]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - security/selinux/hooks.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi...
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT
1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
2069f457
EP
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
1da177e4 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 15 * <dgoeddel@trustedcs.com>
ed6d76e4 16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
82c21bfa 17 * Paul Moore <paul@paul-moore.com>
788e7dd4 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
828dfe1d 23 * as published by the Free Software Foundation.
1da177e4
LT
24 */
25
1da177e4 26#include <linux/init.h>
0b24dcb7 27#include <linux/kd.h>
1da177e4 28#include <linux/kernel.h>
0d094efe 29#include <linux/tracehook.h>
1da177e4
LT
30#include <linux/errno.h>
31#include <linux/sched.h>
32#include <linux/security.h>
33#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
0b24dcb7 40#include <linux/proc_fs.h>
1da177e4 41#include <linux/swap.h>
1da177e4
LT
42#include <linux/spinlock.h>
43#include <linux/syscalls.h>
2a7dba39 44#include <linux/dcache.h>
1da177e4 45#include <linux/file.h>
9f3acc31 46#include <linux/fdtable.h>
1da177e4
LT
47#include <linux/namei.h>
48#include <linux/mount.h>
1da177e4
LT
49#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
227b60f5 53#include <net/ip.h> /* for local_port_range[] */
ca10b9e9 54#include <net/sock.h>
1da177e4 55#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
220deb96 56#include <net/net_namespace.h>
d621d35e 57#include <net/netlabel.h>
f5269710 58#include <linux/uaccess.h>
1da177e4 59#include <asm/ioctls.h>
60063497 60#include <linux/atomic.h>
1da177e4
LT
61#include <linux/bitops.h>
62#include <linux/interrupt.h>
63#include <linux/netdevice.h> /* for network interface checks */
77954983 64#include <net/netlink.h>
1da177e4
LT
65#include <linux/tcp.h>
66#include <linux/udp.h>
2ee92d46 67#include <linux/dccp.h>
1da177e4
LT
68#include <linux/quota.h>
69#include <linux/un.h> /* for Unix socket types */
70#include <net/af_unix.h> /* for Unix socket types */
71#include <linux/parser.h>
72#include <linux/nfs_mount.h>
73#include <net/ipv6.h>
74#include <linux/hugetlb.h>
75#include <linux/personality.h>
1da177e4 76#include <linux/audit.h>
6931dfc9 77#include <linux/string.h>
877ce7c1 78#include <linux/selinux.h>
23970741 79#include <linux/mutex.h>
f06febc9 80#include <linux/posix-timers.h>
00234592 81#include <linux/syslog.h>
3486740a 82#include <linux/user_namespace.h>
44fc7ea0 83#include <linux/export.h>
eb9ae686 84#include <linux/security.h>
40401530
AV
85#include <linux/msg.h>
86#include <linux/shm.h>
1da177e4
LT
87
88#include "avc.h"
89#include "objsec.h"
90#include "netif.h"
224dfbd8 91#include "netnode.h"
3e112172 92#include "netport.h"
d28d1e08 93#include "xfrm.h"
c60475bf 94#include "netlabel.h"
9d57a7f9 95#include "audit.h"
7b98a585 96#include "avc_ss.h"
1da177e4 97
11689d47 98#define NUM_SEL_MNT_OPTS 5
c9180a57 99
20510f2f 100extern struct security_operations *security_ops;
1da177e4 101
d621d35e 102/* SECMARK reference count */
56a4ca99 103static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
d621d35e 104
1da177e4 105#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 106int selinux_enforcing;
1da177e4
LT
107
108static int __init enforcing_setup(char *str)
109{
f5269710
EP
110 unsigned long enforcing;
111 if (!strict_strtoul(str, 0, &enforcing))
112 selinux_enforcing = enforcing ? 1 : 0;
1da177e4
LT
113 return 1;
114}
115__setup("enforcing=", enforcing_setup);
116#endif
117
118#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
119int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
120
121static int __init selinux_enabled_setup(char *str)
122{
f5269710
EP
123 unsigned long enabled;
124 if (!strict_strtoul(str, 0, &enabled))
125 selinux_enabled = enabled ? 1 : 0;
1da177e4
LT
126 return 1;
127}
128__setup("selinux=", selinux_enabled_setup);
30d55280
SS
129#else
130int selinux_enabled = 1;
1da177e4
LT
131#endif
132
e18b890b 133static struct kmem_cache *sel_inode_cache;
7cae7e26 134
d621d35e
PM
135/**
136 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
137 *
138 * Description:
139 * This function checks the SECMARK reference counter to see if any SECMARK
140 * targets are currently configured, if the reference counter is greater than
141 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
142 * enabled, false (0) if SECMARK is disabled.
143 *
144 */
145static int selinux_secmark_enabled(void)
146{
147 return (atomic_read(&selinux_secmark_refcount) > 0);
148}
149
d84f4f99
DH
150/*
151 * initialise the security for the init task
152 */
153static void cred_init_security(void)
1da177e4 154{
3b11a1de 155 struct cred *cred = (struct cred *) current->real_cred;
1da177e4
LT
156 struct task_security_struct *tsec;
157
89d155ef 158 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4 159 if (!tsec)
d84f4f99 160 panic("SELinux: Failed to initialize initial task.\n");
1da177e4 161
d84f4f99 162 tsec->osid = tsec->sid = SECINITSID_KERNEL;
f1752eec 163 cred->security = tsec;
1da177e4
LT
164}
165
88e67f3b
DH
166/*
167 * get the security ID of a set of credentials
168 */
169static inline u32 cred_sid(const struct cred *cred)
170{
171 const struct task_security_struct *tsec;
172
173 tsec = cred->security;
174 return tsec->sid;
175}
176
275bb41e 177/*
3b11a1de 178 * get the objective security ID of a task
275bb41e
DH
179 */
180static inline u32 task_sid(const struct task_struct *task)
181{
275bb41e
DH
182 u32 sid;
183
184 rcu_read_lock();
88e67f3b 185 sid = cred_sid(__task_cred(task));
275bb41e
DH
186 rcu_read_unlock();
187 return sid;
188}
189
190/*
3b11a1de 191 * get the subjective security ID of the current task
275bb41e
DH
192 */
193static inline u32 current_sid(void)
194{
5fb49870 195 const struct task_security_struct *tsec = current_security();
275bb41e
DH
196
197 return tsec->sid;
198}
199
88e67f3b
DH
200/* Allocate and free functions for each kind of security blob. */
201
1da177e4
LT
202static int inode_alloc_security(struct inode *inode)
203{
1da177e4 204 struct inode_security_struct *isec;
275bb41e 205 u32 sid = current_sid();
1da177e4 206
a02fe132 207 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT
208 if (!isec)
209 return -ENOMEM;
210
23970741 211 mutex_init(&isec->lock);
1da177e4 212 INIT_LIST_HEAD(&isec->list);
1da177e4
LT
213 isec->inode = inode;
214 isec->sid = SECINITSID_UNLABELED;
215 isec->sclass = SECCLASS_FILE;
275bb41e 216 isec->task_sid = sid;
1da177e4
LT
217 inode->i_security = isec;
218
219 return 0;
220}
221
222static void inode_free_security(struct inode *inode)
223{
224 struct inode_security_struct *isec = inode->i_security;
225 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
226
1da177e4
LT
227 spin_lock(&sbsec->isec_lock);
228 if (!list_empty(&isec->list))
229 list_del_init(&isec->list);
230 spin_unlock(&sbsec->isec_lock);
231
232 inode->i_security = NULL;
7cae7e26 233 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT
234}
235
236static int file_alloc_security(struct file *file)
237{
1da177e4 238 struct file_security_struct *fsec;
275bb41e 239 u32 sid = current_sid();
1da177e4 240
26d2a4be 241 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT
242 if (!fsec)
243 return -ENOMEM;
244
275bb41e
DH
245 fsec->sid = sid;
246 fsec->fown_sid = sid;
1da177e4
LT
247 file->f_security = fsec;
248
249 return 0;
250}
251
252static void file_free_security(struct file *file)
253{
254 struct file_security_struct *fsec = file->f_security;
1da177e4
LT
255 file->f_security = NULL;
256 kfree(fsec);
257}
258
259static int superblock_alloc_security(struct super_block *sb)
260{
261 struct superblock_security_struct *sbsec;
262
89d155ef 263 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT
264 if (!sbsec)
265 return -ENOMEM;
266
bc7e982b 267 mutex_init(&sbsec->lock);
1da177e4
LT
268 INIT_LIST_HEAD(&sbsec->isec_head);
269 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT
270 sbsec->sb = sb;
271 sbsec->sid = SECINITSID_UNLABELED;
272 sbsec->def_sid = SECINITSID_FILE;
c312feb2 273 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT
274 sb->s_security = sbsec;
275
276 return 0;
277}
278
279static void superblock_free_security(struct super_block *sb)
280{
281 struct superblock_security_struct *sbsec = sb->s_security;
1da177e4
LT
282 sb->s_security = NULL;
283 kfree(sbsec);
284}
285
1da177e4
LT
286/* The file system's label must be initialized prior to use. */
287
eb9ae686 288static const char *labeling_behaviors[7] = {
1da177e4
LT
289 "uses xattr",
290 "uses transition SIDs",
291 "uses task SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
eb9ae686 295 "uses native labeling",
1da177e4
LT
296};
297
298static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
299
300static inline int inode_doinit(struct inode *inode)
301{
302 return inode_doinit_with_dentry(inode, NULL);
303}
304
305enum {
31e87930 306 Opt_error = -1,
1da177e4
LT
307 Opt_context = 1,
308 Opt_fscontext = 2,
c9180a57
EP
309 Opt_defcontext = 3,
310 Opt_rootcontext = 4,
11689d47 311 Opt_labelsupport = 5,
1da177e4
LT
312};
313
a447c093 314static const match_table_t tokens = {
832cbd9a
EP
315 {Opt_context, CONTEXT_STR "%s"},
316 {Opt_fscontext, FSCONTEXT_STR "%s"},
317 {Opt_defcontext, DEFCONTEXT_STR "%s"},
318 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
11689d47 319 {Opt_labelsupport, LABELSUPP_STR},
31e87930 320 {Opt_error, NULL},
1da177e4
LT
321};
322
323#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
324
c312feb2
EP
325static int may_context_mount_sb_relabel(u32 sid,
326 struct superblock_security_struct *sbsec,
275bb41e 327 const struct cred *cred)
c312feb2 328{
275bb41e 329 const struct task_security_struct *tsec = cred->security;
c312feb2
EP
330 int rc;
331
332 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
333 FILESYSTEM__RELABELFROM, NULL);
334 if (rc)
335 return rc;
336
337 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
338 FILESYSTEM__RELABELTO, NULL);
339 return rc;
340}
341
0808925e
EP
342static int may_context_mount_inode_relabel(u32 sid,
343 struct superblock_security_struct *sbsec,
275bb41e 344 const struct cred *cred)
0808925e 345{
275bb41e 346 const struct task_security_struct *tsec = cred->security;
0808925e
EP
347 int rc;
348 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
349 FILESYSTEM__RELABELFROM, NULL);
350 if (rc)
351 return rc;
352
353 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__ASSOCIATE, NULL);
355 return rc;
356}
357
c9180a57 358static int sb_finish_set_opts(struct super_block *sb)
1da177e4 359{
1da177e4 360 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57
EP
361 struct dentry *root = sb->s_root;
362 struct inode *root_inode = root->d_inode;
363 int rc = 0;
1da177e4 364
c9180a57
EP
365 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
366 /* Make sure that the xattr handler exists and that no
367 error other than -ENODATA is returned by getxattr on
368 the root directory. -ENODATA is ok, as this may be
369 the first boot of the SELinux kernel before we have
370 assigned xattr values to the filesystem. */
371 if (!root_inode->i_op->getxattr) {
372 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
373 "xattr support\n", sb->s_id, sb->s_type->name);
374 rc = -EOPNOTSUPP;
375 goto out;
376 }
377 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
378 if (rc < 0 && rc != -ENODATA) {
379 if (rc == -EOPNOTSUPP)
380 printk(KERN_WARNING "SELinux: (dev %s, type "
381 "%s) has no security xattr handler\n",
382 sb->s_id, sb->s_type->name);
383 else
384 printk(KERN_WARNING "SELinux: (dev %s, type "
385 "%s) getxattr errno %d\n", sb->s_id,
386 sb->s_type->name, -rc);
387 goto out;
388 }
389 }
1da177e4 390
11689d47 391 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
1da177e4 392
c9180a57
EP
393 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
394 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
395 sb->s_id, sb->s_type->name);
396 else
397 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
398 sb->s_id, sb->s_type->name,
399 labeling_behaviors[sbsec->behavior-1]);
1da177e4 400
11689d47
DQ
401 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
402 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
403 sbsec->behavior == SECURITY_FS_USE_NONE ||
404 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
405 sbsec->flags &= ~SE_SBLABELSUPP;
406
ddd29ec6
DQ
407 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
408 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
409 sbsec->flags |= SE_SBLABELSUPP;
410
c9180a57
EP
411 /* Initialize the root inode. */
412 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 413
c9180a57
EP
414 /* Initialize any other inodes associated with the superblock, e.g.
415 inodes created prior to initial policy load or inodes created
416 during get_sb by a pseudo filesystem that directly
417 populates itself. */
418 spin_lock(&sbsec->isec_lock);
419next_inode:
420 if (!list_empty(&sbsec->isec_head)) {
421 struct inode_security_struct *isec =
422 list_entry(sbsec->isec_head.next,
423 struct inode_security_struct, list);
424 struct inode *inode = isec->inode;
425 spin_unlock(&sbsec->isec_lock);
426 inode = igrab(inode);
427 if (inode) {
428 if (!IS_PRIVATE(inode))
429 inode_doinit(inode);
430 iput(inode);
431 }
432 spin_lock(&sbsec->isec_lock);
433 list_del_init(&isec->list);
434 goto next_inode;
435 }
436 spin_unlock(&sbsec->isec_lock);
437out:
438 return rc;
439}
1da177e4 440
c9180a57
EP
441/*
442 * This function should allow an FS to ask what it's mount security
443 * options were so it can use those later for submounts, displaying
444 * mount options, or whatever.
445 */
446static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 447 struct security_mnt_opts *opts)
c9180a57
EP
448{
449 int rc = 0, i;
450 struct superblock_security_struct *sbsec = sb->s_security;
451 char *context = NULL;
452 u32 len;
453 char tmp;
1da177e4 454
e0007529 455 security_init_mnt_opts(opts);
1da177e4 456
0d90a7ec 457 if (!(sbsec->flags & SE_SBINITIALIZED))
c9180a57 458 return -EINVAL;
1da177e4 459
c9180a57
EP
460 if (!ss_initialized)
461 return -EINVAL;
1da177e4 462
0d90a7ec 463 tmp = sbsec->flags & SE_MNTMASK;
c9180a57
EP
464 /* count the number of mount options for this sb */
465 for (i = 0; i < 8; i++) {
466 if (tmp & 0x01)
e0007529 467 opts->num_mnt_opts++;
c9180a57
EP
468 tmp >>= 1;
469 }
11689d47
DQ
470 /* Check if the Label support flag is set */
471 if (sbsec->flags & SE_SBLABELSUPP)
472 opts->num_mnt_opts++;
1da177e4 473
e0007529
EP
474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
c9180a57
EP
476 rc = -ENOMEM;
477 goto out_free;
478 }
1da177e4 479
e0007529
EP
480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
c9180a57
EP
482 rc = -ENOMEM;
483 goto out_free;
484 }
1da177e4 485
c9180a57
EP
486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
e0007529
EP
491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP
493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
e0007529
EP
498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP
500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
e0007529
EP
505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP
507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
0808925e 511
c9180a57
EP
512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
e0007529
EP
515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 517 }
11689d47
DQ
518 if (sbsec->flags & SE_SBLABELSUPP) {
519 opts->mnt_opts[i] = NULL;
520 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
521 }
1da177e4 522
e0007529 523 BUG_ON(i != opts->num_mnt_opts);
1da177e4 524
c9180a57
EP
525 return 0;
526
527out_free:
e0007529 528 security_free_mnt_opts(opts);
c9180a57
EP
529 return rc;
530}
1da177e4 531
c9180a57
EP
532static int bad_option(struct superblock_security_struct *sbsec, char flag,
533 u32 old_sid, u32 new_sid)
534{
0d90a7ec
DQ
535 char mnt_flags = sbsec->flags & SE_MNTMASK;
536
c9180a57 537 /* check if the old mount command had the same options */
0d90a7ec 538 if (sbsec->flags & SE_SBINITIALIZED)
c9180a57
EP
539 if (!(sbsec->flags & flag) ||
540 (old_sid != new_sid))
541 return 1;
542
543 /* check if we were passed the same options twice,
544 * aka someone passed context=a,context=b
545 */
0d90a7ec
DQ
546 if (!(sbsec->flags & SE_SBINITIALIZED))
547 if (mnt_flags & flag)
c9180a57
EP
548 return 1;
549 return 0;
550}
e0007529 551
c9180a57
EP
552/*
553 * Allow filesystems with binary mount data to explicitly set mount point
554 * labeling information.
555 */
e0007529 556static int selinux_set_mnt_opts(struct super_block *sb,
649f6e77
DQ
557 struct security_mnt_opts *opts,
558 unsigned long kern_flags,
559 unsigned long *set_kern_flags)
c9180a57 560{
275bb41e 561 const struct cred *cred = current_cred();
c9180a57 562 int rc = 0, i;
c9180a57
EP
563 struct superblock_security_struct *sbsec = sb->s_security;
564 const char *name = sb->s_type->name;
089be43e
JM
565 struct inode *inode = sbsec->sb->s_root->d_inode;
566 struct inode_security_struct *root_isec = inode->i_security;
c9180a57
EP
567 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
568 u32 defcontext_sid = 0;
e0007529
EP
569 char **mount_options = opts->mnt_opts;
570 int *flags = opts->mnt_opts_flags;
571 int num_opts = opts->num_mnt_opts;
c9180a57
EP
572
573 mutex_lock(&sbsec->lock);
574
575 if (!ss_initialized) {
576 if (!num_opts) {
577 /* Defer initialization until selinux_complete_init,
578 after the initial policy is loaded and the security
579 server is ready to handle calls. */
c9180a57
EP
580 goto out;
581 }
582 rc = -EINVAL;
744ba35e
EP
583 printk(KERN_WARNING "SELinux: Unable to set superblock options "
584 "before the security server is initialized\n");
1da177e4 585 goto out;
c9180a57 586 }
649f6e77
DQ
587 if (kern_flags && !set_kern_flags) {
588 /* Specifying internal flags without providing a place to
589 * place the results is not allowed */
590 rc = -EINVAL;
591 goto out;
592 }
1da177e4 593
e0007529
EP
594 /*
595 * Binary mount data FS will come through this function twice. Once
596 * from an explicit call and once from the generic calls from the vfs.
597 * Since the generic VFS calls will not contain any security mount data
598 * we need to skip the double mount verification.
599 *
600 * This does open a hole in which we will not notice if the first
601 * mount using this sb set explict options and a second mount using
602 * this sb does not set any security options. (The first options
603 * will be used for both mounts)
604 */
0d90a7ec 605 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
e0007529 606 && (num_opts == 0))
f5269710 607 goto out;
e0007529 608
c9180a57
EP
609 /*
610 * parse the mount options, check if they are valid sids.
611 * also check if someone is trying to mount the same sb more
612 * than once with different security options.
613 */
614 for (i = 0; i < num_opts; i++) {
615 u32 sid;
11689d47
DQ
616
617 if (flags[i] == SE_SBLABELSUPP)
618 continue;
c9180a57
EP
619 rc = security_context_to_sid(mount_options[i],
620 strlen(mount_options[i]), &sid);
1da177e4
LT
621 if (rc) {
622 printk(KERN_WARNING "SELinux: security_context_to_sid"
623 "(%s) failed for (dev %s, type %s) errno=%d\n",
c9180a57
EP
624 mount_options[i], sb->s_id, name, rc);
625 goto out;
626 }
627 switch (flags[i]) {
628 case FSCONTEXT_MNT:
629 fscontext_sid = sid;
630
631 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
632 fscontext_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= FSCONTEXT_MNT;
636 break;
637 case CONTEXT_MNT:
638 context_sid = sid;
639
640 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
641 context_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= CONTEXT_MNT;
645 break;
646 case ROOTCONTEXT_MNT:
647 rootcontext_sid = sid;
648
649 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
650 rootcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= ROOTCONTEXT_MNT;
654
655 break;
656 case DEFCONTEXT_MNT:
657 defcontext_sid = sid;
658
659 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
660 defcontext_sid))
661 goto out_double_mount;
662
663 sbsec->flags |= DEFCONTEXT_MNT;
664
665 break;
666 default:
667 rc = -EINVAL;
668 goto out;
1da177e4 669 }
c9180a57
EP
670 }
671
0d90a7ec 672 if (sbsec->flags & SE_SBINITIALIZED) {
c9180a57 673 /* previously mounted with options, but not on this attempt? */
0d90a7ec 674 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
c9180a57
EP
675 goto out_double_mount;
676 rc = 0;
677 goto out;
678 }
679
089be43e 680 if (strcmp(sb->s_type->name, "proc") == 0)
0d90a7ec 681 sbsec->flags |= SE_SBPROC;
c9180a57 682
eb9ae686
DQ
683 if (!sbsec->behavior) {
684 /*
685 * Determine the labeling behavior to use for this
686 * filesystem type.
687 */
688 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
689 "proc" : sb->s_type->name,
690 &sbsec->behavior, &sbsec->sid);
691 if (rc) {
692 printk(KERN_WARNING
693 "%s: security_fs_use(%s) returned %d\n",
694 __func__, sb->s_type->name, rc);
695 goto out;
696 }
c9180a57 697 }
c9180a57
EP
698 /* sets the context of the superblock for the fs being mounted. */
699 if (fscontext_sid) {
275bb41e 700 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
1da177e4 701 if (rc)
c9180a57 702 goto out;
1da177e4 703
c9180a57 704 sbsec->sid = fscontext_sid;
c312feb2
EP
705 }
706
707 /*
708 * Switch to using mount point labeling behavior.
709 * sets the label used on all file below the mountpoint, and will set
710 * the superblock context if not already set.
711 */
eb9ae686
DQ
712 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
713 sbsec->behavior = SECURITY_FS_USE_NATIVE;
714 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
715 }
716
c9180a57
EP
717 if (context_sid) {
718 if (!fscontext_sid) {
275bb41e
DH
719 rc = may_context_mount_sb_relabel(context_sid, sbsec,
720 cred);
b04ea3ce 721 if (rc)
c9180a57
EP
722 goto out;
723 sbsec->sid = context_sid;
b04ea3ce 724 } else {
275bb41e
DH
725 rc = may_context_mount_inode_relabel(context_sid, sbsec,
726 cred);
b04ea3ce 727 if (rc)
c9180a57 728 goto out;
b04ea3ce 729 }
c9180a57
EP
730 if (!rootcontext_sid)
731 rootcontext_sid = context_sid;
1da177e4 732
c9180a57 733 sbsec->mntpoint_sid = context_sid;
c312feb2 734 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT
735 }
736
c9180a57 737 if (rootcontext_sid) {
275bb41e
DH
738 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
739 cred);
0808925e 740 if (rc)
c9180a57 741 goto out;
0808925e 742
c9180a57
EP
743 root_isec->sid = rootcontext_sid;
744 root_isec->initialized = 1;
0808925e
EP
745 }
746
c9180a57 747 if (defcontext_sid) {
eb9ae686
DQ
748 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
749 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
c9180a57
EP
750 rc = -EINVAL;
751 printk(KERN_WARNING "SELinux: defcontext option is "
752 "invalid for this filesystem type\n");
753 goto out;
1da177e4
LT
754 }
755
c9180a57
EP
756 if (defcontext_sid != sbsec->def_sid) {
757 rc = may_context_mount_inode_relabel(defcontext_sid,
275bb41e 758 sbsec, cred);
c9180a57
EP
759 if (rc)
760 goto out;
761 }
1da177e4 762
c9180a57 763 sbsec->def_sid = defcontext_sid;
1da177e4
LT
764 }
765
c9180a57 766 rc = sb_finish_set_opts(sb);
1da177e4 767out:
c9180a57 768 mutex_unlock(&sbsec->lock);
1da177e4 769 return rc;
c9180a57
EP
770out_double_mount:
771 rc = -EINVAL;
772 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
773 "security settings for (dev %s, type %s)\n", sb->s_id, name);
774 goto out;
1da177e4
LT
775}
776
094f7b69
JL
777static int selinux_cmp_sb_context(const struct super_block *oldsb,
778 const struct super_block *newsb)
779{
780 struct superblock_security_struct *old = oldsb->s_security;
781 struct superblock_security_struct *new = newsb->s_security;
782 char oldflags = old->flags & SE_MNTMASK;
783 char newflags = new->flags & SE_MNTMASK;
784
785 if (oldflags != newflags)
786 goto mismatch;
787 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
788 goto mismatch;
789 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
790 goto mismatch;
791 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
792 goto mismatch;
793 if (oldflags & ROOTCONTEXT_MNT) {
794 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
795 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
796 if (oldroot->sid != newroot->sid)
797 goto mismatch;
798 }
799 return 0;
800mismatch:
801 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
802 "different security settings for (dev %s, "
803 "type %s)\n", newsb->s_id, newsb->s_type->name);
804 return -EBUSY;
805}
806
807static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
c9180a57 808 struct super_block *newsb)
1da177e4 809{
c9180a57
EP
810 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
811 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 812
c9180a57
EP
813 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
814 int set_context = (oldsbsec->flags & CONTEXT_MNT);
815 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 816
0f5e6420
EP
817 /*
818 * if the parent was able to be mounted it clearly had no special lsm
e8c26255 819 * mount options. thus we can safely deal with this superblock later
0f5e6420 820 */
e8c26255 821 if (!ss_initialized)
094f7b69 822 return 0;
c9180a57 823
c9180a57 824 /* how can we clone if the old one wasn't set up?? */
0d90a7ec 825 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
c9180a57 826
094f7b69 827 /* if fs is reusing a sb, make sure that the contexts match */
0d90a7ec 828 if (newsbsec->flags & SE_SBINITIALIZED)
094f7b69 829 return selinux_cmp_sb_context(oldsb, newsb);
5a552617 830
c9180a57
EP
831 mutex_lock(&newsbsec->lock);
832
833 newsbsec->flags = oldsbsec->flags;
834
835 newsbsec->sid = oldsbsec->sid;
836 newsbsec->def_sid = oldsbsec->def_sid;
837 newsbsec->behavior = oldsbsec->behavior;
838
839 if (set_context) {
840 u32 sid = oldsbsec->mntpoint_sid;
841
842 if (!set_fscontext)
843 newsbsec->sid = sid;
844 if (!set_rootcontext) {
845 struct inode *newinode = newsb->s_root->d_inode;
846 struct inode_security_struct *newisec = newinode->i_security;
847 newisec->sid = sid;
848 }
849 newsbsec->mntpoint_sid = sid;
1da177e4 850 }
c9180a57
EP
851 if (set_rootcontext) {
852 const struct inode *oldinode = oldsb->s_root->d_inode;
853 const struct inode_security_struct *oldisec = oldinode->i_security;
854 struct inode *newinode = newsb->s_root->d_inode;
855 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 856
c9180a57 857 newisec->sid = oldisec->sid;
1da177e4
LT
858 }
859
c9180a57
EP
860 sb_finish_set_opts(newsb);
861 mutex_unlock(&newsbsec->lock);
094f7b69 862 return 0;
c9180a57
EP
863}
864
2e1479d9
AB
865static int selinux_parse_opts_str(char *options,
866 struct security_mnt_opts *opts)
c9180a57 867{
e0007529 868 char *p;
c9180a57
EP
869 char *context = NULL, *defcontext = NULL;
870 char *fscontext = NULL, *rootcontext = NULL;
e0007529 871 int rc, num_mnt_opts = 0;
1da177e4 872
e0007529 873 opts->num_mnt_opts = 0;
1da177e4 874
c9180a57
EP
875 /* Standard string-based options. */
876 while ((p = strsep(&options, "|")) != NULL) {
877 int token;
878 substring_t args[MAX_OPT_ARGS];
1da177e4 879
c9180a57
EP
880 if (!*p)
881 continue;
1da177e4 882
c9180a57 883 token = match_token(p, tokens, args);
1da177e4 884
c9180a57
EP
885 switch (token) {
886 case Opt_context:
887 if (context || defcontext) {
888 rc = -EINVAL;
889 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
890 goto out_err;
891 }
892 context = match_strdup(&args[0]);
893 if (!context) {
894 rc = -ENOMEM;
895 goto out_err;
896 }
897 break;
898
899 case Opt_fscontext:
900 if (fscontext) {
901 rc = -EINVAL;
902 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
903 goto out_err;
904 }
905 fscontext = match_strdup(&args[0]);
906 if (!fscontext) {
907 rc = -ENOMEM;
908 goto out_err;
909 }
910 break;
911
912 case Opt_rootcontext:
913 if (rootcontext) {
914 rc = -EINVAL;
915 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
916 goto out_err;
917 }
918 rootcontext = match_strdup(&args[0]);
919 if (!rootcontext) {
920 rc = -ENOMEM;
921 goto out_err;
922 }
923 break;
924
925 case Opt_defcontext:
926 if (context || defcontext) {
927 rc = -EINVAL;
928 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
929 goto out_err;
930 }
931 defcontext = match_strdup(&args[0]);
932 if (!defcontext) {
933 rc = -ENOMEM;
934 goto out_err;
935 }
936 break;
11689d47
DQ
937 case Opt_labelsupport:
938 break;
c9180a57
EP
939 default:
940 rc = -EINVAL;
941 printk(KERN_WARNING "SELinux: unknown mount option\n");
942 goto out_err;
1da177e4 943
1da177e4 944 }
1da177e4 945 }
c9180a57 946
e0007529
EP
947 rc = -ENOMEM;
948 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
949 if (!opts->mnt_opts)
950 goto out_err;
951
952 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
953 if (!opts->mnt_opts_flags) {
954 kfree(opts->mnt_opts);
955 goto out_err;
956 }
957
c9180a57 958 if (fscontext) {
e0007529
EP
959 opts->mnt_opts[num_mnt_opts] = fscontext;
960 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP
961 }
962 if (context) {
e0007529
EP
963 opts->mnt_opts[num_mnt_opts] = context;
964 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP
965 }
966 if (rootcontext) {
e0007529
EP
967 opts->mnt_opts[num_mnt_opts] = rootcontext;
968 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP
969 }
970 if (defcontext) {
e0007529
EP
971 opts->mnt_opts[num_mnt_opts] = defcontext;
972 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP
973 }
974
e0007529
EP
975 opts->num_mnt_opts = num_mnt_opts;
976 return 0;
977
c9180a57
EP
978out_err:
979 kfree(context);
980 kfree(defcontext);
981 kfree(fscontext);
982 kfree(rootcontext);
1da177e4
LT
983 return rc;
984}
e0007529
EP
985/*
986 * string mount options parsing and call set the sbsec
987 */
988static int superblock_doinit(struct super_block *sb, void *data)
989{
990 int rc = 0;
991 char *options = data;
992 struct security_mnt_opts opts;
993
994 security_init_mnt_opts(&opts);
995
996 if (!data)
997 goto out;
998
999 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1000
1001 rc = selinux_parse_opts_str(options, &opts);
1002 if (rc)
1003 goto out_err;
1004
1005out:
649f6e77 1006 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
e0007529
EP
1007
1008out_err:
1009 security_free_mnt_opts(&opts);
1010 return rc;
1011}
1da177e4 1012
3583a711
AB
1013static void selinux_write_opts(struct seq_file *m,
1014 struct security_mnt_opts *opts)
2069f457
EP
1015{
1016 int i;
1017 char *prefix;
1018
1019 for (i = 0; i < opts->num_mnt_opts; i++) {
11689d47
DQ
1020 char *has_comma;
1021
1022 if (opts->mnt_opts[i])
1023 has_comma = strchr(opts->mnt_opts[i], ',');
1024 else
1025 has_comma = NULL;
2069f457
EP
1026
1027 switch (opts->mnt_opts_flags[i]) {
1028 case CONTEXT_MNT:
1029 prefix = CONTEXT_STR;
1030 break;
1031 case FSCONTEXT_MNT:
1032 prefix = FSCONTEXT_STR;
1033 break;
1034 case ROOTCONTEXT_MNT:
1035 prefix = ROOTCONTEXT_STR;
1036 break;
1037 case DEFCONTEXT_MNT:
1038 prefix = DEFCONTEXT_STR;
1039 break;
11689d47
DQ
1040 case SE_SBLABELSUPP:
1041 seq_putc(m, ',');
1042 seq_puts(m, LABELSUPP_STR);
1043 continue;
2069f457
EP
1044 default:
1045 BUG();
a35c6c83 1046 return;
2069f457
EP
1047 };
1048 /* we need a comma before each option */
1049 seq_putc(m, ',');
1050 seq_puts(m, prefix);
1051 if (has_comma)
1052 seq_putc(m, '\"');
1053 seq_puts(m, opts->mnt_opts[i]);
1054 if (has_comma)
1055 seq_putc(m, '\"');
1056 }
1057}
1058
1059static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060{
1061 struct security_mnt_opts opts;
1062 int rc;
1063
1064 rc = selinux_get_mnt_opts(sb, &opts);
383795c2
EP
1065 if (rc) {
1066 /* before policy load we may get EINVAL, don't show anything */
1067 if (rc == -EINVAL)
1068 rc = 0;
2069f457 1069 return rc;
383795c2 1070 }
2069f457
EP
1071
1072 selinux_write_opts(m, &opts);
1073
1074 security_free_mnt_opts(&opts);
1075
1076 return rc;
1077}
1078
1da177e4
LT
1079static inline u16 inode_mode_to_security_class(umode_t mode)
1080{
1081 switch (mode & S_IFMT) {
1082 case S_IFSOCK:
1083 return SECCLASS_SOCK_FILE;
1084 case S_IFLNK:
1085 return SECCLASS_LNK_FILE;
1086 case S_IFREG:
1087 return SECCLASS_FILE;
1088 case S_IFBLK:
1089 return SECCLASS_BLK_FILE;
1090 case S_IFDIR:
1091 return SECCLASS_DIR;
1092 case S_IFCHR:
1093 return SECCLASS_CHR_FILE;
1094 case S_IFIFO:
1095 return SECCLASS_FIFO_FILE;
1096
1097 }
1098
1099 return SECCLASS_FILE;
1100}
1101
13402580
JM
1102static inline int default_protocol_stream(int protocol)
1103{
1104 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105}
1106
1107static inline int default_protocol_dgram(int protocol)
1108{
1109 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110}
1111
1da177e4
LT
1112static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113{
1114 switch (family) {
1115 case PF_UNIX:
1116 switch (type) {
1117 case SOCK_STREAM:
1118 case SOCK_SEQPACKET:
1119 return SECCLASS_UNIX_STREAM_SOCKET;
1120 case SOCK_DGRAM:
1121 return SECCLASS_UNIX_DGRAM_SOCKET;
1122 }
1123 break;
1124 case PF_INET:
1125 case PF_INET6:
1126 switch (type) {
1127 case SOCK_STREAM:
13402580
JM
1128 if (default_protocol_stream(protocol))
1129 return SECCLASS_TCP_SOCKET;
1130 else
1131 return SECCLASS_RAWIP_SOCKET;
1da177e4 1132 case SOCK_DGRAM:
13402580
JM
1133 if (default_protocol_dgram(protocol))
1134 return SECCLASS_UDP_SOCKET;
1135 else
1136 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM
1137 case SOCK_DCCP:
1138 return SECCLASS_DCCP_SOCKET;
13402580 1139 default:
1da177e4
LT
1140 return SECCLASS_RAWIP_SOCKET;
1141 }
1142 break;
1143 case PF_NETLINK:
1144 switch (protocol) {
1145 case NETLINK_ROUTE:
1146 return SECCLASS_NETLINK_ROUTE_SOCKET;
1147 case NETLINK_FIREWALL:
1148 return SECCLASS_NETLINK_FIREWALL_SOCKET;
7f1fb60c 1149 case NETLINK_SOCK_DIAG:
1da177e4
LT
1150 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151 case NETLINK_NFLOG:
1152 return SECCLASS_NETLINK_NFLOG_SOCKET;
1153 case NETLINK_XFRM:
1154 return SECCLASS_NETLINK_XFRM_SOCKET;
1155 case NETLINK_SELINUX:
1156 return SECCLASS_NETLINK_SELINUX_SOCKET;
1157 case NETLINK_AUDIT:
1158 return SECCLASS_NETLINK_AUDIT_SOCKET;
1159 case NETLINK_IP6_FW:
1160 return SECCLASS_NETLINK_IP6FW_SOCKET;
1161 case NETLINK_DNRTMSG:
1162 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM
1163 case NETLINK_KOBJECT_UEVENT:
1164 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT
1165 default:
1166 return SECCLASS_NETLINK_SOCKET;
1167 }
1168 case PF_PACKET:
1169 return SECCLASS_PACKET_SOCKET;
1170 case PF_KEY:
1171 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP
1172 case PF_APPLETALK:
1173 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT
1174 }
1175
1176 return SECCLASS_SOCKET;
1177}
1178
1179#ifdef CONFIG_PROC_FS
8e6c9693 1180static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT
1181 u16 tclass,
1182 u32 *sid)
1183{
8e6c9693
LAG
1184 int rc;
1185 char *buffer, *path;
1da177e4 1186
828dfe1d 1187 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT
1188 if (!buffer)
1189 return -ENOMEM;
1190
8e6c9693
LAG
1191 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1192 if (IS_ERR(path))
1193 rc = PTR_ERR(path);
1194 else {
1195 /* each process gets a /proc/PID/ entry. Strip off the
1196 * PID part to get a valid selinux labeling.
1197 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1198 while (path[1] >= '0' && path[1] <= '9') {
1199 path[1] = '/';
1200 path++;
1201 }
1202 rc = security_genfs_sid("proc", path, tclass, sid);
1da177e4 1203 }
1da177e4
LT
1204 free_page((unsigned long)buffer);
1205 return rc;
1206}
1207#else
8e6c9693 1208static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT
1209 u16 tclass,
1210 u32 *sid)
1211{
1212 return -EINVAL;
1213}
1214#endif
1215
1216/* The inode's security attributes must be initialized before first use. */
1217static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1218{
1219 struct superblock_security_struct *sbsec = NULL;
1220 struct inode_security_struct *isec = inode->i_security;
1221 u32 sid;
1222 struct dentry *dentry;
1223#define INITCONTEXTLEN 255
1224 char *context = NULL;
1225 unsigned len = 0;
1226 int rc = 0;
1da177e4
LT
1227
1228 if (isec->initialized)
1229 goto out;
1230
23970741 1231 mutex_lock(&isec->lock);
1da177e4 1232 if (isec->initialized)
23970741 1233 goto out_unlock;
1da177e4
LT
1234
1235 sbsec = inode->i_sb->s_security;
0d90a7ec 1236 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1da177e4
LT
1237 /* Defer initialization until selinux_complete_init,
1238 after the initial policy is loaded and the security
1239 server is ready to handle calls. */
1240 spin_lock(&sbsec->isec_lock);
1241 if (list_empty(&isec->list))
1242 list_add(&isec->list, &sbsec->isec_head);
1243 spin_unlock(&sbsec->isec_lock);
23970741 1244 goto out_unlock;
1da177e4
LT
1245 }
1246
1247 switch (sbsec->behavior) {
eb9ae686
DQ
1248 case SECURITY_FS_USE_NATIVE:
1249 break;
1da177e4
LT
1250 case SECURITY_FS_USE_XATTR:
1251 if (!inode->i_op->getxattr) {
1252 isec->sid = sbsec->def_sid;
1253 break;
1254 }
1255
1256 /* Need a dentry, since the xattr API requires one.
1257 Life would be simpler if we could just pass the inode. */
1258 if (opt_dentry) {
1259 /* Called from d_instantiate or d_splice_alias. */
1260 dentry = dget(opt_dentry);
1261 } else {
1262 /* Called from selinux_complete_init, try to find a dentry. */
1263 dentry = d_find_alias(inode);
1264 }
1265 if (!dentry) {
df7f54c0
EP
1266 /*
1267 * this is can be hit on boot when a file is accessed
1268 * before the policy is loaded. When we load policy we
1269 * may find inodes that have no dentry on the
1270 * sbsec->isec_head list. No reason to complain as these
1271 * will get fixed up the next time we go through
1272 * inode_doinit with a dentry, before these inodes could
1273 * be used again by userspace.
1274 */
23970741 1275 goto out_unlock;
1da177e4
LT
1276 }
1277
1278 len = INITCONTEXTLEN;
4cb912f1 1279 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1280 if (!context) {
1281 rc = -ENOMEM;
1282 dput(dentry);
23970741 1283 goto out_unlock;
1da177e4 1284 }
4cb912f1 1285 context[len] = '\0';
1da177e4
LT
1286 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1287 context, len);
1288 if (rc == -ERANGE) {
314dabb8
JM
1289 kfree(context);
1290
1da177e4
LT
1291 /* Need a larger buffer. Query for the right size. */
1292 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1293 NULL, 0);
1294 if (rc < 0) {
1295 dput(dentry);
23970741 1296 goto out_unlock;
1da177e4 1297 }
1da177e4 1298 len = rc;
4cb912f1 1299 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1300 if (!context) {
1301 rc = -ENOMEM;
1302 dput(dentry);
23970741 1303 goto out_unlock;
1da177e4 1304 }
4cb912f1 1305 context[len] = '\0';
1da177e4
LT
1306 rc = inode->i_op->getxattr(dentry,
1307 XATTR_NAME_SELINUX,
1308 context, len);
1309 }
1310 dput(dentry);
1311 if (rc < 0) {
1312 if (rc != -ENODATA) {
744ba35e 1313 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1314 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT
1315 -rc, inode->i_sb->s_id, inode->i_ino);
1316 kfree(context);
23970741 1317 goto out_unlock;
1da177e4
LT
1318 }
1319 /* Map ENODATA to the default file SID */
1320 sid = sbsec->def_sid;
1321 rc = 0;
1322 } else {
f5c1d5b2 1323 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS
1324 sbsec->def_sid,
1325 GFP_NOFS);
1da177e4 1326 if (rc) {
4ba0a8ad
EP
1327 char *dev = inode->i_sb->s_id;
1328 unsigned long ino = inode->i_ino;
1329
1330 if (rc == -EINVAL) {
1331 if (printk_ratelimit())
1332 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1333 "context=%s. This indicates you may need to relabel the inode or the "
1334 "filesystem in question.\n", ino, dev, context);
1335 } else {
1336 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1337 "returned %d for dev=%s ino=%ld\n",
1338 __func__, context, -rc, dev, ino);
1339 }
1da177e4
LT
1340 kfree(context);
1341 /* Leave with the unlabeled SID */
1342 rc = 0;
1343 break;
1344 }
1345 }
1346 kfree(context);
1347 isec->sid = sid;
1348 break;
1349 case SECURITY_FS_USE_TASK:
1350 isec->sid = isec->task_sid;
1351 break;
1352 case SECURITY_FS_USE_TRANS:
1353 /* Default to the fs SID. */
1354 isec->sid = sbsec->sid;
1355
1356 /* Try to obtain a transition SID. */
1357 isec->sclass = inode_mode_to_security_class(inode->i_mode);
652bb9b0
EP
1358 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1359 isec->sclass, NULL, &sid);
1da177e4 1360 if (rc)
23970741 1361 goto out_unlock;
1da177e4
LT
1362 isec->sid = sid;
1363 break;
c312feb2
EP
1364 case SECURITY_FS_USE_MNTPOINT:
1365 isec->sid = sbsec->mntpoint_sid;
1366 break;
1da177e4 1367 default:
c312feb2 1368 /* Default to the fs superblock SID. */
1da177e4
LT
1369 isec->sid = sbsec->sid;
1370
0d90a7ec 1371 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
8e6c9693 1372 if (opt_dentry) {
1da177e4 1373 isec->sclass = inode_mode_to_security_class(inode->i_mode);
8e6c9693 1374 rc = selinux_proc_get_sid(opt_dentry,
1da177e4
LT
1375 isec->sclass,
1376 &sid);
1377 if (rc)
23970741 1378 goto out_unlock;
1da177e4
LT
1379 isec->sid = sid;
1380 }
1381 }
1382 break;
1383 }
1384
1385 isec->initialized = 1;
1386
23970741
EP
1387out_unlock:
1388 mutex_unlock(&isec->lock);
1da177e4
LT
1389out:
1390 if (isec->sclass == SECCLASS_FILE)
1391 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT
1392 return rc;
1393}
1394
1395/* Convert a Linux signal to an access vector. */
1396static inline u32 signal_to_av(int sig)
1397{
1398 u32 perm = 0;
1399
1400 switch (sig) {
1401 case SIGCHLD:
1402 /* Commonly granted from child to parent. */
1403 perm = PROCESS__SIGCHLD;
1404 break;
1405 case SIGKILL:
1406 /* Cannot be caught or ignored */
1407 perm = PROCESS__SIGKILL;
1408 break;
1409 case SIGSTOP:
1410 /* Cannot be caught or ignored */
1411 perm = PROCESS__SIGSTOP;
1412 break;
1413 default:
1414 /* All other signals. */
1415 perm = PROCESS__SIGNAL;
1416 break;
1417 }
1418
1419 return perm;
1420}
1421
d84f4f99
DH
1422/*
1423 * Check permission between a pair of credentials
1424 * fork check, ptrace check, etc.
1425 */
1426static int cred_has_perm(const struct cred *actor,
1427 const struct cred *target,
1428 u32 perms)
1429{
1430 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1431
1432 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1433}
1434
275bb41e 1435/*
88e67f3b 1436 * Check permission between a pair of tasks, e.g. signal checks,
275bb41e
DH
1437 * fork check, ptrace check, etc.
1438 * tsk1 is the actor and tsk2 is the target
3b11a1de 1439 * - this uses the default subjective creds of tsk1
275bb41e
DH
1440 */
1441static int task_has_perm(const struct task_struct *tsk1,
1442 const struct task_struct *tsk2,
1da177e4
LT
1443 u32 perms)
1444{
275bb41e
DH
1445 const struct task_security_struct *__tsec1, *__tsec2;
1446 u32 sid1, sid2;
1da177e4 1447
275bb41e
DH
1448 rcu_read_lock();
1449 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1450 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1451 rcu_read_unlock();
1452 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1da177e4
LT
1453}
1454
3b11a1de
DH
1455/*
1456 * Check permission between current and another task, e.g. signal checks,
1457 * fork check, ptrace check, etc.
1458 * current is the actor and tsk2 is the target
1459 * - this uses current's subjective creds
1460 */
1461static int current_has_perm(const struct task_struct *tsk,
1462 u32 perms)
1463{
1464 u32 sid, tsid;
1465
1466 sid = current_sid();
1467 tsid = task_sid(tsk);
1468 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1469}
1470
b68e418c
SS
1471#if CAP_LAST_CAP > 63
1472#error Fix SELinux to handle capabilities > 63.
1473#endif
1474
1da177e4 1475/* Check whether a task is allowed to use a capability. */
6a9de491 1476static int cred_has_capability(const struct cred *cred,
06112163 1477 int cap, int audit)
1da177e4 1478{
2bf49690 1479 struct common_audit_data ad;
06112163 1480 struct av_decision avd;
b68e418c 1481 u16 sclass;
3699c53c 1482 u32 sid = cred_sid(cred);
b68e418c 1483 u32 av = CAP_TO_MASK(cap);
06112163 1484 int rc;
1da177e4 1485
50c205f5 1486 ad.type = LSM_AUDIT_DATA_CAP;
1da177e4
LT
1487 ad.u.cap = cap;
1488
b68e418c
SS
1489 switch (CAP_TO_INDEX(cap)) {
1490 case 0:
1491 sclass = SECCLASS_CAPABILITY;
1492 break;
1493 case 1:
1494 sclass = SECCLASS_CAPABILITY2;
1495 break;
1496 default:
1497 printk(KERN_ERR
1498 "SELinux: out of range capability %d\n", cap);
1499 BUG();
a35c6c83 1500 return -EINVAL;
b68e418c 1501 }
06112163 1502
275bb41e 1503 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
9ade0cf4
EP
1504 if (audit == SECURITY_CAP_AUDIT) {
1505 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1506 if (rc2)
1507 return rc2;
1508 }
06112163 1509 return rc;
1da177e4
LT
1510}
1511
1512/* Check whether a task is allowed to use a system operation. */
1513static int task_has_system(struct task_struct *tsk,
1514 u32 perms)
1515{
275bb41e 1516 u32 sid = task_sid(tsk);
1da177e4 1517
275bb41e 1518 return avc_has_perm(sid, SECINITSID_KERNEL,
1da177e4
LT
1519 SECCLASS_SYSTEM, perms, NULL);
1520}
1521
1522/* Check whether a task has a particular permission to an inode.
1523 The 'adp' parameter is optional and allows other audit
1524 data to be passed (e.g. the dentry). */
88e67f3b 1525static int inode_has_perm(const struct cred *cred,
1da177e4
LT
1526 struct inode *inode,
1527 u32 perms,
9ade0cf4
EP
1528 struct common_audit_data *adp,
1529 unsigned flags)
1da177e4 1530{
1da177e4 1531 struct inode_security_struct *isec;
275bb41e 1532 u32 sid;
1da177e4 1533
e0e81739
DH
1534 validate_creds(cred);
1535
828dfe1d 1536 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS
1537 return 0;
1538
88e67f3b 1539 sid = cred_sid(cred);
1da177e4
LT
1540 isec = inode->i_security;
1541
9ade0cf4 1542 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1da177e4
LT
1543}
1544
1545/* Same as inode_has_perm, but pass explicit audit data containing
1546 the dentry to help the auditing code to more easily generate the
1547 pathname if needed. */
88e67f3b 1548static inline int dentry_has_perm(const struct cred *cred,
1da177e4
LT
1549 struct dentry *dentry,
1550 u32 av)
1551{
1552 struct inode *inode = dentry->d_inode;
2bf49690 1553 struct common_audit_data ad;
88e67f3b 1554
50c205f5 1555 ad.type = LSM_AUDIT_DATA_DENTRY;
2875fa00
EP
1556 ad.u.dentry = dentry;
1557 return inode_has_perm(cred, inode, av, &ad, 0);
1558}
1559
1560/* Same as inode_has_perm, but pass explicit audit data containing
1561 the path to help the auditing code to more easily generate the
1562 pathname if needed. */
1563static inline int path_has_perm(const struct cred *cred,
1564 struct path *path,
1565 u32 av)
1566{
1567 struct inode *inode = path->dentry->d_inode;
1568 struct common_audit_data ad;
1569
50c205f5 1570 ad.type = LSM_AUDIT_DATA_PATH;
2875fa00 1571 ad.u.path = *path;
9ade0cf4 1572 return inode_has_perm(cred, inode, av, &ad, 0);
1da177e4
LT
1573}
1574
13f8e981
DH
1575/* Same as path_has_perm, but uses the inode from the file struct. */
1576static inline int file_path_has_perm(const struct cred *cred,
1577 struct file *file,
1578 u32 av)
1579{
1580 struct common_audit_data ad;
1581
1582 ad.type = LSM_AUDIT_DATA_PATH;
1583 ad.u.path = file->f_path;
1584 return inode_has_perm(cred, file_inode(file), av, &ad, 0);
1585}
1586
1da177e4
LT
1587/* Check whether a task can use an open file descriptor to
1588 access an inode in a given way. Check access to the
1589 descriptor itself, and then use dentry_has_perm to
1590 check a particular permission to the file.
1591 Access to the descriptor is implicitly granted if it
1592 has the same SID as the process. If av is zero, then
1593 access to the file is not checked, e.g. for cases
1594 where only the descriptor is affected like seek. */
88e67f3b
DH
1595static int file_has_perm(const struct cred *cred,
1596 struct file *file,
1597 u32 av)
1da177e4 1598{
1da177e4 1599 struct file_security_struct *fsec = file->f_security;
496ad9aa 1600 struct inode *inode = file_inode(file);
2bf49690 1601 struct common_audit_data ad;
88e67f3b 1602 u32 sid = cred_sid(cred);
1da177e4
LT
1603 int rc;
1604
50c205f5 1605 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 1606 ad.u.path = file->f_path;
1da177e4 1607
275bb41e
DH
1608 if (sid != fsec->sid) {
1609 rc = avc_has_perm(sid, fsec->sid,
1da177e4
LT
1610 SECCLASS_FD,
1611 FD__USE,
1612 &ad);
1613 if (rc)
88e67f3b 1614 goto out;
1da177e4
LT
1615 }
1616
1617 /* av is zero if only checking access to the descriptor. */
88e67f3b 1618 rc = 0;
1da177e4 1619 if (av)
9ade0cf4 1620 rc = inode_has_perm(cred, inode, av, &ad, 0);
1da177e4 1621
88e67f3b
DH
1622out:
1623 return rc;
1da177e4
LT
1624}
1625
1626/* Check whether a task can create a file. */
1627static int may_create(struct inode *dir,
1628 struct dentry *dentry,
1629 u16 tclass)
1630{
5fb49870 1631 const struct task_security_struct *tsec = current_security();
1da177e4
LT
1632 struct inode_security_struct *dsec;
1633 struct superblock_security_struct *sbsec;
275bb41e 1634 u32 sid, newsid;
2bf49690 1635 struct common_audit_data ad;
1da177e4
LT
1636 int rc;
1637
1da177e4
LT
1638 dsec = dir->i_security;
1639 sbsec = dir->i_sb->s_security;
1640
275bb41e
DH
1641 sid = tsec->sid;
1642 newsid = tsec->create_sid;
1643
50c205f5 1644 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1645 ad.u.dentry = dentry;
1da177e4 1646
275bb41e 1647 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1da177e4
LT
1648 DIR__ADD_NAME | DIR__SEARCH,
1649 &ad);
1650 if (rc)
1651 return rc;
1652
cd89596f 1653 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
cb1e922f
EP
1654 rc = security_transition_sid(sid, dsec->sid, tclass,
1655 &dentry->d_name, &newsid);
1da177e4
LT
1656 if (rc)
1657 return rc;
1658 }
1659
275bb41e 1660 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1da177e4
LT
1661 if (rc)
1662 return rc;
1663
1664 return avc_has_perm(newsid, sbsec->sid,
1665 SECCLASS_FILESYSTEM,
1666 FILESYSTEM__ASSOCIATE, &ad);
1667}
1668
4eb582cf
ML
1669/* Check whether a task can create a key. */
1670static int may_create_key(u32 ksid,
1671 struct task_struct *ctx)
1672{
275bb41e 1673 u32 sid = task_sid(ctx);
4eb582cf 1674
275bb41e 1675 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
4eb582cf
ML
1676}
1677
828dfe1d
EP
1678#define MAY_LINK 0
1679#define MAY_UNLINK 1
1680#define MAY_RMDIR 2
1da177e4
LT
1681
1682/* Check whether a task can link, unlink, or rmdir a file/directory. */
1683static int may_link(struct inode *dir,
1684 struct dentry *dentry,
1685 int kind)
1686
1687{
1da177e4 1688 struct inode_security_struct *dsec, *isec;
2bf49690 1689 struct common_audit_data ad;
275bb41e 1690 u32 sid = current_sid();
1da177e4
LT
1691 u32 av;
1692 int rc;
1693
1da177e4
LT
1694 dsec = dir->i_security;
1695 isec = dentry->d_inode->i_security;
1696
50c205f5 1697 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1698 ad.u.dentry = dentry;
1da177e4
LT
1699
1700 av = DIR__SEARCH;
1701 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
275bb41e 1702 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1703 if (rc)
1704 return rc;
1705
1706 switch (kind) {
1707 case MAY_LINK:
1708 av = FILE__LINK;
1709 break;
1710 case MAY_UNLINK:
1711 av = FILE__UNLINK;
1712 break;
1713 case MAY_RMDIR:
1714 av = DIR__RMDIR;
1715 break;
1716 default:
744ba35e
EP
1717 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1718 __func__, kind);
1da177e4
LT
1719 return 0;
1720 }
1721
275bb41e 1722 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1da177e4
LT
1723 return rc;
1724}
1725
1726static inline int may_rename(struct inode *old_dir,
1727 struct dentry *old_dentry,
1728 struct inode *new_dir,
1729 struct dentry *new_dentry)
1730{
1da177e4 1731 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2bf49690 1732 struct common_audit_data ad;
275bb41e 1733 u32 sid = current_sid();
1da177e4
LT
1734 u32 av;
1735 int old_is_dir, new_is_dir;
1736 int rc;
1737
1da177e4
LT
1738 old_dsec = old_dir->i_security;
1739 old_isec = old_dentry->d_inode->i_security;
1740 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1741 new_dsec = new_dir->i_security;
1742
50c205f5 1743 ad.type = LSM_AUDIT_DATA_DENTRY;
1da177e4 1744
a269434d 1745 ad.u.dentry = old_dentry;
275bb41e 1746 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1da177e4
LT
1747 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1748 if (rc)
1749 return rc;
275bb41e 1750 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1751 old_isec->sclass, FILE__RENAME, &ad);
1752 if (rc)
1753 return rc;
1754 if (old_is_dir && new_dir != old_dir) {
275bb41e 1755 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1756 old_isec->sclass, DIR__REPARENT, &ad);
1757 if (rc)
1758 return rc;
1759 }
1760
a269434d 1761 ad.u.dentry = new_dentry;
1da177e4
LT
1762 av = DIR__ADD_NAME | DIR__SEARCH;
1763 if (new_dentry->d_inode)
1764 av |= DIR__REMOVE_NAME;
275bb41e 1765 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1766 if (rc)
1767 return rc;
1768 if (new_dentry->d_inode) {
1769 new_isec = new_dentry->d_inode->i_security;
1770 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
275bb41e 1771 rc = avc_has_perm(sid, new_isec->sid,
1da177e4
LT
1772 new_isec->sclass,
1773 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1774 if (rc)
1775 return rc;
1776 }
1777
1778 return 0;
1779}
1780
1781/* Check whether a task can perform a filesystem operation. */
88e67f3b 1782static int superblock_has_perm(const struct cred *cred,
1da177e4
LT
1783 struct super_block *sb,
1784 u32 perms,
2bf49690 1785 struct common_audit_data *ad)
1da177e4 1786{
1da177e4 1787 struct superblock_security_struct *sbsec;
88e67f3b 1788 u32 sid = cred_sid(cred);
1da177e4 1789
1da177e4 1790 sbsec = sb->s_security;
275bb41e 1791 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1da177e4
LT
1792}
1793
1794/* Convert a Linux mode and permission mask to an access vector. */
1795static inline u32 file_mask_to_av(int mode, int mask)
1796{
1797 u32 av = 0;
1798
dba19c60 1799 if (!S_ISDIR(mode)) {
1da177e4
LT
1800 if (mask & MAY_EXEC)
1801 av |= FILE__EXECUTE;
1802 if (mask & MAY_READ)
1803 av |= FILE__READ;
1804
1805 if (mask & MAY_APPEND)
1806 av |= FILE__APPEND;
1807 else if (mask & MAY_WRITE)
1808 av |= FILE__WRITE;
1809
1810 } else {
1811 if (mask & MAY_EXEC)
1812 av |= DIR__SEARCH;
1813 if (mask & MAY_WRITE)
1814 av |= DIR__WRITE;
1815 if (mask & MAY_READ)
1816 av |= DIR__READ;
1817 }
1818
1819 return av;
1820}
1821
8b6a5a37
EP
1822/* Convert a Linux file to an access vector. */
1823static inline u32 file_to_av(struct file *file)
1824{
1825 u32 av = 0;
1826
1827 if (file->f_mode & FMODE_READ)
1828 av |= FILE__READ;
1829 if (file->f_mode & FMODE_WRITE) {
1830 if (file->f_flags & O_APPEND)
1831 av |= FILE__APPEND;
1832 else
1833 av |= FILE__WRITE;
1834 }
1835 if (!av) {
1836 /*
1837 * Special file opened with flags 3 for ioctl-only use.
1838 */
1839 av = FILE__IOCTL;
1840 }
1841
1842 return av;
1843}
1844
b0c636b9 1845/*
8b6a5a37 1846 * Convert a file to an access vector and include the correct open
b0c636b9
EP
1847 * open permission.
1848 */
8b6a5a37 1849static inline u32 open_file_to_av(struct file *file)
b0c636b9 1850{
8b6a5a37 1851 u32 av = file_to_av(file);
b0c636b9 1852
49b7b8de
EP
1853 if (selinux_policycap_openperm)
1854 av |= FILE__OPEN;
1855
b0c636b9
EP
1856 return av;
1857}
1858
1da177e4
LT
1859/* Hook functions begin here. */
1860
9e48858f 1861static int selinux_ptrace_access_check(struct task_struct *child,
5cd9c58f 1862 unsigned int mode)
1da177e4 1863{
1da177e4
LT
1864 int rc;
1865
9e48858f 1866 rc = cap_ptrace_access_check(child, mode);
1da177e4
LT
1867 if (rc)
1868 return rc;
1869
69f594a3 1870 if (mode & PTRACE_MODE_READ) {
275bb41e
DH
1871 u32 sid = current_sid();
1872 u32 csid = task_sid(child);
1873 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
006ebb40
SS
1874 }
1875
3b11a1de 1876 return current_has_perm(child, PROCESS__PTRACE);
5cd9c58f
DH
1877}
1878
1879static int selinux_ptrace_traceme(struct task_struct *parent)
1880{
1881 int rc;
1882
200ac532 1883 rc = cap_ptrace_traceme(parent);
5cd9c58f
DH
1884 if (rc)
1885 return rc;
1886
1887 return task_has_perm(parent, current, PROCESS__PTRACE);
1da177e4
LT
1888}
1889
1890static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1891 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT
1892{
1893 int error;
1894
3b11a1de 1895 error = current_has_perm(target, PROCESS__GETCAP);
1da177e4
LT
1896 if (error)
1897 return error;
1898
200ac532 1899 return cap_capget(target, effective, inheritable, permitted);
1da177e4
LT
1900}
1901
d84f4f99
DH
1902static int selinux_capset(struct cred *new, const struct cred *old,
1903 const kernel_cap_t *effective,
1904 const kernel_cap_t *inheritable,
1905 const kernel_cap_t *permitted)
1da177e4
LT
1906{
1907 int error;
1908
200ac532 1909 error = cap_capset(new, old,
d84f4f99 1910 effective, inheritable, permitted);
1da177e4
LT
1911 if (error)
1912 return error;
1913
d84f4f99 1914 return cred_has_perm(old, new, PROCESS__SETCAP);
1da177e4
LT
1915}
1916
5626d3e8
JM
1917/*
1918 * (This comment used to live with the selinux_task_setuid hook,
1919 * which was removed).
1920 *
1921 * Since setuid only affects the current process, and since the SELinux
1922 * controls are not based on the Linux identity attributes, SELinux does not
1923 * need to control this operation. However, SELinux does control the use of
1924 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1925 */
1926
6a9de491
EP
1927static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1928 int cap, int audit)
1da177e4
LT
1929{
1930 int rc;
1931
6a9de491 1932 rc = cap_capable(cred, ns, cap, audit);
1da177e4
LT
1933 if (rc)
1934 return rc;
1935
6a9de491 1936 return cred_has_capability(cred, cap, audit);
1da177e4
LT
1937}
1938
1da177e4
LT
1939static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1940{
88e67f3b 1941 const struct cred *cred = current_cred();
1da177e4
LT
1942 int rc = 0;
1943
1944 if (!sb)
1945 return 0;
1946
1947 switch (cmds) {
828dfe1d
EP
1948 case Q_SYNC:
1949 case Q_QUOTAON:
1950 case Q_QUOTAOFF:
1951 case Q_SETINFO:
1952 case Q_SETQUOTA:
88e67f3b 1953 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
828dfe1d
EP
1954 break;
1955 case Q_GETFMT:
1956 case Q_GETINFO:
1957 case Q_GETQUOTA:
88e67f3b 1958 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
828dfe1d
EP
1959 break;
1960 default:
1961 rc = 0; /* let the kernel handle invalid cmds */
1962 break;
1da177e4
LT
1963 }
1964 return rc;
1965}
1966
1967static int selinux_quota_on(struct dentry *dentry)
1968{
88e67f3b
DH
1969 const struct cred *cred = current_cred();
1970
2875fa00 1971 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1da177e4
LT
1972}
1973
12b3052c 1974static int selinux_syslog(int type)
1da177e4
LT
1975{
1976 int rc;
1977
1da177e4 1978 switch (type) {
d78ca3cd
KC
1979 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1980 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
828dfe1d
EP
1981 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1982 break;
d78ca3cd
KC
1983 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1984 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1985 /* Set level of messages printed to console */
1986 case SYSLOG_ACTION_CONSOLE_LEVEL:
828dfe1d
EP
1987 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1988 break;
d78ca3cd
KC
1989 case SYSLOG_ACTION_CLOSE: /* Close log */
1990 case SYSLOG_ACTION_OPEN: /* Open log */
1991 case SYSLOG_ACTION_READ: /* Read from log */
1992 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1993 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
828dfe1d
EP
1994 default:
1995 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1996 break;
1da177e4
LT
1997 }
1998 return rc;
1999}
2000
2001/*
2002 * Check that a process has enough memory to allocate a new virtual
2003 * mapping. 0 means there is enough memory for the allocation to
2004 * succeed and -ENOMEM implies there is not.
2005 *
1da177e4
LT
2006 * Do not audit the selinux permission check, as this is applied to all
2007 * processes that allocate mappings.
2008 */
34b4e4aa 2009static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT
2010{
2011 int rc, cap_sys_admin = 0;
1da177e4 2012
6a9de491 2013 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
3699c53c 2014 SECURITY_CAP_NOAUDIT);
1da177e4
LT
2015 if (rc == 0)
2016 cap_sys_admin = 1;
2017
34b4e4aa 2018 return __vm_enough_memory(mm, pages, cap_sys_admin);
1da177e4
LT
2019}
2020
2021/* binprm security operations */
2022
a6f76f23 2023static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1da177e4 2024{
a6f76f23
DH
2025 const struct task_security_struct *old_tsec;
2026 struct task_security_struct *new_tsec;
1da177e4 2027 struct inode_security_struct *isec;
2bf49690 2028 struct common_audit_data ad;
496ad9aa 2029 struct inode *inode = file_inode(bprm->file);
1da177e4
LT
2030 int rc;
2031
200ac532 2032 rc = cap_bprm_set_creds(bprm);
1da177e4
LT
2033 if (rc)
2034 return rc;
2035
a6f76f23
DH
2036 /* SELinux context only depends on initial program or script and not
2037 * the script interpreter */
2038 if (bprm->cred_prepared)
1da177e4
LT
2039 return 0;
2040
a6f76f23
DH
2041 old_tsec = current_security();
2042 new_tsec = bprm->cred->security;
1da177e4
LT
2043 isec = inode->i_security;
2044
2045 /* Default to the current task SID. */
a6f76f23
DH
2046 new_tsec->sid = old_tsec->sid;
2047 new_tsec->osid = old_tsec->sid;
1da177e4 2048
28eba5bf 2049 /* Reset fs, key, and sock SIDs on execve. */
a6f76f23
DH
2050 new_tsec->create_sid = 0;
2051 new_tsec->keycreate_sid = 0;
2052 new_tsec->sockcreate_sid = 0;
1da177e4 2053
a6f76f23
DH
2054 if (old_tsec->exec_sid) {
2055 new_tsec->sid = old_tsec->exec_sid;
1da177e4 2056 /* Reset exec SID on execve. */
a6f76f23 2057 new_tsec->exec_sid = 0;
259e5e6c
AL
2058
2059 /*
2060 * Minimize confusion: if no_new_privs and a transition is
2061 * explicitly requested, then fail the exec.
2062 */
2063 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2064 return -EPERM;
1da177e4
LT
2065 } else {
2066 /* Check for a default transition on this program. */
a6f76f23 2067 rc = security_transition_sid(old_tsec->sid, isec->sid,
652bb9b0
EP
2068 SECCLASS_PROCESS, NULL,
2069 &new_tsec->sid);
1da177e4
LT
2070 if (rc)
2071 return rc;
2072 }
2073
50c205f5 2074 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 2075 ad.u.path = bprm->file->f_path;
1da177e4 2076
259e5e6c
AL
2077 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2078 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
a6f76f23 2079 new_tsec->sid = old_tsec->sid;
1da177e4 2080
a6f76f23
DH
2081 if (new_tsec->sid == old_tsec->sid) {
2082 rc = avc_has_perm(old_tsec->sid, isec->sid,
1da177e4
LT
2083 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2084 if (rc)
2085 return rc;
2086 } else {
2087 /* Check permissions for the transition. */
a6f76f23 2088 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
1da177e4
LT
2089 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2090 if (rc)
2091 return rc;
2092
a6f76f23 2093 rc = avc_has_perm(new_tsec->sid, isec->sid,
1da177e4
LT
2094 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2095 if (rc)
2096 return rc;
2097
a6f76f23
DH
2098 /* Check for shared state */
2099 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2100 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2101 SECCLASS_PROCESS, PROCESS__SHARE,
2102 NULL);
2103 if (rc)
2104 return -EPERM;
2105 }
2106
2107 /* Make sure that anyone attempting to ptrace over a task that
2108 * changes its SID has the appropriate permit */
2109 if (bprm->unsafe &
2110 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2111 struct task_struct *tracer;
2112 struct task_security_struct *sec;
2113 u32 ptsid = 0;
2114
2115 rcu_read_lock();
06d98473 2116 tracer = ptrace_parent(current);
a6f76f23
DH
2117 if (likely(tracer != NULL)) {
2118 sec = __task_cred(tracer)->security;
2119 ptsid = sec->sid;
2120 }
2121 rcu_read_unlock();
2122
2123 if (ptsid != 0) {
2124 rc = avc_has_perm(ptsid, new_tsec->sid,
2125 SECCLASS_PROCESS,
2126 PROCESS__PTRACE, NULL);
2127 if (rc)
2128 return -EPERM;
2129 }
2130 }
1da177e4 2131
a6f76f23
DH
2132 /* Clear any possibly unsafe personality bits on exec: */
2133 bprm->per_clear |= PER_CLEAR_ON_SETID;
1da177e4
LT
2134 }
2135
1da177e4
LT
2136 return 0;
2137}
2138
828dfe1d 2139static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4 2140{
5fb49870 2141 const struct task_security_struct *tsec = current_security();
275bb41e 2142 u32 sid, osid;
1da177e4
LT
2143 int atsecure = 0;
2144
275bb41e
DH
2145 sid = tsec->sid;
2146 osid = tsec->osid;
2147
2148 if (osid != sid) {
1da177e4
LT
2149 /* Enable secure mode for SIDs transitions unless
2150 the noatsecure permission is granted between
2151 the two SIDs, i.e. ahp returns 0. */
275bb41e 2152 atsecure = avc_has_perm(osid, sid,
a6f76f23
DH
2153 SECCLASS_PROCESS,
2154 PROCESS__NOATSECURE, NULL);
1da177e4
LT
2155 }
2156
200ac532 2157 return (atsecure || cap_bprm_secureexec(bprm));
1da177e4
LT
2158}
2159
c3c073f8
AV
2160static int match_file(const void *p, struct file *file, unsigned fd)
2161{
2162 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2163}
2164
1da177e4 2165/* Derived from fs/exec.c:flush_old_files. */
745ca247
DH
2166static inline void flush_unauthorized_files(const struct cred *cred,
2167 struct files_struct *files)
1da177e4 2168{
1da177e4 2169 struct file *file, *devnull = NULL;
b20c8122 2170 struct tty_struct *tty;
24ec839c 2171 int drop_tty = 0;
c3c073f8 2172 unsigned n;
1da177e4 2173
24ec839c 2174 tty = get_current_tty();
1da177e4 2175 if (tty) {
ee2ffa0d 2176 spin_lock(&tty_files_lock);
37dd0bd0 2177 if (!list_empty(&tty->tty_files)) {
d996b62a 2178 struct tty_file_private *file_priv;
37dd0bd0 2179
1da177e4 2180 /* Revalidate access to controlling tty.
13f8e981
DH
2181 Use file_path_has_perm on the tty path directly
2182 rather than using file_has_perm, as this particular
2183 open file may belong to another process and we are
2184 only interested in the inode-based check here. */
d996b62a
NP
2185 file_priv = list_first_entry(&tty->tty_files,
2186 struct tty_file_private, list);
2187 file = file_priv->file;
13f8e981 2188 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
24ec839c 2189 drop_tty = 1;
1da177e4 2190 }
ee2ffa0d 2191 spin_unlock(&tty_files_lock);
452a00d2 2192 tty_kref_put(tty);
1da177e4 2193 }
98a27ba4
EB
2194 /* Reset controlling tty. */
2195 if (drop_tty)
2196 no_tty();
1da177e4
LT
2197
2198 /* Revalidate access to inherited open files. */
c3c073f8
AV
2199 n = iterate_fd(files, 0, match_file, cred);
2200 if (!n) /* none found? */
2201 return;
1da177e4 2202
c3c073f8 2203 devnull = dentry_open(&selinux_null, O_RDWR, cred);
45525b26
AV
2204 if (IS_ERR(devnull))
2205 devnull = NULL;
2206 /* replace all the matching ones with this */
2207 do {
2208 replace_fd(n - 1, devnull, 0);
2209 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2210 if (devnull)
c3c073f8 2211 fput(devnull);
1da177e4
LT
2212}
2213
a6f76f23
DH
2214/*
2215 * Prepare a process for imminent new credential changes due to exec
2216 */
2217static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
1da177e4 2218{
a6f76f23
DH
2219 struct task_security_struct *new_tsec;
2220 struct rlimit *rlim, *initrlim;
2221 int rc, i;
d84f4f99 2222
a6f76f23
DH
2223 new_tsec = bprm->cred->security;
2224 if (new_tsec->sid == new_tsec->osid)
2225 return;
1da177e4 2226
a6f76f23
DH
2227 /* Close files for which the new task SID is not authorized. */
2228 flush_unauthorized_files(bprm->cred, current->files);
0356357c 2229
a6f76f23
DH
2230 /* Always clear parent death signal on SID transitions. */
2231 current->pdeath_signal = 0;
0356357c 2232
a6f76f23
DH
2233 /* Check whether the new SID can inherit resource limits from the old
2234 * SID. If not, reset all soft limits to the lower of the current
2235 * task's hard limit and the init task's soft limit.
2236 *
2237 * Note that the setting of hard limits (even to lower them) can be
2238 * controlled by the setrlimit check. The inclusion of the init task's
2239 * soft limit into the computation is to avoid resetting soft limits
2240 * higher than the default soft limit for cases where the default is
2241 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2242 */
2243 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2244 PROCESS__RLIMITINH, NULL);
2245 if (rc) {
eb2d55a3
ON
2246 /* protect against do_prlimit() */
2247 task_lock(current);
a6f76f23
DH
2248 for (i = 0; i < RLIM_NLIMITS; i++) {
2249 rlim = current->signal->rlim + i;
2250 initrlim = init_task.signal->rlim + i;
2251 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4 2252 }
eb2d55a3
ON
2253 task_unlock(current);
2254 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
1da177e4
LT
2255 }
2256}
2257
2258/*
a6f76f23
DH
2259 * Clean up the process immediately after the installation of new credentials
2260 * due to exec
1da177e4 2261 */
a6f76f23 2262static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
1da177e4 2263{
a6f76f23 2264 const struct task_security_struct *tsec = current_security();
1da177e4 2265 struct itimerval itimer;
a6f76f23 2266 u32 osid, sid;
1da177e4
LT
2267 int rc, i;
2268
a6f76f23
DH
2269 osid = tsec->osid;
2270 sid = tsec->sid;
2271
2272 if (sid == osid)
1da177e4
LT
2273 return;
2274
a6f76f23
DH
2275 /* Check whether the new SID can inherit signal state from the old SID.
2276 * If not, clear itimers to avoid subsequent signal generation and
2277 * flush and unblock signals.
2278 *
2279 * This must occur _after_ the task SID has been updated so that any
2280 * kill done after the flush will be checked against the new SID.
2281 */
2282 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
1da177e4
LT
2283 if (rc) {
2284 memset(&itimer, 0, sizeof itimer);
2285 for (i = 0; i < 3; i++)
2286 do_setitimer(i, &itimer, NULL);
1da177e4 2287 spin_lock_irq(&current->sighand->siglock);
3bcac026
DH
2288 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2289 __flush_signals(current);
2290 flush_signal_handlers(current, 1);
2291 sigemptyset(&current->blocked);
2292 }
1da177e4
LT
2293 spin_unlock_irq(&current->sighand->siglock);
2294 }
2295
a6f76f23
DH
2296 /* Wake up the parent if it is waiting so that it can recheck
2297 * wait permission to the new task SID. */
ecd6de3c 2298 read_lock(&tasklist_lock);
0b7570e7 2299 __wake_up_parent(current, current->real_parent);
ecd6de3c 2300 read_unlock(&tasklist_lock);
1da177e4
LT
2301}
2302
2303/* superblock security operations */
2304
2305static int selinux_sb_alloc_security(struct super_block *sb)
2306{
2307 return superblock_alloc_security(sb);
2308}
2309
2310static void selinux_sb_free_security(struct super_block *sb)
2311{
2312 superblock_free_security(sb);
2313}
2314
2315static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2316{
2317 if (plen > olen)
2318 return 0;
2319
2320 return !memcmp(prefix, option, plen);
2321}
2322
2323static inline int selinux_option(char *option, int len)
2324{
832cbd9a
EP
2325 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2326 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2327 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
11689d47
DQ
2328 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2329 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
1da177e4
LT
2330}
2331
2332static inline void take_option(char **to, char *from, int *first, int len)
2333{
2334 if (!*first) {
2335 **to = ',';
2336 *to += 1;
3528a953 2337 } else
1da177e4
LT
2338 *first = 0;
2339 memcpy(*to, from, len);
2340 *to += len;
2341}
2342
828dfe1d
EP
2343static inline void take_selinux_option(char **to, char *from, int *first,
2344 int len)
3528a953
CO
2345{
2346 int current_size = 0;
2347
2348 if (!*first) {
2349 **to = '|';
2350 *to += 1;
828dfe1d 2351 } else
3528a953
CO
2352 *first = 0;
2353
2354 while (current_size < len) {
2355 if (*from != '"') {
2356 **to = *from;
2357 *to += 1;
2358 }
2359 from += 1;
2360 current_size += 1;
2361 }
2362}
2363
e0007529 2364static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT
2365{
2366 int fnosec, fsec, rc = 0;
2367 char *in_save, *in_curr, *in_end;
2368 char *sec_curr, *nosec_save, *nosec;
3528a953 2369 int open_quote = 0;
1da177e4
LT
2370
2371 in_curr = orig;
2372 sec_curr = copy;
2373
1da177e4
LT
2374 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2375 if (!nosec) {
2376 rc = -ENOMEM;
2377 goto out;
2378 }
2379
2380 nosec_save = nosec;
2381 fnosec = fsec = 1;
2382 in_save = in_end = orig;
2383
2384 do {
3528a953
CO
2385 if (*in_end == '"')
2386 open_quote = !open_quote;
2387 if ((*in_end == ',' && open_quote == 0) ||
2388 *in_end == '\0') {
1da177e4
LT
2389 int len = in_end - in_curr;
2390
2391 if (selinux_option(in_curr, len))
3528a953 2392 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT
2393 else
2394 take_option(&nosec, in_curr, &fnosec, len);
2395
2396 in_curr = in_end + 1;
2397 }
2398 } while (*in_end++);
2399
6931dfc9 2400 strcpy(in_save, nosec_save);
da3caa20 2401 free_page((unsigned long)nosec_save);
1da177e4
LT
2402out:
2403 return rc;
2404}
2405
026eb167
EP
2406static int selinux_sb_remount(struct super_block *sb, void *data)
2407{
2408 int rc, i, *flags;
2409 struct security_mnt_opts opts;
2410 char *secdata, **mount_options;
2411 struct superblock_security_struct *sbsec = sb->s_security;
2412
2413 if (!(sbsec->flags & SE_SBINITIALIZED))
2414 return 0;
2415
2416 if (!data)
2417 return 0;
2418
2419 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2420 return 0;
2421
2422 security_init_mnt_opts(&opts);
2423 secdata = alloc_secdata();
2424 if (!secdata)
2425 return -ENOMEM;
2426 rc = selinux_sb_copy_data(data, secdata);
2427 if (rc)
2428 goto out_free_secdata;
2429
2430 rc = selinux_parse_opts_str(secdata, &opts);
2431 if (rc)
2432 goto out_free_secdata;
2433
2434 mount_options = opts.mnt_opts;
2435 flags = opts.mnt_opts_flags;
2436
2437 for (i = 0; i < opts.num_mnt_opts; i++) {
2438 u32 sid;
2439 size_t len;
2440
2441 if (flags[i] == SE_SBLABELSUPP)
2442 continue;
2443 len = strlen(mount_options[i]);
2444 rc = security_context_to_sid(mount_options[i], len, &sid);
2445 if (rc) {
2446 printk(KERN_WARNING "SELinux: security_context_to_sid"
2447 "(%s) failed for (dev %s, type %s) errno=%d\n",
2448 mount_options[i], sb->s_id, sb->s_type->name, rc);
2449 goto out_free_opts;
2450 }
2451 rc = -EINVAL;
2452 switch (flags[i]) {
2453 case FSCONTEXT_MNT:
2454 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2455 goto out_bad_option;
2456 break;
2457 case CONTEXT_MNT:
2458 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2459 goto out_bad_option;
2460 break;
2461 case ROOTCONTEXT_MNT: {
2462 struct inode_security_struct *root_isec;
2463 root_isec = sb->s_root->d_inode->i_security;
2464
2465 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2466 goto out_bad_option;
2467 break;
2468 }
2469 case DEFCONTEXT_MNT:
2470 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2471 goto out_bad_option;
2472 break;
2473 default:
2474 goto out_free_opts;
2475 }
2476 }
2477
2478 rc = 0;
2479out_free_opts:
2480 security_free_mnt_opts(&opts);
2481out_free_secdata:
2482 free_secdata(secdata);
2483 return rc;
2484out_bad_option:
2485 printk(KERN_WARNING "SELinux: unable to change security options "
2486 "during remount (dev %s, type=%s)\n", sb->s_id,
2487 sb->s_type->name);
2488 goto out_free_opts;
2489}
2490
12204e24 2491static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
1da177e4 2492{
88e67f3b 2493 const struct cred *cred = current_cred();
2bf49690 2494 struct common_audit_data ad;
1da177e4
LT
2495 int rc;
2496
2497 rc = superblock_doinit(sb, data);
2498 if (rc)
2499 return rc;
2500
74192246
JM
2501 /* Allow all mounts performed by the kernel */
2502 if (flags & MS_KERNMOUNT)
2503 return 0;
2504
50c205f5 2505 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2506 ad.u.dentry = sb->s_root;
88e67f3b 2507 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
1da177e4
LT
2508}
2509
726c3342 2510static int selinux_sb_statfs(struct dentry *dentry)
1da177e4 2511{
88e67f3b 2512 const struct cred *cred = current_cred();
2bf49690 2513 struct common_audit_data ad;
1da177e4 2514
50c205f5 2515 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2516 ad.u.dentry = dentry->d_sb->s_root;
88e67f3b 2517 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT
2518}
2519
808d4e3c 2520static int selinux_mount(const char *dev_name,
b5266eb4 2521 struct path *path,
808d4e3c 2522 const char *type,
828dfe1d
EP
2523 unsigned long flags,
2524 void *data)
1da177e4 2525{
88e67f3b 2526 const struct cred *cred = current_cred();
1da177e4
LT
2527
2528 if (flags & MS_REMOUNT)
d8c9584e 2529 return superblock_has_perm(cred, path->dentry->d_sb,
828dfe1d 2530 FILESYSTEM__REMOUNT, NULL);
1da177e4 2531 else
2875fa00 2532 return path_has_perm(cred, path, FILE__MOUNTON);
1da177e4
LT
2533}
2534
2535static int selinux_umount(struct vfsmount *mnt, int flags)
2536{
88e67f3b 2537 const struct cred *cred = current_cred();
1da177e4 2538
88e67f3b 2539 return superblock_has_perm(cred, mnt->mnt_sb,
828dfe1d 2540 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT
2541}
2542
2543/* inode security operations */
2544
2545static int selinux_inode_alloc_security(struct inode *inode)
2546{
2547 return inode_alloc_security(inode);
2548}
2549
2550static void selinux_inode_free_security(struct inode *inode)
2551{
2552 inode_free_security(inode);
2553}
2554
d47be3df
DQ
2555static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2556 struct qstr *name, void **ctx,
2557 u32 *ctxlen)
2558{
2559 const struct cred *cred = current_cred();
2560 struct task_security_struct *tsec;
2561 struct inode_security_struct *dsec;
2562 struct superblock_security_struct *sbsec;
2563 struct inode *dir = dentry->d_parent->d_inode;
2564 u32 newsid;
2565 int rc;
2566
2567 tsec = cred->security;
2568 dsec = dir->i_security;
2569 sbsec = dir->i_sb->s_security;
2570
2571 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2572 newsid = tsec->create_sid;
2573 } else {
2574 rc = security_transition_sid(tsec->sid, dsec->sid,
2575 inode_mode_to_security_class(mode),
2576 name,
2577 &newsid);
2578 if (rc) {
2579 printk(KERN_WARNING
2580 "%s: security_transition_sid failed, rc=%d\n",
2581 __func__, -rc);
2582 return rc;
2583 }
2584 }
2585
2586 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2587}
2588
5e41ff9e 2589static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
9548906b
TH
2590 const struct qstr *qstr,
2591 const char **name,
2a7dba39 2592 void **value, size_t *len)
5e41ff9e 2593{
5fb49870 2594 const struct task_security_struct *tsec = current_security();
5e41ff9e
SS
2595 struct inode_security_struct *dsec;
2596 struct superblock_security_struct *sbsec;
275bb41e 2597 u32 sid, newsid, clen;
5e41ff9e 2598 int rc;
9548906b 2599 char *context;
5e41ff9e 2600
5e41ff9e
SS
2601 dsec = dir->i_security;
2602 sbsec = dir->i_sb->s_security;
5e41ff9e 2603
275bb41e
DH
2604 sid = tsec->sid;
2605 newsid = tsec->create_sid;
2606
415103f9
EP
2607 if ((sbsec->flags & SE_SBINITIALIZED) &&
2608 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2609 newsid = sbsec->mntpoint_sid;
2610 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
275bb41e 2611 rc = security_transition_sid(sid, dsec->sid,
5e41ff9e 2612 inode_mode_to_security_class(inode->i_mode),
652bb9b0 2613 qstr, &newsid);
5e41ff9e
SS
2614 if (rc) {
2615 printk(KERN_WARNING "%s: "
2616 "security_transition_sid failed, rc=%d (dev=%s "
2617 "ino=%ld)\n",
dd6f953a 2618 __func__,
5e41ff9e
SS
2619 -rc, inode->i_sb->s_id, inode->i_ino);
2620 return rc;
2621 }
2622 }
2623
296fddf7 2624 /* Possibly defer initialization to selinux_complete_init. */
0d90a7ec 2625 if (sbsec->flags & SE_SBINITIALIZED) {
296fddf7
EP
2626 struct inode_security_struct *isec = inode->i_security;
2627 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2628 isec->sid = newsid;
2629 isec->initialized = 1;
2630 }
5e41ff9e 2631
cd89596f 2632 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
25a74f3b
SS
2633 return -EOPNOTSUPP;
2634
9548906b
TH
2635 if (name)
2636 *name = XATTR_SELINUX_SUFFIX;
5e41ff9e 2637
570bc1c2 2638 if (value && len) {
12b29f34 2639 rc = security_sid_to_context_force(newsid, &context, &clen);
9548906b 2640 if (rc)
570bc1c2 2641 return rc;
570bc1c2
SS
2642 *value = context;
2643 *len = clen;
5e41ff9e 2644 }
5e41ff9e 2645
5e41ff9e
SS
2646 return 0;
2647}
2648
4acdaf27 2649static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
1da177e4
LT
2650{
2651 return may_create(dir, dentry, SECCLASS_FILE);
2652}
2653
1da177e4
LT
2654static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2655{
1da177e4
LT
2656 return may_link(dir, old_dentry, MAY_LINK);
2657}
2658
1da177e4
LT
2659static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2660{
1da177e4
LT
2661 return may_link(dir, dentry, MAY_UNLINK);
2662}
2663
2664static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2665{
2666 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2667}
2668
18bb1db3 2669static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
1da177e4
LT
2670{
2671 return may_create(dir, dentry, SECCLASS_DIR);
2672}
2673
1da177e4
LT
2674static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2675{
2676 return may_link(dir, dentry, MAY_RMDIR);
2677}
2678
1a67aafb 2679static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
1da177e4 2680{
1da177e4
LT
2681 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2682}
2683
1da177e4 2684static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2685 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT
2686{
2687 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2688}
2689
1da177e4
LT
2690static int selinux_inode_readlink(struct dentry *dentry)
2691{
88e67f3b
DH
2692 const struct cred *cred = current_cred();
2693
2875fa00 2694 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT
2695}
2696
2697static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2698{
88e67f3b 2699 const struct cred *cred = current_cred();
1da177e4 2700
2875fa00 2701 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT
2702}
2703
d4cf970d
EP
2704static noinline int audit_inode_permission(struct inode *inode,
2705 u32 perms, u32 audited, u32 denied,
2706 unsigned flags)
1da177e4 2707{
b782e0a6 2708 struct common_audit_data ad;
d4cf970d
EP
2709 struct inode_security_struct *isec = inode->i_security;
2710 int rc;
2711
50c205f5 2712 ad.type = LSM_AUDIT_DATA_INODE;
d4cf970d
EP
2713 ad.u.inode = inode;
2714
2715 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2716 audited, denied, &ad, flags);
2717 if (rc)
2718 return rc;
2719 return 0;
2720}
2721
e74f71eb 2722static int selinux_inode_permission(struct inode *inode, int mask)
1da177e4 2723{
88e67f3b 2724 const struct cred *cred = current_cred();
b782e0a6
EP
2725 u32 perms;
2726 bool from_access;
cf1dd1da 2727 unsigned flags = mask & MAY_NOT_BLOCK;
2e334057
EP
2728 struct inode_security_struct *isec;
2729 u32 sid;
2730 struct av_decision avd;
2731 int rc, rc2;
2732 u32 audited, denied;
1da177e4 2733
b782e0a6 2734 from_access = mask & MAY_ACCESS;
d09ca739
EP
2735 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2736
b782e0a6
EP
2737 /* No permission to check. Existence test. */
2738 if (!mask)
1da177e4 2739 return 0;
1da177e4 2740
2e334057 2741 validate_creds(cred);
b782e0a6 2742
2e334057
EP
2743 if (unlikely(IS_PRIVATE(inode)))
2744 return 0;
b782e0a6
EP
2745
2746 perms = file_mask_to_av(inode->i_mode, mask);
2747
2e334057
EP
2748 sid = cred_sid(cred);
2749 isec = inode->i_security;
2750
2751 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2752 audited = avc_audit_required(perms, &avd, rc,
2753 from_access ? FILE__AUDIT_ACCESS : 0,
2754 &denied);
2755 if (likely(!audited))
2756 return rc;
2757
d4cf970d 2758 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2e334057
EP
2759 if (rc2)
2760 return rc2;
2761 return rc;
1da177e4
LT
2762}
2763
2764static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2765{
88e67f3b 2766 const struct cred *cred = current_cred();
bc6a6008 2767 unsigned int ia_valid = iattr->ia_valid;
95dbf739 2768 __u32 av = FILE__WRITE;
1da177e4 2769
bc6a6008
AW
2770 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2771 if (ia_valid & ATTR_FORCE) {
2772 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2773 ATTR_FORCE);
2774 if (!ia_valid)
2775 return 0;
2776 }
1da177e4 2777
bc6a6008
AW
2778 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2779 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2875fa00 2780 return dentry_has_perm(cred, dentry, FILE__SETATTR);
1da177e4 2781
3d2195c3 2782 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
95dbf739
EP
2783 av |= FILE__OPEN;
2784
2785 return dentry_has_perm(cred, dentry, av);
1da177e4
LT
2786}
2787
2788static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2789{
88e67f3b 2790 const struct cred *cred = current_cred();
2875fa00
EP
2791 struct path path;
2792
2793 path.dentry = dentry;
2794 path.mnt = mnt;
88e67f3b 2795
2875fa00 2796 return path_has_perm(cred, &path, FILE__GETATTR);
1da177e4
LT
2797}
2798
8f0cfa52 2799static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771 2800{
88e67f3b
DH
2801 const struct cred *cred = current_cred();
2802
b5376771
SH
2803 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2804 sizeof XATTR_SECURITY_PREFIX - 1)) {
2805 if (!strcmp(name, XATTR_NAME_CAPS)) {
2806 if (!capable(CAP_SETFCAP))
2807 return -EPERM;
2808 } else if (!capable(CAP_SYS_ADMIN)) {
2809 /* A different attribute in the security namespace.
2810 Restrict to administrator. */
2811 return -EPERM;
2812 }
2813 }
2814
2815 /* Not an attribute we recognize, so just check the
2816 ordinary setattr permission. */
2875fa00 2817 return dentry_has_perm(cred, dentry, FILE__SETATTR);
b5376771
SH
2818}
2819
8f0cfa52
DH
2820static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2821 const void *value, size_t size, int flags)
1da177e4 2822{
1da177e4
LT
2823 struct inode *inode = dentry->d_inode;
2824 struct inode_security_struct *isec = inode->i_security;
2825 struct superblock_security_struct *sbsec;
2bf49690 2826 struct common_audit_data ad;
275bb41e 2827 u32 newsid, sid = current_sid();
1da177e4
LT
2828 int rc = 0;
2829
b5376771
SH
2830 if (strcmp(name, XATTR_NAME_SELINUX))
2831 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2832
2833 sbsec = inode->i_sb->s_security;
cd89596f 2834 if (!(sbsec->flags & SE_SBLABELSUPP))
1da177e4
LT
2835 return -EOPNOTSUPP;
2836
2e149670 2837 if (!inode_owner_or_capable(inode))
1da177e4
LT
2838 return -EPERM;
2839
50c205f5 2840 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2841 ad.u.dentry = dentry;
1da177e4 2842
275bb41e 2843 rc = avc_has_perm(sid, isec->sid, isec->sclass,
1da177e4
LT
2844 FILE__RELABELFROM, &ad);
2845 if (rc)
2846 return rc;
2847
2848 rc = security_context_to_sid(value, size, &newsid);
12b29f34 2849 if (rc == -EINVAL) {
d6ea83ec
EP
2850 if (!capable(CAP_MAC_ADMIN)) {
2851 struct audit_buffer *ab;
2852 size_t audit_size;
2853 const char *str;
2854
2855 /* We strip a nul only if it is at the end, otherwise the
2856 * context contains a nul and we should audit that */
e3fea3f7
AV
2857 if (value) {
2858 str = value;
2859 if (str[size - 1] == '\0')
2860 audit_size = size - 1;
2861 else
2862 audit_size = size;
2863 } else {
2864 str = "";
2865 audit_size = 0;
2866 }
d6ea83ec
EP
2867 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2868 audit_log_format(ab, "op=setxattr invalid_context=");
2869 audit_log_n_untrustedstring(ab, value, audit_size);
2870 audit_log_end(ab);
2871
12b29f34 2872 return rc;
d6ea83ec 2873 }
12b29f34
SS
2874 rc = security_context_to_sid_force(value, size, &newsid);
2875 }
1da177e4
LT
2876 if (rc)
2877 return rc;
2878
275bb41e 2879 rc = avc_has_perm(sid, newsid, isec->sclass,
1da177e4
LT
2880 FILE__RELABELTO, &ad);
2881 if (rc)
2882 return rc;
2883
275bb41e 2884 rc = security_validate_transition(isec->sid, newsid, sid,
828dfe1d 2885 isec->sclass);
1da177e4
LT
2886 if (rc)
2887 return rc;
2888
2889 return avc_has_perm(newsid,
2890 sbsec->sid,
2891 SECCLASS_FILESYSTEM,
2892 FILESYSTEM__ASSOCIATE,
2893 &ad);
2894}
2895
8f0cfa52 2896static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
f5269710 2897 const void *value, size_t size,
8f0cfa52 2898 int flags)
1da177e4
LT
2899{
2900 struct inode *inode = dentry->d_inode;
2901 struct inode_security_struct *isec = inode->i_security;
2902 u32 newsid;
2903 int rc;
2904
2905 if (strcmp(name, XATTR_NAME_SELINUX)) {
2906 /* Not an attribute we recognize, so nothing to do. */
2907 return;
2908 }
2909
12b29f34 2910 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 2911 if (rc) {
12b29f34
SS
2912 printk(KERN_ERR "SELinux: unable to map context to SID"
2913 "for (%s, %lu), rc=%d\n",
2914 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT
2915 return;
2916 }
2917
aa9c2669 2918 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 2919 isec->sid = newsid;
aa9c2669
DQ
2920 isec->initialized = 1;
2921
1da177e4
LT
2922 return;
2923}
2924
8f0cfa52 2925static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 2926{
88e67f3b
DH
2927 const struct cred *cred = current_cred();
2928
2875fa00 2929 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT
2930}
2931
828dfe1d 2932static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4 2933{
88e67f3b
DH
2934 const struct cred *cred = current_cred();
2935
2875fa00 2936 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT
2937}
2938
8f0cfa52 2939static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 2940{
b5376771
SH
2941 if (strcmp(name, XATTR_NAME_SELINUX))
2942 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2943
2944 /* No one is allowed to remove a SELinux security label.
2945 You can change the label, but all data must be labeled. */
2946 return -EACCES;
2947}
2948
d381d8a9 2949/*
abc69bb6 2950 * Copy the inode security context value to the user.
d381d8a9
JM
2951 *
2952 * Permission check is handled by selinux_inode_getxattr hook.
2953 */
42492594 2954static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 2955{
42492594
DQ
2956 u32 size;
2957 int error;
2958 char *context = NULL;
1da177e4 2959 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2960
8c8570fb
DK
2961 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2962 return -EOPNOTSUPP;
d381d8a9 2963
abc69bb6
SS
2964 /*
2965 * If the caller has CAP_MAC_ADMIN, then get the raw context
2966 * value even if it is not defined by current policy; otherwise,
2967 * use the in-core value under current policy.
2968 * Use the non-auditing forms of the permission checks since
2969 * getxattr may be called by unprivileged processes commonly
2970 * and lack of permission just means that we fall back to the
2971 * in-core context value, not a denial.
2972 */
6a9de491 2973 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3699c53c 2974 SECURITY_CAP_NOAUDIT);
abc69bb6
SS
2975 if (!error)
2976 error = security_sid_to_context_force(isec->sid, &context,
2977 &size);
2978 else
2979 error = security_sid_to_context(isec->sid, &context, &size);
42492594
DQ
2980 if (error)
2981 return error;
2982 error = size;
2983 if (alloc) {
2984 *buffer = context;
2985 goto out_nofree;
2986 }
2987 kfree(context);
2988out_nofree:
2989 return error;
1da177e4
LT
2990}
2991
2992static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 2993 const void *value, size_t size, int flags)
1da177e4
LT
2994{
2995 struct inode_security_struct *isec = inode->i_security;
2996 u32 newsid;
2997 int rc;
2998
2999 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3000 return -EOPNOTSUPP;
3001
3002 if (!value || !size)
3003 return -EACCES;
3004
828dfe1d 3005 rc = security_context_to_sid((void *)value, size, &newsid);
1da177e4
LT
3006 if (rc)
3007 return rc;
3008
aa9c2669 3009 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 3010 isec->sid = newsid;
ddd29ec6 3011 isec->initialized = 1;
1da177e4
LT
3012 return 0;
3013}
3014
3015static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3016{
3017 const int len = sizeof(XATTR_NAME_SELINUX);
3018 if (buffer && len <= buffer_size)
3019 memcpy(buffer, XATTR_NAME_SELINUX, len);
3020 return len;
3021}
3022
713a04ae
AD
3023static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3024{
3025 struct inode_security_struct *isec = inode->i_security;
3026 *secid = isec->sid;
3027}
3028
1da177e4
LT
3029/* file security operations */
3030
788e7dd4 3031static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 3032{
88e67f3b 3033 const struct cred *cred = current_cred();
496ad9aa 3034 struct inode *inode = file_inode(file);
1da177e4 3035
1da177e4
LT
3036 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3037 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3038 mask |= MAY_APPEND;
3039
389fb800
PM
3040 return file_has_perm(cred, file,
3041 file_mask_to_av(inode->i_mode, mask));
1da177e4
LT
3042}
3043
788e7dd4
YN
3044static int selinux_file_permission(struct file *file, int mask)
3045{
496ad9aa 3046 struct inode *inode = file_inode(file);
20dda18b
SS
3047 struct file_security_struct *fsec = file->f_security;
3048 struct inode_security_struct *isec = inode->i_security;
3049 u32 sid = current_sid();
3050
389fb800 3051 if (!mask)
788e7dd4
YN
3052 /* No permission to check. Existence test. */
3053 return 0;
788e7dd4 3054
20dda18b
SS
3055 if (sid == fsec->sid && fsec->isid == isec->sid &&
3056 fsec->pseqno == avc_policy_seqno())
83d49856 3057 /* No change since file_open check. */
20dda18b
SS
3058 return 0;
3059
788e7dd4
YN
3060 return selinux_revalidate_file_permission(file, mask);
3061}
3062
1da177e4
LT
3063static int selinux_file_alloc_security(struct file *file)
3064{
3065 return file_alloc_security(file);
3066}
3067
3068static void selinux_file_free_security(struct file *file)
3069{
3070 file_free_security(file);
3071}
3072
3073static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3074 unsigned long arg)
3075{
88e67f3b 3076 const struct cred *cred = current_cred();
0b24dcb7 3077 int error = 0;
1da177e4 3078
0b24dcb7
EP
3079 switch (cmd) {
3080 case FIONREAD:
3081 /* fall through */
3082 case FIBMAP:
3083 /* fall through */
3084 case FIGETBSZ:
3085 /* fall through */
2f99c369 3086 case FS_IOC_GETFLAGS:
0b24dcb7 3087 /* fall through */
2f99c369 3088 case FS_IOC_GETVERSION:
0b24dcb7
EP
3089 error = file_has_perm(cred, file, FILE__GETATTR);
3090 break;
1da177e4 3091
2f99c369 3092 case FS_IOC_SETFLAGS:
0b24dcb7 3093 /* fall through */
2f99c369 3094 case FS_IOC_SETVERSION:
0b24dcb7
EP
3095 error = file_has_perm(cred, file, FILE__SETATTR);
3096 break;
3097
3098 /* sys_ioctl() checks */
3099 case FIONBIO:
3100 /* fall through */
3101 case FIOASYNC:
3102 error = file_has_perm(cred, file, 0);
3103 break;
1da177e4 3104
0b24dcb7
EP
3105 case KDSKBENT:
3106 case KDSKBSENT:
6a9de491
EP
3107 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3108 SECURITY_CAP_AUDIT);
0b24dcb7
EP
3109 break;
3110
3111 /* default case assumes that the command will go
3112 * to the file's ioctl() function.
3113 */
3114 default:
3115 error = file_has_perm(cred, file, FILE__IOCTL);
3116 }
3117 return error;
1da177e4
LT
3118}
3119
fcaaade1
SS
3120static int default_noexec;
3121
1da177e4
LT
3122static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3123{
88e67f3b 3124 const struct cred *cred = current_cred();
d84f4f99 3125 int rc = 0;
88e67f3b 3126
fcaaade1
SS
3127 if (default_noexec &&
3128 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
1da177e4
LT
3129 /*
3130 * We are making executable an anonymous mapping or a
3131 * private file mapping that will also be writable.
3132 * This has an additional check.
3133 */
d84f4f99 3134 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
1da177e4 3135 if (rc)
d84f4f99 3136 goto error;
1da177e4 3137 }
1da177e4
LT
3138
3139 if (file) {
3140 /* read access is always possible with a mapping */
3141 u32 av = FILE__READ;
3142
3143 /* write access only matters if the mapping is shared */
3144 if (shared && (prot & PROT_WRITE))
3145 av |= FILE__WRITE;
3146
3147 if (prot & PROT_EXEC)
3148 av |= FILE__EXECUTE;
3149
88e67f3b 3150 return file_has_perm(cred, file, av);
1da177e4 3151 }
d84f4f99
DH
3152
3153error:
3154 return rc;
1da177e4
LT
3155}
3156
e5467859 3157static int selinux_mmap_addr(unsigned long addr)
1da177e4 3158{
ed032189 3159 int rc = 0;
275bb41e 3160 u32 sid = current_sid();
1da177e4 3161
84336d1a
EP
3162 /*
3163 * notice that we are intentionally putting the SELinux check before
3164 * the secondary cap_file_mmap check. This is such a likely attempt
3165 * at bad behaviour/exploit that we always want to get the AVC, even
3166 * if DAC would have also denied the operation.
3167 */
a2551df7 3168 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
ed032189
EP
3169 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3170 MEMPROTECT__MMAP_ZERO, NULL);
84336d1a
EP
3171 if (rc)
3172 return rc;
3173 }
3174
3175 /* do DAC check on address space usage */
e5467859
AV
3176 return cap_mmap_addr(addr);
3177}
1da177e4 3178
e5467859
AV
3179static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3180 unsigned long prot, unsigned long flags)
3181{
1da177e4
LT
3182 if (selinux_checkreqprot)
3183 prot = reqprot;
3184
3185 return file_map_prot_check(file, prot,
3186 (flags & MAP_TYPE) == MAP_SHARED);
3187}
3188
3189static int selinux_file_mprotect(struct vm_area_struct *vma,
3190 unsigned long reqprot,
3191 unsigned long prot)
3192{
88e67f3b 3193 const struct cred *cred = current_cred();
1da177e4
LT
3194
3195 if (selinux_checkreqprot)
3196 prot = reqprot;
3197
fcaaade1
SS
3198 if (default_noexec &&
3199 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
d541bbee 3200 int rc = 0;
db4c9641
SS
3201 if (vma->vm_start >= vma->vm_mm->start_brk &&
3202 vma->vm_end <= vma->vm_mm->brk) {
d84f4f99 3203 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
db4c9641
SS
3204 } else if (!vma->vm_file &&
3205 vma->vm_start <= vma->vm_mm->start_stack &&
3206 vma->vm_end >= vma->vm_mm->start_stack) {
3b11a1de 3207 rc = current_has_perm(current, PROCESS__EXECSTACK);
db4c9641
SS
3208 } else if (vma->vm_file && vma->anon_vma) {
3209 /*
3210 * We are making executable a file mapping that has
3211 * had some COW done. Since pages might have been
3212 * written, check ability to execute the possibly
3213 * modified content. This typically should only
3214 * occur for text relocations.
3215 */
d84f4f99 3216 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
db4c9641 3217 }