]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - security/selinux/hooks.c
add hlist_bl_lock/unlock helpers
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT
1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
2069f457
EP
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
1da177e4 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 15 * <dgoeddel@trustedcs.com>
ed6d76e4
PM
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
788e7dd4 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
828dfe1d 23 * as published by the Free Software Foundation.
1da177e4
LT
24 */
25
1da177e4 26#include <linux/init.h>
0b24dcb7 27#include <linux/kd.h>
1da177e4 28#include <linux/kernel.h>
0d094efe 29#include <linux/tracehook.h>
1da177e4 30#include <linux/errno.h>
0b24dcb7 31#include <linux/ext2_fs.h>
1da177e4
LT
32#include <linux/sched.h>
33#include <linux/security.h>
34#include <linux/xattr.h>
35#include <linux/capability.h>
36#include <linux/unistd.h>
37#include <linux/mm.h>
38#include <linux/mman.h>
39#include <linux/slab.h>
40#include <linux/pagemap.h>
0b24dcb7 41#include <linux/proc_fs.h>
1da177e4 42#include <linux/swap.h>
1da177e4
LT
43#include <linux/spinlock.h>
44#include <linux/syscalls.h>
2a7dba39 45#include <linux/dcache.h>
1da177e4 46#include <linux/file.h>
9f3acc31 47#include <linux/fdtable.h>
1da177e4
LT
48#include <linux/namei.h>
49#include <linux/mount.h>
1da177e4
LT
50#include <linux/netfilter_ipv4.h>
51#include <linux/netfilter_ipv6.h>
52#include <linux/tty.h>
53#include <net/icmp.h>
227b60f5 54#include <net/ip.h> /* for local_port_range[] */
1da177e4 55#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
220deb96 56#include <net/net_namespace.h>
d621d35e 57#include <net/netlabel.h>
f5269710 58#include <linux/uaccess.h>
1da177e4 59#include <asm/ioctls.h>
d621d35e 60#include <asm/atomic.h>
1da177e4
LT
61#include <linux/bitops.h>
62#include <linux/interrupt.h>
63#include <linux/netdevice.h> /* for network interface checks */
64#include <linux/netlink.h>
65#include <linux/tcp.h>
66#include <linux/udp.h>
2ee92d46 67#include <linux/dccp.h>
1da177e4
LT
68#include <linux/quota.h>
69#include <linux/un.h> /* for Unix socket types */
70#include <net/af_unix.h> /* for Unix socket types */
71#include <linux/parser.h>
72#include <linux/nfs_mount.h>
73#include <net/ipv6.h>
74#include <linux/hugetlb.h>
75#include <linux/personality.h>
1da177e4 76#include <linux/audit.h>
6931dfc9 77#include <linux/string.h>
877ce7c1 78#include <linux/selinux.h>
23970741 79#include <linux/mutex.h>
f06febc9 80#include <linux/posix-timers.h>
00234592 81#include <linux/syslog.h>
3486740a 82#include <linux/user_namespace.h>
1da177e4
LT
83
84#include "avc.h"
85#include "objsec.h"
86#include "netif.h"
224dfbd8 87#include "netnode.h"
3e112172 88#include "netport.h"
d28d1e08 89#include "xfrm.h"
c60475bf 90#include "netlabel.h"
9d57a7f9 91#include "audit.h"
1da177e4 92
11689d47 93#define NUM_SEL_MNT_OPTS 5
c9180a57 94
1da177e4 95extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
20510f2f 96extern struct security_operations *security_ops;
1da177e4 97
d621d35e
PM
98/* SECMARK reference count */
99atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
1da177e4 101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 102int selinux_enforcing;
1da177e4
LT
103
104static int __init enforcing_setup(char *str)
105{
f5269710
EP
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
1da177e4
LT
109 return 1;
110}
111__setup("enforcing=", enforcing_setup);
112#endif
113
114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117static int __init selinux_enabled_setup(char *str)
118{
f5269710
EP
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
1da177e4
LT
122 return 1;
123}
124__setup("selinux=", selinux_enabled_setup);
30d55280
SS
125#else
126int selinux_enabled = 1;
1da177e4
LT
127#endif
128
e18b890b 129static struct kmem_cache *sel_inode_cache;
7cae7e26 130
d621d35e
PM
131/**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
139 *
140 */
141static int selinux_secmark_enabled(void)
142{
143 return (atomic_read(&selinux_secmark_refcount) > 0);
144}
145
d84f4f99
DH
146/*
147 * initialise the security for the init task
148 */
149static void cred_init_security(void)
1da177e4 150{
3b11a1de 151 struct cred *cred = (struct cred *) current->real_cred;
1da177e4
LT
152 struct task_security_struct *tsec;
153
89d155ef 154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4 155 if (!tsec)
d84f4f99 156 panic("SELinux: Failed to initialize initial task.\n");
1da177e4 157
d84f4f99 158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
f1752eec 159 cred->security = tsec;
1da177e4
LT
160}
161
88e67f3b
DH
162/*
163 * get the security ID of a set of credentials
164 */
165static inline u32 cred_sid(const struct cred *cred)
166{
167 const struct task_security_struct *tsec;
168
169 tsec = cred->security;
170 return tsec->sid;
171}
172
275bb41e 173/*
3b11a1de 174 * get the objective security ID of a task
275bb41e
DH
175 */
176static inline u32 task_sid(const struct task_struct *task)
177{
275bb41e
DH
178 u32 sid;
179
180 rcu_read_lock();
88e67f3b 181 sid = cred_sid(__task_cred(task));
275bb41e
DH
182 rcu_read_unlock();
183 return sid;
184}
185
186/*
3b11a1de 187 * get the subjective security ID of the current task
275bb41e
DH
188 */
189static inline u32 current_sid(void)
190{
5fb49870 191 const struct task_security_struct *tsec = current_security();
275bb41e
DH
192
193 return tsec->sid;
194}
195
88e67f3b
DH
196/* Allocate and free functions for each kind of security blob. */
197
1da177e4
LT
198static int inode_alloc_security(struct inode *inode)
199{
1da177e4 200 struct inode_security_struct *isec;
275bb41e 201 u32 sid = current_sid();
1da177e4 202
a02fe132 203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT
204 if (!isec)
205 return -ENOMEM;
206
23970741 207 mutex_init(&isec->lock);
1da177e4 208 INIT_LIST_HEAD(&isec->list);
1da177e4
LT
209 isec->inode = inode;
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
275bb41e 212 isec->task_sid = sid;
1da177e4
LT
213 inode->i_security = isec;
214
215 return 0;
216}
217
218static void inode_free_security(struct inode *inode)
219{
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
222
1da177e4
LT
223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
227
228 inode->i_security = NULL;
7cae7e26 229 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT
230}
231
232static int file_alloc_security(struct file *file)
233{
1da177e4 234 struct file_security_struct *fsec;
275bb41e 235 u32 sid = current_sid();
1da177e4 236
26d2a4be 237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT
238 if (!fsec)
239 return -ENOMEM;
240
275bb41e
DH
241 fsec->sid = sid;
242 fsec->fown_sid = sid;
1da177e4
LT
243 file->f_security = fsec;
244
245 return 0;
246}
247
248static void file_free_security(struct file *file)
249{
250 struct file_security_struct *fsec = file->f_security;
1da177e4
LT
251 file->f_security = NULL;
252 kfree(fsec);
253}
254
255static int superblock_alloc_security(struct super_block *sb)
256{
257 struct superblock_security_struct *sbsec;
258
89d155ef 259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT
260 if (!sbsec)
261 return -ENOMEM;
262
bc7e982b 263 mutex_init(&sbsec->lock);
1da177e4
LT
264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT
266 sbsec->sb = sb;
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
c312feb2 269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT
270 sb->s_security = sbsec;
271
272 return 0;
273}
274
275static void superblock_free_security(struct super_block *sb)
276{
277 struct superblock_security_struct *sbsec = sb->s_security;
1da177e4
LT
278 sb->s_security = NULL;
279 kfree(sbsec);
280}
281
1da177e4
LT
282/* The security server must be initialized before
283 any labeling or access decisions can be provided. */
284extern int ss_initialized;
285
286/* The file system's label must be initialized prior to use. */
287
634a539e 288static const char *labeling_behaviors[6] = {
1da177e4
LT
289 "uses xattr",
290 "uses transition SIDs",
291 "uses task SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
295};
296
297static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
298
299static inline int inode_doinit(struct inode *inode)
300{
301 return inode_doinit_with_dentry(inode, NULL);
302}
303
304enum {
31e87930 305 Opt_error = -1,
1da177e4
LT
306 Opt_context = 1,
307 Opt_fscontext = 2,
c9180a57
EP
308 Opt_defcontext = 3,
309 Opt_rootcontext = 4,
11689d47 310 Opt_labelsupport = 5,
1da177e4
LT
311};
312
a447c093 313static const match_table_t tokens = {
832cbd9a
EP
314 {Opt_context, CONTEXT_STR "%s"},
315 {Opt_fscontext, FSCONTEXT_STR "%s"},
316 {Opt_defcontext, DEFCONTEXT_STR "%s"},
317 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
11689d47 318 {Opt_labelsupport, LABELSUPP_STR},
31e87930 319 {Opt_error, NULL},
1da177e4
LT
320};
321
322#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
323
c312feb2
EP
324static int may_context_mount_sb_relabel(u32 sid,
325 struct superblock_security_struct *sbsec,
275bb41e 326 const struct cred *cred)
c312feb2 327{
275bb41e 328 const struct task_security_struct *tsec = cred->security;
c312feb2
EP
329 int rc;
330
331 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
332 FILESYSTEM__RELABELFROM, NULL);
333 if (rc)
334 return rc;
335
336 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
337 FILESYSTEM__RELABELTO, NULL);
338 return rc;
339}
340
0808925e
EP
341static int may_context_mount_inode_relabel(u32 sid,
342 struct superblock_security_struct *sbsec,
275bb41e 343 const struct cred *cred)
0808925e 344{
275bb41e 345 const struct task_security_struct *tsec = cred->security;
0808925e
EP
346 int rc;
347 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELFROM, NULL);
349 if (rc)
350 return rc;
351
352 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
353 FILESYSTEM__ASSOCIATE, NULL);
354 return rc;
355}
356
c9180a57 357static int sb_finish_set_opts(struct super_block *sb)
1da177e4 358{
1da177e4 359 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57
EP
360 struct dentry *root = sb->s_root;
361 struct inode *root_inode = root->d_inode;
362 int rc = 0;
1da177e4 363
c9180a57
EP
364 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
365 /* Make sure that the xattr handler exists and that no
366 error other than -ENODATA is returned by getxattr on
367 the root directory. -ENODATA is ok, as this may be
368 the first boot of the SELinux kernel before we have
369 assigned xattr values to the filesystem. */
370 if (!root_inode->i_op->getxattr) {
371 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
372 "xattr support\n", sb->s_id, sb->s_type->name);
373 rc = -EOPNOTSUPP;
374 goto out;
375 }
376 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
377 if (rc < 0 && rc != -ENODATA) {
378 if (rc == -EOPNOTSUPP)
379 printk(KERN_WARNING "SELinux: (dev %s, type "
380 "%s) has no security xattr handler\n",
381 sb->s_id, sb->s_type->name);
382 else
383 printk(KERN_WARNING "SELinux: (dev %s, type "
384 "%s) getxattr errno %d\n", sb->s_id,
385 sb->s_type->name, -rc);
386 goto out;
387 }
388 }
1da177e4 389
11689d47 390 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
1da177e4 391
c9180a57
EP
392 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
393 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
394 sb->s_id, sb->s_type->name);
395 else
396 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
397 sb->s_id, sb->s_type->name,
398 labeling_behaviors[sbsec->behavior-1]);
1da177e4 399
11689d47
DQ
400 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
401 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
402 sbsec->behavior == SECURITY_FS_USE_NONE ||
403 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
404 sbsec->flags &= ~SE_SBLABELSUPP;
405
ddd29ec6
DQ
406 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
407 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
408 sbsec->flags |= SE_SBLABELSUPP;
409
c9180a57
EP
410 /* Initialize the root inode. */
411 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 412
c9180a57
EP
413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
416 populates itself. */
417 spin_lock(&sbsec->isec_lock);
418next_inode:
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
422 struct inode_security_struct, list);
423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
426 if (inode) {
427 if (!IS_PRIVATE(inode))
428 inode_doinit(inode);
429 iput(inode);
430 }
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
433 goto next_inode;
434 }
435 spin_unlock(&sbsec->isec_lock);
436out:
437 return rc;
438}
1da177e4 439
c9180a57
EP
440/*
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
444 */
445static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 446 struct security_mnt_opts *opts)
c9180a57
EP
447{
448 int rc = 0, i;
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
451 u32 len;
452 char tmp;
1da177e4 453
e0007529 454 security_init_mnt_opts(opts);
1da177e4 455
0d90a7ec 456 if (!(sbsec->flags & SE_SBINITIALIZED))
c9180a57 457 return -EINVAL;
1da177e4 458
c9180a57
EP
459 if (!ss_initialized)
460 return -EINVAL;
1da177e4 461
0d90a7ec 462 tmp = sbsec->flags & SE_MNTMASK;
c9180a57
EP
463 /* count the number of mount options for this sb */
464 for (i = 0; i < 8; i++) {
465 if (tmp & 0x01)
e0007529 466 opts->num_mnt_opts++;
c9180a57
EP
467 tmp >>= 1;
468 }
11689d47
DQ
469 /* Check if the Label support flag is set */
470 if (sbsec->flags & SE_SBLABELSUPP)
471 opts->num_mnt_opts++;
1da177e4 472
e0007529
EP
473 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
474 if (!opts->mnt_opts) {
c9180a57
EP
475 rc = -ENOMEM;
476 goto out_free;
477 }
1da177e4 478
e0007529
EP
479 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
480 if (!opts->mnt_opts_flags) {
c9180a57
EP
481 rc = -ENOMEM;
482 goto out_free;
483 }
1da177e4 484
c9180a57
EP
485 i = 0;
486 if (sbsec->flags & FSCONTEXT_MNT) {
487 rc = security_sid_to_context(sbsec->sid, &context, &len);
488 if (rc)
489 goto out_free;
e0007529
EP
490 opts->mnt_opts[i] = context;
491 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP
492 }
493 if (sbsec->flags & CONTEXT_MNT) {
494 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
495 if (rc)
496 goto out_free;
e0007529
EP
497 opts->mnt_opts[i] = context;
498 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP
499 }
500 if (sbsec->flags & DEFCONTEXT_MNT) {
501 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
502 if (rc)
503 goto out_free;
e0007529
EP
504 opts->mnt_opts[i] = context;
505 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP
506 }
507 if (sbsec->flags & ROOTCONTEXT_MNT) {
508 struct inode *root = sbsec->sb->s_root->d_inode;
509 struct inode_security_struct *isec = root->i_security;
0808925e 510
c9180a57
EP
511 rc = security_sid_to_context(isec->sid, &context, &len);
512 if (rc)
513 goto out_free;
e0007529
EP
514 opts->mnt_opts[i] = context;
515 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 516 }
11689d47
DQ
517 if (sbsec->flags & SE_SBLABELSUPP) {
518 opts->mnt_opts[i] = NULL;
519 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
520 }
1da177e4 521
e0007529 522 BUG_ON(i != opts->num_mnt_opts);
1da177e4 523
c9180a57
EP
524 return 0;
525
526out_free:
e0007529 527 security_free_mnt_opts(opts);
c9180a57
EP
528 return rc;
529}
1da177e4 530
c9180a57
EP
531static int bad_option(struct superblock_security_struct *sbsec, char flag,
532 u32 old_sid, u32 new_sid)
533{
0d90a7ec
DQ
534 char mnt_flags = sbsec->flags & SE_MNTMASK;
535
c9180a57 536 /* check if the old mount command had the same options */
0d90a7ec 537 if (sbsec->flags & SE_SBINITIALIZED)
c9180a57
EP
538 if (!(sbsec->flags & flag) ||
539 (old_sid != new_sid))
540 return 1;
541
542 /* check if we were passed the same options twice,
543 * aka someone passed context=a,context=b
544 */
0d90a7ec
DQ
545 if (!(sbsec->flags & SE_SBINITIALIZED))
546 if (mnt_flags & flag)
c9180a57
EP
547 return 1;
548 return 0;
549}
e0007529 550
c9180a57
EP
551/*
552 * Allow filesystems with binary mount data to explicitly set mount point
553 * labeling information.
554 */
e0007529
EP
555static int selinux_set_mnt_opts(struct super_block *sb,
556 struct security_mnt_opts *opts)
c9180a57 557{
275bb41e 558 const struct cred *cred = current_cred();
c9180a57 559 int rc = 0, i;
c9180a57
EP
560 struct superblock_security_struct *sbsec = sb->s_security;
561 const char *name = sb->s_type->name;
089be43e
JM
562 struct inode *inode = sbsec->sb->s_root->d_inode;
563 struct inode_security_struct *root_isec = inode->i_security;
c9180a57
EP
564 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
565 u32 defcontext_sid = 0;
e0007529
EP
566 char **mount_options = opts->mnt_opts;
567 int *flags = opts->mnt_opts_flags;
568 int num_opts = opts->num_mnt_opts;
c9180a57
EP
569
570 mutex_lock(&sbsec->lock);
571
572 if (!ss_initialized) {
573 if (!num_opts) {
574 /* Defer initialization until selinux_complete_init,
575 after the initial policy is loaded and the security
576 server is ready to handle calls. */
c9180a57
EP
577 goto out;
578 }
579 rc = -EINVAL;
744ba35e
EP
580 printk(KERN_WARNING "SELinux: Unable to set superblock options "
581 "before the security server is initialized\n");
1da177e4 582 goto out;
c9180a57 583 }
1da177e4 584
e0007529
EP
585 /*
586 * Binary mount data FS will come through this function twice. Once
587 * from an explicit call and once from the generic calls from the vfs.
588 * Since the generic VFS calls will not contain any security mount data
589 * we need to skip the double mount verification.
590 *
591 * This does open a hole in which we will not notice if the first
592 * mount using this sb set explict options and a second mount using
593 * this sb does not set any security options. (The first options
594 * will be used for both mounts)
595 */
0d90a7ec 596 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
e0007529 597 && (num_opts == 0))
f5269710 598 goto out;
e0007529 599
c9180a57
EP
600 /*
601 * parse the mount options, check if they are valid sids.
602 * also check if someone is trying to mount the same sb more
603 * than once with different security options.
604 */
605 for (i = 0; i < num_opts; i++) {
606 u32 sid;
11689d47
DQ
607
608 if (flags[i] == SE_SBLABELSUPP)
609 continue;
c9180a57
EP
610 rc = security_context_to_sid(mount_options[i],
611 strlen(mount_options[i]), &sid);
1da177e4
LT
612 if (rc) {
613 printk(KERN_WARNING "SELinux: security_context_to_sid"
614 "(%s) failed for (dev %s, type %s) errno=%d\n",
c9180a57
EP
615 mount_options[i], sb->s_id, name, rc);
616 goto out;
617 }
618 switch (flags[i]) {
619 case FSCONTEXT_MNT:
620 fscontext_sid = sid;
621
622 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
623 fscontext_sid))
624 goto out_double_mount;
625
626 sbsec->flags |= FSCONTEXT_MNT;
627 break;
628 case CONTEXT_MNT:
629 context_sid = sid;
630
631 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
632 context_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= CONTEXT_MNT;
636 break;
637 case ROOTCONTEXT_MNT:
638 rootcontext_sid = sid;
639
640 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
641 rootcontext_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= ROOTCONTEXT_MNT;
645
646 break;
647 case DEFCONTEXT_MNT:
648 defcontext_sid = sid;
649
650 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
651 defcontext_sid))
652 goto out_double_mount;
653
654 sbsec->flags |= DEFCONTEXT_MNT;
655
656 break;
657 default:
658 rc = -EINVAL;
659 goto out;
1da177e4 660 }
c9180a57
EP
661 }
662
0d90a7ec 663 if (sbsec->flags & SE_SBINITIALIZED) {
c9180a57 664 /* previously mounted with options, but not on this attempt? */
0d90a7ec 665 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
c9180a57
EP
666 goto out_double_mount;
667 rc = 0;
668 goto out;
669 }
670
089be43e 671 if (strcmp(sb->s_type->name, "proc") == 0)
0d90a7ec 672 sbsec->flags |= SE_SBPROC;
c9180a57
EP
673
674 /* Determine the labeling behavior to use for this filesystem type. */
0d90a7ec 675 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
c9180a57
EP
676 if (rc) {
677 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
089be43e 678 __func__, sb->s_type->name, rc);
c9180a57
EP
679 goto out;
680 }
1da177e4 681
c9180a57
EP
682 /* sets the context of the superblock for the fs being mounted. */
683 if (fscontext_sid) {
275bb41e 684 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
1da177e4 685 if (rc)
c9180a57 686 goto out;
1da177e4 687
c9180a57 688 sbsec->sid = fscontext_sid;
c312feb2
EP
689 }
690
691 /*
692 * Switch to using mount point labeling behavior.
693 * sets the label used on all file below the mountpoint, and will set
694 * the superblock context if not already set.
695 */
c9180a57
EP
696 if (context_sid) {
697 if (!fscontext_sid) {
275bb41e
DH
698 rc = may_context_mount_sb_relabel(context_sid, sbsec,
699 cred);
b04ea3ce 700 if (rc)
c9180a57
EP
701 goto out;
702 sbsec->sid = context_sid;
b04ea3ce 703 } else {
275bb41e
DH
704 rc = may_context_mount_inode_relabel(context_sid, sbsec,
705 cred);
b04ea3ce 706 if (rc)
c9180a57 707 goto out;
b04ea3ce 708 }
c9180a57
EP
709 if (!rootcontext_sid)
710 rootcontext_sid = context_sid;
1da177e4 711
c9180a57 712 sbsec->mntpoint_sid = context_sid;
c312feb2 713 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT
714 }
715
c9180a57 716 if (rootcontext_sid) {
275bb41e
DH
717 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
718 cred);
0808925e 719 if (rc)
c9180a57 720 goto out;
0808925e 721
c9180a57
EP
722 root_isec->sid = rootcontext_sid;
723 root_isec->initialized = 1;
0808925e
EP
724 }
725
c9180a57
EP
726 if (defcontext_sid) {
727 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
728 rc = -EINVAL;
729 printk(KERN_WARNING "SELinux: defcontext option is "
730 "invalid for this filesystem type\n");
731 goto out;
1da177e4
LT
732 }
733
c9180a57
EP
734 if (defcontext_sid != sbsec->def_sid) {
735 rc = may_context_mount_inode_relabel(defcontext_sid,
275bb41e 736 sbsec, cred);
c9180a57
EP
737 if (rc)
738 goto out;
739 }
1da177e4 740
c9180a57 741 sbsec->def_sid = defcontext_sid;
1da177e4
LT
742 }
743
c9180a57 744 rc = sb_finish_set_opts(sb);
1da177e4 745out:
c9180a57 746 mutex_unlock(&sbsec->lock);
1da177e4 747 return rc;
c9180a57
EP
748out_double_mount:
749 rc = -EINVAL;
750 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
751 "security settings for (dev %s, type %s)\n", sb->s_id, name);
752 goto out;
1da177e4
LT
753}
754
c9180a57
EP
755static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
756 struct super_block *newsb)
1da177e4 757{
c9180a57
EP
758 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
759 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 760
c9180a57
EP
761 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
762 int set_context = (oldsbsec->flags & CONTEXT_MNT);
763 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 764
0f5e6420
EP
765 /*
766 * if the parent was able to be mounted it clearly had no special lsm
e8c26255 767 * mount options. thus we can safely deal with this superblock later
0f5e6420 768 */
e8c26255 769 if (!ss_initialized)
0f5e6420 770 return;
c9180a57 771
c9180a57 772 /* how can we clone if the old one wasn't set up?? */
0d90a7ec 773 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
c9180a57 774
5a552617 775 /* if fs is reusing a sb, just let its options stand... */
0d90a7ec 776 if (newsbsec->flags & SE_SBINITIALIZED)
5a552617
EP
777 return;
778
c9180a57
EP
779 mutex_lock(&newsbsec->lock);
780
781 newsbsec->flags = oldsbsec->flags;
782
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
786
787 if (set_context) {
788 u32 sid = oldsbsec->mntpoint_sid;
789
790 if (!set_fscontext)
791 newsbsec->sid = sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
795 newisec->sid = sid;
796 }
797 newsbsec->mntpoint_sid = sid;
1da177e4 798 }
c9180a57
EP
799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 804
c9180a57 805 newisec->sid = oldisec->sid;
1da177e4
LT
806 }
807
c9180a57
EP
808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
810}
811
2e1479d9
AB
812static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
c9180a57 814{
e0007529 815 char *p;
c9180a57
EP
816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
e0007529 818 int rc, num_mnt_opts = 0;
1da177e4 819
e0007529 820 opts->num_mnt_opts = 0;
1da177e4 821
c9180a57
EP
822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
824 int token;
825 substring_t args[MAX_OPT_ARGS];
1da177e4 826
c9180a57
EP
827 if (!*p)
828 continue;
1da177e4 829
c9180a57 830 token = match_token(p, tokens, args);
1da177e4 831
c9180a57
EP
832 switch (token) {
833 case Opt_context:
834 if (context || defcontext) {
835 rc = -EINVAL;
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
837 goto out_err;
838 }
839 context = match_strdup(&args[0]);
840 if (!context) {
841 rc = -ENOMEM;
842 goto out_err;
843 }
844 break;
845
846 case Opt_fscontext:
847 if (fscontext) {
848 rc = -EINVAL;
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
850 goto out_err;
851 }
852 fscontext = match_strdup(&args[0]);
853 if (!fscontext) {
854 rc = -ENOMEM;
855 goto out_err;
856 }
857 break;
858
859 case Opt_rootcontext:
860 if (rootcontext) {
861 rc = -EINVAL;
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
863 goto out_err;
864 }
865 rootcontext = match_strdup(&args[0]);
866 if (!rootcontext) {
867 rc = -ENOMEM;
868 goto out_err;
869 }
870 break;
871
872 case Opt_defcontext:
873 if (context || defcontext) {
874 rc = -EINVAL;
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
876 goto out_err;
877 }
878 defcontext = match_strdup(&args[0]);
879 if (!defcontext) {
880 rc = -ENOMEM;
881 goto out_err;
882 }
883 break;
11689d47
DQ
884 case Opt_labelsupport:
885 break;
c9180a57
EP
886 default:
887 rc = -EINVAL;
888 printk(KERN_WARNING "SELinux: unknown mount option\n");
889 goto out_err;
1da177e4 890
1da177e4 891 }
1da177e4 892 }
c9180a57 893
e0007529
EP
894 rc = -ENOMEM;
895 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
896 if (!opts->mnt_opts)
897 goto out_err;
898
899 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
900 if (!opts->mnt_opts_flags) {
901 kfree(opts->mnt_opts);
902 goto out_err;
903 }
904
c9180a57 905 if (fscontext) {
e0007529
EP
906 opts->mnt_opts[num_mnt_opts] = fscontext;
907 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP
908 }
909 if (context) {
e0007529
EP
910 opts->mnt_opts[num_mnt_opts] = context;
911 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP
912 }
913 if (rootcontext) {
e0007529
EP
914 opts->mnt_opts[num_mnt_opts] = rootcontext;
915 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP
916 }
917 if (defcontext) {
e0007529
EP
918 opts->mnt_opts[num_mnt_opts] = defcontext;
919 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP
920 }
921
e0007529
EP
922 opts->num_mnt_opts = num_mnt_opts;
923 return 0;
924
c9180a57
EP
925out_err:
926 kfree(context);
927 kfree(defcontext);
928 kfree(fscontext);
929 kfree(rootcontext);
1da177e4
LT
930 return rc;
931}
e0007529
EP
932/*
933 * string mount options parsing and call set the sbsec
934 */
935static int superblock_doinit(struct super_block *sb, void *data)
936{
937 int rc = 0;
938 char *options = data;
939 struct security_mnt_opts opts;
940
941 security_init_mnt_opts(&opts);
942
943 if (!data)
944 goto out;
945
946 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
947
948 rc = selinux_parse_opts_str(options, &opts);
949 if (rc)
950 goto out_err;
951
952out:
953 rc = selinux_set_mnt_opts(sb, &opts);
954
955out_err:
956 security_free_mnt_opts(&opts);
957 return rc;
958}
1da177e4 959
3583a711
AB
960static void selinux_write_opts(struct seq_file *m,
961 struct security_mnt_opts *opts)
2069f457
EP
962{
963 int i;
964 char *prefix;
965
966 for (i = 0; i < opts->num_mnt_opts; i++) {
11689d47
DQ
967 char *has_comma;
968
969 if (opts->mnt_opts[i])
970 has_comma = strchr(opts->mnt_opts[i], ',');
971 else
972 has_comma = NULL;
2069f457
EP
973
974 switch (opts->mnt_opts_flags[i]) {
975 case CONTEXT_MNT:
976 prefix = CONTEXT_STR;
977 break;
978 case FSCONTEXT_MNT:
979 prefix = FSCONTEXT_STR;
980 break;
981 case ROOTCONTEXT_MNT:
982 prefix = ROOTCONTEXT_STR;
983 break;
984 case DEFCONTEXT_MNT:
985 prefix = DEFCONTEXT_STR;
986 break;
11689d47
DQ
987 case SE_SBLABELSUPP:
988 seq_putc(m, ',');
989 seq_puts(m, LABELSUPP_STR);
990 continue;
2069f457
EP
991 default:
992 BUG();
993 };
994 /* we need a comma before each option */
995 seq_putc(m, ',');
996 seq_puts(m, prefix);
997 if (has_comma)
998 seq_putc(m, '\"');
999 seq_puts(m, opts->mnt_opts[i]);
1000 if (has_comma)
1001 seq_putc(m, '\"');
1002 }
1003}
1004
1005static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1006{
1007 struct security_mnt_opts opts;
1008 int rc;
1009
1010 rc = selinux_get_mnt_opts(sb, &opts);
383795c2
EP
1011 if (rc) {
1012 /* before policy load we may get EINVAL, don't show anything */
1013 if (rc == -EINVAL)
1014 rc = 0;
2069f457 1015 return rc;
383795c2 1016 }
2069f457
EP
1017
1018 selinux_write_opts(m, &opts);
1019
1020 security_free_mnt_opts(&opts);
1021
1022 return rc;
1023}
1024
1da177e4
LT
1025static inline u16 inode_mode_to_security_class(umode_t mode)
1026{
1027 switch (mode & S_IFMT) {
1028 case S_IFSOCK:
1029 return SECCLASS_SOCK_FILE;
1030 case S_IFLNK:
1031 return SECCLASS_LNK_FILE;
1032 case S_IFREG:
1033 return SECCLASS_FILE;
1034 case S_IFBLK:
1035 return SECCLASS_BLK_FILE;
1036 case S_IFDIR:
1037 return SECCLASS_DIR;
1038 case S_IFCHR:
1039 return SECCLASS_CHR_FILE;
1040 case S_IFIFO:
1041 return SECCLASS_FIFO_FILE;
1042
1043 }
1044
1045 return SECCLASS_FILE;
1046}
1047
13402580
JM
1048static inline int default_protocol_stream(int protocol)
1049{
1050 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1051}
1052
1053static inline int default_protocol_dgram(int protocol)
1054{
1055 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1056}
1057
1da177e4
LT
1058static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1059{
1060 switch (family) {
1061 case PF_UNIX:
1062 switch (type) {
1063 case SOCK_STREAM:
1064 case SOCK_SEQPACKET:
1065 return SECCLASS_UNIX_STREAM_SOCKET;
1066 case SOCK_DGRAM:
1067 return SECCLASS_UNIX_DGRAM_SOCKET;
1068 }
1069 break;
1070 case PF_INET:
1071 case PF_INET6:
1072 switch (type) {
1073 case SOCK_STREAM:
13402580
JM
1074 if (default_protocol_stream(protocol))
1075 return SECCLASS_TCP_SOCKET;
1076 else
1077 return SECCLASS_RAWIP_SOCKET;
1da177e4 1078 case SOCK_DGRAM:
13402580
JM
1079 if (default_protocol_dgram(protocol))
1080 return SECCLASS_UDP_SOCKET;
1081 else
1082 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM
1083 case SOCK_DCCP:
1084 return SECCLASS_DCCP_SOCKET;
13402580 1085 default:
1da177e4
LT
1086 return SECCLASS_RAWIP_SOCKET;
1087 }
1088 break;
1089 case PF_NETLINK:
1090 switch (protocol) {
1091 case NETLINK_ROUTE:
1092 return SECCLASS_NETLINK_ROUTE_SOCKET;
1093 case NETLINK_FIREWALL:
1094 return SECCLASS_NETLINK_FIREWALL_SOCKET;
216efaaa 1095 case NETLINK_INET_DIAG:
1da177e4
LT
1096 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1097 case NETLINK_NFLOG:
1098 return SECCLASS_NETLINK_NFLOG_SOCKET;
1099 case NETLINK_XFRM:
1100 return SECCLASS_NETLINK_XFRM_SOCKET;
1101 case NETLINK_SELINUX:
1102 return SECCLASS_NETLINK_SELINUX_SOCKET;
1103 case NETLINK_AUDIT:
1104 return SECCLASS_NETLINK_AUDIT_SOCKET;
1105 case NETLINK_IP6_FW:
1106 return SECCLASS_NETLINK_IP6FW_SOCKET;
1107 case NETLINK_DNRTMSG:
1108 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM
1109 case NETLINK_KOBJECT_UEVENT:
1110 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT
1111 default:
1112 return SECCLASS_NETLINK_SOCKET;
1113 }
1114 case PF_PACKET:
1115 return SECCLASS_PACKET_SOCKET;
1116 case PF_KEY:
1117 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP
1118 case PF_APPLETALK:
1119 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT
1120 }
1121
1122 return SECCLASS_SOCKET;
1123}
1124
1125#ifdef CONFIG_PROC_FS
8e6c9693 1126static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT
1127 u16 tclass,
1128 u32 *sid)
1129{
8e6c9693
LAG
1130 int rc;
1131 char *buffer, *path;
1da177e4 1132
828dfe1d 1133 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT
1134 if (!buffer)
1135 return -ENOMEM;
1136
8e6c9693
LAG
1137 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1138 if (IS_ERR(path))
1139 rc = PTR_ERR(path);
1140 else {
1141 /* each process gets a /proc/PID/ entry. Strip off the
1142 * PID part to get a valid selinux labeling.
1143 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1144 while (path[1] >= '0' && path[1] <= '9') {
1145 path[1] = '/';
1146 path++;
1147 }
1148 rc = security_genfs_sid("proc", path, tclass, sid);
1da177e4 1149 }
1da177e4
LT
1150 free_page((unsigned long)buffer);
1151 return rc;
1152}
1153#else
8e6c9693 1154static int selinux_proc_get_sid(struct dentry *dentry,
1da177e4
LT
1155 u16 tclass,
1156 u32 *sid)
1157{
1158 return -EINVAL;
1159}
1160#endif
1161
1162/* The inode's security attributes must be initialized before first use. */
1163static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1164{
1165 struct superblock_security_struct *sbsec = NULL;
1166 struct inode_security_struct *isec = inode->i_security;
1167 u32 sid;
1168 struct dentry *dentry;
1169#define INITCONTEXTLEN 255
1170 char *context = NULL;
1171 unsigned len = 0;
1172 int rc = 0;
1da177e4
LT
1173
1174 if (isec->initialized)
1175 goto out;
1176
23970741 1177 mutex_lock(&isec->lock);
1da177e4 1178 if (isec->initialized)
23970741 1179 goto out_unlock;
1da177e4
LT
1180
1181 sbsec = inode->i_sb->s_security;
0d90a7ec 1182 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1da177e4
LT
1183 /* Defer initialization until selinux_complete_init,
1184 after the initial policy is loaded and the security
1185 server is ready to handle calls. */
1186 spin_lock(&sbsec->isec_lock);
1187 if (list_empty(&isec->list))
1188 list_add(&isec->list, &sbsec->isec_head);
1189 spin_unlock(&sbsec->isec_lock);
23970741 1190 goto out_unlock;
1da177e4
LT
1191 }
1192
1193 switch (sbsec->behavior) {
1194 case SECURITY_FS_USE_XATTR:
1195 if (!inode->i_op->getxattr) {
1196 isec->sid = sbsec->def_sid;
1197 break;
1198 }
1199
1200 /* Need a dentry, since the xattr API requires one.
1201 Life would be simpler if we could just pass the inode. */
1202 if (opt_dentry) {
1203 /* Called from d_instantiate or d_splice_alias. */
1204 dentry = dget(opt_dentry);
1205 } else {
1206 /* Called from selinux_complete_init, try to find a dentry. */
1207 dentry = d_find_alias(inode);
1208 }
1209 if (!dentry) {
df7f54c0
EP
1210 /*
1211 * this is can be hit on boot when a file is accessed
1212 * before the policy is loaded. When we load policy we
1213 * may find inodes that have no dentry on the
1214 * sbsec->isec_head list. No reason to complain as these
1215 * will get fixed up the next time we go through
1216 * inode_doinit with a dentry, before these inodes could
1217 * be used again by userspace.
1218 */
23970741 1219 goto out_unlock;
1da177e4
LT
1220 }
1221
1222 len = INITCONTEXTLEN;
4cb912f1 1223 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1224 if (!context) {
1225 rc = -ENOMEM;
1226 dput(dentry);
23970741 1227 goto out_unlock;
1da177e4 1228 }
4cb912f1 1229 context[len] = '\0';
1da177e4
LT
1230 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1231 context, len);
1232 if (rc == -ERANGE) {
314dabb8
JM
1233 kfree(context);
1234
1da177e4
LT
1235 /* Need a larger buffer. Query for the right size. */
1236 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1237 NULL, 0);
1238 if (rc < 0) {
1239 dput(dentry);
23970741 1240 goto out_unlock;
1da177e4 1241 }
1da177e4 1242 len = rc;
4cb912f1 1243 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1244 if (!context) {
1245 rc = -ENOMEM;
1246 dput(dentry);
23970741 1247 goto out_unlock;
1da177e4 1248 }
4cb912f1 1249 context[len] = '\0';
1da177e4
LT
1250 rc = inode->i_op->getxattr(dentry,
1251 XATTR_NAME_SELINUX,
1252 context, len);
1253 }
1254 dput(dentry);
1255 if (rc < 0) {
1256 if (rc != -ENODATA) {
744ba35e 1257 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1258 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT
1259 -rc, inode->i_sb->s_id, inode->i_ino);
1260 kfree(context);
23970741 1261 goto out_unlock;
1da177e4
LT
1262 }
1263 /* Map ENODATA to the default file SID */
1264 sid = sbsec->def_sid;
1265 rc = 0;
1266 } else {
f5c1d5b2 1267 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS
1268 sbsec->def_sid,
1269 GFP_NOFS);
1da177e4 1270 if (rc) {
4ba0a8ad
EP
1271 char *dev = inode->i_sb->s_id;
1272 unsigned long ino = inode->i_ino;
1273
1274 if (rc == -EINVAL) {
1275 if (printk_ratelimit())
1276 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1277 "context=%s. This indicates you may need to relabel the inode or the "
1278 "filesystem in question.\n", ino, dev, context);
1279 } else {
1280 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1281 "returned %d for dev=%s ino=%ld\n",
1282 __func__, context, -rc, dev, ino);
1283 }
1da177e4
LT
1284 kfree(context);
1285 /* Leave with the unlabeled SID */
1286 rc = 0;
1287 break;
1288 }
1289 }
1290 kfree(context);
1291 isec->sid = sid;
1292 break;
1293 case SECURITY_FS_USE_TASK:
1294 isec->sid = isec->task_sid;
1295 break;
1296 case SECURITY_FS_USE_TRANS:
1297 /* Default to the fs SID. */
1298 isec->sid = sbsec->sid;
1299
1300 /* Try to obtain a transition SID. */
1301 isec->sclass = inode_mode_to_security_class(inode->i_mode);
652bb9b0
EP
1302 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1303 isec->sclass, NULL, &sid);
1da177e4 1304 if (rc)
23970741 1305 goto out_unlock;
1da177e4
LT
1306 isec->sid = sid;
1307 break;
c312feb2
EP
1308 case SECURITY_FS_USE_MNTPOINT:
1309 isec->sid = sbsec->mntpoint_sid;
1310 break;
1da177e4 1311 default:
c312feb2 1312 /* Default to the fs superblock SID. */
1da177e4
LT
1313 isec->sid = sbsec->sid;
1314
0d90a7ec 1315 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
8e6c9693 1316 if (opt_dentry) {
1da177e4 1317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
8e6c9693 1318 rc = selinux_proc_get_sid(opt_dentry,
1da177e4
LT
1319 isec->sclass,
1320 &sid);
1321 if (rc)
23970741 1322 goto out_unlock;
1da177e4
LT
1323 isec->sid = sid;
1324 }
1325 }
1326 break;
1327 }
1328
1329 isec->initialized = 1;
1330
23970741
EP
1331out_unlock:
1332 mutex_unlock(&isec->lock);
1da177e4
LT
1333out:
1334 if (isec->sclass == SECCLASS_FILE)
1335 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT
1336 return rc;
1337}
1338
1339/* Convert a Linux signal to an access vector. */
1340static inline u32 signal_to_av(int sig)
1341{
1342 u32 perm = 0;
1343
1344 switch (sig) {
1345 case SIGCHLD:
1346 /* Commonly granted from child to parent. */
1347 perm = PROCESS__SIGCHLD;
1348 break;
1349 case SIGKILL:
1350 /* Cannot be caught or ignored */
1351 perm = PROCESS__SIGKILL;
1352 break;
1353 case SIGSTOP:
1354 /* Cannot be caught or ignored */
1355 perm = PROCESS__SIGSTOP;
1356 break;
1357 default:
1358 /* All other signals. */
1359 perm = PROCESS__SIGNAL;
1360 break;
1361 }
1362
1363 return perm;
1364}
1365
d84f4f99
DH
1366/*
1367 * Check permission between a pair of credentials
1368 * fork check, ptrace check, etc.
1369 */
1370static int cred_has_perm(const struct cred *actor,
1371 const struct cred *target,
1372 u32 perms)
1373{
1374 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1375
1376 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1377}
1378
275bb41e 1379/*
88e67f3b 1380 * Check permission between a pair of tasks, e.g. signal checks,
275bb41e
DH
1381 * fork check, ptrace check, etc.
1382 * tsk1 is the actor and tsk2 is the target
3b11a1de 1383 * - this uses the default subjective creds of tsk1
275bb41e
DH
1384 */
1385static int task_has_perm(const struct task_struct *tsk1,
1386 const struct task_struct *tsk2,
1da177e4
LT
1387 u32 perms)
1388{
275bb41e
DH
1389 const struct task_security_struct *__tsec1, *__tsec2;
1390 u32 sid1, sid2;
1da177e4 1391
275bb41e
DH
1392 rcu_read_lock();
1393 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1394 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1395 rcu_read_unlock();
1396 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1da177e4
LT
1397}
1398
3b11a1de
DH
1399/*
1400 * Check permission between current and another task, e.g. signal checks,
1401 * fork check, ptrace check, etc.
1402 * current is the actor and tsk2 is the target
1403 * - this uses current's subjective creds
1404 */
1405static int current_has_perm(const struct task_struct *tsk,
1406 u32 perms)
1407{
1408 u32 sid, tsid;
1409
1410 sid = current_sid();
1411 tsid = task_sid(tsk);
1412 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1413}
1414
b68e418c
SS
1415#if CAP_LAST_CAP > 63
1416#error Fix SELinux to handle capabilities > 63.
1417#endif
1418
1da177e4
LT
1419/* Check whether a task is allowed to use a capability. */
1420static int task_has_capability(struct task_struct *tsk,
3699c53c 1421 const struct cred *cred,
06112163 1422 int cap, int audit)
1da177e4 1423{
2bf49690 1424 struct common_audit_data ad;
06112163 1425 struct av_decision avd;
b68e418c 1426 u16 sclass;
3699c53c 1427 u32 sid = cred_sid(cred);
b68e418c 1428 u32 av = CAP_TO_MASK(cap);
06112163 1429 int rc;
1da177e4 1430
2bf49690 1431 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1da177e4
LT
1432 ad.tsk = tsk;
1433 ad.u.cap = cap;
1434
b68e418c
SS
1435 switch (CAP_TO_INDEX(cap)) {
1436 case 0:
1437 sclass = SECCLASS_CAPABILITY;
1438 break;
1439 case 1:
1440 sclass = SECCLASS_CAPABILITY2;
1441 break;
1442 default:
1443 printk(KERN_ERR
1444 "SELinux: out of range capability %d\n", cap);
1445 BUG();
1446 }
06112163 1447
275bb41e 1448 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
06112163 1449 if (audit == SECURITY_CAP_AUDIT)
275bb41e 1450 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
06112163 1451 return rc;
1da177e4
LT
1452}
1453
1454/* Check whether a task is allowed to use a system operation. */
1455static int task_has_system(struct task_struct *tsk,
1456 u32 perms)
1457{
275bb41e 1458 u32 sid = task_sid(tsk);
1da177e4 1459
275bb41e 1460 return avc_has_perm(sid, SECINITSID_KERNEL,
1da177e4
LT
1461 SECCLASS_SYSTEM, perms, NULL);
1462}
1463
1464/* Check whether a task has a particular permission to an inode.
1465 The 'adp' parameter is optional and allows other audit
1466 data to be passed (e.g. the dentry). */
88e67f3b 1467static int inode_has_perm(const struct cred *cred,
1da177e4
LT
1468 struct inode *inode,
1469 u32 perms,
2bf49690 1470 struct common_audit_data *adp)
1da177e4 1471{
1da177e4 1472 struct inode_security_struct *isec;
2bf49690 1473 struct common_audit_data ad;
275bb41e 1474 u32 sid;
1da177e4 1475
e0e81739
DH
1476 validate_creds(cred);
1477
828dfe1d 1478 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS
1479 return 0;
1480
88e67f3b 1481 sid = cred_sid(cred);
1da177e4
LT
1482 isec = inode->i_security;
1483
1484 if (!adp) {
1485 adp = &ad;
2bf49690 1486 COMMON_AUDIT_DATA_INIT(&ad, FS);
1da177e4
LT
1487 ad.u.fs.inode = inode;
1488 }
1489
275bb41e 1490 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1da177e4
LT
1491}
1492
1493/* Same as inode_has_perm, but pass explicit audit data containing
1494 the dentry to help the auditing code to more easily generate the
1495 pathname if needed. */
88e67f3b 1496static inline int dentry_has_perm(const struct cred *cred,
1da177e4
LT
1497 struct vfsmount *mnt,
1498 struct dentry *dentry,
1499 u32 av)
1500{
1501 struct inode *inode = dentry->d_inode;
2bf49690 1502 struct common_audit_data ad;
88e67f3b 1503
2bf49690 1504 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf
JB
1505 ad.u.fs.path.mnt = mnt;
1506 ad.u.fs.path.dentry = dentry;
88e67f3b 1507 return inode_has_perm(cred, inode, av, &ad);
1da177e4
LT
1508}
1509
1510/* Check whether a task can use an open file descriptor to
1511 access an inode in a given way. Check access to the
1512 descriptor itself, and then use dentry_has_perm to
1513 check a particular permission to the file.
1514 Access to the descriptor is implicitly granted if it
1515 has the same SID as the process. If av is zero, then
1516 access to the file is not checked, e.g. for cases
1517 where only the descriptor is affected like seek. */
88e67f3b
DH
1518static int file_has_perm(const struct cred *cred,
1519 struct file *file,
1520 u32 av)
1da177e4 1521{
1da177e4 1522 struct file_security_struct *fsec = file->f_security;
44707fdf 1523 struct inode *inode = file->f_path.dentry->d_inode;
2bf49690 1524 struct common_audit_data ad;
88e67f3b 1525 u32 sid = cred_sid(cred);
1da177e4
LT
1526 int rc;
1527
2bf49690 1528 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1529 ad.u.fs.path = file->f_path;
1da177e4 1530
275bb41e
DH
1531 if (sid != fsec->sid) {
1532 rc = avc_has_perm(sid, fsec->sid,
1da177e4
LT
1533 SECCLASS_FD,
1534 FD__USE,
1535 &ad);
1536 if (rc)
88e67f3b 1537 goto out;
1da177e4
LT
1538 }
1539
1540 /* av is zero if only checking access to the descriptor. */
88e67f3b 1541 rc = 0;
1da177e4 1542 if (av)
88e67f3b 1543 rc = inode_has_perm(cred, inode, av, &ad);
1da177e4 1544
88e67f3b
DH
1545out:
1546 return rc;
1da177e4
LT
1547}
1548
1549/* Check whether a task can create a file. */
1550static int may_create(struct inode *dir,
1551 struct dentry *dentry,
1552 u16 tclass)
1553{
5fb49870 1554 const struct task_security_struct *tsec = current_security();
1da177e4
LT
1555 struct inode_security_struct *dsec;
1556 struct superblock_security_struct *sbsec;
275bb41e 1557 u32 sid, newsid;
2bf49690 1558 struct common_audit_data ad;
1da177e4
LT
1559 int rc;
1560
1da177e4
LT
1561 dsec = dir->i_security;
1562 sbsec = dir->i_sb->s_security;
1563
275bb41e
DH
1564 sid = tsec->sid;
1565 newsid = tsec->create_sid;
1566
2bf49690 1567 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1568 ad.u.fs.path.dentry = dentry;
1da177e4 1569
275bb41e 1570 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1da177e4
LT
1571 DIR__ADD_NAME | DIR__SEARCH,
1572 &ad);
1573 if (rc)
1574 return rc;
1575
cd89596f 1576 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
652bb9b0 1577 rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
1da177e4
LT
1578 if (rc)
1579 return rc;
1580 }
1581
275bb41e 1582 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1da177e4
LT
1583 if (rc)
1584 return rc;
1585
1586 return avc_has_perm(newsid, sbsec->sid,
1587 SECCLASS_FILESYSTEM,
1588 FILESYSTEM__ASSOCIATE, &ad);
1589}
1590
4eb582cf
ML
1591/* Check whether a task can create a key. */
1592static int may_create_key(u32 ksid,
1593 struct task_struct *ctx)
1594{
275bb41e 1595 u32 sid = task_sid(ctx);
4eb582cf 1596
275bb41e 1597 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
4eb582cf
ML
1598}
1599
828dfe1d
EP
1600#define MAY_LINK 0
1601#define MAY_UNLINK 1
1602#define MAY_RMDIR 2
1da177e4
LT
1603
1604/* Check whether a task can link, unlink, or rmdir a file/directory. */
1605static int may_link(struct inode *dir,
1606 struct dentry *dentry,
1607 int kind)
1608
1609{
1da177e4 1610 struct inode_security_struct *dsec, *isec;
2bf49690 1611 struct common_audit_data ad;
275bb41e 1612 u32 sid = current_sid();
1da177e4
LT
1613 u32 av;
1614 int rc;
1615
1da177e4
LT
1616 dsec = dir->i_security;
1617 isec = dentry->d_inode->i_security;
1618
2bf49690 1619 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1620 ad.u.fs.path.dentry = dentry;
1da177e4
LT
1621
1622 av = DIR__SEARCH;
1623 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
275bb41e 1624 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1625 if (rc)
1626 return rc;
1627
1628 switch (kind) {
1629 case MAY_LINK:
1630 av = FILE__LINK;
1631 break;
1632 case MAY_UNLINK:
1633 av = FILE__UNLINK;
1634 break;
1635 case MAY_RMDIR:
1636 av = DIR__RMDIR;
1637 break;
1638 default:
744ba35e
EP
1639 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1640 __func__, kind);
1da177e4
LT
1641 return 0;
1642 }
1643
275bb41e 1644 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1da177e4
LT
1645 return rc;
1646}
1647
1648static inline int may_rename(struct inode *old_dir,
1649 struct dentry *old_dentry,
1650 struct inode *new_dir,
1651 struct dentry *new_dentry)
1652{
1da177e4 1653 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2bf49690 1654 struct common_audit_data ad;
275bb41e 1655 u32 sid = current_sid();
1da177e4
LT
1656 u32 av;
1657 int old_is_dir, new_is_dir;
1658 int rc;
1659
1da177e4
LT
1660 old_dsec = old_dir->i_security;
1661 old_isec = old_dentry->d_inode->i_security;
1662 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1663 new_dsec = new_dir->i_security;
1664
2bf49690 1665 COMMON_AUDIT_DATA_INIT(&ad, FS);
1da177e4 1666
44707fdf 1667 ad.u.fs.path.dentry = old_dentry;
275bb41e 1668 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1da177e4
LT
1669 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1670 if (rc)
1671 return rc;
275bb41e 1672 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1673 old_isec->sclass, FILE__RENAME, &ad);
1674 if (rc)
1675 return rc;
1676 if (old_is_dir && new_dir != old_dir) {
275bb41e 1677 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1678 old_isec->sclass, DIR__REPARENT, &ad);
1679 if (rc)
1680 return rc;
1681 }
1682
44707fdf 1683 ad.u.fs.path.dentry = new_dentry;
1da177e4
LT
1684 av = DIR__ADD_NAME | DIR__SEARCH;
1685 if (new_dentry->d_inode)
1686 av |= DIR__REMOVE_NAME;
275bb41e 1687 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1688 if (rc)
1689 return rc;
1690 if (new_dentry->d_inode) {
1691 new_isec = new_dentry->d_inode->i_security;
1692 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
275bb41e 1693 rc = avc_has_perm(sid, new_isec->sid,
1da177e4
LT
1694 new_isec->sclass,
1695 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1696 if (rc)
1697 return rc;
1698 }
1699
1700 return 0;
1701}
1702
1703/* Check whether a task can perform a filesystem operation. */
88e67f3b 1704static int superblock_has_perm(const struct cred *cred,
1da177e4
LT
1705 struct super_block *sb,
1706 u32 perms,
2bf49690 1707 struct common_audit_data *ad)
1da177e4 1708{
1da177e4 1709 struct superblock_security_struct *sbsec;
88e67f3b 1710 u32 sid = cred_sid(cred);
1da177e4 1711
1da177e4 1712 sbsec = sb->s_security;
275bb41e 1713 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1da177e4
LT
1714}
1715
1716/* Convert a Linux mode and permission mask to an access vector. */
1717static inline u32 file_mask_to_av(int mode, int mask)
1718{
1719 u32 av = 0;
1720
1721 if ((mode & S_IFMT) != S_IFDIR) {
1722 if (mask & MAY_EXEC)
1723 av |= FILE__EXECUTE;
1724 if (mask & MAY_READ)
1725 av |= FILE__READ;
1726
1727 if (mask & MAY_APPEND)
1728 av |= FILE__APPEND;
1729 else if (mask & MAY_WRITE)
1730 av |= FILE__WRITE;
1731
1732 } else {
1733 if (mask & MAY_EXEC)
1734 av |= DIR__SEARCH;
1735 if (mask & MAY_WRITE)
1736 av |= DIR__WRITE;
1737 if (mask & MAY_READ)
1738 av |= DIR__READ;
1739 }
1740
1741 return av;
1742}
1743
8b6a5a37
EP
1744/* Convert a Linux file to an access vector. */
1745static inline u32 file_to_av(struct file *file)
1746{
1747 u32 av = 0;
1748
1749 if (file->f_mode & FMODE_READ)
1750 av |= FILE__READ;
1751 if (file->f_mode & FMODE_WRITE) {
1752 if (file->f_flags & O_APPEND)
1753 av |= FILE__APPEND;
1754 else
1755 av |= FILE__WRITE;
1756 }
1757 if (!av) {
1758 /*
1759 * Special file opened with flags 3 for ioctl-only use.
1760 */
1761 av = FILE__IOCTL;
1762 }
1763
1764 return av;
1765}
1766
b0c636b9 1767/*
8b6a5a37 1768 * Convert a file to an access vector and include the correct open
b0c636b9
EP
1769 * open permission.
1770 */
8b6a5a37 1771static inline u32 open_file_to_av(struct file *file)
b0c636b9 1772{
8b6a5a37 1773 u32 av = file_to_av(file);
b0c636b9 1774
49b7b8de
EP
1775 if (selinux_policycap_openperm)
1776 av |= FILE__OPEN;
1777
b0c636b9
EP
1778 return av;
1779}
1780
1da177e4
LT
1781/* Hook functions begin here. */
1782
9e48858f 1783static int selinux_ptrace_access_check(struct task_struct *child,
5cd9c58f 1784 unsigned int mode)
1da177e4 1785{
1da177e4
LT
1786 int rc;
1787
9e48858f 1788 rc = cap_ptrace_access_check(child, mode);
1da177e4
LT
1789 if (rc)
1790 return rc;
1791
006ebb40 1792 if (mode == PTRACE_MODE_READ) {
275bb41e
DH
1793 u32 sid = current_sid();
1794 u32 csid = task_sid(child);
1795 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
006ebb40
SS
1796 }
1797
3b11a1de 1798 return current_has_perm(child, PROCESS__PTRACE);
5cd9c58f
DH
1799}
1800
1801static int selinux_ptrace_traceme(struct task_struct *parent)
1802{
1803 int rc;
1804
200ac532 1805 rc = cap_ptrace_traceme(parent);
5cd9c58f
DH
1806 if (rc)
1807 return rc;
1808
1809 return task_has_perm(parent, current, PROCESS__PTRACE);
1da177e4
LT
1810}
1811
1812static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1813 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT
1814{
1815 int error;
1816
3b11a1de 1817 error = current_has_perm(target, PROCESS__GETCAP);
1da177e4
LT
1818 if (error)
1819 return error;
1820
200ac532 1821 return cap_capget(target, effective, inheritable, permitted);
1da177e4
LT
1822}
1823
d84f4f99
DH
1824static int selinux_capset(struct cred *new, const struct cred *old,
1825 const kernel_cap_t *effective,
1826 const kernel_cap_t *inheritable,
1827 const kernel_cap_t *permitted)
1da177e4
LT
1828{
1829 int error;
1830
200ac532 1831 error = cap_capset(new, old,
d84f4f99 1832 effective, inheritable, permitted);
1da177e4
LT
1833 if (error)
1834 return error;
1835
d84f4f99 1836 return cred_has_perm(old, new, PROCESS__SETCAP);
1da177e4
LT
1837}
1838
5626d3e8
JM
1839/*
1840 * (This comment used to live with the selinux_task_setuid hook,
1841 * which was removed).
1842 *
1843 * Since setuid only affects the current process, and since the SELinux
1844 * controls are not based on the Linux identity attributes, SELinux does not
1845 * need to control this operation. However, SELinux does control the use of
1846 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1847 */
1848
3699c53c 1849static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
3486740a 1850 struct user_namespace *ns, int cap, int audit)
1da177e4
LT
1851{
1852 int rc;
1853
3486740a 1854 rc = cap_capable(tsk, cred, ns, cap, audit);
1da177e4
LT
1855 if (rc)
1856 return rc;
1857
3699c53c 1858 return task_has_capability(tsk, cred, cap, audit);
1da177e4
LT
1859}
1860
1da177e4
LT
1861static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1862{
88e67f3b 1863 const struct cred *cred = current_cred();
1da177e4
LT
1864 int rc = 0;
1865
1866 if (!sb)
1867 return 0;
1868
1869 switch (cmds) {
828dfe1d
EP
1870 case Q_SYNC:
1871 case Q_QUOTAON:
1872 case Q_QUOTAOFF:
1873 case Q_SETINFO:
1874 case Q_SETQUOTA:
88e67f3b 1875 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
828dfe1d
EP
1876 break;
1877 case Q_GETFMT:
1878 case Q_GETINFO:
1879 case Q_GETQUOTA:
88e67f3b 1880 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
828dfe1d
EP
1881 break;
1882 default:
1883 rc = 0; /* let the kernel handle invalid cmds */
1884 break;
1da177e4
LT
1885 }
1886 return rc;
1887}
1888
1889static int selinux_quota_on(struct dentry *dentry)
1890{
88e67f3b
DH
1891 const struct cred *cred = current_cred();
1892
1893 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
1da177e4
LT
1894}
1895
12b3052c 1896static int selinux_syslog(int type)
1da177e4
LT
1897{
1898 int rc;
1899
1da177e4 1900 switch (type) {
d78ca3cd
KC
1901 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1902 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
828dfe1d
EP
1903 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1904 break;
d78ca3cd
KC
1905 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1906 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1907 /* Set level of messages printed to console */
1908 case SYSLOG_ACTION_CONSOLE_LEVEL:
828dfe1d
EP
1909 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1910 break;
d78ca3cd
KC
1911 case SYSLOG_ACTION_CLOSE: /* Close log */
1912 case SYSLOG_ACTION_OPEN: /* Open log */
1913 case SYSLOG_ACTION_READ: /* Read from log */
1914 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1915 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
828dfe1d
EP
1916 default:
1917 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1918 break;
1da177e4
LT
1919 }
1920 return rc;
1921}
1922
1923/*
1924 * Check that a process has enough memory to allocate a new virtual
1925 * mapping. 0 means there is enough memory for the allocation to
1926 * succeed and -ENOMEM implies there is not.
1927 *
1da177e4
LT
1928 * Do not audit the selinux permission check, as this is applied to all
1929 * processes that allocate mappings.
1930 */
34b4e4aa 1931static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT
1932{
1933 int rc, cap_sys_admin = 0;
1da177e4 1934
3486740a
SH
1935 rc = selinux_capable(current, current_cred(),
1936 &init_user_ns, CAP_SYS_ADMIN,
3699c53c 1937 SECURITY_CAP_NOAUDIT);
1da177e4
LT
1938 if (rc == 0)
1939 cap_sys_admin = 1;
1940
34b4e4aa 1941 return __vm_enough_memory(mm, pages, cap_sys_admin);
1da177e4
LT
1942}
1943
1944/* binprm security operations */
1945
a6f76f23 1946static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1da177e4 1947{
a6f76f23
DH
1948 const struct task_security_struct *old_tsec;
1949 struct task_security_struct *new_tsec;
1da177e4 1950 struct inode_security_struct *isec;
2bf49690 1951 struct common_audit_data ad;
a6f76f23 1952 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1da177e4
LT
1953 int rc;
1954
200ac532 1955 rc = cap_bprm_set_creds(bprm);
1da177e4
LT
1956 if (rc)
1957 return rc;
1958
a6f76f23
DH
1959 /* SELinux context only depends on initial program or script and not
1960 * the script interpreter */
1961 if (bprm->cred_prepared)
1da177e4
LT
1962 return 0;
1963
a6f76f23
DH
1964 old_tsec = current_security();
1965 new_tsec = bprm->cred->security;
1da177e4
LT
1966 isec = inode->i_security;
1967
1968 /* Default to the current task SID. */
a6f76f23
DH
1969 new_tsec->sid = old_tsec->sid;
1970 new_tsec->osid = old_tsec->sid;
1da177e4 1971
28eba5bf 1972 /* Reset fs, key, and sock SIDs on execve. */
a6f76f23
DH
1973 new_tsec->create_sid = 0;
1974 new_tsec->keycreate_sid = 0;
1975 new_tsec->sockcreate_sid = 0;
1da177e4 1976
a6f76f23
DH
1977 if (old_tsec->exec_sid) {
1978 new_tsec->sid = old_tsec->exec_sid;
1da177e4 1979 /* Reset exec SID on execve. */
a6f76f23 1980 new_tsec->exec_sid = 0;
1da177e4
LT
1981 } else {
1982 /* Check for a default transition on this program. */
a6f76f23 1983 rc = security_transition_sid(old_tsec->sid, isec->sid,
652bb9b0
EP
1984 SECCLASS_PROCESS, NULL,
1985 &new_tsec->sid);
1da177e4
LT
1986 if (rc)
1987 return rc;
1988 }
1989
2bf49690 1990 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1991 ad.u.fs.path = bprm->file->f_path;
1da177e4 1992
3d5ff529 1993 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
a6f76f23 1994 new_tsec->sid = old_tsec->sid;
1da177e4 1995
a6f76f23
DH
1996 if (new_tsec->sid == old_tsec->sid) {
1997 rc = avc_has_perm(old_tsec->sid, isec->sid,
1da177e4
LT
1998 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1999 if (rc)
2000 return rc;
2001 } else {
2002 /* Check permissions for the transition. */
a6f76f23 2003 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
1da177e4
LT
2004 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2005 if (rc)
2006 return rc;
2007
a6f76f23 2008 rc = avc_has_perm(new_tsec->sid, isec->sid,
1da177e4
LT
2009 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2010 if (rc)
2011 return rc;
2012
a6f76f23
DH
2013 /* Check for shared state */
2014 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2015 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2016 SECCLASS_PROCESS, PROCESS__SHARE,
2017 NULL);
2018 if (rc)
2019 return -EPERM;
2020 }
2021
2022 /* Make sure that anyone attempting to ptrace over a task that
2023 * changes its SID has the appropriate permit */
2024 if (bprm->unsafe &
2025 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2026 struct task_struct *tracer;
2027 struct task_security_struct *sec;
2028 u32 ptsid = 0;
2029
2030 rcu_read_lock();
2031 tracer = tracehook_tracer_task(current);
2032 if (likely(tracer != NULL)) {
2033 sec = __task_cred(tracer)->security;
2034 ptsid = sec->sid;
2035 }
2036 rcu_read_unlock();
2037
2038 if (ptsid != 0) {
2039 rc = avc_has_perm(ptsid, new_tsec->sid,
2040 SECCLASS_PROCESS,
2041 PROCESS__PTRACE, NULL);
2042 if (rc)
2043 return -EPERM;
2044 }
2045 }
1da177e4 2046
a6f76f23
DH
2047 /* Clear any possibly unsafe personality bits on exec: */
2048 bprm->per_clear |= PER_CLEAR_ON_SETID;
1da177e4
LT
2049 }
2050
1da177e4
LT
2051 return 0;
2052}
2053
828dfe1d 2054static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4 2055{
5fb49870 2056 const struct task_security_struct *tsec = current_security();
275bb41e 2057 u32 sid, osid;
1da177e4
LT
2058 int atsecure = 0;
2059
275bb41e
DH
2060 sid = tsec->sid;
2061 osid = tsec->osid;
2062
2063 if (osid != sid) {
1da177e4
LT
2064 /* Enable secure mode for SIDs transitions unless
2065 the noatsecure permission is granted between
2066 the two SIDs, i.e. ahp returns 0. */
275bb41e 2067 atsecure = avc_has_perm(osid, sid,
a6f76f23
DH
2068 SECCLASS_PROCESS,
2069 PROCESS__NOATSECURE, NULL);
1da177e4
LT
2070 }
2071
200ac532 2072 return (atsecure || cap_bprm_secureexec(bprm));
1da177e4
LT
2073}
2074
1da177e4
LT
2075extern struct vfsmount *selinuxfs_mount;
2076extern struct dentry *selinux_null;
2077
2078/* Derived from fs/exec.c:flush_old_files. */
745ca247
DH
2079static inline void flush_unauthorized_files(const struct cred *cred,
2080 struct files_struct *files)
1da177e4 2081{
2bf49690 2082 struct common_audit_data ad;
1da177e4 2083 struct file *file, *devnull = NULL;
b20c8122 2084 struct tty_struct *tty;
badf1662 2085 struct fdtable *fdt;
1da177e4 2086 long j = -1;
24ec839c 2087 int drop_tty = 0;
1da177e4 2088
24ec839c 2089 tty = get_current_tty();
1da177e4 2090 if (tty) {
ee2ffa0d 2091 spin_lock(&tty_files_lock);
37dd0bd0 2092 if (!list_empty(&tty->tty_files)) {
d996b62a 2093 struct tty_file_private *file_priv;
37dd0bd0
EP
2094 struct inode *inode;
2095
1da177e4
LT
2096 /* Revalidate access to controlling tty.
2097 Use inode_has_perm on the tty inode directly rather
2098 than using file_has_perm, as this particular open
2099 file may belong to another process and we are only
2100 interested in the inode-based check here. */
d996b62a
NP
2101 file_priv = list_first_entry(&tty->tty_files,
2102 struct tty_file_private, list);
2103 file = file_priv->file;
37dd0bd0 2104 inode = file->f_path.dentry->d_inode;
88e67f3b 2105 if (inode_has_perm(cred, inode,
1da177e4 2106 FILE__READ | FILE__WRITE, NULL)) {
24ec839c 2107 drop_tty = 1;
1da177e4
LT
2108 }
2109 }
ee2ffa0d 2110 spin_unlock(&tty_files_lock);
452a00d2 2111 tty_kref_put(tty);
1da177e4 2112 }
98a27ba4
EB
2113 /* Reset controlling tty. */
2114 if (drop_tty)
2115 no_tty();
1da177e4
LT
2116
2117 /* Revalidate access to inherited open files. */
2118
2bf49690 2119 COMMON_AUDIT_DATA_INIT(&ad, FS);
1da177e4
LT
2120
2121 spin_lock(&files->file_lock);
2122 for (;;) {
2123 unsigned long set, i;
2124 int fd;
2125
2126 j++;
2127 i = j * __NFDBITS;
badf1662 2128 fdt = files_fdtable(files);
bbea9f69 2129 if (i >= fdt->max_fds)
1da177e4 2130 break;
badf1662 2131 set = fdt->open_fds->fds_bits[j];
1da177e4
LT
2132 if (!set)
2133 continue;
2134 spin_unlock(&files->file_lock);
828dfe1d 2135 for ( ; set ; i++, set >>= 1) {
1da177e4
LT
2136 if (set & 1) {
2137 file = fget(i);
2138 if (!file)
2139 continue;
88e67f3b 2140 if (file_has_perm(cred,
1da177e4
LT
2141 file,
2142 file_to_av(file))) {
2143 sys_close(i);
2144 fd = get_unused_fd();
2145 if (fd != i) {
2146 if (fd >= 0)
2147 put_unused_fd(fd);
2148 fput(file);
2149 continue;
2150 }
2151 if (devnull) {
095975da 2152 get_file(devnull);
1da177e4 2153 } else {
745ca247
DH
2154 devnull = dentry_open(
2155 dget(selinux_null),
2156 mntget(selinuxfs_mount),
2157 O_RDWR, cred);
fc5d81e6
AM
2158 if (IS_ERR(devnull)) {
2159 devnull = NULL;
1da177e4
LT
2160 put_unused_fd(fd);
2161 fput(file);
2162 continue;
2163 }
2164 }
2165 fd_install(fd, devnull);
2166 }
2167 fput(file);
2168 }
2169 }
2170 spin_lock(&files->file_lock);
2171
2172 }
2173 spin_unlock(&files->file_lock);
2174}
2175
a6f76f23
DH
2176/*
2177 * Prepare a process for imminent new credential changes due to exec
2178 */
2179static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
1da177e4 2180{
a6f76f23
DH
2181 struct task_security_struct *new_tsec;
2182 struct rlimit *rlim, *initrlim;
2183 int rc, i;
d84f4f99 2184
a6f76f23
DH
2185 new_tsec = bprm->cred->security;
2186 if (new_tsec->sid == new_tsec->osid)
2187 return;
1da177e4 2188
a6f76f23
DH
2189 /* Close files for which the new task SID is not authorized. */
2190 flush_unauthorized_files(bprm->cred, current->files);
0356357c 2191
a6f76f23
DH
2192 /* Always clear parent death signal on SID transitions. */
2193 current->pdeath_signal = 0;
0356357c 2194
a6f76f23
DH
2195 /* Check whether the new SID can inherit resource limits from the old
2196 * SID. If not, reset all soft limits to the lower of the current
2197 * task's hard limit and the init task's soft limit.
2198 *
2199 * Note that the setting of hard limits (even to lower them) can be
2200 * controlled by the setrlimit check. The inclusion of the init task's
2201 * soft limit into the computation is to avoid resetting soft limits
2202 * higher than the default soft limit for cases where the default is
2203 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2204 */
2205 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2206 PROCESS__RLIMITINH, NULL);
2207 if (rc) {
eb2d55a3
ON
2208 /* protect against do_prlimit() */
2209 task_lock(current);
a6f76f23
DH
2210 for (i = 0; i < RLIM_NLIMITS; i++) {
2211 rlim = current->signal->rlim + i;
2212 initrlim = init_task.signal->rlim + i;
2213 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4 2214 }
eb2d55a3
ON
2215 task_unlock(current);
2216 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
1da177e4
LT
2217 }
2218}
2219
2220/*
a6f76f23
DH
2221 * Clean up the process immediately after the installation of new credentials
2222 * due to exec
1da177e4 2223 */
a6f76f23 2224static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
1da177e4 2225{
a6f76f23 2226 const struct task_security_struct *tsec = current_security();
1da177e4 2227 struct itimerval itimer;
a6f76f23 2228 u32 osid, sid;
1da177e4
LT
2229 int rc, i;
2230
a6f76f23
DH
2231 osid = tsec->osid;
2232 sid = tsec->sid;
2233
2234 if (sid == osid)
1da177e4
LT
2235 return;
2236
a6f76f23
DH
2237 /* Check whether the new SID can inherit signal state from the old SID.
2238 * If not, clear itimers to avoid subsequent signal generation and
2239 * flush and unblock signals.
2240 *
2241 * This must occur _after_ the task SID has been updated so that any
2242 * kill done after the flush will be checked against the new SID.
2243 */
2244 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
1da177e4
LT
2245 if (rc) {
2246 memset(&itimer, 0, sizeof itimer);
2247 for (i = 0; i < 3; i++)
2248 do_setitimer(i, &itimer, NULL);
1da177e4 2249 spin_lock_irq(&current->sighand->siglock);
3bcac026
DH
2250 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2251 __flush_signals(current);
2252 flush_signal_handlers(current, 1);
2253 sigemptyset(&current->blocked);
2254 }
1da177e4
LT
2255 spin_unlock_irq(&current->sighand->siglock);
2256 }
2257
a6f76f23
DH
2258 /* Wake up the parent if it is waiting so that it can recheck
2259 * wait permission to the new task SID. */
ecd6de3c 2260 read_lock(&tasklist_lock);
0b7570e7 2261 __wake_up_parent(current, current->real_parent);
ecd6de3c 2262 read_unlock(&tasklist_lock);
1da177e4
LT
2263}
2264
2265/* superblock security operations */
2266
2267static int selinux_sb_alloc_security(struct super_block *sb)
2268{
2269 return superblock_alloc_security(sb);
2270}
2271
2272static void selinux_sb_free_security(struct super_block *sb)
2273{
2274 superblock_free_security(sb);
2275}
2276
2277static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2278{
2279 if (plen > olen)
2280 return 0;
2281
2282 return !memcmp(prefix, option, plen);
2283}
2284
2285static inline int selinux_option(char *option, int len)
2286{
832cbd9a
EP
2287 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2288 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2289 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
11689d47
DQ
2290 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2291 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
1da177e4
LT
2292}
2293
2294static inline void take_option(char **to, char *from, int *first, int len)
2295{
2296 if (!*first) {
2297 **to = ',';
2298 *to += 1;
3528a953 2299 } else
1da177e4
LT
2300 *first = 0;
2301 memcpy(*to, from, len);
2302 *to += len;
2303}
2304
828dfe1d
EP
2305static inline void take_selinux_option(char **to, char *from, int *first,
2306 int len)
3528a953
CO
2307{
2308 int current_size = 0;
2309
2310 if (!*first) {
2311 **to = '|';
2312 *to += 1;
828dfe1d 2313 } else
3528a953
CO
2314 *first = 0;
2315
2316 while (current_size < len) {
2317 if (*from != '"') {
2318 **to = *from;
2319 *to += 1;
2320 }
2321 from += 1;
2322 current_size += 1;
2323 }
2324}
2325
e0007529 2326static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT
2327{
2328 int fnosec, fsec, rc = 0;
2329 char *in_save, *in_curr, *in_end;
2330 char *sec_curr, *nosec_save, *nosec;
3528a953 2331 int open_quote = 0;
1da177e4
LT
2332
2333 in_curr = orig;
2334 sec_curr = copy;
2335
1da177e4
LT
2336 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2337 if (!nosec) {
2338 rc = -ENOMEM;
2339 goto out;
2340 }
2341
2342 nosec_save = nosec;
2343 fnosec = fsec = 1;
2344 in_save = in_end = orig;
2345
2346 do {
3528a953
CO
2347 if (*in_end == '"')
2348 open_quote = !open_quote;
2349 if ((*in_end == ',' && open_quote == 0) ||
2350 *in_end == '\0') {
1da177e4
LT
2351 int len = in_end - in_curr;
2352
2353 if (selinux_option(in_curr, len))
3528a953 2354 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT
2355 else
2356 take_option(&nosec, in_curr, &fnosec, len);
2357
2358 in_curr = in_end + 1;
2359 }
2360 } while (*in_end++);
2361
6931dfc9 2362 strcpy(in_save, nosec_save);
da3caa20 2363 free_page((unsigned long)nosec_save);
1da177e4
LT
2364out:
2365 return rc;
2366}
2367
026eb167
EP
2368static int selinux_sb_remount(struct super_block *sb, void *data)
2369{
2370 int rc, i, *flags;
2371 struct security_mnt_opts opts;
2372 char *secdata, **mount_options;
2373 struct superblock_security_struct *sbsec = sb->s_security;
2374
2375 if (!(sbsec->flags & SE_SBINITIALIZED))
2376 return 0;
2377
2378 if (!data)
2379 return 0;
2380
2381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2382 return 0;
2383
2384 security_init_mnt_opts(&opts);
2385 secdata = alloc_secdata();
2386 if (!secdata)
2387 return -ENOMEM;
2388 rc = selinux_sb_copy_data(data, secdata);
2389 if (rc)
2390 goto out_free_secdata;
2391
2392 rc = selinux_parse_opts_str(secdata, &opts);
2393 if (rc)
2394 goto out_free_secdata;
2395
2396 mount_options = opts.mnt_opts;
2397 flags = opts.mnt_opts_flags;
2398
2399 for (i = 0; i < opts.num_mnt_opts; i++) {
2400 u32 sid;
2401 size_t len;
2402
2403 if (flags[i] == SE_SBLABELSUPP)
2404 continue;
2405 len = strlen(mount_options[i]);
2406 rc = security_context_to_sid(mount_options[i], len, &sid);
2407 if (rc) {
2408 printk(KERN_WARNING "SELinux: security_context_to_sid"
2409 "(%s) failed for (dev %s, type %s) errno=%d\n",
2410 mount_options[i], sb->s_id, sb->s_type->name, rc);
2411 goto out_free_opts;
2412 }
2413 rc = -EINVAL;
2414 switch (flags[i]) {
2415 case FSCONTEXT_MNT:
2416 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2417 goto out_bad_option;
2418 break;
2419 case CONTEXT_MNT:
2420 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2421 goto out_bad_option;
2422 break;
2423 case ROOTCONTEXT_MNT: {
2424 struct inode_security_struct *root_isec;
2425 root_isec = sb->s_root->d_inode->i_security;
2426
2427 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2428 goto out_bad_option;
2429 break;
2430 }
2431 case DEFCONTEXT_MNT:
2432 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2433 goto out_bad_option;
2434 break;
2435 default:
2436 goto out_free_opts;
2437 }
2438 }
2439
2440 rc = 0;
2441out_free_opts:
2442 security_free_mnt_opts(&opts);
2443out_free_secdata:
2444 free_secdata(secdata);
2445 return rc;
2446out_bad_option:
2447 printk(KERN_WARNING "SELinux: unable to change security options "
2448 "during remount (dev %s, type=%s)\n", sb->s_id,
2449 sb->s_type->name);
2450 goto out_free_opts;
2451}
2452
12204e24 2453static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
1da177e4 2454{
88e67f3b 2455 const struct cred *cred = current_cred();
2bf49690 2456 struct common_audit_data ad;
1da177e4
LT
2457 int rc;
2458
2459 rc = superblock_doinit(sb, data);
2460 if (rc)
2461 return rc;
2462
74192246
JM
2463 /* Allow all mounts performed by the kernel */
2464 if (flags & MS_KERNMOUNT)
2465 return 0;
2466
2bf49690 2467 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2468 ad.u.fs.path.dentry = sb->s_root;
88e67f3b 2469 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
1da177e4
LT
2470}
2471
726c3342 2472static int selinux_sb_statfs(struct dentry *dentry)
1da177e4 2473{
88e67f3b 2474 const struct cred *cred = current_cred();
2bf49690 2475 struct common_audit_data ad;
1da177e4 2476
2bf49690 2477 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2478 ad.u.fs.path.dentry = dentry->d_sb->s_root;
88e67f3b 2479 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT
2480}
2481
828dfe1d 2482static int selinux_mount(char *dev_name,
b5266eb4 2483 struct path *path,
828dfe1d
EP
2484 char *type,
2485 unsigned long flags,
2486 void *data)
1da177e4 2487{
88e67f3b 2488 const struct cred *cred = current_cred();
1da177e4
LT
2489
2490 if (flags & MS_REMOUNT)
88e67f3b 2491 return superblock_has_perm(cred, path->mnt->mnt_sb,
828dfe1d 2492 FILESYSTEM__REMOUNT, NULL);
1da177e4 2493 else
88e67f3b 2494 return dentry_has_perm(cred, path->mnt, path->dentry,
828dfe1d 2495 FILE__MOUNTON);
1da177e4
LT
2496}
2497
2498static int selinux_umount(struct vfsmount *mnt, int flags)
2499{
88e67f3b 2500 const struct cred *cred = current_cred();
1da177e4 2501
88e67f3b 2502 return superblock_has_perm(cred, mnt->mnt_sb,
828dfe1d 2503 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT
2504}
2505
2506/* inode security operations */
2507
2508static int selinux_inode_alloc_security(struct inode *inode)
2509{
2510 return inode_alloc_security(inode);
2511}
2512
2513static void selinux_inode_free_security(struct inode *inode)
2514{
2515 inode_free_security(inode);
2516}
2517
5e41ff9e 2518static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2a7dba39
EP
2519 const struct qstr *qstr, char **name,
2520 void **value, size_t *len)
5e41ff9e 2521{
5fb49870 2522 const struct task_security_struct *tsec = current_security();
5e41ff9e
SS
2523 struct inode_security_struct *dsec;
2524 struct superblock_security_struct *sbsec;
275bb41e 2525 u32 sid, newsid, clen;
5e41ff9e 2526 int rc;
570bc1c2 2527 char *namep = NULL, *context;
5e41ff9e 2528
5e41ff9e
SS
2529 dsec = dir->i_security;
2530 sbsec = dir->i_sb->s_security;
5e41ff9e 2531
275bb41e
DH
2532 sid = tsec->sid;
2533 newsid = tsec->create_sid;
2534
415103f9
EP
2535 if ((sbsec->flags & SE_SBINITIALIZED) &&
2536 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2537 newsid = sbsec->mntpoint_sid;
2538 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
275bb41e 2539 rc = security_transition_sid(sid, dsec->sid,
5e41ff9e 2540 inode_mode_to_security_class(inode->i_mode),
652bb9b0 2541 qstr, &newsid);
5e41ff9e
SS
2542 if (rc) {
2543 printk(KERN_WARNING "%s: "
2544 "security_transition_sid failed, rc=%d (dev=%s "
2545 "ino=%ld)\n",
dd6f953a 2546 __func__,
5e41ff9e
SS
2547 -rc, inode->i_sb->s_id, inode->i_ino);
2548 return rc;
2549 }
2550 }
2551
296fddf7 2552 /* Possibly defer initialization to selinux_complete_init. */
0d90a7ec 2553 if (sbsec->flags & SE_SBINITIALIZED) {
296fddf7
EP
2554 struct inode_security_struct *isec = inode->i_security;
2555 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2556 isec->sid = newsid;
2557 isec->initialized = 1;
2558 }
5e41ff9e 2559
cd89596f 2560 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
25a74f3b
SS
2561 return -EOPNOTSUPP;
2562
570bc1c2 2563 if (name) {
a02fe132 2564 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
570bc1c2
SS
2565 if (!namep)
2566 return -ENOMEM;
2567 *name = namep;
2568 }
5e41ff9e 2569
570bc1c2 2570 if (value && len) {
12b29f34 2571 rc = security_sid_to_context_force(newsid, &context, &clen);
570bc1c2
SS
2572 if (rc) {
2573 kfree(namep);
2574 return rc;
2575 }
2576 *value = context;
2577 *len = clen;
5e41ff9e 2578 }
5e41ff9e 2579
5e41ff9e
SS
2580 return 0;
2581}
2582
1da177e4
LT
2583static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2584{
2585 return may_create(dir, dentry, SECCLASS_FILE);
2586}
2587
1da177e4
LT
2588static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2589{
1da177e4
LT
2590 return may_link(dir, old_dentry, MAY_LINK);
2591}
2592
1da177e4
LT
2593static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2594{
1da177e4
LT
2595 return may_link(dir, dentry, MAY_UNLINK);
2596}
2597
2598static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2599{
2600 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2601}
2602
1da177e4
LT
2603static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2604{
2605 return may_create(dir, dentry, SECCLASS_DIR);
2606}
2607
1da177e4
LT
2608static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2609{
2610 return may_link(dir, dentry, MAY_RMDIR);
2611}
2612
2613static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2614{
1da177e4
LT
2615 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2616}
2617
1da177e4 2618static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2619 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT
2620{
2621 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2622}
2623
1da177e4
LT
2624static int selinux_inode_readlink(struct dentry *dentry)
2625{
88e67f3b
DH
2626 const struct cred *cred = current_cred();
2627
2628 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
1da177e4
LT
2629}
2630
2631static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2632{
88e67f3b 2633 const struct cred *cred = current_cred();
1da177e4 2634
88e67f3b 2635 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
1da177e4
LT
2636}
2637
8c9e80ed 2638static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
1da177e4 2639{
88e67f3b 2640 const struct cred *cred = current_cred();
b782e0a6
EP
2641 struct common_audit_data ad;
2642 u32 perms;
2643 bool from_access;
1da177e4 2644
b782e0a6 2645 from_access = mask & MAY_ACCESS;
d09ca739
EP
2646 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2647
b782e0a6
EP
2648 /* No permission to check. Existence test. */
2649 if (!mask)
1da177e4 2650 return 0;
1da177e4 2651
8c9e80ed
AK
2652 /* May be droppable after audit */
2653 if (flags & IPERM_FLAG_RCU)
2654 return -ECHILD;
2655
b782e0a6
EP
2656 COMMON_AUDIT_DATA_INIT(&ad, FS);
2657 ad.u.fs.inode = inode;
2658
2659 if (from_access)
2660 ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
2661
2662 perms = file_mask_to_av(inode->i_mode, mask);
2663
2664 return inode_has_perm(cred, inode, perms, &ad);
1da177e4
LT
2665}
2666
2667static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2668{
88e67f3b 2669 const struct cred *cred = current_cred();
bc6a6008 2670 unsigned int ia_valid = iattr->ia_valid;
1da177e4 2671
bc6a6008
AW
2672 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2673 if (ia_valid & ATTR_FORCE) {
2674 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2675 ATTR_FORCE);
2676 if (!ia_valid)
2677 return 0;
2678 }
1da177e4 2679
bc6a6008
AW
2680 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2681 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
88e67f3b 2682 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
1da177e4 2683
88e67f3b 2684 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
1da177e4
LT
2685}
2686
2687static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2688{
88e67f3b
DH
2689 const struct cred *cred = current_cred();
2690
2691 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
1da177e4
LT
2692}
2693
8f0cfa52 2694static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771 2695{
88e67f3b
DH
2696 const struct cred *cred = current_cred();
2697
b5376771
SH
2698 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2699 sizeof XATTR_SECURITY_PREFIX - 1)) {
2700 if (!strcmp(name, XATTR_NAME_CAPS)) {
2701 if (!capable(CAP_SETFCAP))
2702 return -EPERM;
2703 } else if (!capable(CAP_SYS_ADMIN)) {
2704 /* A different attribute in the security namespace.
2705 Restrict to administrator. */
2706 return -EPERM;
2707 }
2708 }
2709
2710 /* Not an attribute we recognize, so just check the
2711 ordinary setattr permission. */
88e67f3b 2712 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
b5376771
SH
2713}
2714
8f0cfa52
DH
2715static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2716 const void *value, size_t size, int flags)
1da177e4 2717{
1da177e4
LT
2718 struct inode *inode = dentry->d_inode;
2719 struct inode_security_struct *isec = inode->i_security;
2720 struct superblock_security_struct *sbsec;
2bf49690 2721 struct common_audit_data ad;
275bb41e 2722 u32 newsid, sid = current_sid();
1da177e4
LT
2723 int rc = 0;
2724
b5376771
SH
2725 if (strcmp(name, XATTR_NAME_SELINUX))
2726 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2727
2728 sbsec = inode->i_sb->s_security;
cd89596f 2729 if (!(sbsec->flags & SE_SBLABELSUPP))
1da177e4
LT
2730 return -EOPNOTSUPP;
2731
2e149670 2732 if (!inode_owner_or_capable(inode))
1da177e4
LT
2733 return -EPERM;
2734
2bf49690 2735 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2736 ad.u.fs.path.dentry = dentry;
1da177e4 2737
275bb41e 2738 rc = avc_has_perm(sid, isec->sid, isec->sclass,
1da177e4
LT
2739 FILE__RELABELFROM, &ad);
2740 if (rc)
2741 return rc;
2742
2743 rc = security_context_to_sid(value, size, &newsid);
12b29f34
SS
2744 if (rc == -EINVAL) {
2745 if (!capable(CAP_MAC_ADMIN))
2746 return rc;
2747 rc = security_context_to_sid_force(value, size, &newsid);
2748 }
1da177e4
LT
2749 if (rc)
2750 return rc;
2751
275bb41e 2752 rc = avc_has_perm(sid, newsid, isec->sclass,
1da177e4
LT
2753 FILE__RELABELTO, &ad);
2754 if (rc)
2755 return rc;
2756
275bb41e 2757 rc = security_validate_transition(isec->sid, newsid, sid,
828dfe1d 2758 isec->sclass);
1da177e4
LT
2759 if (rc)
2760 return rc;
2761
2762 return avc_has_perm(newsid,
2763 sbsec->sid,
2764 SECCLASS_FILESYSTEM,
2765 FILESYSTEM__ASSOCIATE,
2766 &ad);
2767}
2768
8f0cfa52 2769static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
f5269710 2770 const void *value, size_t size,
8f0cfa52 2771 int flags)
1da177e4
LT
2772{
2773 struct inode *inode = dentry->d_inode;
2774 struct inode_security_struct *isec = inode->i_security;
2775 u32 newsid;
2776 int rc;
2777
2778 if (strcmp(name, XATTR_NAME_SELINUX)) {
2779 /* Not an attribute we recognize, so nothing to do. */
2780 return;
2781 }
2782
12b29f34 2783 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 2784 if (rc) {
12b29f34
SS
2785 printk(KERN_ERR "SELinux: unable to map context to SID"
2786 "for (%s, %lu), rc=%d\n",
2787 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT
2788 return;
2789 }
2790
2791 isec->sid = newsid;
2792 return;
2793}
2794
8f0cfa52 2795static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 2796{
88e67f3b
DH
2797 const struct cred *cred = current_cred();
2798
2799 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
1da177e4
LT
2800}
2801
828dfe1d 2802static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4 2803{
88e67f3b
DH
2804 const struct cred *cred = current_cred();
2805
2806 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
1da177e4
LT
2807}
2808
8f0cfa52 2809static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 2810{
b5376771
SH
2811 if (strcmp(name, XATTR_NAME_SELINUX))
2812 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2813
2814 /* No one is allowed to remove a SELinux security label.
2815 You can change the label, but all data must be labeled. */
2816 return -EACCES;
2817}
2818
d381d8a9 2819/*
abc69bb6 2820 * Copy the inode security context value to the user.
d381d8a9
JM
2821 *
2822 * Permission check is handled by selinux_inode_getxattr hook.
2823 */
42492594 2824static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 2825{
42492594
DQ
2826 u32 size;
2827 int error;
2828 char *context = NULL;
1da177e4 2829 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2830
8c8570fb
DK
2831 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2832 return -EOPNOTSUPP;
d381d8a9 2833
abc69bb6
SS
2834 /*
2835 * If the caller has CAP_MAC_ADMIN, then get the raw context
2836 * value even if it is not defined by current policy; otherwise,
2837 * use the in-core value under current policy.
2838 * Use the non-auditing forms of the permission checks since
2839 * getxattr may be called by unprivileged processes commonly
2840 * and lack of permission just means that we fall back to the
2841 * in-core context value, not a denial.
2842 */
3486740a
SH
2843 error = selinux_capable(current, current_cred(),
2844 &init_user_ns, CAP_MAC_ADMIN,
3699c53c 2845 SECURITY_CAP_NOAUDIT);
abc69bb6
SS
2846 if (!error)
2847 error = security_sid_to_context_force(isec->sid, &context,
2848 &size);
2849 else
2850 error = security_sid_to_context(isec->sid, &context, &size);
42492594
DQ
2851 if (error)
2852 return error;
2853 error = size;
2854 if (alloc) {
2855 *buffer = context;
2856 goto out_nofree;
2857 }
2858 kfree(context);
2859out_nofree:
2860 return error;
1da177e4
LT
2861}
2862
2863static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 2864 const void *value, size_t size, int flags)
1da177e4
LT
2865{
2866 struct inode_security_struct *isec = inode->i_security;
2867 u32 newsid;
2868 int rc;
2869
2870 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2871 return -EOPNOTSUPP;
2872
2873 if (!value || !size)
2874 return -EACCES;
2875
828dfe1d 2876 rc = security_context_to_sid((void *)value, size, &newsid);
1da177e4
LT
2877 if (rc)
2878 return rc;
2879
2880 isec->sid = newsid;
ddd29ec6 2881 isec->initialized = 1;
1da177e4
LT
2882 return 0;
2883}
2884
2885static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2886{
2887 const int len = sizeof(XATTR_NAME_SELINUX);
2888 if (buffer && len <= buffer_size)
2889 memcpy(buffer, XATTR_NAME_SELINUX, len);
2890 return len;
2891}
2892
713a04ae
AD
2893static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2894{
2895 struct inode_security_struct *isec = inode->i_security;
2896 *secid = isec->sid;
2897}
2898
1da177e4
LT
2899/* file security operations */
2900
788e7dd4 2901static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 2902{
88e67f3b 2903 const struct cred *cred = current_cred();
3d5ff529 2904 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4 2905
1da177e4
LT
2906 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2907 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2908 mask |= MAY_APPEND;
2909
389fb800
PM
2910 return file_has_perm(cred, file,
2911 file_mask_to_av(inode->i_mode, mask));
1da177e4
LT
2912}
2913
788e7dd4
YN
2914static int selinux_file_permission(struct file *file, int mask)
2915{
20dda18b
SS
2916 struct inode *inode = file->f_path.dentry->d_inode;
2917 struct file_security_struct *fsec = file->f_security;
2918 struct inode_security_struct *isec = inode->i_security;
2919 u32 sid = current_sid();
2920
389fb800 2921 if (!mask)
788e7dd4
YN
2922 /* No permission to check. Existence test. */
2923 return 0;
788e7dd4 2924
20dda18b
SS
2925 if (sid == fsec->sid && fsec->isid == isec->sid &&
2926 fsec->pseqno == avc_policy_seqno())
2927 /* No change since dentry_open check. */
2928 return 0;
2929
788e7dd4
YN
2930 return selinux_revalidate_file_permission(file, mask);
2931}
2932
1da177e4
LT
2933static int selinux_file_alloc_security(struct file *file)
2934{
2935 return file_alloc_security(file);
2936}
2937
2938static void selinux_file_free_security(struct file *file)
2939{
2940 file_free_security(file);
2941}
2942
2943static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2944 unsigned long arg)
2945{
88e67f3b 2946 const struct cred *cred = current_cred();
0b24dcb7 2947 int error = 0;
1da177e4 2948
0b24dcb7
EP
2949 switch (cmd) {
2950 case FIONREAD:
2951 /* fall through */
2952 case FIBMAP:
2953 /* fall through */
2954 case FIGETBSZ:
2955 /* fall through */
2956 case EXT2_IOC_GETFLAGS:
2957 /* fall through */
2958 case EXT2_IOC_GETVERSION:
2959 error = file_has_perm(cred, file, FILE__GETATTR);
2960 break;
1da177e4 2961
0b24dcb7
EP
2962 case EXT2_IOC_SETFLAGS:
2963 /* fall through */
2964 case EXT2_IOC_SETVERSION:
2965 error = file_has_perm(cred, file, FILE__SETATTR);
2966 break;
2967
2968 /* sys_ioctl() checks */
2969 case FIONBIO:
2970 /* fall through */
2971 case FIOASYNC:
2972 error = file_has_perm(cred, file, 0);
2973 break;
1da177e4 2974
0b24dcb7
EP
2975 case KDSKBENT:
2976 case KDSKBSENT:
2977 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
3486740a 2978 SECURITY_CAP_AUDIT);
0b24dcb7
EP
2979 break;
2980
2981 /* default case assumes that the command will go
2982 * to the file's ioctl() function.
2983 */
2984 default:
2985 error = file_has_perm(cred, file, FILE__IOCTL);
2986 }
2987 return error;
1da177e4
LT
2988}
2989
fcaaade1
SS
2990static int default_noexec;
2991
1da177e4
LT
2992static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2993{
88e67f3b 2994 const struct cred *cred = current_cred();
d84f4f99 2995 int rc = 0;
88e67f3b 2996
fcaaade1
SS
2997 if (default_noexec &&
2998 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
1da177e4
LT
2999 /*
3000 * We are making executable an anonymous mapping or a
3001 * private file mapping that will also be writable.
3002 * This has an additional check.
3003 */
d84f4f99 3004 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
1da177e4 3005 if (rc)
d84f4f99 3006 goto error;
1da177e4 3007 }
1da177e4
LT
3008
3009 if (file) {
3010 /* read access is always possible with a mapping */
3011 u32 av = FILE__READ;
3012
3013 /* write access only matters if the mapping is shared */
3014 if (shared && (prot & PROT_WRITE))
3015 av |= FILE__WRITE;
3016
3017 if (prot & PROT_EXEC)
3018 av |= FILE__EXECUTE;
3019
88e67f3b 3020 return file_has_perm(cred, file, av);
1da177e4 3021 }
d84f4f99
DH
3022
3023error:
3024 return rc;
1da177e4
LT
3025}
3026
3027static int selinux_file_mmap(struct file *file, unsigned long reqprot,
ed032189
EP
3028 unsigned long prot, unsigned long flags,
3029 unsigned long addr, unsigned long addr_only)
1da177e4 3030{
ed032189 3031 int rc = 0;
275bb41e 3032 u32 sid = current_sid();
1da177e4 3033
84336d1a
EP
3034 /*
3035 * notice that we are intentionally putting the SELinux check before
3036 * the secondary cap_file_mmap check. This is such a likely attempt
3037 * at bad behaviour/exploit that we always want to get the AVC, even
3038 * if DAC would have also denied the operation.
3039 */
a2551df7 3040 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
ed032189
EP
3041 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3042 MEMPROTECT__MMAP_ZERO, NULL);
84336d1a
EP
3043 if (rc)
3044 return rc;
3045 }
3046
3047 /* do DAC check on address space usage */
3048 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
ed032189 3049 if (rc || addr_only)
1da177e4
LT
3050 return rc;
3051
3052 if (selinux_checkreqprot)
3053 prot = reqprot;
3054
3055 return file_map_prot_check(file, prot,
3056 (flags & MAP_TYPE) == MAP_SHARED);
3057}
3058
3059static int selinux_file_mprotect(struct vm_area_struct *vma,
3060 unsigned long reqprot,
3061 unsigned long prot)
3062{
88e67f3b 3063 const struct cred *cred = current_cred();
1da177e4
LT
3064
3065 if (selinux_checkreqprot)
3066 prot = reqprot;
3067
fcaaade1
SS
3068 if (default_noexec &&
3069 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
d541bbee 3070 int rc = 0;
db4c9641
SS
3071 if (vma->vm_start >= vma->vm_mm->start_brk &&
3072 vma->vm_end <= vma->vm_mm->brk) {
d84f4f99 3073 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
db4c9641
SS
3074 } else if (!vma->vm_file &&
3075 vma->vm_start <= vma->vm_mm->start_stack &&
3076 vma->vm_end >= vma->vm_mm->start_stack) {
3b11a1de 3077 rc = current_has_perm(current, PROCESS__EXECSTACK);
db4c9641
SS
3078 } else if (vma->vm_file && vma->anon_vma) {
3079 /*
3080 * We are making executable a file mapping that has
3081 * had some COW done. Since pages might have been
3082 * written, check ability to execute the possibly
3083 * modified content. This typically should only
3084 * occur for text relocations.
3085 */
d84f4f99 3086 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
db4c9641 3087 }