]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - security/selinux/hooks.c
selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT
1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
2069f457
EP
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
1da177e4 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 15 * <dgoeddel@trustedcs.com>
ed6d76e4 16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
82c21bfa 17 * Paul Moore <paul@paul-moore.com>
788e7dd4 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
828dfe1d 23 * as published by the Free Software Foundation.
1da177e4
LT
24 */
25
1da177e4 26#include <linux/init.h>
0b24dcb7 27#include <linux/kd.h>
1da177e4 28#include <linux/kernel.h>
0d094efe 29#include <linux/tracehook.h>
1da177e4
LT
30#include <linux/errno.h>
31#include <linux/sched.h>
3c4ed7bd 32#include <linux/lsm_hooks.h>
1da177e4
LT
33#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
0b24dcb7 40#include <linux/proc_fs.h>
1da177e4 41#include <linux/swap.h>
1da177e4
LT
42#include <linux/spinlock.h>
43#include <linux/syscalls.h>
2a7dba39 44#include <linux/dcache.h>
1da177e4 45#include <linux/file.h>
9f3acc31 46#include <linux/fdtable.h>
1da177e4
LT
47#include <linux/namei.h>
48#include <linux/mount.h>
1da177e4
LT
49#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
227b60f5 53#include <net/ip.h> /* for local_port_range[] */
1da177e4 54#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
47180068 55#include <net/inet_connection_sock.h>
220deb96 56#include <net/net_namespace.h>
d621d35e 57#include <net/netlabel.h>
f5269710 58#include <linux/uaccess.h>
1da177e4 59#include <asm/ioctls.h>
60063497 60#include <linux/atomic.h>
1da177e4
LT
61#include <linux/bitops.h>
62#include <linux/interrupt.h>
63#include <linux/netdevice.h> /* for network interface checks */
77954983 64#include <net/netlink.h>
1da177e4
LT
65#include <linux/tcp.h>
66#include <linux/udp.h>
2ee92d46 67#include <linux/dccp.h>
1da177e4
LT
68#include <linux/quota.h>
69#include <linux/un.h> /* for Unix socket types */
70#include <net/af_unix.h> /* for Unix socket types */
71#include <linux/parser.h>
72#include <linux/nfs_mount.h>
73#include <net/ipv6.h>
74#include <linux/hugetlb.h>
75#include <linux/personality.h>
1da177e4 76#include <linux/audit.h>
6931dfc9 77#include <linux/string.h>
877ce7c1 78#include <linux/selinux.h>
23970741 79#include <linux/mutex.h>
f06febc9 80#include <linux/posix-timers.h>
00234592 81#include <linux/syslog.h>
3486740a 82#include <linux/user_namespace.h>
44fc7ea0 83#include <linux/export.h>
40401530
AV
84#include <linux/msg.h>
85#include <linux/shm.h>
1da177e4
LT
86
87#include "avc.h"
88#include "objsec.h"
89#include "netif.h"
224dfbd8 90#include "netnode.h"
3e112172 91#include "netport.h"
d28d1e08 92#include "xfrm.h"
c60475bf 93#include "netlabel.h"
9d57a7f9 94#include "audit.h"
7b98a585 95#include "avc_ss.h"
1da177e4 96
d621d35e 97/* SECMARK reference count */
56a4ca99 98static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
d621d35e 99
1da177e4 100#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 101int selinux_enforcing;
1da177e4
LT
102
103static int __init enforcing_setup(char *str)
104{
f5269710 105 unsigned long enforcing;
29707b20 106 if (!kstrtoul(str, 0, &enforcing))
f5269710 107 selinux_enforcing = enforcing ? 1 : 0;
1da177e4
LT
108 return 1;
109}
110__setup("enforcing=", enforcing_setup);
111#endif
112
113#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116static int __init selinux_enabled_setup(char *str)
117{
f5269710 118 unsigned long enabled;
29707b20 119 if (!kstrtoul(str, 0, &enabled))
f5269710 120 selinux_enabled = enabled ? 1 : 0;
1da177e4
LT
121 return 1;
122}
123__setup("selinux=", selinux_enabled_setup);
30d55280
SS
124#else
125int selinux_enabled = 1;
1da177e4
LT
126#endif
127
e18b890b 128static struct kmem_cache *sel_inode_cache;
7cae7e26 129
d621d35e
PM
130/**
131 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
132 *
133 * Description:
134 * This function checks the SECMARK reference counter to see if any SECMARK
135 * targets are currently configured, if the reference counter is greater than
136 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
2be4d74f
CP
137 * enabled, false (0) if SECMARK is disabled. If the always_check_network
138 * policy capability is enabled, SECMARK is always considered enabled.
d621d35e
PM
139 *
140 */
141static int selinux_secmark_enabled(void)
142{
2be4d74f
CP
143 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
144}
145
146/**
147 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
148 *
149 * Description:
150 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
151 * (1) if any are enabled or false (0) if neither are enabled. If the
152 * always_check_network policy capability is enabled, peer labeling
153 * is always considered enabled.
154 *
155 */
156static int selinux_peerlbl_enabled(void)
157{
158 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
d621d35e
PM
159}
160
615e51fd
PM
161static int selinux_netcache_avc_callback(u32 event)
162{
163 if (event == AVC_CALLBACK_RESET) {
164 sel_netif_flush();
165 sel_netnode_flush();
166 sel_netport_flush();
167 synchronize_net();
168 }
169 return 0;
170}
171
d84f4f99
DH
172/*
173 * initialise the security for the init task
174 */
175static void cred_init_security(void)
1da177e4 176{
3b11a1de 177 struct cred *cred = (struct cred *) current->real_cred;
1da177e4
LT
178 struct task_security_struct *tsec;
179
89d155ef 180 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4 181 if (!tsec)
d84f4f99 182 panic("SELinux: Failed to initialize initial task.\n");
1da177e4 183
d84f4f99 184 tsec->osid = tsec->sid = SECINITSID_KERNEL;
f1752eec 185 cred->security = tsec;
1da177e4
LT
186}
187
88e67f3b
DH
188/*
189 * get the security ID of a set of credentials
190 */
191static inline u32 cred_sid(const struct cred *cred)
192{
193 const struct task_security_struct *tsec;
194
195 tsec = cred->security;
196 return tsec->sid;
197}
198
275bb41e 199/*
3b11a1de 200 * get the objective security ID of a task
275bb41e
DH
201 */
202static inline u32 task_sid(const struct task_struct *task)
203{
275bb41e
DH
204 u32 sid;
205
206 rcu_read_lock();
88e67f3b 207 sid = cred_sid(__task_cred(task));
275bb41e
DH
208 rcu_read_unlock();
209 return sid;
210}
211
212/*
3b11a1de 213 * get the subjective security ID of the current task
275bb41e
DH
214 */
215static inline u32 current_sid(void)
216{
5fb49870 217 const struct task_security_struct *tsec = current_security();
275bb41e
DH
218
219 return tsec->sid;
220}
221
88e67f3b
DH
222/* Allocate and free functions for each kind of security blob. */
223
1da177e4
LT
224static int inode_alloc_security(struct inode *inode)
225{
1da177e4 226 struct inode_security_struct *isec;
275bb41e 227 u32 sid = current_sid();
1da177e4 228
a02fe132 229 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT
230 if (!isec)
231 return -ENOMEM;
232
23970741 233 mutex_init(&isec->lock);
1da177e4 234 INIT_LIST_HEAD(&isec->list);
1da177e4
LT
235 isec->inode = inode;
236 isec->sid = SECINITSID_UNLABELED;
237 isec->sclass = SECCLASS_FILE;
275bb41e 238 isec->task_sid = sid;
1da177e4
LT
239 inode->i_security = isec;
240
241 return 0;
242}
243
3dc91d43
SR
244static void inode_free_rcu(struct rcu_head *head)
245{
246 struct inode_security_struct *isec;
247
248 isec = container_of(head, struct inode_security_struct, rcu);
249 kmem_cache_free(sel_inode_cache, isec);
250}
251
1da177e4
LT
252static void inode_free_security(struct inode *inode)
253{
254 struct inode_security_struct *isec = inode->i_security;
255 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
256
9629d04a
WL
257 /*
258 * As not all inode security structures are in a list, we check for
259 * empty list outside of the lock to make sure that we won't waste
260 * time taking a lock doing nothing.
261 *
262 * The list_del_init() function can be safely called more than once.
263 * It should not be possible for this function to be called with
264 * concurrent list_add(), but for better safety against future changes
265 * in the code, we use list_empty_careful() here.
266 */
267 if (!list_empty_careful(&isec->list)) {
268 spin_lock(&sbsec->isec_lock);
1da177e4 269 list_del_init(&isec->list);
9629d04a
WL
270 spin_unlock(&sbsec->isec_lock);
271 }
1da177e4 272
3dc91d43
SR
273 /*
274 * The inode may still be referenced in a path walk and
275 * a call to selinux_inode_permission() can be made
276 * after inode_free_security() is called. Ideally, the VFS
277 * wouldn't do this, but fixing that is a much harder
278 * job. For now, simply free the i_security via RCU, and
279 * leave the current inode->i_security pointer intact.
280 * The inode will be freed after the RCU grace period too.
281 */
282 call_rcu(&isec->rcu, inode_free_rcu);
1da177e4
LT
283}
284
285static int file_alloc_security(struct file *file)
286{
1da177e4 287 struct file_security_struct *fsec;
275bb41e 288 u32 sid = current_sid();
1da177e4 289
26d2a4be 290 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT
291 if (!fsec)
292 return -ENOMEM;
293
275bb41e
DH
294 fsec->sid = sid;
295 fsec->fown_sid = sid;
1da177e4
LT
296 file->f_security = fsec;
297
298 return 0;
299}
300
301static void file_free_security(struct file *file)
302{
303 struct file_security_struct *fsec = file->f_security;
1da177e4
LT
304 file->f_security = NULL;
305 kfree(fsec);
306}
307
308static int superblock_alloc_security(struct super_block *sb)
309{
310 struct superblock_security_struct *sbsec;
311
89d155ef 312 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT
313 if (!sbsec)
314 return -ENOMEM;
315
bc7e982b 316 mutex_init(&sbsec->lock);
1da177e4
LT
317 INIT_LIST_HEAD(&sbsec->isec_head);
318 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT
319 sbsec->sb = sb;
320 sbsec->sid = SECINITSID_UNLABELED;
321 sbsec->def_sid = SECINITSID_FILE;
c312feb2 322 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT
323 sb->s_security = sbsec;
324
325 return 0;
326}
327
328static void superblock_free_security(struct super_block *sb)
329{
330 struct superblock_security_struct *sbsec = sb->s_security;
1da177e4
LT
331 sb->s_security = NULL;
332 kfree(sbsec);
333}
334
1da177e4
LT
335/* The file system's label must be initialized prior to use. */
336
eb9ae686 337static const char *labeling_behaviors[7] = {
1da177e4
LT
338 "uses xattr",
339 "uses transition SIDs",
340 "uses task SIDs",
341 "uses genfs_contexts",
342 "not configured for labeling",
343 "uses mountpoint labeling",
eb9ae686 344 "uses native labeling",
1da177e4
LT
345};
346
347static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
348
349static inline int inode_doinit(struct inode *inode)
350{
351 return inode_doinit_with_dentry(inode, NULL);
352}
353
354enum {
31e87930 355 Opt_error = -1,
1da177e4
LT
356 Opt_context = 1,
357 Opt_fscontext = 2,
c9180a57
EP
358 Opt_defcontext = 3,
359 Opt_rootcontext = 4,
11689d47 360 Opt_labelsupport = 5,
d355987f 361 Opt_nextmntopt = 6,
1da177e4
LT
362};
363
d355987f
EP
364#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
365
a447c093 366static const match_table_t tokens = {
832cbd9a
EP
367 {Opt_context, CONTEXT_STR "%s"},
368 {Opt_fscontext, FSCONTEXT_STR "%s"},
369 {Opt_defcontext, DEFCONTEXT_STR "%s"},
370 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
11689d47 371 {Opt_labelsupport, LABELSUPP_STR},
31e87930 372 {Opt_error, NULL},
1da177e4
LT
373};
374
375#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
376
c312feb2
EP
377static int may_context_mount_sb_relabel(u32 sid,
378 struct superblock_security_struct *sbsec,
275bb41e 379 const struct cred *cred)
c312feb2 380{
275bb41e 381 const struct task_security_struct *tsec = cred->security;
c312feb2
EP
382 int rc;
383
384 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
385 FILESYSTEM__RELABELFROM, NULL);
386 if (rc)
387 return rc;
388
389 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
390 FILESYSTEM__RELABELTO, NULL);
391 return rc;
392}
393
0808925e
EP
394static int may_context_mount_inode_relabel(u32 sid,
395 struct superblock_security_struct *sbsec,
275bb41e 396 const struct cred *cred)
0808925e 397{
275bb41e 398 const struct task_security_struct *tsec = cred->security;
0808925e
EP
399 int rc;
400 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
401 FILESYSTEM__RELABELFROM, NULL);
402 if (rc)
403 return rc;
404
405 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
406 FILESYSTEM__ASSOCIATE, NULL);
407 return rc;
408}
409
b43e725d
EP
410static int selinux_is_sblabel_mnt(struct super_block *sb)
411{
412 struct superblock_security_struct *sbsec = sb->s_security;
413
d5f3a5f6
MS
414 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
415 sbsec->behavior == SECURITY_FS_USE_TRANS ||
416 sbsec->behavior == SECURITY_FS_USE_TASK ||
9fc2b4b4 417 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
d5f3a5f6
MS
418 /* Special handling. Genfs but also in-core setxattr handler */
419 !strcmp(sb->s_type->name, "sysfs") ||
420 !strcmp(sb->s_type->name, "pstore") ||
421 !strcmp(sb->s_type->name, "debugfs") ||
422 !strcmp(sb->s_type->name, "rootfs");
b43e725d
EP
423}
424
c9180a57 425static int sb_finish_set_opts(struct super_block *sb)
1da177e4 426{
1da177e4 427 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57 428 struct dentry *root = sb->s_root;
c6f493d6 429 struct inode *root_inode = d_backing_inode(root);
c9180a57 430 int rc = 0;
1da177e4 431
c9180a57
EP
432 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
433 /* Make sure that the xattr handler exists and that no
434 error other than -ENODATA is returned by getxattr on
435 the root directory. -ENODATA is ok, as this may be
436 the first boot of the SELinux kernel before we have
437 assigned xattr values to the filesystem. */
438 if (!root_inode->i_op->getxattr) {
29b1deb2
LT
439 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
440 "xattr support\n", sb->s_id, sb->s_type->name);
c9180a57
EP
441 rc = -EOPNOTSUPP;
442 goto out;
443 }
444 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
445 if (rc < 0 && rc != -ENODATA) {
446 if (rc == -EOPNOTSUPP)
447 printk(KERN_WARNING "SELinux: (dev %s, type "
29b1deb2
LT
448 "%s) has no security xattr handler\n",
449 sb->s_id, sb->s_type->name);
c9180a57
EP
450 else
451 printk(KERN_WARNING "SELinux: (dev %s, type "
29b1deb2
LT
452 "%s) getxattr errno %d\n", sb->s_id,
453 sb->s_type->name, -rc);
c9180a57
EP
454 goto out;
455 }
456 }
1da177e4 457
c9180a57 458 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
29b1deb2
LT
459 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
460 sb->s_id, sb->s_type->name);
1da177e4 461
eadcabc6 462 sbsec->flags |= SE_SBINITIALIZED;
b43e725d 463 if (selinux_is_sblabel_mnt(sb))
12f348b9 464 sbsec->flags |= SBLABEL_MNT;
ddd29ec6 465
c9180a57
EP
466 /* Initialize the root inode. */
467 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 468
c9180a57
EP
469 /* Initialize any other inodes associated with the superblock, e.g.
470 inodes created prior to initial policy load or inodes created
471 during get_sb by a pseudo filesystem that directly
472 populates itself. */
473 spin_lock(&sbsec->isec_lock);
474next_inode:
475 if (!list_empty(&sbsec->isec_head)) {
476 struct inode_security_struct *isec =
477 list_entry(sbsec->isec_head.next,
478 struct inode_security_struct, list);
479 struct inode *inode = isec->inode;
923190d3 480 list_del_init(&isec->list);
c9180a57
EP
481 spin_unlock(&sbsec->isec_lock);
482 inode = igrab(inode);
483 if (inode) {
484 if (!IS_PRIVATE(inode))
485 inode_doinit(inode);
486 iput(inode);
487 }
488 spin_lock(&sbsec->isec_lock);
c9180a57
EP
489 goto next_inode;
490 }
491 spin_unlock(&sbsec->isec_lock);
492out:
493 return rc;
494}
1da177e4 495
c9180a57
EP
496/*
497 * This function should allow an FS to ask what it's mount security
498 * options were so it can use those later for submounts, displaying
499 * mount options, or whatever.
500 */
501static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 502 struct security_mnt_opts *opts)
c9180a57
EP
503{
504 int rc = 0, i;
505 struct superblock_security_struct *sbsec = sb->s_security;
506 char *context = NULL;
507 u32 len;
508 char tmp;
1da177e4 509
e0007529 510 security_init_mnt_opts(opts);
1da177e4 511
0d90a7ec 512 if (!(sbsec->flags & SE_SBINITIALIZED))
c9180a57 513 return -EINVAL;
1da177e4 514
c9180a57
EP
515 if (!ss_initialized)
516 return -EINVAL;
1da177e4 517
af8e50cc
EP
518 /* make sure we always check enough bits to cover the mask */
519 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
520
0d90a7ec 521 tmp = sbsec->flags & SE_MNTMASK;
c9180a57 522 /* count the number of mount options for this sb */
af8e50cc 523 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
c9180a57 524 if (tmp & 0x01)
e0007529 525 opts->num_mnt_opts++;
c9180a57
EP
526 tmp >>= 1;
527 }
11689d47 528 /* Check if the Label support flag is set */
0b4bdb35 529 if (sbsec->flags & SBLABEL_MNT)
11689d47 530 opts->num_mnt_opts++;
1da177e4 531
e0007529
EP
532 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
533 if (!opts->mnt_opts) {
c9180a57
EP
534 rc = -ENOMEM;
535 goto out_free;
536 }
1da177e4 537
e0007529
EP
538 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
539 if (!opts->mnt_opts_flags) {
c9180a57
EP
540 rc = -ENOMEM;
541 goto out_free;
542 }
1da177e4 543
c9180a57
EP
544 i = 0;
545 if (sbsec->flags & FSCONTEXT_MNT) {
546 rc = security_sid_to_context(sbsec->sid, &context, &len);
547 if (rc)
548 goto out_free;
e0007529
EP
549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP
551 }
552 if (sbsec->flags & CONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
554 if (rc)
555 goto out_free;
e0007529
EP
556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP
558 }
559 if (sbsec->flags & DEFCONTEXT_MNT) {
560 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
561 if (rc)
562 goto out_free;
e0007529
EP
563 opts->mnt_opts[i] = context;
564 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP
565 }
566 if (sbsec->flags & ROOTCONTEXT_MNT) {
c6f493d6 567 struct inode *root = d_backing_inode(sbsec->sb->s_root);
c9180a57 568 struct inode_security_struct *isec = root->i_security;
0808925e 569
c9180a57
EP
570 rc = security_sid_to_context(isec->sid, &context, &len);
571 if (rc)
572 goto out_free;
e0007529
EP
573 opts->mnt_opts[i] = context;
574 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 575 }
12f348b9 576 if (sbsec->flags & SBLABEL_MNT) {
11689d47 577 opts->mnt_opts[i] = NULL;
12f348b9 578 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
11689d47 579 }
1da177e4 580
e0007529 581 BUG_ON(i != opts->num_mnt_opts);
1da177e4 582
c9180a57
EP
583 return 0;
584
585out_free:
e0007529 586 security_free_mnt_opts(opts);
c9180a57
EP
587 return rc;
588}
1da177e4 589
c9180a57
EP
590static int bad_option(struct superblock_security_struct *sbsec, char flag,
591 u32 old_sid, u32 new_sid)
592{
0d90a7ec
DQ
593 char mnt_flags = sbsec->flags & SE_MNTMASK;
594
c9180a57 595 /* check if the old mount command had the same options */
0d90a7ec 596 if (sbsec->flags & SE_SBINITIALIZED)
c9180a57
EP
597 if (!(sbsec->flags & flag) ||
598 (old_sid != new_sid))
599 return 1;
600
601 /* check if we were passed the same options twice,
602 * aka someone passed context=a,context=b
603 */
0d90a7ec
DQ
604 if (!(sbsec->flags & SE_SBINITIALIZED))
605 if (mnt_flags & flag)
c9180a57
EP
606 return 1;
607 return 0;
608}
e0007529 609
c9180a57
EP
610/*
611 * Allow filesystems with binary mount data to explicitly set mount point
612 * labeling information.
613 */
e0007529 614static int selinux_set_mnt_opts(struct super_block *sb,
649f6e77
DQ
615 struct security_mnt_opts *opts,
616 unsigned long kern_flags,
617 unsigned long *set_kern_flags)
c9180a57 618{
275bb41e 619 const struct cred *cred = current_cred();
c9180a57 620 int rc = 0, i;
c9180a57 621 struct superblock_security_struct *sbsec = sb->s_security;
29b1deb2 622 const char *name = sb->s_type->name;
c6f493d6 623 struct inode *inode = d_backing_inode(sbsec->sb->s_root);
089be43e 624 struct inode_security_struct *root_isec = inode->i_security;
c9180a57
EP
625 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
626 u32 defcontext_sid = 0;
e0007529
EP
627 char **mount_options = opts->mnt_opts;
628 int *flags = opts->mnt_opts_flags;
629 int num_opts = opts->num_mnt_opts;
c9180a57
EP
630
631 mutex_lock(&sbsec->lock);
632
633 if (!ss_initialized) {
634 if (!num_opts) {
635 /* Defer initialization until selinux_complete_init,
636 after the initial policy is loaded and the security
637 server is ready to handle calls. */
c9180a57
EP
638 goto out;
639 }
640 rc = -EINVAL;
744ba35e
EP
641 printk(KERN_WARNING "SELinux: Unable to set superblock options "
642 "before the security server is initialized\n");
1da177e4 643 goto out;
c9180a57 644 }
649f6e77
DQ
645 if (kern_flags && !set_kern_flags) {
646 /* Specifying internal flags without providing a place to
647 * place the results is not allowed */
648 rc = -EINVAL;
649 goto out;
650 }
1da177e4 651
e0007529
EP
652 /*
653 * Binary mount data FS will come through this function twice. Once
654 * from an explicit call and once from the generic calls from the vfs.
655 * Since the generic VFS calls will not contain any security mount data
656 * we need to skip the double mount verification.
657 *
658 * This does open a hole in which we will not notice if the first
659 * mount using this sb set explict options and a second mount using
660 * this sb does not set any security options. (The first options
661 * will be used for both mounts)
662 */
0d90a7ec 663 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
e0007529 664 && (num_opts == 0))
f5269710 665 goto out;
e0007529 666
c9180a57
EP
667 /*
668 * parse the mount options, check if they are valid sids.
669 * also check if someone is trying to mount the same sb more
670 * than once with different security options.
671 */
672 for (i = 0; i < num_opts; i++) {
673 u32 sid;
11689d47 674
12f348b9 675 if (flags[i] == SBLABEL_MNT)
11689d47 676 continue;
c9180a57 677 rc = security_context_to_sid(mount_options[i],
52a4c640 678 strlen(mount_options[i]), &sid, GFP_KERNEL);
1da177e4
LT
679 if (rc) {
680 printk(KERN_WARNING "SELinux: security_context_to_sid"
29b1deb2
LT
681 "(%s) failed for (dev %s, type %s) errno=%d\n",
682 mount_options[i], sb->s_id, name, rc);
c9180a57
EP
683 goto out;
684 }
685 switch (flags[i]) {
686 case FSCONTEXT_MNT:
687 fscontext_sid = sid;
688
689 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
690 fscontext_sid))
691 goto out_double_mount;
692
693 sbsec->flags |= FSCONTEXT_MNT;
694 break;
695 case CONTEXT_MNT:
696 context_sid = sid;
697
698 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
699 context_sid))
700 goto out_double_mount;
701
702 sbsec->flags |= CONTEXT_MNT;
703 break;
704 case ROOTCONTEXT_MNT:
705 rootcontext_sid = sid;
706
707 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
708 rootcontext_sid))
709 goto out_double_mount;
710
711 sbsec->flags |= ROOTCONTEXT_MNT;
712
713 break;
714 case DEFCONTEXT_MNT:
715 defcontext_sid = sid;
716
717 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
718 defcontext_sid))
719 goto out_double_mount;
720
721 sbsec->flags |= DEFCONTEXT_MNT;
722
723 break;
724 default:
725 rc = -EINVAL;
726 goto out;
1da177e4 727 }
c9180a57
EP
728 }
729
0d90a7ec 730 if (sbsec->flags & SE_SBINITIALIZED) {
c9180a57 731 /* previously mounted with options, but not on this attempt? */
0d90a7ec 732 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
c9180a57
EP
733 goto out_double_mount;
734 rc = 0;
735 goto out;
736 }
737
089be43e 738 if (strcmp(sb->s_type->name, "proc") == 0)
134509d5
SS
739 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
740
8e014720
SS
741 if (!strcmp(sb->s_type->name, "debugfs") ||
742 !strcmp(sb->s_type->name, "sysfs") ||
743 !strcmp(sb->s_type->name, "pstore"))
134509d5 744 sbsec->flags |= SE_SBGENFS;
c9180a57 745
eb9ae686
DQ
746 if (!sbsec->behavior) {
747 /*
748 * Determine the labeling behavior to use for this
749 * filesystem type.
750 */
98f700f3 751 rc = security_fs_use(sb);
eb9ae686
DQ
752 if (rc) {
753 printk(KERN_WARNING
754 "%s: security_fs_use(%s) returned %d\n",
755 __func__, sb->s_type->name, rc);
756 goto out;
757 }
c9180a57 758 }
c9180a57
EP
759 /* sets the context of the superblock for the fs being mounted. */
760 if (fscontext_sid) {
275bb41e 761 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
1da177e4 762 if (rc)
c9180a57 763 goto out;
1da177e4 764
c9180a57 765 sbsec->sid = fscontext_sid;
c312feb2
EP
766 }
767
768 /*
769 * Switch to using mount point labeling behavior.
770 * sets the label used on all file below the mountpoint, and will set
771 * the superblock context if not already set.
772 */
eb9ae686
DQ
773 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
774 sbsec->behavior = SECURITY_FS_USE_NATIVE;
775 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
776 }
777
c9180a57
EP
778 if (context_sid) {
779 if (!fscontext_sid) {
275bb41e
DH
780 rc = may_context_mount_sb_relabel(context_sid, sbsec,
781 cred);
b04ea3ce 782 if (rc)
c9180a57
EP
783 goto out;
784 sbsec->sid = context_sid;
b04ea3ce 785 } else {
275bb41e
DH
786 rc = may_context_mount_inode_relabel(context_sid, sbsec,
787 cred);
b04ea3ce 788 if (rc)
c9180a57 789 goto out;
b04ea3ce 790 }
c9180a57
EP
791 if (!rootcontext_sid)
792 rootcontext_sid = context_sid;
1da177e4 793
c9180a57 794 sbsec->mntpoint_sid = context_sid;
c312feb2 795 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT
796 }
797
c9180a57 798 if (rootcontext_sid) {
275bb41e
DH
799 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
800 cred);
0808925e 801 if (rc)
c9180a57 802 goto out;
0808925e 803
c9180a57
EP
804 root_isec->sid = rootcontext_sid;
805 root_isec->initialized = 1;
0808925e
EP
806 }
807
c9180a57 808 if (defcontext_sid) {
eb9ae686
DQ
809 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
810 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
c9180a57
EP
811 rc = -EINVAL;
812 printk(KERN_WARNING "SELinux: defcontext option is "
813 "invalid for this filesystem type\n");
814 goto out;
1da177e4
LT
815 }
816
c9180a57
EP
817 if (defcontext_sid != sbsec->def_sid) {
818 rc = may_context_mount_inode_relabel(defcontext_sid,
275bb41e 819 sbsec, cred);
c9180a57
EP
820 if (rc)
821 goto out;
822 }
1da177e4 823
c9180a57 824 sbsec->def_sid = defcontext_sid;
1da177e4
LT
825 }
826
c9180a57 827 rc = sb_finish_set_opts(sb);
1da177e4 828out:
c9180a57 829 mutex_unlock(&sbsec->lock);
1da177e4 830 return rc;
c9180a57
EP
831out_double_mount:
832 rc = -EINVAL;
833 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
29b1deb2 834 "security settings for (dev %s, type %s)\n", sb->s_id, name);
c9180a57 835 goto out;
1da177e4
LT
836}
837
094f7b69
JL
838static int selinux_cmp_sb_context(const struct super_block *oldsb,
839 const struct super_block *newsb)
840{
841 struct superblock_security_struct *old = oldsb->s_security;
842 struct superblock_security_struct *new = newsb->s_security;
843 char oldflags = old->flags & SE_MNTMASK;
844 char newflags = new->flags & SE_MNTMASK;
845
846 if (oldflags != newflags)
847 goto mismatch;
848 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
849 goto mismatch;
850 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
851 goto mismatch;
852 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
853 goto mismatch;
854 if (oldflags & ROOTCONTEXT_MNT) {
c6f493d6
DH
855 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
856 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
094f7b69
JL
857 if (oldroot->sid != newroot->sid)
858 goto mismatch;
859 }
860 return 0;
861mismatch:
862 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
863 "different security settings for (dev %s, "
864 "type %s)\n", newsb->s_id, newsb->s_type->name);
865 return -EBUSY;
866}
867
868static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
c9180a57 869 struct super_block *newsb)
1da177e4 870{
c9180a57
EP
871 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
872 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 873
c9180a57
EP
874 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
875 int set_context = (oldsbsec->flags & CONTEXT_MNT);
876 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 877
0f5e6420
EP
878 /*
879 * if the parent was able to be mounted it clearly had no special lsm
e8c26255 880 * mount options. thus we can safely deal with this superblock later
0f5e6420 881 */
e8c26255 882 if (!ss_initialized)
094f7b69 883 return 0;
c9180a57 884
c9180a57 885 /* how can we clone if the old one wasn't set up?? */
0d90a7ec 886 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
c9180a57 887
094f7b69 888 /* if fs is reusing a sb, make sure that the contexts match */
0d90a7ec 889 if (newsbsec->flags & SE_SBINITIALIZED)
094f7b69 890 return selinux_cmp_sb_context(oldsb, newsb);
5a552617 891
c9180a57
EP
892 mutex_lock(&newsbsec->lock);
893
894 newsbsec->flags = oldsbsec->flags;
895
896 newsbsec->sid = oldsbsec->sid;
897 newsbsec->def_sid = oldsbsec->def_sid;
898 newsbsec->behavior = oldsbsec->behavior;
899
900 if (set_context) {
901 u32 sid = oldsbsec->mntpoint_sid;
902
903 if (!set_fscontext)
904 newsbsec->sid = sid;
905 if (!set_rootcontext) {
c6f493d6 906 struct inode *newinode = d_backing_inode(newsb->s_root);
c9180a57
EP
907 struct inode_security_struct *newisec = newinode->i_security;
908 newisec->sid = sid;
909 }
910 newsbsec->mntpoint_sid = sid;
1da177e4 911 }
c9180a57 912 if (set_rootcontext) {
c6f493d6 913 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
c9180a57 914 const struct inode_security_struct *oldisec = oldinode->i_security;
c6f493d6 915 struct inode *newinode = d_backing_inode(newsb->s_root);
c9180a57 916 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 917
c9180a57 918 newisec->sid = oldisec->sid;
1da177e4
LT
919 }
920
c9180a57
EP
921 sb_finish_set_opts(newsb);
922 mutex_unlock(&newsbsec->lock);
094f7b69 923 return 0;
c9180a57
EP
924}
925
2e1479d9
AB
926static int selinux_parse_opts_str(char *options,
927 struct security_mnt_opts *opts)
c9180a57 928{
e0007529 929 char *p;
c9180a57
EP
930 char *context = NULL, *defcontext = NULL;
931 char *fscontext = NULL, *rootcontext = NULL;
e0007529 932 int rc, num_mnt_opts = 0;
1da177e4 933
e0007529 934 opts->num_mnt_opts = 0;
1da177e4 935
c9180a57
EP
936 /* Standard string-based options. */
937 while ((p = strsep(&options, "|")) != NULL) {
938 int token;
939 substring_t args[MAX_OPT_ARGS];
1da177e4 940
c9180a57
EP
941 if (!*p)
942 continue;
1da177e4 943
c9180a57 944 token = match_token(p, tokens, args);
1da177e4 945
c9180a57
EP
946 switch (token) {
947 case Opt_context:
948 if (context || defcontext) {
949 rc = -EINVAL;
950 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
951 goto out_err;
952 }
953 context = match_strdup(&args[0]);
954 if (!context) {
955 rc = -ENOMEM;
956 goto out_err;
957 }
958 break;
959
960 case Opt_fscontext:
961 if (fscontext) {
962 rc = -EINVAL;
963 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
964 goto out_err;
965 }
966 fscontext = match_strdup(&args[0]);
967 if (!fscontext) {
968 rc = -ENOMEM;
969 goto out_err;
970 }
971 break;
972
973 case Opt_rootcontext:
974 if (rootcontext) {
975 rc = -EINVAL;
976 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
977 goto out_err;
978 }
979 rootcontext = match_strdup(&args[0]);
980 if (!rootcontext) {
981 rc = -ENOMEM;
982 goto out_err;
983 }
984 break;
985
986 case Opt_defcontext:
987 if (context || defcontext) {
988 rc = -EINVAL;
989 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
990 goto out_err;
991 }
992 defcontext = match_strdup(&args[0]);
993 if (!defcontext) {
994 rc = -ENOMEM;
995 goto out_err;
996 }
997 break;
11689d47
DQ
998 case Opt_labelsupport:
999 break;
c9180a57
EP
1000 default:
1001 rc = -EINVAL;
1002 printk(KERN_WARNING "SELinux: unknown mount option\n");
1003 goto out_err;
1da177e4 1004
1da177e4 1005 }
1da177e4 1006 }
c9180a57 1007
e0007529
EP
1008 rc = -ENOMEM;
1009 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010 if (!opts->mnt_opts)
1011 goto out_err;
1012
1013 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014 if (!opts->mnt_opts_flags) {
1015 kfree(opts->mnt_opts);
1016 goto out_err;
1017 }
1018
c9180a57 1019 if (fscontext) {
e0007529
EP
1020 opts->mnt_opts[num_mnt_opts] = fscontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP
1022 }
1023 if (context) {
e0007529
EP
1024 opts->mnt_opts[num_mnt_opts] = context;
1025 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP
1026 }
1027 if (rootcontext) {
e0007529
EP
1028 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP
1030 }
1031 if (defcontext) {
e0007529
EP
1032 opts->mnt_opts[num_mnt_opts] = defcontext;
1033 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP
1034 }
1035
e0007529
EP
1036 opts->num_mnt_opts = num_mnt_opts;
1037 return 0;
1038
c9180a57
EP
1039out_err:
1040 kfree(context);
1041 kfree(defcontext);
1042 kfree(fscontext);
1043 kfree(rootcontext);
1da177e4
LT
1044 return rc;
1045}
e0007529
EP
1046/*
1047 * string mount options parsing and call set the sbsec
1048 */
1049static int superblock_doinit(struct super_block *sb, void *data)
1050{
1051 int rc = 0;
1052 char *options = data;
1053 struct security_mnt_opts opts;
1054
1055 security_init_mnt_opts(&opts);
1056
1057 if (!data)
1058 goto out;
1059
1060 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1061
1062 rc = selinux_parse_opts_str(options, &opts);
1063 if (rc)
1064 goto out_err;
1065
1066out:
649f6e77 1067 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
e0007529
EP
1068
1069out_err:
1070 security_free_mnt_opts(&opts);
1071 return rc;
1072}
1da177e4 1073
3583a711
AB
1074static void selinux_write_opts(struct seq_file *m,
1075 struct security_mnt_opts *opts)
2069f457
EP
1076{
1077 int i;
1078 char *prefix;
1079
1080 for (i = 0; i < opts->num_mnt_opts; i++) {
11689d47
DQ
1081 char *has_comma;
1082
1083 if (opts->mnt_opts[i])
1084 has_comma = strchr(opts->mnt_opts[i], ',');
1085 else
1086 has_comma = NULL;
2069f457
EP
1087
1088 switch (opts->mnt_opts_flags[i]) {
1089 case CONTEXT_MNT:
1090 prefix = CONTEXT_STR;
1091 break;
1092 case FSCONTEXT_MNT:
1093 prefix = FSCONTEXT_STR;
1094 break;
1095 case ROOTCONTEXT_MNT:
1096 prefix = ROOTCONTEXT_STR;
1097 break;
1098 case DEFCONTEXT_MNT:
1099 prefix = DEFCONTEXT_STR;
1100 break;
12f348b9 1101 case SBLABEL_MNT:
11689d47
DQ
1102 seq_putc(m, ',');
1103 seq_puts(m, LABELSUPP_STR);
1104 continue;
2069f457
EP
1105 default:
1106 BUG();
a35c6c83 1107 return;
2069f457
EP
1108 };
1109 /* we need a comma before each option */
1110 seq_putc(m, ',');
1111 seq_puts(m, prefix);
1112 if (has_comma)
1113 seq_putc(m, '\"');
a068acf2 1114 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
2069f457
EP
1115 if (has_comma)
1116 seq_putc(m, '\"');
1117 }
1118}
1119
1120static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1121{
1122 struct security_mnt_opts opts;
1123 int rc;
1124
1125 rc = selinux_get_mnt_opts(sb, &opts);
383795c2
EP
1126 if (rc) {
1127 /* before policy load we may get EINVAL, don't show anything */
1128 if (rc == -EINVAL)
1129 rc = 0;
2069f457 1130 return rc;
383795c2 1131 }
2069f457
EP
1132
1133 selinux_write_opts(m, &opts);
1134
1135 security_free_mnt_opts(&opts);
1136
1137 return rc;
1138}
1139
1da177e4
LT
1140static inline u16 inode_mode_to_security_class(umode_t mode)
1141{
1142 switch (mode & S_IFMT) {
1143 case S_IFSOCK:
1144 return SECCLASS_SOCK_FILE;
1145 case S_IFLNK:
1146 return SECCLASS_LNK_FILE;
1147 case S_IFREG:
1148 return SECCLASS_FILE;
1149 case S_IFBLK:
1150 return SECCLASS_BLK_FILE;
1151 case S_IFDIR:
1152 return SECCLASS_DIR;
1153 case S_IFCHR:
1154 return SECCLASS_CHR_FILE;
1155 case S_IFIFO:
1156 return SECCLASS_FIFO_FILE;
1157
1158 }
1159
1160 return SECCLASS_FILE;
1161}
1162
13402580
JM
1163static inline int default_protocol_stream(int protocol)
1164{
1165 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1166}
1167
1168static inline int default_protocol_dgram(int protocol)
1169{
1170 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1171}
1172
1da177e4
LT
1173static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1174{
1175 switch (family) {
1176 case PF_UNIX:
1177 switch (type) {
1178 case SOCK_STREAM:
1179 case SOCK_SEQPACKET:
1180 return SECCLASS_UNIX_STREAM_SOCKET;
1181 case SOCK_DGRAM:
1182 return SECCLASS_UNIX_DGRAM_SOCKET;
1183 }
1184 break;
1185 case PF_INET:
1186 case PF_INET6:
1187 switch (type) {
1188 case SOCK_STREAM:
13402580
JM
1189 if (default_protocol_stream(protocol))
1190 return SECCLASS_TCP_SOCKET;
1191 else
1192 return SECCLASS_RAWIP_SOCKET;
1da177e4 1193 case SOCK_DGRAM:
13402580
JM
1194 if (default_protocol_dgram(protocol))
1195 return SECCLASS_UDP_SOCKET;
1196 else
1197 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM
1198 case SOCK_DCCP:
1199 return SECCLASS_DCCP_SOCKET;
13402580 1200 default:
1da177e4
LT
1201 return SECCLASS_RAWIP_SOCKET;
1202 }
1203 break;
1204 case PF_NETLINK:
1205 switch (protocol) {
1206 case NETLINK_ROUTE:
1207 return SECCLASS_NETLINK_ROUTE_SOCKET;
7f1fb60c 1208 case NETLINK_SOCK_DIAG:
1da177e4
LT
1209 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1210 case NETLINK_NFLOG:
1211 return SECCLASS_NETLINK_NFLOG_SOCKET;
1212 case NETLINK_XFRM:
1213 return SECCLASS_NETLINK_XFRM_SOCKET;
1214 case NETLINK_SELINUX:
1215 return SECCLASS_NETLINK_SELINUX_SOCKET;
6c6d2e9b
SS
1216 case NETLINK_ISCSI:
1217 return SECCLASS_NETLINK_ISCSI_SOCKET;
1da177e4
LT
1218 case NETLINK_AUDIT:
1219 return SECCLASS_NETLINK_AUDIT_SOCKET;
6c6d2e9b
SS
1220 case NETLINK_FIB_LOOKUP:
1221 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222 case NETLINK_CONNECTOR:
1223 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224 case NETLINK_NETFILTER:
1225 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1da177e4
LT
1226 case NETLINK_DNRTMSG:
1227 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM
1228 case NETLINK_KOBJECT_UEVENT:
1229 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
6c6d2e9b
SS
1230 case NETLINK_GENERIC:
1231 return SECCLASS_NETLINK_GENERIC_SOCKET;
1232 case NETLINK_SCSITRANSPORT:
1233 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1234 case NETLINK_RDMA:
1235 return SECCLASS_NETLINK_RDMA_SOCKET;
1236 case NETLINK_CRYPTO:
1237 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1da177e4
LT
1238 default:
1239 return SECCLASS_NETLINK_SOCKET;
1240 }
1241 case PF_PACKET:
1242 return SECCLASS_PACKET_SOCKET;
1243 case PF_KEY:
1244 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP
1245 case PF_APPLETALK:
1246 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT
1247 }
1248
1249 return SECCLASS_SOCKET;
1250}
1251
134509d5
SS
1252static int selinux_genfs_get_sid(struct dentry *dentry,
1253 u16 tclass,
1254 u16 flags,
1255 u32 *sid)
1da177e4 1256{
8e6c9693 1257 int rc;
134509d5 1258 struct super_block *sb = dentry->d_inode->i_sb;
8e6c9693 1259 char *buffer, *path;
1da177e4 1260
828dfe1d 1261 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT
1262 if (!buffer)
1263 return -ENOMEM;
1264
8e6c9693
LAG
1265 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1266 if (IS_ERR(path))
1267 rc = PTR_ERR(path);
1268 else {
134509d5
SS
1269 if (flags & SE_SBPROC) {
1270 /* each process gets a /proc/PID/ entry. Strip off the
1271 * PID part to get a valid selinux labeling.
1272 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273 while (path[1] >= '0' && path[1] <= '9') {
1274 path[1] = '/';
1275 path++;
1276 }
8e6c9693 1277 }
134509d5 1278 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1da177e4 1279 }
1da177e4
LT
1280 free_page((unsigned long)buffer);
1281 return rc;
1282}
1da177e4
LT
1283
1284/* The inode's security attributes must be initialized before first use. */
1285static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1286{
1287 struct superblock_security_struct *sbsec = NULL;
1288 struct inode_security_struct *isec = inode->i_security;
1289 u32 sid;
1290 struct dentry *dentry;
1291#define INITCONTEXTLEN 255
1292 char *context = NULL;
1293 unsigned len = 0;
1294 int rc = 0;
1da177e4
LT
1295
1296 if (isec->initialized)
1297 goto out;
1298
23970741 1299 mutex_lock(&isec->lock);
1da177e4 1300 if (isec->initialized)
23970741 1301 goto out_unlock;
1da177e4
LT
1302
1303 sbsec = inode->i_sb->s_security;
0d90a7ec 1304 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1da177e4
LT
1305 /* Defer initialization until selinux_complete_init,
1306 after the initial policy is loaded and the security
1307 server is ready to handle calls. */
1308 spin_lock(&sbsec->isec_lock);
1309 if (list_empty(&isec->list))
1310 list_add(&isec->list, &sbsec->isec_head);
1311 spin_unlock(&sbsec->isec_lock);
23970741 1312 goto out_unlock;
1da177e4
LT
1313 }
1314
1315 switch (sbsec->behavior) {
eb9ae686
DQ
1316 case SECURITY_FS_USE_NATIVE:
1317 break;
1da177e4
LT
1318 case SECURITY_FS_USE_XATTR:
1319 if (!inode->i_op->getxattr) {
1320 isec->sid = sbsec->def_sid;
1321 break;
1322 }
1323
1324 /* Need a dentry, since the xattr API requires one.
1325 Life would be simpler if we could just pass the inode. */
1326 if (opt_dentry) {
1327 /* Called from d_instantiate or d_splice_alias. */
1328 dentry = dget(opt_dentry);
1329 } else {
1330 /* Called from selinux_complete_init, try to find a dentry. */
1331 dentry = d_find_alias(inode);
1332 }
1333 if (!dentry) {
df7f54c0
EP
1334 /*
1335 * this is can be hit on boot when a file is accessed
1336 * before the policy is loaded. When we load policy we
1337 * may find inodes that have no dentry on the
1338 * sbsec->isec_head list. No reason to complain as these
1339 * will get fixed up the next time we go through
1340 * inode_doinit with a dentry, before these inodes could
1341 * be used again by userspace.
1342 */
23970741 1343 goto out_unlock;
1da177e4
LT
1344 }
1345
1346 len = INITCONTEXTLEN;
4cb912f1 1347 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1348 if (!context) {
1349 rc = -ENOMEM;
1350 dput(dentry);
23970741 1351 goto out_unlock;
1da177e4 1352 }
4cb912f1 1353 context[len] = '\0';
1da177e4
LT
1354 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1355 context, len);
1356 if (rc == -ERANGE) {
314dabb8
JM
1357 kfree(context);
1358
1da177e4
LT
1359 /* Need a larger buffer. Query for the right size. */
1360 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361 NULL, 0);
1362 if (rc < 0) {
1363 dput(dentry);
23970741 1364 goto out_unlock;
1da177e4 1365 }
1da177e4 1366 len = rc;
4cb912f1 1367 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1368 if (!context) {
1369 rc = -ENOMEM;
1370 dput(dentry);
23970741 1371 goto out_unlock;
1da177e4 1372 }
4cb912f1 1373 context[len] = '\0';
1da177e4
LT
1374 rc = inode->i_op->getxattr(dentry,
1375 XATTR_NAME_SELINUX,
1376 context, len);
1377 }
1378 dput(dentry);
1379 if (rc < 0) {
1380 if (rc != -ENODATA) {
744ba35e 1381 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1382 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT
1383 -rc, inode->i_sb->s_id, inode->i_ino);
1384 kfree(context);
23970741 1385 goto out_unlock;
1da177e4
LT
1386 }
1387 /* Map ENODATA to the default file SID */
1388 sid = sbsec->def_sid;
1389 rc = 0;
1390 } else {
f5c1d5b2 1391 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS
1392 sbsec->def_sid,
1393 GFP_NOFS);
1da177e4 1394 if (rc) {
4ba0a8ad
EP
1395 char *dev = inode->i_sb->s_id;
1396 unsigned long ino = inode->i_ino;
1397
1398 if (rc == -EINVAL) {
1399 if (printk_ratelimit())
1400 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401 "context=%s. This indicates you may need to relabel the inode or the "
1402 "filesystem in question.\n", ino, dev, context);
1403 } else {
1404 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1405 "returned %d for dev=%s ino=%ld\n",
1406 __func__, context, -rc, dev, ino);
1407 }
1da177e4
LT
1408 kfree(context);
1409 /* Leave with the unlabeled SID */
1410 rc = 0;
1411 break;
1412 }
1413 }
1414 kfree(context);
1415 isec->sid = sid;
1416 break;
1417 case SECURITY_FS_USE_TASK:
1418 isec->sid = isec->task_sid;
1419 break;
1420 case SECURITY_FS_USE_TRANS:
1421 /* Default to the fs SID. */
1422 isec->sid = sbsec->sid;
1423
1424 /* Try to obtain a transition SID. */
1425 isec->sclass = inode_mode_to_security_class(inode->i_mode);
652bb9b0
EP
1426 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427 isec->sclass, NULL, &sid);
1da177e4 1428 if (rc)
23970741 1429 goto out_unlock;
1da177e4
LT
1430 isec->sid = sid;
1431 break;
c312feb2
EP
1432 case SECURITY_FS_USE_MNTPOINT:
1433 isec->sid = sbsec->mntpoint_sid;
1434 break;
1da177e4 1435 default:
c312feb2 1436 /* Default to the fs superblock SID. */
1da177e4
LT
1437 isec->sid = sbsec->sid;
1438
134509d5 1439 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
f64410ec
PM
1440 /* We must have a dentry to determine the label on
1441 * procfs inodes */
1442 if (opt_dentry)
1443 /* Called from d_instantiate or
1444 * d_splice_alias. */
1445 dentry = dget(opt_dentry);
1446 else
1447 /* Called from selinux_complete_init, try to
1448 * find a dentry. */
1449 dentry = d_find_alias(inode);
1450 /*
1451 * This can be hit on boot when a file is accessed
1452 * before the policy is loaded. When we load policy we
1453 * may find inodes that have no dentry on the
1454 * sbsec->isec_head list. No reason to complain as
1455 * these will get fixed up the next time we go through
1456 * inode_doinit() with a dentry, before these inodes
1457 * could be used again by userspace.
1458 */
1459 if (!dentry)
1460 goto out_unlock;
1461 isec->sclass = inode_mode_to_security_class(inode->i_mode);
134509d5
SS
1462 rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463 sbsec->flags, &sid);
f64410ec
PM
1464 dput(dentry);
1465 if (rc)
1466 goto out_unlock;
1467 isec->sid = sid;
1da177e4
LT
1468 }
1469 break;
1470 }
1471
1472 isec->initialized = 1;
1473
23970741
EP
1474out_unlock:
1475 mutex_unlock(&isec->lock);
1da177e4
LT
1476out:
1477 if (isec->sclass == SECCLASS_FILE)
1478 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT
1479 return rc;
1480}
1481
1482/* Convert a Linux signal to an access vector. */
1483static inline u32 signal_to_av(int sig)
1484{
1485 u32 perm = 0;
1486
1487 switch (sig) {
1488 case SIGCHLD:
1489 /* Commonly granted from child to parent. */
1490 perm = PROCESS__SIGCHLD;
1491 break;
1492 case SIGKILL:
1493 /* Cannot be caught or ignored */
1494 perm = PROCESS__SIGKILL;
1495 break;
1496 case SIGSTOP:
1497 /* Cannot be caught or ignored */
1498 perm = PROCESS__SIGSTOP;
1499 break;
1500 default:
1501 /* All other signals. */
1502 perm = PROCESS__SIGNAL;
1503 break;
1504 }
1505
1506 return perm;
1507}
1508
d84f4f99
DH
1509/*
1510 * Check permission between a pair of credentials
1511 * fork check, ptrace check, etc.
1512 */
1513static int cred_has_perm(const struct cred *actor,
1514 const struct cred *target,
1515 u32 perms)
1516{
1517 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1518
1519 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1520}
1521
275bb41e 1522/*
88e67f3b 1523 * Check permission between a pair of tasks, e.g. signal checks,
275bb41e
DH
1524 * fork check, ptrace check, etc.
1525 * tsk1 is the actor and tsk2 is the target
3b11a1de 1526 * - this uses the default subjective creds of tsk1
275bb41e
DH
1527 */
1528static int task_has_perm(const struct task_struct *tsk1,
1529 const struct task_struct *tsk2,
1da177e4
LT
1530 u32 perms)
1531{
275bb41e
DH
1532 const struct task_security_struct *__tsec1, *__tsec2;
1533 u32 sid1, sid2;
1da177e4 1534
275bb41e
DH
1535 rcu_read_lock();
1536 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1537 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1538 rcu_read_unlock();
1539 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1da177e4
LT
1540}
1541
3b11a1de
DH
1542/*
1543 * Check permission between current and another task, e.g. signal checks,
1544 * fork check, ptrace check, etc.
1545 * current is the actor and tsk2 is the target
1546 * - this uses current's subjective creds
1547 */
1548static int current_has_perm(const struct task_struct *tsk,
1549 u32 perms)
1550{
1551 u32 sid, tsid;
1552
1553 sid = current_sid();
1554 tsid = task_sid(tsk);
1555 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1556}
1557
b68e418c
SS
1558#if CAP_LAST_CAP > 63
1559#error Fix SELinux to handle capabilities > 63.
1560#endif
1561
1da177e4 1562/* Check whether a task is allowed to use a capability. */
6a9de491 1563static int cred_has_capability(const struct cred *cred,
06112163 1564 int cap, int audit)
1da177e4 1565{
2bf49690 1566 struct common_audit_data ad;
06112163 1567 struct av_decision avd;
b68e418c 1568 u16 sclass;
3699c53c 1569 u32 sid = cred_sid(cred);
b68e418c 1570 u32 av = CAP_TO_MASK(cap);
06112163 1571 int rc;
1da177e4 1572
50c205f5 1573 ad.type = LSM_AUDIT_DATA_CAP;
1da177e4
LT
1574 ad.u.cap = cap;
1575
b68e418c
SS
1576 switch (CAP_TO_INDEX(cap)) {
1577 case 0:
1578 sclass = SECCLASS_CAPABILITY;
1579 break;
1580 case 1:
1581 sclass = SECCLASS_CAPABILITY2;
1582 break;
1583 default:
1584 printk(KERN_ERR
1585 "SELinux: out of range capability %d\n", cap);
1586 BUG();
a35c6c83 1587 return -EINVAL;
b68e418c 1588 }
06112163 1589
275bb41e 1590 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
9ade0cf4 1591 if (audit == SECURITY_CAP_AUDIT) {
7b20ea25 1592 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
9ade0cf4
EP
1593 if (rc2)
1594 return rc2;
1595 }
06112163 1596 return rc;
1da177e4
LT
1597}
1598
1599/* Check whether a task is allowed to use a system operation. */
1600static int task_has_system(struct task_struct *tsk,
1601 u32 perms)
1602{
275bb41e 1603 u32 sid = task_sid(tsk);
1da177e4 1604
275bb41e 1605 return avc_has_perm(sid, SECINITSID_KERNEL,
1da177e4
LT
1606 SECCLASS_SYSTEM, perms, NULL);
1607}
1608
1609/* Check whether a task has a particular permission to an inode.
1610 The 'adp' parameter is optional and allows other audit
1611 data to be passed (e.g. the dentry). */
88e67f3b 1612static int inode_has_perm(const struct cred *cred,
1da177e4
LT
1613 struct inode *inode,
1614 u32 perms,
19e49834 1615 struct common_audit_data *adp)
1da177e4 1616{
1da177e4 1617 struct inode_security_struct *isec;
275bb41e 1618 u32 sid;
1da177e4 1619
e0e81739
DH
1620 validate_creds(cred);
1621
828dfe1d 1622 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS
1623 return 0;
1624
88e67f3b 1625 sid = cred_sid(cred);
1da177e4
LT
1626 isec = inode->i_security;
1627
19e49834 1628 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1da177e4
LT
1629}
1630
1631/* Same as inode_has_perm, but pass explicit audit data containing
1632 the dentry to help the auditing code to more easily generate the
1633 pathname if needed. */
88e67f3b 1634static inline int dentry_has_perm(const struct cred *cred,
1da177e4
LT
1635 struct dentry *dentry,
1636 u32 av)
1637{
c6f493d6 1638 struct inode *inode = d_backing_inode(dentry);
2bf49690 1639 struct common_audit_data ad;
88e67f3b 1640
50c205f5 1641 ad.type = LSM_AUDIT_DATA_DENTRY;
2875fa00 1642 ad.u.dentry = dentry;
19e49834 1643 return inode_has_perm(cred, inode, av, &ad);
2875fa00
EP
1644}
1645
1646/* Same as inode_has_perm, but pass explicit audit data containing
1647 the path to help the auditing code to more easily generate the
1648 pathname if needed. */
1649static inline int path_has_perm(const struct cred *cred,
3f7036a0 1650 const struct path *path,
2875fa00
EP
1651 u32 av)
1652{
c6f493d6 1653 struct inode *inode = d_backing_inode(path->dentry);
2875fa00
EP
1654 struct common_audit_data ad;
1655
50c205f5 1656 ad.type = LSM_AUDIT_DATA_PATH;
2875fa00 1657 ad.u.path = *path;
19e49834 1658 return inode_has_perm(cred, inode, av, &ad);
1da177e4
LT
1659}
1660
13f8e981
DH
1661/* Same as path_has_perm, but uses the inode from the file struct. */
1662static inline int file_path_has_perm(const struct cred *cred,
1663 struct file *file,
1664 u32 av)
1665{
1666 struct common_audit_data ad;
1667
1668 ad.type = LSM_AUDIT_DATA_PATH;
1669 ad.u.path = file->f_path;
19e49834 1670 return inode_has_perm(cred, file_inode(file), av, &ad);
13f8e981
DH
1671}
1672
1da177e4
LT
1673/* Check whether a task can use an open file descriptor to
1674 access an inode in a given way. Check access to the
1675 descriptor itself, and then use dentry_has_perm to
1676 check a particular permission to the file.
1677 Access to the descriptor is implicitly granted if it
1678 has the same SID as the process. If av is zero, then
1679 access to the file is not checked, e.g. for cases
1680 where only the descriptor is affected like seek. */
88e67f3b
DH
1681static int file_has_perm(const struct cred *cred,
1682 struct file *file,
1683 u32 av)
1da177e4 1684{
1da177e4 1685 struct file_security_struct *fsec = file->f_security;
496ad9aa 1686 struct inode *inode = file_inode(file);
2bf49690 1687 struct common_audit_data ad;
88e67f3b 1688 u32 sid = cred_sid(cred);
1da177e4
LT
1689 int rc;
1690
50c205f5 1691 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 1692 ad.u.path = file->f_path;
1da177e4 1693
275bb41e
DH
1694 if (sid != fsec->sid) {
1695 rc = avc_has_perm(sid, fsec->sid,
1da177e4
LT
1696 SECCLASS_FD,
1697 FD__USE,
1698 &ad);
1699 if (rc)
88e67f3b 1700 goto out;
1da177e4
LT
1701 }
1702
1703 /* av is zero if only checking access to the descriptor. */
88e67f3b 1704 rc = 0;
1da177e4 1705 if (av)
19e49834 1706 rc = inode_has_perm(cred, inode, av, &ad);
1da177e4 1707
88e67f3b
DH
1708out:
1709 return rc;
1da177e4
LT
1710}
1711
c3c188b2
DH
1712/*
1713 * Determine the label for an inode that might be unioned.
1714 */
1715static int selinux_determine_inode_label(const struct inode *dir,
1716 const struct qstr *name,
1717 u16 tclass,
1718 u32 *_new_isid)
1719{
1720 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1721 const struct inode_security_struct *dsec = dir->i_security;
1722 const struct task_security_struct *tsec = current_security();
1723
1724 if ((sbsec->flags & SE_SBINITIALIZED) &&
1725 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1726 *_new_isid = sbsec->mntpoint_sid;
1727 } else if ((sbsec->flags & SBLABEL_MNT) &&
1728 tsec->create_sid) {
1729 *_new_isid = tsec->create_sid;
1730 } else {
1731 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1732 name, _new_isid);
1733 }
1734
1735 return 0;
1736}
1737
1da177e4
LT
1738/* Check whether a task can create a file. */
1739static int may_create(struct inode *dir,
1740 struct dentry *dentry,
1741 u16 tclass)
1742{
5fb49870 1743 const struct task_security_struct *tsec = current_security();
1da177e4
LT
1744 struct inode_security_struct *dsec;
1745 struct superblock_security_struct *sbsec;
275bb41e 1746 u32 sid, newsid;
2bf49690 1747 struct common_audit_data ad;
1da177e4
LT
1748 int rc;
1749
1da177e4
LT
1750 dsec = dir->i_security;
1751 sbsec = dir->i_sb->s_security;
1752
275bb41e 1753 sid = tsec->sid;
275bb41e 1754
50c205f5 1755 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1756 ad.u.dentry = dentry;
1da177e4 1757
275bb41e 1758 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1da177e4
LT
1759 DIR__ADD_NAME | DIR__SEARCH,
1760 &ad);
1761 if (rc)
1762 return rc;
1763
c3c188b2
DH
1764 rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1765 &newsid);
1766 if (rc)
1767 return rc;
1da177e4 1768
275bb41e 1769 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1da177e4
LT
1770 if (rc)
1771 return rc;
1772
1773 return avc_has_perm(newsid, sbsec->sid,
1774 SECCLASS_FILESYSTEM,
1775 FILESYSTEM__ASSOCIATE, &ad);
1776}
1777
4eb582cf
ML
1778/* Check whether a task can create a key. */
1779static int may_create_key(u32 ksid,
1780 struct task_struct *ctx)
1781{
275bb41e 1782 u32 sid = task_sid(ctx);
4eb582cf 1783
275bb41e 1784 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
4eb582cf
ML
1785}
1786
828dfe1d
EP
1787#define MAY_LINK 0
1788#define MAY_UNLINK 1
1789#define MAY_RMDIR 2
1da177e4
LT
1790
1791/* Check whether a task can link, unlink, or rmdir a file/directory. */
1792static int may_link(struct inode *dir,
1793 struct dentry *dentry,
1794 int kind)
1795
1796{
1da177e4 1797 struct inode_security_struct *dsec, *isec;
2bf49690 1798 struct common_audit_data ad;
275bb41e 1799 u32 sid = current_sid();
1da177e4
LT
1800 u32 av;
1801 int rc;
1802
1da177e4 1803 dsec = dir->i_security;
c6f493d6 1804 isec = d_backing_inode(dentry)->i_security;
1da177e4 1805
50c205f5 1806 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 1807 ad.u.dentry = dentry;
1da177e4
LT
1808
1809 av = DIR__SEARCH;
1810 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
275bb41e 1811 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1812 if (rc)
1813 return rc;
1814
1815 switch (kind) {
1816 case MAY_LINK:
1817 av = FILE__LINK;
1818 break;
1819 case MAY_UNLINK:
1820 av = FILE__UNLINK;
1821 break;
1822 case MAY_RMDIR:
1823 av = DIR__RMDIR;
1824 break;
1825 default:
744ba35e
EP
1826 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1827 __func__, kind);
1da177e4
LT
1828 return 0;
1829 }
1830
275bb41e 1831 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1da177e4
LT
1832 return rc;
1833}
1834
1835static inline int may_rename(struct inode *old_dir,
1836 struct dentry *old_dentry,
1837 struct inode *new_dir,
1838 struct dentry *new_dentry)
1839{
1da177e4 1840 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2bf49690 1841 struct common_audit_data ad;
275bb41e 1842 u32 sid = current_sid();
1da177e4
LT
1843 u32 av;
1844 int old_is_dir, new_is_dir;
1845 int rc;
1846
1da177e4 1847 old_dsec = old_dir->i_security;
c6f493d6 1848 old_isec = d_backing_inode(old_dentry)->i_security;
e36cb0b8 1849 old_is_dir = d_is_dir(old_dentry);
1da177e4
LT
1850 new_dsec = new_dir->i_security;
1851
50c205f5 1852 ad.type = LSM_AUDIT_DATA_DENTRY;
1da177e4 1853
a269434d 1854 ad.u.dentry = old_dentry;
275bb41e 1855 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1da177e4
LT
1856 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1857 if (rc)
1858 return rc;
275bb41e 1859 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1860 old_isec->sclass, FILE__RENAME, &ad);
1861 if (rc)
1862 return rc;
1863 if (old_is_dir && new_dir != old_dir) {
275bb41e 1864 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1865 old_isec->sclass, DIR__REPARENT, &ad);
1866 if (rc)
1867 return rc;
1868 }
1869
a269434d 1870 ad.u.dentry = new_dentry;
1da177e4 1871 av = DIR__ADD_NAME | DIR__SEARCH;
2c616d4d 1872 if (d_is_positive(new_dentry))
1da177e4 1873 av |= DIR__REMOVE_NAME;
275bb41e 1874 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1875 if (rc)
1876 return rc;
2c616d4d 1877 if (d_is_positive(new_dentry)) {
c6f493d6 1878 new_isec = d_backing_inode(new_dentry)->i_security;
e36cb0b8 1879 new_is_dir = d_is_dir(new_dentry);
275bb41e 1880 rc = avc_has_perm(sid, new_isec->sid,
1da177e4
LT
1881 new_isec->sclass,
1882 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1883 if (rc)
1884 return rc;
1885 }
1886
1887 return 0;
1888}
1889
1890/* Check whether a task can perform a filesystem operation. */
88e67f3b 1891static int superblock_has_perm(const struct cred *cred,
1da177e4
LT
1892 struct super_block *sb,
1893 u32 perms,
2bf49690 1894 struct common_audit_data *ad)
1da177e4 1895{
1da177e4 1896 struct superblock_security_struct *sbsec;
88e67f3b 1897 u32 sid = cred_sid(cred);
1da177e4 1898
1da177e4 1899 sbsec = sb->s_security;
275bb41e 1900 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1da177e4
LT
1901}
1902
1903/* Convert a Linux mode and permission mask to an access vector. */
1904static inline u32 file_mask_to_av(int mode, int mask)
1905{
1906 u32 av = 0;
1907
dba19c60 1908 if (!S_ISDIR(mode)) {
1da177e4
LT
1909 if (mask & MAY_EXEC)
1910 av |= FILE__EXECUTE;
1911 if (mask & MAY_READ)
1912 av |= FILE__READ;
1913
1914 if (mask & MAY_APPEND)
1915 av |= FILE__APPEND;
1916 else if (mask & MAY_WRITE)
1917 av |= FILE__WRITE;
1918
1919 } else {
1920 if (mask & MAY_EXEC)
1921 av |= DIR__SEARCH;
1922 if (mask & MAY_WRITE)
1923 av |= DIR__WRITE;
1924 if (mask & MAY_READ)
1925 av |= DIR__READ;
1926 }
1927
1928 return av;
1929}
1930
8b6a5a37
EP
1931/* Convert a Linux file to an access vector. */
1932static inline u32 file_to_av(struct file *file)
1933{
1934 u32 av = 0;
1935
1936 if (file->f_mode & FMODE_READ)
1937 av |= FILE__READ;
1938 if (file->f_mode & FMODE_WRITE) {
1939 if (file->f_flags & O_APPEND)
1940 av |= FILE__APPEND;
1941 else
1942 av |= FILE__WRITE;
1943 }
1944 if (!av) {
1945 /*
1946 * Special file opened with flags 3 for ioctl-only use.
1947 */
1948 av = FILE__IOCTL;
1949 }
1950
1951 return av;
1952}
1953
b0c636b9 1954/*
8b6a5a37 1955 * Convert a file to an access vector and include the correct open
b0c636b9
EP
1956 * open permission.
1957 */
8b6a5a37 1958static inline u32 open_file_to_av(struct file *file)
b0c636b9 1959{
8b6a5a37 1960 u32 av = file_to_av(file);
b0c636b9 1961
49b7b8de
EP
1962 if (selinux_policycap_openperm)
1963 av |= FILE__OPEN;
1964
b0c636b9
EP
1965 return av;
1966}
1967
1da177e4
LT
1968/* Hook functions begin here. */
1969
79af7307
SS
1970static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1971{
1972 u32 mysid = current_sid();
1973 u32 mgrsid = task_sid(mgr);
1974
1975 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1976 BINDER__SET_CONTEXT_MGR, NULL);
1977}
1978
1979static int selinux_binder_transaction(struct task_struct *from,
1980 struct task_struct *to)
1981{
1982 u32 mysid = current_sid();
1983 u32 fromsid = task_sid(from);
1984 u32 tosid = task_sid(to);
1985 int rc;
1986
1987 if (mysid != fromsid) {
1988 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1989 BINDER__IMPERSONATE, NULL);
1990 if (rc)
1991 return rc;
1992 }
1993
1994 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1995 NULL);
1996}
1997
1998static int selinux_binder_transfer_binder(struct task_struct *from,
1999 struct task_struct *to)
2000{
2001 u32 fromsid = task_sid(from);
2002 u32 tosid = task_sid(to);
2003
2004 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2005 NULL);
2006}
2007
2008static int selinux_binder_transfer_file(struct task_struct *from,
2009 struct task_struct *to,
2010 struct file *file)
2011{
2012 u32 sid = task_sid(to);
2013 struct file_security_struct *fsec = file->f_security;
c6f493d6 2014 struct inode *inode = d_backing_inode(file->f_path.dentry);
79af7307
SS
2015 struct inode_security_struct *isec = inode->i_security;
2016 struct common_audit_data ad;
2017 int rc;
2018
2019 ad.type = LSM_AUDIT_DATA_PATH;
2020 ad.u.path = file->f_path;
2021
2022 if (sid != fsec->sid) {
2023 rc = avc_has_perm(sid, fsec->sid,
2024 SECCLASS_FD,
2025 FD__USE,
2026 &ad);
2027 if (rc)
2028 return rc;
2029 }
2030
2031 if (unlikely(IS_PRIVATE(inode)))
2032 return 0;
2033
2034 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2035 &ad);
2036}
2037
9e48858f 2038static int selinux_ptrace_access_check(struct task_struct *child,
5cd9c58f 2039 unsigned int mode)
1da177e4 2040{
69f594a3 2041 if (mode & PTRACE_MODE_READ) {
275bb41e
DH
2042 u32 sid = current_sid();
2043 u32 csid = task_sid(child);
2044 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
006ebb40
SS
2045 }
2046
3b11a1de 2047 return current_has_perm(child, PROCESS__PTRACE);
5cd9c58f
DH
2048}
2049
2050static int selinux_ptrace_traceme(struct task_struct *parent)
2051{
5cd9c58f 2052 return task_has_perm(parent, current, PROCESS__PTRACE);
1da177e4
LT
2053}
2054
2055static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 2056 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4 2057{
b1d9e6b0 2058 return current_has_perm(target, PROCESS__GETCAP);
1da177e4
LT
2059}
2060
d84f4f99
DH
2061static int selinux_capset(struct cred *new, const struct cred *old,
2062 const kernel_cap_t *effective,
2063 const kernel_cap_t *inheritable,
2064 const kernel_cap_t *permitted)
1da177e4 2065{
d84f4f99 2066 return cred_has_perm(old, new, PROCESS__SETCAP);
1da177e4
LT
2067}
2068
5626d3e8
JM
2069/*
2070 * (This comment used to live with the selinux_task_setuid hook,
2071 * which was removed).
2072 *
2073 * Since setuid only affects the current process, and since the SELinux
2074 * controls are not based on the Linux identity attributes, SELinux does not
2075 * need to control this operation. However, SELinux does control the use of
2076 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2077 */
2078
6a9de491
EP
2079static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2080 int cap, int audit)
1da177e4 2081{
6a9de491 2082 return cred_has_capability(cred, cap, audit);
1da177e4
LT
2083}
2084
1da177e4
LT
2085static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2086{
88e67f3b 2087 const struct cred *cred = current_cred();
1da177e4
LT
2088 int rc = 0;
2089
2090 if (!sb)
2091 return 0;
2092
2093 switch (cmds) {
828dfe1d
EP
2094 case Q_SYNC:
2095 case Q_QUOTAON:
2096 case Q_QUOTAOFF:
2097 case Q_SETINFO:
2098 case Q_SETQUOTA:
88e67f3b 2099 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
828dfe1d
EP
2100 break;
2101 case Q_GETFMT:
2102 case Q_GETINFO:
2103 case Q_GETQUOTA:
88e67f3b 2104 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
828dfe1d
EP
2105 break;
2106 default:
2107 rc = 0; /* let the kernel handle invalid cmds */
2108 break;
1da177e4
LT
2109 }
2110 return rc;
2111}
2112
2113static int selinux_quota_on(struct dentry *dentry)
2114{
88e67f3b
DH
2115 const struct cred *cred = current_cred();
2116
2875fa00 2117 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1da177e4
LT
2118}
2119
12b3052c 2120static int selinux_syslog(int type)
1da177e4
LT
2121{
2122 int rc;
2123
1da177e4 2124 switch (type) {
d78ca3cd
KC
2125 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2126 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
828dfe1d
EP
2127 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2128 break;
d78ca3cd
KC
2129 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2130 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2131 /* Set level of messages printed to console */
2132 case SYSLOG_ACTION_CONSOLE_LEVEL:
828dfe1d
EP
2133 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2134 break;
d78ca3cd
KC
2135 case SYSLOG_ACTION_CLOSE: /* Close log */
2136 case SYSLOG_ACTION_OPEN: /* Open log */
2137 case SYSLOG_ACTION_READ: /* Read from log */
2138 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2139 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
828dfe1d
EP
2140 default:
2141 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2142 break;
1da177e4
LT
2143 }
2144 return rc;
2145}
2146
2147/*
2148 * Check that a process has enough memory to allocate a new virtual
2149 * mapping. 0 means there is enough memory for the allocation to
2150 * succeed and -ENOMEM implies there is not.
2151 *
1da177e4
LT
2152 * Do not audit the selinux permission check, as this is applied to all
2153 * processes that allocate mappings.
2154 */
34b4e4aa 2155static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT
2156{
2157 int rc, cap_sys_admin = 0;
1da177e4 2158
b1d9e6b0
CS
2159 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2160 SECURITY_CAP_NOAUDIT);
1da177e4
LT
2161 if (rc == 0)
2162 cap_sys_admin = 1;
2163
b1d9e6b0 2164 return cap_sys_admin;
1da177e4
LT
2165}
2166
2167/* binprm security operations */
2168
7b0d0b40
SS
2169static int check_nnp_nosuid(const struct linux_binprm *bprm,
2170 const struct task_security_struct *old_tsec,
2171 const struct task_security_struct *new_tsec)
2172{
2173 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2174 int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2175 int rc;
2176
2177 if (!nnp && !nosuid)
2178 return 0; /* neither NNP nor nosuid */
2179
2180 if (new_tsec->sid == old_tsec->sid)
2181 return 0; /* No change in credentials */
2182
2183 /*
2184 * The only transitions we permit under NNP or nosuid
2185 * are transitions to bounded SIDs, i.e. SIDs that are
2186 * guaranteed to only be allowed a subset of the permissions
2187 * of the current SID.
2188 */
2189 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2190 if (rc) {
2191 /*
2192 * On failure, preserve the errno values for NNP vs nosuid.
2193 * NNP: Operation not permitted for caller.
2194 * nosuid: Permission denied to file.
2195 */
2196 if (nnp)
2197 return -EPERM;
2198 else
2199 return -EACCES;
2200 }
2201 return 0;
2202}
2203
a6f76f23 2204static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1da177e4 2205{
a6f76f23
DH
2206 const struct task_security_struct *old_tsec;
2207 struct task_security_struct *new_tsec;
1da177e4 2208 struct inode_security_struct *isec;
2bf49690 2209 struct common_audit_data ad;
496ad9aa 2210 struct inode *inode = file_inode(bprm->file);
1da177e4
LT
2211 int rc;
2212
a6f76f23
DH
2213 /* SELinux context only depends on initial program or script and not
2214 * the script interpreter */
2215 if (bprm->cred_prepared)
1da177e4
LT
2216 return 0;
2217
a6f76f23
DH
2218 old_tsec = current_security();
2219 new_tsec = bprm->cred->security;
1da177e4
LT
2220 isec = inode->i_security;
2221
2222 /* Default to the current task SID. */
a6f76f23
DH
2223 new_tsec->sid = old_tsec->sid;
2224 new_tsec->osid = old_tsec->sid;
1da177e4 2225
28eba5bf 2226 /* Reset fs, key, and sock SIDs on execve. */
a6f76f23
DH
2227 new_tsec->create_sid = 0;
2228 new_tsec->keycreate_sid = 0;
2229 new_tsec->sockcreate_sid = 0;
1da177e4 2230
a6f76f23
DH
2231 if (old_tsec->exec_sid) {
2232 new_tsec->sid = old_tsec->exec_sid;
1da177e4 2233 /* Reset exec SID on execve. */
a6f76f23 2234 new_tsec->exec_sid = 0;
259e5e6c 2235
7b0d0b40
SS
2236 /* Fail on NNP or nosuid if not an allowed transition. */
2237 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2238 if (rc)
2239 return rc;
1da177e4
LT
2240 } else {
2241 /* Check for a default transition on this program. */
a6f76f23 2242 rc = security_transition_sid(old_tsec->sid, isec->sid,
652bb9b0
EP
2243 SECCLASS_PROCESS, NULL,
2244 &new_tsec->sid);
1da177e4
LT
2245 if (rc)
2246 return rc;
7b0d0b40
SS
2247
2248 /*
2249 * Fallback to old SID on NNP or nosuid if not an allowed
2250 * transition.
2251 */
2252 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2253 if (rc)
2254 new_tsec->sid = old_tsec->sid;
1da177e4
LT
2255 }
2256
50c205f5 2257 ad.type = LSM_AUDIT_DATA_PATH;
f48b7399 2258 ad.u.path = bprm->file->f_path;
1da177e4 2259
a6f76f23
DH
2260 if (new_tsec->sid == old_tsec->sid) {
2261 rc = avc_has_perm(old_tsec->sid, isec->sid,
1da177e4
LT
2262 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2263 if (rc)
2264 return rc;
2265 } else {
2266 /* Check permissions for the transition. */
a6f76f23 2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
1da177e4
LT
2268 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2269 if (rc)
2270 return rc;
2271
a6f76f23 2272 rc = avc_has_perm(new_tsec->sid, isec->sid,
1da177e4
LT
2273 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2274 if (rc)
2275 return rc;
2276
a6f76f23
DH
2277 /* Check for shared state */
2278 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2279 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2280 SECCLASS_PROCESS, PROCESS__SHARE,
2281 NULL);
2282 if (rc)
2283 return -EPERM;
2284 }
2285
2286 /* Make sure that anyone attempting to ptrace over a task that
2287 * changes its SID has the appropriate permit */
2288 if (bprm->unsafe &
2289 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2290 struct task_struct *tracer;
2291 struct task_security_struct *sec;
2292 u32 ptsid = 0;
2293
2294 rcu_read_lock();
06d98473 2295 tracer = ptrace_parent(current);
a6f76f23
DH
2296 if (likely(tracer != NULL)) {
2297 sec = __task_cred(tracer)->security;
2298 ptsid = sec->sid;
2299 }
2300 rcu_read_unlock();
2301
2302 if (ptsid != 0) {
2303 rc = avc_has_perm(ptsid, new_tsec->sid,
2304 SECCLASS_PROCESS,
2305 PROCESS__PTRACE, NULL);
2306 if (rc)
2307 return -EPERM;
2308 }
2309 }
1da177e4 2310
a6f76f23
DH
2311 /* Clear any possibly unsafe personality bits on exec: */
2312 bprm->per_clear |= PER_CLEAR_ON_SETID;
1da177e4
LT
2313 }
2314
1da177e4
LT
2315 return 0;
2316}
2317
828dfe1d 2318static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4 2319{
5fb49870 2320 const struct task_security_struct *tsec = current_security();
275bb41e 2321 u32 sid, osid;
1da177e4
LT
2322 int atsecure = 0;
2323
275bb41e
DH
2324 sid = tsec->sid;
2325 osid = tsec->osid;
2326
2327 if (osid != sid) {
1da177e4
LT
2328 /* Enable secure mode for SIDs transitions unless
2329 the noatsecure permission is granted between
2330 the two SIDs, i.e. ahp returns 0. */
275bb41e 2331 atsecure = avc_has_perm(osid, sid,
a6f76f23
DH
2332 SECCLASS_PROCESS,
2333 PROCESS__NOATSECURE, NULL);
1da177e4
LT
2334 }
2335
b1d9e6b0 2336 return !!atsecure;
1da177e4
LT
2337}
2338
c3c073f8
AV
2339static int match_file(const void *p, struct file *file, unsigned fd)
2340{
2341 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2342}
2343
1da177e4 2344/* Derived from fs/exec.c:flush_old_files. */
745ca247
DH
2345static inline void flush_unauthorized_files(const struct cred *cred,
2346 struct files_struct *files)
1da177e4 2347{
1da177e4 2348 struct file *file, *devnull = NULL;
b20c8122 2349 struct tty_struct *tty;
24ec839c 2350 int drop_tty = 0;
c3c073f8 2351 unsigned n;
1da177e4 2352
24ec839c 2353 tty = get_current_tty();
1da177e4 2354 if (tty) {
ee2ffa0d 2355 spin_lock(&tty_files_lock);
37dd0bd0 2356 if (!list_empty(&tty->tty_files)) {
d996b62a 2357 struct tty_file_private *file_priv;
37dd0bd0 2358
1da177e4 2359 /* Revalidate access to controlling tty.
13f8e981
DH
2360 Use file_path_has_perm on the tty path directly
2361 rather than using file_has_perm, as this particular
2362 open file may belong to another process and we are
2363 only interested in the inode-based check here. */
d996b62a
NP
2364 file_priv = list_first_entry(&tty->tty_files,
2365 struct tty_file_private, list);
2366 file = file_priv->file;
13f8e981 2367 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
24ec839c 2368 drop_tty = 1;
1da177e4 2369 }
ee2ffa0d 2370 spin_unlock(&tty_files_lock);
452a00d2 2371 tty_kref_put(tty);
1da177e4 2372 }
98a27ba4
EB
2373 /* Reset controlling tty. */
2374 if (drop_tty)
2375 no_tty();
1da177e4
LT
2376
2377 /* Revalidate access to inherited open files. */
c3c073f8
AV
2378 n = iterate_fd(files, 0, match_file, cred);
2379 if (!n) /* none found? */
2380 return;
1da177e4 2381
c3c073f8 2382 devnull = dentry_open(&selinux_null, O_RDWR, cred);
45525b26
AV
2383 if (IS_ERR(devnull))
2384 devnull = NULL;
2385 /* replace all the matching ones with this */
2386 do {
2387 replace_fd(n - 1, devnull, 0);
2388 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2389 if (devnull)
c3c073f8 2390 fput(devnull);
1da177e4
LT
2391}
2392
a6f76f23
DH
2393/*
2394 * Prepare a process for imminent new credential changes due to exec
2395 */
2396static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
1da177e4 2397{
a6f76f23
DH
2398 struct task_security_struct *new_tsec;
2399 struct rlimit *rlim, *initrlim;
2400 int rc, i;
d84f4f99 2401
a6f76f23
DH
2402 new_tsec = bprm->cred->security;
2403 if (new_tsec->sid == new_tsec->osid)
2404 return;
1da177e4 2405
a6f76f23
DH
2406 /* Close files for which the new task SID is not authorized. */
2407 flush_unauthorized_files(bprm->cred, current->files);
0356357c 2408
a6f76f23
DH
2409 /* Always clear parent death signal on SID transitions. */
2410 current->pdeath_signal = 0;
0356357c 2411
a6f76f23
DH
2412 /* Check whether the new SID can inherit resource limits from the old
2413 * SID. If not, reset all soft limits to the lower of the current
2414 * task's hard limit and the init task's soft limit.
2415 *
2416 * Note that the setting of hard limits (even to lower them) can be
2417 * controlled by the setrlimit check. The inclusion of the init task's
2418 * soft limit into the computation is to avoid resetting soft limits
2419 * higher than the default soft limit for cases where the default is
2420 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2421 */
2422 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2423 PROCESS__RLIMITINH, NULL);
2424 if (rc) {
eb2d55a3
ON
2425 /* protect against do_prlimit() */
2426 task_lock(current);
a6f76f23
DH
2427 for (i = 0; i < RLIM_NLIMITS; i++) {
2428 rlim = current->signal->rlim + i;
2429 initrlim = init_task.signal->rlim + i;
2430 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4 2431 }
eb2d55a3
ON
2432 task_unlock(current);
2433 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
1da177e4
LT
2434 }
2435}
2436
2437/*
a6f76f23
DH
2438 * Clean up the process immediately after the installation of new credentials
2439 * due to exec
1da177e4 2440 */
a6f76f23 2441static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
1da177e4 2442{
a6f76f23 2443 const struct task_security_struct *tsec = current_security();
1da177e4 2444 struct itimerval itimer;
a6f76f23 2445 u32 osid, sid;
1da177e4
LT
2446 int rc, i;
2447
a6f76f23
DH
2448 osid = tsec->osid;
2449 sid = tsec->sid;
2450
2451 if (sid == osid)
1da177e4
LT
2452 return;
2453
a6f76f23
DH
2454 /* Check whether the new SID can inherit signal state from the old SID.
2455 * If not, clear itimers to avoid subsequent signal generation and
2456 * flush and unblock signals.
2457 *
2458 * This must occur _after_ the task SID has been updated so that any
2459 * kill done after the flush will be checked against the new SID.
2460 */
2461 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
1da177e4
LT
2462 if (rc) {
2463 memset(&itimer, 0, sizeof itimer);
2464 for (i = 0; i < 3; i++)
2465 do_setitimer(i, &itimer, NULL);
1da177e4 2466 spin_lock_irq(&current->sighand->siglock);
9e7c8f8c
ON
2467 if (!fatal_signal_pending(current)) {
2468 flush_sigqueue(&current->pending);
2469 flush_sigqueue(&current->signal->shared_pending);
3bcac026
DH
2470 flush_signal_handlers(current, 1);
2471 sigemptyset(&current->blocked);
9e7c8f8c 2472 recalc_sigpending();
3bcac026 2473 }
1da177e4
LT
2474 spin_unlock_irq(&current->sighand->siglock);
2475 }
2476
a6f76f23
DH
2477 /* Wake up the parent if it is waiting so that it can recheck
2478 * wait permission to the new task SID. */
ecd6de3c 2479 read_lock(&tasklist_lock);
0b7570e7 2480 __wake_up_parent(current, current->real_parent);
ecd6de3c 2481 read_unlock(&tasklist_lock);
1da177e4
LT
2482}
2483
2484/* superblock security operations */
2485
2486static int selinux_sb_alloc_security(struct super_block *sb)
2487{
2488 return superblock_alloc_security(sb);
2489}
2490
2491static void selinux_sb_free_security(struct super_block *sb)
2492{
2493 superblock_free_security(sb);
2494}
2495
2496static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2497{
2498 if (plen > olen)
2499 return 0;
2500
2501 return !memcmp(prefix, option, plen);
2502}
2503
2504static inline int selinux_option(char *option, int len)
2505{
832cbd9a
EP
2506 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2507 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2508 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
11689d47
DQ
2509 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2510 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
1da177e4
LT
2511}
2512
2513static inline void take_option(char **to, char *from, int *first, int len)
2514{
2515 if (!*first) {
2516 **to = ',';
2517 *to += 1;
3528a953 2518 } else
1da177e4
LT
2519 *first = 0;
2520 memcpy(*to, from, len);
2521 *to += len;
2522}
2523
828dfe1d
EP
2524static inline void take_selinux_option(char **to, char *from, int *first,
2525 int len)
3528a953
CO
2526{
2527 int current_size = 0;
2528
2529 if (!*first) {
2530 **to = '|';
2531 *to += 1;
828dfe1d 2532 } else
3528a953
CO
2533 *first = 0;
2534
2535 while (current_size < len) {
2536 if (*from != '"') {
2537 **to = *from;
2538 *to += 1;
2539 }
2540 from += 1;
2541 current_size += 1;
2542 }
2543}
2544
e0007529 2545static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT
2546{
2547 int fnosec, fsec, rc = 0;
2548 char *in_save, *in_curr, *in_end;
2549 char *sec_curr, *nosec_save, *nosec;
3528a953 2550 int open_quote = 0;
1da177e4
LT
2551
2552 in_curr = orig;
2553 sec_curr = copy;
2554
1da177e4
LT
2555 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2556 if (!nosec) {
2557 rc = -ENOMEM;
2558 goto out;
2559 }
2560
2561 nosec_save = nosec;
2562 fnosec = fsec = 1;
2563 in_save = in_end = orig;
2564
2565 do {
3528a953
CO
2566 if (*in_end == '"')
2567 open_quote = !open_quote;
2568 if ((*in_end == ',' && open_quote == 0) ||
2569 *in_end == '\0') {
1da177e4
LT
2570 int len = in_end - in_curr;
2571
2572 if (selinux_option(in_curr, len))
3528a953 2573 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT
2574 else
2575 take_option(&nosec, in_curr, &fnosec, len);
2576
2577 in_curr = in_end + 1;
2578 }
2579 } while (*in_end++);
2580
6931dfc9 2581 strcpy(in_save, nosec_save);
da3caa20 2582 free_page((unsigned long)nosec_save);
1da177e4
LT
2583out:
2584 return rc;
2585}
2586
026eb167
EP
2587static int selinux_sb_remount(struct super_block *sb, void *data)
2588{
2589 int rc, i, *flags;
2590 struct security_mnt_opts opts;
2591 char *secdata, **mount_options;
2592 struct superblock_security_struct *sbsec = sb->s_security;
2593
2594 if (!(sbsec->flags & SE_SBINITIALIZED))
2595 return 0;
2596
2597 if (!data)
2598 return 0;
2599
2600 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2601 return 0;
2602
2603 security_init_mnt_opts(&opts);
2604 secdata = alloc_secdata();
2605 if (!secdata)
2606 return -ENOMEM;
2607 rc = selinux_sb_copy_data(data, secdata);
2608 if (rc)
2609 goto out_free_secdata;
2610
2611 rc = selinux_parse_opts_str(secdata, &opts);
2612 if (rc)
2613 goto out_free_secdata;
2614
2615 mount_options = opts.mnt_opts;
2616 flags = opts.mnt_opts_flags;
2617
2618 for (i = 0; i < opts.num_mnt_opts; i++) {
2619 u32 sid;
2620 size_t len;
2621
12f348b9 2622 if (flags[i] == SBLABEL_MNT)
026eb167
EP
2623 continue;
2624 len = strlen(mount_options[i]);
52a4c640
NA
2625 rc = security_context_to_sid(mount_options[i], len, &sid,
2626 GFP_KERNEL);
026eb167
EP
2627 if (rc) {
2628 printk(KERN_WARNING "SELinux: security_context_to_sid"
29b1deb2
LT
2629 "(%s) failed for (dev %s, type %s) errno=%d\n",
2630 mount_options[i], sb->s_id, sb->s_type->name, rc);
026eb167
EP
2631 goto out_free_opts;
2632 }
2633 rc = -EINVAL;
2634 switch (flags[i]) {
2635 case FSCONTEXT_MNT:
2636 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2637 goto out_bad_option;
2638 break;
2639 case CONTEXT_MNT:
2640 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2641 goto out_bad_option;
2642 break;
2643 case ROOTCONTEXT_MNT: {
2644 struct inode_security_struct *root_isec;
c6f493d6 2645 root_isec = d_backing_inode(sb->s_root)->i_security;
026eb167
EP
2646
2647 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2648 goto out_bad_option;
2649 break;
2650 }
2651 case DEFCONTEXT_MNT:
2652 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2653 goto out_bad_option;
2654 break;
2655 default:
2656 goto out_free_opts;
2657 }
2658 }
2659
2660 rc = 0;
2661out_free_opts:
2662 security_free_mnt_opts(&opts);
2663out_free_secdata:
2664 free_secdata(secdata);
2665 return rc;
2666out_bad_option:
2667 printk(KERN_WARNING "SELinux: unable to change security options "
29b1deb2
LT
2668 "during remount (dev %s, type=%s)\n", sb->s_id,
2669 sb->s_type->name);
026eb167
EP
2670 goto out_free_opts;
2671}
2672
12204e24 2673static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
1da177e4 2674{
88e67f3b 2675 const struct cred *cred = current_cred();
2bf49690 2676 struct common_audit_data ad;
1da177e4
LT
2677 int rc;
2678
2679 rc = superblock_doinit(sb, data);
2680 if (rc)
2681 return rc;
2682
74192246
JM
2683 /* Allow all mounts performed by the kernel */
2684 if (flags & MS_KERNMOUNT)
2685 return 0;
2686
50c205f5 2687 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2688 ad.u.dentry = sb->s_root;
88e67f3b 2689 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
1da177e4
LT
2690}
2691
726c3342 2692static int selinux_sb_statfs(struct dentry *dentry)
1da177e4 2693{
88e67f3b 2694 const struct cred *cred = current_cred();
2bf49690 2695 struct common_audit_data ad;
1da177e4 2696
50c205f5 2697 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 2698 ad.u.dentry = dentry->d_sb->s_root;
88e67f3b 2699 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT
2700}
2701
808d4e3c 2702static int selinux_mount(const char *dev_name,
b5266eb4 2703 struct path *path,
808d4e3c 2704 const char *type,
828dfe1d
EP
2705 unsigned long flags,
2706 void *data)
1da177e4 2707{
88e67f3b 2708 const struct cred *cred = current_cred();
1da177e4
LT
2709
2710 if (flags & MS_REMOUNT)
d8c9584e 2711 return superblock_has_perm(cred, path->dentry->d_sb,
828dfe1d 2712 FILESYSTEM__REMOUNT, NULL);
1da177e4 2713 else
2875fa00 2714 return path_has_perm(cred, path, FILE__MOUNTON);
1da177e4
LT
2715}
2716
2717static int selinux_umount(struct vfsmount *mnt, int flags)
2718{
88e67f3b 2719 const struct cred *cred = current_cred();
1da177e4 2720
88e67f3b 2721 return superblock_has_perm(cred, mnt->mnt_sb,
828dfe1d 2722 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT
2723}
2724
2725/* inode security operations */
2726
2727static int selinux_inode_alloc_security(struct inode *inode)
2728{
2729 return inode_alloc_security(inode);
2730}
2731
2732static void selinux_inode_free_security(struct inode *inode)
2733{
2734 inode_free_security(inode);
2735}
2736
d47be3df
DQ
2737static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2738 struct qstr *name, void **ctx,
2739 u32 *ctxlen)
2740{
d47be3df
DQ
2741 u32 newsid;
2742 int rc;
2743
c3c188b2
DH
2744 rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2745 inode_mode_to_security_class(mode),
2746 &newsid);
2747 if (rc)
2748 return rc;
d47be3df
DQ
2749
2750 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2751}
2752
5e41ff9e 2753static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
9548906b
TH
2754 const struct qstr *qstr,
2755 const char **name,
2a7dba39 2756 void **value, size_t *len)
5e41ff9e 2757{
5fb49870 2758 const struct task_security_struct *tsec = current_security();
5e41ff9e
SS
2759 struct inode_security_struct *dsec;
2760 struct superblock_security_struct *sbsec;
275bb41e 2761 u32 sid, newsid, clen;
5e41ff9e 2762 int rc;
9548906b 2763 char *context;
5e41ff9e 2764
5e41ff9e
SS
2765 dsec = dir->i_security;
2766 sbsec = dir->i_sb->s_security;
5e41ff9e 2767
275bb41e
DH
2768 sid = tsec->sid;
2769 newsid = tsec->create_sid;
2770
c3c188b2
DH
2771 rc = selinux_determine_inode_label(
2772 dir, qstr,
2773 inode_mode_to_security_class(inode->i_mode),
2774 &newsid);
2775 if (rc)
2776 return rc;
5e41ff9e 2777
296fddf7 2778 /* Possibly defer initialization to selinux_complete_init. */
0d90a7ec 2779 if (sbsec->flags & SE_SBINITIALIZED) {
296fddf7
EP
2780 struct inode_security_struct *isec = inode->i_security;
2781 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2782 isec->sid = newsid;
2783 isec->initialized = 1;
2784 }
5e41ff9e 2785
12f348b9 2786 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
25a74f3b
SS
2787 return -EOPNOTSUPP;
2788
9548906b
TH
2789 if (name)
2790 *name = XATTR_SELINUX_SUFFIX;
5e41ff9e 2791
570bc1c2 2792 if (value && len) {
12b29f34 2793 rc = security_sid_to_context_force(newsid, &context, &clen);
9548906b 2794 if (rc)
570bc1c2 2795 return rc;
570bc1c2
SS
2796 *value = context;
2797 *len = clen;
5e41ff9e 2798 }
5e41ff9e 2799
5e41ff9e
SS
2800 return 0;
2801}
2802
4acdaf27 2803static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
1da177e4
LT
2804{
2805 return may_create(dir, dentry, SECCLASS_FILE);
2806}
2807
1da177e4
LT
2808static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2809{
1da177e4
LT
2810 return may_link(dir, old_dentry, MAY_LINK);
2811}
2812
1da177e4
LT
2813static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2814{
1da177e4
LT
2815 return may_link(dir, dentry, MAY_UNLINK);
2816}
2817
2818static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2819{
2820 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2821}
2822
18bb1db3 2823static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
1da177e4
LT
2824{
2825 return may_create(dir, dentry, SECCLASS_DIR);
2826}
2827
1da177e4
LT
2828static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2829{
2830 return may_link(dir, dentry, MAY_RMDIR);
2831}
2832
1a67aafb 2833static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
1da177e4 2834{
1da177e4
LT
2835 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2836}
2837
1da177e4 2838static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2839 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT
2840{
2841 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2842}
2843
1da177e4
LT
2844static int selinux_inode_readlink(struct dentry *dentry)
2845{
88e67f3b
DH
2846 const struct cred *cred = current_cred();
2847
2875fa00 2848 return dentry_has_perm(cred, dentry, FILE__READ);
1da177e4
LT
2849}
2850
bda0be7a
N
2851static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2852 bool rcu)
1da177e4 2853{
88e67f3b 2854 const struct cred *cred = current_cred();
bda0be7a
N
2855 struct common_audit_data ad;
2856 struct inode_security_struct *isec;
2857 u32 sid;
1da177e4 2858
bda0be7a
N
2859 validate_creds(cred);
2860
2861 ad.type = LSM_AUDIT_DATA_DENTRY;
2862 ad.u.dentry = dentry;
2863 sid = cred_sid(cred);
2864 isec = inode->i_security;
2865
2866 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2867 rcu ? MAY_NOT_BLOCK : 0);
1da177e4
LT
2868}
2869
d4cf970d
EP
2870static noinline int audit_inode_permission(struct inode *inode,
2871 u32 perms, u32 audited, u32 denied,
626b9740 2872 int result,
d4cf970d 2873 unsigned flags)
1da177e4 2874{
b782e0a6 2875 struct common_audit_data ad;
d4cf970d
EP
2876 struct inode_security_struct *isec = inode->i_security;
2877 int rc;
2878
50c205f5 2879 ad.type = LSM_AUDIT_DATA_INODE;
d4cf970d
EP
2880 ad.u.inode = inode;
2881
2882 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
626b9740 2883 audited, denied, result, &ad, flags);
d4cf970d
EP
2884 if (rc)
2885 return rc;
2886 return 0;
2887}
2888
e74f71eb 2889static int selinux_inode_permission(struct inode *inode, int mask)
1da177e4 2890{
88e67f3b 2891 const struct cred *cred = current_cred();
b782e0a6
EP
2892 u32 perms;
2893 bool from_access;
cf1dd1da 2894 unsigned flags = mask & MAY_NOT_BLOCK;
2e334057
EP
2895 struct inode_security_struct *isec;
2896 u32 sid;
2897 struct av_decision avd;
2898 int rc, rc2;
2899 u32 audited, denied;
1da177e4 2900
b782e0a6 2901 from_access = mask & MAY_ACCESS;
d09ca739
EP
2902 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2903
b782e0a6
EP
2904 /* No permission to check. Existence test. */
2905 if (!mask)
1da177e4 2906 return 0;
1da177e4 2907
2e334057 2908 validate_creds(cred);
b782e0a6 2909
2e334057
EP
2910 if (unlikely(IS_PRIVATE(inode)))
2911 return 0;
b782e0a6
EP
2912
2913 perms = file_mask_to_av(inode->i_mode, mask);
2914
2e334057
EP
2915 sid = cred_sid(cred);
2916 isec = inode->i_security;
2917
2918 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2919 audited = avc_audit_required(perms, &avd, rc,
2920 from_access ? FILE__AUDIT_ACCESS : 0,
2921 &denied);
2922 if (likely(!audited))
2923 return rc;
2924
626b9740 2925 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2e334057
EP
2926 if (rc2)
2927 return rc2;
2928 return rc;
1da177e4
LT
2929}
2930
2931static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2932{
88e67f3b 2933 const struct cred *cred = current_cred();
bc6a6008 2934 unsigned int ia_valid = iattr->ia_valid;
95dbf739 2935 __u32 av = FILE__WRITE;
1da177e4 2936
bc6a6008
AW
2937 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2938 if (ia_valid & ATTR_FORCE) {
2939 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2940 ATTR_FORCE);
2941 if (!ia_valid)
2942 return 0;
2943 }
1da177e4 2944
bc6a6008
AW
2945 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2946 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2875fa00 2947 return dentry_has_perm(cred, dentry, FILE__SETATTR);
1da177e4 2948
3d2195c3 2949 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
95dbf739
EP
2950 av |= FILE__OPEN;
2951
2952 return dentry_has_perm(cred, dentry, av);
1da177e4
LT
2953}
2954
3f7036a0 2955static int selinux_inode_getattr(const struct path *path)
1da177e4 2956{
3f7036a0 2957 return path_has_perm(current_cred(), path, FILE__GETATTR);
1da177e4
LT
2958}
2959
8f0cfa52 2960static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771 2961{
88e67f3b
DH
2962 const struct cred *cred = current_cred();
2963
b5376771
SH
2964 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2965 sizeof XATTR_SECURITY_PREFIX - 1)) {
2966 if (!strcmp(name, XATTR_NAME_CAPS)) {
2967 if (!capable(CAP_SETFCAP))
2968 return -EPERM;
2969 } else if (!capable(CAP_SYS_ADMIN)) {
2970 /* A different attribute in the security namespace.
2971 Restrict to administrator. */
2972 return -EPERM;
2973 }
2974 }
2975
2976 /* Not an attribute we recognize, so just check the
2977 ordinary setattr permission. */
2875fa00 2978 return dentry_has_perm(cred, dentry, FILE__SETATTR);
b5376771
SH
2979}
2980
8f0cfa52
DH
2981static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2982 const void *value, size_t size, int flags)
1da177e4 2983{
c6f493d6 2984 struct inode *inode = d_backing_inode(dentry);
1da177e4
LT
2985 struct inode_security_struct *isec = inode->i_security;
2986 struct superblock_security_struct *sbsec;
2bf49690 2987 struct common_audit_data ad;
275bb41e 2988 u32 newsid, sid = current_sid();
1da177e4
LT
2989 int rc = 0;
2990
b5376771
SH
2991 if (strcmp(name, XATTR_NAME_SELINUX))
2992 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2993
2994 sbsec = inode->i_sb->s_security;
12f348b9 2995 if (!(sbsec->flags & SBLABEL_MNT))
1da177e4
LT
2996 return -EOPNOTSUPP;
2997
2e149670 2998 if (!inode_owner_or_capable(inode))
1da177e4
LT
2999 return -EPERM;
3000
50c205f5 3001 ad.type = LSM_AUDIT_DATA_DENTRY;
a269434d 3002 ad.u.dentry = dentry;
1da177e4 3003
275bb41e 3004 rc = avc_has_perm(sid, isec->sid, isec->sclass,
1da177e4
LT
3005 FILE__RELABELFROM, &ad);
3006 if (rc)
3007 return rc;
3008
52a4c640 3009 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
12b29f34 3010 if (rc == -EINVAL) {
d6ea83ec
EP
3011 if (!capable(CAP_MAC_ADMIN)) {
3012 struct audit_buffer *ab;
3013 size_t audit_size;
3014 const char *str;
3015
3016 /* We strip a nul only if it is at the end, otherwise the
3017 * context contains a nul and we should audit that */
e3fea3f7
AV
3018 if (value) {
3019 str = value;
3020 if (str[size - 1] == '\0')
3021 audit_size = size - 1;
3022 else
3023 audit_size = size;
3024 } else {
3025 str = "";
3026 audit_size = 0;
3027 }
d6ea83ec
EP
3028 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3029 audit_log_format(ab, "op=setxattr invalid_context=");
3030 audit_log_n_untrustedstring(ab, value, audit_size);
3031 audit_log_end(ab);
3032
12b29f34 3033 return rc;
d6ea83ec 3034 }
12b29f34
SS
3035 rc = security_context_to_sid_force(value, size, &newsid);
3036 }
1da177e4
LT
3037 if (rc)
3038 return rc;
3039
275bb41e 3040 rc = avc_has_perm(sid, newsid, isec->sclass,
1da177e4
LT
3041 FILE__RELABELTO, &ad);
3042 if (rc)
3043 return rc;
3044
275bb41e 3045 rc = security_validate_transition(isec->sid, newsid, sid,
828dfe1d 3046 isec->sclass);
1da177e4
LT
3047 if (rc)
3048 return rc;
3049
3050 return avc_has_perm(newsid,
3051 sbsec->sid,
3052 SECCLASS_FILESYSTEM,
3053 FILESYSTEM__ASSOCIATE,
3054 &ad);
3055}
3056
8f0cfa52 3057static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
f5269710 3058 const void *value, size_t size,
8f0cfa52 3059 int flags)
1da177e4 3060{
c6f493d6 3061 struct inode *inode = d_backing_inode(dentry);
1da177e4
LT
3062 struct inode_security_struct *isec = inode->i_security;
3063 u32 newsid;
3064 int rc;
3065
3066 if (strcmp(name, XATTR_NAME_SELINUX)) {
3067 /* Not an attribute we recognize, so nothing to do. */
3068 return;
3069 }
3070
12b29f34 3071 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 3072 if (rc) {
12b29f34
SS
3073 printk(KERN_ERR "SELinux: unable to map context to SID"
3074 "for (%s, %lu), rc=%d\n",
3075 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT
3076 return;
3077 }
3078
aa9c2669 3079 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 3080 isec->sid = newsid;
aa9c2669
DQ
3081 isec->initialized = 1;
3082
1da177e4
LT
3083 return;
3084}
3085
8f0cfa52 3086static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 3087{
88e67f3b
DH
3088 const struct cred *cred = current_cred();
3089
2875fa00 3090 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT
3091}
3092
828dfe1d 3093static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4 3094{
88e67f3b
DH
3095 const struct cred *cred = current_cred();
3096
2875fa00 3097 return dentry_has_perm(cred, dentry, FILE__GETATTR);
1da177e4
LT
3098}
3099
8f0cfa52 3100static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 3101{
b5376771
SH
3102 if (strcmp(name, XATTR_NAME_SELINUX))
3103 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
3104
3105 /* No one is allowed to remove a SELinux security label.
3106 You can change the label, but all data must be labeled. */
3107 return -EACCES;
3108}
3109
d381d8a9 3110/*
abc69bb6 3111 * Copy the inode security context value to the user.
d381d8a9
JM
3112 *
3113 * Permission check is handled by selinux_inode_getxattr hook.
3114 */
42492594 3115static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 3116{
42492594
DQ
3117 u32 size;
3118 int error;
3119 char *context = NULL;
1da177e4 3120 struct inode_security_struct *isec = inode->i_security;
d381d8a9 3121
8c8570fb
DK
3122 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3123 return -EOPNOTSUPP;
d381d8a9 3124
abc69bb6
SS
3125 /*
3126 * If the caller has CAP_MAC_ADMIN, then get the raw context
3127 * value even if it is not defined by current policy; otherwise,
3128 * use the in-core value under current policy.
3129 * Use the non-auditing forms of the permission checks since
3130 * getxattr may be called by unprivileged processes commonly
3131 * and lack of permission just means that we fall back to the
3132 * in-core context value, not a denial.
3133 */
b1d9e6b0
CS
3134 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3135 SECURITY_CAP_NOAUDIT);
3136 if (!error)
3137 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3138 SECURITY_CAP_NOAUDIT);
abc69bb6
SS
3139 if (!error)
3140 error = security_sid_to_context_force(isec->sid, &context,
3141 &size);
3142 else
3143 error = security_sid_to_context(isec->sid, &context, &size);
42492594
DQ
3144 if (error)
3145 return error;
3146 error = size;
3147 if (alloc) {
3148 *buffer = context;
3149 goto out_nofree;
3150 }
3151 kfree(context);
3152out_nofree:
3153 return error;
1da177e4
LT
3154}
3155
3156static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 3157 const void *value, size_t size, int flags)
1da177e4
LT
3158{
3159 struct inode_security_struct *isec = inode->i_security;
3160 u32 newsid;
3161 int rc;
3162
3163 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3164 return -EOPNOTSUPP;
3165
3166 if (!value || !size)
3167 return -EACCES;
3168
52a4c640 3169 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
1da177e4
LT
3170 if (rc)
3171 return rc;
3172
aa9c2669 3173 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4 3174 isec->sid = newsid;
ddd29ec6 3175 isec->initialized = 1;
1da177e4
LT
3176 return 0;
3177}
3178
3179static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3180{
3181 const int len = sizeof(XATTR_NAME_SELINUX);
3182 if (buffer && len <= buffer_size)
3183 memcpy(buffer, XATTR_NAME_SELINUX, len);
3184 return len;
3185}
3186
713a04ae
AD
3187static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3188{
3189 struct inode_security_struct *isec = inode->i_security;
3190 *secid = isec->sid;
3191}
3192
1da177e4
LT
3193/* file security operations */
3194
788e7dd4 3195static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 3196{
88e67f3b 3197 const struct cred *cred = current_cred();
496ad9aa 3198 struct inode *inode = file_inode(file);
1da177e4 3199
1da177e4
LT
3200 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3201 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3202 mask |= MAY_APPEND;
3203
389fb800
PM
3204 return file_has_perm(cred, file,
3205 file_mask_to_av(inode->i_mode, mask));
1da177e4
LT
3206}
3207
788e7dd4
YN
3208static int selinux_file_permission(struct file *file, int mask)
3209{
496ad9aa 3210 struct inode *inode = file_inode(file);
20dda18b
SS
3211 struct file_security_struct *fsec = file->f_security;
3212 struct inode_security_struct *isec = inode->i_security;
3213 u32 sid = current_sid();
3214
389fb800 3215 if (!mask)
788e7dd4
YN
3216 /* No permission to check. Existence test. */
3217 return 0;
788e7dd4 3218
20dda18b
SS
3219 if (sid == fsec->sid && fsec->isid == isec->sid &&
3220 fsec->pseqno == avc_policy_seqno())
83d49856 3221 /* No change since file_open check. */
20dda18b
SS
3222 return 0;
3223
788e7dd4
YN
3224 return selinux_revalidate_file_permission(file, mask);
3225}
3226
1da177e4
LT
3227static int selinux_file_alloc_security(struct file *file)
3228{
3229 return file_alloc_security(file);
3230}
3231
3232static void selinux_file_free_security(struct file *file)
3233{
3234 file_free_security(file);
3235}
3236
fa1aa143
JVS
3237/*
3238 * Check whether a task has the ioctl permission and cmd
3239 * operation to an inode.
3240 */
3241int ioctl_has_perm(const struct cred *cred, struct file *file,
3242 u32 requested, u16 cmd)
3243{
3244 struct common_audit_data ad;
3245 struct file_security_struct *fsec = file->f_security;
3246 struct inode *inode = file_inode(file);
3247 struct inode_security_struct *isec = inode->i_security;
3248 struct lsm_ioctlop_audit ioctl;
3249 u32 ssid = cred_sid(cred);
3250 int rc;
3251 u8 driver = cmd >> 8;
3252 u8 xperm = cmd & 0xff;
3253
3254 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3255 ad.u.op = &ioctl;
3256 ad.u.op->cmd = cmd;
3257 ad.u.op->path = file->f_path;
3258
3259 if (ssid != fsec->sid) {
3260 rc = avc_has_perm(ssid, fsec->sid,
3261 SECCLASS_FD,
3262 FD__USE,
3263 &ad);
3264 if (rc)
3265 goto out;
3266 }
3267
3268 if (unlikely(IS_PRIVATE(inode)))
3269 return 0;
3270
3271 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3272 requested, driver, xperm, &ad);
3273out:
3274 return rc;
3275}
3276
1da177e4
LT
3277static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3278 unsigned long arg)
3279{
88e67f3b 3280 const struct cred *cred = current_cred();
0b24dcb7 3281 int error = 0;
1da177e4 3282
0b24dcb7
EP
3283 switch (cmd) {
3284 case FIONREAD:
3285 /* fall through */
3286 case FIBMAP:
3287 /* fall through */
3288 case FIGETBSZ:
3289 /* fall through */
2f99c369 3290 case FS_IOC_GETFLAGS:
0b24dcb7 3291 /* fall through */
2f99c369 3292 case FS_IOC_GETVERSION:
0b24dcb7
EP
3293 error = file_has_perm(cred, file, FILE__GETATTR);
3294 break;
1da177e4 3295
2f99c369 3296 case FS_IOC_SETFLAGS:
0b24dcb7 3297 /* fall through */
2f99c369 3298 case FS_IOC_SETVERSION:
0b24dcb7
EP
3299 error = file_has_perm(cred, file, FILE__SETATTR);
3300 break;
3301
3302 /* sys_ioctl() checks */
3303 case FIONBIO:
3304 /* fall through */
3305 case FIOASYNC:
3306 error = file_has_perm(cred, file, 0);
3307 break;
1da177e4 3308
0b24dcb7
EP
3309 case KDSKBENT:
3310 case KDSKBSENT:
6a9de491
EP
3311 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3312 SECURITY_CAP_AUDIT);
0b24dcb7
EP
3313 break;
3314
3315 /* default case assumes that the command will go
3316 * to the file's ioctl() function.
3317 */
3318 default:
fa1aa143 3319 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
0b24dcb7
EP
3320 }
3321 return error;
1da177e4
LT
3322}
3323
fcaaade1
SS
3324static int default_noexec;
3325
1da177e4
LT
3326static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3327{
88e67f3b 3328 const struct cred *cred = current_cred();
d84f4f99 3329 int rc = 0;
88e67f3b 3330
fcaaade1 3331 if (default_noexec &&
892e8cac
SS
3332 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3333 (!shared && (prot & PROT_WRITE)))) {
1da177e4
LT
3334 /*
3335 * We are making executable an anonymous mapping or a
3336 * private file mapping that will also be writable.
3337 * This has an additional check.
3338 */
d84f4f99 3339 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
1da177e4 3340 if (rc)
d84f4f99 3341 goto error;
1da177e4 3342 }
1da177e4
LT
3343
3344 if (file) {
3345 /* read access is always possible with a mapping */
3346 u32 av = FILE__READ;
3347
3348 /* write access only matters if the mapping is shared */
3349 if (shared && (prot & PROT_WRITE))
3350 av |= FILE__WRITE;
3351
3352 if (prot & PROT_EXEC)
3353 av |= FILE__EXECUTE;
3354
88e67f3b 3355 return file_has_perm(cred, file, av);
1da177e4 3356 }
d84f4f99
DH
3357
3358error:
3359 return rc;
1da177e4
LT
3360}
3361
e5467859 3362static int selinux_mmap_addr(unsigned long addr)
1da177e4 3363{
b1d9e6b0 3364 int rc = 0;
1da177e4 3365
a2551df7 3366 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
98883bfd 3367 u32 sid = current_sid();
ed032189
EP
3368 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3369 MEMPROTECT__MMAP_ZERO, NULL);
84336d1a
EP
3370 }
3371
98883bfd 3372 return rc;
e5467859 3373}
1da177e4 3374
e5467859
AV
3375static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3376 unsigned long prot, unsigned long flags)
3377{
1da177e4
LT
3378 if (selinux_checkreqprot)
3379 prot = reqprot;
3380
3381 return file_map_prot_check(file, prot,
3382 (flags & MAP_TYPE) == MAP_SHARED);
3383}
3384
3385static int selinux_file_mprotect(struct vm_area_struct *vma,
3386 unsigned long reqprot,
3387 unsigned long prot)
3388{
88e67f3b 3389 const struct cred *cred = current_cred();
1da177e4
LT
3390
3391 if (selinux_checkreqprot)
3392 prot = reqprot;
3393
fcaaade1
SS
3394 if (default_noexec &&
3395 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
d541bbee 3396 int rc = 0;
db4c9641
SS
3397 if (vma->vm_start >= vma->vm_mm->start_brk &&
3398 vma->vm_end <= vma->vm_mm->brk) {
d84f4f99 3399 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
db4c9641
SS
3400 } else if (!vma->vm_file &&
3401 vma->vm_start <= vma->vm_mm->start_stack &&
3402 vma->vm_end >= vma->vm_mm->start_stack) {
3b11a1de 3403 rc = current_has_perm(current, PROCESS__EXECSTACK);
db4c9641
SS
3404 } else if (vma->vm_file && vma->anon_vma) {
3405 /*
3406 * We are making executable a file mapping that has
3407 * had some COW done. Since pages might have been
3408 * written, check ability to execute the possibly
3409 * modified content. This typically should only
3410 * occur for text relocations.
3411 */
d84f4f99 3412 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
db4c9641 3413 }