projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched
[deliverable/linux.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
33 #include <linux/mm.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
45 #include <linux/kd.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
49 #include <net/icmp.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/dccp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
66 #include <net/ipv6.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
72 #include <linux/selinux.h>
73 #include <linux/mutex.h>
74
75 #include "avc.h"
76 #include "objsec.h"
77 #include "netif.h"
78 #include "xfrm.h"
79 #include "netlabel.h"
80
81 #define XATTR_SELINUX_SUFFIX "selinux"
82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
83
84 extern unsigned int policydb_loaded_version;
85 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
86 extern int selinux_compat_net;
87
88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89 int selinux_enforcing = 0;
90
91 static int __init enforcing_setup(char *str)
92 {
93 selinux_enforcing = simple_strtol(str,NULL,0);
94 return 1;
95 }
96 __setup("enforcing=", enforcing_setup);
97 #endif
98
99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
101
102 static int __init selinux_enabled_setup(char *str)
103 {
104 selinux_enabled = simple_strtol(str, NULL, 0);
105 return 1;
106 }
107 __setup("selinux=", selinux_enabled_setup);
108 #else
109 int selinux_enabled = 1;
110 #endif
111
112 /* Original (dummy) security module. */
113 static struct security_operations *original_ops = NULL;
114
115 /* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119 static struct security_operations *secondary_ops = NULL;
120
121 /* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123 static LIST_HEAD(superblock_security_head);
124 static DEFINE_SPINLOCK(sb_security_lock);
125
126 static struct kmem_cache *sel_inode_cache;
127
128 /* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
131 {
132 char *context;
133 unsigned len;
134 int rc;
135
136 rc = security_sid_to_context(sid, &context, &len);
137 if (rc)
138 return rc;
139
140 if (!buffer || !size)
141 goto getsecurity_exit;
142
143 if (size < len) {
144 len = -ERANGE;
145 goto getsecurity_exit;
146 }
147 memcpy(buffer, context, len);
148
149 getsecurity_exit:
150 kfree(context);
151 return len;
152 }
153
154 /* Allocate and free functions for each kind of security blob. */
155
156 static int task_alloc_security(struct task_struct *task)
157 {
158 struct task_security_struct *tsec;
159
160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
161 if (!tsec)
162 return -ENOMEM;
163
164 tsec->task = task;
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
167
168 return 0;
169 }
170
171 static void task_free_security(struct task_struct *task)
172 {
173 struct task_security_struct *tsec = task->security;
174 task->security = NULL;
175 kfree(tsec);
176 }
177
178 static int inode_alloc_security(struct inode *inode)
179 {
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
182
183 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
184 if (!isec)
185 return -ENOMEM;
186
187 mutex_init(&isec->lock);
188 INIT_LIST_HEAD(&isec->list);
189 isec->inode = inode;
190 isec->sid = SECINITSID_UNLABELED;
191 isec->sclass = SECCLASS_FILE;
192 isec->task_sid = tsec->sid;
193 inode->i_security = isec;
194
195 return 0;
196 }
197
198 static void inode_free_security(struct inode *inode)
199 {
200 struct inode_security_struct *isec = inode->i_security;
201 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202
203 spin_lock(&sbsec->isec_lock);
204 if (!list_empty(&isec->list))
205 list_del_init(&isec->list);
206 spin_unlock(&sbsec->isec_lock);
207
208 inode->i_security = NULL;
209 kmem_cache_free(sel_inode_cache, isec);
210 }
211
212 static int file_alloc_security(struct file *file)
213 {
214 struct task_security_struct *tsec = current->security;
215 struct file_security_struct *fsec;
216
217 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
218 if (!fsec)
219 return -ENOMEM;
220
221 fsec->file = file;
222 fsec->sid = tsec->sid;
223 fsec->fown_sid = tsec->sid;
224 file->f_security = fsec;
225
226 return 0;
227 }
228
229 static void file_free_security(struct file *file)
230 {
231 struct file_security_struct *fsec = file->f_security;
232 file->f_security = NULL;
233 kfree(fsec);
234 }
235
236 static int superblock_alloc_security(struct super_block *sb)
237 {
238 struct superblock_security_struct *sbsec;
239
240 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 if (!sbsec)
242 return -ENOMEM;
243
244 mutex_init(&sbsec->lock);
245 INIT_LIST_HEAD(&sbsec->list);
246 INIT_LIST_HEAD(&sbsec->isec_head);
247 spin_lock_init(&sbsec->isec_lock);
248 sbsec->sb = sb;
249 sbsec->sid = SECINITSID_UNLABELED;
250 sbsec->def_sid = SECINITSID_FILE;
251 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
252 sb->s_security = sbsec;
253
254 return 0;
255 }
256
257 static void superblock_free_security(struct super_block *sb)
258 {
259 struct superblock_security_struct *sbsec = sb->s_security;
260
261 spin_lock(&sb_security_lock);
262 if (!list_empty(&sbsec->list))
263 list_del_init(&sbsec->list);
264 spin_unlock(&sb_security_lock);
265
266 sb->s_security = NULL;
267 kfree(sbsec);
268 }
269
270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
271 {
272 struct sk_security_struct *ssec;
273
274 ssec = kzalloc(sizeof(*ssec), priority);
275 if (!ssec)
276 return -ENOMEM;
277
278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 ssec->sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
282
283 selinux_netlbl_sk_security_init(ssec, family);
284
285 return 0;
286 }
287
288 static void sk_free_security(struct sock *sk)
289 {
290 struct sk_security_struct *ssec = sk->sk_security;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294 }
295
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
299
300 /* The file system's label must be initialized prior to use. */
301
302 static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309 };
310
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313 static inline int inode_doinit(struct inode *inode)
314 {
315 return inode_doinit_with_dentry(inode, NULL);
316 }
317
318 enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
322 Opt_rootcontext = 8,
323 };
324
325 static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
329 {Opt_rootcontext, "rootcontext=%s"},
330 };
331
332 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333
334 static int may_context_mount_sb_relabel(u32 sid,
335 struct superblock_security_struct *sbsec,
336 struct task_security_struct *tsec)
337 {
338 int rc;
339
340 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
341 FILESYSTEM__RELABELFROM, NULL);
342 if (rc)
343 return rc;
344
345 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
346 FILESYSTEM__RELABELTO, NULL);
347 return rc;
348 }
349
350 static int may_context_mount_inode_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
352 struct task_security_struct *tsec)
353 {
354 int rc;
355 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
356 FILESYSTEM__RELABELFROM, NULL);
357 if (rc)
358 return rc;
359
360 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
361 FILESYSTEM__ASSOCIATE, NULL);
362 return rc;
363 }
364
365 static int try_context_mount(struct super_block *sb, void *data)
366 {
367 char *context = NULL, *defcontext = NULL;
368 char *fscontext = NULL, *rootcontext = NULL;
369 const char *name;
370 u32 sid;
371 int alloc = 0, rc = 0, seen = 0;
372 struct task_security_struct *tsec = current->security;
373 struct superblock_security_struct *sbsec = sb->s_security;
374
375 if (!data)
376 goto out;
377
378 name = sb->s_type->name;
379
380 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
381
382 /* NFS we understand. */
383 if (!strcmp(name, "nfs")) {
384 struct nfs_mount_data *d = data;
385
386 if (d->version < NFS_MOUNT_VERSION)
387 goto out;
388
389 if (d->context[0]) {
390 context = d->context;
391 seen |= Opt_context;
392 }
393 } else
394 goto out;
395
396 } else {
397 /* Standard string-based options. */
398 char *p, *options = data;
399
400 while ((p = strsep(&options, "|")) != NULL) {
401 int token;
402 substring_t args[MAX_OPT_ARGS];
403
404 if (!*p)
405 continue;
406
407 token = match_token(p, tokens, args);
408
409 switch (token) {
410 case Opt_context:
411 if (seen & (Opt_context|Opt_defcontext)) {
412 rc = -EINVAL;
413 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
414 goto out_free;
415 }
416 context = match_strdup(&args[0]);
417 if (!context) {
418 rc = -ENOMEM;
419 goto out_free;
420 }
421 if (!alloc)
422 alloc = 1;
423 seen |= Opt_context;
424 break;
425
426 case Opt_fscontext:
427 if (seen & Opt_fscontext) {
428 rc = -EINVAL;
429 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
430 goto out_free;
431 }
432 fscontext = match_strdup(&args[0]);
433 if (!fscontext) {
434 rc = -ENOMEM;
435 goto out_free;
436 }
437 if (!alloc)
438 alloc = 1;
439 seen |= Opt_fscontext;
440 break;
441
442 case Opt_rootcontext:
443 if (seen & Opt_rootcontext) {
444 rc = -EINVAL;
445 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
446 goto out_free;
447 }
448 rootcontext = match_strdup(&args[0]);
449 if (!rootcontext) {
450 rc = -ENOMEM;
451 goto out_free;
452 }
453 if (!alloc)
454 alloc = 1;
455 seen |= Opt_rootcontext;
456 break;
457
458 case Opt_defcontext:
459 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
460 rc = -EINVAL;
461 printk(KERN_WARNING "SELinux: "
462 "defcontext option is invalid "
463 "for this filesystem type\n");
464 goto out_free;
465 }
466 if (seen & (Opt_context|Opt_defcontext)) {
467 rc = -EINVAL;
468 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
469 goto out_free;
470 }
471 defcontext = match_strdup(&args[0]);
472 if (!defcontext) {
473 rc = -ENOMEM;
474 goto out_free;
475 }
476 if (!alloc)
477 alloc = 1;
478 seen |= Opt_defcontext;
479 break;
480
481 default:
482 rc = -EINVAL;
483 printk(KERN_WARNING "SELinux: unknown mount "
484 "option\n");
485 goto out_free;
486
487 }
488 }
489 }
490
491 if (!seen)
492 goto out;
493
494 /* sets the context of the superblock for the fs being mounted. */
495 if (fscontext) {
496 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
497 if (rc) {
498 printk(KERN_WARNING "SELinux: security_context_to_sid"
499 "(%s) failed for (dev %s, type %s) errno=%d\n",
500 fscontext, sb->s_id, name, rc);
501 goto out_free;
502 }
503
504 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
505 if (rc)
506 goto out_free;
507
508 sbsec->sid = sid;
509 }
510
511 /*
512 * Switch to using mount point labeling behavior.
513 * sets the label used on all file below the mountpoint, and will set
514 * the superblock context if not already set.
515 */
516 if (context) {
517 rc = security_context_to_sid(context, strlen(context), &sid);
518 if (rc) {
519 printk(KERN_WARNING "SELinux: security_context_to_sid"
520 "(%s) failed for (dev %s, type %s) errno=%d\n",
521 context, sb->s_id, name, rc);
522 goto out_free;
523 }
524
525 if (!fscontext) {
526 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
527 if (rc)
528 goto out_free;
529 sbsec->sid = sid;
530 } else {
531 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
532 if (rc)
533 goto out_free;
534 }
535 sbsec->mntpoint_sid = sid;
536
537 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
538 }
539
540 if (rootcontext) {
541 struct inode *inode = sb->s_root->d_inode;
542 struct inode_security_struct *isec = inode->i_security;
543 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
544 if (rc) {
545 printk(KERN_WARNING "SELinux: security_context_to_sid"
546 "(%s) failed for (dev %s, type %s) errno=%d\n",
547 rootcontext, sb->s_id, name, rc);
548 goto out_free;
549 }
550
551 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
552 if (rc)
553 goto out_free;
554
555 isec->sid = sid;
556 isec->initialized = 1;
557 }
558
559 if (defcontext) {
560 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
561 if (rc) {
562 printk(KERN_WARNING "SELinux: security_context_to_sid"
563 "(%s) failed for (dev %s, type %s) errno=%d\n",
564 defcontext, sb->s_id, name, rc);
565 goto out_free;
566 }
567
568 if (sid == sbsec->def_sid)
569 goto out_free;
570
571 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
572 if (rc)
573 goto out_free;
574
575 sbsec->def_sid = sid;
576 }
577
578 out_free:
579 if (alloc) {
580 kfree(context);
581 kfree(defcontext);
582 kfree(fscontext);
583 kfree(rootcontext);
584 }
585 out:
586 return rc;
587 }
588
589 static int superblock_doinit(struct super_block *sb, void *data)
590 {
591 struct superblock_security_struct *sbsec = sb->s_security;
592 struct dentry *root = sb->s_root;
593 struct inode *inode = root->d_inode;
594 int rc = 0;
595
596 mutex_lock(&sbsec->lock);
597 if (sbsec->initialized)
598 goto out;
599
600 if (!ss_initialized) {
601 /* Defer initialization until selinux_complete_init,
602 after the initial policy is loaded and the security
603 server is ready to handle calls. */
604 spin_lock(&sb_security_lock);
605 if (list_empty(&sbsec->list))
606 list_add(&sbsec->list, &superblock_security_head);
607 spin_unlock(&sb_security_lock);
608 goto out;
609 }
610
611 /* Determine the labeling behavior to use for this filesystem type. */
612 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
613 if (rc) {
614 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
615 __FUNCTION__, sb->s_type->name, rc);
616 goto out;
617 }
618
619 rc = try_context_mount(sb, data);
620 if (rc)
621 goto out;
622
623 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
624 /* Make sure that the xattr handler exists and that no
625 error other than -ENODATA is returned by getxattr on
626 the root directory. -ENODATA is ok, as this may be
627 the first boot of the SELinux kernel before we have
628 assigned xattr values to the filesystem. */
629 if (!inode->i_op->getxattr) {
630 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
631 "xattr support\n", sb->s_id, sb->s_type->name);
632 rc = -EOPNOTSUPP;
633 goto out;
634 }
635 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
636 if (rc < 0 && rc != -ENODATA) {
637 if (rc == -EOPNOTSUPP)
638 printk(KERN_WARNING "SELinux: (dev %s, type "
639 "%s) has no security xattr handler\n",
640 sb->s_id, sb->s_type->name);
641 else
642 printk(KERN_WARNING "SELinux: (dev %s, type "
643 "%s) getxattr errno %d\n", sb->s_id,
644 sb->s_type->name, -rc);
645 goto out;
646 }
647 }
648
649 if (strcmp(sb->s_type->name, "proc") == 0)
650 sbsec->proc = 1;
651
652 sbsec->initialized = 1;
653
654 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
655 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
656 sb->s_id, sb->s_type->name);
657 }
658 else {
659 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
660 sb->s_id, sb->s_type->name,
661 labeling_behaviors[sbsec->behavior-1]);
662 }
663
664 /* Initialize the root inode. */
665 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
666
667 /* Initialize any other inodes associated with the superblock, e.g.
668 inodes created prior to initial policy load or inodes created
669 during get_sb by a pseudo filesystem that directly
670 populates itself. */
671 spin_lock(&sbsec->isec_lock);
672 next_inode:
673 if (!list_empty(&sbsec->isec_head)) {
674 struct inode_security_struct *isec =
675 list_entry(sbsec->isec_head.next,
676 struct inode_security_struct, list);
677 struct inode *inode = isec->inode;
678 spin_unlock(&sbsec->isec_lock);
679 inode = igrab(inode);
680 if (inode) {
681 if (!IS_PRIVATE (inode))
682 inode_doinit(inode);
683 iput(inode);
684 }
685 spin_lock(&sbsec->isec_lock);
686 list_del_init(&isec->list);
687 goto next_inode;
688 }
689 spin_unlock(&sbsec->isec_lock);
690 out:
691 mutex_unlock(&sbsec->lock);
692 return rc;
693 }
694
695 static inline u16 inode_mode_to_security_class(umode_t mode)
696 {
697 switch (mode & S_IFMT) {
698 case S_IFSOCK:
699 return SECCLASS_SOCK_FILE;
700 case S_IFLNK:
701 return SECCLASS_LNK_FILE;
702 case S_IFREG:
703 return SECCLASS_FILE;
704 case S_IFBLK:
705 return SECCLASS_BLK_FILE;
706 case S_IFDIR:
707 return SECCLASS_DIR;
708 case S_IFCHR:
709 return SECCLASS_CHR_FILE;
710 case S_IFIFO:
711 return SECCLASS_FIFO_FILE;
712
713 }
714
715 return SECCLASS_FILE;
716 }
717
718 static inline int default_protocol_stream(int protocol)
719 {
720 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
721 }
722
723 static inline int default_protocol_dgram(int protocol)
724 {
725 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
726 }
727
728 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
729 {
730 switch (family) {
731 case PF_UNIX:
732 switch (type) {
733 case SOCK_STREAM:
734 case SOCK_SEQPACKET:
735 return SECCLASS_UNIX_STREAM_SOCKET;
736 case SOCK_DGRAM:
737 return SECCLASS_UNIX_DGRAM_SOCKET;
738 }
739 break;
740 case PF_INET:
741 case PF_INET6:
742 switch (type) {
743 case SOCK_STREAM:
744 if (default_protocol_stream(protocol))
745 return SECCLASS_TCP_SOCKET;
746 else
747 return SECCLASS_RAWIP_SOCKET;
748 case SOCK_DGRAM:
749 if (default_protocol_dgram(protocol))
750 return SECCLASS_UDP_SOCKET;
751 else
752 return SECCLASS_RAWIP_SOCKET;
753 case SOCK_DCCP:
754 return SECCLASS_DCCP_SOCKET;
755 default:
756 return SECCLASS_RAWIP_SOCKET;
757 }
758 break;
759 case PF_NETLINK:
760 switch (protocol) {
761 case NETLINK_ROUTE:
762 return SECCLASS_NETLINK_ROUTE_SOCKET;
763 case NETLINK_FIREWALL:
764 return SECCLASS_NETLINK_FIREWALL_SOCKET;
765 case NETLINK_INET_DIAG:
766 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 case NETLINK_NFLOG:
768 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 case NETLINK_XFRM:
770 return SECCLASS_NETLINK_XFRM_SOCKET;
771 case NETLINK_SELINUX:
772 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 case NETLINK_AUDIT:
774 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 case NETLINK_IP6_FW:
776 return SECCLASS_NETLINK_IP6FW_SOCKET;
777 case NETLINK_DNRTMSG:
778 return SECCLASS_NETLINK_DNRT_SOCKET;
779 case NETLINK_KOBJECT_UEVENT:
780 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
781 default:
782 return SECCLASS_NETLINK_SOCKET;
783 }
784 case PF_PACKET:
785 return SECCLASS_PACKET_SOCKET;
786 case PF_KEY:
787 return SECCLASS_KEY_SOCKET;
788 case PF_APPLETALK:
789 return SECCLASS_APPLETALK_SOCKET;
790 }
791
792 return SECCLASS_SOCKET;
793 }
794
795 #ifdef CONFIG_PROC_FS
796 static int selinux_proc_get_sid(struct proc_dir_entry *de,
797 u16 tclass,
798 u32 *sid)
799 {
800 int buflen, rc;
801 char *buffer, *path, *end;
802
803 buffer = (char*)__get_free_page(GFP_KERNEL);
804 if (!buffer)
805 return -ENOMEM;
806
807 buflen = PAGE_SIZE;
808 end = buffer+buflen;
809 *--end = '\0';
810 buflen--;
811 path = end-1;
812 *path = '/';
813 while (de && de != de->parent) {
814 buflen -= de->namelen + 1;
815 if (buflen < 0)
816 break;
817 end -= de->namelen;
818 memcpy(end, de->name, de->namelen);
819 *--end = '/';
820 path = end;
821 de = de->parent;
822 }
823 rc = security_genfs_sid("proc", path, tclass, sid);
824 free_page((unsigned long)buffer);
825 return rc;
826 }
827 #else
828 static int selinux_proc_get_sid(struct proc_dir_entry *de,
829 u16 tclass,
830 u32 *sid)
831 {
832 return -EINVAL;
833 }
834 #endif
835
836 /* The inode's security attributes must be initialized before first use. */
837 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838 {
839 struct superblock_security_struct *sbsec = NULL;
840 struct inode_security_struct *isec = inode->i_security;
841 u32 sid;
842 struct dentry *dentry;
843 #define INITCONTEXTLEN 255
844 char *context = NULL;
845 unsigned len = 0;
846 int rc = 0;
847
848 if (isec->initialized)
849 goto out;
850
851 mutex_lock(&isec->lock);
852 if (isec->initialized)
853 goto out_unlock;
854
855 sbsec = inode->i_sb->s_security;
856 if (!sbsec->initialized) {
857 /* Defer initialization until selinux_complete_init,
858 after the initial policy is loaded and the security
859 server is ready to handle calls. */
860 spin_lock(&sbsec->isec_lock);
861 if (list_empty(&isec->list))
862 list_add(&isec->list, &sbsec->isec_head);
863 spin_unlock(&sbsec->isec_lock);
864 goto out_unlock;
865 }
866
867 switch (sbsec->behavior) {
868 case SECURITY_FS_USE_XATTR:
869 if (!inode->i_op->getxattr) {
870 isec->sid = sbsec->def_sid;
871 break;
872 }
873
874 /* Need a dentry, since the xattr API requires one.
875 Life would be simpler if we could just pass the inode. */
876 if (opt_dentry) {
877 /* Called from d_instantiate or d_splice_alias. */
878 dentry = dget(opt_dentry);
879 } else {
880 /* Called from selinux_complete_init, try to find a dentry. */
881 dentry = d_find_alias(inode);
882 }
883 if (!dentry) {
884 printk(KERN_WARNING "%s: no dentry for dev=%s "
885 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
886 inode->i_ino);
887 goto out_unlock;
888 }
889
890 len = INITCONTEXTLEN;
891 context = kmalloc(len, GFP_KERNEL);
892 if (!context) {
893 rc = -ENOMEM;
894 dput(dentry);
895 goto out_unlock;
896 }
897 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
898 context, len);
899 if (rc == -ERANGE) {
900 /* Need a larger buffer. Query for the right size. */
901 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
902 NULL, 0);
903 if (rc < 0) {
904 dput(dentry);
905 goto out_unlock;
906 }
907 kfree(context);
908 len = rc;
909 context = kmalloc(len, GFP_KERNEL);
910 if (!context) {
911 rc = -ENOMEM;
912 dput(dentry);
913 goto out_unlock;
914 }
915 rc = inode->i_op->getxattr(dentry,
916 XATTR_NAME_SELINUX,
917 context, len);
918 }
919 dput(dentry);
920 if (rc < 0) {
921 if (rc != -ENODATA) {
922 printk(KERN_WARNING "%s: getxattr returned "
923 "%d for dev=%s ino=%ld\n", __FUNCTION__,
924 -rc, inode->i_sb->s_id, inode->i_ino);
925 kfree(context);
926 goto out_unlock;
927 }
928 /* Map ENODATA to the default file SID */
929 sid = sbsec->def_sid;
930 rc = 0;
931 } else {
932 rc = security_context_to_sid_default(context, rc, &sid,
933 sbsec->def_sid);
934 if (rc) {
935 printk(KERN_WARNING "%s: context_to_sid(%s) "
936 "returned %d for dev=%s ino=%ld\n",
937 __FUNCTION__, context, -rc,
938 inode->i_sb->s_id, inode->i_ino);
939 kfree(context);
940 /* Leave with the unlabeled SID */
941 rc = 0;
942 break;
943 }
944 }
945 kfree(context);
946 isec->sid = sid;
947 break;
948 case SECURITY_FS_USE_TASK:
949 isec->sid = isec->task_sid;
950 break;
951 case SECURITY_FS_USE_TRANS:
952 /* Default to the fs SID. */
953 isec->sid = sbsec->sid;
954
955 /* Try to obtain a transition SID. */
956 isec->sclass = inode_mode_to_security_class(inode->i_mode);
957 rc = security_transition_sid(isec->task_sid,
958 sbsec->sid,
959 isec->sclass,
960 &sid);
961 if (rc)
962 goto out_unlock;
963 isec->sid = sid;
964 break;
965 case SECURITY_FS_USE_MNTPOINT:
966 isec->sid = sbsec->mntpoint_sid;
967 break;
968 default:
969 /* Default to the fs superblock SID. */
970 isec->sid = sbsec->sid;
971
972 if (sbsec->proc) {
973 struct proc_inode *proci = PROC_I(inode);
974 if (proci->pde) {
975 isec->sclass = inode_mode_to_security_class(inode->i_mode);
976 rc = selinux_proc_get_sid(proci->pde,
977 isec->sclass,
978 &sid);
979 if (rc)
980 goto out_unlock;
981 isec->sid = sid;
982 }
983 }
984 break;
985 }
986
987 isec->initialized = 1;
988
989 out_unlock:
990 mutex_unlock(&isec->lock);
991 out:
992 if (isec->sclass == SECCLASS_FILE)
993 isec->sclass = inode_mode_to_security_class(inode->i_mode);
994 return rc;
995 }
996
997 /* Convert a Linux signal to an access vector. */
998 static inline u32 signal_to_av(int sig)
999 {
1000 u32 perm = 0;
1001
1002 switch (sig) {
1003 case SIGCHLD:
1004 /* Commonly granted from child to parent. */
1005 perm = PROCESS__SIGCHLD;
1006 break;
1007 case SIGKILL:
1008 /* Cannot be caught or ignored */
1009 perm = PROCESS__SIGKILL;
1010 break;
1011 case SIGSTOP:
1012 /* Cannot be caught or ignored */
1013 perm = PROCESS__SIGSTOP;
1014 break;
1015 default:
1016 /* All other signals. */
1017 perm = PROCESS__SIGNAL;
1018 break;
1019 }
1020
1021 return perm;
1022 }
1023
1024 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1025 fork check, ptrace check, etc. */
1026 static int task_has_perm(struct task_struct *tsk1,
1027 struct task_struct *tsk2,
1028 u32 perms)
1029 {
1030 struct task_security_struct *tsec1, *tsec2;
1031
1032 tsec1 = tsk1->security;
1033 tsec2 = tsk2->security;
1034 return avc_has_perm(tsec1->sid, tsec2->sid,
1035 SECCLASS_PROCESS, perms, NULL);
1036 }
1037
1038 /* Check whether a task is allowed to use a capability. */
1039 static int task_has_capability(struct task_struct *tsk,
1040 int cap)
1041 {
1042 struct task_security_struct *tsec;
1043 struct avc_audit_data ad;
1044
1045 tsec = tsk->security;
1046
1047 AVC_AUDIT_DATA_INIT(&ad,CAP);
1048 ad.tsk = tsk;
1049 ad.u.cap = cap;
1050
1051 return avc_has_perm(tsec->sid, tsec->sid,
1052 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053 }
1054
1055 /* Check whether a task is allowed to use a system operation. */
1056 static int task_has_system(struct task_struct *tsk,
1057 u32 perms)
1058 {
1059 struct task_security_struct *tsec;
1060
1061 tsec = tsk->security;
1062
1063 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064 SECCLASS_SYSTEM, perms, NULL);
1065 }
1066
1067 /* Check whether a task has a particular permission to an inode.
1068 The 'adp' parameter is optional and allows other audit
1069 data to be passed (e.g. the dentry). */
1070 static int inode_has_perm(struct task_struct *tsk,
1071 struct inode *inode,
1072 u32 perms,
1073 struct avc_audit_data *adp)
1074 {
1075 struct task_security_struct *tsec;
1076 struct inode_security_struct *isec;
1077 struct avc_audit_data ad;
1078
1079 if (unlikely (IS_PRIVATE (inode)))
1080 return 0;
1081
1082 tsec = tsk->security;
1083 isec = inode->i_security;
1084
1085 if (!adp) {
1086 adp = &ad;
1087 AVC_AUDIT_DATA_INIT(&ad, FS);
1088 ad.u.fs.inode = inode;
1089 }
1090
1091 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092 }
1093
1094 /* Same as inode_has_perm, but pass explicit audit data containing
1095 the dentry to help the auditing code to more easily generate the
1096 pathname if needed. */
1097 static inline int dentry_has_perm(struct task_struct *tsk,
1098 struct vfsmount *mnt,
1099 struct dentry *dentry,
1100 u32 av)
1101 {
1102 struct inode *inode = dentry->d_inode;
1103 struct avc_audit_data ad;
1104 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.mnt = mnt;
1106 ad.u.fs.dentry = dentry;
1107 return inode_has_perm(tsk, inode, av, &ad);
1108 }
1109
1110 /* Check whether a task can use an open file descriptor to
1111 access an inode in a given way. Check access to the
1112 descriptor itself, and then use dentry_has_perm to
1113 check a particular permission to the file.
1114 Access to the descriptor is implicitly granted if it
1115 has the same SID as the process. If av is zero, then
1116 access to the file is not checked, e.g. for cases
1117 where only the descriptor is affected like seek. */
1118 static int file_has_perm(struct task_struct *tsk,
1119 struct file *file,
1120 u32 av)
1121 {
1122 struct task_security_struct *tsec = tsk->security;
1123 struct file_security_struct *fsec = file->f_security;
1124 struct vfsmount *mnt = file->f_path.mnt;
1125 struct dentry *dentry = file->f_path.dentry;
1126 struct inode *inode = dentry->d_inode;
1127 struct avc_audit_data ad;
1128 int rc;
1129
1130 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.mnt = mnt;
1132 ad.u.fs.dentry = dentry;
1133
1134 if (tsec->sid != fsec->sid) {
1135 rc = avc_has_perm(tsec->sid, fsec->sid,
1136 SECCLASS_FD,
1137 FD__USE,
1138 &ad);
1139 if (rc)
1140 return rc;
1141 }
1142
1143 /* av is zero if only checking access to the descriptor. */
1144 if (av)
1145 return inode_has_perm(tsk, inode, av, &ad);
1146
1147 return 0;
1148 }
1149
1150 /* Check whether a task can create a file. */
1151 static int may_create(struct inode *dir,
1152 struct dentry *dentry,
1153 u16 tclass)
1154 {
1155 struct task_security_struct *tsec;
1156 struct inode_security_struct *dsec;
1157 struct superblock_security_struct *sbsec;
1158 u32 newsid;
1159 struct avc_audit_data ad;
1160 int rc;
1161
1162 tsec = current->security;
1163 dsec = dir->i_security;
1164 sbsec = dir->i_sb->s_security;
1165
1166 AVC_AUDIT_DATA_INIT(&ad, FS);
1167 ad.u.fs.dentry = dentry;
1168
1169 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170 DIR__ADD_NAME | DIR__SEARCH,
1171 &ad);
1172 if (rc)
1173 return rc;
1174
1175 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176 newsid = tsec->create_sid;
1177 } else {
1178 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179 &newsid);
1180 if (rc)
1181 return rc;
1182 }
1183
1184 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185 if (rc)
1186 return rc;
1187
1188 return avc_has_perm(newsid, sbsec->sid,
1189 SECCLASS_FILESYSTEM,
1190 FILESYSTEM__ASSOCIATE, &ad);
1191 }
1192
1193 /* Check whether a task can create a key. */
1194 static int may_create_key(u32 ksid,
1195 struct task_struct *ctx)
1196 {
1197 struct task_security_struct *tsec;
1198
1199 tsec = ctx->security;
1200
1201 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202 }
1203
1204 #define MAY_LINK 0
1205 #define MAY_UNLINK 1
1206 #define MAY_RMDIR 2
1207
1208 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1209 static int may_link(struct inode *dir,
1210 struct dentry *dentry,
1211 int kind)
1212
1213 {
1214 struct task_security_struct *tsec;
1215 struct inode_security_struct *dsec, *isec;
1216 struct avc_audit_data ad;
1217 u32 av;
1218 int rc;
1219
1220 tsec = current->security;
1221 dsec = dir->i_security;
1222 isec = dentry->d_inode->i_security;
1223
1224 AVC_AUDIT_DATA_INIT(&ad, FS);
1225 ad.u.fs.dentry = dentry;
1226
1227 av = DIR__SEARCH;
1228 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230 if (rc)
1231 return rc;
1232
1233 switch (kind) {
1234 case MAY_LINK:
1235 av = FILE__LINK;
1236 break;
1237 case MAY_UNLINK:
1238 av = FILE__UNLINK;
1239 break;
1240 case MAY_RMDIR:
1241 av = DIR__RMDIR;
1242 break;
1243 default:
1244 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1245 return 0;
1246 }
1247
1248 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249 return rc;
1250 }
1251
1252 static inline int may_rename(struct inode *old_dir,
1253 struct dentry *old_dentry,
1254 struct inode *new_dir,
1255 struct dentry *new_dentry)
1256 {
1257 struct task_security_struct *tsec;
1258 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259 struct avc_audit_data ad;
1260 u32 av;
1261 int old_is_dir, new_is_dir;
1262 int rc;
1263
1264 tsec = current->security;
1265 old_dsec = old_dir->i_security;
1266 old_isec = old_dentry->d_inode->i_security;
1267 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268 new_dsec = new_dir->i_security;
1269
1270 AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272 ad.u.fs.dentry = old_dentry;
1273 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275 if (rc)
1276 return rc;
1277 rc = avc_has_perm(tsec->sid, old_isec->sid,
1278 old_isec->sclass, FILE__RENAME, &ad);
1279 if (rc)
1280 return rc;
1281 if (old_is_dir && new_dir != old_dir) {
1282 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283 old_isec->sclass, DIR__REPARENT, &ad);
1284 if (rc)
1285 return rc;
1286 }
1287
1288 ad.u.fs.dentry = new_dentry;
1289 av = DIR__ADD_NAME | DIR__SEARCH;
1290 if (new_dentry->d_inode)
1291 av |= DIR__REMOVE_NAME;
1292 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293 if (rc)
1294 return rc;
1295 if (new_dentry->d_inode) {
1296 new_isec = new_dentry->d_inode->i_security;
1297 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 new_isec->sclass,
1300 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301 if (rc)
1302 return rc;
1303 }
1304
1305 return 0;
1306 }
1307
1308 /* Check whether a task can perform a filesystem operation. */
1309 static int superblock_has_perm(struct task_struct *tsk,
1310 struct super_block *sb,
1311 u32 perms,
1312 struct avc_audit_data *ad)
1313 {
1314 struct task_security_struct *tsec;
1315 struct superblock_security_struct *sbsec;
1316
1317 tsec = tsk->security;
1318 sbsec = sb->s_security;
1319 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320 perms, ad);
1321 }
1322
1323 /* Convert a Linux mode and permission mask to an access vector. */
1324 static inline u32 file_mask_to_av(int mode, int mask)
1325 {
1326 u32 av = 0;
1327
1328 if ((mode & S_IFMT) != S_IFDIR) {
1329 if (mask & MAY_EXEC)
1330 av |= FILE__EXECUTE;
1331 if (mask & MAY_READ)
1332 av |= FILE__READ;
1333
1334 if (mask & MAY_APPEND)
1335 av |= FILE__APPEND;
1336 else if (mask & MAY_WRITE)
1337 av |= FILE__WRITE;
1338
1339 } else {
1340 if (mask & MAY_EXEC)
1341 av |= DIR__SEARCH;
1342 if (mask & MAY_WRITE)
1343 av |= DIR__WRITE;
1344 if (mask & MAY_READ)
1345 av |= DIR__READ;
1346 }
1347
1348 return av;
1349 }
1350
1351 /* Convert a Linux file to an access vector. */
1352 static inline u32 file_to_av(struct file *file)
1353 {
1354 u32 av = 0;
1355
1356 if (file->f_mode & FMODE_READ)
1357 av |= FILE__READ;
1358 if (file->f_mode & FMODE_WRITE) {
1359 if (file->f_flags & O_APPEND)
1360 av |= FILE__APPEND;
1361 else
1362 av |= FILE__WRITE;
1363 }
1364
1365 return av;
1366 }
1367
1368 /* Hook functions begin here. */
1369
1370 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371 {
1372 struct task_security_struct *psec = parent->security;
1373 struct task_security_struct *csec = child->security;
1374 int rc;
1375
1376 rc = secondary_ops->ptrace(parent,child);
1377 if (rc)
1378 return rc;
1379
1380 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381 /* Save the SID of the tracing process for later use in apply_creds. */
1382 if (!(child->ptrace & PT_PTRACED) && !rc)
1383 csec->ptrace_sid = psec->sid;
1384 return rc;
1385 }
1386
1387 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389 {
1390 int error;
1391
1392 error = task_has_perm(current, target, PROCESS__GETCAP);
1393 if (error)
1394 return error;
1395
1396 return secondary_ops->capget(target, effective, inheritable, permitted);
1397 }
1398
1399 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401 {
1402 int error;
1403
1404 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405 if (error)
1406 return error;
1407
1408 return task_has_perm(current, target, PROCESS__SETCAP);
1409 }
1410
1411 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 {
1414 secondary_ops->capset_set(target, effective, inheritable, permitted);
1415 }
1416
1417 static int selinux_capable(struct task_struct *tsk, int cap)
1418 {
1419 int rc;
1420
1421 rc = secondary_ops->capable(tsk, cap);
1422 if (rc)
1423 return rc;
1424
1425 return task_has_capability(tsk,cap);
1426 }
1427
1428 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429 {
1430 int buflen, rc;
1431 char *buffer, *path, *end;
1432
1433 rc = -ENOMEM;
1434 buffer = (char*)__get_free_page(GFP_KERNEL);
1435 if (!buffer)
1436 goto out;
1437
1438 buflen = PAGE_SIZE;
1439 end = buffer+buflen;
1440 *--end = '\0';
1441 buflen--;
1442 path = end-1;
1443 *path = '/';
1444 while (table) {
1445 const char *name = table->procname;
1446 size_t namelen = strlen(name);
1447 buflen -= namelen + 1;
1448 if (buflen < 0)
1449 goto out_free;
1450 end -= namelen;
1451 memcpy(end, name, namelen);
1452 *--end = '/';
1453 path = end;
1454 table = table->parent;
1455 }
1456 buflen -= 4;
1457 if (buflen < 0)
1458 goto out_free;
1459 end -= 4;
1460 memcpy(end, "/sys", 4);
1461 path = end;
1462 rc = security_genfs_sid("proc", path, tclass, sid);
1463 out_free:
1464 free_page((unsigned long)buffer);
1465 out:
1466 return rc;
1467 }
1468
1469 static int selinux_sysctl(ctl_table *table, int op)
1470 {
1471 int error = 0;
1472 u32 av;
1473 struct task_security_struct *tsec;
1474 u32 tsid;
1475 int rc;
1476
1477 rc = secondary_ops->sysctl(table, op);
1478 if (rc)
1479 return rc;
1480
1481 tsec = current->security;
1482
1483 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1485 if (rc) {
1486 /* Default to the well-defined sysctl SID. */
1487 tsid = SECINITSID_SYSCTL;
1488 }
1489
1490 /* The op values are "defined" in sysctl.c, thereby creating
1491 * a bad coupling between this module and sysctl.c */
1492 if(op == 001) {
1493 error = avc_has_perm(tsec->sid, tsid,
1494 SECCLASS_DIR, DIR__SEARCH, NULL);
1495 } else {
1496 av = 0;
1497 if (op & 004)
1498 av |= FILE__READ;
1499 if (op & 002)
1500 av |= FILE__WRITE;
1501 if (av)
1502 error = avc_has_perm(tsec->sid, tsid,
1503 SECCLASS_FILE, av, NULL);
1504 }
1505
1506 return error;
1507 }
1508
1509 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510 {
1511 int rc = 0;
1512
1513 if (!sb)
1514 return 0;
1515
1516 switch (cmds) {
1517 case Q_SYNC:
1518 case Q_QUOTAON:
1519 case Q_QUOTAOFF:
1520 case Q_SETINFO:
1521 case Q_SETQUOTA:
1522 rc = superblock_has_perm(current,
1523 sb,
1524 FILESYSTEM__QUOTAMOD, NULL);
1525 break;
1526 case Q_GETFMT:
1527 case Q_GETINFO:
1528 case Q_GETQUOTA:
1529 rc = superblock_has_perm(current,
1530 sb,
1531 FILESYSTEM__QUOTAGET, NULL);
1532 break;
1533 default:
1534 rc = 0; /* let the kernel handle invalid cmds */
1535 break;
1536 }
1537 return rc;
1538 }
1539
1540 static int selinux_quota_on(struct dentry *dentry)
1541 {
1542 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543 }
1544
1545 static int selinux_syslog(int type)
1546 {
1547 int rc;
1548
1549 rc = secondary_ops->syslog(type);
1550 if (rc)
1551 return rc;
1552
1553 switch (type) {
1554 case 3: /* Read last kernel messages */
1555 case 10: /* Return size of the log buffer */
1556 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557 break;
1558 case 6: /* Disable logging to console */
1559 case 7: /* Enable logging to console */
1560 case 8: /* Set level of messages printed to console */
1561 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562 break;
1563 case 0: /* Close log */
1564 case 1: /* Open log */
1565 case 2: /* Read from log */
1566 case 4: /* Read/clear last kernel messages */
1567 case 5: /* Clear ring buffer */
1568 default:
1569 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570 break;
1571 }
1572 return rc;
1573 }
1574
1575 /*
1576 * Check that a process has enough memory to allocate a new virtual
1577 * mapping. 0 means there is enough memory for the allocation to
1578 * succeed and -ENOMEM implies there is not.
1579 *
1580 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581 * if the capability is granted, but __vm_enough_memory requires 1 if
1582 * the capability is granted.
1583 *
1584 * Do not audit the selinux permission check, as this is applied to all
1585 * processes that allocate mappings.
1586 */
1587 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1588 {
1589 int rc, cap_sys_admin = 0;
1590 struct task_security_struct *tsec = current->security;
1591
1592 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593 if (rc == 0)
1594 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1595 SECCLASS_CAPABILITY,
1596 CAP_TO_MASK(CAP_SYS_ADMIN),
1597 0,
1598 NULL);
1599
1600 if (rc == 0)
1601 cap_sys_admin = 1;
1602
1603 return __vm_enough_memory(mm, pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610 struct bprm_security_struct *bsec;
1611
1612 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613 if (!bsec)
1614 return -ENOMEM;
1615
1616 bsec->bprm = bprm;
1617 bsec->sid = SECINITSID_UNLABELED;
1618 bsec->set = 0;
1619
1620 bprm->security = bsec;
1621 return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626 struct task_security_struct *tsec;
1627 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628 struct inode_security_struct *isec;
1629 struct bprm_security_struct *bsec;
1630 u32 newsid;
1631 struct avc_audit_data ad;
1632 int rc;
1633
1634 rc = secondary_ops->bprm_set_security(bprm);
1635 if (rc)
1636 return rc;
1637
1638 bsec = bprm->security;
1639
1640 if (bsec->set)
1641 return 0;
1642
1643 tsec = current->security;
1644 isec = inode->i_security;
1645
1646 /* Default to the current task SID. */
1647 bsec->sid = tsec->sid;
1648
1649 /* Reset fs, key, and sock SIDs on execve. */
1650 tsec->create_sid = 0;
1651 tsec->keycreate_sid = 0;
1652 tsec->sockcreate_sid = 0;
1653
1654 if (tsec->exec_sid) {
1655 newsid = tsec->exec_sid;
1656 /* Reset exec SID on execve. */
1657 tsec->exec_sid = 0;
1658 } else {
1659 /* Check for a default transition on this program. */
1660 rc = security_transition_sid(tsec->sid, isec->sid,
1661 SECCLASS_PROCESS, &newsid);
1662 if (rc)
1663 return rc;
1664 }
1665
1666 AVC_AUDIT_DATA_INIT(&ad, FS);
1667 ad.u.fs.mnt = bprm->file->f_path.mnt;
1668 ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671 newsid = tsec->sid;
1672
1673 if (tsec->sid == newsid) {
1674 rc = avc_has_perm(tsec->sid, isec->sid,
1675 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676 if (rc)
1677 return rc;
1678 } else {
1679 /* Check permissions for the transition. */
1680 rc = avc_has_perm(tsec->sid, newsid,
1681 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682 if (rc)
1683 return rc;
1684
1685 rc = avc_has_perm(newsid, isec->sid,
1686 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687 if (rc)
1688 return rc;
1689
1690 /* Clear any possibly unsafe personality bits on exec: */
1691 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693 /* Set the security field to the new SID. */
1694 bsec->sid = newsid;
1695 }
1696
1697 bsec->set = 1;
1698 return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703 return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709 struct task_security_struct *tsec = current->security;
1710 int atsecure = 0;
1711
1712 if (tsec->osid != tsec->sid) {
1713 /* Enable secure mode for SIDs transitions unless
1714 the noatsecure permission is granted between
1715 the two SIDs, i.e. ahp returns 0. */
1716 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717 SECCLASS_PROCESS,
1718 PROCESS__NOATSECURE, NULL);
1719 }
1720
1721 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726 kfree(bprm->security);
1727 bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736 struct avc_audit_data ad;
1737 struct file *file, *devnull = NULL;
1738 struct tty_struct *tty;
1739 struct fdtable *fdt;
1740 long j = -1;
1741 int drop_tty = 0;
1742
1743 mutex_lock(&tty_mutex);
1744 tty = get_current_tty();
1745 if (tty) {
1746 file_list_lock();
1747 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748 if (file) {
1749 /* Revalidate access to controlling tty.
1750 Use inode_has_perm on the tty inode directly rather
1751 than using file_has_perm, as this particular open
1752 file may belong to another process and we are only
1753 interested in the inode-based check here. */
1754 struct inode *inode = file->f_path.dentry->d_inode;
1755 if (inode_has_perm(current, inode,
1756 FILE__READ | FILE__WRITE, NULL)) {
1757 drop_tty = 1;
1758 }
1759 }
1760 file_list_unlock();
1761 }
1762 mutex_unlock(&tty_mutex);
1763 /* Reset controlling tty. */
1764 if (drop_tty)
1765 no_tty();
1766
1767 /* Revalidate access to inherited open files. */
1768
1769 AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771 spin_lock(&files->file_lock);
1772 for (;;) {
1773 unsigned long set, i;
1774 int fd;
1775
1776 j++;
1777 i = j * __NFDBITS;
1778 fdt = files_fdtable(files);
1779 if (i >= fdt->max_fds)
1780 break;
1781 set = fdt->open_fds->fds_bits[j];
1782 if (!set)
1783 continue;
1784 spin_unlock(&files->file_lock);
1785 for ( ; set ; i++,set >>= 1) {
1786 if (set & 1) {
1787 file = fget(i);
1788 if (!file)
1789 continue;
1790 if (file_has_perm(current,
1791 file,
1792 file_to_av(file))) {
1793 sys_close(i);
1794 fd = get_unused_fd();
1795 if (fd != i) {
1796 if (fd >= 0)
1797 put_unused_fd(fd);
1798 fput(file);
1799 continue;
1800 }
1801 if (devnull) {
1802 get_file(devnull);
1803 } else {
1804 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1805 if (IS_ERR(devnull)) {
1806 devnull = NULL;
1807 put_unused_fd(fd);
1808 fput(file);
1809 continue;
1810 }
1811 }
1812 fd_install(fd, devnull);
1813 }
1814 fput(file);
1815 }
1816 }
1817 spin_lock(&files->file_lock);
1818
1819 }
1820 spin_unlock(&files->file_lock);
1821 }
1822
1823 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1824 {
1825 struct task_security_struct *tsec;
1826 struct bprm_security_struct *bsec;
1827 u32 sid;
1828 int rc;
1829
1830 secondary_ops->bprm_apply_creds(bprm, unsafe);
1831
1832 tsec = current->security;
1833
1834 bsec = bprm->security;
1835 sid = bsec->sid;
1836
1837 tsec->osid = tsec->sid;
1838 bsec->unsafe = 0;
1839 if (tsec->sid != sid) {
1840 /* Check for shared state. If not ok, leave SID
1841 unchanged and kill. */
1842 if (unsafe & LSM_UNSAFE_SHARE) {
1843 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1844 PROCESS__SHARE, NULL);
1845 if (rc) {
1846 bsec->unsafe = 1;
1847 return;
1848 }
1849 }
1850
1851 /* Check for ptracing, and update the task SID if ok.
1852 Otherwise, leave SID unchanged and kill. */
1853 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1854 rc = avc_has_perm(tsec->ptrace_sid, sid,
1855 SECCLASS_PROCESS, PROCESS__PTRACE,
1856 NULL);
1857 if (rc) {
1858 bsec->unsafe = 1;
1859 return;
1860 }
1861 }
1862 tsec->sid = sid;
1863 }
1864 }
1865
1866 /*
1867 * called after apply_creds without the task lock held
1868 */
1869 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1870 {
1871 struct task_security_struct *tsec;
1872 struct rlimit *rlim, *initrlim;
1873 struct itimerval itimer;
1874 struct bprm_security_struct *bsec;
1875 int rc, i;
1876
1877 tsec = current->security;
1878 bsec = bprm->security;
1879
1880 if (bsec->unsafe) {
1881 force_sig_specific(SIGKILL, current);
1882 return;
1883 }
1884 if (tsec->osid == tsec->sid)
1885 return;
1886
1887 /* Close files for which the new task SID is not authorized. */
1888 flush_unauthorized_files(current->files);
1889
1890 /* Check whether the new SID can inherit signal state
1891 from the old SID. If not, clear itimers to avoid
1892 subsequent signal generation and flush and unblock
1893 signals. This must occur _after_ the task SID has
1894 been updated so that any kill done after the flush
1895 will be checked against the new SID. */
1896 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897 PROCESS__SIGINH, NULL);
1898 if (rc) {
1899 memset(&itimer, 0, sizeof itimer);
1900 for (i = 0; i < 3; i++)
1901 do_setitimer(i, &itimer, NULL);
1902 flush_signals(current);
1903 spin_lock_irq(&current->sighand->siglock);
1904 flush_signal_handlers(current, 1);
1905 sigemptyset(&current->blocked);
1906 recalc_sigpending();
1907 spin_unlock_irq(&current->sighand->siglock);
1908 }
1909
1910 /* Always clear parent death signal on SID transitions. */
1911 current->pdeath_signal = 0;
1912
1913 /* Check whether the new SID can inherit resource limits
1914 from the old SID. If not, reset all soft limits to
1915 the lower of the current task's hard limit and the init
1916 task's soft limit. Note that the setting of hard limits
1917 (even to lower them) can be controlled by the setrlimit
1918 check. The inclusion of the init task's soft limit into
1919 the computation is to avoid resetting soft limits higher
1920 than the default soft limit for cases where the default
1921 is lower than the hard limit, e.g. RLIMIT_CORE or
1922 RLIMIT_STACK.*/
1923 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1924 PROCESS__RLIMITINH, NULL);
1925 if (rc) {
1926 for (i = 0; i < RLIM_NLIMITS; i++) {
1927 rlim = current->signal->rlim + i;
1928 initrlim = init_task.signal->rlim+i;
1929 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1930 }
1931 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1932 /*
1933 * This will cause RLIMIT_CPU calculations
1934 * to be refigured.
1935 */
1936 current->it_prof_expires = jiffies_to_cputime(1);
1937 }
1938 }
1939
1940 /* Wake up the parent if it is waiting so that it can
1941 recheck wait permission to the new task SID. */
1942 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1943 }
1944
1945 /* superblock security operations */
1946
1947 static int selinux_sb_alloc_security(struct super_block *sb)
1948 {
1949 return superblock_alloc_security(sb);
1950 }
1951
1952 static void selinux_sb_free_security(struct super_block *sb)
1953 {
1954 superblock_free_security(sb);
1955 }
1956
1957 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1958 {
1959 if (plen > olen)
1960 return 0;
1961
1962 return !memcmp(prefix, option, plen);
1963 }
1964
1965 static inline int selinux_option(char *option, int len)
1966 {
1967 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1968 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1969 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1970 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1971 }
1972
1973 static inline void take_option(char **to, char *from, int *first, int len)
1974 {
1975 if (!*first) {
1976 **to = ',';
1977 *to += 1;
1978 } else
1979 *first = 0;
1980 memcpy(*to, from, len);
1981 *to += len;
1982 }
1983
1984 static inline void take_selinux_option(char **to, char *from, int *first,
1985 int len)
1986 {
1987 int current_size = 0;
1988
1989 if (!*first) {
1990 **to = '|';
1991 *to += 1;
1992 }
1993 else
1994 *first = 0;
1995
1996 while (current_size < len) {
1997 if (*from != '"') {
1998 **to = *from;
1999 *to += 1;
2000 }
2001 from += 1;
2002 current_size += 1;
2003 }
2004 }
2005
2006 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2007 {
2008 int fnosec, fsec, rc = 0;
2009 char *in_save, *in_curr, *in_end;
2010 char *sec_curr, *nosec_save, *nosec;
2011 int open_quote = 0;
2012
2013 in_curr = orig;
2014 sec_curr = copy;
2015
2016 /* Binary mount data: just copy */
2017 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2018 copy_page(sec_curr, in_curr);
2019 goto out;
2020 }
2021
2022 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2023 if (!nosec) {
2024 rc = -ENOMEM;
2025 goto out;
2026 }
2027
2028 nosec_save = nosec;
2029 fnosec = fsec = 1;
2030 in_save = in_end = orig;
2031
2032 do {
2033 if (*in_end == '"')
2034 open_quote = !open_quote;
2035 if ((*in_end == ',' && open_quote == 0) ||
2036 *in_end == '\0') {
2037 int len = in_end - in_curr;
2038
2039 if (selinux_option(in_curr, len))
2040 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2041 else
2042 take_option(&nosec, in_curr, &fnosec, len);
2043
2044 in_curr = in_end + 1;
2045 }
2046 } while (*in_end++);
2047
2048 strcpy(in_save, nosec_save);
2049 free_page((unsigned long)nosec_save);
2050 out:
2051 return rc;
2052 }
2053
2054 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2055 {
2056 struct avc_audit_data ad;
2057 int rc;
2058
2059 rc = superblock_doinit(sb, data);
2060 if (rc)
2061 return rc;
2062
2063 AVC_AUDIT_DATA_INIT(&ad,FS);
2064 ad.u.fs.dentry = sb->s_root;
2065 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2066 }
2067
2068 static int selinux_sb_statfs(struct dentry *dentry)
2069 {
2070 struct avc_audit_data ad;
2071
2072 AVC_AUDIT_DATA_INIT(&ad,FS);
2073 ad.u.fs.dentry = dentry->d_sb->s_root;
2074 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2075 }
2076
2077 static int selinux_mount(char * dev_name,
2078 struct nameidata *nd,
2079 char * type,
2080 unsigned long flags,
2081 void * data)
2082 {
2083 int rc;
2084
2085 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2086 if (rc)
2087 return rc;
2088
2089 if (flags & MS_REMOUNT)
2090 return superblock_has_perm(current, nd->mnt->mnt_sb,
2091 FILESYSTEM__REMOUNT, NULL);
2092 else
2093 return dentry_has_perm(current, nd->mnt, nd->dentry,
2094 FILE__MOUNTON);
2095 }
2096
2097 static int selinux_umount(struct vfsmount *mnt, int flags)
2098 {
2099 int rc;
2100
2101 rc = secondary_ops->sb_umount(mnt, flags);
2102 if (rc)
2103 return rc;
2104
2105 return superblock_has_perm(current,mnt->mnt_sb,
2106 FILESYSTEM__UNMOUNT,NULL);
2107 }
2108
2109 /* inode security operations */
2110
2111 static int selinux_inode_alloc_security(struct inode *inode)
2112 {
2113 return inode_alloc_security(inode);
2114 }
2115
2116 static void selinux_inode_free_security(struct inode *inode)
2117 {
2118 inode_free_security(inode);
2119 }
2120
2121 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2122 char **name, void **value,
2123 size_t *len)
2124 {
2125 struct task_security_struct *tsec;
2126 struct inode_security_struct *dsec;
2127 struct superblock_security_struct *sbsec;
2128 u32 newsid, clen;
2129 int rc;
2130 char *namep = NULL, *context;
2131
2132 tsec = current->security;
2133 dsec = dir->i_security;
2134 sbsec = dir->i_sb->s_security;
2135
2136 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2137 newsid = tsec->create_sid;
2138 } else {
2139 rc = security_transition_sid(tsec->sid, dsec->sid,
2140 inode_mode_to_security_class(inode->i_mode),
2141 &newsid);
2142 if (rc) {
2143 printk(KERN_WARNING "%s: "
2144 "security_transition_sid failed, rc=%d (dev=%s "
2145 "ino=%ld)\n",
2146 __FUNCTION__,
2147 -rc, inode->i_sb->s_id, inode->i_ino);
2148 return rc;
2149 }
2150 }
2151
2152 /* Possibly defer initialization to selinux_complete_init. */
2153 if (sbsec->initialized) {
2154 struct inode_security_struct *isec = inode->i_security;
2155 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2156 isec->sid = newsid;
2157 isec->initialized = 1;
2158 }
2159
2160 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2161 return -EOPNOTSUPP;
2162
2163 if (name) {
2164 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2165 if (!namep)
2166 return -ENOMEM;
2167 *name = namep;
2168 }
2169
2170 if (value && len) {
2171 rc = security_sid_to_context(newsid, &context, &clen);
2172 if (rc) {
2173 kfree(namep);
2174 return rc;
2175 }
2176 *value = context;
2177 *len = clen;
2178 }
2179
2180 return 0;
2181 }
2182
2183 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2184 {
2185 return may_create(dir, dentry, SECCLASS_FILE);
2186 }
2187
2188 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2189 {
2190 int rc;
2191
2192 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2193 if (rc)
2194 return rc;
2195 return may_link(dir, old_dentry, MAY_LINK);
2196 }
2197
2198 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2199 {
2200 int rc;
2201
2202 rc = secondary_ops->inode_unlink(dir, dentry);
2203 if (rc)
2204 return rc;
2205 return may_link(dir, dentry, MAY_UNLINK);
2206 }
2207
2208 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2209 {
2210 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2211 }
2212
2213 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2214 {
2215 return may_create(dir, dentry, SECCLASS_DIR);
2216 }
2217
2218 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2219 {
2220 return may_link(dir, dentry, MAY_RMDIR);
2221 }
2222
2223 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2224 {
2225 int rc;
2226
2227 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2228 if (rc)
2229 return rc;
2230
2231 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2232 }
2233
2234 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2235 struct inode *new_inode, struct dentry *new_dentry)
2236 {
2237 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2238 }
2239
2240 static int selinux_inode_readlink(struct dentry *dentry)
2241 {
2242 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2243 }
2244
2245 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2246 {
2247 int rc;
2248
2249 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2250 if (rc)
2251 return rc;
2252 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2253 }
2254
2255 static int selinux_inode_permission(struct inode *inode, int mask,
2256 struct nameidata *nd)
2257 {
2258 int rc;
2259
2260 rc = secondary_ops->inode_permission(inode, mask, nd);
2261 if (rc)
2262 return rc;
2263
2264 if (!mask) {
2265 /* No permission to check. Existence test. */
2266 return 0;
2267 }
2268
2269 return inode_has_perm(current, inode,
2270 file_mask_to_av(inode->i_mode, mask), NULL);
2271 }
2272
2273 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2274 {
2275 int rc;
2276
2277 rc = secondary_ops->inode_setattr(dentry, iattr);
2278 if (rc)
2279 return rc;
2280
2281 if (iattr->ia_valid & ATTR_FORCE)
2282 return 0;
2283
2284 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2285 ATTR_ATIME_SET | ATTR_MTIME_SET))
2286 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2287
2288 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2289 }
2290
2291 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2292 {
2293 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2294 }
2295
2296 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2297 {
2298 struct task_security_struct *tsec = current->security;
2299 struct inode *inode = dentry->d_inode;
2300 struct inode_security_struct *isec = inode->i_security;
2301 struct superblock_security_struct *sbsec;
2302 struct avc_audit_data ad;
2303 u32 newsid;
2304 int rc = 0;
2305
2306 if (strcmp(name, XATTR_NAME_SELINUX)) {
2307 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2308 sizeof XATTR_SECURITY_PREFIX - 1) &&
2309 !capable(CAP_SYS_ADMIN)) {
2310 /* A different attribute in the security namespace.
2311 Restrict to administrator. */
2312 return -EPERM;
2313 }
2314
2315 /* Not an attribute we recognize, so just check the
2316 ordinary setattr permission. */
2317 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2318 }
2319
2320 sbsec = inode->i_sb->s_security;
2321 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2322 return -EOPNOTSUPP;
2323
2324 if (!is_owner_or_cap(inode))
2325 return -EPERM;
2326
2327 AVC_AUDIT_DATA_INIT(&ad,FS);
2328 ad.u.fs.dentry = dentry;
2329
2330 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2331 FILE__RELABELFROM, &ad);
2332 if (rc)
2333 return rc;
2334
2335 rc = security_context_to_sid(value, size, &newsid);
2336 if (rc)
2337 return rc;
2338
2339 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2340 FILE__RELABELTO, &ad);
2341 if (rc)
2342 return rc;
2343
2344 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2345 isec->sclass);
2346 if (rc)
2347 return rc;
2348
2349 return avc_has_perm(newsid,
2350 sbsec->sid,
2351 SECCLASS_FILESYSTEM,
2352 FILESYSTEM__ASSOCIATE,
2353 &ad);
2354 }
2355
2356 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2357 void *value, size_t size, int flags)
2358 {
2359 struct inode *inode = dentry->d_inode;
2360 struct inode_security_struct *isec = inode->i_security;
2361 u32 newsid;
2362 int rc;
2363
2364 if (strcmp(name, XATTR_NAME_SELINUX)) {
2365 /* Not an attribute we recognize, so nothing to do. */
2366 return;
2367 }
2368
2369 rc = security_context_to_sid(value, size, &newsid);
2370 if (rc) {
2371 printk(KERN_WARNING "%s: unable to obtain SID for context "
2372 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2373 return;
2374 }
2375
2376 isec->sid = newsid;
2377 return;
2378 }
2379
2380 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2381 {
2382 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2383 }
2384
2385 static int selinux_inode_listxattr (struct dentry *dentry)
2386 {
2387 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2388 }
2389
2390 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2391 {
2392 if (strcmp(name, XATTR_NAME_SELINUX)) {
2393 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2394 sizeof XATTR_SECURITY_PREFIX - 1) &&
2395 !capable(CAP_SYS_ADMIN)) {
2396 /* A different attribute in the security namespace.
2397 Restrict to administrator. */
2398 return -EPERM;
2399 }
2400
2401 /* Not an attribute we recognize, so just check the
2402 ordinary setattr permission. Might want a separate
2403 permission for removexattr. */
2404 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2405 }
2406
2407 /* No one is allowed to remove a SELinux security label.
2408 You can change the label, but all data must be labeled. */
2409 return -EACCES;
2410 }
2411
2412 static const char *selinux_inode_xattr_getsuffix(void)
2413 {
2414 return XATTR_SELINUX_SUFFIX;
2415 }
2416
2417 /*
2418 * Copy the in-core inode security context value to the user. If the
2419 * getxattr() prior to this succeeded, check to see if we need to
2420 * canonicalize the value to be finally returned to the user.
2421 *
2422 * Permission check is handled by selinux_inode_getxattr hook.
2423 */
2424 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2425 {
2426 struct inode_security_struct *isec = inode->i_security;
2427
2428 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2429 return -EOPNOTSUPP;
2430
2431 return selinux_getsecurity(isec->sid, buffer, size);
2432 }
2433
2434 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2435 const void *value, size_t size, int flags)
2436 {
2437 struct inode_security_struct *isec = inode->i_security;
2438 u32 newsid;
2439 int rc;
2440
2441 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2442 return -EOPNOTSUPP;
2443
2444 if (!value || !size)
2445 return -EACCES;
2446
2447 rc = security_context_to_sid((void*)value, size, &newsid);
2448 if (rc)
2449 return rc;
2450
2451 isec->sid = newsid;
2452 return 0;
2453 }
2454
2455 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2456 {
2457 const int len = sizeof(XATTR_NAME_SELINUX);
2458 if (buffer && len <= buffer_size)
2459 memcpy(buffer, XATTR_NAME_SELINUX, len);
2460 return len;
2461 }
2462
2463 /* file security operations */
2464
2465 static int selinux_file_permission(struct file *file, int mask)
2466 {
2467 int rc;
2468 struct inode *inode = file->f_path.dentry->d_inode;
2469
2470 if (!mask) {
2471 /* No permission to check. Existence test. */
2472 return 0;
2473 }
2474
2475 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2476 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2477 mask |= MAY_APPEND;
2478
2479 rc = file_has_perm(current, file,
2480 file_mask_to_av(inode->i_mode, mask));
2481 if (rc)
2482 return rc;
2483
2484 return selinux_netlbl_inode_permission(inode, mask);
2485 }
2486
2487 static int selinux_file_alloc_security(struct file *file)
2488 {
2489 return file_alloc_security(file);
2490 }
2491
2492 static void selinux_file_free_security(struct file *file)
2493 {
2494 file_free_security(file);
2495 }
2496
2497 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2498 unsigned long arg)
2499 {
2500 int error = 0;
2501
2502 switch (cmd) {
2503 case FIONREAD:
2504 /* fall through */
2505 case FIBMAP:
2506 /* fall through */
2507 case FIGETBSZ:
2508 /* fall through */
2509 case EXT2_IOC_GETFLAGS:
2510 /* fall through */
2511 case EXT2_IOC_GETVERSION:
2512 error = file_has_perm(current, file, FILE__GETATTR);
2513 break;
2514
2515 case EXT2_IOC_SETFLAGS:
2516 /* fall through */
2517 case EXT2_IOC_SETVERSION:
2518 error = file_has_perm(current, file, FILE__SETATTR);
2519 break;
2520
2521 /* sys_ioctl() checks */
2522 case FIONBIO:
2523 /* fall through */
2524 case FIOASYNC:
2525 error = file_has_perm(current, file, 0);
2526 break;
2527
2528 case KDSKBENT:
2529 case KDSKBSENT:
2530 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2531 break;
2532
2533 /* default case assumes that the command will go
2534 * to the file's ioctl() function.
2535 */
2536 default:
2537 error = file_has_perm(current, file, FILE__IOCTL);
2538
2539 }
2540 return error;
2541 }
2542
2543 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2544 {
2545 #ifndef CONFIG_PPC32
2546 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2547 /*
2548 * We are making executable an anonymous mapping or a
2549 * private file mapping that will also be writable.
2550 * This has an additional check.
2551 */
2552 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2553 if (rc)
2554 return rc;
2555 }
2556 #endif
2557
2558 if (file) {
2559 /* read access is always possible with a mapping */
2560 u32 av = FILE__READ;
2561
2562 /* write access only matters if the mapping is shared */
2563 if (shared && (prot & PROT_WRITE))
2564 av |= FILE__WRITE;
2565
2566 if (prot & PROT_EXEC)
2567 av |= FILE__EXECUTE;
2568
2569 return file_has_perm(current, file, av);
2570 }
2571 return 0;
2572 }
2573
2574 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2575 unsigned long prot, unsigned long flags,
2576 unsigned long addr, unsigned long addr_only)
2577 {
2578 int rc = 0;
2579 u32 sid = ((struct task_security_struct*)(current->security))->sid;
2580
2581 if (addr < mmap_min_addr)
2582 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2583 MEMPROTECT__MMAP_ZERO, NULL);
2584 if (rc || addr_only)
2585 return rc;
2586
2587 if (selinux_checkreqprot)
2588 prot = reqprot;
2589
2590 return file_map_prot_check(file, prot,
2591 (flags & MAP_TYPE) == MAP_SHARED);
2592 }
2593
2594 static int selinux_file_mprotect(struct vm_area_struct *vma,
2595 unsigned long reqprot,
2596 unsigned long prot)
2597 {
2598 int rc;
2599
2600 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2601 if (rc)
2602 return rc;
2603
2604 if (selinux_checkreqprot)
2605 prot = reqprot;
2606
2607 #ifndef CONFIG_PPC32
2608 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2609 rc = 0;
2610 if (vma->vm_start >= vma->vm_mm->start_brk &&
2611 vma->vm_end <= vma->vm_mm->brk) {
2612 rc = task_has_perm(current, current,
2613 PROCESS__EXECHEAP);
2614 } else if (!vma->vm_file &&
2615 vma->vm_start <= vma->vm_mm->start_stack &&
2616 vma->vm_end >= vma->vm_mm->start_stack) {
2617 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2618 } else if (vma->vm_file && vma->anon_vma) {
2619 /*
2620 * We are making executable a file mapping that has
2621 * had some COW done. Since pages might have been
2622 * written, check ability to execute the possibly
2623 * modified content. This typically should only
2624 * occur for text relocations.
2625 */
2626 rc = file_has_perm(current, vma->vm_file,
2627 FILE__EXECMOD);
2628 }
2629 if (rc)
2630 return rc;
2631 }
2632 #endif
2633
2634 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2635 }
2636
2637 static int selinux_file_lock(struct file *file, unsigned int cmd)
2638 {
2639 return file_has_perm(current, file, FILE__LOCK);
2640 }
2641
2642 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2643 unsigned long arg)
2644 {
2645 int err = 0;
2646
2647 switch (cmd) {
2648 case F_SETFL:
2649 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2650 err = -EINVAL;
2651 break;
2652 }
2653
2654 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2655 err = file_has_perm(current, file,FILE__WRITE);
2656 break;
2657 }
2658 /* fall through */
2659 case F_SETOWN:
2660 case F_SETSIG:
2661 case F_GETFL:
2662 case F_GETOWN:
2663 case F_GETSIG:
2664 /* Just check FD__USE permission */
2665 err = file_has_perm(current, file, 0);
2666 break;
2667 case F_GETLK:
2668 case F_SETLK:
2669 case F_SETLKW:
2670 #if BITS_PER_LONG == 32
2671 case F_GETLK64:
2672 case F_SETLK64:
2673 case F_SETLKW64:
2674 #endif
2675 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2676 err = -EINVAL;
2677 break;
2678 }
2679 err = file_has_perm(current, file, FILE__LOCK);
2680 break;
2681 }
2682
2683 return err;
2684 }
2685
2686 static int selinux_file_set_fowner(struct file *file)
2687 {
2688 struct task_security_struct *tsec;
2689 struct file_security_struct *fsec;
2690
2691 tsec = current->security;
2692 fsec = file->f_security;
2693 fsec->fown_sid = tsec->sid;
2694
2695 return 0;
2696 }
2697
2698 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2699 struct fown_struct *fown, int signum)
2700 {
2701 struct file *file;
2702 u32 perm;
2703 struct task_security_struct *tsec;
2704 struct file_security_struct *fsec;
2705
2706 /* struct fown_struct is never outside the context of a struct file */
2707 file = container_of(fown, struct file, f_owner);
2708
2709 tsec = tsk->security;
2710 fsec = file->f_security;
2711
2712 if (!signum)
2713 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2714 else
2715 perm = signal_to_av(signum);
2716
2717 return avc_has_perm(fsec->fown_sid, tsec->sid,
2718 SECCLASS_PROCESS, perm, NULL);
2719 }
2720
2721 static int selinux_file_receive(struct file *file)
2722 {
2723 return file_has_perm(current, file, file_to_av(file));
2724 }
2725
2726 /* task security operations */
2727
2728 static int selinux_task_create(unsigned long clone_flags)
2729 {
2730 int rc;
2731
2732 rc = secondary_ops->task_create(clone_flags);
2733 if (rc)
2734 return rc;
2735
2736 return task_has_perm(current, current, PROCESS__FORK);
2737 }
2738
2739 static int selinux_task_alloc_security(struct task_struct *tsk)
2740 {
2741 struct task_security_struct *tsec1, *tsec2;
2742 int rc;
2743
2744 tsec1 = current->security;
2745
2746 rc = task_alloc_security(tsk);
2747 if (rc)
2748 return rc;
2749 tsec2 = tsk->security;
2750
2751 tsec2->osid = tsec1->osid;
2752 tsec2->sid = tsec1->sid;
2753
2754 /* Retain the exec, fs, key, and sock SIDs across fork */
2755 tsec2->exec_sid = tsec1->exec_sid;
2756 tsec2->create_sid = tsec1->create_sid;
2757 tsec2->keycreate_sid = tsec1->keycreate_sid;
2758 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2759
2760 /* Retain ptracer SID across fork, if any.
2761 This will be reset by the ptrace hook upon any
2762 subsequent ptrace_attach operations. */
2763 tsec2->ptrace_sid = tsec1->ptrace_sid;
2764
2765 return 0;
2766 }
2767
2768 static void selinux_task_free_security(struct task_struct *tsk)
2769 {
2770 task_free_security(tsk);
2771 }
2772
2773 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2774 {
2775 /* Since setuid only affects the current process, and
2776 since the SELinux controls are not based on the Linux
2777 identity attributes, SELinux does not need to control
2778 this operation. However, SELinux does control the use
2779 of the CAP_SETUID and CAP_SETGID capabilities using the
2780 capable hook. */
2781 return 0;
2782 }
2783
2784 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2785 {
2786 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2787 }
2788
2789 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2790 {
2791 /* See the comment for setuid above. */
2792 return 0;
2793 }
2794
2795 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2796 {
2797 return task_has_perm(current, p, PROCESS__SETPGID);
2798 }
2799
2800 static int selinux_task_getpgid(struct task_struct *p)
2801 {
2802 return task_has_perm(current, p, PROCESS__GETPGID);
2803 }
2804
2805 static int selinux_task_getsid(struct task_struct *p)
2806 {
2807 return task_has_perm(current, p, PROCESS__GETSESSION);
2808 }
2809
2810 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2811 {
2812 selinux_get_task_sid(p, secid);
2813 }
2814
2815 static int selinux_task_setgroups(struct group_info *group_info)
2816 {
2817 /* See the comment for setuid above. */
2818 return 0;
2819 }
2820
2821 static int selinux_task_setnice(struct task_struct *p, int nice)
2822 {
2823 int rc;
2824
2825 rc = secondary_ops->task_setnice(p, nice);
2826 if (rc)
2827 return rc;
2828
2829 return task_has_perm(current,p, PROCESS__SETSCHED);
2830 }
2831
2832 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2833 {
2834 return task_has_perm(current, p, PROCESS__SETSCHED);
2835 }
2836
2837 static int selinux_task_getioprio(struct task_struct *p)
2838 {
2839 return task_has_perm(current, p, PROCESS__GETSCHED);
2840 }
2841
2842 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2843 {
2844 struct rlimit *old_rlim = current->signal->rlim + resource;
2845 int rc;
2846
2847 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2848 if (rc)
2849 return rc;
2850
2851 /* Control the ability to change the hard limit (whether
2852 lowering or raising it), so that the hard limit can
2853 later be used as a safe reset point for the soft limit
2854 upon context transitions. See selinux_bprm_apply_creds. */
2855 if (old_rlim->rlim_max != new_rlim->rlim_max)
2856 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2857
2858 return 0;
2859 }
2860
2861 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2862 {
2863 return task_has_perm(current, p, PROCESS__SETSCHED);
2864 }
2865
2866 static int selinux_task_getscheduler(struct task_struct *p)
2867 {
2868 return task_has_perm(current, p, PROCESS__GETSCHED);
2869 }
2870
2871 static int selinux_task_movememory(struct task_struct *p)
2872 {
2873 return task_has_perm(current, p, PROCESS__SETSCHED);
2874 }
2875
2876 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2877 int sig, u32 secid)
2878 {
2879 u32 perm;
2880 int rc;
2881 struct task_security_struct *tsec;
2882
2883 rc = secondary_ops->task_kill(p, info, sig, secid);
2884 if (rc)
2885 return rc;
2886
2887 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2888 return 0;
2889
2890 if (!sig)
2891 perm = PROCESS__SIGNULL; /* null signal; existence test */
2892 else
2893 perm = signal_to_av(sig);
2894 tsec = p->security;
2895 if (secid)
2896 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2897 else
2898 rc = task_has_perm(current, p, perm);
2899 return rc;
2900 }
2901
2902 static int selinux_task_prctl(int option,
2903 unsigned long arg2,
2904 unsigned long arg3,
2905 unsigned long arg4,
2906 unsigned long arg5)
2907 {
2908 /* The current prctl operations do not appear to require
2909 any SELinux controls since they merely observe or modify
2910 the state of the current process. */
2911 return 0;
2912 }
2913
2914 static int selinux_task_wait(struct task_struct *p)
2915 {
2916 u32 perm;
2917
2918 perm = signal_to_av(p->exit_signal);
2919
2920 return task_has_perm(p, current, perm);
2921 }
2922
2923 static void selinux_task_reparent_to_init(struct task_struct *p)
2924 {
2925 struct task_security_struct *tsec;
2926
2927 secondary_ops->task_reparent_to_init(p);
2928
2929 tsec = p->security;
2930 tsec->osid = tsec->sid;
2931 tsec->sid = SECINITSID_KERNEL;
2932 return;
2933 }
2934
2935 static void selinux_task_to_inode(struct task_struct *p,
2936 struct inode *inode)
2937 {
2938 struct task_security_struct *tsec = p->security;
2939 struct inode_security_struct *isec = inode->i_security;
2940
2941 isec->sid = tsec->sid;
2942 isec->initialized = 1;
2943 return;
2944 }
2945
2946 /* Returns error only if unable to parse addresses */
2947 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2948 struct avc_audit_data *ad, u8 *proto)
2949 {
2950 int offset, ihlen, ret = -EINVAL;
2951 struct iphdr _iph, *ih;
2952
2953 offset = skb_network_offset(skb);
2954 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2955 if (ih == NULL)
2956 goto out;
2957
2958 ihlen = ih->ihl * 4;
2959 if (ihlen < sizeof(_iph))
2960 goto out;
2961
2962 ad->u.net.v4info.saddr = ih->saddr;
2963 ad->u.net.v4info.daddr = ih->daddr;
2964 ret = 0;
2965
2966 if (proto)
2967 *proto = ih->protocol;
2968
2969 switch (ih->protocol) {
2970 case IPPROTO_TCP: {
2971 struct tcphdr _tcph, *th;
2972
2973 if (ntohs(ih->frag_off) & IP_OFFSET)
2974 break;
2975
2976 offset += ihlen;
2977 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2978 if (th == NULL)
2979 break;
2980
2981 ad->u.net.sport = th->source;
2982 ad->u.net.dport = th->dest;
2983 break;
2984 }
2985
2986 case IPPROTO_UDP: {
2987 struct udphdr _udph, *uh;
2988
2989 if (ntohs(ih->frag_off) & IP_OFFSET)
2990 break;
2991
2992 offset += ihlen;
2993 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2994 if (uh == NULL)
2995 break;
2996
2997 ad->u.net.sport = uh->source;
2998 ad->u.net.dport = uh->dest;
2999 break;
3000 }
3001
3002 case IPPROTO_DCCP: {
3003 struct dccp_hdr _dccph, *dh;
3004
3005 if (ntohs(ih->frag_off) & IP_OFFSET)
3006 break;
3007
3008 offset += ihlen;
3009 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3010 if (dh == NULL)
3011 break;
3012
3013 ad->u.net.sport = dh->dccph_sport;
3014 ad->u.net.dport = dh->dccph_dport;
3015 break;
3016 }
3017
3018 default:
3019 break;
3020 }
3021 out:
3022 return ret;
3023 }
3024
3025 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3026
3027 /* Returns error only if unable to parse addresses */
3028 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3029 struct avc_audit_data *ad, u8 *proto)
3030 {
3031 u8 nexthdr;
3032 int ret = -EINVAL, offset;
3033 struct ipv6hdr _ipv6h, *ip6;
3034
3035 offset = skb_network_offset(skb);
3036 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3037 if (ip6 == NULL)
3038 goto out;
3039
3040 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3041 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3042 ret = 0;
3043
3044 nexthdr = ip6->nexthdr;
3045 offset += sizeof(_ipv6h);
3046 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3047 if (offset < 0)
3048 goto out;
3049
3050 if (proto)
3051 *proto = nexthdr;
3052
3053 switch (nexthdr) {
3054 case IPPROTO_TCP: {
3055 struct tcphdr _tcph, *th;
3056
3057 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3058 if (th == NULL)
3059 break;
3060
3061 ad->u.net.sport = th->source;
3062 ad->u.net.dport = th->dest;
3063 break;
3064 }
3065
3066 case IPPROTO_UDP: {
3067 struct udphdr _udph, *uh;
3068
3069 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3070 if (uh == NULL)
3071 break;
3072
3073 ad->u.net.sport = uh->source;
3074 ad->u.net.dport = uh->dest;
3075 break;
3076 }
3077
3078 case IPPROTO_DCCP: {
3079 struct dccp_hdr _dccph, *dh;
3080
3081 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3082 if (dh == NULL)
3083 break;
3084
3085 ad->u.net.sport = dh->dccph_sport;
3086 ad->u.net.dport = dh->dccph_dport;
3087 break;
3088 }
3089
3090 /* includes fragments */
3091 default:
3092 break;
3093 }
3094 out:
3095 return ret;
3096 }
3097
3098 #endif /* IPV6 */
3099
3100 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3101 char **addrp, int *len, int src, u8 *proto)
3102 {
3103 int ret = 0;
3104
3105 switch (ad->u.net.family) {
3106 case PF_INET:
3107 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3108 if (ret || !addrp)
3109 break;
3110 *len = 4;
3111 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3112 &ad->u.net.v4info.daddr);
3113 break;
3114
3115 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3116 case PF_INET6:
3117 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3118 if (ret || !addrp)
3119 break;
3120 *len = 16;
3121 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3122 &ad->u.net.v6info.daddr);
3123 break;
3124 #endif /* IPV6 */
3125 default:
3126 break;
3127 }
3128
3129 return ret;
3130 }
3131
3132 /**
3133 * selinux_skb_extlbl_sid - Determine the external label of a packet
3134 * @skb: the packet
3135 * @sid: the packet's SID
3136 *
3137 * Description:
3138 * Check the various different forms of external packet labeling and determine
3139 * the external SID for the packet. If only one form of external labeling is
3140 * present then it is used, if both labeled IPsec and NetLabel labels are
3141 * present then the SELinux type information is taken from the labeled IPsec
3142 * SA and the MLS sensitivity label information is taken from the NetLabel
3143 * security attributes. This bit of "magic" is done in the call to
3144 * selinux_netlbl_skbuff_getsid().
3145 *
3146 */
3147 static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
3148 {
3149 u32 xfrm_sid;
3150 u32 nlbl_sid;
3151
3152 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3153 if (selinux_netlbl_skbuff_getsid(skb,
3154 (xfrm_sid == SECSID_NULL ?
3155 SECINITSID_NETMSG : xfrm_sid),
3156 &nlbl_sid) != 0)
3157 nlbl_sid = SECSID_NULL;
3158 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3159 }
3160
3161 /* socket security operations */
3162 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3163 u32 perms)
3164 {
3165 struct inode_security_struct *isec;
3166 struct task_security_struct *tsec;
3167 struct avc_audit_data ad;
3168 int err = 0;
3169
3170 tsec = task->security;
3171 isec = SOCK_INODE(sock)->i_security;
3172
3173 if (isec->sid == SECINITSID_KERNEL)
3174 goto out;
3175
3176 AVC_AUDIT_DATA_INIT(&ad,NET);
3177 ad.u.net.sk = sock->sk;
3178 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3179
3180 out:
3181 return err;
3182 }
3183
3184 static int selinux_socket_create(int family, int type,
3185 int protocol, int kern)
3186 {
3187 int err = 0;
3188 struct task_security_struct *tsec;
3189 u32 newsid;
3190
3191 if (kern)
3192 goto out;
3193
3194 tsec = current->security;
3195 newsid = tsec->sockcreate_sid ? : tsec->sid;
3196 err = avc_has_perm(tsec->sid, newsid,
3197 socket_type_to_security_class(family, type,
3198 protocol), SOCKET__CREATE, NULL);
3199
3200 out:
3201 return err;
3202 }
3203
3204 static int selinux_socket_post_create(struct socket *sock, int family,
3205 int type, int protocol, int kern)
3206 {
3207 int err = 0;
3208 struct inode_security_struct *isec;
3209 struct task_security_struct *tsec;
3210 struct sk_security_struct *sksec;
3211 u32 newsid;
3212
3213 isec = SOCK_INODE(sock)->i_security;
3214
3215 tsec = current->security;
3216 newsid = tsec->sockcreate_sid ? : tsec->sid;
3217 isec->sclass = socket_type_to_security_class(family, type, protocol);
3218 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3219 isec->initialized = 1;
3220
3221 if (sock->sk) {
3222 sksec = sock->sk->sk_security;
3223 sksec->sid = isec->sid;
3224 err = selinux_netlbl_socket_post_create(sock);
3225 }
3226
3227 return err;
3228 }
3229
3230 /* Range of port numbers used to automatically bind.
3231 Need to determine whether we should perform a name_bind
3232 permission check between the socket and the port number. */
3233 #define ip_local_port_range_0 sysctl_local_port_range[0]
3234 #define ip_local_port_range_1 sysctl_local_port_range[1]
3235
3236 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3237 {
3238 u16 family;
3239 int err;
3240
3241 err = socket_has_perm(current, sock, SOCKET__BIND);
3242 if (err)
3243 goto out;
3244
3245 /*
3246 * If PF_INET or PF_INET6, check name_bind permission for the port.
3247 * Multiple address binding for SCTP is not supported yet: we just
3248 * check the first address now.
3249 */
3250 family = sock->sk->sk_family;
3251 if (family == PF_INET || family == PF_INET6) {
3252 char *addrp;
3253 struct inode_security_struct *isec;
3254 struct task_security_struct *tsec;
3255 struct avc_audit_data ad;
3256 struct sockaddr_in *addr4 = NULL;
3257 struct sockaddr_in6 *addr6 = NULL;
3258 unsigned short snum;
3259 struct sock *sk = sock->sk;
3260 u32 sid, node_perm, addrlen;
3261
3262 tsec = current->security;
3263 isec = SOCK_INODE(sock)->i_security;
3264
3265 if (family == PF_INET) {
3266 addr4 = (struct sockaddr_in *)address;
3267 snum = ntohs(addr4->sin_port);
3268 addrlen = sizeof(addr4->sin_addr.s_addr);
3269 addrp = (char *)&addr4->sin_addr.s_addr;
3270 } else {
3271 addr6 = (struct sockaddr_in6 *)address;
3272 snum = ntohs(addr6->sin6_port);
3273 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3274 addrp = (char *)&addr6->sin6_addr.s6_addr;
3275 }
3276
3277 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3278 snum > ip_local_port_range_1)) {
3279 err = security_port_sid(sk->sk_family, sk->sk_type,
3280 sk->sk_protocol, snum, &sid);
3281 if (err)
3282 goto out;
3283 AVC_AUDIT_DATA_INIT(&ad,NET);
3284 ad.u.net.sport = htons(snum);
3285 ad.u.net.family = family;
3286 err = avc_has_perm(isec->sid, sid,
3287 isec->sclass,
3288 SOCKET__NAME_BIND, &ad);
3289 if (err)
3290 goto out;
3291 }
3292
3293 switch(isec->sclass) {
3294 case SECCLASS_TCP_SOCKET:
3295 node_perm = TCP_SOCKET__NODE_BIND;
3296 break;
3297
3298 case SECCLASS_UDP_SOCKET:
3299 node_perm = UDP_SOCKET__NODE_BIND;
3300 break;
3301
3302 case SECCLASS_DCCP_SOCKET:
3303 node_perm = DCCP_SOCKET__NODE_BIND;
3304 break;
3305
3306 default:
3307 node_perm = RAWIP_SOCKET__NODE_BIND;
3308 break;
3309 }
3310
3311 err = security_node_sid(family, addrp, addrlen, &sid);
3312 if (err)
3313 goto out;
3314
3315 AVC_AUDIT_DATA_INIT(&ad,NET);
3316 ad.u.net.sport = htons(snum);
3317 ad.u.net.family = family;
3318
3319 if (family == PF_INET)
3320 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3321 else
3322 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3323
3324 err = avc_has_perm(isec->sid, sid,
3325 isec->sclass, node_perm, &ad);
3326 if (err)
3327 goto out;
3328 }
3329 out:
3330 return err;
3331 }
3332
3333 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3334 {
3335 struct inode_security_struct *isec;
3336 int err;
3337
3338 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3339 if (err)
3340 return err;
3341
3342 /*
3343 * If a TCP or DCCP socket, check name_connect permission for the port.
3344 */
3345 isec = SOCK_INODE(sock)->i_security;
3346 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3347 isec->sclass == SECCLASS_DCCP_SOCKET) {
3348 struct sock *sk = sock->sk;
3349 struct avc_audit_data ad;
3350 struct sockaddr_in *addr4 = NULL;
3351 struct sockaddr_in6 *addr6 = NULL;
3352 unsigned short snum;
3353 u32 sid, perm;
3354
3355 if (sk->sk_family == PF_INET) {
3356 addr4 = (struct sockaddr_in *)address;
3357 if (addrlen < sizeof(struct sockaddr_in))
3358 return -EINVAL;
3359 snum = ntohs(addr4->sin_port);
3360 } else {
3361 addr6 = (struct sockaddr_in6 *)address;
3362 if (addrlen < SIN6_LEN_RFC2133)
3363 return -EINVAL;
3364 snum = ntohs(addr6->sin6_port);
3365 }
3366
3367 err = security_port_sid(sk->sk_family, sk->sk_type,
3368 sk->sk_protocol, snum, &sid);
3369 if (err)
3370 goto out;
3371
3372 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3373 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3374
3375 AVC_AUDIT_DATA_INIT(&ad,NET);
3376 ad.u.net.dport = htons(snum);
3377 ad.u.net.family = sk->sk_family;
3378 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3379 if (err)
3380 goto out;
3381 }
3382
3383 out:
3384 return err;
3385 }
3386
3387 static int selinux_socket_listen(struct socket *sock, int backlog)
3388 {
3389 return socket_has_perm(current, sock, SOCKET__LISTEN);
3390 }
3391
3392 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3393 {
3394 int err;
3395 struct inode_security_struct *isec;
3396 struct inode_security_struct *newisec;
3397
3398 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3399 if (err)
3400 return err;
3401
3402 newisec = SOCK_INODE(newsock)->i_security;
3403
3404 isec = SOCK_INODE(sock)->i_security;
3405 newisec->sclass = isec->sclass;
3406 newisec->sid = isec->sid;
3407 newisec->initialized = 1;
3408
3409 return 0;
3410 }
3411
3412 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3413 int size)
3414 {
3415 int rc;
3416
3417 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3418 if (rc)
3419 return rc;
3420
3421 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3422 }
3423
3424 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3425 int size, int flags)
3426 {
3427 return socket_has_perm(current, sock, SOCKET__READ);
3428 }
3429
3430 static int selinux_socket_getsockname(struct socket *sock)
3431 {
3432 return socket_has_perm(current, sock, SOCKET__GETATTR);
3433 }
3434
3435 static int selinux_socket_getpeername(struct socket *sock)
3436 {
3437 return socket_has_perm(current, sock, SOCKET__GETATTR);
3438 }
3439
3440 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3441 {
3442 int err;
3443
3444 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3445 if (err)
3446 return err;
3447
3448 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3449 }
3450
3451 static int selinux_socket_getsockopt(struct socket *sock, int level,
3452 int optname)
3453 {
3454 return socket_has_perm(current, sock, SOCKET__GETOPT);
3455 }
3456
3457 static int selinux_socket_shutdown(struct socket *sock, int how)
3458 {
3459 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3460 }
3461
3462 static int selinux_socket_unix_stream_connect(struct socket *sock,
3463 struct socket *other,
3464 struct sock *newsk)
3465 {
3466 struct sk_security_struct *ssec;
3467 struct inode_security_struct *isec;
3468 struct inode_security_struct *other_isec;
3469 struct avc_audit_data ad;
3470 int err;
3471
3472 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3473 if (err)
3474 return err;
3475
3476 isec = SOCK_INODE(sock)->i_security;
3477 other_isec = SOCK_INODE(other)->i_security;
3478
3479 AVC_AUDIT_DATA_INIT(&ad,NET);
3480 ad.u.net.sk = other->sk;
3481
3482 err = avc_has_perm(isec->sid, other_isec->sid,
3483 isec->sclass,
3484 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3485 if (err)
3486 return err;
3487
3488 /* connecting socket */
3489 ssec = sock->sk->sk_security;
3490 ssec->peer_sid = other_isec->sid;
3491
3492 /* server child socket */
3493 ssec = newsk->sk_security;
3494 ssec->peer_sid = isec->sid;
3495 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3496
3497 return err;
3498 }
3499
3500 static int selinux_socket_unix_may_send(struct socket *sock,
3501 struct socket *other)
3502 {
3503 struct inode_security_struct *isec;
3504 struct inode_security_struct *other_isec;
3505 struct avc_audit_data ad;
3506 int err;
3507
3508 isec = SOCK_INODE(sock)->i_security;
3509 other_isec = SOCK_INODE(other)->i_security;
3510
3511 AVC_AUDIT_DATA_INIT(&ad,NET);
3512 ad.u.net.sk = other->sk;
3513
3514 err = avc_has_perm(isec->sid, other_isec->sid,
3515 isec->sclass, SOCKET__SENDTO, &ad);
3516 if (err)
3517 return err;
3518
3519 return 0;
3520 }
3521
3522 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3523 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3524 {
3525 int err = 0;
3526 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3527 struct socket *sock;
3528 u16 sock_class = 0;
3529 u32 sock_sid = 0;
3530
3531 read_lock_bh(&sk->sk_callback_lock);
3532 sock = sk->sk_socket;
3533 if (sock) {
3534 struct inode *inode;
3535 inode = SOCK_INODE(sock);
3536 if (inode) {
3537 struct inode_security_struct *isec;
3538 isec = inode->i_security;
3539 sock_sid = isec->sid;
3540 sock_class = isec->sclass;
3541 }
3542 }
3543 read_unlock_bh(&sk->sk_callback_lock);
3544 if (!sock_sid)
3545 goto out;
3546
3547 if (!skb->dev)
3548 goto out;
3549
3550 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3551 if (err)
3552 goto out;
3553
3554 switch (sock_class) {
3555 case SECCLASS_UDP_SOCKET:
3556 netif_perm = NETIF__UDP_RECV;
3557 node_perm = NODE__UDP_RECV;
3558 recv_perm = UDP_SOCKET__RECV_MSG;
3559 break;
3560
3561 case SECCLASS_TCP_SOCKET:
3562 netif_perm = NETIF__TCP_RECV;
3563 node_perm = NODE__TCP_RECV;
3564 recv_perm = TCP_SOCKET__RECV_MSG;
3565 break;
3566
3567 case SECCLASS_DCCP_SOCKET:
3568 netif_perm = NETIF__DCCP_RECV;
3569 node_perm = NODE__DCCP_RECV;
3570 recv_perm = DCCP_SOCKET__RECV_MSG;
3571 break;
3572
3573 default:
3574 netif_perm = NETIF__RAWIP_RECV;
3575 node_perm = NODE__RAWIP_RECV;
3576 break;
3577 }
3578
3579 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3580 if (err)
3581 goto out;
3582
3583 err = security_node_sid(family, addrp, len, &node_sid);
3584 if (err)
3585 goto out;
3586
3587 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3588 if (err)
3589 goto out;
3590
3591 if (recv_perm) {
3592 u32 port_sid;
3593
3594 err = security_port_sid(sk->sk_family, sk->sk_type,
3595 sk->sk_protocol, ntohs(ad->u.net.sport),
3596 &port_sid);
3597 if (err)
3598 goto out;
3599
3600 err = avc_has_perm(sock_sid, port_sid,
3601 sock_class, recv_perm, ad);
3602 }
3603
3604 out:
3605 return err;
3606 }
3607
3608 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3609 {
3610 u16 family;
3611 char *addrp;
3612 int len, err = 0;
3613 struct avc_audit_data ad;
3614 struct sk_security_struct *sksec = sk->sk_security;
3615
3616 family = sk->sk_family;
3617 if (family != PF_INET && family != PF_INET6)
3618 goto out;
3619
3620 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3621 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3622 family = PF_INET;
3623
3624 AVC_AUDIT_DATA_INIT(&ad, NET);
3625 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3626 ad.u.net.family = family;
3627
3628 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3629 if (err)
3630 goto out;
3631
3632 if (selinux_compat_net)
3633 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3634 addrp, len);
3635 else
3636 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3637 PACKET__RECV, &ad);
3638 if (err)
3639 goto out;
3640
3641 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3642 if (err)
3643 goto out;
3644
3645 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3646 out:
3647 return err;
3648 }
3649
3650 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3651 int __user *optlen, unsigned len)
3652 {
3653 int err = 0;
3654 char *scontext;
3655 u32 scontext_len;
3656 struct sk_security_struct *ssec;
3657 struct inode_security_struct *isec;
3658 u32 peer_sid = SECSID_NULL;
3659
3660 isec = SOCK_INODE(sock)->i_security;
3661
3662 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3663 isec->sclass == SECCLASS_TCP_SOCKET) {
3664 ssec = sock->sk->sk_security;
3665 peer_sid = ssec->peer_sid;
3666 }
3667 if (peer_sid == SECSID_NULL) {
3668 err = -ENOPROTOOPT;
3669 goto out;
3670 }
3671
3672 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3673
3674 if (err)
3675 goto out;
3676
3677 if (scontext_len > len) {
3678 err = -ERANGE;
3679 goto out_len;
3680 }
3681
3682 if (copy_to_user(optval, scontext, scontext_len))
3683 err = -EFAULT;
3684
3685 out_len:
3686 if (put_user(scontext_len, optlen))
3687 err = -EFAULT;
3688
3689 kfree(scontext);
3690 out:
3691 return err;
3692 }
3693
3694 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3695 {
3696 u32 peer_secid = SECSID_NULL;
3697 int err = 0;
3698
3699 if (sock && sock->sk->sk_family == PF_UNIX)
3700 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3701 else if (skb)
3702 selinux_skb_extlbl_sid(skb, &peer_secid);
3703
3704 if (peer_secid == SECSID_NULL)
3705 err = -EINVAL;
3706 *secid = peer_secid;
3707
3708 return err;
3709 }
3710
3711 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3712 {
3713 return sk_alloc_security(sk, family, priority);
3714 }
3715
3716 static void selinux_sk_free_security(struct sock *sk)
3717 {
3718 sk_free_security(sk);
3719 }
3720
3721 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3722 {
3723 struct sk_security_struct *ssec = sk->sk_security;
3724 struct sk_security_struct *newssec = newsk->sk_security;
3725
3726 newssec->sid = ssec->sid;
3727 newssec->peer_sid = ssec->peer_sid;
3728
3729 selinux_netlbl_sk_security_clone(ssec, newssec);
3730 }
3731
3732 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3733 {
3734 if (!sk)
3735 *secid = SECINITSID_ANY_SOCKET;
3736 else {
3737 struct sk_security_struct *sksec = sk->sk_security;
3738
3739 *secid = sksec->sid;
3740 }
3741 }
3742
3743 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3744 {
3745 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3746 struct sk_security_struct *sksec = sk->sk_security;
3747
3748 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3749 sk->sk_family == PF_UNIX)
3750 isec->sid = sksec->sid;
3751
3752 selinux_netlbl_sock_graft(sk, parent);
3753 }
3754
3755 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3756 struct request_sock *req)
3757 {
3758 struct sk_security_struct *sksec = sk->sk_security;
3759 int err;
3760 u32 newsid;
3761 u32 peersid;
3762
3763 selinux_skb_extlbl_sid(skb, &peersid);
3764 if (peersid == SECSID_NULL) {
3765 req->secid = sksec->sid;
3766 req->peer_secid = SECSID_NULL;
3767 return 0;
3768 }
3769
3770 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3771 if (err)
3772 return err;
3773
3774 req->secid = newsid;
3775 req->peer_secid = peersid;
3776 return 0;
3777 }
3778
3779 static void selinux_inet_csk_clone(struct sock *newsk,
3780 const struct request_sock *req)
3781 {
3782 struct sk_security_struct *newsksec = newsk->sk_security;
3783
3784 newsksec->sid = req->secid;
3785 newsksec->peer_sid = req->peer_secid;
3786 /* NOTE: Ideally, we should also get the isec->sid for the
3787 new socket in sync, but we don't have the isec available yet.
3788 So we will wait until sock_graft to do it, by which
3789 time it will have been created and available. */
3790
3791 /* We don't need to take any sort of lock here as we are the only
3792 * thread with access to newsksec */
3793 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3794 }
3795
3796 static void selinux_inet_conn_established(struct sock *sk,
3797 struct sk_buff *skb)
3798 {
3799 struct sk_security_struct *sksec = sk->sk_security;
3800
3801 selinux_skb_extlbl_sid(skb, &sksec->peer_sid);
3802 }
3803
3804 static void selinux_req_classify_flow(const struct request_sock *req,
3805 struct flowi *fl)
3806 {
3807 fl->secid = req->secid;
3808 }
3809
3810 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3811 {
3812 int err = 0;
3813 u32 perm;
3814 struct nlmsghdr *nlh;
3815 struct socket *sock = sk->sk_socket;
3816 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3817
3818 if (skb->len < NLMSG_SPACE(0)) {
3819 err = -EINVAL;
3820 goto out;
3821 }
3822 nlh = nlmsg_hdr(skb);
3823
3824 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3825 if (err) {
3826 if (err == -EINVAL) {
3827 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3828 "SELinux: unrecognized netlink message"
3829 " type=%hu for sclass=%hu\n",
3830 nlh->nlmsg_type, isec->sclass);
3831 if (!selinux_enforcing)
3832 err = 0;
3833 }
3834
3835 /* Ignore */
3836 if (err == -ENOENT)
3837 err = 0;
3838 goto out;
3839 }
3840
3841 err = socket_has_perm(current, sock, perm);
3842 out:
3843 return err;
3844 }
3845
3846 #ifdef CONFIG_NETFILTER
3847
3848 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3849 struct avc_audit_data *ad,
3850 u16 family, char *addrp, int len)
3851 {
3852 int err = 0;
3853 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3854 struct socket *sock;
3855 struct inode *inode;
3856 struct inode_security_struct *isec;
3857
3858 sock = sk->sk_socket;
3859 if (!sock)
3860 goto out;
3861
3862 inode = SOCK_INODE(sock);
3863 if (!inode)
3864 goto out;
3865
3866 isec = inode->i_security;
3867
3868 err = sel_netif_sids(dev, &if_sid, NULL);
3869 if (err)
3870 goto out;
3871
3872 switch (isec->sclass) {
3873 case SECCLASS_UDP_SOCKET:
3874 netif_perm = NETIF__UDP_SEND;
3875 node_perm = NODE__UDP_SEND;
3876 send_perm = UDP_SOCKET__SEND_MSG;
3877 break;
3878
3879 case SECCLASS_TCP_SOCKET:
3880 netif_perm = NETIF__TCP_SEND;
3881 node_perm = NODE__TCP_SEND;
3882 send_perm = TCP_SOCKET__SEND_MSG;
3883 break;
3884
3885 case SECCLASS_DCCP_SOCKET:
3886 netif_perm = NETIF__DCCP_SEND;
3887 node_perm = NODE__DCCP_SEND;
3888 send_perm = DCCP_SOCKET__SEND_MSG;
3889 break;
3890
3891 default:
3892 netif_perm = NETIF__RAWIP_SEND;
3893 node_perm = NODE__RAWIP_SEND;
3894 break;
3895 }
3896
3897 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3898 if (err)
3899 goto out;
3900
3901 err = security_node_sid(family, addrp, len, &node_sid);
3902 if (err)
3903 goto out;
3904
3905 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3906 if (err)
3907 goto out;
3908
3909 if (send_perm) {
3910 u32 port_sid;
3911
3912 err = security_port_sid(sk->sk_family,
3913 sk->sk_type,
3914 sk->sk_protocol,
3915 ntohs(ad->u.net.dport),
3916 &port_sid);
3917 if (err)
3918 goto out;
3919
3920 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3921 send_perm, ad);
3922 }
3923 out:
3924 return err;
3925 }
3926
3927 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3928 struct sk_buff **pskb,
3929 const struct net_device *in,
3930 const struct net_device *out,
3931 int (*okfn)(struct sk_buff *),
3932 u16 family)
3933 {
3934 char *addrp;
3935 int len, err = 0;
3936 struct sock *sk;
3937 struct sk_buff *skb = *pskb;
3938 struct avc_audit_data ad;
3939 struct net_device *dev = (struct net_device *)out;
3940 struct sk_security_struct *sksec;
3941 u8 proto;
3942
3943 sk = skb->sk;
3944 if (!sk)
3945 goto out;
3946
3947 sksec = sk->sk_security;
3948
3949 AVC_AUDIT_DATA_INIT(&ad, NET);
3950 ad.u.net.netif = dev->name;
3951 ad.u.net.family = family;
3952
3953 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3954 if (err)
3955 goto out;
3956
3957 if (selinux_compat_net)
3958 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3959 family, addrp, len);
3960 else
3961 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3962 PACKET__SEND, &ad);
3963
3964 if (err)
3965 goto out;
3966
3967 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3968 out:
3969 return err ? NF_DROP : NF_ACCEPT;
3970 }
3971
3972 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3973 struct sk_buff **pskb,
3974 const struct net_device *in,
3975 const struct net_device *out,
3976 int (*okfn)(struct sk_buff *))
3977 {
3978 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3979 }
3980
3981 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3982
3983 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3984 struct sk_buff **pskb,
3985 const struct net_device *in,
3986 const struct net_device *out,
3987 int (*okfn)(struct sk_buff *))
3988 {
3989 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3990 }
3991
3992 #endif /* IPV6 */
3993
3994 #endif /* CONFIG_NETFILTER */
3995
3996 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3997 {
3998 int err;
3999
4000 err = secondary_ops->netlink_send(sk, skb);
4001 if (err)
4002 return err;
4003
4004 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4005 err = selinux_nlmsg_perm(sk, skb);
4006
4007 return err;
4008 }
4009
4010 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4011 {
4012 int err;
4013 struct avc_audit_data ad;
4014
4015 err = secondary_ops->netlink_recv(skb, capability);
4016 if (err)
4017 return err;
4018
4019 AVC_AUDIT_DATA_INIT(&ad, CAP);
4020 ad.u.cap = capability;
4021
4022 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4023 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4024 }
4025
4026 static int ipc_alloc_security(struct task_struct *task,
4027 struct kern_ipc_perm *perm,
4028 u16 sclass)
4029 {
4030 struct task_security_struct *tsec = task->security;
4031 struct ipc_security_struct *isec;
4032
4033 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4034 if (!isec)
4035 return -ENOMEM;
4036
4037 isec->sclass = sclass;
4038 isec->ipc_perm = perm;
4039 isec->sid = tsec->sid;
4040 perm->security = isec;
4041
4042 return 0;
4043 }
4044
4045 static void ipc_free_security(struct kern_ipc_perm *perm)
4046 {
4047 struct ipc_security_struct *isec = perm->security;
4048 perm->security = NULL;
4049 kfree(isec);
4050 }
4051
4052 static int msg_msg_alloc_security(struct msg_msg *msg)
4053 {
4054 struct msg_security_struct *msec;
4055
4056 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4057 if (!msec)
4058 return -ENOMEM;
4059
4060 msec->msg = msg;
4061 msec->sid = SECINITSID_UNLABELED;
4062 msg->security = msec;
4063
4064 return 0;
4065 }
4066
4067 static void msg_msg_free_security(struct msg_msg *msg)
4068 {
4069 struct msg_security_struct *msec = msg->security;
4070
4071 msg->security = NULL;
4072 kfree(msec);
4073 }
4074
4075 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4076 u32 perms)
4077 {
4078 struct task_security_struct *tsec;
4079 struct ipc_security_struct *isec;
4080 struct avc_audit_data ad;
4081
4082 tsec = current->security;
4083 isec = ipc_perms->security;
4084
4085 AVC_AUDIT_DATA_INIT(&ad, IPC);
4086 ad.u.ipc_id = ipc_perms->key;
4087
4088 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4089 }
4090
4091 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4092 {
4093 return msg_msg_alloc_security(msg);
4094 }
4095
4096 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4097 {
4098 msg_msg_free_security(msg);
4099 }
4100
4101 /* message queue security operations */
4102 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4103 {
4104 struct task_security_struct *tsec;
4105 struct ipc_security_struct *isec;
4106 struct avc_audit_data ad;
4107 int rc;
4108
4109 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4110 if (rc)
4111 return rc;
4112
4113 tsec = current->security;
4114 isec = msq->q_perm.security;
4115
4116 AVC_AUDIT_DATA_INIT(&ad, IPC);
4117 ad.u.ipc_id = msq->q_perm.key;
4118
4119 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4120 MSGQ__CREATE, &ad);
4121 if (rc) {
4122 ipc_free_security(&msq->q_perm);
4123 return rc;
4124 }
4125 return 0;
4126 }
4127
4128 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4129 {
4130 ipc_free_security(&msq->q_perm);
4131 }
4132
4133 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4134 {
4135 struct task_security_struct *tsec;
4136 struct ipc_security_struct *isec;
4137 struct avc_audit_data ad;
4138
4139 tsec = current->security;
4140 isec = msq->q_perm.security;
4141
4142 AVC_AUDIT_DATA_INIT(&ad, IPC);
4143 ad.u.ipc_id = msq->q_perm.key;
4144
4145 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4146 MSGQ__ASSOCIATE, &ad);
4147 }
4148
4149 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4150 {
4151 int err;
4152 int perms;
4153
4154 switch(cmd) {
4155 case IPC_INFO:
4156 case MSG_INFO:
4157 /* No specific object, just general system-wide information. */
4158 return task_has_system(current, SYSTEM__IPC_INFO);
4159 case IPC_STAT:
4160 case MSG_STAT:
4161 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4162 break;
4163 case IPC_SET:
4164 perms = MSGQ__SETATTR;
4165 break;
4166 case IPC_RMID:
4167 perms = MSGQ__DESTROY;
4168 break;
4169 default:
4170 return 0;
4171 }
4172
4173 err = ipc_has_perm(&msq->q_perm, perms);
4174 return err;
4175 }
4176
4177 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4178 {
4179 struct task_security_struct *tsec;
4180 struct ipc_security_struct *isec;
4181 struct msg_security_struct *msec;
4182 struct avc_audit_data ad;
4183 int rc;
4184
4185 tsec = current->security;
4186 isec = msq->q_perm.security;
4187 msec = msg->security;
4188
4189 /*
4190 * First time through, need to assign label to the message
4191 */
4192 if (msec->sid == SECINITSID_UNLABELED) {
4193 /*
4194 * Compute new sid based on current process and
4195 * message queue this message will be stored in
4196 */
4197 rc = security_transition_sid(tsec->sid,
4198 isec->sid,
4199 SECCLASS_MSG,
4200 &msec->sid);
4201 if (rc)
4202 return rc;
4203 }
4204
4205 AVC_AUDIT_DATA_INIT(&ad, IPC);
4206 ad.u.ipc_id = msq->q_perm.key;
4207
4208 /* Can this process write to the queue? */
4209 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4210 MSGQ__WRITE, &ad);
4211 if (!rc)
4212 /* Can this process send the message */
4213 rc = avc_has_perm(tsec->sid, msec->sid,
4214 SECCLASS_MSG, MSG__SEND, &ad);
4215 if (!rc)
4216 /* Can the message be put in the queue? */
4217 rc = avc_has_perm(msec->sid, isec->sid,
4218 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4219
4220 return rc;
4221 }
4222
4223 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4224 struct task_struct *target,
4225 long type, int mode)
4226 {
4227 struct task_security_struct *tsec;
4228 struct ipc_security_struct *isec;
4229 struct msg_security_struct *msec;
4230 struct avc_audit_data ad;
4231 int rc;
4232
4233 tsec = target->security;
4234 isec = msq->q_perm.security;
4235 msec = msg->security;
4236
4237 AVC_AUDIT_DATA_INIT(&ad, IPC);
4238 ad.u.ipc_id = msq->q_perm.key;
4239
4240 rc = avc_has_perm(tsec->sid, isec->sid,
4241 SECCLASS_MSGQ, MSGQ__READ, &ad);
4242 if (!rc)
4243 rc = avc_has_perm(tsec->sid, msec->sid,
4244 SECCLASS_MSG, MSG__RECEIVE, &ad);
4245 return rc;
4246 }
4247
4248 /* Shared Memory security operations */
4249 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4250 {
4251 struct task_security_struct *tsec;
4252 struct ipc_security_struct *isec;
4253 struct avc_audit_data ad;
4254 int rc;
4255
4256 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4257 if (rc)
4258 return rc;
4259
4260 tsec = current->security;
4261 isec = shp->shm_perm.security;
4262
4263 AVC_AUDIT_DATA_INIT(&ad, IPC);
4264 ad.u.ipc_id = shp->shm_perm.key;
4265
4266 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4267 SHM__CREATE, &ad);
4268 if (rc) {
4269 ipc_free_security(&shp->shm_perm);
4270 return rc;
4271 }
4272 return 0;
4273 }
4274
4275 static void selinux_shm_free_security(struct shmid_kernel *shp)
4276 {
4277 ipc_free_security(&shp->shm_perm);
4278 }
4279
4280 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4281 {
4282 struct task_security_struct *tsec;
4283 struct ipc_security_struct *isec;
4284 struct avc_audit_data ad;
4285
4286 tsec = current->security;
4287 isec = shp->shm_perm.security;
4288
4289 AVC_AUDIT_DATA_INIT(&ad, IPC);
4290 ad.u.ipc_id = shp->shm_perm.key;
4291
4292 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4293 SHM__ASSOCIATE, &ad);
4294 }
4295
4296 /* Note, at this point, shp is locked down */
4297 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4298 {
4299 int perms;
4300 int err;
4301
4302 switch(cmd) {
4303 case IPC_INFO:
4304 case SHM_INFO:
4305 /* No specific object, just general system-wide information. */
4306 return task_has_system(current, SYSTEM__IPC_INFO);
4307 case IPC_STAT:
4308 case SHM_STAT:
4309 perms = SHM__GETATTR | SHM__ASSOCIATE;
4310 break;
4311 case IPC_SET:
4312 perms = SHM__SETATTR;
4313 break;
4314 case SHM_LOCK:
4315 case SHM_UNLOCK:
4316 perms = SHM__LOCK;
4317 break;
4318 case IPC_RMID:
4319 perms = SHM__DESTROY;
4320 break;
4321 default:
4322 return 0;
4323 }
4324
4325 err = ipc_has_perm(&shp->shm_perm, perms);
4326 return err;
4327 }
4328
4329 static int selinux_shm_shmat(struct shmid_kernel *shp,
4330 char __user *shmaddr, int shmflg)
4331 {
4332 u32 perms;
4333 int rc;
4334
4335 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4336 if (rc)
4337 return rc;
4338
4339 if (shmflg & SHM_RDONLY)
4340 perms = SHM__READ;
4341 else
4342 perms = SHM__READ | SHM__WRITE;
4343
4344 return ipc_has_perm(&shp->shm_perm, perms);
4345 }
4346
4347 /* Semaphore security operations */
4348 static int selinux_sem_alloc_security(struct sem_array *sma)
4349 {
4350 struct task_security_struct *tsec;
4351 struct ipc_security_struct *isec;
4352 struct avc_audit_data ad;
4353 int rc;
4354
4355 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4356 if (rc)
4357 return rc;
4358
4359 tsec = current->security;
4360 isec = sma->sem_perm.security;
4361
4362 AVC_AUDIT_DATA_INIT(&ad, IPC);
4363 ad.u.ipc_id = sma->sem_perm.key;
4364
4365 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4366 SEM__CREATE, &ad);
4367 if (rc) {
4368 ipc_free_security(&sma->sem_perm);
4369 return rc;
4370 }
4371 return 0;
4372 }
4373
4374 static void selinux_sem_free_security(struct sem_array *sma)
4375 {
4376 ipc_free_security(&sma->sem_perm);
4377 }
4378
4379 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4380 {
4381 struct task_security_struct *tsec;
4382 struct ipc_security_struct *isec;
4383 struct avc_audit_data ad;
4384
4385 tsec = current->security;
4386 isec = sma->sem_perm.security;
4387
4388 AVC_AUDIT_DATA_INIT(&ad, IPC);
4389 ad.u.ipc_id = sma->sem_perm.key;
4390
4391 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4392 SEM__ASSOCIATE, &ad);
4393 }
4394
4395 /* Note, at this point, sma is locked down */
4396 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4397 {
4398 int err;
4399 u32 perms;
4400
4401 switch(cmd) {
4402 case IPC_INFO:
4403 case SEM_INFO:
4404 /* No specific object, just general system-wide information. */
4405 return task_has_system(current, SYSTEM__IPC_INFO);
4406 case GETPID:
4407 case GETNCNT:
4408 case GETZCNT:
4409 perms = SEM__GETATTR;
4410 break;
4411 case GETVAL:
4412 case GETALL:
4413 perms = SEM__READ;
4414 break;
4415 case SETVAL:
4416 case SETALL:
4417 perms = SEM__WRITE;
4418 break;
4419 case IPC_RMID:
4420 perms = SEM__DESTROY;
4421 break;
4422 case IPC_SET:
4423 perms = SEM__SETATTR;
4424 break;
4425 case IPC_STAT:
4426 case SEM_STAT:
4427 perms = SEM__GETATTR | SEM__ASSOCIATE;
4428 break;
4429 default:
4430 return 0;
4431 }
4432
4433 err = ipc_has_perm(&sma->sem_perm, perms);
4434 return err;
4435 }
4436
4437 static int selinux_sem_semop(struct sem_array *sma,
4438 struct sembuf *sops, unsigned nsops, int alter)
4439 {
4440 u32 perms;
4441
4442 if (alter)
4443 perms = SEM__READ | SEM__WRITE;
4444 else
4445 perms = SEM__READ;
4446
4447 return ipc_has_perm(&sma->sem_perm, perms);
4448 }
4449
4450 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4451 {
4452 u32 av = 0;
4453
4454 av = 0;
4455 if (flag & S_IRUGO)
4456 av |= IPC__UNIX_READ;
4457 if (flag & S_IWUGO)
4458 av |= IPC__UNIX_WRITE;
4459
4460 if (av == 0)
4461 return 0;
4462
4463 return ipc_has_perm(ipcp, av);
4464 }
4465
4466 /* module stacking operations */
4467 static int selinux_register_security (const char *name, struct security_operations *ops)
4468 {
4469 if (secondary_ops != original_ops) {
4470 printk(KERN_ERR "%s: There is already a secondary security "
4471 "module registered.\n", __FUNCTION__);
4472 return -EINVAL;
4473 }
4474
4475 secondary_ops = ops;
4476
4477 printk(KERN_INFO "%s: Registering secondary module %s\n",
4478 __FUNCTION__,
4479 name);
4480
4481 return 0;
4482 }
4483
4484 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4485 {
4486 if (ops != secondary_ops) {
4487 printk(KERN_ERR "%s: trying to unregister a security module "
4488 "that is not registered.\n", __FUNCTION__);
4489 return -EINVAL;
4490 }
4491
4492 secondary_ops = original_ops;
4493
4494 return 0;
4495 }
4496
4497 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4498 {
4499 if (inode)
4500 inode_doinit_with_dentry(inode, dentry);
4501 }
4502
4503 static int selinux_getprocattr(struct task_struct *p,
4504 char *name, char **value)
4505 {
4506 struct task_security_struct *tsec;
4507 u32 sid;
4508 int error;
4509 unsigned len;
4510
4511 if (current != p) {
4512 error = task_has_perm(current, p, PROCESS__GETATTR);
4513 if (error)
4514 return error;
4515 }
4516
4517 tsec = p->security;
4518
4519 if (!strcmp(name, "current"))
4520 sid = tsec->sid;
4521 else if (!strcmp(name, "prev"))
4522 sid = tsec->osid;
4523 else if (!strcmp(name, "exec"))
4524 sid = tsec->exec_sid;
4525 else if (!strcmp(name, "fscreate"))
4526 sid = tsec->create_sid;
4527 else if (!strcmp(name, "keycreate"))
4528 sid = tsec->keycreate_sid;
4529 else if (!strcmp(name, "sockcreate"))
4530 sid = tsec->sockcreate_sid;
4531 else
4532 return -EINVAL;
4533
4534 if (!sid)
4535 return 0;
4536
4537 error = security_sid_to_context(sid, value, &len);
4538 if (error)
4539 return error;
4540 return len;
4541 }
4542
4543 static int selinux_setprocattr(struct task_struct *p,
4544 char *name, void *value, size_t size)
4545 {
4546 struct task_security_struct *tsec;
4547 u32 sid = 0;
4548 int error;
4549 char *str = value;
4550
4551 if (current != p) {
4552 /* SELinux only allows a process to change its own
4553 security attributes. */
4554 return -EACCES;
4555 }
4556
4557 /*
4558 * Basic control over ability to set these attributes at all.
4559 * current == p, but we'll pass them separately in case the
4560 * above restriction is ever removed.
4561 */
4562 if (!strcmp(name, "exec"))
4563 error = task_has_perm(current, p, PROCESS__SETEXEC);
4564 else if (!strcmp(name, "fscreate"))
4565 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4566 else if (!strcmp(name, "keycreate"))
4567 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4568 else if (!strcmp(name, "sockcreate"))
4569 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4570 else if (!strcmp(name, "current"))
4571 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4572 else
4573 error = -EINVAL;
4574 if (error)
4575 return error;
4576
4577 /* Obtain a SID for the context, if one was specified. */
4578 if (size && str[1] && str[1] != '\n') {
4579 if (str[size-1] == '\n') {
4580 str[size-1] = 0;
4581 size--;
4582 }
4583 error = security_context_to_sid(value, size, &sid);
4584 if (error)
4585 return error;
4586 }
4587
4588 /* Permission checking based on the specified context is
4589 performed during the actual operation (execve,
4590 open/mkdir/...), when we know the full context of the
4591 operation. See selinux_bprm_set_security for the execve
4592 checks and may_create for the file creation checks. The
4593 operation will then fail if the context is not permitted. */
4594 tsec = p->security;
4595 if (!strcmp(name, "exec"))
4596 tsec->exec_sid = sid;
4597 else if (!strcmp(name, "fscreate"))
4598 tsec->create_sid = sid;
4599 else if (!strcmp(name, "keycreate")) {
4600 error = may_create_key(sid, p);
4601 if (error)
4602 return error;
4603 tsec->keycreate_sid = sid;
4604 } else if (!strcmp(name, "sockcreate"))
4605 tsec->sockcreate_sid = sid;
4606 else if (!strcmp(name, "current")) {
4607 struct av_decision avd;
4608
4609 if (sid == 0)
4610 return -EINVAL;
4611
4612 /* Only allow single threaded processes to change context */
4613 if (atomic_read(&p->mm->mm_users) != 1) {
4614 struct task_struct *g, *t;
4615 struct mm_struct *mm = p->mm;
4616 read_lock(&tasklist_lock);
4617 do_each_thread(g, t)
4618 if (t->mm == mm && t != p) {
4619 read_unlock(&tasklist_lock);
4620 return -EPERM;
4621 }
4622 while_each_thread(g, t);
4623 read_unlock(&tasklist_lock);
4624 }
4625
4626 /* Check permissions for the transition. */
4627 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4628 PROCESS__DYNTRANSITION, NULL);
4629 if (error)
4630 return error;
4631
4632 /* Check for ptracing, and update the task SID if ok.
4633 Otherwise, leave SID unchanged and fail. */
4634 task_lock(p);
4635 if (p->ptrace & PT_PTRACED) {
4636 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4637 SECCLASS_PROCESS,
4638 PROCESS__PTRACE, 0, &avd);
4639 if (!error)
4640 tsec->sid = sid;
4641 task_unlock(p);
4642 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4643 PROCESS__PTRACE, &avd, error, NULL);
4644 if (error)
4645 return error;
4646 } else {
4647 tsec->sid = sid;
4648 task_unlock(p);
4649 }
4650 }
4651 else
4652 return -EINVAL;
4653
4654 return size;
4655 }
4656
4657 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4658 {
4659 return security_sid_to_context(secid, secdata, seclen);
4660 }
4661
4662 static void selinux_release_secctx(char *secdata, u32 seclen)
4663 {
4664 kfree(secdata);
4665 }
4666
4667 #ifdef CONFIG_KEYS
4668
4669 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4670 unsigned long flags)
4671 {
4672 struct task_security_struct *tsec = tsk->security;
4673 struct key_security_struct *ksec;
4674
4675 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4676 if (!ksec)
4677 return -ENOMEM;
4678
4679 ksec->obj = k;
4680 if (tsec->keycreate_sid)
4681 ksec->sid = tsec->keycreate_sid;
4682 else
4683 ksec->sid = tsec->sid;
4684 k->security = ksec;
4685
4686 return 0;
4687 }
4688
4689 static void selinux_key_free(struct key *k)
4690 {
4691 struct key_security_struct *ksec = k->security;
4692
4693 k->security = NULL;
4694 kfree(ksec);
4695 }
4696
4697 static int selinux_key_permission(key_ref_t key_ref,
4698 struct task_struct *ctx,
4699 key_perm_t perm)
4700 {
4701 struct key *key;
4702 struct task_security_struct *tsec;
4703 struct key_security_struct *ksec;
4704
4705 key = key_ref_to_ptr(key_ref);
4706
4707 tsec = ctx->security;
4708 ksec = key->security;
4709
4710 /* if no specific permissions are requested, we skip the
4711 permission check. No serious, additional covert channels
4712 appear to be created. */
4713 if (perm == 0)
4714 return 0;
4715
4716 return avc_has_perm(tsec->sid, ksec->sid,
4717 SECCLASS_KEY, perm, NULL);
4718 }
4719
4720 #endif
4721
4722 static struct security_operations selinux_ops = {
4723 .ptrace = selinux_ptrace,
4724 .capget = selinux_capget,
4725 .capset_check = selinux_capset_check,
4726 .capset_set = selinux_capset_set,
4727 .sysctl = selinux_sysctl,
4728 .capable = selinux_capable,
4729 .quotactl = selinux_quotactl,
4730 .quota_on = selinux_quota_on,
4731 .syslog = selinux_syslog,
4732 .vm_enough_memory = selinux_vm_enough_memory,
4733
4734 .netlink_send = selinux_netlink_send,
4735 .netlink_recv = selinux_netlink_recv,
4736
4737 .bprm_alloc_security = selinux_bprm_alloc_security,
4738 .bprm_free_security = selinux_bprm_free_security,
4739 .bprm_apply_creds = selinux_bprm_apply_creds,
4740 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4741 .bprm_set_security = selinux_bprm_set_security,
4742 .bprm_check_security = selinux_bprm_check_security,
4743 .bprm_secureexec = selinux_bprm_secureexec,
4744
4745 .sb_alloc_security = selinux_sb_alloc_security,
4746 .sb_free_security = selinux_sb_free_security,
4747 .sb_copy_data = selinux_sb_copy_data,
4748 .sb_kern_mount = selinux_sb_kern_mount,
4749 .sb_statfs = selinux_sb_statfs,
4750 .sb_mount = selinux_mount,
4751 .sb_umount = selinux_umount,
4752
4753 .inode_alloc_security = selinux_inode_alloc_security,
4754 .inode_free_security = selinux_inode_free_security,
4755 .inode_init_security = selinux_inode_init_security,
4756 .inode_create = selinux_inode_create,
4757 .inode_link = selinux_inode_link,
4758 .inode_unlink = selinux_inode_unlink,
4759 .inode_symlink = selinux_inode_symlink,
4760 .inode_mkdir = selinux_inode_mkdir,
4761 .inode_rmdir = selinux_inode_rmdir,
4762 .inode_mknod = selinux_inode_mknod,
4763 .inode_rename = selinux_inode_rename,
4764 .inode_readlink = selinux_inode_readlink,
4765 .inode_follow_link = selinux_inode_follow_link,
4766 .inode_permission = selinux_inode_permission,
4767 .inode_setattr = selinux_inode_setattr,
4768 .inode_getattr = selinux_inode_getattr,
4769 .inode_setxattr = selinux_inode_setxattr,
4770 .inode_post_setxattr = selinux_inode_post_setxattr,
4771 .inode_getxattr = selinux_inode_getxattr,
4772 .inode_listxattr = selinux_inode_listxattr,
4773 .inode_removexattr = selinux_inode_removexattr,
4774 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4775 .inode_getsecurity = selinux_inode_getsecurity,
4776 .inode_setsecurity = selinux_inode_setsecurity,
4777 .inode_listsecurity = selinux_inode_listsecurity,
4778
4779 .file_permission = selinux_file_permission,
4780 .file_alloc_security = selinux_file_alloc_security,
4781 .file_free_security = selinux_file_free_security,
4782 .file_ioctl = selinux_file_ioctl,
4783 .file_mmap = selinux_file_mmap,
4784 .file_mprotect = selinux_file_mprotect,
4785 .file_lock = selinux_file_lock,
4786 .file_fcntl = selinux_file_fcntl,
4787 .file_set_fowner = selinux_file_set_fowner,
4788 .file_send_sigiotask = selinux_file_send_sigiotask,
4789 .file_receive = selinux_file_receive,
4790
4791 .task_create = selinux_task_create,
4792 .task_alloc_security = selinux_task_alloc_security,
4793 .task_free_security = selinux_task_free_security,
4794 .task_setuid = selinux_task_setuid,
4795 .task_post_setuid = selinux_task_post_setuid,
4796 .task_setgid = selinux_task_setgid,
4797 .task_setpgid = selinux_task_setpgid,
4798 .task_getpgid = selinux_task_getpgid,
4799 .task_getsid = selinux_task_getsid,
4800 .task_getsecid = selinux_task_getsecid,
4801 .task_setgroups = selinux_task_setgroups,
4802 .task_setnice = selinux_task_setnice,
4803 .task_setioprio = selinux_task_setioprio,
4804 .task_getioprio = selinux_task_getioprio,
4805 .task_setrlimit = selinux_task_setrlimit,
4806 .task_setscheduler = selinux_task_setscheduler,
4807 .task_getscheduler = selinux_task_getscheduler,
4808 .task_movememory = selinux_task_movememory,
4809 .task_kill = selinux_task_kill,
4810 .task_wait = selinux_task_wait,
4811 .task_prctl = selinux_task_prctl,
4812 .task_reparent_to_init = selinux_task_reparent_to_init,
4813 .task_to_inode = selinux_task_to_inode,
4814
4815 .ipc_permission = selinux_ipc_permission,
4816
4817 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4818 .msg_msg_free_security = selinux_msg_msg_free_security,
4819
4820 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4821 .msg_queue_free_security = selinux_msg_queue_free_security,
4822 .msg_queue_associate = selinux_msg_queue_associate,
4823 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4824 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4825 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4826
4827 .shm_alloc_security = selinux_shm_alloc_security,
4828 .shm_free_security = selinux_shm_free_security,
4829 .shm_associate = selinux_shm_associate,
4830 .shm_shmctl = selinux_shm_shmctl,
4831 .shm_shmat = selinux_shm_shmat,
4832
4833 .sem_alloc_security = selinux_sem_alloc_security,
4834 .sem_free_security = selinux_sem_free_security,
4835 .sem_associate = selinux_sem_associate,
4836 .sem_semctl = selinux_sem_semctl,
4837 .sem_semop = selinux_sem_semop,
4838
4839 .register_security = selinux_register_security,
4840 .unregister_security = selinux_unregister_security,
4841
4842 .d_instantiate = selinux_d_instantiate,
4843
4844 .getprocattr = selinux_getprocattr,
4845 .setprocattr = selinux_setprocattr,
4846
4847 .secid_to_secctx = selinux_secid_to_secctx,
4848 .release_secctx = selinux_release_secctx,
4849
4850 .unix_stream_connect = selinux_socket_unix_stream_connect,
4851 .unix_may_send = selinux_socket_unix_may_send,
4852
4853 .socket_create = selinux_socket_create,
4854 .socket_post_create = selinux_socket_post_create,
4855 .socket_bind = selinux_socket_bind,
4856 .socket_connect = selinux_socket_connect,
4857 .socket_listen = selinux_socket_listen,
4858 .socket_accept = selinux_socket_accept,
4859 .socket_sendmsg = selinux_socket_sendmsg,
4860 .socket_recvmsg = selinux_socket_recvmsg,
4861 .socket_getsockname = selinux_socket_getsockname,
4862 .socket_getpeername = selinux_socket_getpeername,
4863 .socket_getsockopt = selinux_socket_getsockopt,
4864 .socket_setsockopt = selinux_socket_setsockopt,
4865 .socket_shutdown = selinux_socket_shutdown,
4866 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4867 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4868 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4869 .sk_alloc_security = selinux_sk_alloc_security,
4870 .sk_free_security = selinux_sk_free_security,
4871 .sk_clone_security = selinux_sk_clone_security,
4872 .sk_getsecid = selinux_sk_getsecid,
4873 .sock_graft = selinux_sock_graft,
4874 .inet_conn_request = selinux_inet_conn_request,
4875 .inet_csk_clone = selinux_inet_csk_clone,
4876 .inet_conn_established = selinux_inet_conn_established,
4877 .req_classify_flow = selinux_req_classify_flow,
4878
4879 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4880 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4881 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4882 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4883 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4884 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4885 .xfrm_state_free_security = selinux_xfrm_state_free,
4886 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4887 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4888 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
4889 .xfrm_decode_session = selinux_xfrm_decode_session,
4890 #endif
4891
4892 #ifdef CONFIG_KEYS
4893 .key_alloc = selinux_key_alloc,
4894 .key_free = selinux_key_free,
4895 .key_permission = selinux_key_permission,
4896 #endif
4897 };
4898
4899 static __init int selinux_init(void)
4900 {
4901 struct task_security_struct *tsec;
4902
4903 if (!selinux_enabled) {
4904 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4905 return 0;
4906 }
4907
4908 printk(KERN_INFO "SELinux: Initializing.\n");
4909
4910 /* Set the security state for the initial task. */
4911 if (task_alloc_security(current))
4912 panic("SELinux: Failed to initialize initial task.\n");
4913 tsec = current->security;
4914 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4915
4916 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4917 sizeof(struct inode_security_struct),
4918 0, SLAB_PANIC, NULL);
4919 avc_init();
4920
4921 original_ops = secondary_ops = security_ops;
4922 if (!secondary_ops)
4923 panic ("SELinux: No initial security operations\n");
4924 if (register_security (&selinux_ops))
4925 panic("SELinux: Unable to register with kernel.\n");
4926
4927 if (selinux_enforcing) {
4928 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
4929 } else {
4930 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
4931 }
4932
4933 #ifdef CONFIG_KEYS
4934 /* Add security information to initial keyrings */
4935 selinux_key_alloc(&root_user_keyring, current,
4936 KEY_ALLOC_NOT_IN_QUOTA);
4937 selinux_key_alloc(&root_session_keyring, current,
4938 KEY_ALLOC_NOT_IN_QUOTA);
4939 #endif
4940
4941 return 0;
4942 }
4943
4944 void selinux_complete_init(void)
4945 {
4946 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
4947
4948 /* Set up any superblocks initialized prior to the policy load. */
4949 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
4950 spin_lock(&sb_lock);
4951 spin_lock(&sb_security_lock);
4952 next_sb:
4953 if (!list_empty(&superblock_security_head)) {
4954 struct superblock_security_struct *sbsec =
4955 list_entry(superblock_security_head.next,
4956 struct superblock_security_struct,
4957 list);
4958 struct super_block *sb = sbsec->sb;
4959 sb->s_count++;
4960 spin_unlock(&sb_security_lock);
4961 spin_unlock(&sb_lock);
4962 down_read(&sb->s_umount);
4963 if (sb->s_root)
4964 superblock_doinit(sb, NULL);
4965 drop_super(sb);
4966 spin_lock(&sb_lock);
4967 spin_lock(&sb_security_lock);
4968 list_del_init(&sbsec->list);
4969 goto next_sb;
4970 }
4971 spin_unlock(&sb_security_lock);
4972 spin_unlock(&sb_lock);
4973 }
4974
4975 /* SELinux requires early initialization in order to label
4976 all processes and objects when they are created. */
4977 security_initcall(selinux_init);
4978
4979 #if defined(CONFIG_NETFILTER)
4980
4981 static struct nf_hook_ops selinux_ipv4_op = {
4982 .hook = selinux_ipv4_postroute_last,
4983 .owner = THIS_MODULE,
4984 .pf = PF_INET,
4985 .hooknum = NF_IP_POST_ROUTING,
4986 .priority = NF_IP_PRI_SELINUX_LAST,
4987 };
4988
4989 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4990
4991 static struct nf_hook_ops selinux_ipv6_op = {
4992 .hook = selinux_ipv6_postroute_last,
4993 .owner = THIS_MODULE,
4994 .pf = PF_INET6,
4995 .hooknum = NF_IP6_POST_ROUTING,
4996 .priority = NF_IP6_PRI_SELINUX_LAST,
4997 };
4998
4999 #endif /* IPV6 */
5000
5001 static int __init selinux_nf_ip_init(void)
5002 {
5003 int err = 0;
5004
5005 if (!selinux_enabled)
5006 goto out;
5007
5008 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5009
5010 err = nf_register_hook(&selinux_ipv4_op);
5011 if (err)
5012 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5013
5014 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5015
5016 err = nf_register_hook(&selinux_ipv6_op);
5017 if (err)
5018 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5019
5020 #endif /* IPV6 */
5021
5022 out:
5023 return err;
5024 }
5025
5026 __initcall(selinux_nf_ip_init);
5027
5028 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5029 static void selinux_nf_ip_exit(void)
5030 {
5031 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5032
5033 nf_unregister_hook(&selinux_ipv4_op);
5034 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5035 nf_unregister_hook(&selinux_ipv6_op);
5036 #endif /* IPV6 */
5037 }
5038 #endif
5039
5040 #else /* CONFIG_NETFILTER */
5041
5042 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5043 #define selinux_nf_ip_exit()
5044 #endif
5045
5046 #endif /* CONFIG_NETFILTER */
5047
5048 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5049 int selinux_disable(void)
5050 {
5051 extern void exit_sel_fs(void);
5052 static int selinux_disabled = 0;
5053
5054 if (ss_initialized) {
5055 /* Not permitted after initial policy load. */
5056 return -EINVAL;
5057 }
5058
5059 if (selinux_disabled) {
5060 /* Only do this once. */
5061 return -EINVAL;
5062 }
5063
5064 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5065
5066 selinux_disabled = 1;
5067 selinux_enabled = 0;
5068
5069 /* Reset security_ops to the secondary module, dummy or capability. */
5070 security_ops = secondary_ops;
5071
5072 /* Unregister netfilter hooks. */
5073 selinux_nf_ip_exit();
5074
5075 /* Unregister selinuxfs. */
5076 exit_sel_fs();
5077
5078 return 0;
5079 }
5080 #endif
5081
5082
Linux kernel - Deliverables
This page took 0.130846 seconds and 6 git commands to generate.