]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - security/selinux/hooks.c
projects / mirror_ubuntu-hirsute-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[PATCH] sysctl: fix the selinux_sysctl_get_sid
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
7420ed23
VY		 15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
1da177e4
LT		 17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
1da177e4
LT		 23#include <linux/module.h>
24#include <linux/init.h>
25#include <linux/kernel.h>
26#include <linux/ptrace.h>
27#include <linux/errno.h>
28#include <linux/sched.h>
29#include <linux/security.h>
30#include <linux/xattr.h>
31#include <linux/capability.h>
32#include <linux/unistd.h>
33#include <linux/mm.h>
34#include <linux/mman.h>
35#include <linux/slab.h>
36#include <linux/pagemap.h>
37#include <linux/swap.h>
38#include <linux/smp_lock.h>
39#include <linux/spinlock.h>
40#include <linux/syscalls.h>
41#include <linux/file.h>
42#include <linux/namei.h>
43#include <linux/mount.h>
44#include <linux/ext2_fs.h>
45#include <linux/proc_fs.h>
46#include <linux/kd.h>
47#include <linux/netfilter_ipv4.h>
48#include <linux/netfilter_ipv6.h>
49#include <linux/tty.h>
50#include <net/icmp.h>
51#include <net/ip.h> /* for sysctl_local_port_range[] */
52#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53#include <asm/uaccess.h>
1da177e4
LT		 54#include <asm/ioctls.h>
55#include <linux/bitops.h>
56#include <linux/interrupt.h>
57#include <linux/netdevice.h> /* for network interface checks */
58#include <linux/netlink.h>
59#include <linux/tcp.h>
60#include <linux/udp.h>
2ee92d46 61#include <linux/dccp.h>
1da177e4
LT		 62#include <linux/quota.h>
63#include <linux/un.h> /* for Unix socket types */
64#include <net/af_unix.h> /* for Unix socket types */
65#include <linux/parser.h>
66#include <linux/nfs_mount.h>
67#include <net/ipv6.h>
68#include <linux/hugetlb.h>
69#include <linux/personality.h>
70#include <linux/sysctl.h>
71#include <linux/audit.h>
6931dfc9 72#include <linux/string.h>
877ce7c1 73#include <linux/selinux.h>
23970741 74#include <linux/mutex.h>
1da177e4
LT		 75
76#include "avc.h"
77#include "objsec.h"
78#include "netif.h"
d28d1e08 79#include "xfrm.h"
7420ed23 80#include "selinux_netlabel.h"
1da177e4
LT		 81
82#define XATTR_SELINUX_SUFFIX "selinux"
83#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84
85extern unsigned int policydb_loaded_version;
86extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
4e5ab4cb 87extern int selinux_compat_net;
1da177e4
LT		 88
89#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
90int selinux_enforcing = 0;
91
92static int __init enforcing_setup(char *str)
93{
94 selinux_enforcing = simple_strtol(str,NULL,0);
95 return 1;
96}
97__setup("enforcing=", enforcing_setup);
98#endif
99
100#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
101int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102
103static int __init selinux_enabled_setup(char *str)
104{
105 selinux_enabled = simple_strtol(str, NULL, 0);
106 return 1;
107}
108__setup("selinux=", selinux_enabled_setup);
30d55280
SS		 109#else
110int selinux_enabled = 1;
1da177e4
LT		 111#endif
112
113/* Original (dummy) security module. */
114static struct security_operations *original_ops = NULL;
115
116/* Minimal support for a secondary security module,
117 just to allow the use of the dummy or capability modules.
118 The owlsm module can alternatively be used as a secondary
119 module as long as CONFIG_OWLSM_FD is not enabled. */
120static struct security_operations *secondary_ops = NULL;
121
122/* Lists of inode and superblock security structures initialized
123 before the policy was loaded. */
124static LIST_HEAD(superblock_security_head);
125static DEFINE_SPINLOCK(sb_security_lock);
126
e18b890b 127static struct kmem_cache *sel_inode_cache;
7cae7e26 128
8c8570fb
DK		 129/* Return security context for a given sid or just the context
130 length if the buffer is null or length is 0 */
131static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132{
133 char *context;
134 unsigned len;
135 int rc;
136
137 rc = security_sid_to_context(sid, &context, &len);
138 if (rc)
139 return rc;
140
141 if (!buffer || !size)
142 goto getsecurity_exit;
143
144 if (size < len) {
145 len = -ERANGE;
146 goto getsecurity_exit;
147 }
148 memcpy(buffer, context, len);
149
150getsecurity_exit:
151 kfree(context);
152 return len;
153}
154
1da177e4
LT		 155/* Allocate and free functions for each kind of security blob. */
156
157static int task_alloc_security(struct task_struct *task)
158{
159 struct task_security_struct *tsec;
160
89d155ef 161 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4
LT		 162 if (!tsec)
163 return -ENOMEM;
164
1da177e4
LT		 165 tsec->task = task;
166 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
167 task->security = tsec;
168
169 return 0;
170}
171
172static void task_free_security(struct task_struct *task)
173{
174 struct task_security_struct *tsec = task->security;
1da177e4
LT		 175 task->security = NULL;
176 kfree(tsec);
177}
178
179static int inode_alloc_security(struct inode *inode)
180{
181 struct task_security_struct *tsec = current->security;
182 struct inode_security_struct *isec;
183
c3762229 184 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
1da177e4
LT		 185 if (!isec)
186 return -ENOMEM;
187
23970741 188 mutex_init(&isec->lock);
1da177e4 189 INIT_LIST_HEAD(&isec->list);
1da177e4
LT		 190 isec->inode = inode;
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
9ac49d22 193 isec->task_sid = tsec->sid;
1da177e4
LT		 194 inode->i_security = isec;
195
196 return 0;
197}
198
199static void inode_free_security(struct inode *inode)
200{
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
1da177e4
LT		 204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
208
209 inode->i_security = NULL;
7cae7e26 210 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT		 211}
212
213static int file_alloc_security(struct file *file)
214{
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
217
26d2a4be 218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT		 219 if (!fsec)
220 return -ENOMEM;
221
1da177e4 222 fsec->file = file;
9ac49d22
SS		 223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
1da177e4
LT		 225 file->f_security = fsec;
226
227 return 0;
228}
229
230static void file_free_security(struct file *file)
231{
232 struct file_security_struct *fsec = file->f_security;
1da177e4
LT		 233 file->f_security = NULL;
234 kfree(fsec);
235}
236
237static int superblock_alloc_security(struct super_block *sb)
238{
239 struct superblock_security_struct *sbsec;
240
89d155ef 241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT		 242 if (!sbsec)
243 return -ENOMEM;
244
bc7e982b 245 mutex_init(&sbsec->lock);
1da177e4
LT		 246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT		 249 sbsec->sb = sb;
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
c312feb2 252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT		 253 sb->s_security = sbsec;
254
255 return 0;
256}
257
258static void superblock_free_security(struct super_block *sb)
259{
260 struct superblock_security_struct *sbsec = sb->s_security;
261
1da177e4
LT		 262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
266
267 sb->s_security = NULL;
268 kfree(sbsec);
269}
270
7d877f3b 271static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
1da177e4
LT		 272{
273 struct sk_security_struct *ssec;
274
89d155ef 275 ssec = kzalloc(sizeof(*ssec), priority);
1da177e4
LT		 276 if (!ssec)
277 return -ENOMEM;
278
1da177e4
LT		 279 ssec->sk = sk;
280 ssec->peer_sid = SECINITSID_UNLABELED;
892c141e 281 ssec->sid = SECINITSID_UNLABELED;
1da177e4
LT		 282 sk->sk_security = ssec;
283
99f59ed0
PM		 284 selinux_netlbl_sk_security_init(ssec, family);
285
1da177e4
LT		 286 return 0;
287}
288
289static void sk_free_security(struct sock *sk)
290{
291 struct sk_security_struct *ssec = sk->sk_security;
292
1da177e4
LT		 293 sk->sk_security = NULL;
294 kfree(ssec);
295}
1da177e4
LT		 296
297/* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299extern int ss_initialized;
300
301/* The file system's label must be initialized prior to use. */
302
303static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310};
311
312static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314static inline int inode_doinit(struct inode *inode)
315{
316 return inode_doinit_with_dentry(inode, NULL);
317}
318
319enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
0808925e 323 Opt_rootcontext = 8,
1da177e4
LT		 324};
325
326static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
0808925e 330 {Opt_rootcontext, "rootcontext=%s"},
1da177e4
LT		 331};
332
333#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
334
c312feb2
EP		 335static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
338{
339 int rc;
340
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
343 if (rc)
344 return rc;
345
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
348 return rc;
349}
350
0808925e
EP		 351static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
354{
355 int rc;
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
358 if (rc)
359 return rc;
360
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
363 return rc;
364}
365
1da177e4
LT		 366static int try_context_mount(struct super_block *sb, void *data)
367{
368 char *context = NULL, *defcontext = NULL;
0808925e 369 char *fscontext = NULL, *rootcontext = NULL;
1da177e4
LT		 370 const char *name;
371 u32 sid;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
375
376 if (!data)
377 goto out;
378
379 name = sb->s_type->name;
380
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
382
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
386
387 if (d->version < NFS_MOUNT_VERSION)
388 goto out;
389
390 if (d->context[0]) {
391 context = d->context;
392 seen |= Opt_context;
393 }
394 } else
395 goto out;
396
397 } else {
398 /* Standard string-based options. */
399 char *p, *options = data;
400
3528a953 401 while ((p = strsep(&options, "|")) != NULL) {
1da177e4
LT		 402 int token;
403 substring_t args[MAX_OPT_ARGS];
404
405 if (!*p)
406 continue;
407
408 token = match_token(p, tokens, args);
409
410 switch (token) {
411 case Opt_context:
c312feb2 412 if (seen & (Opt_context|Opt_defcontext)) {
1da177e4
LT		 413 rc = -EINVAL;
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
415 goto out_free;
416 }
417 context = match_strdup(&args[0]);
418 if (!context) {
419 rc = -ENOMEM;
420 goto out_free;
421 }
422 if (!alloc)
423 alloc = 1;
424 seen |= Opt_context;
425 break;
426
427 case Opt_fscontext:
c312feb2 428 if (seen & Opt_fscontext) {
1da177e4
LT		 429 rc = -EINVAL;
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
431 goto out_free;
432 }
c312feb2
EP		 433 fscontext = match_strdup(&args[0]);
434 if (!fscontext) {
1da177e4
LT		 435 rc = -ENOMEM;
436 goto out_free;
437 }
438 if (!alloc)
439 alloc = 1;
440 seen |= Opt_fscontext;
441 break;
442
0808925e
EP		 443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
445 rc = -EINVAL;
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
447 goto out_free;
448 }
449 rootcontext = match_strdup(&args[0]);
450 if (!rootcontext) {
451 rc = -ENOMEM;
452 goto out_free;
453 }
454 if (!alloc)
455 alloc = 1;
456 seen |= Opt_rootcontext;
457 break;
458
1da177e4
LT		 459 case Opt_defcontext:
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
461 rc = -EINVAL;
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
465 goto out_free;
466 }
467 if (seen & (Opt_context|Opt_defcontext)) {
468 rc = -EINVAL;
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
470 goto out_free;
471 }
472 defcontext = match_strdup(&args[0]);
473 if (!defcontext) {
474 rc = -ENOMEM;
475 goto out_free;
476 }
477 if (!alloc)
478 alloc = 1;
479 seen |= Opt_defcontext;
480 break;
481
482 default:
483 rc = -EINVAL;
484 printk(KERN_WARNING "SELinux: unknown mount "
485 "option\n");
486 goto out_free;
487
488 }
489 }
490 }
491
492 if (!seen)
493 goto out;
494
c312feb2
EP		 495 /* sets the context of the superblock for the fs being mounted. */
496 if (fscontext) {
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
1da177e4
LT		 498 if (rc) {
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
c312feb2 501 fscontext, sb->s_id, name, rc);
1da177e4
LT		 502 goto out_free;
503 }
504
c312feb2 505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
1da177e4
LT		 506 if (rc)
507 goto out_free;
508
c312feb2
EP		 509 sbsec->sid = sid;
510 }
511
512 /*
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
516 */
517 if (context) {
518 rc = security_context_to_sid(context, strlen(context), &sid);
519 if (rc) {
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
523 goto out_free;
524 }
525
b04ea3ce
EP		 526 if (!fscontext) {
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
528 if (rc)
529 goto out_free;
c312feb2 530 sbsec->sid = sid;
b04ea3ce
EP		 531 } else {
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
533 if (rc)
534 goto out_free;
535 }
c312feb2 536 sbsec->mntpoint_sid = sid;
1da177e4 537
c312feb2 538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT		 539 }
540
0808925e
EP		 541 if (rootcontext) {
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
545 if (rc) {
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
549 goto out_free;
550 }
551
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
553 if (rc)
554 goto out_free;
555
556 isec->sid = sid;
557 isec->initialized = 1;
558 }
559
1da177e4
LT		 560 if (defcontext) {
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
562 if (rc) {
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
566 goto out_free;
567 }
568
569 if (sid == sbsec->def_sid)
570 goto out_free;
571
0808925e 572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
1da177e4
LT		 573 if (rc)
574 goto out_free;
575
576 sbsec->def_sid = sid;
577 }
578
579out_free:
580 if (alloc) {
581 kfree(context);
582 kfree(defcontext);
c312feb2 583 kfree(fscontext);
0808925e 584 kfree(rootcontext);
1da177e4
LT		 585 }
586out:
587 return rc;
588}
589
590static int superblock_doinit(struct super_block *sb, void *data)
591{
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
595 int rc = 0;
596
bc7e982b 597 mutex_lock(&sbsec->lock);
1da177e4
LT		 598 if (sbsec->initialized)
599 goto out;
600
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
609 goto out;
610 }
611
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
614 if (rc) {
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
617 goto out;
618 }
619
620 rc = try_context_mount(sb, data);
621 if (rc)
622 goto out;
623
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
633 rc = -EOPNOTSUPP;
634 goto out;
635 }
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
642 else
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
646 goto out;
647 }
648 }
649
650 if (strcmp(sb->s_type->name, "proc") == 0)
651 sbsec->proc = 1;
652
653 sbsec->initialized = 1;
654
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
658 }
659 else {
660 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
663 }
664
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
667
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
671 populates itself. */
672 spin_lock(&sbsec->isec_lock);
673next_inode:
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
681 if (inode) {
682 if (!IS_PRIVATE (inode))
683 inode_doinit(inode);
684 iput(inode);
685 }
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
688 goto next_inode;
689 }
690 spin_unlock(&sbsec->isec_lock);
691out:
bc7e982b 692 mutex_unlock(&sbsec->lock);
1da177e4
LT		 693 return rc;
694}
695
696static inline u16 inode_mode_to_security_class(umode_t mode)
697{
698 switch (mode & S_IFMT) {
699 case S_IFSOCK:
700 return SECCLASS_SOCK_FILE;
701 case S_IFLNK:
702 return SECCLASS_LNK_FILE;
703 case S_IFREG:
704 return SECCLASS_FILE;
705 case S_IFBLK:
706 return SECCLASS_BLK_FILE;
707 case S_IFDIR:
708 return SECCLASS_DIR;
709 case S_IFCHR:
710 return SECCLASS_CHR_FILE;
711 case S_IFIFO:
712 return SECCLASS_FIFO_FILE;
713
714 }
715
716 return SECCLASS_FILE;
717}
718
13402580
JM		 719static inline int default_protocol_stream(int protocol)
720{
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
722}
723
724static inline int default_protocol_dgram(int protocol)
725{
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
727}
728
1da177e4
LT		 729static inline u16 socket_type_to_security_class(int family, int type, int protocol)
730{
731 switch (family) {
732 case PF_UNIX:
733 switch (type) {
734 case SOCK_STREAM:
735 case SOCK_SEQPACKET:
736 return SECCLASS_UNIX_STREAM_SOCKET;
737 case SOCK_DGRAM:
738 return SECCLASS_UNIX_DGRAM_SOCKET;
739 }
740 break;
741 case PF_INET:
742 case PF_INET6:
743 switch (type) {
744 case SOCK_STREAM:
13402580
JM		 745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
747 else
748 return SECCLASS_RAWIP_SOCKET;
1da177e4 749 case SOCK_DGRAM:
13402580
JM		 750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
752 else
753 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM		 754 case SOCK_DCCP:
755 return SECCLASS_DCCP_SOCKET;
13402580 756 default:
1da177e4
LT		 757 return SECCLASS_RAWIP_SOCKET;
758 }
759 break;
760 case PF_NETLINK:
761 switch (protocol) {
762 case NETLINK_ROUTE:
763 return SECCLASS_NETLINK_ROUTE_SOCKET;
764 case NETLINK_FIREWALL:
765 return SECCLASS_NETLINK_FIREWALL_SOCKET;
216efaaa 766 case NETLINK_INET_DIAG:
1da177e4
LT		 767 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
768 case NETLINK_NFLOG:
769 return SECCLASS_NETLINK_NFLOG_SOCKET;
770 case NETLINK_XFRM:
771 return SECCLASS_NETLINK_XFRM_SOCKET;
772 case NETLINK_SELINUX:
773 return SECCLASS_NETLINK_SELINUX_SOCKET;
774 case NETLINK_AUDIT:
775 return SECCLASS_NETLINK_AUDIT_SOCKET;
776 case NETLINK_IP6_FW:
777 return SECCLASS_NETLINK_IP6FW_SOCKET;
778 case NETLINK_DNRTMSG:
779 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 780 case NETLINK_KOBJECT_UEVENT:
781 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 782 default:
783 return SECCLASS_NETLINK_SOCKET;
784 }
785 case PF_PACKET:
786 return SECCLASS_PACKET_SOCKET;
787 case PF_KEY:
788 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP		 789 case PF_APPLETALK:
790 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT		 791 }
792
793 return SECCLASS_SOCKET;
794}
795
796#ifdef CONFIG_PROC_FS
797static int selinux_proc_get_sid(struct proc_dir_entry *de,
798 u16 tclass,
799 u32 *sid)
800{
801 int buflen, rc;
802 char *buffer, *path, *end;
803
804 buffer = (char*)__get_free_page(GFP_KERNEL);
805 if (!buffer)
806 return -ENOMEM;
807
808 buflen = PAGE_SIZE;
809 end = buffer+buflen;
810 *--end = '\0';
811 buflen--;
812 path = end-1;
813 *path = '/';
814 while (de && de != de->parent) {
815 buflen -= de->namelen + 1;
816 if (buflen < 0)
817 break;
818 end -= de->namelen;
819 memcpy(end, de->name, de->namelen);
820 *--end = '/';
821 path = end;
822 de = de->parent;
823 }
824 rc = security_genfs_sid("proc", path, tclass, sid);
825 free_page((unsigned long)buffer);
826 return rc;
827}
828#else
829static int selinux_proc_get_sid(struct proc_dir_entry *de,
830 u16 tclass,
831 u32 *sid)
832{
833 return -EINVAL;
834}
835#endif
836
837/* The inode's security attributes must be initialized before first use. */
838static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
839{
840 struct superblock_security_struct *sbsec = NULL;
841 struct inode_security_struct *isec = inode->i_security;
842 u32 sid;
843 struct dentry *dentry;
844#define INITCONTEXTLEN 255
845 char *context = NULL;
846 unsigned len = 0;
847 int rc = 0;
1da177e4
LT		 848
849 if (isec->initialized)
850 goto out;
851
23970741 852 mutex_lock(&isec->lock);
1da177e4 853 if (isec->initialized)
23970741 854 goto out_unlock;
1da177e4
LT		 855
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
23970741 865 goto out_unlock;
1da177e4
LT		 866 }
867
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
872 break;
873 }
874
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
877 if (opt_dentry) {
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
880 } else {
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
883 }
884 if (!dentry) {
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
887 inode->i_ino);
23970741 888 goto out_unlock;
1da177e4
LT		 889 }
890
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
893 if (!context) {
894 rc = -ENOMEM;
895 dput(dentry);
23970741 896 goto out_unlock;
1da177e4
LT		 897 }
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
899 context, len);
900 if (rc == -ERANGE) {
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
903 NULL, 0);
904 if (rc < 0) {
905 dput(dentry);
23970741 906 goto out_unlock;
1da177e4
LT		 907 }
908 kfree(context);
909 len = rc;
910 context = kmalloc(len, GFP_KERNEL);
911 if (!context) {
912 rc = -ENOMEM;
913 dput(dentry);
23970741 914 goto out_unlock;
1da177e4
LT		 915 }
916 rc = inode->i_op->getxattr(dentry,
917 XATTR_NAME_SELINUX,
918 context, len);
919 }
920 dput(dentry);
921 if (rc < 0) {
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
926 kfree(context);
23970741 927 goto out_unlock;
1da177e4
LT		 928 }
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
931 rc = 0;
932 } else {
f5c1d5b2
JM		 933 rc = security_context_to_sid_default(context, rc, &sid,
934 sbsec->def_sid);
1da177e4
LT		 935 if (rc) {
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
940 kfree(context);
941 /* Leave with the unlabeled SID */
942 rc = 0;
943 break;
944 }
945 }
946 kfree(context);
947 isec->sid = sid;
948 break;
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
951 break;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
955
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
959 sbsec->sid,
960 isec->sclass,
961 &sid);
962 if (rc)
23970741 963 goto out_unlock;
1da177e4
LT		 964 isec->sid = sid;
965 break;
c312feb2
EP		 966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
968 break;
1da177e4 969 default:
c312feb2 970 /* Default to the fs superblock SID. */
1da177e4
LT		 971 isec->sid = sbsec->sid;
972
973 if (sbsec->proc) {
974 struct proc_inode *proci = PROC_I(inode);
975 if (proci->pde) {
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
978 isec->sclass,
979 &sid);
980 if (rc)
23970741 981 goto out_unlock;
1da177e4
LT		 982 isec->sid = sid;
983 }
984 }
985 break;
986 }
987
988 isec->initialized = 1;
989
23970741
EP		 990out_unlock:
991 mutex_unlock(&isec->lock);
1da177e4
LT		 992out:
993 if (isec->sclass == SECCLASS_FILE)
994 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT		 995 return rc;
996}
997
998/* Convert a Linux signal to an access vector. */
999static inline u32 signal_to_av(int sig)
1000{
1001 u32 perm = 0;
1002
1003 switch (sig) {
1004 case SIGCHLD:
1005 /* Commonly granted from child to parent. */
1006 perm = PROCESS__SIGCHLD;
1007 break;
1008 case SIGKILL:
1009 /* Cannot be caught or ignored */
1010 perm = PROCESS__SIGKILL;
1011 break;
1012 case SIGSTOP:
1013 /* Cannot be caught or ignored */
1014 perm = PROCESS__SIGSTOP;
1015 break;
1016 default:
1017 /* All other signals. */
1018 perm = PROCESS__SIGNAL;
1019 break;
1020 }
1021
1022 return perm;
1023}
1024
1025/* Check permission betweeen a pair of tasks, e.g. signal checks,
1026 fork check, ptrace check, etc. */
1027static int task_has_perm(struct task_struct *tsk1,
1028 struct task_struct *tsk2,
1029 u32 perms)
1030{
1031 struct task_security_struct *tsec1, *tsec2;
1032
1033 tsec1 = tsk1->security;
1034 tsec2 = tsk2->security;
1035 return avc_has_perm(tsec1->sid, tsec2->sid,
1036 SECCLASS_PROCESS, perms, NULL);
1037}
1038
1039/* Check whether a task is allowed to use a capability. */
1040static int task_has_capability(struct task_struct *tsk,
1041 int cap)
1042{
1043 struct task_security_struct *tsec;
1044 struct avc_audit_data ad;
1045
1046 tsec = tsk->security;
1047
1048 AVC_AUDIT_DATA_INIT(&ad,CAP);
1049 ad.tsk = tsk;
1050 ad.u.cap = cap;
1051
1052 return avc_has_perm(tsec->sid, tsec->sid,
1053 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1054}
1055
1056/* Check whether a task is allowed to use a system operation. */
1057static int task_has_system(struct task_struct *tsk,
1058 u32 perms)
1059{
1060 struct task_security_struct *tsec;
1061
1062 tsec = tsk->security;
1063
1064 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1065 SECCLASS_SYSTEM, perms, NULL);
1066}
1067
1068/* Check whether a task has a particular permission to an inode.
1069 The 'adp' parameter is optional and allows other audit
1070 data to be passed (e.g. the dentry). */
1071static int inode_has_perm(struct task_struct *tsk,
1072 struct inode *inode,
1073 u32 perms,
1074 struct avc_audit_data *adp)
1075{
1076 struct task_security_struct *tsec;
1077 struct inode_security_struct *isec;
1078 struct avc_audit_data ad;
1079
1080 tsec = tsk->security;
1081 isec = inode->i_security;
1082
1083 if (!adp) {
1084 adp = &ad;
1085 AVC_AUDIT_DATA_INIT(&ad, FS);
1086 ad.u.fs.inode = inode;
1087 }
1088
1089 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1090}
1091
1092/* Same as inode_has_perm, but pass explicit audit data containing
1093 the dentry to help the auditing code to more easily generate the
1094 pathname if needed. */
1095static inline int dentry_has_perm(struct task_struct *tsk,
1096 struct vfsmount *mnt,
1097 struct dentry *dentry,
1098 u32 av)
1099{
1100 struct inode *inode = dentry->d_inode;
1101 struct avc_audit_data ad;
1102 AVC_AUDIT_DATA_INIT(&ad,FS);
1103 ad.u.fs.mnt = mnt;
1104 ad.u.fs.dentry = dentry;
1105 return inode_has_perm(tsk, inode, av, &ad);
1106}
1107
1108/* Check whether a task can use an open file descriptor to
1109 access an inode in a given way. Check access to the
1110 descriptor itself, and then use dentry_has_perm to
1111 check a particular permission to the file.
1112 Access to the descriptor is implicitly granted if it
1113 has the same SID as the process. If av is zero, then
1114 access to the file is not checked, e.g. for cases
1115 where only the descriptor is affected like seek. */
858119e1 1116static int file_has_perm(struct task_struct *tsk,
1da177e4
LT		 1117 struct file *file,
1118 u32 av)
1119{
1120 struct task_security_struct *tsec = tsk->security;
1121 struct file_security_struct *fsec = file->f_security;
3d5ff529
JS		 1122 struct vfsmount *mnt = file->f_path.mnt;
1123 struct dentry *dentry = file->f_path.dentry;
1da177e4
LT		 1124 struct inode *inode = dentry->d_inode;
1125 struct avc_audit_data ad;
1126 int rc;
1127
1128 AVC_AUDIT_DATA_INIT(&ad, FS);
1129 ad.u.fs.mnt = mnt;
1130 ad.u.fs.dentry = dentry;
1131
1132 if (tsec->sid != fsec->sid) {
1133 rc = avc_has_perm(tsec->sid, fsec->sid,
1134 SECCLASS_FD,
1135 FD__USE,
1136 &ad);
1137 if (rc)
1138 return rc;
1139 }
1140
1141 /* av is zero if only checking access to the descriptor. */
1142 if (av)
1143 return inode_has_perm(tsk, inode, av, &ad);
1144
1145 return 0;
1146}
1147
1148/* Check whether a task can create a file. */
1149static int may_create(struct inode *dir,
1150 struct dentry *dentry,
1151 u16 tclass)
1152{
1153 struct task_security_struct *tsec;
1154 struct inode_security_struct *dsec;
1155 struct superblock_security_struct *sbsec;
1156 u32 newsid;
1157 struct avc_audit_data ad;
1158 int rc;
1159
1160 tsec = current->security;
1161 dsec = dir->i_security;
1162 sbsec = dir->i_sb->s_security;
1163
1164 AVC_AUDIT_DATA_INIT(&ad, FS);
1165 ad.u.fs.dentry = dentry;
1166
1167 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1168 DIR__ADD_NAME | DIR__SEARCH,
1169 &ad);
1170 if (rc)
1171 return rc;
1172
1173 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1174 newsid = tsec->create_sid;
1175 } else {
1176 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1177 &newsid);
1178 if (rc)
1179 return rc;
1180 }
1181
1182 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1183 if (rc)
1184 return rc;
1185
1186 return avc_has_perm(newsid, sbsec->sid,
1187 SECCLASS_FILESYSTEM,
1188 FILESYSTEM__ASSOCIATE, &ad);
1189}
1190
4eb582cf
ML		 1191/* Check whether a task can create a key. */
1192static int may_create_key(u32 ksid,
1193 struct task_struct *ctx)
1194{
1195 struct task_security_struct *tsec;
1196
1197 tsec = ctx->security;
1198
1199 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1200}
1201
1da177e4
LT		 1202#define MAY_LINK 0
1203#define MAY_UNLINK 1
1204#define MAY_RMDIR 2
1205
1206/* Check whether a task can link, unlink, or rmdir a file/directory. */
1207static int may_link(struct inode *dir,
1208 struct dentry *dentry,
1209 int kind)
1210
1211{
1212 struct task_security_struct *tsec;
1213 struct inode_security_struct *dsec, *isec;
1214 struct avc_audit_data ad;
1215 u32 av;
1216 int rc;
1217
1218 tsec = current->security;
1219 dsec = dir->i_security;
1220 isec = dentry->d_inode->i_security;
1221
1222 AVC_AUDIT_DATA_INIT(&ad, FS);
1223 ad.u.fs.dentry = dentry;
1224
1225 av = DIR__SEARCH;
1226 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1227 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1228 if (rc)
1229 return rc;
1230
1231 switch (kind) {
1232 case MAY_LINK:
1233 av = FILE__LINK;
1234 break;
1235 case MAY_UNLINK:
1236 av = FILE__UNLINK;
1237 break;
1238 case MAY_RMDIR:
1239 av = DIR__RMDIR;
1240 break;
1241 default:
1242 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1243 return 0;
1244 }
1245
1246 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1247 return rc;
1248}
1249
1250static inline int may_rename(struct inode *old_dir,
1251 struct dentry *old_dentry,
1252 struct inode *new_dir,
1253 struct dentry *new_dentry)
1254{
1255 struct task_security_struct *tsec;
1256 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1257 struct avc_audit_data ad;
1258 u32 av;
1259 int old_is_dir, new_is_dir;
1260 int rc;
1261
1262 tsec = current->security;
1263 old_dsec = old_dir->i_security;
1264 old_isec = old_dentry->d_inode->i_security;
1265 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1266 new_dsec = new_dir->i_security;
1267
1268 AVC_AUDIT_DATA_INIT(&ad, FS);
1269
1270 ad.u.fs.dentry = old_dentry;
1271 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1272 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1273 if (rc)
1274 return rc;
1275 rc = avc_has_perm(tsec->sid, old_isec->sid,
1276 old_isec->sclass, FILE__RENAME, &ad);
1277 if (rc)
1278 return rc;
1279 if (old_is_dir && new_dir != old_dir) {
1280 rc = avc_has_perm(tsec->sid, old_isec->sid,
1281 old_isec->sclass, DIR__REPARENT, &ad);
1282 if (rc)
1283 return rc;
1284 }
1285
1286 ad.u.fs.dentry = new_dentry;
1287 av = DIR__ADD_NAME | DIR__SEARCH;
1288 if (new_dentry->d_inode)
1289 av |= DIR__REMOVE_NAME;
1290 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1291 if (rc)
1292 return rc;
1293 if (new_dentry->d_inode) {
1294 new_isec = new_dentry->d_inode->i_security;
1295 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1296 rc = avc_has_perm(tsec->sid, new_isec->sid,
1297 new_isec->sclass,
1298 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1299 if (rc)
1300 return rc;
1301 }
1302
1303 return 0;
1304}
1305
1306/* Check whether a task can perform a filesystem operation. */
1307static int superblock_has_perm(struct task_struct *tsk,
1308 struct super_block *sb,
1309 u32 perms,
1310 struct avc_audit_data *ad)
1311{
1312 struct task_security_struct *tsec;
1313 struct superblock_security_struct *sbsec;
1314
1315 tsec = tsk->security;
1316 sbsec = sb->s_security;
1317 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1318 perms, ad);
1319}
1320
1321/* Convert a Linux mode and permission mask to an access vector. */
1322static inline u32 file_mask_to_av(int mode, int mask)
1323{
1324 u32 av = 0;
1325
1326 if ((mode & S_IFMT) != S_IFDIR) {
1327 if (mask & MAY_EXEC)
1328 av |= FILE__EXECUTE;
1329 if (mask & MAY_READ)
1330 av |= FILE__READ;
1331
1332 if (mask & MAY_APPEND)
1333 av |= FILE__APPEND;
1334 else if (mask & MAY_WRITE)
1335 av |= FILE__WRITE;
1336
1337 } else {
1338 if (mask & MAY_EXEC)
1339 av |= DIR__SEARCH;
1340 if (mask & MAY_WRITE)
1341 av |= DIR__WRITE;
1342 if (mask & MAY_READ)
1343 av |= DIR__READ;
1344 }
1345
1346 return av;
1347}
1348
1349/* Convert a Linux file to an access vector. */
1350static inline u32 file_to_av(struct file *file)
1351{
1352 u32 av = 0;
1353
1354 if (file->f_mode & FMODE_READ)
1355 av |= FILE__READ;
1356 if (file->f_mode & FMODE_WRITE) {
1357 if (file->f_flags & O_APPEND)
1358 av |= FILE__APPEND;
1359 else
1360 av |= FILE__WRITE;
1361 }
1362
1363 return av;
1364}
1365
1da177e4
LT		 1366/* Hook functions begin here. */
1367
1368static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1369{
1370 struct task_security_struct *psec = parent->security;
1371 struct task_security_struct *csec = child->security;
1372 int rc;
1373
1374 rc = secondary_ops->ptrace(parent,child);
1375 if (rc)
1376 return rc;
1377
1378 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1379 /* Save the SID of the tracing process for later use in apply_creds. */
341c2d80 1380 if (!(child->ptrace & PT_PTRACED) && !rc)
1da177e4
LT		 1381 csec->ptrace_sid = psec->sid;
1382 return rc;
1383}
1384
1385static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1386 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1387{
1388 int error;
1389
1390 error = task_has_perm(current, target, PROCESS__GETCAP);
1391 if (error)
1392 return error;
1393
1394 return secondary_ops->capget(target, effective, inheritable, permitted);
1395}
1396
1397static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1398 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1399{
1400 int error;
1401
1402 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1403 if (error)
1404 return error;
1405
1406 return task_has_perm(current, target, PROCESS__SETCAP);
1407}
1408
1409static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1410 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1411{
1412 secondary_ops->capset_set(target, effective, inheritable, permitted);
1413}
1414
1415static int selinux_capable(struct task_struct *tsk, int cap)
1416{
1417 int rc;
1418
1419 rc = secondary_ops->capable(tsk, cap);
1420 if (rc)
1421 return rc;
1422
1423 return task_has_capability(tsk,cap);
1424}
1425
3fbfa981
EB		 1426static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1427{
1428 int buflen, rc;
1429 char *buffer, *path, *end;
1430
1431 rc = -ENOMEM;
1432 buffer = (char*)__get_free_page(GFP_KERNEL);
1433 if (!buffer)
1434 goto out;
1435
1436 buflen = PAGE_SIZE;
1437 end = buffer+buflen;
1438 *--end = '\0';
1439 buflen--;
1440 path = end-1;
1441 *path = '/';
1442 while (table) {
1443 const char *name = table->procname;
1444 size_t namelen = strlen(name);
1445 buflen -= namelen + 1;
1446 if (buflen < 0)
1447 goto out_free;
1448 end -= namelen;
1449 memcpy(end, name, namelen);
1450 *--end = '/';
1451 path = end;
1452 table = table->parent;
1453 }
b599fdfd
EB		 1454 buflen -= 4;
1455 if (buflen < 0)
1456 goto out_free;
1457 end -= 4;
1458 memcpy(end, "/sys", 4);
1459 path = end;
3fbfa981
EB		 1460 rc = security_genfs_sid("proc", path, tclass, sid);
1461out_free:
1462 free_page((unsigned long)buffer);
1463out:
1464 return rc;
1465}
1466
1da177e4
LT		 1467static int selinux_sysctl(ctl_table *table, int op)
1468{
1469 int error = 0;
1470 u32 av;
1471 struct task_security_struct *tsec;
1472 u32 tsid;
1473 int rc;
1474
1475 rc = secondary_ops->sysctl(table, op);
1476 if (rc)
1477 return rc;
1478
1479 tsec = current->security;
1480
3fbfa981
EB		 1481 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1482 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1da177e4
LT		 1483 if (rc) {
1484 /* Default to the well-defined sysctl SID. */
1485 tsid = SECINITSID_SYSCTL;
1486 }
1487
1488 /* The op values are "defined" in sysctl.c, thereby creating
1489 * a bad coupling between this module and sysctl.c */
1490 if(op == 001) {
1491 error = avc_has_perm(tsec->sid, tsid,
1492 SECCLASS_DIR, DIR__SEARCH, NULL);
1493 } else {
1494 av = 0;
1495 if (op & 004)
1496 av |= FILE__READ;
1497 if (op & 002)
1498 av |= FILE__WRITE;
1499 if (av)
1500 error = avc_has_perm(tsec->sid, tsid,
1501 SECCLASS_FILE, av, NULL);
1502 }
1503
1504 return error;
1505}
1506
1507static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1508{
1509 int rc = 0;
1510
1511 if (!sb)
1512 return 0;
1513
1514 switch (cmds) {
1515 case Q_SYNC:
1516 case Q_QUOTAON:
1517 case Q_QUOTAOFF:
1518 case Q_SETINFO:
1519 case Q_SETQUOTA:
1520 rc = superblock_has_perm(current,
1521 sb,
1522 FILESYSTEM__QUOTAMOD, NULL);
1523 break;
1524 case Q_GETFMT:
1525 case Q_GETINFO:
1526 case Q_GETQUOTA:
1527 rc = superblock_has_perm(current,
1528 sb,
1529 FILESYSTEM__QUOTAGET, NULL);
1530 break;
1531 default:
1532 rc = 0; /* let the kernel handle invalid cmds */
1533 break;
1534 }
1535 return rc;
1536}
1537
1538static int selinux_quota_on(struct dentry *dentry)
1539{
1540 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1541}
1542
1543static int selinux_syslog(int type)
1544{
1545 int rc;
1546
1547 rc = secondary_ops->syslog(type);
1548 if (rc)
1549 return rc;
1550
1551 switch (type) {
1552 case 3: /* Read last kernel messages */
1553 case 10: /* Return size of the log buffer */
1554 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1555 break;
1556 case 6: /* Disable logging to console */
1557 case 7: /* Enable logging to console */
1558 case 8: /* Set level of messages printed to console */
1559 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1560 break;
1561 case 0: /* Close log */
1562 case 1: /* Open log */
1563 case 2: /* Read from log */
1564 case 4: /* Read/clear last kernel messages */
1565 case 5: /* Clear ring buffer */
1566 default:
1567 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1568 break;
1569 }
1570 return rc;
1571}
1572
1573/*
1574 * Check that a process has enough memory to allocate a new virtual
1575 * mapping. 0 means there is enough memory for the allocation to
1576 * succeed and -ENOMEM implies there is not.
1577 *
1578 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1579 * if the capability is granted, but __vm_enough_memory requires 1 if
1580 * the capability is granted.
1581 *
1582 * Do not audit the selinux permission check, as this is applied to all
1583 * processes that allocate mappings.
1584 */
1585static int selinux_vm_enough_memory(long pages)
1586{
1587 int rc, cap_sys_admin = 0;
1588 struct task_security_struct *tsec = current->security;
1589
1590 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1591 if (rc == 0)
1592 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1593 SECCLASS_CAPABILITY,
1594 CAP_TO_MASK(CAP_SYS_ADMIN),
1595 NULL);
1596
1597 if (rc == 0)
1598 cap_sys_admin = 1;
1599
1600 return __vm_enough_memory(pages, cap_sys_admin);
1601}
1602
1603/* binprm security operations */
1604
1605static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1606{
1607 struct bprm_security_struct *bsec;
1608
89d155ef 1609 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1da177e4
LT		 1610 if (!bsec)
1611 return -ENOMEM;
1612
1da177e4
LT		 1613 bsec->bprm = bprm;
1614 bsec->sid = SECINITSID_UNLABELED;
1615 bsec->set = 0;
1616
1617 bprm->security = bsec;
1618 return 0;
1619}
1620
1621static int selinux_bprm_set_security(struct linux_binprm *bprm)
1622{
1623 struct task_security_struct *tsec;
3d5ff529 1624 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1da177e4
LT		 1625 struct inode_security_struct *isec;
1626 struct bprm_security_struct *bsec;
1627 u32 newsid;
1628 struct avc_audit_data ad;
1629 int rc;
1630
1631 rc = secondary_ops->bprm_set_security(bprm);
1632 if (rc)
1633 return rc;
1634
1635 bsec = bprm->security;
1636
1637 if (bsec->set)
1638 return 0;
1639
1640 tsec = current->security;
1641 isec = inode->i_security;
1642
1643 /* Default to the current task SID. */
1644 bsec->sid = tsec->sid;
1645
28eba5bf 1646 /* Reset fs, key, and sock SIDs on execve. */
1da177e4 1647 tsec->create_sid = 0;
28eba5bf 1648 tsec->keycreate_sid = 0;
42c3e03e 1649 tsec->sockcreate_sid = 0;
1da177e4
LT		 1650
1651 if (tsec->exec_sid) {
1652 newsid = tsec->exec_sid;
1653 /* Reset exec SID on execve. */
1654 tsec->exec_sid = 0;
1655 } else {
1656 /* Check for a default transition on this program. */
1657 rc = security_transition_sid(tsec->sid, isec->sid,
1658 SECCLASS_PROCESS, &newsid);
1659 if (rc)
1660 return rc;
1661 }
1662
1663 AVC_AUDIT_DATA_INIT(&ad, FS);
3d5ff529
JS		 1664 ad.u.fs.mnt = bprm->file->f_path.mnt;
1665 ad.u.fs.dentry = bprm->file->f_path.dentry;
1da177e4 1666
3d5ff529 1667 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1da177e4
LT		 1668 newsid = tsec->sid;
1669
1670 if (tsec->sid == newsid) {
1671 rc = avc_has_perm(tsec->sid, isec->sid,
1672 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1673 if (rc)
1674 return rc;
1675 } else {
1676 /* Check permissions for the transition. */
1677 rc = avc_has_perm(tsec->sid, newsid,
1678 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1679 if (rc)
1680 return rc;
1681
1682 rc = avc_has_perm(newsid, isec->sid,
1683 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1684 if (rc)
1685 return rc;
1686
1687 /* Clear any possibly unsafe personality bits on exec: */
1688 current->personality &= ~PER_CLEAR_ON_SETID;
1689
1690 /* Set the security field to the new SID. */
1691 bsec->sid = newsid;
1692 }
1693
1694 bsec->set = 1;
1695 return 0;
1696}
1697
1698static int selinux_bprm_check_security (struct linux_binprm *bprm)
1699{
1700 return secondary_ops->bprm_check_security(bprm);
1701}
1702
1703
1704static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1705{
1706 struct task_security_struct *tsec = current->security;
1707 int atsecure = 0;
1708
1709 if (tsec->osid != tsec->sid) {
1710 /* Enable secure mode for SIDs transitions unless
1711 the noatsecure permission is granted between
1712 the two SIDs, i.e. ahp returns 0. */
1713 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1714 SECCLASS_PROCESS,
1715 PROCESS__NOATSECURE, NULL);
1716 }
1717
1718 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1719}
1720
1721static void selinux_bprm_free_security(struct linux_binprm *bprm)
1722{
9a5f04bf 1723 kfree(bprm->security);
1da177e4 1724 bprm->security = NULL;
1da177e4
LT		 1725}
1726
1727extern struct vfsmount *selinuxfs_mount;
1728extern struct dentry *selinux_null;
1729
1730/* Derived from fs/exec.c:flush_old_files. */
1731static inline void flush_unauthorized_files(struct files_struct * files)
1732{
1733 struct avc_audit_data ad;
1734 struct file *file, *devnull = NULL;
b20c8122 1735 struct tty_struct *tty;
badf1662 1736 struct fdtable *fdt;
1da177e4 1737 long j = -1;
24ec839c 1738 int drop_tty = 0;
1da177e4 1739
b20c8122 1740 mutex_lock(&tty_mutex);
24ec839c 1741 tty = get_current_tty();
1da177e4
LT		 1742 if (tty) {
1743 file_list_lock();
2f512016 1744 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1da177e4
LT		 1745 if (file) {
1746 /* Revalidate access to controlling tty.
1747 Use inode_has_perm on the tty inode directly rather
1748 than using file_has_perm, as this particular open
1749 file may belong to another process and we are only
1750 interested in the inode-based check here. */
3d5ff529 1751 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 1752 if (inode_has_perm(current, inode,
1753 FILE__READ | FILE__WRITE, NULL)) {
24ec839c 1754 drop_tty = 1;
1da177e4
LT		 1755 }
1756 }
1757 file_list_unlock();
24ec839c
PZ		 1758
1759 /* Reset controlling tty. */
1760 if (drop_tty)
1761 proc_set_tty(current, NULL);
1da177e4 1762 }
b20c8122 1763 mutex_unlock(&tty_mutex);
1da177e4
LT		 1764
1765 /* Revalidate access to inherited open files. */
1766
1767 AVC_AUDIT_DATA_INIT(&ad,FS);
1768
1769 spin_lock(&files->file_lock);
1770 for (;;) {
1771 unsigned long set, i;
1772 int fd;
1773
1774 j++;
1775 i = j * __NFDBITS;
badf1662 1776 fdt = files_fdtable(files);
bbea9f69 1777 if (i >= fdt->max_fds)
1da177e4 1778 break;
badf1662 1779 set = fdt->open_fds->fds_bits[j];
1da177e4
LT		 1780 if (!set)
1781 continue;
1782 spin_unlock(&files->file_lock);
1783 for ( ; set ; i++,set >>= 1) {
1784 if (set & 1) {
1785 file = fget(i);
1786 if (!file)
1787 continue;
1788 if (file_has_perm(current,
1789 file,
1790 file_to_av(file))) {
1791 sys_close(i);
1792 fd = get_unused_fd();
1793 if (fd != i) {
1794 if (fd >= 0)
1795 put_unused_fd(fd);
1796 fput(file);
1797 continue;
1798 }
1799 if (devnull) {
095975da 1800 get_file(devnull);
1da177e4
LT		 1801 } else {
1802 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
fc5d81e6
AM		 1803 if (IS_ERR(devnull)) {
1804 devnull = NULL;
1da177e4
LT		 1805 put_unused_fd(fd);
1806 fput(file);
1807 continue;
1808 }
1809 }
1810 fd_install(fd, devnull);
1811 }
1812 fput(file);
1813 }
1814 }
1815 spin_lock(&files->file_lock);
1816
1817 }
1818 spin_unlock(&files->file_lock);
1819}
1820
1821static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1822{
1823 struct task_security_struct *tsec;
1824 struct bprm_security_struct *bsec;
1825 u32 sid;
1826 int rc;
1827
1828 secondary_ops->bprm_apply_creds(bprm, unsafe);
1829
1830 tsec = current->security;
1831
1832 bsec = bprm->security;
1833 sid = bsec->sid;
1834
1835 tsec->osid = tsec->sid;
1836 bsec->unsafe = 0;
1837 if (tsec->sid != sid) {
1838 /* Check for shared state. If not ok, leave SID
1839 unchanged and kill. */
1840 if (unsafe & LSM_UNSAFE_SHARE) {
1841 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1842 PROCESS__SHARE, NULL);
1843 if (rc) {
1844 bsec->unsafe = 1;
1845 return;
1846 }
1847 }
1848
1849 /* Check for ptracing, and update the task SID if ok.
1850 Otherwise, leave SID unchanged and kill. */
1851 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1852 rc = avc_has_perm(tsec->ptrace_sid, sid,
1853 SECCLASS_PROCESS, PROCESS__PTRACE,
1854 NULL);
1855 if (rc) {
1856 bsec->unsafe = 1;
1857 return;
1858 }
1859 }
1860 tsec->sid = sid;
1861 }
1862}
1863
1864/*
1865 * called after apply_creds without the task lock held
1866 */
1867static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1868{
1869 struct task_security_struct *tsec;
1870 struct rlimit *rlim, *initrlim;
1871 struct itimerval itimer;
1872 struct bprm_security_struct *bsec;
1873 int rc, i;
1874
1875 tsec = current->security;
1876 bsec = bprm->security;
1877
1878 if (bsec->unsafe) {
1879 force_sig_specific(SIGKILL, current);
1880 return;
1881 }
1882 if (tsec->osid == tsec->sid)
1883 return;
1884
1885 /* Close files for which the new task SID is not authorized. */
1886 flush_unauthorized_files(current->files);
1887
1888 /* Check whether the new SID can inherit signal state
1889 from the old SID. If not, clear itimers to avoid
1890 subsequent signal generation and flush and unblock
1891 signals. This must occur _after_ the task SID has
1892 been updated so that any kill done after the flush
1893 will be checked against the new SID. */
1894 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1895 PROCESS__SIGINH, NULL);
1896 if (rc) {
1897 memset(&itimer, 0, sizeof itimer);
1898 for (i = 0; i < 3; i++)
1899 do_setitimer(i, &itimer, NULL);
1900 flush_signals(current);
1901 spin_lock_irq(&current->sighand->siglock);
1902 flush_signal_handlers(current, 1);
1903 sigemptyset(&current->blocked);
1904 recalc_sigpending();
1905 spin_unlock_irq(&current->sighand->siglock);
1906 }
1907
1908 /* Check whether the new SID can inherit resource limits
1909 from the old SID. If not, reset all soft limits to
1910 the lower of the current task's hard limit and the init
1911 task's soft limit. Note that the setting of hard limits
1912 (even to lower them) can be controlled by the setrlimit
1913 check. The inclusion of the init task's soft limit into
1914 the computation is to avoid resetting soft limits higher
1915 than the default soft limit for cases where the default
1916 is lower than the hard limit, e.g. RLIMIT_CORE or
1917 RLIMIT_STACK.*/
1918 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1919 PROCESS__RLIMITINH, NULL);
1920 if (rc) {
1921 for (i = 0; i < RLIM_NLIMITS; i++) {
1922 rlim = current->signal->rlim + i;
1923 initrlim = init_task.signal->rlim+i;
1924 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1925 }
1926 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1927 /*
1928 * This will cause RLIMIT_CPU calculations
1929 * to be refigured.
1930 */
1931 current->it_prof_expires = jiffies_to_cputime(1);
1932 }
1933 }
1934
1935 /* Wake up the parent if it is waiting so that it can
1936 recheck wait permission to the new task SID. */
1937 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1938}
1939
1940/* superblock security operations */
1941
1942static int selinux_sb_alloc_security(struct super_block *sb)
1943{
1944 return superblock_alloc_security(sb);
1945}
1946
1947static void selinux_sb_free_security(struct super_block *sb)
1948{
1949 superblock_free_security(sb);
1950}
1951
1952static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1953{
1954 if (plen > olen)
1955 return 0;
1956
1957 return !memcmp(prefix, option, plen);
1958}
1959
1960static inline int selinux_option(char *option, int len)
1961{
1962 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1963 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
0808925e
EP		 1964 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1965 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1da177e4
LT		 1966}
1967
1968static inline void take_option(char **to, char *from, int *first, int len)
1969{
1970 if (!*first) {
1971 **to = ',';
1972 *to += 1;
3528a953 1973 } else
1da177e4
LT		 1974 *first = 0;
1975 memcpy(*to, from, len);
1976 *to += len;
1977}
1978
3528a953
CO		 1979static inline void take_selinux_option(char **to, char *from, int *first,
1980 int len)
1981{
1982 int current_size = 0;
1983
1984 if (!*first) {
1985 **to = '|';
1986 *to += 1;
1987 }
1988 else
1989 *first = 0;
1990
1991 while (current_size < len) {
1992 if (*from != '"') {
1993 **to = *from;
1994 *to += 1;
1995 }
1996 from += 1;
1997 current_size += 1;
1998 }
1999}
2000
1da177e4
LT		 2001static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2002{
2003 int fnosec, fsec, rc = 0;
2004 char *in_save, *in_curr, *in_end;
2005 char *sec_curr, *nosec_save, *nosec;
3528a953 2006 int open_quote = 0;
1da177e4
LT		 2007
2008 in_curr = orig;
2009 sec_curr = copy;
2010
2011 /* Binary mount data: just copy */
2012 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2013 copy_page(sec_curr, in_curr);
2014 goto out;
2015 }
2016
2017 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2018 if (!nosec) {
2019 rc = -ENOMEM;
2020 goto out;
2021 }
2022
2023 nosec_save = nosec;
2024 fnosec = fsec = 1;
2025 in_save = in_end = orig;
2026
2027 do {
3528a953
CO		 2028 if (*in_end == '"')
2029 open_quote = !open_quote;
2030 if ((*in_end == ',' && open_quote == 0) ||
2031 *in_end == '\0') {
1da177e4
LT		 2032 int len = in_end - in_curr;
2033
2034 if (selinux_option(in_curr, len))
3528a953 2035 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT		 2036 else
2037 take_option(&nosec, in_curr, &fnosec, len);
2038
2039 in_curr = in_end + 1;
2040 }
2041 } while (*in_end++);
2042
6931dfc9 2043 strcpy(in_save, nosec_save);
da3caa20 2044 free_page((unsigned long)nosec_save);
1da177e4
LT		 2045out:
2046 return rc;
2047}
2048
2049static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2050{
2051 struct avc_audit_data ad;
2052 int rc;
2053
2054 rc = superblock_doinit(sb, data);
2055 if (rc)
2056 return rc;
2057
2058 AVC_AUDIT_DATA_INIT(&ad,FS);
2059 ad.u.fs.dentry = sb->s_root;
2060 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2061}
2062
726c3342 2063static int selinux_sb_statfs(struct dentry *dentry)
1da177e4
LT		 2064{
2065 struct avc_audit_data ad;
2066
2067 AVC_AUDIT_DATA_INIT(&ad,FS);
726c3342
DH		 2068 ad.u.fs.dentry = dentry->d_sb->s_root;
2069 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT		 2070}
2071
2072static int selinux_mount(char * dev_name,
2073 struct nameidata *nd,
2074 char * type,
2075 unsigned long flags,
2076 void * data)
2077{
2078 int rc;
2079
2080 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2081 if (rc)
2082 return rc;
2083
2084 if (flags & MS_REMOUNT)
2085 return superblock_has_perm(current, nd->mnt->mnt_sb,
2086 FILESYSTEM__REMOUNT, NULL);
2087 else
2088 return dentry_has_perm(current, nd->mnt, nd->dentry,
2089 FILE__MOUNTON);
2090}
2091
2092static int selinux_umount(struct vfsmount *mnt, int flags)
2093{
2094 int rc;
2095
2096 rc = secondary_ops->sb_umount(mnt, flags);
2097 if (rc)
2098 return rc;
2099
2100 return superblock_has_perm(current,mnt->mnt_sb,
2101 FILESYSTEM__UNMOUNT,NULL);
2102}
2103
2104/* inode security operations */
2105
2106static int selinux_inode_alloc_security(struct inode *inode)
2107{
2108 return inode_alloc_security(inode);
2109}
2110
2111static void selinux_inode_free_security(struct inode *inode)
2112{
2113 inode_free_security(inode);
2114}
2115
5e41ff9e
SS		 2116static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2117 char **name, void **value,
2118 size_t *len)
2119{
2120 struct task_security_struct *tsec;
2121 struct inode_security_struct *dsec;
2122 struct superblock_security_struct *sbsec;
570bc1c2 2123 u32 newsid, clen;
5e41ff9e 2124 int rc;
570bc1c2 2125 char *namep = NULL, *context;
5e41ff9e
SS		 2126
2127 tsec = current->security;
2128 dsec = dir->i_security;
2129 sbsec = dir->i_sb->s_security;
5e41ff9e
SS		 2130
2131 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2132 newsid = tsec->create_sid;
2133 } else {
2134 rc = security_transition_sid(tsec->sid, dsec->sid,
2135 inode_mode_to_security_class(inode->i_mode),
2136 &newsid);
2137 if (rc) {
2138 printk(KERN_WARNING "%s: "
2139 "security_transition_sid failed, rc=%d (dev=%s "
2140 "ino=%ld)\n",
2141 __FUNCTION__,
2142 -rc, inode->i_sb->s_id, inode->i_ino);
2143 return rc;
2144 }
2145 }
2146
296fddf7
EP		 2147 /* Possibly defer initialization to selinux_complete_init. */
2148 if (sbsec->initialized) {
2149 struct inode_security_struct *isec = inode->i_security;
2150 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2151 isec->sid = newsid;
2152 isec->initialized = 1;
2153 }
5e41ff9e 2154
8aad3875 2155 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
25a74f3b
SS		 2156 return -EOPNOTSUPP;
2157
570bc1c2
SS		 2158 if (name) {
2159 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2160 if (!namep)
2161 return -ENOMEM;
2162 *name = namep;
2163 }
5e41ff9e 2164
570bc1c2
SS		 2165 if (value && len) {
2166 rc = security_sid_to_context(newsid, &context, &clen);
2167 if (rc) {
2168 kfree(namep);
2169 return rc;
2170 }
2171 *value = context;
2172 *len = clen;
5e41ff9e 2173 }
5e41ff9e 2174
5e41ff9e
SS		 2175 return 0;
2176}
2177
1da177e4
LT		 2178static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2179{
2180 return may_create(dir, dentry, SECCLASS_FILE);
2181}
2182
1da177e4
LT		 2183static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2184{
2185 int rc;
2186
2187 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2188 if (rc)
2189 return rc;
2190 return may_link(dir, old_dentry, MAY_LINK);
2191}
2192
1da177e4
LT		 2193static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2194{
2195 int rc;
2196
2197 rc = secondary_ops->inode_unlink(dir, dentry);
2198 if (rc)
2199 return rc;
2200 return may_link(dir, dentry, MAY_UNLINK);
2201}
2202
2203static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2204{
2205 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2206}
2207
1da177e4
LT		 2208static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2209{
2210 return may_create(dir, dentry, SECCLASS_DIR);
2211}
2212
1da177e4
LT		 2213static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2214{
2215 return may_link(dir, dentry, MAY_RMDIR);
2216}
2217
2218static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2219{
2220 int rc;
2221
2222 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2223 if (rc)
2224 return rc;
2225
2226 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2227}
2228
1da177e4
LT		 2229static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2230 struct inode *new_inode, struct dentry *new_dentry)
2231{
2232 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2233}
2234
1da177e4
LT		 2235static int selinux_inode_readlink(struct dentry *dentry)
2236{
2237 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2238}
2239
2240static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2241{
2242 int rc;
2243
2244 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2245 if (rc)
2246 return rc;
2247 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2248}
2249
2250static int selinux_inode_permission(struct inode *inode, int mask,
2251 struct nameidata *nd)
2252{
2253 int rc;
2254
2255 rc = secondary_ops->inode_permission(inode, mask, nd);
2256 if (rc)
2257 return rc;
2258
2259 if (!mask) {
2260 /* No permission to check. Existence test. */
2261 return 0;
2262 }
2263
2264 return inode_has_perm(current, inode,
2265 file_mask_to_av(inode->i_mode, mask), NULL);
2266}
2267
2268static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2269{
2270 int rc;
2271
2272 rc = secondary_ops->inode_setattr(dentry, iattr);
2273 if (rc)
2274 return rc;
2275
2276 if (iattr->ia_valid & ATTR_FORCE)
2277 return 0;
2278
2279 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2280 ATTR_ATIME_SET | ATTR_MTIME_SET))
2281 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2282
2283 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2284}
2285
2286static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2287{
2288 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2289}
2290
2291static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2292{
2293 struct task_security_struct *tsec = current->security;
2294 struct inode *inode = dentry->d_inode;
2295 struct inode_security_struct *isec = inode->i_security;
2296 struct superblock_security_struct *sbsec;
2297 struct avc_audit_data ad;
2298 u32 newsid;
2299 int rc = 0;
2300
2301 if (strcmp(name, XATTR_NAME_SELINUX)) {
2302 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2303 sizeof XATTR_SECURITY_PREFIX - 1) &&
2304 !capable(CAP_SYS_ADMIN)) {
2305 /* A different attribute in the security namespace.
2306 Restrict to administrator. */
2307 return -EPERM;
2308 }
2309
2310 /* Not an attribute we recognize, so just check the
2311 ordinary setattr permission. */
2312 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2313 }
2314
2315 sbsec = inode->i_sb->s_security;
2316 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2317 return -EOPNOTSUPP;
2318
2319 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2320 return -EPERM;
2321
2322 AVC_AUDIT_DATA_INIT(&ad,FS);
2323 ad.u.fs.dentry = dentry;
2324
2325 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2326 FILE__RELABELFROM, &ad);
2327 if (rc)
2328 return rc;
2329
2330 rc = security_context_to_sid(value, size, &newsid);
2331 if (rc)
2332 return rc;
2333
2334 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2335 FILE__RELABELTO, &ad);
2336 if (rc)
2337 return rc;
2338
2339 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2340 isec->sclass);
2341 if (rc)
2342 return rc;
2343
2344 return avc_has_perm(newsid,
2345 sbsec->sid,
2346 SECCLASS_FILESYSTEM,
2347 FILESYSTEM__ASSOCIATE,
2348 &ad);
2349}
2350
2351static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2352 void *value, size_t size, int flags)
2353{
2354 struct inode *inode = dentry->d_inode;
2355 struct inode_security_struct *isec = inode->i_security;
2356 u32 newsid;
2357 int rc;
2358
2359 if (strcmp(name, XATTR_NAME_SELINUX)) {
2360 /* Not an attribute we recognize, so nothing to do. */
2361 return;
2362 }
2363
2364 rc = security_context_to_sid(value, size, &newsid);
2365 if (rc) {
2366 printk(KERN_WARNING "%s: unable to obtain SID for context "
2367 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2368 return;
2369 }
2370
2371 isec->sid = newsid;
2372 return;
2373}
2374
2375static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2376{
1da177e4
LT		 2377 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2378}
2379
2380static int selinux_inode_listxattr (struct dentry *dentry)
2381{
2382 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2383}
2384
2385static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2386{
2387 if (strcmp(name, XATTR_NAME_SELINUX)) {
2388 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2389 sizeof XATTR_SECURITY_PREFIX - 1) &&
2390 !capable(CAP_SYS_ADMIN)) {
2391 /* A different attribute in the security namespace.
2392 Restrict to administrator. */
2393 return -EPERM;
2394 }
2395
2396 /* Not an attribute we recognize, so just check the
2397 ordinary setattr permission. Might want a separate
2398 permission for removexattr. */
2399 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2400 }
2401
2402 /* No one is allowed to remove a SELinux security label.
2403 You can change the label, but all data must be labeled. */
2404 return -EACCES;
2405}
2406
8c8570fb
DK		 2407static const char *selinux_inode_xattr_getsuffix(void)
2408{
2409 return XATTR_SELINUX_SUFFIX;
2410}
2411
d381d8a9
JM		 2412/*
2413 * Copy the in-core inode security context value to the user. If the
2414 * getxattr() prior to this succeeded, check to see if we need to
2415 * canonicalize the value to be finally returned to the user.
2416 *
2417 * Permission check is handled by selinux_inode_getxattr hook.
2418 */
7306a0b9 2419static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
1da177e4
LT		 2420{
2421 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2422
8c8570fb
DK		 2423 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2424 return -EOPNOTSUPP;
d381d8a9 2425
8c8570fb 2426 return selinux_getsecurity(isec->sid, buffer, size);
1da177e4
LT		 2427}
2428
2429static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2430 const void *value, size_t size, int flags)
2431{
2432 struct inode_security_struct *isec = inode->i_security;
2433 u32 newsid;
2434 int rc;
2435
2436 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2437 return -EOPNOTSUPP;
2438
2439 if (!value || !size)
2440 return -EACCES;
2441
2442 rc = security_context_to_sid((void*)value, size, &newsid);
2443 if (rc)
2444 return rc;
2445
2446 isec->sid = newsid;
2447 return 0;
2448}
2449
2450static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2451{
2452 const int len = sizeof(XATTR_NAME_SELINUX);
2453 if (buffer && len <= buffer_size)
2454 memcpy(buffer, XATTR_NAME_SELINUX, len);
2455 return len;
2456}
2457
2458/* file security operations */
2459
2460static int selinux_file_permission(struct file *file, int mask)
2461{
7420ed23 2462 int rc;
3d5ff529 2463 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4
LT		 2464
2465 if (!mask) {
2466 /* No permission to check. Existence test. */
2467 return 0;
2468 }
2469
2470 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2471 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2472 mask |= MAY_APPEND;
2473
7420ed23
VY		 2474 rc = file_has_perm(current, file,
2475 file_mask_to_av(inode->i_mode, mask));
2476 if (rc)
2477 return rc;
2478
2479 return selinux_netlbl_inode_permission(inode, mask);
1da177e4
LT		 2480}
2481
2482static int selinux_file_alloc_security(struct file *file)
2483{
2484 return file_alloc_security(file);
2485}
2486
2487static void selinux_file_free_security(struct file *file)
2488{
2489 file_free_security(file);
2490}
2491
2492static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2493 unsigned long arg)
2494{
2495 int error = 0;
2496
2497 switch (cmd) {
2498 case FIONREAD:
2499 /* fall through */
2500 case FIBMAP:
2501 /* fall through */
2502 case FIGETBSZ:
2503 /* fall through */
2504 case EXT2_IOC_GETFLAGS:
2505 /* fall through */
2506 case EXT2_IOC_GETVERSION:
2507 error = file_has_perm(current, file, FILE__GETATTR);
2508 break;
2509
2510 case EXT2_IOC_SETFLAGS:
2511 /* fall through */
2512 case EXT2_IOC_SETVERSION:
2513 error = file_has_perm(current, file, FILE__SETATTR);
2514 break;
2515
2516 /* sys_ioctl() checks */
2517 case FIONBIO:
2518 /* fall through */
2519 case FIOASYNC:
2520 error = file_has_perm(current, file, 0);
2521 break;
2522
2523 case KDSKBENT:
2524 case KDSKBSENT:
2525 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2526 break;
2527
2528 /* default case assumes that the command will go
2529 * to the file's ioctl() function.
2530 */
2531 default:
2532 error = file_has_perm(current, file, FILE__IOCTL);
2533
2534 }
2535 return error;
2536}
2537
2538static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2539{
2540#ifndef CONFIG_PPC32
2541 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2542 /*
2543 * We are making executable an anonymous mapping or a
2544 * private file mapping that will also be writable.
2545 * This has an additional check.
2546 */
2547 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2548 if (rc)
2549 return rc;
2550 }
2551#endif
2552
2553 if (file) {
2554 /* read access is always possible with a mapping */
2555 u32 av = FILE__READ;
2556
2557 /* write access only matters if the mapping is shared */
2558 if (shared && (prot & PROT_WRITE))
2559 av |= FILE__WRITE;
2560
2561 if (prot & PROT_EXEC)
2562 av |= FILE__EXECUTE;
2563
2564 return file_has_perm(current, file, av);
2565 }
2566 return 0;
2567}
2568
2569static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2570 unsigned long prot, unsigned long flags)
2571{
2572 int rc;
2573
2574 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2575 if (rc)
2576 return rc;
2577
2578 if (selinux_checkreqprot)
2579 prot = reqprot;
2580
2581 return file_map_prot_check(file, prot,
2582 (flags & MAP_TYPE) == MAP_SHARED);
2583}
2584
2585static int selinux_file_mprotect(struct vm_area_struct *vma,
2586 unsigned long reqprot,
2587 unsigned long prot)
2588{
2589 int rc;
2590
2591 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2592 if (rc)
2593 return rc;
2594
2595 if (selinux_checkreqprot)
2596 prot = reqprot;
2597
2598#ifndef CONFIG_PPC32
db4c9641
SS		 2599 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2600 rc = 0;
2601 if (vma->vm_start >= vma->vm_mm->start_brk &&
2602 vma->vm_end <= vma->vm_mm->brk) {
2603 rc = task_has_perm(current, current,
2604 PROCESS__EXECHEAP);
2605 } else if (!vma->vm_file &&
2606 vma->vm_start <= vma->vm_mm->start_stack &&
2607 vma->vm_end >= vma->vm_mm->start_stack) {
2608 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2609 } else if (vma->vm_file && vma->anon_vma) {
2610 /*
2611 * We are making executable a file mapping that has
2612 * had some COW done. Since pages might have been
2613 * written, check ability to execute the possibly
2614 * modified content. This typically should only
2615 * occur for text relocations.
2616 */
2617 rc = file_has_perm(current, vma->vm_file,
2618 FILE__EXECMOD);
2619 }