]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - security/selinux/hooks.c
selinux: Support for the new TUN LSM hooks
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT
1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
828dfe1d
EP
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
1da177e4
LT
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
2069f457
EP
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
1da177e4 14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
828dfe1d 15 * <dgoeddel@trustedcs.com>
ed6d76e4
PM
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
788e7dd4 18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
828dfe1d 19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
1da177e4
LT
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
828dfe1d 23 * as published by the Free Software Foundation.
1da177e4
LT
24 */
25
1da177e4
LT
26#include <linux/init.h>
27#include <linux/kernel.h>
0d094efe 28#include <linux/tracehook.h>
1da177e4
LT
29#include <linux/errno.h>
30#include <linux/sched.h>
31#include <linux/security.h>
32#include <linux/xattr.h>
33#include <linux/capability.h>
34#include <linux/unistd.h>
35#include <linux/mm.h>
36#include <linux/mman.h>
37#include <linux/slab.h>
38#include <linux/pagemap.h>
39#include <linux/swap.h>
1da177e4
LT
40#include <linux/spinlock.h>
41#include <linux/syscalls.h>
42#include <linux/file.h>
9f3acc31 43#include <linux/fdtable.h>
1da177e4
LT
44#include <linux/namei.h>
45#include <linux/mount.h>
1da177e4 46#include <linux/proc_fs.h>
1da177e4
LT
47#include <linux/netfilter_ipv4.h>
48#include <linux/netfilter_ipv6.h>
49#include <linux/tty.h>
50#include <net/icmp.h>
227b60f5 51#include <net/ip.h> /* for local_port_range[] */
1da177e4 52#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
220deb96 53#include <net/net_namespace.h>
d621d35e 54#include <net/netlabel.h>
f5269710 55#include <linux/uaccess.h>
1da177e4 56#include <asm/ioctls.h>
d621d35e 57#include <asm/atomic.h>
1da177e4
LT
58#include <linux/bitops.h>
59#include <linux/interrupt.h>
60#include <linux/netdevice.h> /* for network interface checks */
61#include <linux/netlink.h>
62#include <linux/tcp.h>
63#include <linux/udp.h>
2ee92d46 64#include <linux/dccp.h>
1da177e4
LT
65#include <linux/quota.h>
66#include <linux/un.h> /* for Unix socket types */
67#include <net/af_unix.h> /* for Unix socket types */
68#include <linux/parser.h>
69#include <linux/nfs_mount.h>
70#include <net/ipv6.h>
71#include <linux/hugetlb.h>
72#include <linux/personality.h>
73#include <linux/sysctl.h>
74#include <linux/audit.h>
6931dfc9 75#include <linux/string.h>
877ce7c1 76#include <linux/selinux.h>
23970741 77#include <linux/mutex.h>
f06febc9 78#include <linux/posix-timers.h>
1da177e4
LT
79
80#include "avc.h"
81#include "objsec.h"
82#include "netif.h"
224dfbd8 83#include "netnode.h"
3e112172 84#include "netport.h"
d28d1e08 85#include "xfrm.h"
c60475bf 86#include "netlabel.h"
9d57a7f9 87#include "audit.h"
1da177e4
LT
88
89#define XATTR_SELINUX_SUFFIX "selinux"
90#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
91
11689d47 92#define NUM_SEL_MNT_OPTS 5
c9180a57 93
1da177e4
LT
94extern unsigned int policydb_loaded_version;
95extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
20510f2f 96extern struct security_operations *security_ops;
1da177e4 97
d621d35e
PM
98/* SECMARK reference count */
99atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
1da177e4 101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
828dfe1d 102int selinux_enforcing;
1da177e4
LT
103
104static int __init enforcing_setup(char *str)
105{
f5269710
EP
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
1da177e4
LT
109 return 1;
110}
111__setup("enforcing=", enforcing_setup);
112#endif
113
114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117static int __init selinux_enabled_setup(char *str)
118{
f5269710
EP
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
1da177e4
LT
122 return 1;
123}
124__setup("selinux=", selinux_enabled_setup);
30d55280
SS
125#else
126int selinux_enabled = 1;
1da177e4
LT
127#endif
128
1da177e4 129
6f0f0fd4
JM
130/*
131 * Minimal support for a secondary security module,
132 * just to allow the use of the capability module.
133 */
828dfe1d 134static struct security_operations *secondary_ops;
1da177e4
LT
135
136/* Lists of inode and superblock security structures initialized
137 before the policy was loaded. */
138static LIST_HEAD(superblock_security_head);
139static DEFINE_SPINLOCK(sb_security_lock);
140
e18b890b 141static struct kmem_cache *sel_inode_cache;
7cae7e26 142
d621d35e
PM
143/**
144 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
145 *
146 * Description:
147 * This function checks the SECMARK reference counter to see if any SECMARK
148 * targets are currently configured, if the reference counter is greater than
149 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
150 * enabled, false (0) if SECMARK is disabled.
151 *
152 */
153static int selinux_secmark_enabled(void)
154{
155 return (atomic_read(&selinux_secmark_refcount) > 0);
156}
157
d84f4f99
DH
158/*
159 * initialise the security for the init task
160 */
161static void cred_init_security(void)
1da177e4 162{
3b11a1de 163 struct cred *cred = (struct cred *) current->real_cred;
1da177e4
LT
164 struct task_security_struct *tsec;
165
89d155ef 166 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4 167 if (!tsec)
d84f4f99 168 panic("SELinux: Failed to initialize initial task.\n");
1da177e4 169
d84f4f99 170 tsec->osid = tsec->sid = SECINITSID_KERNEL;
f1752eec 171 cred->security = tsec;
1da177e4
LT
172}
173
88e67f3b
DH
174/*
175 * get the security ID of a set of credentials
176 */
177static inline u32 cred_sid(const struct cred *cred)
178{
179 const struct task_security_struct *tsec;
180
181 tsec = cred->security;
182 return tsec->sid;
183}
184
275bb41e 185/*
3b11a1de 186 * get the objective security ID of a task
275bb41e
DH
187 */
188static inline u32 task_sid(const struct task_struct *task)
189{
275bb41e
DH
190 u32 sid;
191
192 rcu_read_lock();
88e67f3b 193 sid = cred_sid(__task_cred(task));
275bb41e
DH
194 rcu_read_unlock();
195 return sid;
196}
197
198/*
3b11a1de 199 * get the subjective security ID of the current task
275bb41e
DH
200 */
201static inline u32 current_sid(void)
202{
203 const struct task_security_struct *tsec = current_cred()->security;
204
205 return tsec->sid;
206}
207
88e67f3b
DH
208/* Allocate and free functions for each kind of security blob. */
209
1da177e4
LT
210static int inode_alloc_security(struct inode *inode)
211{
1da177e4 212 struct inode_security_struct *isec;
275bb41e 213 u32 sid = current_sid();
1da177e4 214
a02fe132 215 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
1da177e4
LT
216 if (!isec)
217 return -ENOMEM;
218
23970741 219 mutex_init(&isec->lock);
1da177e4 220 INIT_LIST_HEAD(&isec->list);
1da177e4
LT
221 isec->inode = inode;
222 isec->sid = SECINITSID_UNLABELED;
223 isec->sclass = SECCLASS_FILE;
275bb41e 224 isec->task_sid = sid;
1da177e4
LT
225 inode->i_security = isec;
226
227 return 0;
228}
229
230static void inode_free_security(struct inode *inode)
231{
232 struct inode_security_struct *isec = inode->i_security;
233 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
234
1da177e4
LT
235 spin_lock(&sbsec->isec_lock);
236 if (!list_empty(&isec->list))
237 list_del_init(&isec->list);
238 spin_unlock(&sbsec->isec_lock);
239
240 inode->i_security = NULL;
7cae7e26 241 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT
242}
243
244static int file_alloc_security(struct file *file)
245{
1da177e4 246 struct file_security_struct *fsec;
275bb41e 247 u32 sid = current_sid();
1da177e4 248
26d2a4be 249 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT
250 if (!fsec)
251 return -ENOMEM;
252
275bb41e
DH
253 fsec->sid = sid;
254 fsec->fown_sid = sid;
1da177e4
LT
255 file->f_security = fsec;
256
257 return 0;
258}
259
260static void file_free_security(struct file *file)
261{
262 struct file_security_struct *fsec = file->f_security;
1da177e4
LT
263 file->f_security = NULL;
264 kfree(fsec);
265}
266
267static int superblock_alloc_security(struct super_block *sb)
268{
269 struct superblock_security_struct *sbsec;
270
89d155ef 271 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT
272 if (!sbsec)
273 return -ENOMEM;
274
bc7e982b 275 mutex_init(&sbsec->lock);
1da177e4
LT
276 INIT_LIST_HEAD(&sbsec->list);
277 INIT_LIST_HEAD(&sbsec->isec_head);
278 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT
279 sbsec->sb = sb;
280 sbsec->sid = SECINITSID_UNLABELED;
281 sbsec->def_sid = SECINITSID_FILE;
c312feb2 282 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
1da177e4
LT
283 sb->s_security = sbsec;
284
285 return 0;
286}
287
288static void superblock_free_security(struct super_block *sb)
289{
290 struct superblock_security_struct *sbsec = sb->s_security;
291
1da177e4
LT
292 spin_lock(&sb_security_lock);
293 if (!list_empty(&sbsec->list))
294 list_del_init(&sbsec->list);
295 spin_unlock(&sb_security_lock);
296
297 sb->s_security = NULL;
298 kfree(sbsec);
299}
300
7d877f3b 301static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
1da177e4
LT
302{
303 struct sk_security_struct *ssec;
304
89d155ef 305 ssec = kzalloc(sizeof(*ssec), priority);
1da177e4
LT
306 if (!ssec)
307 return -ENOMEM;
308
1da177e4 309 ssec->peer_sid = SECINITSID_UNLABELED;
892c141e 310 ssec->sid = SECINITSID_UNLABELED;
1da177e4
LT
311 sk->sk_security = ssec;
312
389fb800 313 selinux_netlbl_sk_security_reset(ssec);
99f59ed0 314
1da177e4
LT
315 return 0;
316}
317
318static void sk_free_security(struct sock *sk)
319{
320 struct sk_security_struct *ssec = sk->sk_security;
321
1da177e4 322 sk->sk_security = NULL;
6c5b3fc0 323 selinux_netlbl_sk_security_free(ssec);
1da177e4
LT
324 kfree(ssec);
325}
1da177e4
LT
326
327/* The security server must be initialized before
328 any labeling or access decisions can be provided. */
329extern int ss_initialized;
330
331/* The file system's label must be initialized prior to use. */
332
333static char *labeling_behaviors[6] = {
334 "uses xattr",
335 "uses transition SIDs",
336 "uses task SIDs",
337 "uses genfs_contexts",
338 "not configured for labeling",
339 "uses mountpoint labeling",
340};
341
342static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
343
344static inline int inode_doinit(struct inode *inode)
345{
346 return inode_doinit_with_dentry(inode, NULL);
347}
348
349enum {
31e87930 350 Opt_error = -1,
1da177e4
LT
351 Opt_context = 1,
352 Opt_fscontext = 2,
c9180a57
EP
353 Opt_defcontext = 3,
354 Opt_rootcontext = 4,
11689d47 355 Opt_labelsupport = 5,
1da177e4
LT
356};
357
a447c093 358static const match_table_t tokens = {
832cbd9a
EP
359 {Opt_context, CONTEXT_STR "%s"},
360 {Opt_fscontext, FSCONTEXT_STR "%s"},
361 {Opt_defcontext, DEFCONTEXT_STR "%s"},
362 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
11689d47 363 {Opt_labelsupport, LABELSUPP_STR},
31e87930 364 {Opt_error, NULL},
1da177e4
LT
365};
366
367#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
368
c312feb2
EP
369static int may_context_mount_sb_relabel(u32 sid,
370 struct superblock_security_struct *sbsec,
275bb41e 371 const struct cred *cred)
c312feb2 372{
275bb41e 373 const struct task_security_struct *tsec = cred->security;
c312feb2
EP
374 int rc;
375
376 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
377 FILESYSTEM__RELABELFROM, NULL);
378 if (rc)
379 return rc;
380
381 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
382 FILESYSTEM__RELABELTO, NULL);
383 return rc;
384}
385
0808925e
EP
386static int may_context_mount_inode_relabel(u32 sid,
387 struct superblock_security_struct *sbsec,
275bb41e 388 const struct cred *cred)
0808925e 389{
275bb41e 390 const struct task_security_struct *tsec = cred->security;
0808925e
EP
391 int rc;
392 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
393 FILESYSTEM__RELABELFROM, NULL);
394 if (rc)
395 return rc;
396
397 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
398 FILESYSTEM__ASSOCIATE, NULL);
399 return rc;
400}
401
c9180a57 402static int sb_finish_set_opts(struct super_block *sb)
1da177e4 403{
1da177e4 404 struct superblock_security_struct *sbsec = sb->s_security;
c9180a57
EP
405 struct dentry *root = sb->s_root;
406 struct inode *root_inode = root->d_inode;
407 int rc = 0;
1da177e4 408
c9180a57
EP
409 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
410 /* Make sure that the xattr handler exists and that no
411 error other than -ENODATA is returned by getxattr on
412 the root directory. -ENODATA is ok, as this may be
413 the first boot of the SELinux kernel before we have
414 assigned xattr values to the filesystem. */
415 if (!root_inode->i_op->getxattr) {
416 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
417 "xattr support\n", sb->s_id, sb->s_type->name);
418 rc = -EOPNOTSUPP;
419 goto out;
420 }
421 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
422 if (rc < 0 && rc != -ENODATA) {
423 if (rc == -EOPNOTSUPP)
424 printk(KERN_WARNING "SELinux: (dev %s, type "
425 "%s) has no security xattr handler\n",
426 sb->s_id, sb->s_type->name);
427 else
428 printk(KERN_WARNING "SELinux: (dev %s, type "
429 "%s) getxattr errno %d\n", sb->s_id,
430 sb->s_type->name, -rc);
431 goto out;
432 }
433 }
1da177e4 434
11689d47 435 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
1da177e4 436
c9180a57
EP
437 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
438 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
439 sb->s_id, sb->s_type->name);
440 else
441 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
442 sb->s_id, sb->s_type->name,
443 labeling_behaviors[sbsec->behavior-1]);
1da177e4 444
11689d47
DQ
445 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
446 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
447 sbsec->behavior == SECURITY_FS_USE_NONE ||
448 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
449 sbsec->flags &= ~SE_SBLABELSUPP;
450
c9180a57
EP
451 /* Initialize the root inode. */
452 rc = inode_doinit_with_dentry(root_inode, root);
1da177e4 453
c9180a57
EP
454 /* Initialize any other inodes associated with the superblock, e.g.
455 inodes created prior to initial policy load or inodes created
456 during get_sb by a pseudo filesystem that directly
457 populates itself. */
458 spin_lock(&sbsec->isec_lock);
459next_inode:
460 if (!list_empty(&sbsec->isec_head)) {
461 struct inode_security_struct *isec =
462 list_entry(sbsec->isec_head.next,
463 struct inode_security_struct, list);
464 struct inode *inode = isec->inode;
465 spin_unlock(&sbsec->isec_lock);
466 inode = igrab(inode);
467 if (inode) {
468 if (!IS_PRIVATE(inode))
469 inode_doinit(inode);
470 iput(inode);
471 }
472 spin_lock(&sbsec->isec_lock);
473 list_del_init(&isec->list);
474 goto next_inode;
475 }
476 spin_unlock(&sbsec->isec_lock);
477out:
478 return rc;
479}
1da177e4 480
c9180a57
EP
481/*
482 * This function should allow an FS to ask what it's mount security
483 * options were so it can use those later for submounts, displaying
484 * mount options, or whatever.
485 */
486static int selinux_get_mnt_opts(const struct super_block *sb,
e0007529 487 struct security_mnt_opts *opts)
c9180a57
EP
488{
489 int rc = 0, i;
490 struct superblock_security_struct *sbsec = sb->s_security;
491 char *context = NULL;
492 u32 len;
493 char tmp;
1da177e4 494
e0007529 495 security_init_mnt_opts(opts);
1da177e4 496
0d90a7ec 497 if (!(sbsec->flags & SE_SBINITIALIZED))
c9180a57 498 return -EINVAL;
1da177e4 499
c9180a57
EP
500 if (!ss_initialized)
501 return -EINVAL;
1da177e4 502
0d90a7ec 503 tmp = sbsec->flags & SE_MNTMASK;
c9180a57
EP
504 /* count the number of mount options for this sb */
505 for (i = 0; i < 8; i++) {
506 if (tmp & 0x01)
e0007529 507 opts->num_mnt_opts++;
c9180a57
EP
508 tmp >>= 1;
509 }
11689d47
DQ
510 /* Check if the Label support flag is set */
511 if (sbsec->flags & SE_SBLABELSUPP)
512 opts->num_mnt_opts++;
1da177e4 513
e0007529
EP
514 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
515 if (!opts->mnt_opts) {
c9180a57
EP
516 rc = -ENOMEM;
517 goto out_free;
518 }
1da177e4 519
e0007529
EP
520 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
521 if (!opts->mnt_opts_flags) {
c9180a57
EP
522 rc = -ENOMEM;
523 goto out_free;
524 }
1da177e4 525
c9180a57
EP
526 i = 0;
527 if (sbsec->flags & FSCONTEXT_MNT) {
528 rc = security_sid_to_context(sbsec->sid, &context, &len);
529 if (rc)
530 goto out_free;
e0007529
EP
531 opts->mnt_opts[i] = context;
532 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
c9180a57
EP
533 }
534 if (sbsec->flags & CONTEXT_MNT) {
535 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
536 if (rc)
537 goto out_free;
e0007529
EP
538 opts->mnt_opts[i] = context;
539 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
c9180a57
EP
540 }
541 if (sbsec->flags & DEFCONTEXT_MNT) {
542 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
543 if (rc)
544 goto out_free;
e0007529
EP
545 opts->mnt_opts[i] = context;
546 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
c9180a57
EP
547 }
548 if (sbsec->flags & ROOTCONTEXT_MNT) {
549 struct inode *root = sbsec->sb->s_root->d_inode;
550 struct inode_security_struct *isec = root->i_security;
0808925e 551
c9180a57
EP
552 rc = security_sid_to_context(isec->sid, &context, &len);
553 if (rc)
554 goto out_free;
e0007529
EP
555 opts->mnt_opts[i] = context;
556 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
c9180a57 557 }
11689d47
DQ
558 if (sbsec->flags & SE_SBLABELSUPP) {
559 opts->mnt_opts[i] = NULL;
560 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
561 }
1da177e4 562
e0007529 563 BUG_ON(i != opts->num_mnt_opts);
1da177e4 564
c9180a57
EP
565 return 0;
566
567out_free:
e0007529 568 security_free_mnt_opts(opts);
c9180a57
EP
569 return rc;
570}
1da177e4 571
c9180a57
EP
572static int bad_option(struct superblock_security_struct *sbsec, char flag,
573 u32 old_sid, u32 new_sid)
574{
0d90a7ec
DQ
575 char mnt_flags = sbsec->flags & SE_MNTMASK;
576
c9180a57 577 /* check if the old mount command had the same options */
0d90a7ec 578 if (sbsec->flags & SE_SBINITIALIZED)
c9180a57
EP
579 if (!(sbsec->flags & flag) ||
580 (old_sid != new_sid))
581 return 1;
582
583 /* check if we were passed the same options twice,
584 * aka someone passed context=a,context=b
585 */
0d90a7ec
DQ
586 if (!(sbsec->flags & SE_SBINITIALIZED))
587 if (mnt_flags & flag)
c9180a57
EP
588 return 1;
589 return 0;
590}
e0007529 591
c9180a57
EP
592/*
593 * Allow filesystems with binary mount data to explicitly set mount point
594 * labeling information.
595 */
e0007529
EP
596static int selinux_set_mnt_opts(struct super_block *sb,
597 struct security_mnt_opts *opts)
c9180a57 598{
275bb41e 599 const struct cred *cred = current_cred();
c9180a57 600 int rc = 0, i;
c9180a57
EP
601 struct superblock_security_struct *sbsec = sb->s_security;
602 const char *name = sb->s_type->name;
089be43e
JM
603 struct inode *inode = sbsec->sb->s_root->d_inode;
604 struct inode_security_struct *root_isec = inode->i_security;
c9180a57
EP
605 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
606 u32 defcontext_sid = 0;
e0007529
EP
607 char **mount_options = opts->mnt_opts;
608 int *flags = opts->mnt_opts_flags;
609 int num_opts = opts->num_mnt_opts;
c9180a57
EP
610
611 mutex_lock(&sbsec->lock);
612
613 if (!ss_initialized) {
614 if (!num_opts) {
615 /* Defer initialization until selinux_complete_init,
616 after the initial policy is loaded and the security
617 server is ready to handle calls. */
618 spin_lock(&sb_security_lock);
619 if (list_empty(&sbsec->list))
620 list_add(&sbsec->list, &superblock_security_head);
621 spin_unlock(&sb_security_lock);
622 goto out;
623 }
624 rc = -EINVAL;
744ba35e
EP
625 printk(KERN_WARNING "SELinux: Unable to set superblock options "
626 "before the security server is initialized\n");
1da177e4 627 goto out;
c9180a57 628 }
1da177e4 629
e0007529
EP
630 /*
631 * Binary mount data FS will come through this function twice. Once
632 * from an explicit call and once from the generic calls from the vfs.
633 * Since the generic VFS calls will not contain any security mount data
634 * we need to skip the double mount verification.
635 *
636 * This does open a hole in which we will not notice if the first
637 * mount using this sb set explict options and a second mount using
638 * this sb does not set any security options. (The first options
639 * will be used for both mounts)
640 */
0d90a7ec 641 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
e0007529 642 && (num_opts == 0))
f5269710 643 goto out;
e0007529 644
c9180a57
EP
645 /*
646 * parse the mount options, check if they are valid sids.
647 * also check if someone is trying to mount the same sb more
648 * than once with different security options.
649 */
650 for (i = 0; i < num_opts; i++) {
651 u32 sid;
11689d47
DQ
652
653 if (flags[i] == SE_SBLABELSUPP)
654 continue;
c9180a57
EP
655 rc = security_context_to_sid(mount_options[i],
656 strlen(mount_options[i]), &sid);
1da177e4
LT
657 if (rc) {
658 printk(KERN_WARNING "SELinux: security_context_to_sid"
659 "(%s) failed for (dev %s, type %s) errno=%d\n",
c9180a57
EP
660 mount_options[i], sb->s_id, name, rc);
661 goto out;
662 }
663 switch (flags[i]) {
664 case FSCONTEXT_MNT:
665 fscontext_sid = sid;
666
667 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
668 fscontext_sid))
669 goto out_double_mount;
670
671 sbsec->flags |= FSCONTEXT_MNT;
672 break;
673 case CONTEXT_MNT:
674 context_sid = sid;
675
676 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
677 context_sid))
678 goto out_double_mount;
679
680 sbsec->flags |= CONTEXT_MNT;
681 break;
682 case ROOTCONTEXT_MNT:
683 rootcontext_sid = sid;
684
685 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
686 rootcontext_sid))
687 goto out_double_mount;
688
689 sbsec->flags |= ROOTCONTEXT_MNT;
690
691 break;
692 case DEFCONTEXT_MNT:
693 defcontext_sid = sid;
694
695 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
696 defcontext_sid))
697 goto out_double_mount;
698
699 sbsec->flags |= DEFCONTEXT_MNT;
700
701 break;
702 default:
703 rc = -EINVAL;
704 goto out;
1da177e4 705 }
c9180a57
EP
706 }
707
0d90a7ec 708 if (sbsec->flags & SE_SBINITIALIZED) {
c9180a57 709 /* previously mounted with options, but not on this attempt? */
0d90a7ec 710 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
c9180a57
EP
711 goto out_double_mount;
712 rc = 0;
713 goto out;
714 }
715
089be43e 716 if (strcmp(sb->s_type->name, "proc") == 0)
0d90a7ec 717 sbsec->flags |= SE_SBPROC;
c9180a57
EP
718
719 /* Determine the labeling behavior to use for this filesystem type. */
0d90a7ec 720 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
c9180a57
EP
721 if (rc) {
722 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
089be43e 723 __func__, sb->s_type->name, rc);
c9180a57
EP
724 goto out;
725 }
1da177e4 726
c9180a57
EP
727 /* sets the context of the superblock for the fs being mounted. */
728 if (fscontext_sid) {
275bb41e 729 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
1da177e4 730 if (rc)
c9180a57 731 goto out;
1da177e4 732
c9180a57 733 sbsec->sid = fscontext_sid;
c312feb2
EP
734 }
735
736 /*
737 * Switch to using mount point labeling behavior.
738 * sets the label used on all file below the mountpoint, and will set
739 * the superblock context if not already set.
740 */
c9180a57
EP
741 if (context_sid) {
742 if (!fscontext_sid) {
275bb41e
DH
743 rc = may_context_mount_sb_relabel(context_sid, sbsec,
744 cred);
b04ea3ce 745 if (rc)
c9180a57
EP
746 goto out;
747 sbsec->sid = context_sid;
b04ea3ce 748 } else {
275bb41e
DH
749 rc = may_context_mount_inode_relabel(context_sid, sbsec,
750 cred);
b04ea3ce 751 if (rc)
c9180a57 752 goto out;
b04ea3ce 753 }
c9180a57
EP
754 if (!rootcontext_sid)
755 rootcontext_sid = context_sid;
1da177e4 756
c9180a57 757 sbsec->mntpoint_sid = context_sid;
c312feb2 758 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
1da177e4
LT
759 }
760
c9180a57 761 if (rootcontext_sid) {
275bb41e
DH
762 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
763 cred);
0808925e 764 if (rc)
c9180a57 765 goto out;
0808925e 766
c9180a57
EP
767 root_isec->sid = rootcontext_sid;
768 root_isec->initialized = 1;
0808925e
EP
769 }
770
c9180a57
EP
771 if (defcontext_sid) {
772 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
773 rc = -EINVAL;
774 printk(KERN_WARNING "SELinux: defcontext option is "
775 "invalid for this filesystem type\n");
776 goto out;
1da177e4
LT
777 }
778
c9180a57
EP
779 if (defcontext_sid != sbsec->def_sid) {
780 rc = may_context_mount_inode_relabel(defcontext_sid,
275bb41e 781 sbsec, cred);
c9180a57
EP
782 if (rc)
783 goto out;
784 }
1da177e4 785
c9180a57 786 sbsec->def_sid = defcontext_sid;
1da177e4
LT
787 }
788
c9180a57 789 rc = sb_finish_set_opts(sb);
1da177e4 790out:
c9180a57 791 mutex_unlock(&sbsec->lock);
1da177e4 792 return rc;
c9180a57
EP
793out_double_mount:
794 rc = -EINVAL;
795 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
796 "security settings for (dev %s, type %s)\n", sb->s_id, name);
797 goto out;
1da177e4
LT
798}
799
c9180a57
EP
800static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
801 struct super_block *newsb)
1da177e4 802{
c9180a57
EP
803 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
804 struct superblock_security_struct *newsbsec = newsb->s_security;
1da177e4 805
c9180a57
EP
806 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
807 int set_context = (oldsbsec->flags & CONTEXT_MNT);
808 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1da177e4 809
0f5e6420
EP
810 /*
811 * if the parent was able to be mounted it clearly had no special lsm
812 * mount options. thus we can safely put this sb on the list and deal
813 * with it later
814 */
815 if (!ss_initialized) {
816 spin_lock(&sb_security_lock);
817 if (list_empty(&newsbsec->list))
818 list_add(&newsbsec->list, &superblock_security_head);
819 spin_unlock(&sb_security_lock);
820 return;
821 }
c9180a57 822
c9180a57 823 /* how can we clone if the old one wasn't set up?? */
0d90a7ec 824 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
c9180a57 825
5a552617 826 /* if fs is reusing a sb, just let its options stand... */
0d90a7ec 827 if (newsbsec->flags & SE_SBINITIALIZED)
5a552617
EP
828 return;
829
c9180a57
EP
830 mutex_lock(&newsbsec->lock);
831
832 newsbsec->flags = oldsbsec->flags;
833
834 newsbsec->sid = oldsbsec->sid;
835 newsbsec->def_sid = oldsbsec->def_sid;
836 newsbsec->behavior = oldsbsec->behavior;
837
838 if (set_context) {
839 u32 sid = oldsbsec->mntpoint_sid;
840
841 if (!set_fscontext)
842 newsbsec->sid = sid;
843 if (!set_rootcontext) {
844 struct inode *newinode = newsb->s_root->d_inode;
845 struct inode_security_struct *newisec = newinode->i_security;
846 newisec->sid = sid;
847 }
848 newsbsec->mntpoint_sid = sid;
1da177e4 849 }
c9180a57
EP
850 if (set_rootcontext) {
851 const struct inode *oldinode = oldsb->s_root->d_inode;
852 const struct inode_security_struct *oldisec = oldinode->i_security;
853 struct inode *newinode = newsb->s_root->d_inode;
854 struct inode_security_struct *newisec = newinode->i_security;
1da177e4 855
c9180a57 856 newisec->sid = oldisec->sid;
1da177e4
LT
857 }
858
c9180a57
EP
859 sb_finish_set_opts(newsb);
860 mutex_unlock(&newsbsec->lock);
861}
862
2e1479d9
AB
863static int selinux_parse_opts_str(char *options,
864 struct security_mnt_opts *opts)
c9180a57 865{
e0007529 866 char *p;
c9180a57
EP
867 char *context = NULL, *defcontext = NULL;
868 char *fscontext = NULL, *rootcontext = NULL;
e0007529 869 int rc, num_mnt_opts = 0;
1da177e4 870
e0007529 871 opts->num_mnt_opts = 0;
1da177e4 872
c9180a57
EP
873 /* Standard string-based options. */
874 while ((p = strsep(&options, "|")) != NULL) {
875 int token;
876 substring_t args[MAX_OPT_ARGS];
1da177e4 877
c9180a57
EP
878 if (!*p)
879 continue;
1da177e4 880
c9180a57 881 token = match_token(p, tokens, args);
1da177e4 882
c9180a57
EP
883 switch (token) {
884 case Opt_context:
885 if (context || defcontext) {
886 rc = -EINVAL;
887 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
888 goto out_err;
889 }
890 context = match_strdup(&args[0]);
891 if (!context) {
892 rc = -ENOMEM;
893 goto out_err;
894 }
895 break;
896
897 case Opt_fscontext:
898 if (fscontext) {
899 rc = -EINVAL;
900 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
901 goto out_err;
902 }
903 fscontext = match_strdup(&args[0]);
904 if (!fscontext) {
905 rc = -ENOMEM;
906 goto out_err;
907 }
908 break;
909
910 case Opt_rootcontext:
911 if (rootcontext) {
912 rc = -EINVAL;
913 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
914 goto out_err;
915 }
916 rootcontext = match_strdup(&args[0]);
917 if (!rootcontext) {
918 rc = -ENOMEM;
919 goto out_err;
920 }
921 break;
922
923 case Opt_defcontext:
924 if (context || defcontext) {
925 rc = -EINVAL;
926 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
927 goto out_err;
928 }
929 defcontext = match_strdup(&args[0]);
930 if (!defcontext) {
931 rc = -ENOMEM;
932 goto out_err;
933 }
934 break;
11689d47
DQ
935 case Opt_labelsupport:
936 break;
c9180a57
EP
937 default:
938 rc = -EINVAL;
939 printk(KERN_WARNING "SELinux: unknown mount option\n");
940 goto out_err;
1da177e4 941
1da177e4 942 }
1da177e4 943 }
c9180a57 944
e0007529
EP
945 rc = -ENOMEM;
946 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
947 if (!opts->mnt_opts)
948 goto out_err;
949
950 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
951 if (!opts->mnt_opts_flags) {
952 kfree(opts->mnt_opts);
953 goto out_err;
954 }
955
c9180a57 956 if (fscontext) {
e0007529
EP
957 opts->mnt_opts[num_mnt_opts] = fscontext;
958 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
c9180a57
EP
959 }
960 if (context) {
e0007529
EP
961 opts->mnt_opts[num_mnt_opts] = context;
962 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
c9180a57
EP
963 }
964 if (rootcontext) {
e0007529
EP
965 opts->mnt_opts[num_mnt_opts] = rootcontext;
966 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
c9180a57
EP
967 }
968 if (defcontext) {
e0007529
EP
969 opts->mnt_opts[num_mnt_opts] = defcontext;
970 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
c9180a57
EP
971 }
972
e0007529
EP
973 opts->num_mnt_opts = num_mnt_opts;
974 return 0;
975
c9180a57
EP
976out_err:
977 kfree(context);
978 kfree(defcontext);
979 kfree(fscontext);
980 kfree(rootcontext);
1da177e4
LT
981 return rc;
982}
e0007529
EP
983/*
984 * string mount options parsing and call set the sbsec
985 */
986static int superblock_doinit(struct super_block *sb, void *data)
987{
988 int rc = 0;
989 char *options = data;
990 struct security_mnt_opts opts;
991
992 security_init_mnt_opts(&opts);
993
994 if (!data)
995 goto out;
996
997 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
998
999 rc = selinux_parse_opts_str(options, &opts);
1000 if (rc)
1001 goto out_err;
1002
1003out:
1004 rc = selinux_set_mnt_opts(sb, &opts);
1005
1006out_err:
1007 security_free_mnt_opts(&opts);
1008 return rc;
1009}
1da177e4 1010
3583a711
AB
1011static void selinux_write_opts(struct seq_file *m,
1012 struct security_mnt_opts *opts)
2069f457
EP
1013{
1014 int i;
1015 char *prefix;
1016
1017 for (i = 0; i < opts->num_mnt_opts; i++) {
11689d47
DQ
1018 char *has_comma;
1019
1020 if (opts->mnt_opts[i])
1021 has_comma = strchr(opts->mnt_opts[i], ',');
1022 else
1023 has_comma = NULL;
2069f457
EP
1024
1025 switch (opts->mnt_opts_flags[i]) {
1026 case CONTEXT_MNT:
1027 prefix = CONTEXT_STR;
1028 break;
1029 case FSCONTEXT_MNT:
1030 prefix = FSCONTEXT_STR;
1031 break;
1032 case ROOTCONTEXT_MNT:
1033 prefix = ROOTCONTEXT_STR;
1034 break;
1035 case DEFCONTEXT_MNT:
1036 prefix = DEFCONTEXT_STR;
1037 break;
11689d47
DQ
1038 case SE_SBLABELSUPP:
1039 seq_putc(m, ',');
1040 seq_puts(m, LABELSUPP_STR);
1041 continue;
2069f457
EP
1042 default:
1043 BUG();
1044 };
1045 /* we need a comma before each option */
1046 seq_putc(m, ',');
1047 seq_puts(m, prefix);
1048 if (has_comma)
1049 seq_putc(m, '\"');
1050 seq_puts(m, opts->mnt_opts[i]);
1051 if (has_comma)
1052 seq_putc(m, '\"');
1053 }
1054}
1055
1056static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1057{
1058 struct security_mnt_opts opts;
1059 int rc;
1060
1061 rc = selinux_get_mnt_opts(sb, &opts);
383795c2
EP
1062 if (rc) {
1063 /* before policy load we may get EINVAL, don't show anything */
1064 if (rc == -EINVAL)
1065 rc = 0;
2069f457 1066 return rc;
383795c2 1067 }
2069f457
EP
1068
1069 selinux_write_opts(m, &opts);
1070
1071 security_free_mnt_opts(&opts);
1072
1073 return rc;
1074}
1075
1da177e4
LT
1076static inline u16 inode_mode_to_security_class(umode_t mode)
1077{
1078 switch (mode & S_IFMT) {
1079 case S_IFSOCK:
1080 return SECCLASS_SOCK_FILE;
1081 case S_IFLNK:
1082 return SECCLASS_LNK_FILE;
1083 case S_IFREG:
1084 return SECCLASS_FILE;
1085 case S_IFBLK:
1086 return SECCLASS_BLK_FILE;
1087 case S_IFDIR:
1088 return SECCLASS_DIR;
1089 case S_IFCHR:
1090 return SECCLASS_CHR_FILE;
1091 case S_IFIFO:
1092 return SECCLASS_FIFO_FILE;
1093
1094 }
1095
1096 return SECCLASS_FILE;
1097}
1098
13402580
JM
1099static inline int default_protocol_stream(int protocol)
1100{
1101 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1102}
1103
1104static inline int default_protocol_dgram(int protocol)
1105{
1106 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1107}
1108
1da177e4
LT
1109static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1110{
1111 switch (family) {
1112 case PF_UNIX:
1113 switch (type) {
1114 case SOCK_STREAM:
1115 case SOCK_SEQPACKET:
1116 return SECCLASS_UNIX_STREAM_SOCKET;
1117 case SOCK_DGRAM:
1118 return SECCLASS_UNIX_DGRAM_SOCKET;
1119 }
1120 break;
1121 case PF_INET:
1122 case PF_INET6:
1123 switch (type) {
1124 case SOCK_STREAM:
13402580
JM
1125 if (default_protocol_stream(protocol))
1126 return SECCLASS_TCP_SOCKET;
1127 else
1128 return SECCLASS_RAWIP_SOCKET;
1da177e4 1129 case SOCK_DGRAM:
13402580
JM
1130 if (default_protocol_dgram(protocol))
1131 return SECCLASS_UDP_SOCKET;
1132 else
1133 return SECCLASS_RAWIP_SOCKET;
2ee92d46
JM
1134 case SOCK_DCCP:
1135 return SECCLASS_DCCP_SOCKET;
13402580 1136 default:
1da177e4
LT
1137 return SECCLASS_RAWIP_SOCKET;
1138 }
1139 break;
1140 case PF_NETLINK:
1141 switch (protocol) {
1142 case NETLINK_ROUTE:
1143 return SECCLASS_NETLINK_ROUTE_SOCKET;
1144 case NETLINK_FIREWALL:
1145 return SECCLASS_NETLINK_FIREWALL_SOCKET;
216efaaa 1146 case NETLINK_INET_DIAG:
1da177e4
LT
1147 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1148 case NETLINK_NFLOG:
1149 return SECCLASS_NETLINK_NFLOG_SOCKET;
1150 case NETLINK_XFRM:
1151 return SECCLASS_NETLINK_XFRM_SOCKET;
1152 case NETLINK_SELINUX:
1153 return SECCLASS_NETLINK_SELINUX_SOCKET;
1154 case NETLINK_AUDIT:
1155 return SECCLASS_NETLINK_AUDIT_SOCKET;
1156 case NETLINK_IP6_FW:
1157 return SECCLASS_NETLINK_IP6FW_SOCKET;
1158 case NETLINK_DNRTMSG:
1159 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM
1160 case NETLINK_KOBJECT_UEVENT:
1161 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT
1162 default:
1163 return SECCLASS_NETLINK_SOCKET;
1164 }
1165 case PF_PACKET:
1166 return SECCLASS_PACKET_SOCKET;
1167 case PF_KEY:
1168 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP
1169 case PF_APPLETALK:
1170 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT
1171 }
1172
1173 return SECCLASS_SOCKET;
1174}
1175
1176#ifdef CONFIG_PROC_FS
1177static int selinux_proc_get_sid(struct proc_dir_entry *de,
1178 u16 tclass,
1179 u32 *sid)
1180{
1181 int buflen, rc;
1182 char *buffer, *path, *end;
1183
828dfe1d 1184 buffer = (char *)__get_free_page(GFP_KERNEL);
1da177e4
LT
1185 if (!buffer)
1186 return -ENOMEM;
1187
1188 buflen = PAGE_SIZE;
1189 end = buffer+buflen;
1190 *--end = '\0';
1191 buflen--;
1192 path = end-1;
1193 *path = '/';
1194 while (de && de != de->parent) {
1195 buflen -= de->namelen + 1;
1196 if (buflen < 0)
1197 break;
1198 end -= de->namelen;
1199 memcpy(end, de->name, de->namelen);
1200 *--end = '/';
1201 path = end;
1202 de = de->parent;
1203 }
1204 rc = security_genfs_sid("proc", path, tclass, sid);
1205 free_page((unsigned long)buffer);
1206 return rc;
1207}
1208#else
1209static int selinux_proc_get_sid(struct proc_dir_entry *de,
1210 u16 tclass,
1211 u32 *sid)
1212{
1213 return -EINVAL;
1214}
1215#endif
1216
1217/* The inode's security attributes must be initialized before first use. */
1218static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1219{
1220 struct superblock_security_struct *sbsec = NULL;
1221 struct inode_security_struct *isec = inode->i_security;
1222 u32 sid;
1223 struct dentry *dentry;
1224#define INITCONTEXTLEN 255
1225 char *context = NULL;
1226 unsigned len = 0;
1227 int rc = 0;
1da177e4
LT
1228
1229 if (isec->initialized)
1230 goto out;
1231
23970741 1232 mutex_lock(&isec->lock);
1da177e4 1233 if (isec->initialized)
23970741 1234 goto out_unlock;
1da177e4
LT
1235
1236 sbsec = inode->i_sb->s_security;
0d90a7ec 1237 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1da177e4
LT
1238 /* Defer initialization until selinux_complete_init,
1239 after the initial policy is loaded and the security
1240 server is ready to handle calls. */
1241 spin_lock(&sbsec->isec_lock);
1242 if (list_empty(&isec->list))
1243 list_add(&isec->list, &sbsec->isec_head);
1244 spin_unlock(&sbsec->isec_lock);
23970741 1245 goto out_unlock;
1da177e4
LT
1246 }
1247
1248 switch (sbsec->behavior) {
1249 case SECURITY_FS_USE_XATTR:
1250 if (!inode->i_op->getxattr) {
1251 isec->sid = sbsec->def_sid;
1252 break;
1253 }
1254
1255 /* Need a dentry, since the xattr API requires one.
1256 Life would be simpler if we could just pass the inode. */
1257 if (opt_dentry) {
1258 /* Called from d_instantiate or d_splice_alias. */
1259 dentry = dget(opt_dentry);
1260 } else {
1261 /* Called from selinux_complete_init, try to find a dentry. */
1262 dentry = d_find_alias(inode);
1263 }
1264 if (!dentry) {
df7f54c0
EP
1265 /*
1266 * this is can be hit on boot when a file is accessed
1267 * before the policy is loaded. When we load policy we
1268 * may find inodes that have no dentry on the
1269 * sbsec->isec_head list. No reason to complain as these
1270 * will get fixed up the next time we go through
1271 * inode_doinit with a dentry, before these inodes could
1272 * be used again by userspace.
1273 */
23970741 1274 goto out_unlock;
1da177e4
LT
1275 }
1276
1277 len = INITCONTEXTLEN;
4cb912f1 1278 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1279 if (!context) {
1280 rc = -ENOMEM;
1281 dput(dentry);
23970741 1282 goto out_unlock;
1da177e4 1283 }
4cb912f1 1284 context[len] = '\0';
1da177e4
LT
1285 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1286 context, len);
1287 if (rc == -ERANGE) {
314dabb8
JM
1288 kfree(context);
1289
1da177e4
LT
1290 /* Need a larger buffer. Query for the right size. */
1291 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1292 NULL, 0);
1293 if (rc < 0) {
1294 dput(dentry);
23970741 1295 goto out_unlock;
1da177e4 1296 }
1da177e4 1297 len = rc;
4cb912f1 1298 context = kmalloc(len+1, GFP_NOFS);
1da177e4
LT
1299 if (!context) {
1300 rc = -ENOMEM;
1301 dput(dentry);
23970741 1302 goto out_unlock;
1da177e4 1303 }
4cb912f1 1304 context[len] = '\0';
1da177e4
LT
1305 rc = inode->i_op->getxattr(dentry,
1306 XATTR_NAME_SELINUX,
1307 context, len);
1308 }
1309 dput(dentry);
1310 if (rc < 0) {
1311 if (rc != -ENODATA) {
744ba35e 1312 printk(KERN_WARNING "SELinux: %s: getxattr returned "
dd6f953a 1313 "%d for dev=%s ino=%ld\n", __func__,
1da177e4
LT
1314 -rc, inode->i_sb->s_id, inode->i_ino);
1315 kfree(context);
23970741 1316 goto out_unlock;
1da177e4
LT
1317 }
1318 /* Map ENODATA to the default file SID */
1319 sid = sbsec->def_sid;
1320 rc = 0;
1321 } else {
f5c1d5b2 1322 rc = security_context_to_sid_default(context, rc, &sid,
869ab514
SS
1323 sbsec->def_sid,
1324 GFP_NOFS);
1da177e4 1325 if (rc) {
4ba0a8ad
EP
1326 char *dev = inode->i_sb->s_id;
1327 unsigned long ino = inode->i_ino;
1328
1329 if (rc == -EINVAL) {
1330 if (printk_ratelimit())
1331 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1332 "context=%s. This indicates you may need to relabel the inode or the "
1333 "filesystem in question.\n", ino, dev, context);
1334 } else {
1335 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1336 "returned %d for dev=%s ino=%ld\n",
1337 __func__, context, -rc, dev, ino);
1338 }
1da177e4
LT
1339 kfree(context);
1340 /* Leave with the unlabeled SID */
1341 rc = 0;
1342 break;
1343 }
1344 }
1345 kfree(context);
1346 isec->sid = sid;
1347 break;
1348 case SECURITY_FS_USE_TASK:
1349 isec->sid = isec->task_sid;
1350 break;
1351 case SECURITY_FS_USE_TRANS:
1352 /* Default to the fs SID. */
1353 isec->sid = sbsec->sid;
1354
1355 /* Try to obtain a transition SID. */
1356 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1357 rc = security_transition_sid(isec->task_sid,
1358 sbsec->sid,
1359 isec->sclass,
1360 &sid);
1361 if (rc)
23970741 1362 goto out_unlock;
1da177e4
LT
1363 isec->sid = sid;
1364 break;
c312feb2
EP
1365 case SECURITY_FS_USE_MNTPOINT:
1366 isec->sid = sbsec->mntpoint_sid;
1367 break;
1da177e4 1368 default:
c312feb2 1369 /* Default to the fs superblock SID. */
1da177e4
LT
1370 isec->sid = sbsec->sid;
1371
0d90a7ec 1372 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1da177e4
LT
1373 struct proc_inode *proci = PROC_I(inode);
1374 if (proci->pde) {
1375 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1376 rc = selinux_proc_get_sid(proci->pde,
1377 isec->sclass,
1378 &sid);
1379 if (rc)
23970741 1380 goto out_unlock;
1da177e4
LT
1381 isec->sid = sid;
1382 }
1383 }
1384 break;
1385 }
1386
1387 isec->initialized = 1;
1388
23970741
EP
1389out_unlock:
1390 mutex_unlock(&isec->lock);
1da177e4
LT
1391out:
1392 if (isec->sclass == SECCLASS_FILE)
1393 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1da177e4
LT
1394 return rc;
1395}
1396
1397/* Convert a Linux signal to an access vector. */
1398static inline u32 signal_to_av(int sig)
1399{
1400 u32 perm = 0;
1401
1402 switch (sig) {
1403 case SIGCHLD:
1404 /* Commonly granted from child to parent. */
1405 perm = PROCESS__SIGCHLD;
1406 break;
1407 case SIGKILL:
1408 /* Cannot be caught or ignored */
1409 perm = PROCESS__SIGKILL;
1410 break;
1411 case SIGSTOP:
1412 /* Cannot be caught or ignored */
1413 perm = PROCESS__SIGSTOP;
1414 break;
1415 default:
1416 /* All other signals. */
1417 perm = PROCESS__SIGNAL;
1418 break;
1419 }
1420
1421 return perm;
1422}
1423
d84f4f99
DH
1424/*
1425 * Check permission between a pair of credentials
1426 * fork check, ptrace check, etc.
1427 */
1428static int cred_has_perm(const struct cred *actor,
1429 const struct cred *target,
1430 u32 perms)
1431{
1432 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1433
1434 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1435}
1436
275bb41e 1437/*
88e67f3b 1438 * Check permission between a pair of tasks, e.g. signal checks,
275bb41e
DH
1439 * fork check, ptrace check, etc.
1440 * tsk1 is the actor and tsk2 is the target
3b11a1de 1441 * - this uses the default subjective creds of tsk1
275bb41e
DH
1442 */
1443static int task_has_perm(const struct task_struct *tsk1,
1444 const struct task_struct *tsk2,
1da177e4
LT
1445 u32 perms)
1446{
275bb41e
DH
1447 const struct task_security_struct *__tsec1, *__tsec2;
1448 u32 sid1, sid2;
1da177e4 1449
275bb41e
DH
1450 rcu_read_lock();
1451 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1452 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1453 rcu_read_unlock();
1454 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1da177e4
LT
1455}
1456
3b11a1de
DH
1457/*
1458 * Check permission between current and another task, e.g. signal checks,
1459 * fork check, ptrace check, etc.
1460 * current is the actor and tsk2 is the target
1461 * - this uses current's subjective creds
1462 */
1463static int current_has_perm(const struct task_struct *tsk,
1464 u32 perms)
1465{
1466 u32 sid, tsid;
1467
1468 sid = current_sid();
1469 tsid = task_sid(tsk);
1470 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1471}
1472
b68e418c
SS
1473#if CAP_LAST_CAP > 63
1474#error Fix SELinux to handle capabilities > 63.
1475#endif
1476
1da177e4
LT
1477/* Check whether a task is allowed to use a capability. */
1478static int task_has_capability(struct task_struct *tsk,
3699c53c 1479 const struct cred *cred,
06112163 1480 int cap, int audit)
1da177e4 1481{
2bf49690 1482 struct common_audit_data ad;
06112163 1483 struct av_decision avd;
b68e418c 1484 u16 sclass;
3699c53c 1485 u32 sid = cred_sid(cred);
b68e418c 1486 u32 av = CAP_TO_MASK(cap);
06112163 1487 int rc;
1da177e4 1488
2bf49690 1489 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1da177e4
LT
1490 ad.tsk = tsk;
1491 ad.u.cap = cap;
1492
b68e418c
SS
1493 switch (CAP_TO_INDEX(cap)) {
1494 case 0:
1495 sclass = SECCLASS_CAPABILITY;
1496 break;
1497 case 1:
1498 sclass = SECCLASS_CAPABILITY2;
1499 break;
1500 default:
1501 printk(KERN_ERR
1502 "SELinux: out of range capability %d\n", cap);
1503 BUG();
1504 }
06112163 1505
275bb41e 1506 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
06112163 1507 if (audit == SECURITY_CAP_AUDIT)
275bb41e 1508 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
06112163 1509 return rc;
1da177e4
LT
1510}
1511
1512/* Check whether a task is allowed to use a system operation. */
1513static int task_has_system(struct task_struct *tsk,
1514 u32 perms)
1515{
275bb41e 1516 u32 sid = task_sid(tsk);
1da177e4 1517
275bb41e 1518 return avc_has_perm(sid, SECINITSID_KERNEL,
1da177e4
LT
1519 SECCLASS_SYSTEM, perms, NULL);
1520}
1521
1522/* Check whether a task has a particular permission to an inode.
1523 The 'adp' parameter is optional and allows other audit
1524 data to be passed (e.g. the dentry). */
88e67f3b 1525static int inode_has_perm(const struct cred *cred,
1da177e4
LT
1526 struct inode *inode,
1527 u32 perms,
2bf49690 1528 struct common_audit_data *adp)
1da177e4 1529{
1da177e4 1530 struct inode_security_struct *isec;
2bf49690 1531 struct common_audit_data ad;
275bb41e 1532 u32 sid;
1da177e4 1533
828dfe1d 1534 if (unlikely(IS_PRIVATE(inode)))
bbaca6c2
SS
1535 return 0;
1536
88e67f3b 1537 sid = cred_sid(cred);
1da177e4
LT
1538 isec = inode->i_security;
1539
1540 if (!adp) {
1541 adp = &ad;
2bf49690 1542 COMMON_AUDIT_DATA_INIT(&ad, FS);
1da177e4
LT
1543 ad.u.fs.inode = inode;
1544 }
1545
275bb41e 1546 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1da177e4
LT
1547}
1548
1549/* Same as inode_has_perm, but pass explicit audit data containing
1550 the dentry to help the auditing code to more easily generate the
1551 pathname if needed. */
88e67f3b 1552static inline int dentry_has_perm(const struct cred *cred,
1da177e4
LT
1553 struct vfsmount *mnt,
1554 struct dentry *dentry,
1555 u32 av)
1556{
1557 struct inode *inode = dentry->d_inode;
2bf49690 1558 struct common_audit_data ad;
88e67f3b 1559
2bf49690 1560 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf
JB
1561 ad.u.fs.path.mnt = mnt;
1562 ad.u.fs.path.dentry = dentry;
88e67f3b 1563 return inode_has_perm(cred, inode, av, &ad);
1da177e4
LT
1564}
1565
1566/* Check whether a task can use an open file descriptor to
1567 access an inode in a given way. Check access to the
1568 descriptor itself, and then use dentry_has_perm to
1569 check a particular permission to the file.
1570 Access to the descriptor is implicitly granted if it
1571 has the same SID as the process. If av is zero, then
1572 access to the file is not checked, e.g. for cases
1573 where only the descriptor is affected like seek. */
88e67f3b
DH
1574static int file_has_perm(const struct cred *cred,
1575 struct file *file,
1576 u32 av)
1da177e4 1577{
1da177e4 1578 struct file_security_struct *fsec = file->f_security;
44707fdf 1579 struct inode *inode = file->f_path.dentry->d_inode;
2bf49690 1580 struct common_audit_data ad;
88e67f3b 1581 u32 sid = cred_sid(cred);
1da177e4
LT
1582 int rc;
1583
2bf49690 1584 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1585 ad.u.fs.path = file->f_path;
1da177e4 1586
275bb41e
DH
1587 if (sid != fsec->sid) {
1588 rc = avc_has_perm(sid, fsec->sid,
1da177e4
LT
1589 SECCLASS_FD,
1590 FD__USE,
1591 &ad);
1592 if (rc)
88e67f3b 1593 goto out;
1da177e4
LT
1594 }
1595
1596 /* av is zero if only checking access to the descriptor. */
88e67f3b 1597 rc = 0;
1da177e4 1598 if (av)
88e67f3b 1599 rc = inode_has_perm(cred, inode, av, &ad);
1da177e4 1600
88e67f3b
DH
1601out:
1602 return rc;
1da177e4
LT
1603}
1604
1605/* Check whether a task can create a file. */
1606static int may_create(struct inode *dir,
1607 struct dentry *dentry,
1608 u16 tclass)
1609{
275bb41e
DH
1610 const struct cred *cred = current_cred();
1611 const struct task_security_struct *tsec = cred->security;
1da177e4
LT
1612 struct inode_security_struct *dsec;
1613 struct superblock_security_struct *sbsec;
275bb41e 1614 u32 sid, newsid;
2bf49690 1615 struct common_audit_data ad;
1da177e4
LT
1616 int rc;
1617
1da177e4
LT
1618 dsec = dir->i_security;
1619 sbsec = dir->i_sb->s_security;
1620
275bb41e
DH
1621 sid = tsec->sid;
1622 newsid = tsec->create_sid;
1623
2bf49690 1624 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1625 ad.u.fs.path.dentry = dentry;
1da177e4 1626
275bb41e 1627 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1da177e4
LT
1628 DIR__ADD_NAME | DIR__SEARCH,
1629 &ad);
1630 if (rc)
1631 return rc;
1632
cd89596f 1633 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
275bb41e 1634 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
1da177e4
LT
1635 if (rc)
1636 return rc;
1637 }
1638
275bb41e 1639 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1da177e4
LT
1640 if (rc)
1641 return rc;
1642
1643 return avc_has_perm(newsid, sbsec->sid,
1644 SECCLASS_FILESYSTEM,
1645 FILESYSTEM__ASSOCIATE, &ad);
1646}
1647
4eb582cf
ML
1648/* Check whether a task can create a key. */
1649static int may_create_key(u32 ksid,
1650 struct task_struct *ctx)
1651{
275bb41e 1652 u32 sid = task_sid(ctx);
4eb582cf 1653
275bb41e 1654 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
4eb582cf
ML
1655}
1656
828dfe1d
EP
1657#define MAY_LINK 0
1658#define MAY_UNLINK 1
1659#define MAY_RMDIR 2
1da177e4
LT
1660
1661/* Check whether a task can link, unlink, or rmdir a file/directory. */
1662static int may_link(struct inode *dir,
1663 struct dentry *dentry,
1664 int kind)
1665
1666{
1da177e4 1667 struct inode_security_struct *dsec, *isec;
2bf49690 1668 struct common_audit_data ad;
275bb41e 1669 u32 sid = current_sid();
1da177e4
LT
1670 u32 av;
1671 int rc;
1672
1da177e4
LT
1673 dsec = dir->i_security;
1674 isec = dentry->d_inode->i_security;
1675
2bf49690 1676 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 1677 ad.u.fs.path.dentry = dentry;
1da177e4
LT
1678
1679 av = DIR__SEARCH;
1680 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
275bb41e 1681 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1682 if (rc)
1683 return rc;
1684
1685 switch (kind) {
1686 case MAY_LINK:
1687 av = FILE__LINK;
1688 break;
1689 case MAY_UNLINK:
1690 av = FILE__UNLINK;
1691 break;
1692 case MAY_RMDIR:
1693 av = DIR__RMDIR;
1694 break;
1695 default:
744ba35e
EP
1696 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1697 __func__, kind);
1da177e4
LT
1698 return 0;
1699 }
1700
275bb41e 1701 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1da177e4
LT
1702 return rc;
1703}
1704
1705static inline int may_rename(struct inode *old_dir,
1706 struct dentry *old_dentry,
1707 struct inode *new_dir,
1708 struct dentry *new_dentry)
1709{
1da177e4 1710 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
2bf49690 1711 struct common_audit_data ad;
275bb41e 1712 u32 sid = current_sid();
1da177e4
LT
1713 u32 av;
1714 int old_is_dir, new_is_dir;
1715 int rc;
1716
1da177e4
LT
1717 old_dsec = old_dir->i_security;
1718 old_isec = old_dentry->d_inode->i_security;
1719 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1720 new_dsec = new_dir->i_security;
1721
2bf49690 1722 COMMON_AUDIT_DATA_INIT(&ad, FS);
1da177e4 1723
44707fdf 1724 ad.u.fs.path.dentry = old_dentry;
275bb41e 1725 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1da177e4
LT
1726 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1727 if (rc)
1728 return rc;
275bb41e 1729 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1730 old_isec->sclass, FILE__RENAME, &ad);
1731 if (rc)
1732 return rc;
1733 if (old_is_dir && new_dir != old_dir) {
275bb41e 1734 rc = avc_has_perm(sid, old_isec->sid,
1da177e4
LT
1735 old_isec->sclass, DIR__REPARENT, &ad);
1736 if (rc)
1737 return rc;
1738 }
1739
44707fdf 1740 ad.u.fs.path.dentry = new_dentry;
1da177e4
LT
1741 av = DIR__ADD_NAME | DIR__SEARCH;
1742 if (new_dentry->d_inode)
1743 av |= DIR__REMOVE_NAME;
275bb41e 1744 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1da177e4
LT
1745 if (rc)
1746 return rc;
1747 if (new_dentry->d_inode) {
1748 new_isec = new_dentry->d_inode->i_security;
1749 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
275bb41e 1750 rc = avc_has_perm(sid, new_isec->sid,
1da177e4
LT
1751 new_isec->sclass,
1752 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1753 if (rc)
1754 return rc;
1755 }
1756
1757 return 0;
1758}
1759
1760/* Check whether a task can perform a filesystem operation. */
88e67f3b 1761static int superblock_has_perm(const struct cred *cred,
1da177e4
LT
1762 struct super_block *sb,
1763 u32 perms,
2bf49690 1764 struct common_audit_data *ad)
1da177e4 1765{
1da177e4 1766 struct superblock_security_struct *sbsec;
88e67f3b 1767 u32 sid = cred_sid(cred);
1da177e4 1768
1da177e4 1769 sbsec = sb->s_security;
275bb41e 1770 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1da177e4
LT
1771}
1772
1773/* Convert a Linux mode and permission mask to an access vector. */
1774static inline u32 file_mask_to_av(int mode, int mask)
1775{
1776 u32 av = 0;
1777
1778 if ((mode & S_IFMT) != S_IFDIR) {
1779 if (mask & MAY_EXEC)
1780 av |= FILE__EXECUTE;
1781 if (mask & MAY_READ)
1782 av |= FILE__READ;
1783
1784 if (mask & MAY_APPEND)
1785 av |= FILE__APPEND;
1786 else if (mask & MAY_WRITE)
1787 av |= FILE__WRITE;
1788
1789 } else {
1790 if (mask & MAY_EXEC)
1791 av |= DIR__SEARCH;
1792 if (mask & MAY_WRITE)
1793 av |= DIR__WRITE;
1794 if (mask & MAY_READ)
1795 av |= DIR__READ;
1796 }
1797
1798 return av;
1799}
1800
8b6a5a37
EP
1801/* Convert a Linux file to an access vector. */
1802static inline u32 file_to_av(struct file *file)
1803{
1804 u32 av = 0;
1805
1806 if (file->f_mode & FMODE_READ)
1807 av |= FILE__READ;
1808 if (file->f_mode & FMODE_WRITE) {
1809 if (file->f_flags & O_APPEND)
1810 av |= FILE__APPEND;
1811 else
1812 av |= FILE__WRITE;
1813 }
1814 if (!av) {
1815 /*
1816 * Special file opened with flags 3 for ioctl-only use.
1817 */
1818 av = FILE__IOCTL;
1819 }
1820
1821 return av;
1822}
1823
b0c636b9 1824/*
8b6a5a37 1825 * Convert a file to an access vector and include the correct open
b0c636b9
EP
1826 * open permission.
1827 */
8b6a5a37 1828static inline u32 open_file_to_av(struct file *file)
b0c636b9 1829{
8b6a5a37 1830 u32 av = file_to_av(file);
b0c636b9
EP
1831
1832 if (selinux_policycap_openperm) {
8b6a5a37 1833 mode_t mode = file->f_path.dentry->d_inode->i_mode;
b0c636b9
EP
1834 /*
1835 * lnk files and socks do not really have an 'open'
1836 */
1837 if (S_ISREG(mode))
1838 av |= FILE__OPEN;
1839 else if (S_ISCHR(mode))
1840 av |= CHR_FILE__OPEN;
1841 else if (S_ISBLK(mode))
1842 av |= BLK_FILE__OPEN;
1843 else if (S_ISFIFO(mode))
1844 av |= FIFO_FILE__OPEN;
1845 else if (S_ISDIR(mode))
1846 av |= DIR__OPEN;
6a25b27d
EP
1847 else if (S_ISSOCK(mode))
1848 av |= SOCK_FILE__OPEN;
b0c636b9 1849 else
744ba35e 1850 printk(KERN_ERR "SELinux: WARNING: inside %s with "
8b6a5a37 1851 "unknown mode:%o\n", __func__, mode);
b0c636b9
EP
1852 }
1853 return av;
1854}
1855
1da177e4
LT
1856/* Hook functions begin here. */
1857
9e48858f 1858static int selinux_ptrace_access_check(struct task_struct *child,
5cd9c58f 1859 unsigned int mode)
1da177e4 1860{
1da177e4
LT
1861 int rc;
1862
9e48858f 1863 rc = cap_ptrace_access_check(child, mode);
1da177e4
LT
1864 if (rc)
1865 return rc;
1866
006ebb40 1867 if (mode == PTRACE_MODE_READ) {
275bb41e
DH
1868 u32 sid = current_sid();
1869 u32 csid = task_sid(child);
1870 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
006ebb40
SS
1871 }
1872
3b11a1de 1873 return current_has_perm(child, PROCESS__PTRACE);
5cd9c58f
DH
1874}
1875
1876static int selinux_ptrace_traceme(struct task_struct *parent)
1877{
1878 int rc;
1879
200ac532 1880 rc = cap_ptrace_traceme(parent);
5cd9c58f
DH
1881 if (rc)
1882 return rc;
1883
1884 return task_has_perm(parent, current, PROCESS__PTRACE);
1da177e4
LT
1885}
1886
1887static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
828dfe1d 1888 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1da177e4
LT
1889{
1890 int error;
1891
3b11a1de 1892 error = current_has_perm(target, PROCESS__GETCAP);
1da177e4
LT
1893 if (error)
1894 return error;
1895
200ac532 1896 return cap_capget(target, effective, inheritable, permitted);
1da177e4
LT
1897}
1898
d84f4f99
DH
1899static int selinux_capset(struct cred *new, const struct cred *old,
1900 const kernel_cap_t *effective,
1901 const kernel_cap_t *inheritable,
1902 const kernel_cap_t *permitted)
1da177e4
LT
1903{
1904 int error;
1905
200ac532 1906 error = cap_capset(new, old,
d84f4f99 1907 effective, inheritable, permitted);
1da177e4
LT
1908 if (error)
1909 return error;
1910
d84f4f99 1911 return cred_has_perm(old, new, PROCESS__SETCAP);
1da177e4
LT
1912}
1913
5626d3e8
JM
1914/*
1915 * (This comment used to live with the selinux_task_setuid hook,
1916 * which was removed).
1917 *
1918 * Since setuid only affects the current process, and since the SELinux
1919 * controls are not based on the Linux identity attributes, SELinux does not
1920 * need to control this operation. However, SELinux does control the use of
1921 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1922 */
1923
3699c53c
DH
1924static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1925 int cap, int audit)
1da177e4
LT
1926{
1927 int rc;
1928
200ac532 1929 rc = cap_capable(tsk, cred, cap, audit);
1da177e4
LT
1930 if (rc)
1931 return rc;
1932
3699c53c 1933 return task_has_capability(tsk, cred, cap, audit);
1da177e4
LT
1934}
1935
3fbfa981
EB
1936static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1937{
1938 int buflen, rc;
1939 char *buffer, *path, *end;
1940
1941 rc = -ENOMEM;
828dfe1d 1942 buffer = (char *)__get_free_page(GFP_KERNEL);
3fbfa981
EB
1943 if (!buffer)
1944 goto out;
1945
1946 buflen = PAGE_SIZE;
1947 end = buffer+buflen;
1948 *--end = '\0';
1949 buflen--;
1950 path = end-1;
1951 *path = '/';
1952 while (table) {
1953 const char *name = table->procname;
1954 size_t namelen = strlen(name);
1955 buflen -= namelen + 1;
1956 if (buflen < 0)
1957 goto out_free;
1958 end -= namelen;
1959 memcpy(end, name, namelen);
1960 *--end = '/';
1961 path = end;
1962 table = table->parent;
1963 }
b599fdfd
EB
1964 buflen -= 4;
1965 if (buflen < 0)
1966 goto out_free;
1967 end -= 4;
1968 memcpy(end, "/sys", 4);
1969 path = end;
3fbfa981
EB
1970 rc = security_genfs_sid("proc", path, tclass, sid);
1971out_free:
1972 free_page((unsigned long)buffer);
1973out:
1974 return rc;
1975}
1976
1da177e4
LT
1977static int selinux_sysctl(ctl_table *table, int op)
1978{
1979 int error = 0;
1980 u32 av;
275bb41e 1981 u32 tsid, sid;
1da177e4
LT
1982 int rc;
1983
275bb41e 1984 sid = current_sid();
1da177e4 1985
3fbfa981
EB
1986 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1987 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1da177e4
LT
1988 if (rc) {
1989 /* Default to the well-defined sysctl SID. */
1990 tsid = SECINITSID_SYSCTL;
1991 }
1992
1993 /* The op values are "defined" in sysctl.c, thereby creating
1994 * a bad coupling between this module and sysctl.c */
828dfe1d 1995 if (op == 001) {
275bb41e 1996 error = avc_has_perm(sid, tsid,
1da177e4
LT
1997 SECCLASS_DIR, DIR__SEARCH, NULL);
1998 } else {
1999 av = 0;
2000 if (op & 004)
2001 av |= FILE__READ;
2002 if (op & 002)
2003 av |= FILE__WRITE;
2004 if (av)
275bb41e 2005 error = avc_has_perm(sid, tsid,
1da177e4 2006 SECCLASS_FILE, av, NULL);
828dfe1d 2007 }
1da177e4
LT
2008
2009 return error;
2010}
2011
2012static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2013{
88e67f3b 2014 const struct cred *cred = current_cred();
1da177e4
LT
2015 int rc = 0;
2016
2017 if (!sb)
2018 return 0;
2019
2020 switch (cmds) {
828dfe1d
EP
2021 case Q_SYNC:
2022 case Q_QUOTAON:
2023 case Q_QUOTAOFF:
2024 case Q_SETINFO:
2025 case Q_SETQUOTA:
88e67f3b 2026 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
828dfe1d
EP
2027 break;
2028 case Q_GETFMT:
2029 case Q_GETINFO:
2030 case Q_GETQUOTA:
88e67f3b 2031 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
828dfe1d
EP
2032 break;
2033 default:
2034 rc = 0; /* let the kernel handle invalid cmds */
2035 break;
1da177e4
LT
2036 }
2037 return rc;
2038}
2039
2040static int selinux_quota_on(struct dentry *dentry)
2041{
88e67f3b
DH
2042 const struct cred *cred = current_cred();
2043
2044 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
1da177e4
LT
2045}
2046
2047static int selinux_syslog(int type)
2048{
2049 int rc;
2050
200ac532 2051 rc = cap_syslog(type);
1da177e4
LT
2052 if (rc)
2053 return rc;
2054
2055 switch (type) {
828dfe1d
EP
2056 case 3: /* Read last kernel messages */
2057 case 10: /* Return size of the log buffer */
2058 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2059 break;
2060 case 6: /* Disable logging to console */
2061 case 7: /* Enable logging to console */
2062 case 8: /* Set level of messages printed to console */
2063 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2064 break;
2065 case 0: /* Close log */
2066 case 1: /* Open log */
2067 case 2: /* Read from log */
2068 case 4: /* Read/clear last kernel messages */
2069 case 5: /* Clear ring buffer */
2070 default:
2071 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2072 break;
1da177e4
LT
2073 }
2074 return rc;
2075}
2076
2077/*
2078 * Check that a process has enough memory to allocate a new virtual
2079 * mapping. 0 means there is enough memory for the allocation to
2080 * succeed and -ENOMEM implies there is not.
2081 *
1da177e4
LT
2082 * Do not audit the selinux permission check, as this is applied to all
2083 * processes that allocate mappings.
2084 */
34b4e4aa 2085static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1da177e4
LT
2086{
2087 int rc, cap_sys_admin = 0;
1da177e4 2088
3699c53c
DH
2089 rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
2090 SECURITY_CAP_NOAUDIT);
1da177e4
LT
2091 if (rc == 0)
2092 cap_sys_admin = 1;
2093
34b4e4aa 2094 return __vm_enough_memory(mm, pages, cap_sys_admin);
1da177e4
LT
2095}
2096
2097/* binprm security operations */
2098
a6f76f23 2099static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1da177e4 2100{
a6f76f23
DH
2101 const struct task_security_struct *old_tsec;
2102 struct task_security_struct *new_tsec;
1da177e4 2103 struct inode_security_struct *isec;
2bf49690 2104 struct common_audit_data ad;
a6f76f23 2105 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1da177e4
LT
2106 int rc;
2107
200ac532 2108 rc = cap_bprm_set_creds(bprm);
1da177e4
LT
2109 if (rc)
2110 return rc;
2111
a6f76f23
DH
2112 /* SELinux context only depends on initial program or script and not
2113 * the script interpreter */
2114 if (bprm->cred_prepared)
1da177e4
LT
2115 return 0;
2116
a6f76f23
DH
2117 old_tsec = current_security();
2118 new_tsec = bprm->cred->security;
1da177e4
LT
2119 isec = inode->i_security;
2120
2121 /* Default to the current task SID. */
a6f76f23
DH
2122 new_tsec->sid = old_tsec->sid;
2123 new_tsec->osid = old_tsec->sid;
1da177e4 2124
28eba5bf 2125 /* Reset fs, key, and sock SIDs on execve. */
a6f76f23
DH
2126 new_tsec->create_sid = 0;
2127 new_tsec->keycreate_sid = 0;
2128 new_tsec->sockcreate_sid = 0;
1da177e4 2129
a6f76f23
DH
2130 if (old_tsec->exec_sid) {
2131 new_tsec->sid = old_tsec->exec_sid;
1da177e4 2132 /* Reset exec SID on execve. */
a6f76f23 2133 new_tsec->exec_sid = 0;
1da177e4
LT
2134 } else {
2135 /* Check for a default transition on this program. */
a6f76f23
DH
2136 rc = security_transition_sid(old_tsec->sid, isec->sid,
2137 SECCLASS_PROCESS, &new_tsec->sid);
1da177e4
LT
2138 if (rc)
2139 return rc;
2140 }
2141
2bf49690 2142 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2143 ad.u.fs.path = bprm->file->f_path;
1da177e4 2144
3d5ff529 2145 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
a6f76f23 2146 new_tsec->sid = old_tsec->sid;
1da177e4 2147
a6f76f23
DH
2148 if (new_tsec->sid == old_tsec->sid) {
2149 rc = avc_has_perm(old_tsec->sid, isec->sid,
1da177e4
LT
2150 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2151 if (rc)
2152 return rc;
2153 } else {
2154 /* Check permissions for the transition. */
a6f76f23 2155 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
1da177e4
LT
2156 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2157 if (rc)
2158 return rc;
2159
a6f76f23 2160 rc = avc_has_perm(new_tsec->sid, isec->sid,
1da177e4
LT
2161 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2162 if (rc)
2163 return rc;
2164
a6f76f23
DH
2165 /* Check for shared state */
2166 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2167 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2168 SECCLASS_PROCESS, PROCESS__SHARE,
2169 NULL);
2170 if (rc)
2171 return -EPERM;
2172 }
2173
2174 /* Make sure that anyone attempting to ptrace over a task that
2175 * changes its SID has the appropriate permit */
2176 if (bprm->unsafe &
2177 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2178 struct task_struct *tracer;
2179 struct task_security_struct *sec;
2180 u32 ptsid = 0;
2181
2182 rcu_read_lock();
2183 tracer = tracehook_tracer_task(current);
2184 if (likely(tracer != NULL)) {
2185 sec = __task_cred(tracer)->security;
2186 ptsid = sec->sid;
2187 }
2188 rcu_read_unlock();
2189
2190 if (ptsid != 0) {
2191 rc = avc_has_perm(ptsid, new_tsec->sid,
2192 SECCLASS_PROCESS,
2193 PROCESS__PTRACE, NULL);
2194 if (rc)
2195 return -EPERM;
2196 }
2197 }
1da177e4 2198
a6f76f23
DH
2199 /* Clear any possibly unsafe personality bits on exec: */
2200 bprm->per_clear |= PER_CLEAR_ON_SETID;
1da177e4
LT
2201 }
2202
1da177e4
LT
2203 return 0;
2204}
2205
828dfe1d 2206static int selinux_bprm_secureexec(struct linux_binprm *bprm)
1da177e4 2207{
275bb41e
DH
2208 const struct cred *cred = current_cred();
2209 const struct task_security_struct *tsec = cred->security;
2210 u32 sid, osid;
1da177e4
LT
2211 int atsecure = 0;
2212
275bb41e
DH
2213 sid = tsec->sid;
2214 osid = tsec->osid;
2215
2216 if (osid != sid) {
1da177e4
LT
2217 /* Enable secure mode for SIDs transitions unless
2218 the noatsecure permission is granted between
2219 the two SIDs, i.e. ahp returns 0. */
275bb41e 2220 atsecure = avc_has_perm(osid, sid,
a6f76f23
DH
2221 SECCLASS_PROCESS,
2222 PROCESS__NOATSECURE, NULL);
1da177e4
LT
2223 }
2224
200ac532 2225 return (atsecure || cap_bprm_secureexec(bprm));
1da177e4
LT
2226}
2227
1da177e4
LT
2228extern struct vfsmount *selinuxfs_mount;
2229extern struct dentry *selinux_null;
2230
2231/* Derived from fs/exec.c:flush_old_files. */
745ca247
DH
2232static inline void flush_unauthorized_files(const struct cred *cred,
2233 struct files_struct *files)
1da177e4 2234{
2bf49690 2235 struct common_audit_data ad;
1da177e4 2236 struct file *file, *devnull = NULL;
b20c8122 2237 struct tty_struct *tty;
badf1662 2238 struct fdtable *fdt;
1da177e4 2239 long j = -1;
24ec839c 2240 int drop_tty = 0;
1da177e4 2241
24ec839c 2242 tty = get_current_tty();
1da177e4
LT
2243 if (tty) {
2244 file_list_lock();
37dd0bd0
EP
2245 if (!list_empty(&tty->tty_files)) {
2246 struct inode *inode;
2247
1da177e4
LT
2248 /* Revalidate access to controlling tty.
2249 Use inode_has_perm on the tty inode directly rather
2250 than using file_has_perm, as this particular open
2251 file may belong to another process and we are only
2252 interested in the inode-based check here. */
37dd0bd0
EP
2253 file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2254 inode = file->f_path.dentry->d_inode;
88e67f3b 2255 if (inode_has_perm(cred, inode,
1da177e4 2256 FILE__READ | FILE__WRITE, NULL)) {
24ec839c 2257 drop_tty = 1;
1da177e4
LT
2258 }
2259 }
2260 file_list_unlock();
452a00d2 2261 tty_kref_put(tty);
1da177e4 2262 }
98a27ba4
EB
2263 /* Reset controlling tty. */
2264 if (drop_tty)
2265 no_tty();
1da177e4
LT
2266
2267 /* Revalidate access to inherited open files. */
2268
2bf49690 2269 COMMON_AUDIT_DATA_INIT(&ad, FS);
1da177e4
LT
2270
2271 spin_lock(&files->file_lock);
2272 for (;;) {
2273 unsigned long set, i;
2274 int fd;
2275
2276 j++;
2277 i = j * __NFDBITS;
badf1662 2278 fdt = files_fdtable(files);
bbea9f69 2279 if (i >= fdt->max_fds)
1da177e4 2280 break;
badf1662 2281 set = fdt->open_fds->fds_bits[j];
1da177e4
LT
2282 if (!set)
2283 continue;
2284 spin_unlock(&files->file_lock);
828dfe1d 2285 for ( ; set ; i++, set >>= 1) {
1da177e4
LT
2286 if (set & 1) {
2287 file = fget(i);
2288 if (!file)
2289 continue;
88e67f3b 2290 if (file_has_perm(cred,
1da177e4
LT
2291 file,
2292 file_to_av(file))) {
2293 sys_close(i);
2294 fd = get_unused_fd();
2295 if (fd != i) {
2296 if (fd >= 0)
2297 put_unused_fd(fd);
2298 fput(file);
2299 continue;
2300 }
2301 if (devnull) {
095975da 2302 get_file(devnull);
1da177e4 2303 } else {
745ca247
DH
2304 devnull = dentry_open(
2305 dget(selinux_null),
2306 mntget(selinuxfs_mount),
2307 O_RDWR, cred);
fc5d81e6
AM
2308 if (IS_ERR(devnull)) {
2309 devnull = NULL;
1da177e4
LT
2310 put_unused_fd(fd);
2311 fput(file);
2312 continue;
2313 }
2314 }
2315 fd_install(fd, devnull);
2316 }
2317 fput(file);
2318 }
2319 }
2320 spin_lock(&files->file_lock);
2321
2322 }
2323 spin_unlock(&files->file_lock);
2324}
2325
a6f76f23
DH
2326/*
2327 * Prepare a process for imminent new credential changes due to exec
2328 */
2329static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
1da177e4 2330{
a6f76f23
DH
2331 struct task_security_struct *new_tsec;
2332 struct rlimit *rlim, *initrlim;
2333 int rc, i;
d84f4f99 2334
a6f76f23
DH
2335 new_tsec = bprm->cred->security;
2336 if (new_tsec->sid == new_tsec->osid)
2337 return;
1da177e4 2338
a6f76f23
DH
2339 /* Close files for which the new task SID is not authorized. */
2340 flush_unauthorized_files(bprm->cred, current->files);
0356357c 2341
a6f76f23
DH
2342 /* Always clear parent death signal on SID transitions. */
2343 current->pdeath_signal = 0;
0356357c 2344
a6f76f23
DH
2345 /* Check whether the new SID can inherit resource limits from the old
2346 * SID. If not, reset all soft limits to the lower of the current
2347 * task's hard limit and the init task's soft limit.
2348 *
2349 * Note that the setting of hard limits (even to lower them) can be
2350 * controlled by the setrlimit check. The inclusion of the init task's
2351 * soft limit into the computation is to avoid resetting soft limits
2352 * higher than the default soft limit for cases where the default is
2353 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2354 */
2355 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2356 PROCESS__RLIMITINH, NULL);
2357 if (rc) {
2358 for (i = 0; i < RLIM_NLIMITS; i++) {
2359 rlim = current->signal->rlim + i;
2360 initrlim = init_task.signal->rlim + i;
2361 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
1da177e4 2362 }
a6f76f23 2363 update_rlimit_cpu(rlim->rlim_cur);
1da177e4
LT
2364 }
2365}
2366
2367/*
a6f76f23
DH
2368 * Clean up the process immediately after the installation of new credentials
2369 * due to exec
1da177e4 2370 */
a6f76f23 2371static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
1da177e4 2372{
a6f76f23 2373 const struct task_security_struct *tsec = current_security();
1da177e4 2374 struct itimerval itimer;
a6f76f23 2375 u32 osid, sid;
1da177e4
LT
2376 int rc, i;
2377
a6f76f23
DH
2378 osid = tsec->osid;
2379 sid = tsec->sid;
2380
2381 if (sid == osid)
1da177e4
LT
2382 return;
2383
a6f76f23
DH
2384 /* Check whether the new SID can inherit signal state from the old SID.
2385 * If not, clear itimers to avoid subsequent signal generation and
2386 * flush and unblock signals.
2387 *
2388 * This must occur _after_ the task SID has been updated so that any
2389 * kill done after the flush will be checked against the new SID.
2390 */
2391 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
1da177e4
LT
2392 if (rc) {
2393 memset(&itimer, 0, sizeof itimer);
2394 for (i = 0; i < 3; i++)
2395 do_setitimer(i, &itimer, NULL);
1da177e4 2396 spin_lock_irq(&current->sighand->siglock);
3bcac026
DH
2397 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2398 __flush_signals(current);
2399 flush_signal_handlers(current, 1);
2400 sigemptyset(&current->blocked);
2401 }
1da177e4
LT
2402 spin_unlock_irq(&current->sighand->siglock);
2403 }
2404
a6f76f23
DH
2405 /* Wake up the parent if it is waiting so that it can recheck
2406 * wait permission to the new task SID. */
ecd6de3c
ON
2407 read_lock(&tasklist_lock);
2408 wake_up_interruptible(&current->real_parent->signal->wait_chldexit);
2409 read_unlock(&tasklist_lock);
1da177e4
LT
2410}
2411
2412/* superblock security operations */
2413
2414static int selinux_sb_alloc_security(struct super_block *sb)
2415{
2416 return superblock_alloc_security(sb);
2417}
2418
2419static void selinux_sb_free_security(struct super_block *sb)
2420{
2421 superblock_free_security(sb);
2422}
2423
2424static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2425{
2426 if (plen > olen)
2427 return 0;
2428
2429 return !memcmp(prefix, option, plen);
2430}
2431
2432static inline int selinux_option(char *option, int len)
2433{
832cbd9a
EP
2434 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2435 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2436 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
11689d47
DQ
2437 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2438 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
1da177e4
LT
2439}
2440
2441static inline void take_option(char **to, char *from, int *first, int len)
2442{
2443 if (!*first) {
2444 **to = ',';
2445 *to += 1;
3528a953 2446 } else
1da177e4
LT
2447 *first = 0;
2448 memcpy(*to, from, len);
2449 *to += len;
2450}
2451
828dfe1d
EP
2452static inline void take_selinux_option(char **to, char *from, int *first,
2453 int len)
3528a953
CO
2454{
2455 int current_size = 0;
2456
2457 if (!*first) {
2458 **to = '|';
2459 *to += 1;
828dfe1d 2460 } else
3528a953
CO
2461 *first = 0;
2462
2463 while (current_size < len) {
2464 if (*from != '"') {
2465 **to = *from;
2466 *to += 1;
2467 }
2468 from += 1;
2469 current_size += 1;
2470 }
2471}
2472
e0007529 2473static int selinux_sb_copy_data(char *orig, char *copy)
1da177e4
LT
2474{
2475 int fnosec, fsec, rc = 0;
2476 char *in_save, *in_curr, *in_end;
2477 char *sec_curr, *nosec_save, *nosec;
3528a953 2478 int open_quote = 0;
1da177e4
LT
2479
2480 in_curr = orig;
2481 sec_curr = copy;
2482
1da177e4
LT
2483 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2484 if (!nosec) {
2485 rc = -ENOMEM;
2486 goto out;
2487 }
2488
2489 nosec_save = nosec;
2490 fnosec = fsec = 1;
2491 in_save = in_end = orig;
2492
2493 do {
3528a953
CO
2494 if (*in_end == '"')
2495 open_quote = !open_quote;
2496 if ((*in_end == ',' && open_quote == 0) ||
2497 *in_end == '\0') {
1da177e4
LT
2498 int len = in_end - in_curr;
2499
2500 if (selinux_option(in_curr, len))
3528a953 2501 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1da177e4
LT
2502 else
2503 take_option(&nosec, in_curr, &fnosec, len);
2504
2505 in_curr = in_end + 1;
2506 }
2507 } while (*in_end++);
2508
6931dfc9 2509 strcpy(in_save, nosec_save);
da3caa20 2510 free_page((unsigned long)nosec_save);
1da177e4
LT
2511out:
2512 return rc;
2513}
2514
12204e24 2515static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
1da177e4 2516{
88e67f3b 2517 const struct cred *cred = current_cred();
2bf49690 2518 struct common_audit_data ad;
1da177e4
LT
2519 int rc;
2520
2521 rc = superblock_doinit(sb, data);
2522 if (rc)
2523 return rc;
2524
74192246
JM
2525 /* Allow all mounts performed by the kernel */
2526 if (flags & MS_KERNMOUNT)
2527 return 0;
2528
2bf49690 2529 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2530 ad.u.fs.path.dentry = sb->s_root;
88e67f3b 2531 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
1da177e4
LT
2532}
2533
726c3342 2534static int selinux_sb_statfs(struct dentry *dentry)
1da177e4 2535{
88e67f3b 2536 const struct cred *cred = current_cred();
2bf49690 2537 struct common_audit_data ad;
1da177e4 2538
2bf49690 2539 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2540 ad.u.fs.path.dentry = dentry->d_sb->s_root;
88e67f3b 2541 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT
2542}
2543
828dfe1d 2544static int selinux_mount(char *dev_name,
b5266eb4 2545 struct path *path,
828dfe1d
EP
2546 char *type,
2547 unsigned long flags,
2548 void *data)
1da177e4 2549{
88e67f3b 2550 const struct cred *cred = current_cred();
1da177e4
LT
2551
2552 if (flags & MS_REMOUNT)
88e67f3b 2553 return superblock_has_perm(cred, path->mnt->mnt_sb,
828dfe1d 2554 FILESYSTEM__REMOUNT, NULL);
1da177e4 2555 else
88e67f3b 2556 return dentry_has_perm(cred, path->mnt, path->dentry,
828dfe1d 2557 FILE__MOUNTON);
1da177e4
LT
2558}
2559
2560static int selinux_umount(struct vfsmount *mnt, int flags)
2561{
88e67f3b 2562 const struct cred *cred = current_cred();
1da177e4 2563
88e67f3b 2564 return superblock_has_perm(cred, mnt->mnt_sb,
828dfe1d 2565 FILESYSTEM__UNMOUNT, NULL);
1da177e4
LT
2566}
2567
2568/* inode security operations */
2569
2570static int selinux_inode_alloc_security(struct inode *inode)
2571{
2572 return inode_alloc_security(inode);
2573}
2574
2575static void selinux_inode_free_security(struct inode *inode)
2576{
2577 inode_free_security(inode);
2578}
2579
5e41ff9e
SS
2580static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2581 char **name, void **value,
2582 size_t *len)
2583{
275bb41e
DH
2584 const struct cred *cred = current_cred();
2585 const struct task_security_struct *tsec = cred->security;
5e41ff9e
SS
2586 struct inode_security_struct *dsec;
2587 struct superblock_security_struct *sbsec;
275bb41e 2588 u32 sid, newsid, clen;
5e41ff9e 2589 int rc;
570bc1c2 2590 char *namep = NULL, *context;
5e41ff9e 2591
5e41ff9e
SS
2592 dsec = dir->i_security;
2593 sbsec = dir->i_sb->s_security;
5e41ff9e 2594
275bb41e
DH
2595 sid = tsec->sid;
2596 newsid = tsec->create_sid;
2597
cd89596f 2598 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
275bb41e 2599 rc = security_transition_sid(sid, dsec->sid,
5e41ff9e
SS
2600 inode_mode_to_security_class(inode->i_mode),
2601 &newsid);
2602 if (rc) {
2603 printk(KERN_WARNING "%s: "
2604 "security_transition_sid failed, rc=%d (dev=%s "
2605 "ino=%ld)\n",
dd6f953a 2606 __func__,
5e41ff9e
SS
2607 -rc, inode->i_sb->s_id, inode->i_ino);
2608 return rc;
2609 }
2610 }
2611
296fddf7 2612 /* Possibly defer initialization to selinux_complete_init. */
0d90a7ec 2613 if (sbsec->flags & SE_SBINITIALIZED) {
296fddf7
EP
2614 struct inode_security_struct *isec = inode->i_security;
2615 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2616 isec->sid = newsid;
2617 isec->initialized = 1;
2618 }
5e41ff9e 2619
cd89596f 2620 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
25a74f3b
SS
2621 return -EOPNOTSUPP;
2622
570bc1c2 2623 if (name) {
a02fe132 2624 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
570bc1c2
SS
2625 if (!namep)
2626 return -ENOMEM;
2627 *name = namep;
2628 }
5e41ff9e 2629
570bc1c2 2630 if (value && len) {
12b29f34 2631 rc = security_sid_to_context_force(newsid, &context, &clen);
570bc1c2
SS
2632 if (rc) {
2633 kfree(namep);
2634 return rc;
2635 }
2636 *value = context;
2637 *len = clen;
5e41ff9e 2638 }
5e41ff9e 2639
5e41ff9e
SS
2640 return 0;
2641}
2642
1da177e4
LT
2643static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2644{
2645 return may_create(dir, dentry, SECCLASS_FILE);
2646}
2647
1da177e4
LT
2648static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2649{
1da177e4
LT
2650 return may_link(dir, old_dentry, MAY_LINK);
2651}
2652
1da177e4
LT
2653static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2654{
1da177e4
LT
2655 return may_link(dir, dentry, MAY_UNLINK);
2656}
2657
2658static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2659{
2660 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2661}
2662
1da177e4
LT
2663static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2664{
2665 return may_create(dir, dentry, SECCLASS_DIR);
2666}
2667
1da177e4
LT
2668static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2669{
2670 return may_link(dir, dentry, MAY_RMDIR);
2671}
2672
2673static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2674{
1da177e4
LT
2675 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2676}
2677
1da177e4 2678static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
828dfe1d 2679 struct inode *new_inode, struct dentry *new_dentry)
1da177e4
LT
2680{
2681 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2682}
2683
1da177e4
LT
2684static int selinux_inode_readlink(struct dentry *dentry)
2685{
88e67f3b
DH
2686 const struct cred *cred = current_cred();
2687
2688 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
1da177e4
LT
2689}
2690
2691static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2692{
88e67f3b 2693 const struct cred *cred = current_cred();
1da177e4 2694
88e67f3b 2695 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
1da177e4
LT
2696}
2697
b77b0646 2698static int selinux_inode_permission(struct inode *inode, int mask)
1da177e4 2699{
88e67f3b 2700 const struct cred *cred = current_cred();
1da177e4
LT
2701
2702 if (!mask) {
2703 /* No permission to check. Existence test. */
2704 return 0;
2705 }
2706
88e67f3b 2707 return inode_has_perm(cred, inode,
8b6a5a37 2708 file_mask_to_av(inode->i_mode, mask), NULL);
1da177e4
LT
2709}
2710
2711static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2712{
88e67f3b 2713 const struct cred *cred = current_cred();
bc6a6008 2714 unsigned int ia_valid = iattr->ia_valid;
1da177e4 2715
bc6a6008
AW
2716 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2717 if (ia_valid & ATTR_FORCE) {
2718 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2719 ATTR_FORCE);
2720 if (!ia_valid)
2721 return 0;
2722 }
1da177e4 2723
bc6a6008
AW
2724 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2725 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
88e67f3b 2726 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
1da177e4 2727
88e67f3b 2728 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
1da177e4
LT
2729}
2730
2731static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2732{
88e67f3b
DH
2733 const struct cred *cred = current_cred();
2734
2735 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
1da177e4
LT
2736}
2737
8f0cfa52 2738static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
b5376771 2739{
88e67f3b
DH
2740 const struct cred *cred = current_cred();
2741
b5376771
SH
2742 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2743 sizeof XATTR_SECURITY_PREFIX - 1)) {
2744 if (!strcmp(name, XATTR_NAME_CAPS)) {
2745 if (!capable(CAP_SETFCAP))
2746 return -EPERM;
2747 } else if (!capable(CAP_SYS_ADMIN)) {
2748 /* A different attribute in the security namespace.
2749 Restrict to administrator. */
2750 return -EPERM;
2751 }
2752 }
2753
2754 /* Not an attribute we recognize, so just check the
2755 ordinary setattr permission. */
88e67f3b 2756 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
b5376771
SH
2757}
2758
8f0cfa52
DH
2759static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2760 const void *value, size_t size, int flags)
1da177e4 2761{
1da177e4
LT
2762 struct inode *inode = dentry->d_inode;
2763 struct inode_security_struct *isec = inode->i_security;
2764 struct superblock_security_struct *sbsec;
2bf49690 2765 struct common_audit_data ad;
275bb41e 2766 u32 newsid, sid = current_sid();
1da177e4
LT
2767 int rc = 0;
2768
b5376771
SH
2769 if (strcmp(name, XATTR_NAME_SELINUX))
2770 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2771
2772 sbsec = inode->i_sb->s_security;
cd89596f 2773 if (!(sbsec->flags & SE_SBLABELSUPP))
1da177e4
LT
2774 return -EOPNOTSUPP;
2775
3bd858ab 2776 if (!is_owner_or_cap(inode))
1da177e4
LT
2777 return -EPERM;
2778
2bf49690 2779 COMMON_AUDIT_DATA_INIT(&ad, FS);
44707fdf 2780 ad.u.fs.path.dentry = dentry;
1da177e4 2781
275bb41e 2782 rc = avc_has_perm(sid, isec->sid, isec->sclass,
1da177e4
LT
2783 FILE__RELABELFROM, &ad);
2784 if (rc)
2785 return rc;
2786
2787 rc = security_context_to_sid(value, size, &newsid);
12b29f34
SS
2788 if (rc == -EINVAL) {
2789 if (!capable(CAP_MAC_ADMIN))
2790 return rc;
2791 rc = security_context_to_sid_force(value, size, &newsid);
2792 }
1da177e4
LT
2793 if (rc)
2794 return rc;
2795
275bb41e 2796 rc = avc_has_perm(sid, newsid, isec->sclass,
1da177e4
LT
2797 FILE__RELABELTO, &ad);
2798 if (rc)
2799 return rc;
2800
275bb41e 2801 rc = security_validate_transition(isec->sid, newsid, sid,
828dfe1d 2802 isec->sclass);
1da177e4
LT
2803 if (rc)
2804 return rc;
2805
2806 return avc_has_perm(newsid,
2807 sbsec->sid,
2808 SECCLASS_FILESYSTEM,
2809 FILESYSTEM__ASSOCIATE,
2810 &ad);
2811}
2812
8f0cfa52 2813static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
f5269710 2814 const void *value, size_t size,
8f0cfa52 2815 int flags)
1da177e4
LT
2816{
2817 struct inode *inode = dentry->d_inode;
2818 struct inode_security_struct *isec = inode->i_security;
2819 u32 newsid;
2820 int rc;
2821
2822 if (strcmp(name, XATTR_NAME_SELINUX)) {
2823 /* Not an attribute we recognize, so nothing to do. */
2824 return;
2825 }
2826
12b29f34 2827 rc = security_context_to_sid_force(value, size, &newsid);
1da177e4 2828 if (rc) {
12b29f34
SS
2829 printk(KERN_ERR "SELinux: unable to map context to SID"
2830 "for (%s, %lu), rc=%d\n",
2831 inode->i_sb->s_id, inode->i_ino, -rc);
1da177e4
LT
2832 return;
2833 }
2834
2835 isec->sid = newsid;
2836 return;
2837}
2838
8f0cfa52 2839static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
1da177e4 2840{
88e67f3b
DH
2841 const struct cred *cred = current_cred();
2842
2843 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
1da177e4
LT
2844}
2845
828dfe1d 2846static int selinux_inode_listxattr(struct dentry *dentry)
1da177e4 2847{
88e67f3b
DH
2848 const struct cred *cred = current_cred();
2849
2850 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
1da177e4
LT
2851}
2852
8f0cfa52 2853static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
1da177e4 2854{
b5376771
SH
2855 if (strcmp(name, XATTR_NAME_SELINUX))
2856 return selinux_inode_setotherxattr(dentry, name);
1da177e4
LT
2857
2858 /* No one is allowed to remove a SELinux security label.
2859 You can change the label, but all data must be labeled. */
2860 return -EACCES;
2861}
2862
d381d8a9 2863/*
abc69bb6 2864 * Copy the inode security context value to the user.
d381d8a9
JM
2865 *
2866 * Permission check is handled by selinux_inode_getxattr hook.
2867 */
42492594 2868static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
1da177e4 2869{
42492594
DQ
2870 u32 size;
2871 int error;
2872 char *context = NULL;
1da177e4 2873 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2874
8c8570fb
DK
2875 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2876 return -EOPNOTSUPP;
d381d8a9 2877
abc69bb6
SS
2878 /*
2879 * If the caller has CAP_MAC_ADMIN, then get the raw context
2880 * value even if it is not defined by current policy; otherwise,
2881 * use the in-core value under current policy.
2882 * Use the non-auditing forms of the permission checks since
2883 * getxattr may be called by unprivileged processes commonly
2884 * and lack of permission just means that we fall back to the
2885 * in-core context value, not a denial.
2886 */
3699c53c
DH
2887 error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
2888 SECURITY_CAP_NOAUDIT);
abc69bb6
SS
2889 if (!error)
2890 error = security_sid_to_context_force(isec->sid, &context,
2891 &size);
2892 else
2893 error = security_sid_to_context(isec->sid, &context, &size);
42492594
DQ
2894 if (error)
2895 return error;
2896 error = size;
2897 if (alloc) {
2898 *buffer = context;
2899 goto out_nofree;
2900 }
2901 kfree(context);
2902out_nofree:
2903 return error;
1da177e4
LT
2904}
2905
2906static int selinux_inode_setsecurity(struct inode *inode, const char *name,
828dfe1d 2907 const void *value, size_t size, int flags)
1da177e4
LT
2908{
2909 struct inode_security_struct *isec = inode->i_security;
2910 u32 newsid;
2911 int rc;
2912
2913 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2914 return -EOPNOTSUPP;
2915
2916 if (!value || !size)
2917 return -EACCES;
2918
828dfe1d 2919 rc = security_context_to_sid((void *)value, size, &newsid);
1da177e4
LT
2920 if (rc)
2921 return rc;
2922
2923 isec->sid = newsid;
2924 return 0;
2925}
2926
2927static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2928{
2929 const int len = sizeof(XATTR_NAME_SELINUX);
2930 if (buffer && len <= buffer_size)
2931 memcpy(buffer, XATTR_NAME_SELINUX, len);
2932 return len;
2933}
2934
713a04ae
AD
2935static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2936{
2937 struct inode_security_struct *isec = inode->i_security;
2938 *secid = isec->sid;
2939}
2940
1da177e4
LT
2941/* file security operations */
2942
788e7dd4 2943static int selinux_revalidate_file_permission(struct file *file, int mask)
1da177e4 2944{
88e67f3b 2945 const struct cred *cred = current_cred();
3d5ff529 2946 struct inode *inode = file->f_path.dentry->d_inode;
1da177e4 2947
1da177e4
LT
2948 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2949 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2950 mask |= MAY_APPEND;
2951
389fb800
PM
2952 return file_has_perm(cred, file,
2953 file_mask_to_av(inode->i_mode, mask));
1da177e4
LT
2954}
2955
788e7dd4
YN
2956static int selinux_file_permission(struct file *file, int mask)
2957{
20dda18b
SS
2958 struct inode *inode = file->f_path.dentry->d_inode;
2959 struct file_security_struct *fsec = file->f_security;
2960 struct inode_security_struct *isec = inode->i_security;
2961 u32 sid = current_sid();
2962
389fb800 2963 if (!mask)
788e7dd4
YN
2964 /* No permission to check. Existence test. */
2965 return 0;
788e7dd4 2966
20dda18b
SS
2967 if (sid == fsec->sid && fsec->isid == isec->sid &&
2968 fsec->pseqno == avc_policy_seqno())
2969 /* No change since dentry_open check. */
2970 return 0;
2971
788e7dd4
YN
2972 return selinux_revalidate_file_permission(file, mask);
2973}
2974
1da177e4
LT
2975static int selinux_file_alloc_security(struct file *file)
2976{
2977 return file_alloc_security(file);
2978}
2979
2980static void selinux_file_free_security(struct file *file)
2981{
2982 file_free_security(file);
2983}
2984
2985static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2986 unsigned long arg)
2987{
88e67f3b 2988 const struct cred *cred = current_cred();
242631c4 2989 u32 av = 0;
1da177e4 2990
242631c4
SS
2991 if (_IOC_DIR(cmd) & _IOC_WRITE)
2992 av |= FILE__WRITE;
2993 if (_IOC_DIR(cmd) & _IOC_READ)
2994 av |= FILE__READ;
2995 if (!av)
2996 av = FILE__IOCTL;
1da177e4 2997
88e67f3b 2998 return file_has_perm(cred, file, av);
1da177e4
LT
2999}
3000
3001static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3002{
88e67f3b 3003 const struct cred *cred = current_cred();
d84f4f99 3004 int rc = 0;
88e67f3b 3005
1da177e4
LT
3006#ifndef CONFIG_PPC32
3007 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3008 /*
3009 * We are making executable an anonymous mapping or a
3010 * private file mapping that will also be writable.
3011 * This has an additional check.
3012 */
d84f4f99 3013 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
1da177e4 3014 if (rc)
d84f4f99 3015 goto error;
1da177e4
LT
3016 }
3017#endif
3018
3019 if (file) {
3020 /* read access is always possible with a mapping */
3021 u32 av = FILE__READ;
3022
3023 /* write access only matters if the mapping is shared */
3024 if (shared && (prot & PROT_WRITE))
3025 av |= FILE__WRITE;
3026
3027 if (prot & PROT_EXEC)
3028 av |= FILE__EXECUTE;
3029
88e67f3b 3030 return file_has_perm(cred, file, av);
1da177e4 3031 }
d84f4f99
DH
3032
3033error:
3034 return rc;
1da177e4
LT
3035}
3036
3037static int selinux_file_mmap(struct file *file, unsigned long reqprot,
ed032189
EP
3038 unsigned long prot, unsigned long flags,
3039 unsigned long addr, unsigned long addr_only)
1da177e4 3040{
ed032189 3041 int rc = 0;
275bb41e 3042 u32 sid = current_sid();
1da177e4 3043
84336d1a
EP
3044 /*
3045 * notice that we are intentionally putting the SELinux check before
3046 * the secondary cap_file_mmap check. This is such a likely attempt
3047 * at bad behaviour/exploit that we always want to get the AVC, even
3048 * if DAC would have also denied the operation.
3049 */
a2551df7 3050 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
ed032189
EP
3051 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3052 MEMPROTECT__MMAP_ZERO, NULL);
84336d1a
EP
3053 if (rc)
3054 return rc;
3055 }
3056
3057 /* do DAC check on address space usage */
3058 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
ed032189 3059 if (rc || addr_only)
1da177e4
LT
3060 return rc;
3061
3062 if (selinux_checkreqprot)
3063 prot = reqprot;
3064
3065 return file_map_prot_check(file, prot,
3066 (flags & MAP_TYPE) == MAP_SHARED);
3067}
3068
3069static int selinux_file_mprotect(struct vm_area_struct *vma,
3070 unsigned long reqprot,
3071 unsigned long prot)
3072{
88e67f3b 3073 const struct cred *cred = current_cred();
1da177e4
LT
3074
3075 if (selinux_checkreqprot)
3076 prot = reqprot;
3077
3078#ifndef CONFIG_PPC32
db4c9641 3079 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
d541bbee 3080 int rc = 0;
db4c9641
SS
3081 if (vma->vm_start >= vma->vm_mm->start_brk &&
3082 vma->vm_end <= vma->vm_mm->brk) {
d84f4f99 3083 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
db4c9641
SS
3084 } else if (!vma->vm_file &&
3085 vma->vm_start <= vma->vm_mm->start_stack &&
3086 vma->vm_end >= vma->vm_mm->start_stack) {
3b11a1de 3087 rc = current_has_perm(current, PROCESS__EXECSTACK);
db4c9641
SS
3088 } else if (vma->vm_file && vma->anon_vma) {
3089 /*
3090 * We are making executable a file mapping that has
3091 * had some COW done. Since pages might have been
3092 * written, check ability to execute the possibly
3093 * modified content. This typically should only
3094 * occur for text relocations.
3095 */
d84f4f99 3096 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
db4c9641 3097 }