 270static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
1da177e4
LT		 271{
272 struct sk_security_struct *ssec;
273
89d155ef 274 ssec = kzalloc(sizeof(*ssec), priority);
1da177e4
LT		 275 if (!ssec)
276 return -ENOMEM;
277
1da177e4
LT		 278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
892c141e 280 ssec->sid = SECINITSID_UNLABELED;
1da177e4
LT		 281 sk->sk_security = ssec;
282
99f59ed0
PM		 283 selinux_netlbl_sk_security_init(ssec, family);
284
1da177e4
LT		 285 return 0;
286}
287
288static void sk_free_security(struct sock *sk)
289{
290 struct sk_security_struct *ssec = sk->sk_security;
291
1da177e4
LT		 292 sk->sk_security = NULL;
293 kfree(ssec);
294}
1da177e4
LT		 295
296/* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298extern int ss_initialized;
299
300/* The file system's label must be initialized prior to use. */
301
302static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309};
310
311static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313static inline int inode_doinit(struct inode *inode)
314{
315 return inode_doinit_with_dentry(inode, NULL);
316}
317
318enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
0808925e 322 Opt_rootcontext = 8,
1da177e4
LT		 323};
324
325static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
0808925e 329 {Opt_rootcontext, "rootcontext=%s"},
1da177e4
LT		 330};
331
332#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333
c312feb2
EP		 334static int may_context_mount_sb_relabel(u32 sid,
335 struct superblock_security_struct *sbsec,
336 struct task_security_struct *tsec)
337{
338 int rc;
339
340 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
341 FILESYSTEM__RELABELFROM, NULL);
342 if (rc)
343 return rc;
344
345 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELTO, NULL);
347 return rc;
348}
349
0808925e
EP		 350static int may_context_mount_inode_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
352 struct task_security_struct *tsec)
353{
354 int rc;
355 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
356 FILESYSTEM__RELABELFROM, NULL);
357 if (rc)
358 return rc;
359
360 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
361 FILESYSTEM__ASSOCIATE, NULL);
362 return rc;
363}
364
1da177e4
LT		 365static int try_context_mount(struct super_block *sb, void *data)
366{
367 char *context = NULL, *defcontext = NULL;
0808925e 368 char *fscontext = NULL, *rootcontext = NULL;
1da177e4
LT		 369 const char *name;
370 u32 sid;
371 int alloc = 0, rc = 0, seen = 0;
372 struct task_security_struct *tsec = current->security;
373 struct superblock_security_struct *sbsec = sb->s_security;
374
375 if (!data)
376 goto out;
377
378 name = sb->s_type->name;
379
380 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
381
382 /* NFS we understand. */
383 if (!strcmp(name, "nfs")) {
384 struct nfs_mount_data *d = data;
385
386 if (d->version < NFS_MOUNT_VERSION)
387 goto out;
388
389 if (d->context[0]) {
390 context = d->context;
391 seen |= Opt_context;
392 }
393 } else
394 goto out;
395
396 } else {
397 /* Standard string-based options. */
398 char *p, *options = data;
399
3528a953 400 while ((p = strsep(&options, "|")) != NULL) {
1da177e4
LT		 401 int token;
402 substring_t args[MAX_OPT_ARGS];
403
404 if (!*p)
405 continue;
406
407 token = match_token(p, tokens, args);
408
409 switch (token) {
410 case Opt_context:
c312feb2 411 if (seen & (Opt_context|Opt_defcontext)) {
1da177e4
LT		 412 rc = -EINVAL;
413 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
414 goto out_free;
415 }
416 context = match_strdup(&args[0]);
417 if (!context) {
418 rc = -ENOMEM;
419 goto out_free;
420 }
421 if (!alloc)
422 alloc = 1;
423 seen |= Opt_context;
424 break;
425
426 case Opt_fscontext:
c312feb2 427 if (seen & Opt_fscontext) {
1da177e4
LT		 428 rc = -EINVAL;
429 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
430 goto out_free;
431 }
c312feb2
EP		 432 fscontext = match_strdup(&args[0]);
433 if (!fscontext) {
1da177e4
LT		 434 rc = -ENOMEM;
435 goto out_free;
436 }
437 if (!alloc)
438 alloc = 1;
439 seen |= Opt_fscontext;
440 break;
441
0808925e
EP		 442 case Opt_rootcontext:
443 if (seen & Opt_rootcontext) {
444 rc = -EINVAL;
445 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
446 goto out_free;
447 }
448 rootcontext = match_strdup(&args[0]);
449 if (!rootcontext) {
450 rc = -ENOMEM;
451 goto out_free;
452 }
453 if (!alloc)
454 alloc = 1;
455 seen |= Opt_rootcontext;
456 break;
457
1da177e4
LT		 458 case Opt_defcontext:
459 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
460 rc = -EINVAL;
461 printk(KERN_WARNING "SELinux: "
462 "defcontext option is invalid "
463 "for this filesystem type\n");
464 goto out_free;
465 }
466 if (seen & (Opt_context|Opt_defcontext)) {
467 rc = -EINVAL;
468 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
469 goto out_free;
470 }
471 defcontext = match_strdup(&args[0]);
472 if (!defcontext) {
473 rc = -ENOMEM;
474 goto out_free;
475 }
476 if (!alloc)
477 alloc = 1;
478 seen |= Opt_defcontext;
479 break;
480
481 default:
482 rc = -EINVAL;
483 printk(KERN_WARNING "SELinux: unknown mount "
484 "option\n");
485 goto out_free;
486
487 }
488 }
489 }
490
491 if (!seen)
492 goto out;
493
c312feb2
EP		 494 /* sets the context of the superblock for the fs being mounted. */
495 if (fscontext) {
496 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
1da177e4
LT		 497 if (rc) {
498 printk(KERN_WARNING "SELinux: security_context_to_sid"
499 "(%s) failed for (dev %s, type %s) errno=%d\n",
c312feb2 500 fscontext, sb->s_id, name, rc);
1da177e4
LT		 501 goto out_free;
502 }
503
c312feb2 504 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
1da177e4
LT		 505 if (rc)
506 goto out_free;
507
c312feb2
EP		 508 sbsec->sid = sid;
509 }
510
511 /*
512 * Switch to using mount point labeling behavior.
513 * sets the label used on all file below the mountpoint, and will set
514 * the superblock context if not already set.
515 */
516 if (context) {
517 rc = security_context_to_sid(context, strlen(context), &sid);
518 if (rc) {
519 printk(KERN_WARNING "SELinux: security_context_to_sid"
520 "(%s) failed for (dev %s, type %s) errno=%d\n",
521 context, sb->s_id, name, rc);
522 goto out_free;
523 }
524
b04ea3ce
EP		 525 if (!fscontext) {
526 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
527 if (rc)
528 goto out_free;
c312feb2 529 sbsec->sid = sid;
b04ea3ce
EP		 530 } else {
531 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
532 if (rc)
533 goto out_free;
534 }
c312feb2 535 sbsec->mntpoint_sid = sid;
1da177e4 536
c312feb2 537 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT		 538 }
539
0808925e
EP		 540 if (rootcontext) {
541 struct inode *inode = sb->s_root->d_inode;
542 struct inode_security_struct *isec = inode->i_security;
543 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
544 if (rc) {
545 printk(KERN_WARNING "SELinux: security_context_to_sid"
546 "(%s) failed for (dev %s, type %s) errno=%d\n",
547 rootcontext, sb->s_id, name, rc);
548 goto out_free;
549 }
550
551 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
552 if (rc)
553 goto out_free;
554
555 isec->sid = sid;
556 isec->initialized = 1;
557 }
558
1da177e4
LT		 559 if (defcontext) {
560 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
561 if (rc) {
562 printk(KERN_WARNING "SELinux: security_context_to_sid"
563 "(%s) failed for (dev %s, type %s) errno=%d\n",
564 defcontext, sb->s_id, name, rc);
565 goto out_free;
566 }
567
568 if (sid == sbsec->def_sid)
569 goto out_free;
570
0808925e 571 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
1da177e4
LT		 572 if (rc)
573 goto out_free;
574
575 sbsec->def_sid = sid;
576 }
577
578out_free:
579 if (alloc) {
580 kfree(context);
581 kfree(defcontext);
c312feb2 582 kfree(fscontext);
0808925e 583 kfree(rootcontext);
1da177e4
LT		 584 }
585out:
586 return rc;
587}
588
589static int superblock_doinit(struct super_block *sb, void *data)
590{
591 struct superblock_security_struct *sbsec = sb->s_security;
592 struct dentry *root = sb->s_root;
593 struct inode *inode = root->d_inode;
594 int rc = 0;
595
bc7e982b 596 mutex_lock(&sbsec->lock);
1da177e4
LT		 597 if (sbsec->initialized)
598 goto out;
599
600 if (!ss_initialized) {
601 /* Defer initialization until selinux_complete_init,
602 after the initial policy is loaded and the security
603 server is ready to handle calls. */
604 spin_lock(&sb_security_lock);
605 if (list_empty(&sbsec->list))
606 list_add(&sbsec->list, &superblock_security_head);
607 spin_unlock(&sb_security_lock);
608 goto out;
609 }
610
611 /* Determine the labeling behavior to use for this filesystem type. */
612 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
613 if (rc) {
614 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
615 __FUNCTION__, sb->s_type->name, rc);
616 goto out;
617 }
618
619 rc = try_context_mount(sb, data);
620 if (rc)
621 goto out;
622
623 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
624 /* Make sure that the xattr handler exists and that no
625 error other than -ENODATA is returned by getxattr on
626 the root directory. -ENODATA is ok, as this may be
627 the first boot of the SELinux kernel before we have
628 assigned xattr values to the filesystem. */
629 if (!inode->i_op->getxattr) {
630 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
631 "xattr support\n", sb->s_id, sb->s_type->name);
632 rc = -EOPNOTSUPP;
633 goto out;
634 }
635 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
636 if (rc < 0 && rc != -ENODATA) {
637 if (rc == -EOPNOTSUPP)
638 printk(KERN_WARNING "SELinux: (dev %s, type "
639 "%s) has no security xattr handler\n",
640 sb->s_id, sb->s_type->name);
641 else
642 printk(KERN_WARNING "SELinux: (dev %s, type "
643 "%s) getxattr errno %d\n", sb->s_id,
644 sb->s_type->name, -rc);
645 goto out;
646 }
647 }
648
649 if (strcmp(sb->s_type->name, "proc") == 0)
650 sbsec->proc = 1;
651
652 sbsec->initialized = 1;
653
654 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
fadcdb45 655 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
1da177e4
LT		 656 sb->s_id, sb->s_type->name);
657 }
658 else {
fadcdb45 659 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
1da177e4
LT		 660 sb->s_id, sb->s_type->name,
661 labeling_behaviors[sbsec->behavior-1]);
662 }
663
664 /* Initialize the root inode. */
665 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
666
667 /* Initialize any other inodes associated with the superblock, e.g.
668 inodes created prior to initial policy load or inodes created
669 during get_sb by a pseudo filesystem that directly
670 populates itself. */
671 spin_lock(&sbsec->isec_lock);
672next_inode:
673 if (!list_empty(&sbsec->isec_head)) {
674 struct inode_security_struct *isec =
675 list_entry(sbsec->isec_head.next,
676 struct inode_security_struct, list);
677 struct inode *inode = isec->inode;
678 spin_unlock(&sbsec->isec_lock);
679 inode = igrab(inode);
680 if (inode) {
681 if (!IS_PRIVATE (inode))
682 inode_doinit(inode);
683 iput(inode);
684 }
685 spin_lock(&sbsec->isec_lock);
686 list_del_init(&isec->list);
687 goto next_inode;
688 }
689 spin_unlock(&sbsec->isec_lock);
690out:
bc7e982b 691 mutex_unlock(&sbsec->lock);
1da177e4
LT		 692 return rc;
693}
694
695static inline u16 inode_mode_to_security_class(umode_t mode)
696{
697 switch (mode & S_IFMT) {
698 case S_IFSOCK:
699 return SECCLASS_SOCK_FILE;
700 case S_IFLNK:
701 return SECCLASS_LNK_FILE;
702 case S_IFREG:
703 return SECCLASS_FILE;
704 case S_IFBLK:
705 return SECCLASS_BLK_FILE;
706 case S_IFDIR:
707 return SECCLASS_DIR;
708 case S_IFCHR:
709 return SECCLASS_CHR_FILE;
710 case S_IFIFO:
711 return SECCLASS_FIFO_FILE;
712
713 }
714
715 return SECCLASS_FILE;
716}
717
13402580
JM		 718static inline int default_protocol_stream(int protocol)
719{
720 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
721}
722
723static inline int default_protocol_dgram(int protocol)
724{
725 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
726}
727
1da177e4
LT		 728static inline u16 socket_type_to_security_class(int family, int type, int protocol)
729{
730 switch (family) {
731 case PF_UNIX:
732 switch (type) {
733 case SOCK_STREAM:
734 case SOCK_SEQPACKET:
735 return SECCLASS_UNIX_STREAM_SOCKET;
736 case SOCK_DGRAM:
737 return SECCLASS_UNIX_DGRAM_SOCKET;
738 }
739 break;
740 case PF_INET:
741 case PF_INET6:
742 switch (type) {
743 case SOCK_STREAM:
13402580
JM		 744 if (default_protocol_stream(protocol))
745 return SECCLASS_TCP_SOCKET;
746 else
747 return SECCLASS_RAWIP_SOCKET;
1da177e4 748 case SOCK_DGRAM:
13402580
JM		 749 if (default_protocol_dgram(protocol))
750 return SECCLASS_UDP_SOCKET;
751 else
752 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM		 753 case SOCK_DCCP:
754 return SECCLASS_DCCP_SOCKET;
13402580 755 default:
1da177e4
LT		 756 return SECCLASS_RAWIP_SOCKET;
757 }
758 break;
759 case PF_NETLINK:
760 switch (protocol) {
761 case NETLINK_ROUTE:
762 return SECCLASS_NETLINK_ROUTE_SOCKET;
763 case NETLINK_FIREWALL:
764 return SECCLASS_NETLINK_FIREWALL_SOCKET;
216efaaa 765 case NETLINK_INET_DIAG:
1da177e4
LT		 766 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 case NETLINK_NFLOG:
768 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 case NETLINK_XFRM:
770 return SECCLASS_NETLINK_XFRM_SOCKET;
771 case NETLINK_SELINUX:
772 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 case NETLINK_AUDIT:
774 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 case NETLINK_IP6_FW:
776 return SECCLASS_NETLINK_IP6FW_SOCKET;
777 case NETLINK_DNRTMSG:
778 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 779 case NETLINK_KOBJECT_UEVENT:
780 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 781 default:
782 return SECCLASS_NETLINK_SOCKET;
783 }
784 case PF_PACKET:
785 return SECCLASS_PACKET_SOCKET;
786 case PF_KEY:
787 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP		 788 case PF_APPLETALK:
789 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT		 790 }
791
792 return SECCLASS_SOCKET;
793}
794
795#ifdef CONFIG_PROC_FS
796static int selinux_proc_get_sid(struct proc_dir_entry *de,
797 u16 tclass,
798 u32 *sid)
799{
800 int buflen, rc;
801 char *buffer, *path, *end;
802
803 buffer = (char*)__get_free_page(GFP_KERNEL);
804 if (!buffer)
805 return -ENOMEM;
806
807 buflen = PAGE_SIZE;
808 end = buffer+buflen;
809 *--end = '\0';
810 buflen--;
811 path = end-1;
812 *path = '/';
813 while (de && de != de->parent) {
814 buflen -= de->namelen + 1;
815 if (buflen < 0)
816 break;
817 end -= de->namelen;
818 memcpy(end, de->name, de->namelen);
819 *--end = '/';
820 path = end;
821 de = de->parent;
822 }
823 rc = security_genfs_sid("proc", path, tclass, sid);
824 free_page((unsigned long)buffer);
825 return rc;
826}
827#else
828static int selinux_proc_get_sid(struct proc_dir_entry *de,
829 u16 tclass,
830 u32 *sid)
831{
832 return -EINVAL;
833}
834#endif
835
836/* The inode's security attributes must be initialized before first use. */
837static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838{
839 struct superblock_security_struct *sbsec = NULL;
840 struct inode_security_struct *isec = inode->i_security;
841 u32 sid;
842 struct dentry *dentry;
843#define INITCONTEXTLEN 255
844 char *context = NULL;
845 unsigned len = 0;
846 int rc = 0;
1da177e4
LT		 847
848 if (isec->initialized)
849 goto out;
850
23970741 851 mutex_lock(&isec->lock);
1da177e4 852 if (isec->initialized)
23970741 853 goto out_unlock;
1da177e4
LT		 854
855 sbsec = inode->i_sb->s_security;
856 if (!sbsec->initialized) {
857 /* Defer initialization until selinux_complete_init,
858 after the initial policy is loaded and the security
859 server is ready to handle calls. */
860 spin_lock(&sbsec->isec_lock);
861 if (list_empty(&isec->list))
862 list_add(&isec->list, &sbsec->isec_head);
863 spin_unlock(&sbsec->isec_lock);
23970741 864 goto out_unlock;
1da177e4
LT		 865 }
866
867 switch (sbsec->behavior) {
868 case SECURITY_FS_USE_XATTR:
869 if (!inode->i_op->getxattr) {
870 isec->sid = sbsec->def_sid;
871 break;
872 }
873
874 /* Need a dentry, since the xattr API requires one.
875 Life would be simpler if we could just pass the inode. */
876 if (opt_dentry) {
877 /* Called from d_instantiate or d_splice_alias. */
878 dentry = dget(opt_dentry);
879 } else {
880 /* Called from selinux_complete_init, try to find a dentry. */
881 dentry = d_find_alias(inode);
882 }
883 if (!dentry) {
884 printk(KERN_WARNING "%s: no dentry for dev=%s "
885 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
886 inode->i_ino);
23970741 887 goto out_unlock;
1da177e4
LT		 888 }
889
890 len = INITCONTEXTLEN;
891 context = kmalloc(len, GFP_KERNEL);
892 if (!context) {
893 rc = -ENOMEM;
894 dput(dentry);
23970741 895 goto out_unlock;
1da177e4
LT		 896 }
897 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
898 context, len);
899 if (rc == -ERANGE) {
900 /* Need a larger buffer. Query for the right size. */
901 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
902 NULL, 0);
903 if (rc < 0) {
904 dput(dentry);
23970741 905 goto out_unlock;
1da177e4
LT		 906 }
907 kfree(context);
908 len = rc;
909 context = kmalloc(len, GFP_KERNEL);
910 if (!context) {
911 rc = -ENOMEM;
912 dput(dentry);
23970741 913 goto out_unlock;
1da177e4
LT		 914 }
915 rc = inode->i_op->getxattr(dentry,
916 XATTR_NAME_SELINUX,
917 context, len);
918 }
919 dput(dentry);
920 if (rc < 0) {
921 if (rc != -ENODATA) {
922 printk(KERN_WARNING "%s: getxattr returned "
923 "%d for dev=%s ino=%ld\n", __FUNCTION__,
924 -rc, inode->i_sb->s_id, inode->i_ino);
925 kfree(context);
23970741 926 goto out_unlock;
1da177e4
LT		 927 }
928 /* Map ENODATA to the default file SID */
929 sid = sbsec->def_sid;
930 rc = 0;
931 } else {
f5c1d5b2
JM		 932 rc = security_context_to_sid_default(context, rc, &sid,
933 sbsec->def_sid);
1da177e4
LT		 934 if (rc) {
935 printk(KERN_WARNING "%s: context_to_sid(%s) "
936 "returned %d for dev=%s ino=%ld\n",
937 __FUNCTION__, context, -rc,
938 inode->i_sb->s_id, inode->i_ino);
939 kfree(context);
940 /* Leave with the unlabeled SID */
941 rc = 0;
942 break;
943 }
944 }
945 kfree(context);
946 isec->sid = sid;
947 break;
948 case SECURITY_FS_USE_TASK:
949 isec->sid = isec->task_sid;
950 break;
951 case SECURITY_FS_USE_TRANS:
952 /* Default to the fs SID. */
953 isec->sid = sbsec->sid;
954
955 /* Try to obtain a transition SID. */
956 isec->sclass = inode_mode_to_security_class(inode->i_mode);
957 rc = security_transition_sid(isec->task_sid,
958 sbsec->sid,
959 isec->sclass,
960 &sid);
961 if (rc)
23970741 962 goto out_unlock;
1da177e4
LT		 963 isec->sid = sid;
964 break;
c312feb2
EP		 965 case SECURITY_FS_USE_MNTPOINT:
966 isec->sid = sbsec->mntpoint_sid;
967 break;
1da177e4 968 default:
c312feb2 969 /* Default to the fs superblock SID. */
1da177e4
LT		 970 isec->sid = sbsec->sid;
971
972 if (sbsec->proc) {
973 struct proc_inode *proci = PROC_I(inode);
974 if (proci->pde) {
975 isec->sclass = inode_mode_to_security_class(inode->i_mode);
976 rc = selinux_proc_get_sid(proci->pde,
977 isec->sclass,
978 &sid);
979 if (rc)
23970741 980 goto out_unlock;
1da177e4
LT		 981 isec->sid = sid;
982 }
983 }
984 break;
985 }
986
987 isec->initialized = 1;
988
23970741
EP		 989out_unlock:
990 mutex_unlock(&isec->lock);
1da177e4
LT		 991out:
992 if (isec->sclass == SECCLASS_FILE)
993 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT		 994 return rc;
995}
996
997/* Convert a Linux signal to an access vector. */
998static inline u32 signal_to_av(int sig)
999{
1000 u32 perm = 0;
1001
1002 switch (sig) {
1003 case SIGCHLD:
1004 /* Commonly granted from child to parent. */
1005 perm = PROCESS__SIGCHLD;
1006 break;
1007 case SIGKILL:
1008 /* Cannot be caught or ignored */
1009 perm = PROCESS__SIGKILL;
1010 break;
1011 case SIGSTOP:
1012 /* Cannot be caught or ignored */
1013 perm = PROCESS__SIGSTOP;
1014 break;
1015 default:
1016 /* All other signals. */
1017 perm = PROCESS__SIGNAL;
1018 break;
1019 }
1020
1021 return perm;
1022}
1023
1024/* Check permission betweeen a pair of tasks, e.g. signal checks,
1025 fork check, ptrace check, etc. */
1026static int task_has_perm(struct task_struct *tsk1,
1027 struct task_struct *tsk2,
1028 u32 perms)
1029{
1030 struct task_security_struct *tsec1, *tsec2;
1031
1032 tsec1 = tsk1->security;
1033 tsec2 = tsk2->security;
1034 return avc_has_perm(tsec1->sid, tsec2->sid,
1035 SECCLASS_PROCESS, perms, NULL);
1036}
1037
1038/* Check whether a task is allowed to use a capability. */
1039static int task_has_capability(struct task_struct *tsk,
1040 int cap)
1041{
1042 struct task_security_struct *tsec;
1043 struct avc_audit_data ad;
1044
1045 tsec = tsk->security;
1046
1047 AVC_AUDIT_DATA_INIT(&ad,CAP);
1048 ad.tsk = tsk;
1049 ad.u.cap = cap;
1050
1051 return avc_has_perm(tsec->sid, tsec->sid,
1052 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053}
1054
1055/* Check whether a task is allowed to use a system operation. */
1056static int task_has_system(struct task_struct *tsk,
1057 u32 perms)
1058{
1059 struct task_security_struct *tsec;
1060
1061 tsec = tsk->security;
1062
1063 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064 SECCLASS_SYSTEM, perms, NULL);
1065}
1066
1067/* Check whether a task has a particular permission to an inode.
1068 The 'adp' parameter is optional and allows other audit
1069 data to be passed (e.g. the dentry). */
1070static int inode_has_perm(struct task_struct *tsk,
1071 struct inode *inode,
1072 u32 perms,
1073 struct avc_audit_data *adp)
1074{
1075 struct task_security_struct *tsec;
1076 struct inode_security_struct *isec;
1077 struct avc_audit_data ad;
1078
bbaca6c2
SS		 1079 if (unlikely (IS_PRIVATE (inode)))
1080 return 0;
1081
1da177e4
LT		 1082 tsec = tsk->security;
1083 isec = inode->i_security;
1084
1085 if (!adp) {
1086 adp = &ad;
1087 AVC_AUDIT_DATA_INIT(&ad, FS);
1088 ad.u.fs.inode = inode;
1089 }
1090
1091 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092}
1093
1094/* Same as inode_has_perm, but pass explicit audit data containing
1095 the dentry to help the auditing code to more easily generate the
1096 pathname if needed. */
1097static inline int dentry_has_perm(struct task_struct *tsk,
1098 struct vfsmount *mnt,
1099 struct dentry *dentry,
1100 u32 av)
1101{
1102 struct inode *inode = dentry->d_inode;
1103 struct avc_audit_data ad;
1104 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.mnt = mnt;
1106 ad.u.fs.dentry = dentry;
1107 return inode_has_perm(tsk, inode, av, &ad);
1108}
1109
1110/* Check whether a task can use an open file descriptor to
1111 access an inode in a given way. Check access to the
1112 descriptor itself, and then use dentry_has_perm to
1113 check a particular permission to the file.
1114 Access to the descriptor is implicitly granted if it
1115 has the same SID as the process. If av is zero, then
1116 access to the file is not checked, e.g. for cases
1117 where only the descriptor is affected like seek. */
858119e1 1118static int file_has_perm(struct task_struct *tsk,
1da177e4
LT		 1119 struct file *file,
1120 u32 av)
1121{
1122 struct task_security_struct *tsec = tsk->security;
1123 struct file_security_struct *fsec = file->f_security;
3d5ff529
JS		 1124 struct vfsmount *mnt = file->f_path.mnt;
1125 struct dentry *dentry = file->f_path.dentry;
1da177e4
LT		 1126 struct inode *inode = dentry->d_inode;
1127 struct avc_audit_data ad;
1128 int rc;
1129
1130 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.mnt = mnt;
1132 ad.u.fs.dentry = dentry;
1133
1134 if (tsec->sid != fsec->sid) {
1135 rc = avc_has_perm(tsec->sid, fsec->sid,
1136 SECCLASS_FD,
1137 FD__USE,
1138 &ad);
1139 if (rc)
1140 return rc;
1141 }
1142
1143 /* av is zero if only checking access to the descriptor. */
1144 if (av)
1145 return inode_has_perm(tsk, inode, av, &ad);
1146
1147 return 0;
1148}
1149
1150/* Check whether a task can create a file. */
1151static int may_create(struct inode *dir,
1152 struct dentry *dentry,
1153 u16 tclass)
1154{
1155 struct task_security_struct *tsec;
1156 struct inode_security_struct *dsec;
1157 struct superblock_security_struct *sbsec;
1158 u32 newsid;
1159 struct avc_audit_data ad;
1160 int rc;
1161
1162 tsec = current->security;
1163 dsec = dir->i_security;
1164 sbsec = dir->i_sb->s_security;
1165
1166 AVC_AUDIT_DATA_INIT(&ad, FS);
1167 ad.u.fs.dentry = dentry;
1168
1169 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170 DIR__ADD_NAME | DIR__SEARCH,
1171 &ad);
1172 if (rc)
1173 return rc;
1174
1175 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176 newsid = tsec->create_sid;
1177 } else {
1178 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179 &newsid);
1180 if (rc)
1181 return rc;
1182 }
1183
1184 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185 if (rc)
1186 return rc;
1187
1188 return avc_has_perm(newsid, sbsec->sid,
1189 SECCLASS_FILESYSTEM,
1190 FILESYSTEM__ASSOCIATE, &ad);
1191}
1192
4eb582cf
ML		 1193/* Check whether a task can create a key. */
1194static int may_create_key(u32 ksid,
1195 struct task_struct *ctx)
1196{
1197 struct task_security_struct *tsec;
1198
1199 tsec = ctx->security;
1200
1201 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202}
1203
1da177e4
LT		 1204#define MAY_LINK 0
1205#define MAY_UNLINK 1
1206#define MAY_RMDIR 2
1207
1208/* Check whether a task can link, unlink, or rmdir a file/directory. */
1209static int may_link(struct inode *dir,
1210 struct dentry *dentry,
1211 int kind)
1212
1213{
1214 struct task_security_struct *tsec;
1215 struct inode_security_struct *dsec, *isec;
1216 struct avc_audit_data ad;
1217 u32 av;
1218 int rc;
1219
1220 tsec = current->security;
1221 dsec = dir->i_security;
1222 isec = dentry->d_inode->i_security;
1223
1224 AVC_AUDIT_DATA_INIT(&ad, FS);
1225 ad.u.fs.dentry = dentry;
1226
1227 av = DIR__SEARCH;
1228 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230 if (rc)
1231 return rc;
1232
1233 switch (kind) {
1234 case MAY_LINK:
1235 av = FILE__LINK;
1236 break;
1237 case MAY_UNLINK:
1238 av = FILE__UNLINK;
1239 break;
1240 case MAY_RMDIR:
1241 av = DIR__RMDIR;
1242 break;
1243 default:
1244 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1245 return 0;
1246 }
1247
1248 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249 return rc;
1250}
1251
1252static inline int may_rename(struct inode *old_dir,
1253 struct dentry *old_dentry,
1254 struct inode *new_dir,
1255 struct dentry *new_dentry)
1256{
1257 struct task_security_struct *tsec;
1258 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259 struct avc_audit_data ad;
1260 u32 av;
1261 int old_is_dir, new_is_dir;
1262 int rc;
1263
1264 tsec = current->security;
1265 old_dsec = old_dir->i_security;
1266 old_isec = old_dentry->d_inode->i_security;
1267 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268 new_dsec = new_dir->i_security;
1269
1270 AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272 ad.u.fs.dentry = old_dentry;
1273 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275 if (rc)
1276 return rc;
1277 rc = avc_has_perm(tsec->sid, old_isec->sid,
1278 old_isec->sclass, FILE__RENAME, &ad);
1279 if (rc)
1280 return rc;
1281 if (old_is_dir && new_dir != old_dir) {
1282 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283 old_isec->sclass, DIR__REPARENT, &ad);
1284 if (rc)
1285 return rc;
1286 }
1287
1288 ad.u.fs.dentry = new_dentry;
1289 av = DIR__ADD_NAME | DIR__SEARCH;
1290 if (new_dentry->d_inode)
1291 av |= DIR__REMOVE_NAME;
1292 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293 if (rc)
1294 return rc;
1295 if (new_dentry->d_inode) {
1296 new_isec = new_dentry->d_inode->i_security;
1297 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 new_isec->sclass,
1300 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301 if (rc)
1302 return rc;
1303 }
1304
1305 return 0;
1306}
1307
1308/* Check whether a task can perform a filesystem operation. */
1309static int superblock_has_perm(struct task_struct *tsk,
1310 struct super_block *sb,
1311 u32 perms,
1312 struct avc_audit_data *ad)
1313{
1314 struct task_security_struct *tsec;
1315 struct superblock_security_struct *sbsec;
1316
1317 tsec = tsk->security;
1318 sbsec = sb->s_security;
1319 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320 perms, ad);
1321}
1322
1323/* Convert a Linux mode and permission mask to an access vector. */
1324static inline u32 file_mask_to_av(int mode, int mask)
1325{
1326 u32 av = 0;
1327
1328 if ((mode & S_IFMT) != S_IFDIR) {
1329 if (mask & MAY_EXEC)
1330 av |= FILE__EXECUTE;
1331 if (mask & MAY_READ)
1332 av |= FILE__READ;
1333
1334 if (mask & MAY_APPEND)
1335 av |= FILE__APPEND;
1336 else if (mask & MAY_WRITE)
1337 av |= FILE__WRITE;
1338
1339 } else {
1340 if (mask & MAY_EXEC)
1341 av |= DIR__SEARCH;
1342 if (mask & MAY_WRITE)
1343 av |= DIR__WRITE;
1344 if (mask & MAY_READ)
1345 av |= DIR__READ;
1346 }
1347
1348 return av;
1349}
1350
1351/* Convert a Linux file to an access vector. */
1352static inline u32 file_to_av(struct file *file)
1353{
1354 u32 av = 0;
1355
1356 if (file->f_mode & FMODE_READ)
1357 av |= FILE__READ;
1358 if (file->f_mode & FMODE_WRITE) {
1359 if (file->f_flags & O_APPEND)
1360 av |= FILE__APPEND;
1361 else
1362 av |= FILE__WRITE;
1363 }
1364
1365 return av;
1366}
1367
1da177e4
LT		 1368/* Hook functions begin here. */
1369
1370static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371{
1372 struct task_security_struct *psec = parent->security;
1373 struct task_security_struct *csec = child->security;
1374 int rc;
1375
1376 rc = secondary_ops->ptrace(parent,child);
1377 if (rc)
1378 return rc;
1379
1380 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381 /* Save the SID of the tracing process for later use in apply_creds. */
341c2d80 1382 if (!(child->ptrace & PT_PTRACED) && !rc)
1da177e4
LT		 1383 csec->ptrace_sid = psec->sid;
1384 return rc;
1385}
1386
1387static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389{
1390 int error;
1391
1392 error = task_has_perm(current, target, PROCESS__GETCAP);
1393 if (error)
1394 return error;
1395
1396 return secondary_ops->capget(target, effective, inheritable, permitted);
1397}
1398
1399static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401{
1402 int error;
1403
1404 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405 if (error)
1406 return error;
1407
1408 return task_has_perm(current, target, PROCESS__SETCAP);
1409}
1410
1411static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413{
1414 secondary_ops->capset_set(target, effective, inheritable, permitted);
1415}
1416
1417static int selinux_capable(struct task_struct *tsk, int cap)
1418{
1419 int rc;
1420
1421 rc = secondary_ops->capable(tsk, cap);
1422 if (rc)
1423 return rc;
1424
1425 return task_has_capability(tsk,cap);
1426}
1427
3fbfa981
EB		 1428static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429{
1430 int buflen, rc;
1431 char *buffer, *path, *end;
1432
1433 rc = -ENOMEM;
1434 buffer = (char*)__get_free_page(GFP_KERNEL);
1435 if (!buffer)
1436 goto out;
1437
1438 buflen = PAGE_SIZE;
1439 end = buffer+buflen;
1440 *--end = '\0';
1441 buflen--;
1442 path = end-1;
1443 *path = '/';
1444 while (table) {
1445 const char *name = table->procname;
1446 size_t namelen = strlen(name);
1447 buflen -= namelen + 1;
1448 if (buflen < 0)
1449 goto out_free;
1450 end -= namelen;
1451 memcpy(end, name, namelen);
1452 *--end = '/';
1453 path = end;
1454 table = table->parent;
1455 }
b599fdfd
EB		 1456 buflen -= 4;
1457 if (buflen < 0)
1458 goto out_free;
1459 end -= 4;
1460 memcpy(end, "/sys", 4);
1461 path = end;
3fbfa981
EB		 1462 rc = security_genfs_sid("proc", path, tclass, sid);
1463out_free:
1464 free_page((unsigned long)buffer);
1465out:
1466 return rc;
1467}
1468
1da177e4
LT		 1469static int selinux_sysctl(ctl_table *table, int op)
1470{
1471 int error = 0;
1472 u32 av;
1473 struct task_security_struct *tsec;
1474 u32 tsid;
1475 int rc;
1476
1477 rc = secondary_ops->sysctl(table, op);
1478 if (rc)
1479 return rc;
1480
1481 tsec = current->security;
1482
3fbfa981
EB		 1483 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1da177e4
LT		 1485 if (rc) {
1486 /* Default to the well-defined sysctl SID. */
1487 tsid = SECINITSID_SYSCTL;
1488 }
1489
1490 /* The op values are "defined" in sysctl.c, thereby creating
1491 * a bad coupling between this module and sysctl.c */
1492 if(op == 001) {
1493 error = avc_has_perm(tsec->sid, tsid,
1494 SECCLASS_DIR, DIR__SEARCH, NULL);
1495 } else {
1496 av = 0;
1497 if (op & 004)
1498 av |= FILE__READ;
1499 if (op & 002)
1500 av |= FILE__WRITE;
1501 if (av)
1502 error = avc_has_perm(tsec->sid, tsid,
1503 SECCLASS_FILE, av, NULL);
1504 }
1505
1506 return error;
1507}
1508
1509static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510{
1511 int rc = 0;
1512
1513 if (!sb)
1514 return 0;
1515
1516 switch (cmds) {
1517 case Q_SYNC:
1518 case Q_QUOTAON:
1519 case Q_QUOTAOFF:
1520 case Q_SETINFO:
1521 case Q_SETQUOTA:
1522 rc = superblock_has_perm(current,
1523 sb,
1524 FILESYSTEM__QUOTAMOD, NULL);
1525 break;
1526 case Q_GETFMT:
1527 case Q_GETINFO:
1528 case Q_GETQUOTA:
1529 rc = superblock_has_perm(current,
1530 sb,
1531 FILESYSTEM__QUOTAGET, NULL);
1532 break;
1533 default:
1534 rc = 0; /* let the kernel handle invalid cmds */
1535 break;
1536 }
1537 return rc;
1538}
1539
1540static int selinux_quota_on(struct dentry *dentry)
1541{
1542 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543}
1544
1545static int selinux_syslog(int type)
1546{
1547 int rc;
1548
1549 rc = secondary_ops->syslog(type);
1550 if (rc)
1551 return rc;
1552
1553 switch (type) {
1554 case 3: /* Read last kernel messages */
1555 case 10: /* Return size of the log buffer */
1556 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557 break;
1558 case 6: /* Disable logging to console */
1559 case 7: /* Enable logging to console */
1560 case 8: /* Set level of messages printed to console */
1561 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562 break;
1563 case 0: /* Close log */
1564 case 1: /* Open log */
1565 case 2: /* Read from log */
1566 case 4: /* Read/clear last kernel messages */
1567 case 5: /* Clear ring buffer */
1568 default:
1569 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570 break;
1571 }
1572 return rc;
1573}
1574
1575/*
1576 * Check that a process has enough memory to allocate a new virtual
1577 * mapping. 0 means there is enough memory for the allocation to
1578 * succeed and -ENOMEM implies there is not.
1579 *
1580 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581 * if the capability is granted, but __vm_enough_memory requires 1 if
1582 * the capability is granted.
1583 *
1584 * Do not audit the selinux permission check, as this is applied to all
1585 * processes that allocate mappings.
1586 */
1587static int selinux_vm_enough_memory(long pages)
1588{
1589 int rc, cap_sys_admin = 0;
1590 struct task_security_struct *tsec = current->security;
1591
1592 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593 if (rc == 0)
1594 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1595 SECCLASS_CAPABILITY,
1596 CAP_TO_MASK(CAP_SYS_ADMIN),
1597 NULL);
1598
1599 if (rc == 0)
1600 cap_sys_admin = 1;
1601
1602 return __vm_enough_memory(pages, cap_sys_admin);
1603}
1604
1605/* binprm security operations */
1606
1607static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1608{
1609 struct bprm_security_struct *bsec;
1610
89d155ef 1611 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1da177e4
LT		 1612 if (!bsec)
1613 return -ENOMEM;
1614
1da177e4
LT		 1615 bsec->bprm = bprm;
1616 bsec->sid = SECINITSID_UNLABELED;
1617 bsec->set = 0;
1618
1619 bprm->security = bsec;
1620 return 0;
1621}
1622
1623static int selinux_bprm_set_security(struct linux_binprm *bprm)
1624{
1625 struct task_security_struct *tsec;
3d5ff529 1626 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1da177e4
LT		 1627 struct inode_security_struct *isec;
1628 struct bprm_security_struct *bsec;
1629 u32 newsid;
1630 struct avc_audit_data ad;
1631 int rc;
1632
1633 rc = secondary_ops->bprm_set_security(bprm);
1634 if (rc)
1635 return rc;
1636
1637 bsec = bprm->security;
1638
1639 if (bsec->set)
1640 return 0;
1641
1642 tsec = current->security;
1643 isec = inode->i_security;
1644
1645 /* Default to the current task SID. */
1646 bsec->sid = tsec->sid;
1647
28eba5bf 1648 /* Reset fs, key, and sock SIDs on execve. */
1da177e4 1649 tsec->create_sid = 0;
28eba5bf 1650 tsec->keycreate_sid = 0;
42c3e03e 1651 tsec->sockcreate_sid = 0;
1da177e4
LT		 1652
1653 if (tsec->exec_sid) {
1654 newsid = tsec->exec_sid;
1655 /* Reset exec SID on execve. */
1656 tsec->exec_sid = 0;
1657 } else {
1658 /* Check for a default transition on this program. */
1659 rc = security_transition_sid(tsec->sid, isec->sid,
1660 SECCLASS_PROCESS, &newsid);
1661 if (rc)
1662 return rc;
1663 }
1664
1665 AVC_AUDIT_DATA_INIT(&ad, FS);
3d5ff529
JS		 1666 ad.u.fs.mnt = bprm->file->f_path.mnt;
1667 ad.u.fs.dentry = bprm->file->f_path.dentry;
1da177e4 1668
3d5ff529 1669 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1da177e4
LT		 1670 newsid = tsec->sid;
1671
1672 if (tsec->sid == newsid) {
1673 rc = avc_has_perm(tsec->sid, isec->sid,
1674 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1675 if (rc)
1676 return rc;
1677 } else {
1678 /* Check permissions for the transition. */
1679 rc = avc_has_perm(tsec->sid, newsid,
1680 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1681 if (rc)
1682 return rc;
1683
1684 rc = avc_has_perm(newsid, isec->sid,
1685 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1686 if (rc)
1687 return rc;
1688
1689 /* Clear any possibly unsafe personality bits on exec: */
1690 current->personality &= ~PER_CLEAR_ON_SETID;
1691
1692 /* Set the security field to the new SID. */
1693 bsec->sid = newsid;
1694 }
1695
1696 bsec->set = 1;
1697 return 0;
1698}
1699
1700static int selinux_bprm_check_security (struct linux_binprm *bprm)
1701{
1702 return secondary_ops->bprm_check_security(bprm);
1703}
1704
1705
1706static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1707{
1708 struct task_security_struct *tsec = current->security;
1709 int atsecure = 0;
1710
1711 if (tsec->osid != tsec->sid) {
1712 /* Enable secure mode for SIDs transitions unless
1713 the noatsecure permission is granted between
1714 the two SIDs, i.e. ahp returns 0. */
1715 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1716 SECCLASS_PROCESS,
1717 PROCESS__NOATSECURE, NULL);
1718 }
1719
1720 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1721}
1722
1723static void selinux_bprm_free_security(struct linux_binprm *bprm)
1724{
9a5f04bf 1725 kfree(bprm->security);
1da177e4 1726 bprm->security = NULL;
1da177e4
LT		 1727}
1728
1729extern struct vfsmount *selinuxfs_mount;
1730extern struct dentry *selinux_null;
1731
1732/* Derived from fs/exec.c:flush_old_files. */
1733static inline void flush_unauthorized_files(struct files_struct * files)
1734{
1735 struct avc_audit_data ad;
1736 struct file *file, *devnull = NULL;
b20c8122 1737 struct tty_struct *tty;
badf1662 1738 struct fdtable *fdt;
1da177e4 1739 long j = -1;
24ec839c 1740 int drop_tty = 0;
1da177e4 1741
b20c8122 1742 mutex_lock(&tty_mutex);
24ec839c 1743 tty = get_current_tty();
1da177e4
LT		 1744 if (tty) {
1745 file_list_lock();
2f512016 1746 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1da177e4
LT		 1747 if (file) {
1748 /* Revalidate access to controlling tty.
1749 Use inode_has_perm on the tty inode directly rather
1750 than using file_has_perm, as this particular open
1751 file may belong to another process and we are only
1752 interested in the inode-based check here. */
3d5ff529 1753 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 1754 if (inode_has_perm(current, inode,
1755 FILE__READ | FILE__WRITE, NULL)) {
24ec839c 1756 drop_tty = 1;
1da177e4
LT		 1757 }
1758 }
1759 file_list_unlock();
1760 }
b20c8122 1761 mutex_unlock(&tty_mutex);
98a27ba4
EB		 1762 /* Reset controlling tty. */
1763 if (drop_tty)
1764 no_tty();
1da177e4
LT		 1765
1766 /* Revalidate access to inherited open files. */
1767
1768 AVC_AUDIT_DATA_INIT(&ad,FS);
1769
1770 spin_lock(&files->file_lock);
1771 for (;;) {
1772 unsigned long set, i;
1773 int fd;
1774
1775 j++;
1776 i = j * __NFDBITS;
badf1662 1777 fdt = files_fdtable(files);
bbea9f69 1778 if (i >= fdt->max_fds)
1da177e4 1779 break;
badf1662 1780 set = fdt->open_fds->fds_bits[j];
1da177e4
LT		 1781 if (!set)
1782 continue;
1783 spin_unlock(&files->file_lock);
1784 for ( ; set ; i++,set >>= 1) {
1785 if (set & 1) {
1786 file = fget(i);
1787 if (!file)
1788 continue;
1789 if (file_has_perm(current,
1790 file,
1791 file_to_av(file))) {
1792 sys_close(i);
1793 fd = get_unused_fd();
1794 if (fd != i) {
1795 if (fd >= 0)
1796 put_unused_fd(fd);
1797 fput(file);
1798 continue;
1799 }
1800 if (devnull) {
095975da 1801 get_file(devnull);
1da177e4
LT		 1802 } else {
1803 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
fc5d81e6
AM		 1804 if (IS_ERR(devnull)) {
1805 devnull = NULL;
1da177e4
LT		 1806 put_unused_fd(fd);
1807 fput(file);
1808 continue;
1809 }
1810 }
1811 fd_install(fd, devnull);
1812 }
1813 fput(file);
1814 }
1815 }
1816 spin_lock(&files->file_lock);
1817
1818 }
1819 spin_unlock(&files->file_lock);
1820}
1821
1822static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1823{
1824 struct task_security_struct *tsec;
1825 struct bprm_security_struct *bsec;
1826 u32 sid;
1827 int rc;
1828
1829 secondary_ops->bprm_apply_creds(bprm, unsafe);
1830
1831 tsec = current->security;
1832
1833 bsec = bprm->security;
1834 sid = bsec->sid;
1835
1836 tsec->osid = tsec->sid;
1837 bsec->unsafe = 0;
1838 if (tsec->sid != sid) {
1839 /* Check for shared state. If not ok, leave SID
1840 unchanged and kill. */
1841 if (unsafe & LSM_UNSAFE_SHARE) {
1842 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1843 PROCESS__SHARE, NULL);
1844 if (rc) {
1845 bsec->unsafe = 1;
1846 return;
1847 }
1848 }
1849
1850 /* Check for ptracing, and update the task SID if ok.
1851 Otherwise, leave SID unchanged and kill. */
1852 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1853 rc = avc_has_perm(tsec->ptrace_sid, sid,
1854 SECCLASS_PROCESS, PROCESS__PTRACE,
1855 NULL);
1856 if (rc) {
1857 bsec->unsafe = 1;
1858 return;
1859 }
1860 }
1861 tsec->sid = sid;
1862 }
1863}
1864
1865/*
1866 * called after apply_creds without the task lock held
1867 */
1868static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1869{
1870 struct task_security_struct *tsec;
1871 struct rlimit *rlim, *initrlim;
1872 struct itimerval itimer;
1873 struct bprm_security_struct *bsec;
1874 int rc, i;
1875
1876 tsec = current->security;
1877 bsec = bprm->security;
1878
1879 if (bsec->unsafe) {
1880 force_sig_specific(SIGKILL, current);
1881 return;
1882 }
1883 if (tsec->osid == tsec->sid)
1884 return;
1885
1886 /* Close files for which the new task SID is not authorized. */
1887 flush_unauthorized_files(current->files);
1888
1889 /* Check whether the new SID can inherit signal state
1890 from the old SID. If not, clear itimers to avoid
1891 subsequent signal generation and flush and unblock
1892 signals. This must occur _after_ the task SID has
1893 been updated so that any kill done after the flush
1894 will be checked against the new SID. */
1895 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1896 PROCESS__SIGINH, NULL);
1897 if (rc) {
1898 memset(&itimer, 0, sizeof itimer);
1899 for (i = 0; i < 3; i++)
1900 do_setitimer(i, &itimer, NULL);
1901 flush_signals(current);
1902 spin_lock_irq(&current->sighand->siglock);
1903 flush_signal_handlers(current, 1);
1904 sigemptyset(&current->blocked);
1905 recalc_sigpending();
1906 spin_unlock_irq(&current->sighand->siglock);
1907 }
1908
1909 /* Check whether the new SID can inherit resource limits
1910 from the old SID. If not, reset all soft limits to
1911 the lower of the current task's hard limit and the init
1912 task's soft limit. Note that the setting of hard limits
1913 (even to lower them) can be controlled by the setrlimit
1914 check. The inclusion of the init task's soft limit into
1915 the computation is to avoid resetting soft limits higher
1916 than the default soft limit for cases where the default
1917 is lower than the hard limit, e.g. RLIMIT_CORE or
1918 RLIMIT_STACK.*/
1919 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1920 PROCESS__RLIMITINH, NULL);
1921 if (rc) {
1922 for (i = 0; i < RLIM_NLIMITS; i++) {
1923 rlim = current->signal->rlim + i;
1924 initrlim = init_task.signal->rlim+i;
1925 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1926 }
1927 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1928 /*
1929 * This will cause RLIMIT_CPU calculations
1930 * to be refigured.
1931 */
1932 current->it_prof_expires = jiffies_to_cputime(1);
1933 }
1934 }
1935
1936 /* Wake up the parent if it is waiting so that it can
1937 recheck wait permission to the new task SID. */
1938 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1939}
1940
1941/* superblock security operations */
1942
1943static int selinux_sb_alloc_security(struct super_block *sb)
1944{
1945 return superblock_alloc_security(sb);
1946}
1947
1948static void selinux_sb_free_security(struct super_block *sb)
1949{
1950 superblock_free_security(sb);
1951}
1952
1953static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1954{
1955 if (plen > olen)
1956 return 0;
1957
1958 return !memcmp(prefix, option, plen);
1959}
1960
1961static inline int selinux_option(char *option, int len)
1962{
1963 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1964 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
0808925e
EP		 1965 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1966 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1da177e4
LT		 1967}
1968
1969static inline void take_option(char **to, char *from, int *first, int len)
1970{
1971 if (!*first) {
1972 **to = ',';
1973 *to += 1;
3528a953 1974 } else
1da177e4
LT		 1975 *first = 0;
1976 memcpy(*to, from, len);
1977 *to += len;
1978}
1979
3528a953
CO		 1980static inline void take_selinux_option(char **to, char *from, int *first,
1981 int len)
1982{
1983 int current_size = 0;
1984
1985 if (!*first) {
1986 **to = '|';
1987 *to += 1;
1988 }
1989 else
1990 *first = 0;
1991
1992 while (current_size < len) {
1993 if (*from != '"') {
1994 **to = *from;
1995 *to += 1;
1996 }
1997 from += 1;
1998 current_size += 1;
1999 }
2000}
2001
1da177e4
LT		 2002static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2003{
2004 int fnosec, fsec, rc = 0;
2005 char *in_save, *in_curr, *in_end;
2006 char *sec_curr, *nosec_save, *nosec;
3528a953 2007 int open_quote = 0;
1da177e4
LT		 2008
2009 in_curr = orig;
2010 sec_curr = copy;
2011
2012 /* Binary mount data: just copy */
2013 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2014 copy_page(sec_curr, in_curr);
2015 goto out;
2016 }
2017
2018 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2019 if (!nosec) {
2020 rc = -ENOMEM;
2021 goto out;
2022 }
2023
2024 nosec_save = nosec;
2025 fnosec = fsec = 1;
2026 in_save = in_end = orig;
2027
2028 do {
3528a953
CO		 2029 if (*in_end == '"')
2030 open_quote = !open_quote;
2031 if ((*in_end == ',' && open_quote == 0) ||
2032 *in_end == '\0') {
1da177e4
LT		 2033 int len = in_end - in_curr;
2034
2035 if (selinux_option(in_curr, len))
3528a953 2036 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT		 2037 else
2038 take_option(&nosec, in_curr, &fnosec, len);
2039
2040 in_curr = in_end + 1;
2041 }
2042 } while (*in_end++);
2043
6931dfc9 2044 strcpy(in_save, nosec_save);
da3caa20 2045 free_page((unsigned long)nosec_save);
1da177e4
LT		 2046out:
2047 return rc;
2048}
2049
2050static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2051{
2052 struct avc_audit_data ad;
2053 int rc;
2054
2055 rc = superblock_doinit(sb, data);
2056 if (rc)
2057 return rc;
2058
2059 AVC_AUDIT_DATA_INIT(&ad,FS);
2060 ad.u.fs.dentry = sb->s_root;
2061 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2062}
2063
726c3342 2064static int selinux_sb_statfs(struct dentry *dentry)
1da177e4
LT		 2065{
2066 struct avc_audit_data ad;
2067
2068 AVC_AUDIT_DATA_INIT(&ad,FS);
726c3342
DH		 2069 ad.u.fs.dentry = dentry->d_sb->s_root;
2070 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT		 2071}
2072
2073static int selinux_mount(char * dev_name,
2074 struct nameidata *nd,
2075 char * type,
2076 unsigned long flags,
2077 void * data)
2078{
2079 int rc;
2080
2081 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2082 if (rc)
2083 return rc;
2084
2085 if (flags & MS_REMOUNT)
2086 return superblock_has_perm(current, nd->mnt->mnt_sb,
2087 FILESYSTEM__REMOUNT, NULL);
2088 else
2089 return dentry_has_perm(current, nd->mnt, nd->dentry,
2090 FILE__MOUNTON);
2091}
2092
2093static int selinux_umount(struct vfsmount *mnt, int flags)
2094{
2095 int rc;
2096
2097 rc = secondary_ops->sb_umount(mnt, flags);
2098 if (rc)
2099 return rc;
2100
2101 return superblock_has_perm(current,mnt->mnt_sb,
2102 FILESYSTEM__UNMOUNT,NULL);
2103}
2104
2105/* inode security operations */
2106
2107static int selinux_inode_alloc_security(struct inode *inode)
2108{
2109 return inode_alloc_security(inode);
2110}
2111
2112static void selinux_inode_free_security(struct inode *inode)
2113{
2114 inode_free_security(inode);
2115}
2116
5e41ff9e
SS		 2117static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2118 char **name, void **value,
2119 size_t *len)
2120{
2121 struct task_security_struct *tsec;
2122 struct inode_security_struct *dsec;
2123 struct superblock_security_struct *sbsec;
570bc1c2 2124 u32 newsid, clen;
5e41ff9e 2125 int rc;
570bc1c2 2126 char *namep = NULL, *context;
5e41ff9e
SS		 2127
2128 tsec = current->security;
2129 dsec = dir->i_security;
2130 sbsec = dir->i_sb->s_security;
5e41ff9e
SS		 2131
2132 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2133 newsid = tsec->create_sid;
2134 } else {
2135 rc = security_transition_sid(tsec->sid, dsec->sid,
2136 inode_mode_to_security_class(inode->i_mode),
2137 &newsid);
2138 if (rc) {
2139 printk(KERN_WARNING "%s: "
2140 "security_transition_sid failed, rc=%d (dev=%s "
2141 "ino=%ld)\n",
2142 __FUNCTION__,
2143 -rc, inode->i_sb->s_id, inode->i_ino);
2144 return rc;
2145 }
2146 }
2147
296fddf7
EP		 2148 /* Possibly defer initialization to selinux_complete_init. */
2149 if (sbsec->initialized) {
2150 struct inode_security_struct *isec = inode->i_security;
2151 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2152 isec->sid = newsid;
2153 isec->initialized = 1;
2154 }
5e41ff9e 2155
8aad3875 2156 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
25a74f3b
SS		 2157 return -EOPNOTSUPP;
2158
570bc1c2
SS		 2159 if (name) {
2160 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2161 if (!namep)
2162 return -ENOMEM;
2163 *name = namep;
2164 }
5e41ff9e 2165
570bc1c2
SS		 2166 if (value && len) {
2167 rc = security_sid_to_context(newsid, &context, &clen);
2168 if (rc) {
2169 kfree(namep);
2170 return rc;
2171 }
2172 *value = context;
2173 *len = clen;
5e41ff9e 2174 }
5e41ff9e 2175
5e41ff9e
SS		 2176 return 0;
2177}
2178
1da177e4
LT		 2179static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2180{
2181 return may_create(dir, dentry, SECCLASS_FILE);
2182}
2183
1da177e4
LT		 2184static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2185{
2186 int rc;
2187
2188 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2189 if (rc)
2190 return rc;
2191 return may_link(dir, old_dentry, MAY_LINK);
2192}
2193
1da177e4
LT		 2194static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2195{
2196 int rc;
2197
2198 rc = secondary_ops->inode_unlink(dir, dentry);
2199 if (rc)
2200 return rc;
2201 return may_link(dir, dentry, MAY_UNLINK);
2202}
2203
2204static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2205{
2206 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2207}
2208
1da177e4
LT		 2209static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2210{
2211 return may_create(dir, dentry, SECCLASS_DIR);
2212}
2213
1da177e4
LT		 2214static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2215{
2216 return may_link(dir, dentry, MAY_RMDIR);
2217}
2218
2219static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2220{
2221 int rc;
2222
2223 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2224 if (rc)
2225 return rc;
2226
2227 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2228}
2229
1da177e4
LT		 2230static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2231 struct inode *new_inode, struct dentry *new_dentry)
2232{
2233 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2234}
2235
1da177e4
LT		 2236static int selinux_inode_readlink(struct dentry *dentry)
2237{
2238 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2239}
2240
2241static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2242{
2243 int rc;
2244
2245 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2246 if (rc)
2247 return rc;
2248 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2249}
2250
2251static int selinux_inode_permission(struct inode *inode, int mask,
2252 struct nameidata *nd)
2253{
2254 int rc;
2255
2256 rc = secondary_ops->inode_permission(inode, mask, nd);
2257 if (rc)
2258 return rc;
2259
2260 if (!mask) {
2261 /* No permission to check. Existence test. */
2262 return 0;
2263 }
2264
2265 return inode_has_perm(current, inode,
2266 file_mask_to_av(inode->i_mode, mask), NULL);
2267}
2268
2269static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2270{
2271 int rc;
2272
2273 rc = secondary_ops->inode_setattr(dentry, iattr);
2274 if (rc)
2275 return rc;
2276
2277 if (iattr->ia_valid & ATTR_FORCE)
2278 return 0;
2279
2280 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2281 ATTR_ATIME_SET | ATTR_MTIME_SET))
2282 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2283
2284 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2285}
2286
2287static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2288{
2289 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2290}
2291
2292static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2293{
2294 struct task_security_struct *tsec = current->security;
2295 struct inode *inode = dentry->d_inode;
2296 struct inode_security_struct *isec = inode->i_security;
2297 struct superblock_security_struct *sbsec;
2298 struct avc_audit_data ad;
2299 u32 newsid;
2300 int rc = 0;
2301
2302 if (strcmp(name, XATTR_NAME_SELINUX)) {
2303 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2304 sizeof XATTR_SECURITY_PREFIX - 1) &&
2305 !capable(CAP_SYS_ADMIN)) {
2306 /* A different attribute in the security namespace.
2307 Restrict to administrator. */
2308 return -EPERM;
2309 }
2310
2311 /* Not an attribute we recognize, so just check the
2312 ordinary setattr permission. */
2313 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2314 }
2315
2316 sbsec = inode->i_sb->s_security;
2317 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2318 return -EOPNOTSUPP;
2319
2320 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2321 return -EPERM;
2322
2323 AVC_AUDIT_DATA_INIT(&ad,FS);
2324 ad.u.fs.dentry = dentry;
2325
2326 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2327 FILE__RELABELFROM, &ad);
2328 if (rc)
2329 return rc;
2330
2331 rc = security_context_to_sid(value, size, &newsid);
2332 if (rc)
2333 return rc;
2334
2335 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2336 FILE__RELABELTO, &ad);
2337 if (rc)
2338 return rc;
2339
2340 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2341 isec->sclass);
2342 if (rc)
2343 return rc;
2344
2345 return avc_has_perm(newsid,
2346 sbsec->sid,
2347 SECCLASS_FILESYSTEM,
2348 FILESYSTEM__ASSOCIATE,
2349 &ad);
2350}
2351
2352static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2353 void *value, size_t size, int flags)
2354{
2355 struct inode *inode = dentry->d_inode;
2356 struct inode_security_struct *isec = inode->i_security;
2357 u32 newsid;
2358 int rc;
2359
2360 if (strcmp(name, XATTR_NAME_SELINUX)) {
2361 /* Not an attribute we recognize, so nothing to do. */
2362 return;
2363 }
2364
2365 rc = security_context_to_sid(value, size, &newsid);
2366 if (rc) {
2367 printk(KERN_WARNING "%s: unable to obtain SID for context "
2368 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2369 return;
2370 }
2371
2372 isec->sid = newsid;
2373 return;
2374}
2375
2376static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2377{
1da177e4
LT		 2378 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2379}
2380
2381static int selinux_inode_listxattr (struct dentry *dentry)
2382{
2383 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2384}
2385
2386static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2387{
2388 if (strcmp(name, XATTR_NAME_SELINUX)) {
2389 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2390 sizeof XATTR_SECURITY_PREFIX - 1) &&
2391 !capable(CAP_SYS_ADMIN)) {
2392 /* A different attribute in the security namespace.
2393 Restrict to administrator. */
2394 return -EPERM;
2395 }
2396
2397 /* Not an attribute we recognize, so just check the
2398 ordinary setattr permission. Might want a separate
2399 permission for removexattr. */
2400 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2401 }
2402
2403 /* No one is allowed to remove a SELinux security label.
2404 You can change the label, but all data must be labeled. */
2405 return -EACCES;
2406}
2407
8c8570fb
DK		 2408static const char *selinux_inode_xattr_getsuffix(void)
2409{
2410 return XATTR_SELINUX_SUFFIX;
2411}
2412
d381d8a9
JM		 2413/*
2414 * Copy the in-core inode security context value to the user. If the
2415 * getxattr() prior to this succeeded, check to see if we need to
2416 * canonicalize the value to be finally returned to the user.
2417 *
2418 * Permission check is handled by selinux_inode_getxattr hook.
2419 */
7306a0b9 2420static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
1da177e4
LT		 2421{
2422 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2423
8c8570fb
DK		 2424 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2425 return -EOPNOTSUPP;
d381d8a9 2426
8c8570fb 2427 return selinux_getsecurity(isec->sid, buffer, size);
1da177e4
LT		 2428}
2429
2430static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2431 const void *value, size_t size, int flags)
2432{
2433 struct inode_security_struct *isec = inode->i_security;
2434 u32 newsid;
2435 int rc;
2436
2437 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2438 return -EOPNOTSUPP;
2439
2440 if (!value || !size)
2441 return -EACCES;
2442
2443 rc = security_context_to_sid((void*)value, size, &newsid);
2444 if (rc)
2445 return rc;
2446
2447 isec->sid = newsid;
2448 return 0;
2449}
2450
2451static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2452{
2453 const int len = sizeof(XATTR_NAME_SELINUX);
2454 if (buffer && len <= buffer_size)
2455 memcpy(buffer, XATTR_NAME_SELINUX, len);
2456 return len;
2457}
2458
2459/* file security operations */
2460
2461static int selinux_file_permission(struct file *file, int mask)
2462{
7420ed23 2463 int rc;
3d5ff529 2464 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 2465
2466 if (!mask) {
2467 /* No permission to check. Existence test. */
2468 return 0;
2469 }
2470
2471 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2472 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2473 mask |= MAY_APPEND;
2474
7420ed23
VY		 2475 rc = file_has_perm(current, file,
2476 file_mask_to_av(inode->i_mode, mask));
2477 if (rc)
2478 return rc;
2479
2480 return selinux_netlbl_inode_permission(inode, mask);
1da177e4
LT		 2481}
2482
2483static int selinux_file_alloc_security(struct file *file)
2484{
2485 return file_alloc_security(file);
2486}
2487
2488static void selinux_file_free_security(struct file *file)
2489{
2490 file_free_security(file);
2491}
2492
2493static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2494 unsigned long arg)
2495{
2496 int error = 0;
2497
2498 switch (cmd) {
2499 case FIONREAD:
2500 /* fall through */
2501 case FIBMAP:
2502 /* fall through */
2503 case FIGETBSZ:
2504 /* fall through */
2505 case EXT2_IOC_GETFLAGS:
2506 /* fall through */
2507 case EXT2_IOC_GETVERSION:
2508 error = file_has_perm(current, file, FILE__GETATTR);
2509 break;
2510
2511 case EXT2_IOC_SETFLAGS:
2512 /* fall through */
2513 case EXT2_IOC_SETVERSION:
2514 error = file_has_perm(current, file, FILE__SETATTR);
2515 break;
2516
2517 /* sys_ioctl() checks */
2518 case FIONBIO:
2519 /* fall through */
2520 case FIOASYNC:
2521 error = file_has_perm(current, file, 0);
2522 break;
2523
2524 case KDSKBENT:
2525 case KDSKBSENT:
2526 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2527 break;
2528
2529 /* default case assumes that the command will go
2530 * to the file's ioctl() function.
2531 */
2532 default:
2533 error = file_has_perm(current, file, FILE__IOCTL);
2534
2535 }
2536 return error;
2537}
2538
2539static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2540{
2541#ifndef CONFIG_PPC32
2542 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2543 /*
2544 * We are making executable an anonymous mapping or a
2545 * private file mapping that will also be writable.
2546 * This has an additional check.
2547 */
2548 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2549 if (rc)
2550 return rc;
2551 }
2552#endif
2553
2554 if (file) {
2555 /* read access is always possible with a mapping */
2556 u32 av = FILE__READ;
2557
2558 /* write access only matters if the mapping is shared */
2559 if (shared && (prot & PROT_WRITE))
2560 av |= FILE__WRITE;
2561
2562 if (prot & PROT_EXEC)
2563 av |= FILE__EXECUTE;
2564
2565 return file_has_perm(current, file, av);
2566 }
2567 return 0;
2568}
2569
2570static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2571 unsigned long prot, unsigned long flags)
2572{
2573 int rc;
2574
2575 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2576 if (rc)
2577 return rc;
2578
2579 if (selinux_checkreqprot)
2580 prot = reqprot;
2581
2582 return file_map_prot_check(file, prot,
2583 (flags & MAP_TYPE) == MAP_SHARED);
2584}
2585
2586static int selinux_file_mprotect(struct vm_area_struct *vma,
2587 unsigned long reqprot,
2588 unsigned long prot)
2589{
2590 int rc;
2591
2592 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2593 if (rc)
2594 return rc;
2595
2596 if (selinux_checkreqprot)
2597 prot = reqprot;
2598
2599#ifndef CONFIG_PPC32
db4c9641
SS		 2600 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2601 rc = 0;
2602 if (vma->vm_start >= vma->vm_mm->start_brk &&
2603 vma->vm_end <= vma->vm_mm->brk) {
2604 rc = task_has_perm(current, current,
2605 PROCESS__EXECHEAP);
2606 } else if (!vma->vm_file &&
2607 vma->vm_start <= vma->vm_mm->start_stack &&
2608 vma->vm_end >= vma->vm_mm->start_stack) {
2609 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2610 } else if (vma->vm_file && vma->anon_vma) {
2611 /*
2612 * We are making executable a file mapping that has
2613 * had some COW done. Since pages might have been
2614 * written, check ability to execute the possibly
2615 * modified content. This typically should only
2616 * occur for text relocations.
2617 */
2618 rc = file_has_perm(current, vma->vm_file,
2619 FILE__EXECMOD);
2620 }