]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - security/selinux/hooks.c
projects / mirror_ubuntu-hirsute-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
SELinux: fix sleeping allocation in security_context_to_sid
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP		 7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT		 10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 14 * <dgoeddel@trustedcs.com>
effad8df 15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
828dfe1d 16 * Paul Moore <paul.moore@hp.com>
788e7dd4 17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT		 19 *
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
828dfe1d 22 * as published by the Free Software Foundation.
1da177e4
LT		 23 */
24
1da177e4
LT		 25#include <linux/init.h>
26#include <linux/kernel.h>
27#include <linux/ptrace.h>
28#include <linux/errno.h>
29#include <linux/sched.h>
30#include <linux/security.h>
31#include <linux/xattr.h>
32#include <linux/capability.h>
33#include <linux/unistd.h>
34#include <linux/mm.h>
35#include <linux/mman.h>
36#include <linux/slab.h>
37#include <linux/pagemap.h>
38#include <linux/swap.h>
1da177e4
LT		 39#include <linux/spinlock.h>
40#include <linux/syscalls.h>
41#include <linux/file.h>
9f3acc31 42#include <linux/fdtable.h>
1da177e4
LT		 43#include <linux/namei.h>
44#include <linux/mount.h>
45#include <linux/ext2_fs.h>
46#include <linux/proc_fs.h>
47#include <linux/kd.h>
48#include <linux/netfilter_ipv4.h>
49#include <linux/netfilter_ipv6.h>
50#include <linux/tty.h>
51#include <net/icmp.h>
227b60f5 52#include <net/ip.h> /* for local_port_range[] */
1da177e4 53#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
220deb96 54#include <net/net_namespace.h>
d621d35e 55#include <net/netlabel.h>
1da177e4 56#include <asm/uaccess.h>
1da177e4 57#include <asm/ioctls.h>
d621d35e 58#include <asm/atomic.h>
1da177e4
LT		 59#include <linux/bitops.h>
60#include <linux/interrupt.h>
61#include <linux/netdevice.h> /* for network interface checks */
62#include <linux/netlink.h>
63#include <linux/tcp.h>
64#include <linux/udp.h>
2ee92d46 65#include <linux/dccp.h>
1da177e4
LT		 66#include <linux/quota.h>
67#include <linux/un.h> /* for Unix socket types */
68#include <net/af_unix.h> /* for Unix socket types */
69#include <linux/parser.h>
70#include <linux/nfs_mount.h>
71#include <net/ipv6.h>
72#include <linux/hugetlb.h>
73#include <linux/personality.h>
74#include <linux/sysctl.h>
75#include <linux/audit.h>
6931dfc9 76#include <linux/string.h>
877ce7c1 77#include <linux/selinux.h>
23970741 78#include <linux/mutex.h>
1da177e4
LT		 79
80#include "avc.h"
81#include "objsec.h"
82#include "netif.h"
224dfbd8 83#include "netnode.h"
3e112172 84#include "netport.h"
d28d1e08 85#include "xfrm.h"
c60475bf 86#include "netlabel.h"
9d57a7f9 87#include "audit.h"
1da177e4
LT		 88
89#define XATTR_SELINUX_SUFFIX "selinux"
90#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
91
c9180a57
EP		 92#define NUM_SEL_MNT_OPTS 4
93
1da177e4
LT		 94extern unsigned int policydb_loaded_version;
95extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
4e5ab4cb 96extern int selinux_compat_net;
20510f2f 97extern struct security_operations *security_ops;
1da177e4 98
d621d35e
PM		 99/* SECMARK reference count */
100atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101
1da177e4 102#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 103int selinux_enforcing;
1da177e4
LT		 104
105static int __init enforcing_setup(char *str)
106{
828dfe1d 107 selinux_enforcing = simple_strtol(str, NULL, 0);
1da177e4
LT		 108 return 1;
109}
110__setup("enforcing=", enforcing_setup);
111#endif
112
113#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116static int __init selinux_enabled_setup(char *str)
117{
118 selinux_enabled = simple_strtol(str, NULL, 0);
119 return 1;
120}
121__setup("selinux=", selinux_enabled_setup);
30d55280
SS		 122#else
123int selinux_enabled = 1;
1da177e4
LT		 124#endif
125
126/* Original (dummy) security module. */
828dfe1d 127static struct security_operations *original_ops;
1da177e4
LT		 128
129/* Minimal support for a secondary security module,
130 just to allow the use of the dummy or capability modules.
131 The owlsm module can alternatively be used as a secondary
132 module as long as CONFIG_OWLSM_FD is not enabled. */
828dfe1d 133static struct security_operations *secondary_ops;
1da177e4
LT		 134
135/* Lists of inode and superblock security structures initialized
136 before the policy was loaded. */
137static LIST_HEAD(superblock_security_head);
138static DEFINE_SPINLOCK(sb_security_lock);
139
e18b890b 140static struct kmem_cache *sel_inode_cache;
7cae7e26 141
d621d35e
PM		 142/**
143 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
144 *
145 * Description:
146 * This function checks the SECMARK reference counter to see if any SECMARK
147 * targets are currently configured, if the reference counter is greater than
148 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
149 * enabled, false (0) if SECMARK is disabled.
150 *
151 */
152static int selinux_secmark_enabled(void)
153{
154 return (atomic_read(&selinux_secmark_refcount) > 0);
155}
156
1da177e4
LT		 157/* Allocate and free functions for each kind of security blob. */
158
159static int task_alloc_security(struct task_struct *task)
160{
161 struct task_security_struct *tsec;
162
89d155ef 163 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4
LT		 164 if (!tsec)
165 return -ENOMEM;
166
0356357c 167 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
1da177e4
LT		 168 task->security = tsec;
169
170 return 0;
171}
172
173static void task_free_security(struct task_struct *task)
174{
175 struct task_security_struct *tsec = task->security;
1da177e4
LT		 176 task->security = NULL;
177 kfree(tsec);
178}
179
180static int inode_alloc_security(struct inode *inode)
181{
182 struct task_security_struct *tsec = current->security;
183 struct inode_security_struct *isec;
184
a02fe132 185 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT		 186 if (!isec)
187 return -ENOMEM;
188
23970741 189 mutex_init(&isec->lock);
1da177e4 190 INIT_LIST_HEAD(&isec->list);
1da177e4
LT		 191 isec->inode = inode;
192 isec->sid = SECINITSID_UNLABELED;
193 isec->sclass = SECCLASS_FILE;
9ac49d22 194 isec->task_sid = tsec->sid;
1da177e4
LT		 195 inode->i_security = isec;
196
197 return 0;
198}
199
200static void inode_free_security(struct inode *inode)
201{
202 struct inode_security_struct *isec = inode->i_security;
203 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
204
1da177e4
LT		 205 spin_lock(&sbsec->isec_lock);
206 if (!list_empty(&isec->list))
207 list_del_init(&isec->list);
208 spin_unlock(&sbsec->isec_lock);
209
210 inode->i_security = NULL;
7cae7e26 211 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT		 212}
213
214static int file_alloc_security(struct file *file)
215{
216 struct task_security_struct *tsec = current->security;
217 struct file_security_struct *fsec;
218
26d2a4be 219 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT		 220 if (!fsec)
221 return -ENOMEM;
222
9ac49d22
SS		 223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
1da177e4
LT		 225 file->f_security = fsec;
226
227 return 0;
228}
229
230static void file_free_security(struct file *file)
231{
232 struct file_security_struct *fsec = file->f_security;
1da177e4
LT		 233 file->f_security = NULL;
234 kfree(fsec);
235}
236
237static int superblock_alloc_security(struct super_block *sb)
238{
239 struct superblock_security_struct *sbsec;
240
89d155ef 241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT		 242 if (!sbsec)
243 return -ENOMEM;
244
bc7e982b 245 mutex_init(&sbsec->lock);
1da177e4
LT		 246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT		 249 sbsec->sb = sb;
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
c312feb2 252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT		 253 sb->s_security = sbsec;
254
255 return 0;
256}
257
258static void superblock_free_security(struct super_block *sb)
259{
260 struct superblock_security_struct *sbsec = sb->s_security;
261
1da177e4
LT		 262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
266
267 sb->s_security = NULL;
268 kfree(sbsec);
269}
270
7d877f3b 271static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
1da177e4
LT		 272{
273 struct sk_security_struct *ssec;
274
89d155ef 275 ssec = kzalloc(sizeof(*ssec), priority);
1da177e4
LT		 276 if (!ssec)
277 return -ENOMEM;
278
1da177e4 279 ssec->peer_sid = SECINITSID_UNLABELED;
892c141e 280 ssec->sid = SECINITSID_UNLABELED;
1da177e4
LT		 281 sk->sk_security = ssec;
282
f74af6e8 283 selinux_netlbl_sk_security_reset(ssec, family);
99f59ed0 284
1da177e4
LT		 285 return 0;
286}
287
288static void sk_free_security(struct sock *sk)
289{
290 struct sk_security_struct *ssec = sk->sk_security;
291
1da177e4
LT		 292 sk->sk_security = NULL;
293 kfree(ssec);
294}
1da177e4
LT		 295
296/* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298extern int ss_initialized;
299
300/* The file system's label must be initialized prior to use. */
301
302static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309};
310
311static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313static inline int inode_doinit(struct inode *inode)
314{
315 return inode_doinit_with_dentry(inode, NULL);
316}
317
318enum {
31e87930 319 Opt_error = -1,
1da177e4
LT		 320 Opt_context = 1,
321 Opt_fscontext = 2,
c9180a57
EP		 322 Opt_defcontext = 3,
323 Opt_rootcontext = 4,
1da177e4
LT		 324};
325
326static match_table_t tokens = {
832cbd9a
EP		 327 {Opt_context, CONTEXT_STR "%s"},
328 {Opt_fscontext, FSCONTEXT_STR "%s"},
329 {Opt_defcontext, DEFCONTEXT_STR "%s"},
330 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
31e87930 331 {Opt_error, NULL},
1da177e4
LT		 332};
333
334#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335
c312feb2
EP		 336static int may_context_mount_sb_relabel(u32 sid,
337 struct superblock_security_struct *sbsec,
338 struct task_security_struct *tsec)
339{
340 int rc;
341
342 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
343 FILESYSTEM__RELABELFROM, NULL);
344 if (rc)
345 return rc;
346
347 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELTO, NULL);
349 return rc;
350}
351
0808925e
EP		 352static int may_context_mount_inode_relabel(u32 sid,
353 struct superblock_security_struct *sbsec,
354 struct task_security_struct *tsec)
355{
356 int rc;
357 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
358 FILESYSTEM__RELABELFROM, NULL);
359 if (rc)
360 return rc;
361
362 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
363 FILESYSTEM__ASSOCIATE, NULL);
364 return rc;
365}
366
c9180a57 367static int sb_finish_set_opts(struct super_block *sb)
1da177e4 368{
1da177e4 369 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57
EP		 370 struct dentry *root = sb->s_root;
371 struct inode *root_inode = root->d_inode;
372 int rc = 0;
1da177e4 373
c9180a57
EP		 374 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
375 /* Make sure that the xattr handler exists and that no
376 error other than -ENODATA is returned by getxattr on
377 the root directory. -ENODATA is ok, as this may be
378 the first boot of the SELinux kernel before we have
379 assigned xattr values to the filesystem. */
380 if (!root_inode->i_op->getxattr) {
381 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
382 "xattr support\n", sb->s_id, sb->s_type->name);
383 rc = -EOPNOTSUPP;
384 goto out;
385 }
386 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
387 if (rc < 0 && rc != -ENODATA) {
388 if (rc == -EOPNOTSUPP)
389 printk(KERN_WARNING "SELinux: (dev %s, type "
390 "%s) has no security xattr handler\n",
391 sb->s_id, sb->s_type->name);
392 else
393 printk(KERN_WARNING "SELinux: (dev %s, type "
394 "%s) getxattr errno %d\n", sb->s_id,
395 sb->s_type->name, -rc);
396 goto out;
397 }
398 }
1da177e4 399
c9180a57 400 sbsec->initialized = 1;
1da177e4 401
c9180a57
EP		 402 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
403 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
404 sb->s_id, sb->s_type->name);
405 else
406 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
407 sb->s_id, sb->s_type->name,
408 labeling_behaviors[sbsec->behavior-1]);
1da177e4 409
c9180a57
EP		 410 /* Initialize the root inode. */
411 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 412
c9180a57
EP		 413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
416 populates itself. */
417 spin_lock(&sbsec->isec_lock);
418next_inode:
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
422 struct inode_security_struct, list);
423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
426 if (inode) {
427 if (!IS_PRIVATE(inode))
428 inode_doinit(inode);
429 iput(inode);
430 }
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
433 goto next_inode;
434 }
435 spin_unlock(&sbsec->isec_lock);
436out:
437 return rc;
438}
1da177e4 439
c9180a57
EP		 440/*
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
444 */
445static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 446 struct security_mnt_opts *opts)
c9180a57
EP		 447{
448 int rc = 0, i;
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
451 u32 len;
452 char tmp;
1da177e4 453
e0007529 454 security_init_mnt_opts(opts);
1da177e4 455
c9180a57
EP		 456 if (!sbsec->initialized)
457 return -EINVAL;
1da177e4 458
c9180a57
EP		 459 if (!ss_initialized)
460 return -EINVAL;
1da177e4 461
c9180a57
EP		 462 /*
463 * if we ever use sbsec flags for anything other than tracking mount
464 * settings this is going to need a mask
465 */
466 tmp = sbsec->flags;
467 /* count the number of mount options for this sb */
468 for (i = 0; i < 8; i++) {
469 if (tmp & 0x01)
e0007529 470 opts->num_mnt_opts++;
c9180a57
EP		 471 tmp >>= 1;
472 }
1da177e4 473
e0007529
EP		 474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
c9180a57
EP		 476 rc = -ENOMEM;
477 goto out_free;
478 }
1da177e4 479
e0007529
EP		 480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
c9180a57
EP		 482 rc = -ENOMEM;
483 goto out_free;
484 }
1da177e4 485
c9180a57
EP		 486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
e0007529
EP		 491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP		 493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
e0007529
EP		 498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP		 500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
e0007529
EP		 505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP		 507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
0808925e 511
c9180a57
EP		 512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
e0007529
EP		 515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 517 }
1da177e4 518
e0007529 519 BUG_ON(i != opts->num_mnt_opts);
1da177e4 520
c9180a57
EP		 521 return 0;
522
523out_free:
e0007529 524 security_free_mnt_opts(opts);
c9180a57
EP		 525 return rc;
526}
1da177e4 527
c9180a57
EP		 528static int bad_option(struct superblock_security_struct *sbsec, char flag,
529 u32 old_sid, u32 new_sid)
530{
531 /* check if the old mount command had the same options */
532 if (sbsec->initialized)
533 if (!(sbsec->flags & flag) ||
534 (old_sid != new_sid))
535 return 1;
536
537 /* check if we were passed the same options twice,
538 * aka someone passed context=a,context=b
539 */
540 if (!sbsec->initialized)
541 if (sbsec->flags & flag)
542 return 1;
543 return 0;
544}
e0007529 545
c9180a57
EP		 546/*
547 * Allow filesystems with binary mount data to explicitly set mount point
548 * labeling information.
549 */
e0007529
EP		 550static int selinux_set_mnt_opts(struct super_block *sb,
551 struct security_mnt_opts *opts)
c9180a57
EP		 552{
553 int rc = 0, i;
554 struct task_security_struct *tsec = current->security;
555 struct superblock_security_struct *sbsec = sb->s_security;
556 const char *name = sb->s_type->name;
557 struct inode *inode = sbsec->sb->s_root->d_inode;
558 struct inode_security_struct *root_isec = inode->i_security;
559 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
560 u32 defcontext_sid = 0;
e0007529
EP		 561 char **mount_options = opts->mnt_opts;
562 int *flags = opts->mnt_opts_flags;
563 int num_opts = opts->num_mnt_opts;
c9180a57
EP		 564
565 mutex_lock(&sbsec->lock);
566
567 if (!ss_initialized) {
568 if (!num_opts) {
569 /* Defer initialization until selinux_complete_init,
570 after the initial policy is loaded and the security
571 server is ready to handle calls. */
572 spin_lock(&sb_security_lock);
573 if (list_empty(&sbsec->list))
574 list_add(&sbsec->list, &superblock_security_head);
575 spin_unlock(&sb_security_lock);
576 goto out;
577 }
578 rc = -EINVAL;
744ba35e
EP		 579 printk(KERN_WARNING "SELinux: Unable to set superblock options "
580 "before the security server is initialized\n");
1da177e4 581 goto out;
c9180a57 582 }
1da177e4 583
e0007529
EP		 584 /*
585 * Binary mount data FS will come through this function twice. Once
586 * from an explicit call and once from the generic calls from the vfs.
587 * Since the generic VFS calls will not contain any security mount data
588 * we need to skip the double mount verification.
589 *
590 * This does open a hole in which we will not notice if the first
591 * mount using this sb set explict options and a second mount using
592 * this sb does not set any security options. (The first options
593 * will be used for both mounts)
594 */
595 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
596 && (num_opts == 0))
597 goto out;
598
c9180a57
EP		 599 /*
600 * parse the mount options, check if they are valid sids.
601 * also check if someone is trying to mount the same sb more
602 * than once with different security options.
603 */
604 for (i = 0; i < num_opts; i++) {
605 u32 sid;
606 rc = security_context_to_sid(mount_options[i],
607 strlen(mount_options[i]), &sid);
1da177e4
LT		 608 if (rc) {
609 printk(KERN_WARNING "SELinux: security_context_to_sid"
610 "(%s) failed for (dev %s, type %s) errno=%d\n",
c9180a57
EP		 611 mount_options[i], sb->s_id, name, rc);
612 goto out;
613 }
614 switch (flags[i]) {
615 case FSCONTEXT_MNT:
616 fscontext_sid = sid;
617
618 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
619 fscontext_sid))
620 goto out_double_mount;
621
622 sbsec->flags |= FSCONTEXT_MNT;
623 break;
624 case CONTEXT_MNT:
625 context_sid = sid;
626
627 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
628 context_sid))
629 goto out_double_mount;
630
631 sbsec->flags |= CONTEXT_MNT;
632 break;
633 case ROOTCONTEXT_MNT:
634 rootcontext_sid = sid;
635
636 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
637 rootcontext_sid))
638 goto out_double_mount;
639
640 sbsec->flags |= ROOTCONTEXT_MNT;
641
642 break;
643 case DEFCONTEXT_MNT:
644 defcontext_sid = sid;
645
646 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
647 defcontext_sid))
648 goto out_double_mount;
649
650 sbsec->flags |= DEFCONTEXT_MNT;
651
652 break;
653 default:
654 rc = -EINVAL;
655 goto out;
1da177e4 656 }
c9180a57
EP		 657 }
658
659 if (sbsec->initialized) {
660 /* previously mounted with options, but not on this attempt? */
661 if (sbsec->flags && !num_opts)
662 goto out_double_mount;
663 rc = 0;
664 goto out;
665 }
666
667 if (strcmp(sb->s_type->name, "proc") == 0)
668 sbsec->proc = 1;
669
670 /* Determine the labeling behavior to use for this filesystem type. */
671 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
672 if (rc) {
673 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
dd6f953a 674 __func__, sb->s_type->name, rc);
c9180a57
EP		 675 goto out;
676 }
1da177e4 677
c9180a57
EP		 678 /* sets the context of the superblock for the fs being mounted. */
679 if (fscontext_sid) {
680
681 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
1da177e4 682 if (rc)
c9180a57 683 goto out;
1da177e4 684
c9180a57 685 sbsec->sid = fscontext_sid;
c312feb2
EP		 686 }
687
688 /*
689 * Switch to using mount point labeling behavior.
690 * sets the label used on all file below the mountpoint, and will set
691 * the superblock context if not already set.
692 */
c9180a57
EP		 693 if (context_sid) {
694 if (!fscontext_sid) {
695 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
b04ea3ce 696 if (rc)
c9180a57
EP		 697 goto out;
698 sbsec->sid = context_sid;
b04ea3ce 699 } else {
c9180a57 700 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
b04ea3ce 701 if (rc)
c9180a57 702 goto out;
b04ea3ce 703 }
c9180a57
EP		 704 if (!rootcontext_sid)
705 rootcontext_sid = context_sid;
1da177e4 706
c9180a57 707 sbsec->mntpoint_sid = context_sid;
c312feb2 708 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT		 709 }
710
c9180a57
EP		 711 if (rootcontext_sid) {
712 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
0808925e 713 if (rc)
c9180a57 714 goto out;
0808925e 715
c9180a57
EP		 716 root_isec->sid = rootcontext_sid;
717 root_isec->initialized = 1;
0808925e
EP		 718 }
719
c9180a57
EP		 720 if (defcontext_sid) {
721 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
722 rc = -EINVAL;
723 printk(KERN_WARNING "SELinux: defcontext option is "
724 "invalid for this filesystem type\n");
725 goto out;
1da177e4
LT		 726 }
727
c9180a57
EP		 728 if (defcontext_sid != sbsec->def_sid) {
729 rc = may_context_mount_inode_relabel(defcontext_sid,
730 sbsec, tsec);
731 if (rc)
732 goto out;
733 }
1da177e4 734
c9180a57 735 sbsec->def_sid = defcontext_sid;
1da177e4
LT		 736 }
737
c9180a57 738 rc = sb_finish_set_opts(sb);
1da177e4 739out:
c9180a57 740 mutex_unlock(&sbsec->lock);
1da177e4 741 return rc;
c9180a57
EP		 742out_double_mount:
743 rc = -EINVAL;
744 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
745 "security settings for (dev %s, type %s)\n", sb->s_id, name);
746 goto out;
1da177e4
LT		 747}
748
c9180a57
EP		 749static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
750 struct super_block *newsb)
1da177e4 751{
c9180a57
EP		 752 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
753 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 754
c9180a57
EP		 755 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
756 int set_context = (oldsbsec->flags & CONTEXT_MNT);
757 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 758
0f5e6420
EP		 759 /*
760 * if the parent was able to be mounted it clearly had no special lsm
761 * mount options. thus we can safely put this sb on the list and deal
762 * with it later
763 */
764 if (!ss_initialized) {
765 spin_lock(&sb_security_lock);
766 if (list_empty(&newsbsec->list))
767 list_add(&newsbsec->list, &superblock_security_head);
768 spin_unlock(&sb_security_lock);
769 return;
770 }
c9180a57 771
c9180a57
EP		 772 /* how can we clone if the old one wasn't set up?? */
773 BUG_ON(!oldsbsec->initialized);
774
5a552617
EP		 775 /* if fs is reusing a sb, just let its options stand... */
776 if (newsbsec->initialized)
777 return;
778
c9180a57
EP		 779 mutex_lock(&newsbsec->lock);
780
781 newsbsec->flags = oldsbsec->flags;
782
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
786
787 if (set_context) {
788 u32 sid = oldsbsec->mntpoint_sid;
789
790 if (!set_fscontext)
791 newsbsec->sid = sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
795 newisec->sid = sid;
796 }
797 newsbsec->mntpoint_sid = sid;
1da177e4 798 }
c9180a57
EP		 799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 804
c9180a57 805 newisec->sid = oldisec->sid;
1da177e4
LT		 806 }
807
c9180a57
EP		 808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
810}
811
2e1479d9
AB		 812static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
c9180a57 814{
e0007529 815 char *p;
c9180a57
EP		 816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
e0007529 818 int rc, num_mnt_opts = 0;
1da177e4 819
e0007529 820 opts->num_mnt_opts = 0;
1da177e4 821
c9180a57
EP		 822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
824 int token;
825 substring_t args[MAX_OPT_ARGS];
1da177e4 826
c9180a57
EP		 827 if (!*p)
828 continue;
1da177e4 829
c9180a57 830 token = match_token(p, tokens, args);
1da177e4 831
c9180a57
EP		 832 switch (token) {
833 case Opt_context:
834 if (context || defcontext) {
835 rc = -EINVAL;
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
837 goto out_err;
838 }
839 context = match_strdup(&args[0]);
840 if (!context) {
841 rc = -ENOMEM;
842 goto out_err;
843 }
844 break;
845
846 case Opt_fscontext:
847 if (fscontext) {
848 rc = -EINVAL;
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
850 goto out_err;
851 }
852 fscontext = match_strdup(&args[0]);
853 if (!fscontext) {
854 rc = -ENOMEM;
855 goto out_err;
856 }
857 break;
858
859 case Opt_rootcontext:
860 if (rootcontext) {
861 rc = -EINVAL;
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
863 goto out_err;
864 }
865 rootcontext = match_strdup(&args[0]);
866 if (!rootcontext) {
867 rc = -ENOMEM;
868 goto out_err;
869 }
870 break;
871
872 case Opt_defcontext:
873 if (context || defcontext) {
874 rc = -EINVAL;
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
876 goto out_err;
877 }
878 defcontext = match_strdup(&args[0]);
879 if (!defcontext) {
880 rc = -ENOMEM;
881 goto out_err;
882 }
883 break;
884
885 default:
886 rc = -EINVAL;
887 printk(KERN_WARNING "SELinux: unknown mount option\n");
888 goto out_err;
1da177e4 889
1da177e4 890 }
1da177e4 891 }
c9180a57 892
e0007529
EP		 893 rc = -ENOMEM;
894 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
895 if (!opts->mnt_opts)
896 goto out_err;
897
898 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
899 if (!opts->mnt_opts_flags) {
900 kfree(opts->mnt_opts);
901 goto out_err;
902 }
903
c9180a57 904 if (fscontext) {
e0007529
EP		 905 opts->mnt_opts[num_mnt_opts] = fscontext;
906 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP		 907 }
908 if (context) {
e0007529
EP		 909 opts->mnt_opts[num_mnt_opts] = context;
910 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP		 911 }
912 if (rootcontext) {
e0007529
EP		 913 opts->mnt_opts[num_mnt_opts] = rootcontext;
914 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP		 915 }
916 if (defcontext) {
e0007529
EP		 917 opts->mnt_opts[num_mnt_opts] = defcontext;
918 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP		 919 }
920
e0007529
EP		 921 opts->num_mnt_opts = num_mnt_opts;
922 return 0;
923
c9180a57
EP		 924out_err:
925 kfree(context);
926 kfree(defcontext);
927 kfree(fscontext);
928 kfree(rootcontext);
1da177e4
LT		 929 return rc;
930}
e0007529
EP		 931/*
932 * string mount options parsing and call set the sbsec
933 */
934static int superblock_doinit(struct super_block *sb, void *data)
935{
936 int rc = 0;
937 char *options = data;
938 struct security_mnt_opts opts;
939
940 security_init_mnt_opts(&opts);
941
942 if (!data)
943 goto out;
944
945 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
946
947 rc = selinux_parse_opts_str(options, &opts);
948 if (rc)
949 goto out_err;
950
951out:
952 rc = selinux_set_mnt_opts(sb, &opts);
953
954out_err:
955 security_free_mnt_opts(&opts);
956 return rc;
957}
1da177e4
LT		 958
959static inline u16 inode_mode_to_security_class(umode_t mode)
960{
961 switch (mode & S_IFMT) {
962 case S_IFSOCK:
963 return SECCLASS_SOCK_FILE;
964 case S_IFLNK:
965 return SECCLASS_LNK_FILE;
966 case S_IFREG:
967 return SECCLASS_FILE;
968 case S_IFBLK:
969 return SECCLASS_BLK_FILE;
970 case S_IFDIR:
971 return SECCLASS_DIR;
972 case S_IFCHR:
973 return SECCLASS_CHR_FILE;
974 case S_IFIFO:
975 return SECCLASS_FIFO_FILE;
976
977 }
978
979 return SECCLASS_FILE;
980}
981
13402580
JM		 982static inline int default_protocol_stream(int protocol)
983{
984 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
985}
986
987static inline int default_protocol_dgram(int protocol)
988{
989 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
990}
991
1da177e4
LT		 992static inline u16 socket_type_to_security_class(int family, int type, int protocol)
993{
994 switch (family) {
995 case PF_UNIX:
996 switch (type) {
997 case SOCK_STREAM:
998 case SOCK_SEQPACKET:
999 return SECCLASS_UNIX_STREAM_SOCKET;
1000 case SOCK_DGRAM:
1001 return SECCLASS_UNIX_DGRAM_SOCKET;
1002 }
1003 break;
1004 case PF_INET:
1005 case PF_INET6:
1006 switch (type) {
1007 case SOCK_STREAM:
13402580
JM		 1008 if (default_protocol_stream(protocol))
1009 return SECCLASS_TCP_SOCKET;
1010 else
1011 return SECCLASS_RAWIP_SOCKET;
1da177e4 1012 case SOCK_DGRAM:
13402580
JM		 1013 if (default_protocol_dgram(protocol))
1014 return SECCLASS_UDP_SOCKET;
1015 else
1016 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM		 1017 case SOCK_DCCP:
1018 return SECCLASS_DCCP_SOCKET;
13402580 1019 default:
1da177e4
LT		 1020 return SECCLASS_RAWIP_SOCKET;
1021 }
1022 break;
1023 case PF_NETLINK:
1024 switch (protocol) {
1025 case NETLINK_ROUTE:
1026 return SECCLASS_NETLINK_ROUTE_SOCKET;
1027 case NETLINK_FIREWALL:
1028 return SECCLASS_NETLINK_FIREWALL_SOCKET;
216efaaa 1029 case NETLINK_INET_DIAG:
1da177e4
LT		 1030 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1031 case NETLINK_NFLOG:
1032 return SECCLASS_NETLINK_NFLOG_SOCKET;
1033 case NETLINK_XFRM:
1034 return SECCLASS_NETLINK_XFRM_SOCKET;
1035 case NETLINK_SELINUX:
1036 return SECCLASS_NETLINK_SELINUX_SOCKET;
1037 case NETLINK_AUDIT:
1038 return SECCLASS_NETLINK_AUDIT_SOCKET;
1039 case NETLINK_IP6_FW:
1040 return SECCLASS_NETLINK_IP6FW_SOCKET;
1041 case NETLINK_DNRTMSG:
1042 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 1043 case NETLINK_KOBJECT_UEVENT:
1044 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 1045 default:
1046 return SECCLASS_NETLINK_SOCKET;
1047 }
1048 case PF_PACKET:
1049 return SECCLASS_PACKET_SOCKET;
1050 case PF_KEY:
1051 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP		 1052 case PF_APPLETALK:
1053 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT		 1054 }
1055
1056 return SECCLASS_SOCKET;
1057}
1058
1059#ifdef CONFIG_PROC_FS
1060static int selinux_proc_get_sid(struct proc_dir_entry *de,
1061 u16 tclass,
1062 u32 *sid)
1063{
1064 int buflen, rc;
1065 char *buffer, *path, *end;
1066
828dfe1d 1067 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT		 1068 if (!buffer)
1069 return -ENOMEM;
1070
1071 buflen = PAGE_SIZE;
1072 end = buffer+buflen;
1073 *--end = '\0';
1074 buflen--;
1075 path = end-1;
1076 *path = '/';
1077 while (de && de != de->parent) {
1078 buflen -= de->namelen + 1;
1079 if (buflen < 0)
1080 break;
1081 end -= de->namelen;
1082 memcpy(end, de->name, de->namelen);
1083 *--end = '/';
1084 path = end;
1085 de = de->parent;
1086 }
1087 rc = security_genfs_sid("proc", path, tclass, sid);
1088 free_page((unsigned long)buffer);
1089 return rc;
1090}
1091#else
1092static int selinux_proc_get_sid(struct proc_dir_entry *de,
1093 u16 tclass,
1094 u32 *sid)
1095{
1096 return -EINVAL;
1097}
1098#endif
1099
1100/* The inode's security attributes must be initialized before first use. */
1101static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1102{
1103 struct superblock_security_struct *sbsec = NULL;
1104 struct inode_security_struct *isec = inode->i_security;
1105 u32 sid;
1106 struct dentry *dentry;
1107#define INITCONTEXTLEN 255
1108 char *context = NULL;
1109 unsigned len = 0;
1110 int rc = 0;
1da177e4
LT		 1111
1112 if (isec->initialized)
1113 goto out;
1114
23970741 1115 mutex_lock(&isec->lock);
1da177e4 1116 if (isec->initialized)
23970741 1117 goto out_unlock;
1da177e4
LT		 1118
1119 sbsec = inode->i_sb->s_security;
1120 if (!sbsec->initialized) {
1121 /* Defer initialization until selinux_complete_init,
1122 after the initial policy is loaded and the security
1123 server is ready to handle calls. */
1124 spin_lock(&sbsec->isec_lock);
1125 if (list_empty(&isec->list))
1126 list_add(&isec->list, &sbsec->isec_head);
1127 spin_unlock(&sbsec->isec_lock);
23970741 1128 goto out_unlock;
1da177e4
LT		 1129 }
1130
1131 switch (sbsec->behavior) {
1132 case SECURITY_FS_USE_XATTR:
1133 if (!inode->i_op->getxattr) {
1134 isec->sid = sbsec->def_sid;
1135 break;
1136 }
1137
1138 /* Need a dentry, since the xattr API requires one.
1139 Life would be simpler if we could just pass the inode. */
1140 if (opt_dentry) {
1141 /* Called from d_instantiate or d_splice_alias. */
1142 dentry = dget(opt_dentry);
1143 } else {
1144 /* Called from selinux_complete_init, try to find a dentry. */
1145 dentry = d_find_alias(inode);
1146 }
1147 if (!dentry) {
744ba35e 1148 printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
dd6f953a 1149 "ino=%ld\n", __func__, inode->i_sb->s_id,
1da177e4 1150 inode->i_ino);
23970741 1151 goto out_unlock;
1da177e4
LT		 1152 }
1153
1154 len = INITCONTEXTLEN;
869ab514 1155 context = kmalloc(len, GFP_NOFS);
1da177e4
LT		 1156 if (!context) {
1157 rc = -ENOMEM;
1158 dput(dentry);
23970741 1159 goto out_unlock;
1da177e4
LT		 1160 }
1161 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1162 context, len);
1163 if (rc == -ERANGE) {
1164 /* Need a larger buffer. Query for the right size. */
1165 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1166 NULL, 0);
1167 if (rc < 0) {
1168 dput(dentry);
23970741 1169 goto out_unlock;
1da177e4
LT		 1170 }
1171 kfree(context);
1172 len = rc;
869ab514 1173 context = kmalloc(len, GFP_NOFS);
1da177e4
LT		 1174 if (!context) {
1175 rc = -ENOMEM;
1176 dput(dentry);
23970741 1177 goto out_unlock;
1da177e4
LT		 1178 }
1179 rc = inode->i_op->getxattr(dentry,
1180 XATTR_NAME_SELINUX,
1181 context, len);
1182 }
1183 dput(dentry);
1184 if (rc < 0) {
1185 if (rc != -ENODATA) {
744ba35e 1186 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1187 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT		 1188 -rc, inode->i_sb->s_id, inode->i_ino);
1189 kfree(context);
23970741 1190 goto out_unlock;
1da177e4
LT		 1191 }
1192 /* Map ENODATA to the default file SID */
1193 sid = sbsec->def_sid;
1194 rc = 0;
1195 } else {
f5c1d5b2 1196 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS		 1197 sbsec->def_sid,
1198 GFP_NOFS);
1da177e4 1199 if (rc) {
744ba35e 1200 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1da177e4 1201 "returned %d for dev=%s ino=%ld\n",
dd6f953a 1202 __func__, context, -rc,
1da177e4
LT		 1203 inode->i_sb->s_id, inode->i_ino);
1204 kfree(context);
1205 /* Leave with the unlabeled SID */
1206 rc = 0;
1207 break;
1208 }
1209 }
1210 kfree(context);
1211 isec->sid = sid;
1212 break;
1213 case SECURITY_FS_USE_TASK:
1214 isec->sid = isec->task_sid;
1215 break;
1216 case SECURITY_FS_USE_TRANS:
1217 /* Default to the fs SID. */
1218 isec->sid = sbsec->sid;
1219
1220 /* Try to obtain a transition SID. */
1221 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1222 rc = security_transition_sid(isec->task_sid,
1223 sbsec->sid,
1224 isec->sclass,
1225 &sid);
1226 if (rc)
23970741 1227 goto out_unlock;
1da177e4
LT		 1228 isec->sid = sid;
1229 break;
c312feb2
EP		 1230 case SECURITY_FS_USE_MNTPOINT:
1231 isec->sid = sbsec->mntpoint_sid;
1232 break;
1da177e4 1233 default:
c312feb2 1234 /* Default to the fs superblock SID. */
1da177e4
LT		 1235 isec->sid = sbsec->sid;
1236
1237 if (sbsec->proc) {
1238 struct proc_inode *proci = PROC_I(inode);
1239 if (proci->pde) {
1240 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1241 rc = selinux_proc_get_sid(proci->pde,
1242 isec->sclass,
1243 &sid);
1244 if (rc)
23970741 1245 goto out_unlock;
1da177e4
LT		 1246 isec->sid = sid;
1247 }
1248 }
1249 break;
1250 }
1251
1252 isec->initialized = 1;
1253
23970741
EP		 1254out_unlock:
1255 mutex_unlock(&isec->lock);
1da177e4
LT		 1256out:
1257 if (isec->sclass == SECCLASS_FILE)
1258 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT		 1259 return rc;
1260}
1261
1262/* Convert a Linux signal to an access vector. */
1263static inline u32 signal_to_av(int sig)
1264{
1265 u32 perm = 0;
1266
1267 switch (sig) {
1268 case SIGCHLD:
1269 /* Commonly granted from child to parent. */
1270 perm = PROCESS__SIGCHLD;
1271 break;
1272 case SIGKILL:
1273 /* Cannot be caught or ignored */
1274 perm = PROCESS__SIGKILL;
1275 break;
1276 case SIGSTOP:
1277 /* Cannot be caught or ignored */
1278 perm = PROCESS__SIGSTOP;
1279 break;
1280 default:
1281 /* All other signals. */
1282 perm = PROCESS__SIGNAL;
1283 break;
1284 }
1285
1286 return perm;
1287}
1288
1289/* Check permission betweeen a pair of tasks, e.g. signal checks,
1290 fork check, ptrace check, etc. */
1291static int task_has_perm(struct task_struct *tsk1,
1292 struct task_struct *tsk2,
1293 u32 perms)
1294{
1295 struct task_security_struct *tsec1, *tsec2;
1296
1297 tsec1 = tsk1->security;
1298 tsec2 = tsk2->security;
1299 return avc_has_perm(tsec1->sid, tsec2->sid,
1300 SECCLASS_PROCESS, perms, NULL);
1301}
1302
b68e418c
SS		 1303#if CAP_LAST_CAP > 63
1304#error Fix SELinux to handle capabilities > 63.
1305#endif
1306
1da177e4
LT		 1307/* Check whether a task is allowed to use a capability. */
1308static int task_has_capability(struct task_struct *tsk,
1309 int cap)
1310{
1311 struct task_security_struct *tsec;
1312 struct avc_audit_data ad;
b68e418c
SS		 1313 u16 sclass;
1314 u32 av = CAP_TO_MASK(cap);
1da177e4
LT		 1315
1316 tsec = tsk->security;
1317
828dfe1d 1318 AVC_AUDIT_DATA_INIT(&ad, CAP);
1da177e4
LT		 1319 ad.tsk = tsk;
1320 ad.u.cap = cap;
1321
b68e418c
SS		 1322 switch (CAP_TO_INDEX(cap)) {
1323 case 0:
1324 sclass = SECCLASS_CAPABILITY;
1325 break;
1326 case 1:
1327 sclass = SECCLASS_CAPABILITY2;
1328 break;
1329 default:
1330 printk(KERN_ERR
1331 "SELinux: out of range capability %d\n", cap);
1332 BUG();
1333 }
1334 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1da177e4
LT		 1335}
1336
1337/* Check whether a task is allowed to use a system operation. */
1338static int task_has_system(struct task_struct *tsk,
1339 u32 perms)
1340{
1341 struct task_security_struct *tsec;
1342
1343 tsec = tsk->security;
1344
1345 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1346 SECCLASS_SYSTEM, perms, NULL);
1347}
1348
1349/* Check whether a task has a particular permission to an inode.
1350 The 'adp' parameter is optional and allows other audit
1351 data to be passed (e.g. the dentry). */
1352static int inode_has_perm(struct task_struct *tsk,
1353 struct inode *inode,
1354 u32 perms,
1355 struct avc_audit_data *adp)
1356{
1357 struct task_security_struct *tsec;
1358 struct inode_security_struct *isec;
1359 struct avc_audit_data ad;
1360
828dfe1d 1361 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS		 1362 return 0;
1363
1da177e4
LT		 1364 tsec = tsk->security;
1365 isec = inode->i_security;
1366
1367 if (!adp) {
1368 adp = &ad;
1369 AVC_AUDIT_DATA_INIT(&ad, FS);
1370 ad.u.fs.inode = inode;
1371 }
1372
1373 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1374}
1375
1376/* Same as inode_has_perm, but pass explicit audit data containing
1377 the dentry to help the auditing code to more easily generate the
1378 pathname if needed. */
1379static inline int dentry_has_perm(struct task_struct *tsk,
1380 struct vfsmount *mnt,
1381 struct dentry *dentry,
1382 u32 av)
1383{
1384 struct inode *inode = dentry->d_inode;
1385 struct avc_audit_data ad;
828dfe1d 1386 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf
JB		 1387 ad.u.fs.path.mnt = mnt;
1388 ad.u.fs.path.dentry = dentry;
1da177e4
LT		 1389 return inode_has_perm(tsk, inode, av, &ad);
1390}
1391
1392/* Check whether a task can use an open file descriptor to
1393 access an inode in a given way. Check access to the
1394 descriptor itself, and then use dentry_has_perm to
1395 check a particular permission to the file.
1396 Access to the descriptor is implicitly granted if it
1397 has the same SID as the process. If av is zero, then
1398 access to the file is not checked, e.g. for cases
1399 where only the descriptor is affected like seek. */
858119e1 1400static int file_has_perm(struct task_struct *tsk,
1da177e4
LT		 1401 struct file *file,
1402 u32 av)
1403{
1404 struct task_security_struct *tsec = tsk->security;
1405 struct file_security_struct *fsec = file->f_security;
44707fdf 1406 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 1407 struct avc_audit_data ad;
1408 int rc;
1409
1410 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1411 ad.u.fs.path = file->f_path;
1da177e4
LT		 1412
1413 if (tsec->sid != fsec->sid) {
1414 rc = avc_has_perm(tsec->sid, fsec->sid,
1415 SECCLASS_FD,
1416 FD__USE,
1417 &ad);
1418 if (rc)
1419 return rc;
1420 }
1421
1422 /* av is zero if only checking access to the descriptor. */
1423 if (av)
1424 return inode_has_perm(tsk, inode, av, &ad);
1425
1426 return 0;
1427}
1428
1429/* Check whether a task can create a file. */
1430static int may_create(struct inode *dir,
1431 struct dentry *dentry,
1432 u16 tclass)
1433{
1434 struct task_security_struct *tsec;
1435 struct inode_security_struct *dsec;
1436 struct superblock_security_struct *sbsec;
1437 u32 newsid;
1438 struct avc_audit_data ad;
1439 int rc;
1440
1441 tsec = current->security;
1442 dsec = dir->i_security;
1443 sbsec = dir->i_sb->s_security;
1444
1445 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1446 ad.u.fs.path.dentry = dentry;
1da177e4
LT		 1447
1448 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1449 DIR__ADD_NAME | DIR__SEARCH,
1450 &ad);
1451 if (rc)
1452 return rc;
1453
1454 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1455 newsid = tsec->create_sid;
1456 } else {
1457 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1458 &newsid);
1459 if (rc)
1460 return rc;
1461 }
1462
1463 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1464 if (rc)
1465 return rc;
1466
1467 return avc_has_perm(newsid, sbsec->sid,
1468 SECCLASS_FILESYSTEM,
1469 FILESYSTEM__ASSOCIATE, &ad);
1470}
1471
4eb582cf
ML		 1472/* Check whether a task can create a key. */
1473static int may_create_key(u32 ksid,
1474 struct task_struct *ctx)
1475{
1476 struct task_security_struct *tsec;
1477
1478 tsec = ctx->security;
1479
1480 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1481}
1482
828dfe1d
EP		 1483#define MAY_LINK 0
1484#define MAY_UNLINK 1
1485#define MAY_RMDIR 2
1da177e4
LT		 1486
1487/* Check whether a task can link, unlink, or rmdir a file/directory. */
1488static int may_link(struct inode *dir,
1489 struct dentry *dentry,
1490 int kind)
1491
1492{
1493 struct task_security_struct *tsec;
1494 struct inode_security_struct *dsec, *isec;
1495 struct avc_audit_data ad;
1496 u32 av;
1497 int rc;
1498
1499 tsec = current->security;
1500 dsec = dir->i_security;
1501 isec = dentry->d_inode->i_security;
1502
1503 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1504 ad.u.fs.path.dentry = dentry;
1da177e4
LT		 1505
1506 av = DIR__SEARCH;
1507 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1508 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1509 if (rc)
1510 return rc;
1511
1512 switch (kind) {
1513 case MAY_LINK:
1514 av = FILE__LINK;
1515 break;
1516 case MAY_UNLINK:
1517 av = FILE__UNLINK;
1518 break;
1519 case MAY_RMDIR:
1520 av = DIR__RMDIR;
1521 break;
1522 default:
744ba35e
EP		 1523 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1524 __func__, kind);
1da177e4
LT		 1525 return 0;
1526 }
1527
1528 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1529 return rc;
1530}
1531
1532static inline int may_rename(struct inode *old_dir,
1533 struct dentry *old_dentry,
1534 struct inode *new_dir,
1535 struct dentry *new_dentry)
1536{
1537 struct task_security_struct *tsec;
1538 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1539 struct avc_audit_data ad;
1540 u32 av;
1541 int old_is_dir, new_is_dir;
1542 int rc;
1543
1544 tsec = current->security;
1545 old_dsec = old_dir->i_security;
1546 old_isec = old_dentry->d_inode->i_security;
1547 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1548 new_dsec = new_dir->i_security;
1549
1550 AVC_AUDIT_DATA_INIT(&ad, FS);
1551
44707fdf 1552 ad.u.fs.path.dentry = old_dentry;
1da177e4
LT		 1553 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1554 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1555 if (rc)
1556 return rc;
1557 rc = avc_has_perm(tsec->sid, old_isec->sid,
1558 old_isec->sclass, FILE__RENAME, &ad);
1559 if (rc)
1560 return rc;
1561 if (old_is_dir && new_dir != old_dir) {
1562 rc = avc_has_perm(tsec->sid, old_isec->sid,
1563 old_isec->sclass, DIR__REPARENT, &ad);
1564 if (rc)
1565 return rc;
1566 }
1567
44707fdf 1568 ad.u.fs.path.dentry = new_dentry;
1da177e4
LT		 1569 av = DIR__ADD_NAME | DIR__SEARCH;
1570 if (new_dentry->d_inode)
1571 av |= DIR__REMOVE_NAME;
1572 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1573 if (rc)
1574 return rc;
1575 if (new_dentry->d_inode) {
1576 new_isec = new_dentry->d_inode->i_security;
1577 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1578 rc = avc_has_perm(tsec->sid, new_isec->sid,
1579 new_isec->sclass,
1580 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1581 if (rc)
1582 return rc;
1583 }
1584
1585 return 0;
1586}
1587
1588/* Check whether a task can perform a filesystem operation. */
1589static int superblock_has_perm(struct task_struct *tsk,
1590 struct super_block *sb,
1591 u32 perms,
1592 struct avc_audit_data *ad)
1593{
1594 struct task_security_struct *tsec;
1595 struct superblock_security_struct *sbsec;
1596
1597 tsec = tsk->security;
1598 sbsec = sb->s_security;
1599 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1600 perms, ad);
1601}
1602
1603/* Convert a Linux mode and permission mask to an access vector. */
1604static inline u32 file_mask_to_av(int mode, int mask)
1605{
1606 u32 av = 0;
1607
1608 if ((mode & S_IFMT) != S_IFDIR) {
1609 if (mask & MAY_EXEC)
1610 av |= FILE__EXECUTE;
1611 if (mask & MAY_READ)
1612 av |= FILE__READ;
1613
1614 if (mask & MAY_APPEND)
1615 av |= FILE__APPEND;
1616 else if (mask & MAY_WRITE)
1617 av |= FILE__WRITE;
1618
1619 } else {
1620 if (mask & MAY_EXEC)
1621 av |= DIR__SEARCH;
1622 if (mask & MAY_WRITE)
1623 av |= DIR__WRITE;
1624 if (mask & MAY_READ)
1625 av |= DIR__READ;
1626 }
1627
1628 return av;
1629}
1630
b0c636b9
EP		 1631/*
1632 * Convert a file mask to an access vector and include the correct open
1633 * open permission.
1634 */
1635static inline u32 open_file_mask_to_av(int mode, int mask)
1636{
1637 u32 av = file_mask_to_av(mode, mask);
1638
1639 if (selinux_policycap_openperm) {
1640 /*
1641 * lnk files and socks do not really have an 'open'
1642 */
1643 if (S_ISREG(mode))
1644 av |= FILE__OPEN;
1645 else if (S_ISCHR(mode))
1646 av |= CHR_FILE__OPEN;
1647 else if (S_ISBLK(mode))
1648 av |= BLK_FILE__OPEN;
1649 else if (S_ISFIFO(mode))
1650 av |= FIFO_FILE__OPEN;
1651 else if (S_ISDIR(mode))
1652 av |= DIR__OPEN;
1653 else
744ba35e
EP		 1654 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1655 "unknown mode:%x\n", __func__, mode);
b0c636b9
EP		 1656 }
1657 return av;
1658}
1659
1da177e4
LT		 1660/* Convert a Linux file to an access vector. */
1661static inline u32 file_to_av(struct file *file)
1662{
1663 u32 av = 0;
1664
1665 if (file->f_mode & FMODE_READ)
1666 av |= FILE__READ;
1667 if (file->f_mode & FMODE_WRITE) {
1668 if (file->f_flags & O_APPEND)
1669 av |= FILE__APPEND;
1670 else
1671 av |= FILE__WRITE;
1672 }
0794c66d
SS		 1673 if (!av) {
1674 /*
1675 * Special file opened with flags 3 for ioctl-only use.
1676 */
1677 av = FILE__IOCTL;
1678 }
1da177e4
LT		 1679
1680 return av;
1681}
1682
1da177e4
LT		 1683/* Hook functions begin here. */
1684
1685static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1686{
1da177e4
LT		 1687 int rc;
1688
828dfe1d 1689 rc = secondary_ops->ptrace(parent, child);
1da177e4
LT		 1690 if (rc)
1691 return rc;
1692
0356357c 1693 return task_has_perm(parent, child, PROCESS__PTRACE);
1da177e4
LT		 1694}
1695
1696static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1697 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT		 1698{
1699 int error;
1700
1701 error = task_has_perm(current, target, PROCESS__GETCAP);
1702 if (error)
1703 return error;
1704
1705 return secondary_ops->capget(target, effective, inheritable, permitted);
1706}
1707
1708static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1709 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT		 1710{
1711 int error;
1712
1713 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1714 if (error)
1715 return error;
1716
1717 return task_has_perm(current, target, PROCESS__SETCAP);
1718}
1719
1720static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1721 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT		 1722{
1723 secondary_ops->capset_set(target, effective, inheritable, permitted);
1724}
1725
1726static int selinux_capable(struct task_struct *tsk, int cap)
1727{
1728 int rc;
1729
1730 rc = secondary_ops->capable(tsk, cap);
1731 if (rc)
1732 return rc;
1733
828dfe1d 1734 return task_has_capability(tsk, cap);
1da177e4
LT		 1735}
1736
3fbfa981
EB		 1737static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1738{
1739 int buflen, rc;
1740 char *buffer, *path, *end;
1741
1742 rc = -ENOMEM;
828dfe1d 1743 buffer = (char *)__get_free_page(GFP_KERNEL);
3fbfa981
EB		 1744 if (!buffer)
1745 goto out;
1746
1747 buflen = PAGE_SIZE;
1748 end = buffer+buflen;
1749 *--end = '\0';
1750 buflen--;
1751 path = end-1;
1752 *path = '/';
1753 while (table) {
1754 const char *name = table->procname;
1755 size_t namelen = strlen(name);
1756 buflen -= namelen + 1;
1757 if (buflen < 0)
1758 goto out_free;
1759 end -= namelen;
1760 memcpy(end, name, namelen);
1761 *--end = '/';
1762 path = end;
1763 table = table->parent;
1764 }
b599fdfd
EB		 1765 buflen -= 4;
1766 if (buflen < 0)
1767 goto out_free;
1768 end -= 4;
1769 memcpy(end, "/sys", 4);
1770 path = end;
3fbfa981
EB		 1771 rc = security_genfs_sid("proc", path, tclass, sid);
1772out_free:
1773 free_page((unsigned long)buffer);
1774out:
1775 return rc;
1776}
1777
1da177e4
LT		 1778static int selinux_sysctl(ctl_table *table, int op)
1779{
1780 int error = 0;
1781 u32 av;
1782 struct task_security_struct *tsec;
1783 u32 tsid;
1784 int rc;
1785
1786 rc = secondary_ops->sysctl(table, op);
1787 if (rc)
1788 return rc;
1789
1790 tsec = current->security;
1791
3fbfa981
EB		 1792 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1793 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1da177e4
LT		 1794 if (rc) {
1795 /* Default to the well-defined sysctl SID. */
1796 tsid = SECINITSID_SYSCTL;
1797 }
1798
1799 /* The op values are "defined" in sysctl.c, thereby creating
1800 * a bad coupling between this module and sysctl.c */
828dfe1d 1801 if (op == 001) {
1da177e4
LT		 1802 error = avc_has_perm(tsec->sid, tsid,
1803 SECCLASS_DIR, DIR__SEARCH, NULL);
1804 } else {
1805 av = 0;
1806 if (op & 004)
1807 av |= FILE__READ;
1808 if (op & 002)
1809 av |= FILE__WRITE;
1810 if (av)
1811 error = avc_has_perm(tsec->sid, tsid,
1812 SECCLASS_FILE, av, NULL);
828dfe1d 1813 }
1da177e4
LT		 1814
1815 return error;
1816}
1817
1818static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1819{
1820 int rc = 0;
1821
1822 if (!sb)
1823 return 0;
1824
1825 switch (cmds) {
828dfe1d
EP		 1826 case Q_SYNC:
1827 case Q_QUOTAON:
1828 case Q_QUOTAOFF:
1829 case Q_SETINFO:
1830 case Q_SETQUOTA:
1831 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1832 NULL);
1833 break;
1834 case Q_GETFMT:
1835 case Q_GETINFO:
1836 case Q_GETQUOTA:
1837 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1838 NULL);
1839 break;
1840 default:
1841 rc = 0; /* let the kernel handle invalid cmds */
1842 break;
1da177e4
LT		 1843 }
1844 return rc;
1845}
1846
1847static int selinux_quota_on(struct dentry *dentry)
1848{
1849 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1850}
1851
1852static int selinux_syslog(int type)
1853{
1854 int rc;
1855
1856 rc = secondary_ops->syslog(type);
1857 if (rc)
1858 return rc;
1859
1860 switch (type) {
828dfe1d
EP		 1861 case 3: /* Read last kernel messages */
1862 case 10: /* Return size of the log buffer */
1863 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1864 break;
1865 case 6: /* Disable logging to console */
1866 case 7: /* Enable logging to console */
1867 case 8: /* Set level of messages printed to console */
1868 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1869 break;
1870 case 0: /* Close log */
1871 case 1: /* Open log */
1872 case 2: /* Read from log */
1873 case 4: /* Read/clear last kernel messages */
1874 case 5: /* Clear ring buffer */
1875 default:
1876 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1877 break;
1da177e4
LT		 1878 }
1879 return rc;
1880}
1881
1882/*
1883 * Check that a process has enough memory to allocate a new virtual
1884 * mapping. 0 means there is enough memory for the allocation to
1885 * succeed and -ENOMEM implies there is not.
1886 *
1887 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1888 * if the capability is granted, but __vm_enough_memory requires 1 if
1889 * the capability is granted.
1890 *
1891 * Do not audit the selinux permission check, as this is applied to all
1892 * processes that allocate mappings.
1893 */
34b4e4aa 1894static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT		 1895{
1896 int rc, cap_sys_admin = 0;
1897 struct task_security_struct *tsec = current->security;
1898
1899 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1900 if (rc == 0)
1901 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2c3c05db
SS		 1902 SECCLASS_CAPABILITY,
1903 CAP_TO_MASK(CAP_SYS_ADMIN),
1904 0,
1905 NULL);
1da177e4
LT		 1906
1907 if (rc == 0)
1908 cap_sys_admin = 1;
1909
34b4e4aa 1910 return __vm_enough_memory(mm, pages, cap_sys_admin);
1da177e4
LT		 1911}
1912
0356357c
RM		 1913/**
1914 * task_tracer_task - return the task that is tracing the given task
1915 * @task: task to consider
1916 *
1917 * Returns NULL if noone is tracing @task, or the &struct task_struct
1918 * pointer to its tracer.
1919 *
1920 * Must be called under rcu_read_lock().
1921 */
1922static struct task_struct *task_tracer_task(struct task_struct *task)
1923{
1924 if (task->ptrace & PT_PTRACED)
1925 return rcu_dereference(task->parent);
1926 return NULL;
1927}
1928
1da177e4
LT		 1929/* binprm security operations */
1930
1931static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1932{
1933 struct bprm_security_struct *bsec;
1934
89d155ef 1935 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1da177e4
LT		 1936 if (!bsec)
1937 return -ENOMEM;
1938
1da177e4
LT		 1939 bsec->sid = SECINITSID_UNLABELED;
1940 bsec->set = 0;
1941
1942 bprm->security = bsec;
1943 return 0;
1944}
1945
1946static int selinux_bprm_set_security(struct linux_binprm *bprm)
1947{
1948 struct task_security_struct *tsec;
3d5ff529 1949 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1da177e4
LT		 1950 struct inode_security_struct *isec;
1951 struct bprm_security_struct *bsec;
1952 u32 newsid;
1953 struct avc_audit_data ad;
1954 int rc;
1955
1956 rc = secondary_ops->bprm_set_security(bprm);
1957 if (rc)
1958 return rc;
1959
1960 bsec = bprm->security;
1961
1962 if (bsec->set)
1963 return 0;
1964
1965 tsec = current->security;
1966 isec = inode->i_security;
1967
1968 /* Default to the current task SID. */
1969 bsec->sid = tsec->sid;
1970
28eba5bf 1971 /* Reset fs, key, and sock SIDs on execve. */
1da177e4 1972 tsec->create_sid = 0;
28eba5bf 1973 tsec->keycreate_sid = 0;
42c3e03e 1974 tsec->sockcreate_sid = 0;
1da177e4
LT		 1975
1976 if (tsec->exec_sid) {
1977 newsid = tsec->exec_sid;
1978 /* Reset exec SID on execve. */
1979 tsec->exec_sid = 0;
1980 } else {
1981 /* Check for a default transition on this program. */
1982 rc = security_transition_sid(tsec->sid, isec->sid,
828dfe1d 1983 SECCLASS_PROCESS, &newsid);
1da177e4
LT		 1984 if (rc)
1985 return rc;
1986 }
1987
1988 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1989 ad.u.fs.path = bprm->file->f_path;
1da177e4 1990
3d5ff529 1991 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1da177e4
LT		 1992 newsid = tsec->sid;
1993
828dfe1d 1994 if (tsec->sid == newsid) {
1da177e4
LT		 1995 rc = avc_has_perm(tsec->sid, isec->sid,
1996 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1997 if (rc)
1998 return rc;
1999 } else {
2000 /* Check permissions for the transition. */
2001 rc = avc_has_perm(tsec->sid, newsid,
2002 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2003 if (rc)
2004 return rc;
2005
2006 rc = avc_has_perm(newsid, isec->sid,
2007 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2008 if (rc)
2009 return rc;
2010
2011 /* Clear any possibly unsafe personality bits on exec: */
2012 current->personality &= ~PER_CLEAR_ON_SETID;
2013
2014 /* Set the security field to the new SID. */
2015 bsec->sid = newsid;
2016 }
2017
2018 bsec->set = 1;
2019 return 0;
2020}
2021
828dfe1d 2022static int selinux_bprm_check_security(struct linux_binprm *bprm)
1da177e4
LT		 2023{
2024 return secondary_ops->bprm_check_security(bprm);
2025}
2026
2027
828dfe1d 2028static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4
LT		 2029{
2030 struct task_security_struct *tsec = current->security;
2031 int atsecure = 0;
2032
2033 if (tsec->osid != tsec->sid) {
2034 /* Enable secure mode for SIDs transitions unless
2035 the noatsecure permission is granted between
2036 the two SIDs, i.e. ahp returns 0. */
2037 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2038 SECCLASS_PROCESS,
2039 PROCESS__NOATSECURE, NULL);
2040 }
2041
2042 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2043}
2044
2045static void selinux_bprm_free_security(struct linux_binprm *bprm)
2046{
9a5f04bf 2047 kfree(bprm->security);
1da177e4 2048 bprm->security = NULL;
1da177e4
LT		 2049}
2050
2051extern struct vfsmount *selinuxfs_mount;
2052extern struct dentry *selinux_null;
2053
2054/* Derived from fs/exec.c:flush_old_files. */
828dfe1d 2055static inline void flush_unauthorized_files(struct files_struct *files)
1da177e4
LT		 2056{
2057 struct avc_audit_data ad;
2058 struct file *file, *devnull = NULL;
b20c8122 2059 struct tty_struct *tty;
badf1662 2060 struct fdtable *fdt;
1da177e4 2061 long j = -1;
24ec839c 2062 int drop_tty = 0;
1da177e4 2063
b20c8122 2064 mutex_lock(&tty_mutex);
24ec839c 2065 tty = get_current_tty();
1da177e4
LT		 2066 if (tty) {
2067 file_list_lock();
2f512016 2068 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1da177e4
LT		 2069 if (file) {
2070 /* Revalidate access to controlling tty.
2071 Use inode_has_perm on the tty inode directly rather
2072 than using file_has_perm, as this particular open
2073 file may belong to another process and we are only
2074 interested in the inode-based check here. */
3d5ff529 2075 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 2076 if (inode_has_perm(current, inode,
2077 FILE__READ | FILE__WRITE, NULL)) {
24ec839c 2078 drop_tty = 1;
1da177e4
LT		 2079 }
2080 }
2081 file_list_unlock();
2082 }
b20c8122 2083 mutex_unlock(&tty_mutex);
98a27ba4
EB		 2084 /* Reset controlling tty. */
2085 if (drop_tty)
2086 no_tty();
1da177e4
LT		 2087
2088 /* Revalidate access to inherited open files. */
2089
828dfe1d 2090 AVC_AUDIT_DATA_INIT(&ad, FS);
1da177e4
LT		 2091
2092 spin_lock(&files->file_lock);
2093 for (;;) {
2094 unsigned long set, i;
2095 int fd;
2096
2097 j++;
2098 i = j * __NFDBITS;
badf1662 2099 fdt = files_fdtable(files);
bbea9f69 2100 if (i >= fdt->max_fds)
1da177e4 2101 break;
badf1662 2102 set = fdt->open_fds->fds_bits[j];
1da177e4
LT		 2103 if (!set)
2104 continue;
2105 spin_unlock(&files->file_lock);
828dfe1d 2106 for ( ; set ; i++, set >>= 1) {
1da177e4
LT		 2107 if (set & 1) {
2108 file = fget(i);
2109 if (!file)
2110 continue;
2111 if (file_has_perm(current,
2112 file,
2113 file_to_av(file))) {
2114 sys_close(i);
2115 fd = get_unused_fd();
2116 if (fd != i) {
2117 if (fd >= 0)
2118 put_unused_fd(fd);
2119 fput(file);
2120 continue;
2121 }
2122 if (devnull) {
095975da 2123 get_file(devnull);
1da177e4
LT		 2124 } else {
2125 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
fc5d81e6
AM		 2126 if (IS_ERR(devnull)) {
2127 devnull = NULL;
1da177e4
LT		 2128 put_unused_fd(fd);
2129 fput(file);
2130 continue;
2131 }
2132 }
2133 fd_install(fd, devnull);
2134 }
2135 fput(file);
2136 }
2137 }
2138 spin_lock(&files->file_lock);
2139
2140 }
2141 spin_unlock(&files->file_lock);
2142}
2143
2144static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2145{
2146 struct task_security_struct *tsec;
2147 struct bprm_security_struct *bsec;
2148 u32 sid;
2149 int rc;
2150
2151 secondary_ops->bprm_apply_creds(bprm, unsafe);
2152
2153 tsec = current->security;
2154
2155 bsec = bprm->security;
2156 sid = bsec->sid;
2157
2158 tsec->osid = tsec->sid;
2159 bsec->unsafe = 0;
2160 if (tsec->sid != sid) {
2161 /* Check for shared state. If not ok, leave SID
2162 unchanged and kill. */
2163 if (unsafe & LSM_UNSAFE_SHARE) {
2164 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2165 PROCESS__SHARE, NULL);
2166 if (rc) {
2167 bsec->unsafe = 1;
2168 return;
2169 }
2170 }
2171
2172 /* Check for ptracing, and update the task SID if ok.
2173 Otherwise, leave SID unchanged and kill. */
2174 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
0356357c
RM		 2175 struct task_struct *tracer;
2176 struct task_security_struct *sec;
2177 u32 ptsid = 0;
2178
2179 rcu_read_lock();
2180 tracer = task_tracer_task(current);
2181 if (likely(tracer != NULL)) {
2182 sec = tracer->security;
2183 ptsid = sec->sid;
2184 }
2185 rcu_read_unlock();
2186
2187 if (ptsid != 0) {
2188 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2189 PROCESS__PTRACE, NULL);
2190 if (rc) {
2191 bsec->unsafe = 1;
2192 return;
2193 }
1da177e4
LT		 2194 }
2195 }
2196 tsec->sid = sid;
2197 }
2198}
2199
2200/*
2201 * called after apply_creds without the task lock held
2202 */
2203static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2204{
2205 struct task_security_struct *tsec;
2206 struct rlimit *rlim, *initrlim;
2207 struct itimerval itimer;
2208 struct bprm_security_struct *bsec;
2209 int rc, i;
2210
2211 tsec = current->security;
2212 bsec = bprm->security;
2213
2214 if (bsec->unsafe) {
2215 force_sig_specific(SIGKILL, current);
2216 return;
2217 }
2218 if (tsec->osid == tsec->sid)
2219 return;
2220
2221 /* Close files for which the new task SID is not authorized. */
2222 flush_unauthorized_files(current->files);
2223
2224 /* Check whether the new SID can inherit signal state
2225 from the old SID. If not, clear itimers to avoid
2226 subsequent signal generation and flush and unblock
2227 signals. This must occur _after_ the task SID has
2228 been updated so that any kill done after the flush
2229 will be checked against the new SID. */
2230 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2231 PROCESS__SIGINH, NULL);
2232 if (rc) {
2233 memset(&itimer, 0, sizeof itimer);
2234 for (i = 0; i < 3; i++)
2235 do_setitimer(i, &itimer, NULL);
2236 flush_signals(current);
2237 spin_lock_irq(&current->sighand->siglock);
2238 flush_signal_handlers(current, 1);
2239 sigemptyset(&current->blocked);
2240 recalc_sigpending();
2241 spin_unlock_irq(&current->sighand->siglock);
2242 }
2243
4ac212ad
SS		 2244 /* Always clear parent death signal on SID transitions. */
2245 current->pdeath_signal = 0;
2246
1da177e4
LT		 2247 /* Check whether the new SID can inherit resource limits
2248 from the old SID. If not, reset all soft limits to
2249 the lower of the current task's hard limit and the init
2250 task's soft limit. Note that the setting of hard limits
2251 (even to lower them) can be controlled by the setrlimit
2252 check. The inclusion of the init task's soft limit into
2253 the computation is to avoid resetting soft limits higher
2254 than the default soft limit for cases where the default
2255 is lower than the hard limit, e.g. RLIMIT_CORE or
2256 RLIMIT_STACK.*/
2257 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2258 PROCESS__RLIMITINH, NULL);
2259 if (rc) {
2260 for (i = 0; i < RLIM_NLIMITS; i++) {
2261 rlim = current->signal->rlim + i;
2262 initrlim = init_task.signal->rlim+i;
828dfe1d 2263 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4
LT		 2264 }
2265 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2266 /*
2267 * This will cause RLIMIT_CPU calculations
2268 * to be refigured.
2269 */
2270 current->it_prof_expires = jiffies_to_cputime(1);
2271 }
2272 }
2273
2274 /* Wake up the parent if it is waiting so that it can
2275 recheck wait permission to the new task SID. */
2276 wake_up_interruptible(&current->parent->signal->wait_chldexit);
2277}
2278
2279/* superblock security operations */
2280
2281static int selinux_sb_alloc_security(struct super_block *sb)
2282{
2283 return superblock_alloc_security(sb);
2284}
2285
2286static void selinux_sb_free_security(struct super_block *sb)
2287{
2288 superblock_free_security(sb);
2289}
2290
2291static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2292{
2293 if (plen > olen)
2294 return 0;
2295
2296 return !memcmp(prefix, option, plen);
2297}
2298
2299static inline int selinux_option(char *option, int len)
2300{
832cbd9a
EP		 2301 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2302 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2303 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2304 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
1da177e4
LT		 2305}
2306
2307static inline void take_option(char **to, char *from, int *first, int len)
2308{
2309 if (!*first) {
2310 **to = ',';
2311 *to += 1;
3528a953 2312 } else
1da177e4
LT		 2313 *first = 0;
2314 memcpy(*to, from, len);
2315 *to += len;
2316}
2317
828dfe1d
EP		 2318static inline void take_selinux_option(char **to, char *from, int *first,
2319 int len)
3528a953
CO		 2320{
2321 int current_size = 0;
2322
2323 if (!*first) {
2324 **to = '|';
2325 *to += 1;
828dfe1d 2326 } else
3528a953
CO		 2327 *first = 0;
2328
2329 while (current_size < len) {
2330 if (*from != '"') {
2331 **to = *from;
2332 *to += 1;
2333 }
2334 from += 1;
2335 current_size += 1;
2336 }
2337}
2338
e0007529 2339static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT		 2340{
2341 int fnosec, fsec, rc = 0;
2342 char *in_save, *in_curr, *in_end;
2343 char *sec_curr, *nosec_save, *nosec;
3528a953 2344 int open_quote = 0;
1da177e4
LT		 2345
2346 in_curr = orig;
2347 sec_curr = copy;
2348
1da177e4
LT		 2349 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2350 if (!nosec) {
2351 rc = -ENOMEM;
2352 goto out;
2353 }
2354
2355 nosec_save = nosec;
2356 fnosec = fsec = 1;
2357 in_save = in_end = orig;
2358
2359 do {
3528a953
CO		 2360 if (*in_end == '"')
2361 open_quote = !open_quote;
2362 if ((*in_end == ',' && open_quote == 0) ||
2363 *in_end == '\0') {
1da177e4
LT		 2364 int len = in_end - in_curr;
2365
2366 if (selinux_option(in_curr, len))
3528a953 2367 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT		 2368 else
2369 take_option(&nosec, in_curr, &fnosec, len);
2370
2371 in_curr = in_end + 1;
2372 }
2373 } while (*in_end++);
2374
6931dfc9 2375 strcpy(in_save, nosec_save);
da3caa20 2376 free_page((unsigned long)nosec_save);
1da177e4
LT		 2377out:
2378 return rc;
2379}
2380
2381static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2382{
2383 struct avc_audit_data ad;
2384 int rc;
2385
2386 rc = superblock_doinit(sb, data);
2387 if (rc)
2388 return rc;
2389
828dfe1d 2390 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2391 ad.u.fs.path.dentry = sb->s_root;
1da177e4
LT		 2392 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2393}
2394
726c3342 2395static int selinux_sb_statfs(struct dentry *dentry)
1da177e4
LT		 2396{
2397 struct avc_audit_data ad;
2398
828dfe1d 2399 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2400 ad.u.fs.path.dentry = dentry->d_sb->s_root;
726c3342 2401 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT		 2402}
2403
828dfe1d 2404static int selinux_mount(char *dev_name,
b5266eb4 2405 struct path *path,
828dfe1d
EP		 2406 char *type,
2407 unsigned long flags,
2408 void *data)
1da177e4
LT		 2409{
2410 int rc;
2411
b5266eb4 2412 rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
1da177e4
LT		 2413 if (rc)
2414 return rc;
2415
2416 if (flags & MS_REMOUNT)
b5266eb4 2417 return superblock_has_perm(current, path->mnt->mnt_sb,
828dfe1d 2418 FILESYSTEM__REMOUNT, NULL);
1da177e4 2419 else
b5266eb4 2420 return dentry_has_perm(current, path->mnt, path->dentry,
828dfe1d 2421 FILE__MOUNTON);
1da177e4
LT		 2422}
2423
2424static int selinux_umount(struct vfsmount *mnt, int flags)
2425{
2426 int rc;
2427
2428 rc = secondary_ops->sb_umount(mnt, flags);
2429 if (rc)
2430 return rc;
2431
828dfe1d
EP		 2432 return superblock_has_perm(current, mnt->mnt_sb,
2433 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT		 2434}
2435
2436/* inode security operations */
2437
2438static int selinux_inode_alloc_security(struct inode *inode)
2439{
2440 return inode_alloc_security(inode);
2441}
2442
2443static void selinux_inode_free_security(struct inode *inode)
2444{
2445 inode_free_security(inode);
2446}
2447
5e41ff9e
SS		 2448static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2449 char **name, void **value,
2450 size_t *len)
2451{
2452 struct task_security_struct *tsec;
2453 struct inode_security_struct *dsec;
2454 struct superblock_security_struct *sbsec;
570bc1c2 2455 u32 newsid, clen;
5e41ff9e 2456 int rc;
570bc1c2 2457 char *namep = NULL, *context;
5e41ff9e
SS		 2458
2459 tsec = current->security;
2460 dsec = dir->i_security;
2461 sbsec = dir->i_sb->s_security;
5e41ff9e
SS		 2462
2463 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2464 newsid = tsec->create_sid;
2465 } else {
2466 rc = security_transition_sid(tsec->sid, dsec->sid,
2467 inode_mode_to_security_class(inode->i_mode),
2468 &newsid);
2469 if (rc) {
2470 printk(KERN_WARNING "%s: "
2471 "security_transition_sid failed, rc=%d (dev=%s "
2472 "ino=%ld)\n",
dd6f953a 2473 __func__,
5e41ff9e
SS		 2474 -rc, inode->i_sb->s_id, inode->i_ino);
2475 return rc;
2476 }
2477 }
2478
296fddf7
EP		 2479 /* Possibly defer initialization to selinux_complete_init. */
2480 if (sbsec->initialized) {
2481 struct inode_security_struct *isec = inode->i_security;
2482 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2483 isec->sid = newsid;
2484 isec->initialized = 1;
2485 }
5e41ff9e 2486
8aad3875 2487 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
25a74f3b
SS		 2488 return -EOPNOTSUPP;
2489
570bc1c2 2490 if (name) {
a02fe132 2491 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
570bc1c2
SS		 2492 if (!namep)
2493 return -ENOMEM;
2494 *name = namep;
2495 }
5e41ff9e 2496
570bc1c2 2497 if (value && len) {
12b29f34 2498 rc = security_sid_to_context_force(newsid, &context, &clen);
570bc1c2
SS		 2499 if (rc) {
2500 kfree(namep);
2501 return rc;
2502 }
2503 *value = context;
2504 *len = clen;
5e41ff9e 2505 }
5e41ff9e 2506
5e41ff9e
SS		 2507 return 0;
2508}
2509
1da177e4
LT		 2510static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2511{
2512 return may_create(dir, dentry, SECCLASS_FILE);
2513}
2514
1da177e4
LT		 2515static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2516{
2517 int rc;
2518
828dfe1d 2519 rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
1da177e4
LT		 2520 if (rc)
2521 return rc;
2522 return may_link(dir, old_dentry, MAY_LINK);
2523}
2524
1da177e4
LT		 2525static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2526{
2527 int rc;
2528
2529 rc = secondary_ops->inode_unlink(dir, dentry);
2530 if (rc)
2531 return rc;
2532 return may_link(dir, dentry, MAY_UNLINK);
2533}
2534
2535static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2536{
2537 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2538}
2539
1da177e4
LT		 2540static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2541{
2542 return may_create(dir, dentry, SECCLASS_DIR);
2543}
2544
1da177e4
LT		 2545static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2546{
2547 return may_link(dir, dentry, MAY_RMDIR);
2548}
2549
2550static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2551{
2552 int rc;
2553
2554 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2555 if (rc)
2556 return rc;
2557
2558 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2559}
2560
1da177e4 2561static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2562 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT		 2563{
2564 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2565}
2566
1da177e4
LT		 2567static int selinux_inode_readlink(struct dentry *dentry)
2568{
2569 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2570}
2571
2572static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2573{
2574 int rc;
2575
828dfe1d 2576 rc = secondary_ops->inode_follow_link(dentry, nameidata);
1da177e4
LT		 2577 if (rc)
2578 return rc;
2579 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2580}
2581
2582static int selinux_inode_permission(struct inode *inode, int mask,
2583 struct nameidata *nd)
2584{
2585 int rc;
2586
2587 rc = secondary_ops->inode_permission(inode, mask, nd);
2588 if (rc)
2589 return rc;
2590
2591 if (!mask) {
2592 /* No permission to check. Existence test. */
2593 return 0;
2594 }
2595
2596 return inode_has_perm(current, inode,
b0c636b9 2597 open_file_mask_to_av(inode->i_mode, mask), NULL);
1da177e4
LT		 2598}
2599
2600static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2601{
2602 int rc;
2603
2604 rc = secondary_ops->inode_setattr(dentry, iattr);
2605 if (rc)
2606 return rc;
2607
2608 if (iattr->ia_valid & ATTR_FORCE)
2609 return 0;
2610
2611 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2612 ATTR_ATIME_SET | ATTR_MTIME_SET))
2613 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2614
2615 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2616}
2617
2618static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2619{
2620 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2621}
2622
8f0cfa52 2623static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771
SH		 2624{
2625 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2626 sizeof XATTR_SECURITY_PREFIX - 1)) {
2627 if (!strcmp(name, XATTR_NAME_CAPS)) {
2628 if (!capable(CAP_SETFCAP))
2629 return -EPERM;
2630 } else if (!capable(CAP_SYS_ADMIN)) {
2631 /* A different attribute in the security namespace.
2632 Restrict to administrator. */
2633 return -EPERM;
2634 }
2635 }
2636
2637 /* Not an attribute we recognize, so just check the
2638 ordinary setattr permission. */
2639 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2640}
2641
8f0cfa52
DH		 2642static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2643 const void *value, size_t size, int flags)
1da177e4
LT		 2644{
2645 struct task_security_struct *tsec = current->security;
2646 struct inode *inode = dentry->d_inode;
2647 struct inode_security_struct *isec = inode->i_security;
2648 struct superblock_security_struct *sbsec;
2649 struct avc_audit_data ad;
2650 u32 newsid;
2651 int rc = 0;
2652
b5376771
SH		 2653 if (strcmp(name, XATTR_NAME_SELINUX))
2654 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT		 2655
2656 sbsec = inode->i_sb->s_security;
2657 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2658 return -EOPNOTSUPP;
2659
3bd858ab 2660 if (!is_owner_or_cap(inode))
1da177e4
LT		 2661 return -EPERM;
2662
828dfe1d 2663 AVC_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2664 ad.u.fs.path.dentry = dentry;
1da177e4
LT		 2665
2666 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2667 FILE__RELABELFROM, &ad);
2668 if (rc)
2669 return rc;
2670
2671 rc = security_context_to_sid(value, size, &newsid);
12b29f34
SS		 2672 if (rc == -EINVAL) {
2673 if (!capable(CAP_MAC_ADMIN))
2674 return rc;
2675 rc = security_context_to_sid_force(value, size, &newsid);
2676 }
1da177e4
LT		 2677 if (rc)
2678 return rc;
2679
2680 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2681 FILE__RELABELTO, &ad);
2682 if (rc)
2683 return rc;
2684
2685 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
828dfe1d 2686 isec->sclass);
1da177e4
LT		 2687 if (rc)
2688 return rc;
2689
2690 return avc_has_perm(newsid,
2691 sbsec->sid,
2692 SECCLASS_FILESYSTEM,
2693 FILESYSTEM__ASSOCIATE,
2694 &ad);
2695}
2696
8f0cfa52
DH		 2697static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2698 const void *value, size_t size,
2699 int flags)
1da177e4
LT		 2700{
2701 struct inode *inode = dentry->d_inode;
2702 struct inode_security_struct *isec = inode->i_security;
2703 u32 newsid;
2704 int rc;
2705
2706 if (strcmp(name, XATTR_NAME_SELINUX)) {
2707 /* Not an attribute we recognize, so nothing to do. */
2708 return;
2709 }
2710
12b29f34 2711 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 2712 if (rc) {
12b29f34
SS		 2713 printk(KERN_ERR "SELinux: unable to map context to SID"
2714 "for (%s, %lu), rc=%d\n",
2715 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT		 2716 return;
2717 }
2718
2719 isec->sid = newsid;
2720 return;
2721}
2722
8f0cfa52 2723static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 2724{
1da177e4
LT		 2725 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2726}
2727
828dfe1d 2728static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4
LT		 2729{
2730 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2731}
2732
8f0cfa52 2733static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 2734{
b5376771
SH		 2735 if (strcmp(name, XATTR_NAME_SELINUX))
2736 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT		 2737
2738 /* No one is allowed to remove a SELinux security label.
2739 You can change the label, but all data must be labeled. */
2740 return -EACCES;
2741}
2742
d381d8a9
JM		 2743/*
2744 * Copy the in-core inode security context value to the user. If the
2745 * getxattr() prior to this succeeded, check to see if we need to
2746 * canonicalize the value to be finally returned to the user.
2747 *
2748 * Permission check is handled by selinux_inode_getxattr hook.
2749 */
42492594 2750static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 2751{
42492594
DQ		 2752 u32 size;
2753 int error;
2754 char *context = NULL;
1da177e4 2755 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2756
8c8570fb
DK		 2757 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2758 return -EOPNOTSUPP;
d381d8a9 2759
42492594
DQ		 2760 error = security_sid_to_context(isec->sid, &context, &size);
2761 if (error)
2762 return error;
2763 error = size;
2764 if (alloc) {
2765 *buffer = context;
2766 goto out_nofree;
2767 }
2768 kfree(context);
2769out_nofree:
2770 return error;
1da177e4
LT		 2771}
2772
2773static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 2774 const void *value, size_t size, int flags)
1da177e4
LT		 2775{
2776 struct inode_security_struct *isec = inode->i_security;
2777 u32 newsid;
2778 int rc;
2779
2780 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2781 return -EOPNOTSUPP;
2782
2783 if (!value || !size)
2784 return -EACCES;
2785
828dfe1d 2786 rc = security_context_to_sid((void *)value, size, &newsid);
1da177e4
LT		 2787 if (rc)
2788 return rc;
2789
2790 isec->sid = newsid;
2791 return 0;
2792}
2793
2794static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2795{
2796 const int len = sizeof(XATTR_NAME_SELINUX);
2797 if (buffer && len <= buffer_size)
2798 memcpy(buffer, XATTR_NAME_SELINUX, len);
2799 return len;
2800}
2801
b5376771
SH		 2802static int selinux_inode_need_killpriv(struct dentry *dentry)
2803{
2804 return secondary_ops->inode_need_killpriv(dentry);
2805}
2806
2807static int selinux_inode_killpriv(struct dentry *dentry)
2808{
2809 return secondary_ops->inode_killpriv(dentry);
2810}
2811
713a04ae
AD		 2812static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2813{
2814 struct inode_security_struct *isec = inode->i_security;
2815 *secid = isec->sid;
2816}
2817
1da177e4
LT		 2818/* file security operations */
2819
788e7dd4 2820static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 2821{
7420ed23 2822 int rc;
3d5ff529 2823 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 2824
2825 if (!mask) {
2826 /* No permission to check. Existence test. */
2827 return 0;
2828 }
2829
2830 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2831 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2832 mask |= MAY_APPEND;
2833
7420ed23
VY		 2834 rc = file_has_perm(current, file,
2835 file_mask_to_av(inode->i_mode, mask));
2836 if (rc)
2837 return rc;
2838
2839 return selinux_netlbl_inode_permission(inode, mask);
1da177e4
LT		 2840}
2841
788e7dd4
YN		 2842static int selinux_file_permission(struct file *file, int mask)
2843{
2844 struct inode *inode = file->f_path.dentry->d_inode;
2845 struct task_security_struct *tsec = current->security;
2846 struct file_security_struct *fsec = file->f_security;
2847 struct inode_security_struct *isec = inode->i_security;
2848
2849 if (!mask) {
2850 /* No permission to check. Existence test. */
2851 return 0;
2852 }
2853
2854 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2855 && fsec->pseqno == avc_policy_seqno())
2856 return selinux_netlbl_inode_permission(inode, mask);
2857
2858 return selinux_revalidate_file_permission(file, mask);
2859}
2860
1da177e4
LT		 2861static int selinux_file_alloc_security(struct file *file)
2862{
2863 return file_alloc_security(file);
2864}
2865
2866static void selinux_file_free_security(struct file *file)
2867{
2868 file_free_security(file);
2869}
2870
2871static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2872 unsigned long arg)
2873{
2874 int error = 0;
2875
2876 switch (cmd) {
828dfe1d
EP		 2877 case FIONREAD:
2878 /* fall through */
2879 case FIBMAP:
2880 /* fall through */
2881 case FIGETBSZ:
2882 /* fall through */
2883 case EXT2_IOC_GETFLAGS:
2884 /* fall through */
2885 case EXT2_IOC_GETVERSION:
2886 error = file_has_perm(current, file, FILE__GETATTR);
2887 break;
1da177e4 2888
828dfe1d
EP		 2889 case EXT2_IOC_SETFLAGS:
2890 /* fall through */
2891 case EXT2_IOC_SETVERSION:
2892 error = file_has_perm(current, file, FILE__SETATTR);
2893 break;
1da177e4 2894
828dfe1d
EP		 2895 /* sys_ioctl() checks */
2896 case FIONBIO:
2897 /* fall through */
2898 case FIOASYNC:
2899 error = file_has_perm(current, file, 0);
2900 break;
1da177e4 2901
828dfe1d
EP		 2902 case KDSKBENT:
2903 case KDSKBSENT:
2904 error = task_has_capability(current, CAP_SYS_TTY_CONFIG);
2905 break;
1da177e4 2906
828dfe1d
EP		 2907 /* default case assumes that the command will go
2908 * to the file's ioctl() function.
2909 */
2910 default:
2911 error = file_has_perm(current, file, FILE__IOCTL);
1da177e4
LT		 2912 }
2913 return error;
2914}
2915
2916static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2917{
2918#ifndef CONFIG_PPC32
2919 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2920 /*
2921 * We are making executable an anonymous mapping or a
2922 * private file mapping that will also be writable.
2923 * This has an additional check.
2924 */
2925 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2926 if (rc)
2927 return rc;
2928 }
2929#endif
2930
2931 if (file) {
2932 /* read access is always possible with a mapping */
2933 u32 av = FILE__READ;
2934
2935 /* write access only matters if the mapping is shared */
2936 if (shared && (prot & PROT_WRITE))
2937 av |= FILE__WRITE;
2938
2939 if (prot & PROT_EXEC)
2940 av |= FILE__EXECUTE;
2941
2942 return file_has_perm(current, file, av);
2943 }
2944 return 0;
2945}
2946
2947static int selinux_file_mmap(struct file *file, unsigned long reqprot,
ed032189
EP		 2948 unsigned long prot, unsigned long flags,
2949 unsigned long addr, unsigned long addr_only)
1da177e4 2950{
ed032189 2951 int rc = 0;
828dfe1d 2952 u32 sid = ((struct task_security_struct *)(current->security))->sid;
1da177e4 2953
ed032189
EP		 2954 if (addr < mmap_min_addr)
2955 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2956 MEMPROTECT__MMAP_ZERO, NULL);
2957 if (rc || addr_only)
1da177e4
LT		 2958 return rc;
2959
2960 if (selinux_checkreqprot)
2961 prot = reqprot;
2962
2963 return file_map_prot_check(file, prot,
2964 (flags & MAP_TYPE) == MAP_SHARED);
2965}
2966
2967static int selinux_file_mprotect(struct vm_area_struct *vma,
2968 unsigned long reqprot,
2969 unsigned long prot)
2970{
2971 int rc;
2972
2973 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2974 if (rc)
2975 return rc;
2976
2977 if (selinux_checkreqprot)
2978 prot = reqprot;
2979
2980#ifndef CONFIG_PPC32
db4c9641
SS		 2981 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2982 rc = 0;
2983 if (vma->vm_start >= vma->vm_mm->start_brk &&
2984 vma->vm_end <= vma->vm_mm->brk) {
2985 rc = task_has_perm(current, current,
2986 PROCESS__EXECHEAP);
2987 } else if (!vma->vm_file &&
2988 vma->vm_start <= vma->vm_mm->start_stack &&
2989 vma->vm_end >= vma->vm_mm->start_stack) {
2990 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2991 } else if (vma->vm_file && vma->anon_vma) {
2992 /*
2993 * We are making executable a file mapping that has
2994 * had some COW done. Since pages might have been
2995 * written, check ability to execute the possibly
2996 * modified content. This typically should only
2997 * occur for text relocations.
2998 */
2999 rc = file_has_perm(current, vma->vm_file,
3000 FILE__EXECMOD);
3001 }