]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-jammy-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
[PATCH] SELinux: decouple fscontext/context mount options
[mirror_ubuntu-jammy-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21 #include <linux/module.h>
22 #include <linux/init.h>
23 #include <linux/kernel.h>
24 #include <linux/ptrace.h>
25 #include <linux/errno.h>
26 #include <linux/sched.h>
27 #include <linux/security.h>
28 #include <linux/xattr.h>
29 #include <linux/capability.h>
30 #include <linux/unistd.h>
31 #include <linux/mm.h>
32 #include <linux/mman.h>
33 #include <linux/slab.h>
34 #include <linux/pagemap.h>
35 #include <linux/swap.h>
36 #include <linux/smp_lock.h>
37 #include <linux/spinlock.h>
38 #include <linux/syscalls.h>
39 #include <linux/file.h>
40 #include <linux/namei.h>
41 #include <linux/mount.h>
42 #include <linux/ext2_fs.h>
43 #include <linux/proc_fs.h>
44 #include <linux/kd.h>
45 #include <linux/netfilter_ipv4.h>
46 #include <linux/netfilter_ipv6.h>
47 #include <linux/tty.h>
48 #include <net/icmp.h>
49 #include <net/ip.h> /* for sysctl_local_port_range[] */
50 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
51 #include <asm/uaccess.h>
52 #include <asm/semaphore.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/quota.h>
61 #include <linux/un.h> /* for Unix socket types */
62 #include <net/af_unix.h> /* for Unix socket types */
63 #include <linux/parser.h>
64 #include <linux/nfs_mount.h>
65 #include <net/ipv6.h>
66 #include <linux/hugetlb.h>
67 #include <linux/personality.h>
68 #include <linux/sysctl.h>
69 #include <linux/audit.h>
70 #include <linux/string.h>
71 #include <linux/selinux.h>
72
73 #include "avc.h"
74 #include "objsec.h"
75 #include "netif.h"
76 #include "xfrm.h"
77
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
84
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
87
88 static int __init enforcing_setup(char *str)
89 {
90 selinux_enforcing = simple_strtol(str,NULL,0);
91 return 1;
92 }
93 __setup("enforcing=", enforcing_setup);
94 #endif
95
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
98
99 static int __init selinux_enabled_setup(char *str)
100 {
101 selinux_enabled = simple_strtol(str, NULL, 0);
102 return 1;
103 }
104 __setup("selinux=", selinux_enabled_setup);
105 #else
106 int selinux_enabled = 1;
107 #endif
108
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
111
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
117
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
122
123 static kmem_cache_t *sel_inode_cache;
124
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
128 {
129 char *context;
130 unsigned len;
131 int rc;
132
133 rc = security_sid_to_context(sid, &context, &len);
134 if (rc)
135 return rc;
136
137 if (!buffer || !size)
138 goto getsecurity_exit;
139
140 if (size < len) {
141 len = -ERANGE;
142 goto getsecurity_exit;
143 }
144 memcpy(buffer, context, len);
145
146 getsecurity_exit:
147 kfree(context);
148 return len;
149 }
150
151 /* Allocate and free functions for each kind of security blob. */
152
153 static int task_alloc_security(struct task_struct *task)
154 {
155 struct task_security_struct *tsec;
156
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
158 if (!tsec)
159 return -ENOMEM;
160
161 tsec->task = task;
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
164
165 return 0;
166 }
167
168 static void task_free_security(struct task_struct *task)
169 {
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
172 kfree(tsec);
173 }
174
175 static int inode_alloc_security(struct inode *inode)
176 {
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
179
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
181 if (!isec)
182 return -ENOMEM;
183
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
187 isec->inode = inode;
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
192
193 return 0;
194 }
195
196 static void inode_free_security(struct inode *inode)
197 {
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
200
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
205
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
208 }
209
210 static int file_alloc_security(struct file *file)
211 {
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
214
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
216 if (!fsec)
217 return -ENOMEM;
218
219 fsec->file = file;
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
223
224 return 0;
225 }
226
227 static void file_free_security(struct file *file)
228 {
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
231 kfree(fsec);
232 }
233
234 static int superblock_alloc_security(struct super_block *sb)
235 {
236 struct superblock_security_struct *sbsec;
237
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
239 if (!sbsec)
240 return -ENOMEM;
241
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
246 sbsec->sb = sb;
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
250 sb->s_security = sbsec;
251
252 return 0;
253 }
254
255 static void superblock_free_security(struct super_block *sb)
256 {
257 struct superblock_security_struct *sbsec = sb->s_security;
258
259 spin_lock(&sb_security_lock);
260 if (!list_empty(&sbsec->list))
261 list_del_init(&sbsec->list);
262 spin_unlock(&sb_security_lock);
263
264 sb->s_security = NULL;
265 kfree(sbsec);
266 }
267
268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
269 {
270 struct sk_security_struct *ssec;
271
272 if (family != PF_UNIX)
273 return 0;
274
275 ssec = kzalloc(sizeof(*ssec), priority);
276 if (!ssec)
277 return -ENOMEM;
278
279 ssec->sk = sk;
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
282
283 return 0;
284 }
285
286 static void sk_free_security(struct sock *sk)
287 {
288 struct sk_security_struct *ssec = sk->sk_security;
289
290 if (sk->sk_family != PF_UNIX)
291 return;
292
293 sk->sk_security = NULL;
294 kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
323 };
324
325 static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
329 };
330
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
332
333 static int may_context_mount_sb_relabel(u32 sid,
334 struct superblock_security_struct *sbsec,
335 struct task_security_struct *tsec)
336 {
337 int rc;
338
339 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
340 FILESYSTEM__RELABELFROM, NULL);
341 if (rc)
342 return rc;
343
344 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
345 FILESYSTEM__RELABELTO, NULL);
346 return rc;
347 }
348
349 static int try_context_mount(struct super_block *sb, void *data)
350 {
351 char *context = NULL, *defcontext = NULL;
352 char *fscontext = NULL;
353 const char *name;
354 u32 sid;
355 int alloc = 0, rc = 0, seen = 0;
356 struct task_security_struct *tsec = current->security;
357 struct superblock_security_struct *sbsec = sb->s_security;
358
359 if (!data)
360 goto out;
361
362 name = sb->s_type->name;
363
364 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
365
366 /* NFS we understand. */
367 if (!strcmp(name, "nfs")) {
368 struct nfs_mount_data *d = data;
369
370 if (d->version < NFS_MOUNT_VERSION)
371 goto out;
372
373 if (d->context[0]) {
374 context = d->context;
375 seen |= Opt_context;
376 }
377 } else
378 goto out;
379
380 } else {
381 /* Standard string-based options. */
382 char *p, *options = data;
383
384 while ((p = strsep(&options, ",")) != NULL) {
385 int token;
386 substring_t args[MAX_OPT_ARGS];
387
388 if (!*p)
389 continue;
390
391 token = match_token(p, tokens, args);
392
393 switch (token) {
394 case Opt_context:
395 if (seen & (Opt_context|Opt_defcontext)) {
396 rc = -EINVAL;
397 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
398 goto out_free;
399 }
400 context = match_strdup(&args[0]);
401 if (!context) {
402 rc = -ENOMEM;
403 goto out_free;
404 }
405 if (!alloc)
406 alloc = 1;
407 seen |= Opt_context;
408 break;
409
410 case Opt_fscontext:
411 if (seen & Opt_fscontext) {
412 rc = -EINVAL;
413 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
414 goto out_free;
415 }
416 fscontext = match_strdup(&args[0]);
417 if (!fscontext) {
418 rc = -ENOMEM;
419 goto out_free;
420 }
421 if (!alloc)
422 alloc = 1;
423 seen |= Opt_fscontext;
424 break;
425
426 case Opt_defcontext:
427 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
428 rc = -EINVAL;
429 printk(KERN_WARNING "SELinux: "
430 "defcontext option is invalid "
431 "for this filesystem type\n");
432 goto out_free;
433 }
434 if (seen & (Opt_context|Opt_defcontext)) {
435 rc = -EINVAL;
436 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
437 goto out_free;
438 }
439 defcontext = match_strdup(&args[0]);
440 if (!defcontext) {
441 rc = -ENOMEM;
442 goto out_free;
443 }
444 if (!alloc)
445 alloc = 1;
446 seen |= Opt_defcontext;
447 break;
448
449 default:
450 rc = -EINVAL;
451 printk(KERN_WARNING "SELinux: unknown mount "
452 "option\n");
453 goto out_free;
454
455 }
456 }
457 }
458
459 if (!seen)
460 goto out;
461
462 /* sets the context of the superblock for the fs being mounted. */
463 if (fscontext) {
464 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
465 if (rc) {
466 printk(KERN_WARNING "SELinux: security_context_to_sid"
467 "(%s) failed for (dev %s, type %s) errno=%d\n",
468 fscontext, sb->s_id, name, rc);
469 goto out_free;
470 }
471
472 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
473 if (rc)
474 goto out_free;
475
476 sbsec->sid = sid;
477 }
478
479 /*
480 * Switch to using mount point labeling behavior.
481 * sets the label used on all file below the mountpoint, and will set
482 * the superblock context if not already set.
483 */
484 if (context) {
485 rc = security_context_to_sid(context, strlen(context), &sid);
486 if (rc) {
487 printk(KERN_WARNING "SELinux: security_context_to_sid"
488 "(%s) failed for (dev %s, type %s) errno=%d\n",
489 context, sb->s_id, name, rc);
490 goto out_free;
491 }
492
493 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
494 if (rc)
495 goto out_free;
496
497 if (!fscontext)
498 sbsec->sid = sid;
499 sbsec->mntpoint_sid = sid;
500
501 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
502 }
503
504 if (defcontext) {
505 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
506 if (rc) {
507 printk(KERN_WARNING "SELinux: security_context_to_sid"
508 "(%s) failed for (dev %s, type %s) errno=%d\n",
509 defcontext, sb->s_id, name, rc);
510 goto out_free;
511 }
512
513 if (sid == sbsec->def_sid)
514 goto out_free;
515
516 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
517 FILESYSTEM__RELABELFROM, NULL);
518 if (rc)
519 goto out_free;
520
521 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
522 FILESYSTEM__ASSOCIATE, NULL);
523 if (rc)
524 goto out_free;
525
526 sbsec->def_sid = sid;
527 }
528
529 out_free:
530 if (alloc) {
531 kfree(context);
532 kfree(defcontext);
533 kfree(fscontext);
534 }
535 out:
536 return rc;
537 }
538
539 static int superblock_doinit(struct super_block *sb, void *data)
540 {
541 struct superblock_security_struct *sbsec = sb->s_security;
542 struct dentry *root = sb->s_root;
543 struct inode *inode = root->d_inode;
544 int rc = 0;
545
546 down(&sbsec->sem);
547 if (sbsec->initialized)
548 goto out;
549
550 if (!ss_initialized) {
551 /* Defer initialization until selinux_complete_init,
552 after the initial policy is loaded and the security
553 server is ready to handle calls. */
554 spin_lock(&sb_security_lock);
555 if (list_empty(&sbsec->list))
556 list_add(&sbsec->list, &superblock_security_head);
557 spin_unlock(&sb_security_lock);
558 goto out;
559 }
560
561 /* Determine the labeling behavior to use for this filesystem type. */
562 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
563 if (rc) {
564 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
565 __FUNCTION__, sb->s_type->name, rc);
566 goto out;
567 }
568
569 rc = try_context_mount(sb, data);
570 if (rc)
571 goto out;
572
573 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
574 /* Make sure that the xattr handler exists and that no
575 error other than -ENODATA is returned by getxattr on
576 the root directory. -ENODATA is ok, as this may be
577 the first boot of the SELinux kernel before we have
578 assigned xattr values to the filesystem. */
579 if (!inode->i_op->getxattr) {
580 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
581 "xattr support\n", sb->s_id, sb->s_type->name);
582 rc = -EOPNOTSUPP;
583 goto out;
584 }
585 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
586 if (rc < 0 && rc != -ENODATA) {
587 if (rc == -EOPNOTSUPP)
588 printk(KERN_WARNING "SELinux: (dev %s, type "
589 "%s) has no security xattr handler\n",
590 sb->s_id, sb->s_type->name);
591 else
592 printk(KERN_WARNING "SELinux: (dev %s, type "
593 "%s) getxattr errno %d\n", sb->s_id,
594 sb->s_type->name, -rc);
595 goto out;
596 }
597 }
598
599 if (strcmp(sb->s_type->name, "proc") == 0)
600 sbsec->proc = 1;
601
602 sbsec->initialized = 1;
603
604 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
605 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
606 sb->s_id, sb->s_type->name);
607 }
608 else {
609 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
610 sb->s_id, sb->s_type->name,
611 labeling_behaviors[sbsec->behavior-1]);
612 }
613
614 /* Initialize the root inode. */
615 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
616
617 /* Initialize any other inodes associated with the superblock, e.g.
618 inodes created prior to initial policy load or inodes created
619 during get_sb by a pseudo filesystem that directly
620 populates itself. */
621 spin_lock(&sbsec->isec_lock);
622 next_inode:
623 if (!list_empty(&sbsec->isec_head)) {
624 struct inode_security_struct *isec =
625 list_entry(sbsec->isec_head.next,
626 struct inode_security_struct, list);
627 struct inode *inode = isec->inode;
628 spin_unlock(&sbsec->isec_lock);
629 inode = igrab(inode);
630 if (inode) {
631 if (!IS_PRIVATE (inode))
632 inode_doinit(inode);
633 iput(inode);
634 }
635 spin_lock(&sbsec->isec_lock);
636 list_del_init(&isec->list);
637 goto next_inode;
638 }
639 spin_unlock(&sbsec->isec_lock);
640 out:
641 up(&sbsec->sem);
642 return rc;
643 }
644
645 static inline u16 inode_mode_to_security_class(umode_t mode)
646 {
647 switch (mode & S_IFMT) {
648 case S_IFSOCK:
649 return SECCLASS_SOCK_FILE;
650 case S_IFLNK:
651 return SECCLASS_LNK_FILE;
652 case S_IFREG:
653 return SECCLASS_FILE;
654 case S_IFBLK:
655 return SECCLASS_BLK_FILE;
656 case S_IFDIR:
657 return SECCLASS_DIR;
658 case S_IFCHR:
659 return SECCLASS_CHR_FILE;
660 case S_IFIFO:
661 return SECCLASS_FIFO_FILE;
662
663 }
664
665 return SECCLASS_FILE;
666 }
667
668 static inline int default_protocol_stream(int protocol)
669 {
670 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
671 }
672
673 static inline int default_protocol_dgram(int protocol)
674 {
675 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
676 }
677
678 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
679 {
680 switch (family) {
681 case PF_UNIX:
682 switch (type) {
683 case SOCK_STREAM:
684 case SOCK_SEQPACKET:
685 return SECCLASS_UNIX_STREAM_SOCKET;
686 case SOCK_DGRAM:
687 return SECCLASS_UNIX_DGRAM_SOCKET;
688 }
689 break;
690 case PF_INET:
691 case PF_INET6:
692 switch (type) {
693 case SOCK_STREAM:
694 if (default_protocol_stream(protocol))
695 return SECCLASS_TCP_SOCKET;
696 else
697 return SECCLASS_RAWIP_SOCKET;
698 case SOCK_DGRAM:
699 if (default_protocol_dgram(protocol))
700 return SECCLASS_UDP_SOCKET;
701 else
702 return SECCLASS_RAWIP_SOCKET;
703 default:
704 return SECCLASS_RAWIP_SOCKET;
705 }
706 break;
707 case PF_NETLINK:
708 switch (protocol) {
709 case NETLINK_ROUTE:
710 return SECCLASS_NETLINK_ROUTE_SOCKET;
711 case NETLINK_FIREWALL:
712 return SECCLASS_NETLINK_FIREWALL_SOCKET;
713 case NETLINK_INET_DIAG:
714 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
715 case NETLINK_NFLOG:
716 return SECCLASS_NETLINK_NFLOG_SOCKET;
717 case NETLINK_XFRM:
718 return SECCLASS_NETLINK_XFRM_SOCKET;
719 case NETLINK_SELINUX:
720 return SECCLASS_NETLINK_SELINUX_SOCKET;
721 case NETLINK_AUDIT:
722 return SECCLASS_NETLINK_AUDIT_SOCKET;
723 case NETLINK_IP6_FW:
724 return SECCLASS_NETLINK_IP6FW_SOCKET;
725 case NETLINK_DNRTMSG:
726 return SECCLASS_NETLINK_DNRT_SOCKET;
727 case NETLINK_KOBJECT_UEVENT:
728 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
729 default:
730 return SECCLASS_NETLINK_SOCKET;
731 }
732 case PF_PACKET:
733 return SECCLASS_PACKET_SOCKET;
734 case PF_KEY:
735 return SECCLASS_KEY_SOCKET;
736 case PF_APPLETALK:
737 return SECCLASS_APPLETALK_SOCKET;
738 }
739
740 return SECCLASS_SOCKET;
741 }
742
743 #ifdef CONFIG_PROC_FS
744 static int selinux_proc_get_sid(struct proc_dir_entry *de,
745 u16 tclass,
746 u32 *sid)
747 {
748 int buflen, rc;
749 char *buffer, *path, *end;
750
751 buffer = (char*)__get_free_page(GFP_KERNEL);
752 if (!buffer)
753 return -ENOMEM;
754
755 buflen = PAGE_SIZE;
756 end = buffer+buflen;
757 *--end = '\0';
758 buflen--;
759 path = end-1;
760 *path = '/';
761 while (de && de != de->parent) {
762 buflen -= de->namelen + 1;
763 if (buflen < 0)
764 break;
765 end -= de->namelen;
766 memcpy(end, de->name, de->namelen);
767 *--end = '/';
768 path = end;
769 de = de->parent;
770 }
771 rc = security_genfs_sid("proc", path, tclass, sid);
772 free_page((unsigned long)buffer);
773 return rc;
774 }
775 #else
776 static int selinux_proc_get_sid(struct proc_dir_entry *de,
777 u16 tclass,
778 u32 *sid)
779 {
780 return -EINVAL;
781 }
782 #endif
783
784 /* The inode's security attributes must be initialized before first use. */
785 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
786 {
787 struct superblock_security_struct *sbsec = NULL;
788 struct inode_security_struct *isec = inode->i_security;
789 u32 sid;
790 struct dentry *dentry;
791 #define INITCONTEXTLEN 255
792 char *context = NULL;
793 unsigned len = 0;
794 int rc = 0;
795 int hold_sem = 0;
796
797 if (isec->initialized)
798 goto out;
799
800 down(&isec->sem);
801 hold_sem = 1;
802 if (isec->initialized)
803 goto out;
804
805 sbsec = inode->i_sb->s_security;
806 if (!sbsec->initialized) {
807 /* Defer initialization until selinux_complete_init,
808 after the initial policy is loaded and the security
809 server is ready to handle calls. */
810 spin_lock(&sbsec->isec_lock);
811 if (list_empty(&isec->list))
812 list_add(&isec->list, &sbsec->isec_head);
813 spin_unlock(&sbsec->isec_lock);
814 goto out;
815 }
816
817 switch (sbsec->behavior) {
818 case SECURITY_FS_USE_XATTR:
819 if (!inode->i_op->getxattr) {
820 isec->sid = sbsec->def_sid;
821 break;
822 }
823
824 /* Need a dentry, since the xattr API requires one.
825 Life would be simpler if we could just pass the inode. */
826 if (opt_dentry) {
827 /* Called from d_instantiate or d_splice_alias. */
828 dentry = dget(opt_dentry);
829 } else {
830 /* Called from selinux_complete_init, try to find a dentry. */
831 dentry = d_find_alias(inode);
832 }
833 if (!dentry) {
834 printk(KERN_WARNING "%s: no dentry for dev=%s "
835 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
836 inode->i_ino);
837 goto out;
838 }
839
840 len = INITCONTEXTLEN;
841 context = kmalloc(len, GFP_KERNEL);
842 if (!context) {
843 rc = -ENOMEM;
844 dput(dentry);
845 goto out;
846 }
847 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
848 context, len);
849 if (rc == -ERANGE) {
850 /* Need a larger buffer. Query for the right size. */
851 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
852 NULL, 0);
853 if (rc < 0) {
854 dput(dentry);
855 goto out;
856 }
857 kfree(context);
858 len = rc;
859 context = kmalloc(len, GFP_KERNEL);
860 if (!context) {
861 rc = -ENOMEM;
862 dput(dentry);
863 goto out;
864 }
865 rc = inode->i_op->getxattr(dentry,
866 XATTR_NAME_SELINUX,
867 context, len);
868 }
869 dput(dentry);
870 if (rc < 0) {
871 if (rc != -ENODATA) {
872 printk(KERN_WARNING "%s: getxattr returned "
873 "%d for dev=%s ino=%ld\n", __FUNCTION__,
874 -rc, inode->i_sb->s_id, inode->i_ino);
875 kfree(context);
876 goto out;
877 }
878 /* Map ENODATA to the default file SID */
879 sid = sbsec->def_sid;
880 rc = 0;
881 } else {
882 rc = security_context_to_sid_default(context, rc, &sid,
883 sbsec->def_sid);
884 if (rc) {
885 printk(KERN_WARNING "%s: context_to_sid(%s) "
886 "returned %d for dev=%s ino=%ld\n",
887 __FUNCTION__, context, -rc,
888 inode->i_sb->s_id, inode->i_ino);
889 kfree(context);
890 /* Leave with the unlabeled SID */
891 rc = 0;
892 break;
893 }
894 }
895 kfree(context);
896 isec->sid = sid;
897 break;
898 case SECURITY_FS_USE_TASK:
899 isec->sid = isec->task_sid;
900 break;
901 case SECURITY_FS_USE_TRANS:
902 /* Default to the fs SID. */
903 isec->sid = sbsec->sid;
904
905 /* Try to obtain a transition SID. */
906 isec->sclass = inode_mode_to_security_class(inode->i_mode);
907 rc = security_transition_sid(isec->task_sid,
908 sbsec->sid,
909 isec->sclass,
910 &sid);
911 if (rc)
912 goto out;
913 isec->sid = sid;
914 break;
915 case SECURITY_FS_USE_MNTPOINT:
916 isec->sid = sbsec->mntpoint_sid;
917 break;
918 default:
919 /* Default to the fs superblock SID. */
920 isec->sid = sbsec->sid;
921
922 if (sbsec->proc) {
923 struct proc_inode *proci = PROC_I(inode);
924 if (proci->pde) {
925 isec->sclass = inode_mode_to_security_class(inode->i_mode);
926 rc = selinux_proc_get_sid(proci->pde,
927 isec->sclass,
928 &sid);
929 if (rc)
930 goto out;
931 isec->sid = sid;
932 }
933 }
934 break;
935 }
936
937 isec->initialized = 1;
938
939 out:
940 if (isec->sclass == SECCLASS_FILE)
941 isec->sclass = inode_mode_to_security_class(inode->i_mode);
942
943 if (hold_sem)
944 up(&isec->sem);
945 return rc;
946 }
947
948 /* Convert a Linux signal to an access vector. */
949 static inline u32 signal_to_av(int sig)
950 {
951 u32 perm = 0;
952
953 switch (sig) {
954 case SIGCHLD:
955 /* Commonly granted from child to parent. */
956 perm = PROCESS__SIGCHLD;
957 break;
958 case SIGKILL:
959 /* Cannot be caught or ignored */
960 perm = PROCESS__SIGKILL;
961 break;
962 case SIGSTOP:
963 /* Cannot be caught or ignored */
964 perm = PROCESS__SIGSTOP;
965 break;
966 default:
967 /* All other signals. */
968 perm = PROCESS__SIGNAL;
969 break;
970 }
971
972 return perm;
973 }
974
975 /* Check permission betweeen a pair of tasks, e.g. signal checks,
976 fork check, ptrace check, etc. */
977 static int task_has_perm(struct task_struct *tsk1,
978 struct task_struct *tsk2,
979 u32 perms)
980 {
981 struct task_security_struct *tsec1, *tsec2;
982
983 tsec1 = tsk1->security;
984 tsec2 = tsk2->security;
985 return avc_has_perm(tsec1->sid, tsec2->sid,
986 SECCLASS_PROCESS, perms, NULL);
987 }
988
989 /* Check whether a task is allowed to use a capability. */
990 static int task_has_capability(struct task_struct *tsk,
991 int cap)
992 {
993 struct task_security_struct *tsec;
994 struct avc_audit_data ad;
995
996 tsec = tsk->security;
997
998 AVC_AUDIT_DATA_INIT(&ad,CAP);
999 ad.tsk = tsk;
1000 ad.u.cap = cap;
1001
1002 return avc_has_perm(tsec->sid, tsec->sid,
1003 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1004 }
1005
1006 /* Check whether a task is allowed to use a system operation. */
1007 static int task_has_system(struct task_struct *tsk,
1008 u32 perms)
1009 {
1010 struct task_security_struct *tsec;
1011
1012 tsec = tsk->security;
1013
1014 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1015 SECCLASS_SYSTEM, perms, NULL);
1016 }
1017
1018 /* Check whether a task has a particular permission to an inode.
1019 The 'adp' parameter is optional and allows other audit
1020 data to be passed (e.g. the dentry). */
1021 static int inode_has_perm(struct task_struct *tsk,
1022 struct inode *inode,
1023 u32 perms,
1024 struct avc_audit_data *adp)
1025 {
1026 struct task_security_struct *tsec;
1027 struct inode_security_struct *isec;
1028 struct avc_audit_data ad;
1029
1030 tsec = tsk->security;
1031 isec = inode->i_security;
1032
1033 if (!adp) {
1034 adp = &ad;
1035 AVC_AUDIT_DATA_INIT(&ad, FS);
1036 ad.u.fs.inode = inode;
1037 }
1038
1039 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1040 }
1041
1042 /* Same as inode_has_perm, but pass explicit audit data containing
1043 the dentry to help the auditing code to more easily generate the
1044 pathname if needed. */
1045 static inline int dentry_has_perm(struct task_struct *tsk,
1046 struct vfsmount *mnt,
1047 struct dentry *dentry,
1048 u32 av)
1049 {
1050 struct inode *inode = dentry->d_inode;
1051 struct avc_audit_data ad;
1052 AVC_AUDIT_DATA_INIT(&ad,FS);
1053 ad.u.fs.mnt = mnt;
1054 ad.u.fs.dentry = dentry;
1055 return inode_has_perm(tsk, inode, av, &ad);
1056 }
1057
1058 /* Check whether a task can use an open file descriptor to
1059 access an inode in a given way. Check access to the
1060 descriptor itself, and then use dentry_has_perm to
1061 check a particular permission to the file.
1062 Access to the descriptor is implicitly granted if it
1063 has the same SID as the process. If av is zero, then
1064 access to the file is not checked, e.g. for cases
1065 where only the descriptor is affected like seek. */
1066 static int file_has_perm(struct task_struct *tsk,
1067 struct file *file,
1068 u32 av)
1069 {
1070 struct task_security_struct *tsec = tsk->security;
1071 struct file_security_struct *fsec = file->f_security;
1072 struct vfsmount *mnt = file->f_vfsmnt;
1073 struct dentry *dentry = file->f_dentry;
1074 struct inode *inode = dentry->d_inode;
1075 struct avc_audit_data ad;
1076 int rc;
1077
1078 AVC_AUDIT_DATA_INIT(&ad, FS);
1079 ad.u.fs.mnt = mnt;
1080 ad.u.fs.dentry = dentry;
1081
1082 if (tsec->sid != fsec->sid) {
1083 rc = avc_has_perm(tsec->sid, fsec->sid,
1084 SECCLASS_FD,
1085 FD__USE,
1086 &ad);
1087 if (rc)
1088 return rc;
1089 }
1090
1091 /* av is zero if only checking access to the descriptor. */
1092 if (av)
1093 return inode_has_perm(tsk, inode, av, &ad);
1094
1095 return 0;
1096 }
1097
1098 /* Check whether a task can create a file. */
1099 static int may_create(struct inode *dir,
1100 struct dentry *dentry,
1101 u16 tclass)
1102 {
1103 struct task_security_struct *tsec;
1104 struct inode_security_struct *dsec;
1105 struct superblock_security_struct *sbsec;
1106 u32 newsid;
1107 struct avc_audit_data ad;
1108 int rc;
1109
1110 tsec = current->security;
1111 dsec = dir->i_security;
1112 sbsec = dir->i_sb->s_security;
1113
1114 AVC_AUDIT_DATA_INIT(&ad, FS);
1115 ad.u.fs.dentry = dentry;
1116
1117 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1118 DIR__ADD_NAME | DIR__SEARCH,
1119 &ad);
1120 if (rc)
1121 return rc;
1122
1123 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1124 newsid = tsec->create_sid;
1125 } else {
1126 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1127 &newsid);
1128 if (rc)
1129 return rc;
1130 }
1131
1132 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1133 if (rc)
1134 return rc;
1135
1136 return avc_has_perm(newsid, sbsec->sid,
1137 SECCLASS_FILESYSTEM,
1138 FILESYSTEM__ASSOCIATE, &ad);
1139 }
1140
1141 /* Check whether a task can create a key. */
1142 static int may_create_key(u32 ksid,
1143 struct task_struct *ctx)
1144 {
1145 struct task_security_struct *tsec;
1146
1147 tsec = ctx->security;
1148
1149 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1150 }
1151
1152 #define MAY_LINK 0
1153 #define MAY_UNLINK 1
1154 #define MAY_RMDIR 2
1155
1156 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1157 static int may_link(struct inode *dir,
1158 struct dentry *dentry,
1159 int kind)
1160
1161 {
1162 struct task_security_struct *tsec;
1163 struct inode_security_struct *dsec, *isec;
1164 struct avc_audit_data ad;
1165 u32 av;
1166 int rc;
1167
1168 tsec = current->security;
1169 dsec = dir->i_security;
1170 isec = dentry->d_inode->i_security;
1171
1172 AVC_AUDIT_DATA_INIT(&ad, FS);
1173 ad.u.fs.dentry = dentry;
1174
1175 av = DIR__SEARCH;
1176 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1177 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1178 if (rc)
1179 return rc;
1180
1181 switch (kind) {
1182 case MAY_LINK:
1183 av = FILE__LINK;
1184 break;
1185 case MAY_UNLINK:
1186 av = FILE__UNLINK;
1187 break;
1188 case MAY_RMDIR:
1189 av = DIR__RMDIR;
1190 break;
1191 default:
1192 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1193 return 0;
1194 }
1195
1196 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1197 return rc;
1198 }
1199
1200 static inline int may_rename(struct inode *old_dir,
1201 struct dentry *old_dentry,
1202 struct inode *new_dir,
1203 struct dentry *new_dentry)
1204 {
1205 struct task_security_struct *tsec;
1206 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1207 struct avc_audit_data ad;
1208 u32 av;
1209 int old_is_dir, new_is_dir;
1210 int rc;
1211
1212 tsec = current->security;
1213 old_dsec = old_dir->i_security;
1214 old_isec = old_dentry->d_inode->i_security;
1215 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1216 new_dsec = new_dir->i_security;
1217
1218 AVC_AUDIT_DATA_INIT(&ad, FS);
1219
1220 ad.u.fs.dentry = old_dentry;
1221 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1222 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1223 if (rc)
1224 return rc;
1225 rc = avc_has_perm(tsec->sid, old_isec->sid,
1226 old_isec->sclass, FILE__RENAME, &ad);
1227 if (rc)
1228 return rc;
1229 if (old_is_dir && new_dir != old_dir) {
1230 rc = avc_has_perm(tsec->sid, old_isec->sid,
1231 old_isec->sclass, DIR__REPARENT, &ad);
1232 if (rc)
1233 return rc;
1234 }
1235
1236 ad.u.fs.dentry = new_dentry;
1237 av = DIR__ADD_NAME | DIR__SEARCH;
1238 if (new_dentry->d_inode)
1239 av |= DIR__REMOVE_NAME;
1240 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1241 if (rc)
1242 return rc;
1243 if (new_dentry->d_inode) {
1244 new_isec = new_dentry->d_inode->i_security;
1245 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1246 rc = avc_has_perm(tsec->sid, new_isec->sid,
1247 new_isec->sclass,
1248 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1249 if (rc)
1250 return rc;
1251 }
1252
1253 return 0;
1254 }
1255
1256 /* Check whether a task can perform a filesystem operation. */
1257 static int superblock_has_perm(struct task_struct *tsk,
1258 struct super_block *sb,
1259 u32 perms,
1260 struct avc_audit_data *ad)
1261 {
1262 struct task_security_struct *tsec;
1263 struct superblock_security_struct *sbsec;
1264
1265 tsec = tsk->security;
1266 sbsec = sb->s_security;
1267 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1268 perms, ad);
1269 }
1270
1271 /* Convert a Linux mode and permission mask to an access vector. */
1272 static inline u32 file_mask_to_av(int mode, int mask)
1273 {
1274 u32 av = 0;
1275
1276 if ((mode & S_IFMT) != S_IFDIR) {
1277 if (mask & MAY_EXEC)
1278 av |= FILE__EXECUTE;
1279 if (mask & MAY_READ)
1280 av |= FILE__READ;
1281
1282 if (mask & MAY_APPEND)
1283 av |= FILE__APPEND;
1284 else if (mask & MAY_WRITE)
1285 av |= FILE__WRITE;
1286
1287 } else {
1288 if (mask & MAY_EXEC)
1289 av |= DIR__SEARCH;
1290 if (mask & MAY_WRITE)
1291 av |= DIR__WRITE;
1292 if (mask & MAY_READ)
1293 av |= DIR__READ;
1294 }
1295
1296 return av;
1297 }
1298
1299 /* Convert a Linux file to an access vector. */
1300 static inline u32 file_to_av(struct file *file)
1301 {
1302 u32 av = 0;
1303
1304 if (file->f_mode & FMODE_READ)
1305 av |= FILE__READ;
1306 if (file->f_mode & FMODE_WRITE) {
1307 if (file->f_flags & O_APPEND)
1308 av |= FILE__APPEND;
1309 else
1310 av |= FILE__WRITE;
1311 }
1312
1313 return av;
1314 }
1315
1316 /* Set an inode's SID to a specified value. */
1317 static int inode_security_set_sid(struct inode *inode, u32 sid)
1318 {
1319 struct inode_security_struct *isec = inode->i_security;
1320 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1321
1322 if (!sbsec->initialized) {
1323 /* Defer initialization to selinux_complete_init. */
1324 return 0;
1325 }
1326
1327 down(&isec->sem);
1328 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1329 isec->sid = sid;
1330 isec->initialized = 1;
1331 up(&isec->sem);
1332 return 0;
1333 }
1334
1335 /* Hook functions begin here. */
1336
1337 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1338 {
1339 struct task_security_struct *psec = parent->security;
1340 struct task_security_struct *csec = child->security;
1341 int rc;
1342
1343 rc = secondary_ops->ptrace(parent,child);
1344 if (rc)
1345 return rc;
1346
1347 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1348 /* Save the SID of the tracing process for later use in apply_creds. */
1349 if (!(child->ptrace & PT_PTRACED) && !rc)
1350 csec->ptrace_sid = psec->sid;
1351 return rc;
1352 }
1353
1354 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1355 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1356 {
1357 int error;
1358
1359 error = task_has_perm(current, target, PROCESS__GETCAP);
1360 if (error)
1361 return error;
1362
1363 return secondary_ops->capget(target, effective, inheritable, permitted);
1364 }
1365
1366 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1367 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1368 {
1369 int error;
1370
1371 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1372 if (error)
1373 return error;
1374
1375 return task_has_perm(current, target, PROCESS__SETCAP);
1376 }
1377
1378 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1379 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1380 {
1381 secondary_ops->capset_set(target, effective, inheritable, permitted);
1382 }
1383
1384 static int selinux_capable(struct task_struct *tsk, int cap)
1385 {
1386 int rc;
1387
1388 rc = secondary_ops->capable(tsk, cap);
1389 if (rc)
1390 return rc;
1391
1392 return task_has_capability(tsk,cap);
1393 }
1394
1395 static int selinux_sysctl(ctl_table *table, int op)
1396 {
1397 int error = 0;
1398 u32 av;
1399 struct task_security_struct *tsec;
1400 u32 tsid;
1401 int rc;
1402
1403 rc = secondary_ops->sysctl(table, op);
1404 if (rc)
1405 return rc;
1406
1407 tsec = current->security;
1408
1409 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1410 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1411 if (rc) {
1412 /* Default to the well-defined sysctl SID. */
1413 tsid = SECINITSID_SYSCTL;
1414 }
1415
1416 /* The op values are "defined" in sysctl.c, thereby creating
1417 * a bad coupling between this module and sysctl.c */
1418 if(op == 001) {
1419 error = avc_has_perm(tsec->sid, tsid,
1420 SECCLASS_DIR, DIR__SEARCH, NULL);
1421 } else {
1422 av = 0;
1423 if (op & 004)
1424 av |= FILE__READ;
1425 if (op & 002)
1426 av |= FILE__WRITE;
1427 if (av)
1428 error = avc_has_perm(tsec->sid, tsid,
1429 SECCLASS_FILE, av, NULL);
1430 }
1431
1432 return error;
1433 }
1434
1435 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1436 {
1437 int rc = 0;
1438
1439 if (!sb)
1440 return 0;
1441
1442 switch (cmds) {
1443 case Q_SYNC:
1444 case Q_QUOTAON:
1445 case Q_QUOTAOFF:
1446 case Q_SETINFO:
1447 case Q_SETQUOTA:
1448 rc = superblock_has_perm(current,
1449 sb,
1450 FILESYSTEM__QUOTAMOD, NULL);
1451 break;
1452 case Q_GETFMT:
1453 case Q_GETINFO:
1454 case Q_GETQUOTA:
1455 rc = superblock_has_perm(current,
1456 sb,
1457 FILESYSTEM__QUOTAGET, NULL);
1458 break;
1459 default:
1460 rc = 0; /* let the kernel handle invalid cmds */
1461 break;
1462 }
1463 return rc;
1464 }
1465
1466 static int selinux_quota_on(struct dentry *dentry)
1467 {
1468 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1469 }
1470
1471 static int selinux_syslog(int type)
1472 {
1473 int rc;
1474
1475 rc = secondary_ops->syslog(type);
1476 if (rc)
1477 return rc;
1478
1479 switch (type) {
1480 case 3: /* Read last kernel messages */
1481 case 10: /* Return size of the log buffer */
1482 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1483 break;
1484 case 6: /* Disable logging to console */
1485 case 7: /* Enable logging to console */
1486 case 8: /* Set level of messages printed to console */
1487 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1488 break;
1489 case 0: /* Close log */
1490 case 1: /* Open log */
1491 case 2: /* Read from log */
1492 case 4: /* Read/clear last kernel messages */
1493 case 5: /* Clear ring buffer */
1494 default:
1495 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1496 break;
1497 }
1498 return rc;
1499 }
1500
1501 /*
1502 * Check that a process has enough memory to allocate a new virtual
1503 * mapping. 0 means there is enough memory for the allocation to
1504 * succeed and -ENOMEM implies there is not.
1505 *
1506 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1507 * if the capability is granted, but __vm_enough_memory requires 1 if
1508 * the capability is granted.
1509 *
1510 * Do not audit the selinux permission check, as this is applied to all
1511 * processes that allocate mappings.
1512 */
1513 static int selinux_vm_enough_memory(long pages)
1514 {
1515 int rc, cap_sys_admin = 0;
1516 struct task_security_struct *tsec = current->security;
1517
1518 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1519 if (rc == 0)
1520 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1521 SECCLASS_CAPABILITY,
1522 CAP_TO_MASK(CAP_SYS_ADMIN),
1523 NULL);
1524
1525 if (rc == 0)
1526 cap_sys_admin = 1;
1527
1528 return __vm_enough_memory(pages, cap_sys_admin);
1529 }
1530
1531 /* binprm security operations */
1532
1533 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1534 {
1535 struct bprm_security_struct *bsec;
1536
1537 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1538 if (!bsec)
1539 return -ENOMEM;
1540
1541 bsec->bprm = bprm;
1542 bsec->sid = SECINITSID_UNLABELED;
1543 bsec->set = 0;
1544
1545 bprm->security = bsec;
1546 return 0;
1547 }
1548
1549 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1550 {
1551 struct task_security_struct *tsec;
1552 struct inode *inode = bprm->file->f_dentry->d_inode;
1553 struct inode_security_struct *isec;
1554 struct bprm_security_struct *bsec;
1555 u32 newsid;
1556 struct avc_audit_data ad;
1557 int rc;
1558
1559 rc = secondary_ops->bprm_set_security(bprm);
1560 if (rc)
1561 return rc;
1562
1563 bsec = bprm->security;
1564
1565 if (bsec->set)
1566 return 0;
1567
1568 tsec = current->security;
1569 isec = inode->i_security;
1570
1571 /* Default to the current task SID. */
1572 bsec->sid = tsec->sid;
1573
1574 /* Reset fs, key, and sock SIDs on execve. */
1575 tsec->create_sid = 0;
1576 tsec->keycreate_sid = 0;
1577 tsec->sockcreate_sid = 0;
1578
1579 if (tsec->exec_sid) {
1580 newsid = tsec->exec_sid;
1581 /* Reset exec SID on execve. */
1582 tsec->exec_sid = 0;
1583 } else {
1584 /* Check for a default transition on this program. */
1585 rc = security_transition_sid(tsec->sid, isec->sid,
1586 SECCLASS_PROCESS, &newsid);
1587 if (rc)
1588 return rc;
1589 }
1590
1591 AVC_AUDIT_DATA_INIT(&ad, FS);
1592 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1593 ad.u.fs.dentry = bprm->file->f_dentry;
1594
1595 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1596 newsid = tsec->sid;
1597
1598 if (tsec->sid == newsid) {
1599 rc = avc_has_perm(tsec->sid, isec->sid,
1600 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1601 if (rc)
1602 return rc;
1603 } else {
1604 /* Check permissions for the transition. */
1605 rc = avc_has_perm(tsec->sid, newsid,
1606 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1607 if (rc)
1608 return rc;
1609
1610 rc = avc_has_perm(newsid, isec->sid,
1611 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1612 if (rc)
1613 return rc;
1614
1615 /* Clear any possibly unsafe personality bits on exec: */
1616 current->personality &= ~PER_CLEAR_ON_SETID;
1617
1618 /* Set the security field to the new SID. */
1619 bsec->sid = newsid;
1620 }
1621
1622 bsec->set = 1;
1623 return 0;
1624 }
1625
1626 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1627 {
1628 return secondary_ops->bprm_check_security(bprm);
1629 }
1630
1631
1632 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1633 {
1634 struct task_security_struct *tsec = current->security;
1635 int atsecure = 0;
1636
1637 if (tsec->osid != tsec->sid) {
1638 /* Enable secure mode for SIDs transitions unless
1639 the noatsecure permission is granted between
1640 the two SIDs, i.e. ahp returns 0. */
1641 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1642 SECCLASS_PROCESS,
1643 PROCESS__NOATSECURE, NULL);
1644 }
1645
1646 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1647 }
1648
1649 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1650 {
1651 kfree(bprm->security);
1652 bprm->security = NULL;
1653 }
1654
1655 extern struct vfsmount *selinuxfs_mount;
1656 extern struct dentry *selinux_null;
1657
1658 /* Derived from fs/exec.c:flush_old_files. */
1659 static inline void flush_unauthorized_files(struct files_struct * files)
1660 {
1661 struct avc_audit_data ad;
1662 struct file *file, *devnull = NULL;
1663 struct tty_struct *tty = current->signal->tty;
1664 struct fdtable *fdt;
1665 long j = -1;
1666
1667 if (tty) {
1668 file_list_lock();
1669 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1670 if (file) {
1671 /* Revalidate access to controlling tty.
1672 Use inode_has_perm on the tty inode directly rather
1673 than using file_has_perm, as this particular open
1674 file may belong to another process and we are only
1675 interested in the inode-based check here. */
1676 struct inode *inode = file->f_dentry->d_inode;
1677 if (inode_has_perm(current, inode,
1678 FILE__READ | FILE__WRITE, NULL)) {
1679 /* Reset controlling tty. */
1680 current->signal->tty = NULL;
1681 current->signal->tty_old_pgrp = 0;
1682 }
1683 }
1684 file_list_unlock();
1685 }
1686
1687 /* Revalidate access to inherited open files. */
1688
1689 AVC_AUDIT_DATA_INIT(&ad,FS);
1690
1691 spin_lock(&files->file_lock);
1692 for (;;) {
1693 unsigned long set, i;
1694 int fd;
1695
1696 j++;
1697 i = j * __NFDBITS;
1698 fdt = files_fdtable(files);
1699 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1700 break;
1701 set = fdt->open_fds->fds_bits[j];
1702 if (!set)
1703 continue;
1704 spin_unlock(&files->file_lock);
1705 for ( ; set ; i++,set >>= 1) {
1706 if (set & 1) {
1707 file = fget(i);
1708 if (!file)
1709 continue;
1710 if (file_has_perm(current,
1711 file,
1712 file_to_av(file))) {
1713 sys_close(i);
1714 fd = get_unused_fd();
1715 if (fd != i) {
1716 if (fd >= 0)
1717 put_unused_fd(fd);
1718 fput(file);
1719 continue;
1720 }
1721 if (devnull) {
1722 get_file(devnull);
1723 } else {
1724 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1725 if (!devnull) {
1726 put_unused_fd(fd);
1727 fput(file);
1728 continue;
1729 }
1730 }
1731 fd_install(fd, devnull);
1732 }
1733 fput(file);
1734 }
1735 }
1736 spin_lock(&files->file_lock);
1737
1738 }
1739 spin_unlock(&files->file_lock);
1740 }
1741
1742 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1743 {
1744 struct task_security_struct *tsec;
1745 struct bprm_security_struct *bsec;
1746 u32 sid;
1747 int rc;
1748
1749 secondary_ops->bprm_apply_creds(bprm, unsafe);
1750
1751 tsec = current->security;
1752
1753 bsec = bprm->security;
1754 sid = bsec->sid;
1755
1756 tsec->osid = tsec->sid;
1757 bsec->unsafe = 0;
1758 if (tsec->sid != sid) {
1759 /* Check for shared state. If not ok, leave SID
1760 unchanged and kill. */
1761 if (unsafe & LSM_UNSAFE_SHARE) {
1762 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1763 PROCESS__SHARE, NULL);
1764 if (rc) {
1765 bsec->unsafe = 1;
1766 return;
1767 }
1768 }
1769
1770 /* Check for ptracing, and update the task SID if ok.
1771 Otherwise, leave SID unchanged and kill. */
1772 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1773 rc = avc_has_perm(tsec->ptrace_sid, sid,
1774 SECCLASS_PROCESS, PROCESS__PTRACE,
1775 NULL);
1776 if (rc) {
1777 bsec->unsafe = 1;
1778 return;
1779 }
1780 }
1781 tsec->sid = sid;
1782 }
1783 }
1784
1785 /*
1786 * called after apply_creds without the task lock held
1787 */
1788 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1789 {
1790 struct task_security_struct *tsec;
1791 struct rlimit *rlim, *initrlim;
1792 struct itimerval itimer;
1793 struct bprm_security_struct *bsec;
1794 int rc, i;
1795
1796 tsec = current->security;
1797 bsec = bprm->security;
1798
1799 if (bsec->unsafe) {
1800 force_sig_specific(SIGKILL, current);
1801 return;
1802 }
1803 if (tsec->osid == tsec->sid)
1804 return;
1805
1806 /* Close files for which the new task SID is not authorized. */
1807 flush_unauthorized_files(current->files);
1808
1809 /* Check whether the new SID can inherit signal state
1810 from the old SID. If not, clear itimers to avoid
1811 subsequent signal generation and flush and unblock
1812 signals. This must occur _after_ the task SID has
1813 been updated so that any kill done after the flush
1814 will be checked against the new SID. */
1815 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1816 PROCESS__SIGINH, NULL);
1817 if (rc) {
1818 memset(&itimer, 0, sizeof itimer);
1819 for (i = 0; i < 3; i++)
1820 do_setitimer(i, &itimer, NULL);
1821 flush_signals(current);
1822 spin_lock_irq(&current->sighand->siglock);
1823 flush_signal_handlers(current, 1);
1824 sigemptyset(&current->blocked);
1825 recalc_sigpending();
1826 spin_unlock_irq(&current->sighand->siglock);
1827 }
1828
1829 /* Check whether the new SID can inherit resource limits
1830 from the old SID. If not, reset all soft limits to
1831 the lower of the current task's hard limit and the init
1832 task's soft limit. Note that the setting of hard limits
1833 (even to lower them) can be controlled by the setrlimit
1834 check. The inclusion of the init task's soft limit into
1835 the computation is to avoid resetting soft limits higher
1836 than the default soft limit for cases where the default
1837 is lower than the hard limit, e.g. RLIMIT_CORE or
1838 RLIMIT_STACK.*/
1839 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1840 PROCESS__RLIMITINH, NULL);
1841 if (rc) {
1842 for (i = 0; i < RLIM_NLIMITS; i++) {
1843 rlim = current->signal->rlim + i;
1844 initrlim = init_task.signal->rlim+i;
1845 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1846 }
1847 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1848 /*
1849 * This will cause RLIMIT_CPU calculations
1850 * to be refigured.
1851 */
1852 current->it_prof_expires = jiffies_to_cputime(1);
1853 }
1854 }
1855
1856 /* Wake up the parent if it is waiting so that it can
1857 recheck wait permission to the new task SID. */
1858 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1859 }
1860
1861 /* superblock security operations */
1862
1863 static int selinux_sb_alloc_security(struct super_block *sb)
1864 {
1865 return superblock_alloc_security(sb);
1866 }
1867
1868 static void selinux_sb_free_security(struct super_block *sb)
1869 {
1870 superblock_free_security(sb);
1871 }
1872
1873 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1874 {
1875 if (plen > olen)
1876 return 0;
1877
1878 return !memcmp(prefix, option, plen);
1879 }
1880
1881 static inline int selinux_option(char *option, int len)
1882 {
1883 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1884 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1885 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1886 }
1887
1888 static inline void take_option(char **to, char *from, int *first, int len)
1889 {
1890 if (!*first) {
1891 **to = ',';
1892 *to += 1;
1893 }
1894 else
1895 *first = 0;
1896 memcpy(*to, from, len);
1897 *to += len;
1898 }
1899
1900 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1901 {
1902 int fnosec, fsec, rc = 0;
1903 char *in_save, *in_curr, *in_end;
1904 char *sec_curr, *nosec_save, *nosec;
1905
1906 in_curr = orig;
1907 sec_curr = copy;
1908
1909 /* Binary mount data: just copy */
1910 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1911 copy_page(sec_curr, in_curr);
1912 goto out;
1913 }
1914
1915 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1916 if (!nosec) {
1917 rc = -ENOMEM;
1918 goto out;
1919 }
1920
1921 nosec_save = nosec;
1922 fnosec = fsec = 1;
1923 in_save = in_end = orig;
1924
1925 do {
1926 if (*in_end == ',' || *in_end == '\0') {
1927 int len = in_end - in_curr;
1928
1929 if (selinux_option(in_curr, len))
1930 take_option(&sec_curr, in_curr, &fsec, len);
1931 else
1932 take_option(&nosec, in_curr, &fnosec, len);
1933
1934 in_curr = in_end + 1;
1935 }
1936 } while (*in_end++);
1937
1938 strcpy(in_save, nosec_save);
1939 free_page((unsigned long)nosec_save);
1940 out:
1941 return rc;
1942 }
1943
1944 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1945 {
1946 struct avc_audit_data ad;
1947 int rc;
1948
1949 rc = superblock_doinit(sb, data);
1950 if (rc)
1951 return rc;
1952
1953 AVC_AUDIT_DATA_INIT(&ad,FS);
1954 ad.u.fs.dentry = sb->s_root;
1955 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1956 }
1957
1958 static int selinux_sb_statfs(struct dentry *dentry)
1959 {
1960 struct avc_audit_data ad;
1961
1962 AVC_AUDIT_DATA_INIT(&ad,FS);
1963 ad.u.fs.dentry = dentry->d_sb->s_root;
1964 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1965 }
1966
1967 static int selinux_mount(char * dev_name,
1968 struct nameidata *nd,
1969 char * type,
1970 unsigned long flags,
1971 void * data)
1972 {
1973 int rc;
1974
1975 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1976 if (rc)
1977 return rc;
1978
1979 if (flags & MS_REMOUNT)
1980 return superblock_has_perm(current, nd->mnt->mnt_sb,
1981 FILESYSTEM__REMOUNT, NULL);
1982 else
1983 return dentry_has_perm(current, nd->mnt, nd->dentry,
1984 FILE__MOUNTON);
1985 }
1986
1987 static int selinux_umount(struct vfsmount *mnt, int flags)
1988 {
1989 int rc;
1990
1991 rc = secondary_ops->sb_umount(mnt, flags);
1992 if (rc)
1993 return rc;
1994
1995 return superblock_has_perm(current,mnt->mnt_sb,
1996 FILESYSTEM__UNMOUNT,NULL);
1997 }
1998
1999 /* inode security operations */
2000
2001 static int selinux_inode_alloc_security(struct inode *inode)
2002 {
2003 return inode_alloc_security(inode);
2004 }
2005
2006 static void selinux_inode_free_security(struct inode *inode)
2007 {
2008 inode_free_security(inode);
2009 }
2010
2011 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2012 char **name, void **value,
2013 size_t *len)
2014 {
2015 struct task_security_struct *tsec;
2016 struct inode_security_struct *dsec;
2017 struct superblock_security_struct *sbsec;
2018 u32 newsid, clen;
2019 int rc;
2020 char *namep = NULL, *context;
2021
2022 tsec = current->security;
2023 dsec = dir->i_security;
2024 sbsec = dir->i_sb->s_security;
2025
2026 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2027 newsid = tsec->create_sid;
2028 } else {
2029 rc = security_transition_sid(tsec->sid, dsec->sid,
2030 inode_mode_to_security_class(inode->i_mode),
2031 &newsid);
2032 if (rc) {
2033 printk(KERN_WARNING "%s: "
2034 "security_transition_sid failed, rc=%d (dev=%s "
2035 "ino=%ld)\n",
2036 __FUNCTION__,
2037 -rc, inode->i_sb->s_id, inode->i_ino);
2038 return rc;
2039 }
2040 }
2041
2042 inode_security_set_sid(inode, newsid);
2043
2044 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2045 return -EOPNOTSUPP;
2046
2047 if (name) {
2048 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2049 if (!namep)
2050 return -ENOMEM;
2051 *name = namep;
2052 }
2053
2054 if (value && len) {
2055 rc = security_sid_to_context(newsid, &context, &clen);
2056 if (rc) {
2057 kfree(namep);
2058 return rc;
2059 }
2060 *value = context;
2061 *len = clen;
2062 }
2063
2064 return 0;
2065 }
2066
2067 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2068 {
2069 return may_create(dir, dentry, SECCLASS_FILE);
2070 }
2071
2072 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2073 {
2074 int rc;
2075
2076 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2077 if (rc)
2078 return rc;
2079 return may_link(dir, old_dentry, MAY_LINK);
2080 }
2081
2082 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2083 {
2084 int rc;
2085
2086 rc = secondary_ops->inode_unlink(dir, dentry);
2087 if (rc)
2088 return rc;
2089 return may_link(dir, dentry, MAY_UNLINK);
2090 }
2091
2092 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2093 {
2094 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2095 }
2096
2097 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2098 {
2099 return may_create(dir, dentry, SECCLASS_DIR);
2100 }
2101
2102 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2103 {
2104 return may_link(dir, dentry, MAY_RMDIR);
2105 }
2106
2107 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2108 {
2109 int rc;
2110
2111 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2112 if (rc)
2113 return rc;
2114
2115 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2116 }
2117
2118 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2119 struct inode *new_inode, struct dentry *new_dentry)
2120 {
2121 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2122 }
2123
2124 static int selinux_inode_readlink(struct dentry *dentry)
2125 {
2126 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2127 }
2128
2129 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2130 {
2131 int rc;
2132
2133 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2134 if (rc)
2135 return rc;
2136 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2137 }
2138
2139 static int selinux_inode_permission(struct inode *inode, int mask,
2140 struct nameidata *nd)
2141 {
2142 int rc;
2143
2144 rc = secondary_ops->inode_permission(inode, mask, nd);
2145 if (rc)
2146 return rc;
2147
2148 if (!mask) {
2149 /* No permission to check. Existence test. */
2150 return 0;
2151 }
2152
2153 return inode_has_perm(current, inode,
2154 file_mask_to_av(inode->i_mode, mask), NULL);
2155 }
2156
2157 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2158 {
2159 int rc;
2160
2161 rc = secondary_ops->inode_setattr(dentry, iattr);
2162 if (rc)
2163 return rc;
2164
2165 if (iattr->ia_valid & ATTR_FORCE)
2166 return 0;
2167
2168 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2169 ATTR_ATIME_SET | ATTR_MTIME_SET))
2170 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2171
2172 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2173 }
2174
2175 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2176 {
2177 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2178 }
2179
2180 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2181 {
2182 struct task_security_struct *tsec = current->security;
2183 struct inode *inode = dentry->d_inode;
2184 struct inode_security_struct *isec = inode->i_security;
2185 struct superblock_security_struct *sbsec;
2186 struct avc_audit_data ad;
2187 u32 newsid;
2188 int rc = 0;
2189
2190 if (strcmp(name, XATTR_NAME_SELINUX)) {
2191 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2192 sizeof XATTR_SECURITY_PREFIX - 1) &&
2193 !capable(CAP_SYS_ADMIN)) {
2194 /* A different attribute in the security namespace.
2195 Restrict to administrator. */
2196 return -EPERM;
2197 }
2198
2199 /* Not an attribute we recognize, so just check the
2200 ordinary setattr permission. */
2201 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2202 }
2203
2204 sbsec = inode->i_sb->s_security;
2205 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2206 return -EOPNOTSUPP;
2207
2208 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2209 return -EPERM;
2210
2211 AVC_AUDIT_DATA_INIT(&ad,FS);
2212 ad.u.fs.dentry = dentry;
2213
2214 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2215 FILE__RELABELFROM, &ad);
2216 if (rc)
2217 return rc;
2218
2219 rc = security_context_to_sid(value, size, &newsid);
2220 if (rc)
2221 return rc;
2222
2223 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2224 FILE__RELABELTO, &ad);
2225 if (rc)
2226 return rc;
2227
2228 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2229 isec->sclass);
2230 if (rc)
2231 return rc;
2232
2233 return avc_has_perm(newsid,
2234 sbsec->sid,
2235 SECCLASS_FILESYSTEM,
2236 FILESYSTEM__ASSOCIATE,
2237 &ad);
2238 }
2239
2240 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2241 void *value, size_t size, int flags)
2242 {
2243 struct inode *inode = dentry->d_inode;
2244 struct inode_security_struct *isec = inode->i_security;
2245 u32 newsid;
2246 int rc;
2247
2248 if (strcmp(name, XATTR_NAME_SELINUX)) {
2249 /* Not an attribute we recognize, so nothing to do. */
2250 return;
2251 }
2252
2253 rc = security_context_to_sid(value, size, &newsid);
2254 if (rc) {
2255 printk(KERN_WARNING "%s: unable to obtain SID for context "
2256 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2257 return;
2258 }
2259
2260 isec->sid = newsid;
2261 return;
2262 }
2263
2264 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2265 {
2266 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2267 }
2268
2269 static int selinux_inode_listxattr (struct dentry *dentry)
2270 {
2271 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2272 }
2273
2274 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2275 {
2276 if (strcmp(name, XATTR_NAME_SELINUX)) {
2277 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2278 sizeof XATTR_SECURITY_PREFIX - 1) &&
2279 !capable(CAP_SYS_ADMIN)) {
2280 /* A different attribute in the security namespace.
2281 Restrict to administrator. */
2282 return -EPERM;
2283 }
2284
2285 /* Not an attribute we recognize, so just check the
2286 ordinary setattr permission. Might want a separate
2287 permission for removexattr. */
2288 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2289 }
2290
2291 /* No one is allowed to remove a SELinux security label.
2292 You can change the label, but all data must be labeled. */
2293 return -EACCES;
2294 }
2295
2296 static const char *selinux_inode_xattr_getsuffix(void)
2297 {
2298 return XATTR_SELINUX_SUFFIX;
2299 }
2300
2301 /*
2302 * Copy the in-core inode security context value to the user. If the
2303 * getxattr() prior to this succeeded, check to see if we need to
2304 * canonicalize the value to be finally returned to the user.
2305 *
2306 * Permission check is handled by selinux_inode_getxattr hook.
2307 */
2308 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2309 {
2310 struct inode_security_struct *isec = inode->i_security;
2311
2312 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2313 return -EOPNOTSUPP;
2314
2315 return selinux_getsecurity(isec->sid, buffer, size);
2316 }
2317
2318 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2319 const void *value, size_t size, int flags)
2320 {
2321 struct inode_security_struct *isec = inode->i_security;
2322 u32 newsid;
2323 int rc;
2324
2325 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2326 return -EOPNOTSUPP;
2327
2328 if (!value || !size)
2329 return -EACCES;
2330
2331 rc = security_context_to_sid((void*)value, size, &newsid);
2332 if (rc)
2333 return rc;
2334
2335 isec->sid = newsid;
2336 return 0;
2337 }
2338
2339 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2340 {
2341 const int len = sizeof(XATTR_NAME_SELINUX);
2342 if (buffer && len <= buffer_size)
2343 memcpy(buffer, XATTR_NAME_SELINUX, len);
2344 return len;
2345 }
2346
2347 /* file security operations */
2348
2349 static int selinux_file_permission(struct file *file, int mask)
2350 {
2351 struct inode *inode = file->f_dentry->d_inode;
2352
2353 if (!mask) {
2354 /* No permission to check. Existence test. */
2355 return 0;
2356 }
2357
2358 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2359 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2360 mask |= MAY_APPEND;
2361
2362 return file_has_perm(current, file,
2363 file_mask_to_av(inode->i_mode, mask));
2364 }
2365
2366 static int selinux_file_alloc_security(struct file *file)
2367 {
2368 return file_alloc_security(file);
2369 }
2370
2371 static void selinux_file_free_security(struct file *file)
2372 {
2373 file_free_security(file);
2374 }
2375
2376 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2377 unsigned long arg)
2378 {
2379 int error = 0;
2380
2381 switch (cmd) {
2382 case FIONREAD:
2383 /* fall through */
2384 case FIBMAP:
2385 /* fall through */
2386 case FIGETBSZ:
2387 /* fall through */
2388 case EXT2_IOC_GETFLAGS:
2389 /* fall through */
2390 case EXT2_IOC_GETVERSION:
2391 error = file_has_perm(current, file, FILE__GETATTR);
2392 break;
2393
2394 case EXT2_IOC_SETFLAGS:
2395 /* fall through */
2396 case EXT2_IOC_SETVERSION:
2397 error = file_has_perm(current, file, FILE__SETATTR);
2398 break;
2399
2400 /* sys_ioctl() checks */
2401 case FIONBIO:
2402 /* fall through */
2403 case FIOASYNC:
2404 error = file_has_perm(current, file, 0);
2405 break;
2406
2407 case KDSKBENT:
2408 case KDSKBSENT:
2409 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2410 break;
2411
2412 /* default case assumes that the command will go
2413 * to the file's ioctl() function.
2414 */
2415 default:
2416 error = file_has_perm(current, file, FILE__IOCTL);
2417
2418 }
2419 return error;
2420 }
2421
2422 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2423 {
2424 #ifndef CONFIG_PPC32
2425 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2426 /*
2427 * We are making executable an anonymous mapping or a
2428 * private file mapping that will also be writable.
2429 * This has an additional check.
2430 */
2431 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2432 if (rc)
2433 return rc;
2434 }
2435 #endif
2436
2437 if (file) {
2438 /* read access is always possible with a mapping */
2439 u32 av = FILE__READ;
2440
2441 /* write access only matters if the mapping is shared */
2442 if (shared && (prot & PROT_WRITE))
2443 av |= FILE__WRITE;
2444
2445 if (prot & PROT_EXEC)
2446 av |= FILE__EXECUTE;
2447
2448 return file_has_perm(current, file, av);
2449 }
2450 return 0;
2451 }
2452
2453 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2454 unsigned long prot, unsigned long flags)
2455 {
2456 int rc;
2457
2458 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2459 if (rc)
2460 return rc;
2461
2462 if (selinux_checkreqprot)
2463 prot = reqprot;
2464
2465 return file_map_prot_check(file, prot,
2466 (flags & MAP_TYPE) == MAP_SHARED);
2467 }
2468
2469 static int selinux_file_mprotect(struct vm_area_struct *vma,
2470 unsigned long reqprot,
2471 unsigned long prot)
2472 {
2473 int rc;
2474
2475 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2476 if (rc)
2477 return rc;
2478
2479 if (selinux_checkreqprot)
2480 prot = reqprot;
2481
2482 #ifndef CONFIG_PPC32
2483 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2484 rc = 0;
2485 if (vma->vm_start >= vma->vm_mm->start_brk &&
2486 vma->vm_end <= vma->vm_mm->brk) {
2487 rc = task_has_perm(current, current,
2488 PROCESS__EXECHEAP);
2489 } else if (!vma->vm_file &&
2490 vma->vm_start <= vma->vm_mm->start_stack &&
2491 vma->vm_end >= vma->vm_mm->start_stack) {
2492 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2493 } else if (vma->vm_file && vma->anon_vma) {
2494 /*
2495 * We are making executable a file mapping that has
2496 * had some COW done. Since pages might have been
2497 * written, check ability to execute the possibly
2498 * modified content. This typically should only
2499 * occur for text relocations.
2500 */
2501 rc = file_has_perm(current, vma->vm_file,
2502 FILE__EXECMOD);
2503 }
2504 if (rc)
2505 return rc;
2506 }
2507 #endif
2508
2509 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2510 }
2511
2512 static int selinux_file_lock(struct file *file, unsigned int cmd)
2513 {
2514 return file_has_perm(current, file, FILE__LOCK);
2515 }
2516
2517 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2518 unsigned long arg)
2519 {
2520 int err = 0;
2521
2522 switch (cmd) {
2523 case F_SETFL:
2524 if (!file->f_dentry || !file->f_dentry->d_inode) {
2525 err = -EINVAL;
2526 break;
2527 }
2528
2529 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2530 err = file_has_perm(current, file,FILE__WRITE);
2531 break;
2532 }
2533 /* fall through */
2534 case F_SETOWN:
2535 case F_SETSIG:
2536 case F_GETFL:
2537 case F_GETOWN:
2538 case F_GETSIG:
2539 /* Just check FD__USE permission */
2540 err = file_has_perm(current, file, 0);
2541 break;
2542 case F_GETLK:
2543 case F_SETLK:
2544 case F_SETLKW:
2545 #if BITS_PER_LONG == 32
2546 case F_GETLK64:
2547 case F_SETLK64:
2548 case F_SETLKW64:
2549 #endif
2550 if (!file->f_dentry || !file->f_dentry->d_inode) {
2551 err = -EINVAL;
2552 break;
2553 }
2554 err = file_has_perm(current, file, FILE__LOCK);
2555 break;
2556 }
2557
2558 return err;
2559 }
2560
2561 static int selinux_file_set_fowner(struct file *file)
2562 {
2563 struct task_security_struct *tsec;
2564 struct file_security_struct *fsec;
2565
2566 tsec = current->security;
2567 fsec = file->f_security;
2568 fsec->fown_sid = tsec->sid;
2569
2570 return 0;
2571 }
2572
2573 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2574 struct fown_struct *fown, int signum)
2575 {
2576 struct file *file;
2577 u32 perm;
2578 struct task_security_struct *tsec;
2579 struct file_security_struct *fsec;
2580
2581 /* struct fown_struct is never outside the context of a struct file */
2582 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2583
2584 tsec = tsk->security;
2585 fsec = file->f_security;
2586
2587 if (!signum)
2588 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2589 else
2590 perm = signal_to_av(signum);
2591
2592 return avc_has_perm(fsec->fown_sid, tsec->sid,
2593 SECCLASS_PROCESS, perm, NULL);
2594 }
2595
2596 static int selinux_file_receive(struct file *file)
2597 {
2598 return file_has_perm(current, file, file_to_av(file));
2599 }
2600
2601 /* task security operations */
2602
2603 static int selinux_task_create(unsigned long clone_flags)
2604 {
2605 int rc;
2606
2607 rc = secondary_ops->task_create(clone_flags);
2608 if (rc)
2609 return rc;
2610
2611 return task_has_perm(current, current, PROCESS__FORK);
2612 }
2613
2614 static int selinux_task_alloc_security(struct task_struct *tsk)
2615 {
2616 struct task_security_struct *tsec1, *tsec2;
2617 int rc;
2618
2619 tsec1 = current->security;
2620
2621 rc = task_alloc_security(tsk);
2622 if (rc)
2623 return rc;
2624 tsec2 = tsk->security;
2625
2626 tsec2->osid = tsec1->osid;
2627 tsec2->sid = tsec1->sid;
2628
2629 /* Retain the exec, fs, key, and sock SIDs across fork */
2630 tsec2->exec_sid = tsec1->exec_sid;
2631 tsec2->create_sid = tsec1->create_sid;
2632 tsec2->keycreate_sid = tsec1->keycreate_sid;
2633 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2634
2635 /* Retain ptracer SID across fork, if any.
2636 This will be reset by the ptrace hook upon any
2637 subsequent ptrace_attach operations. */
2638 tsec2->ptrace_sid = tsec1->ptrace_sid;
2639
2640 return 0;
2641 }
2642
2643 static void selinux_task_free_security(struct task_struct *tsk)
2644 {
2645 task_free_security(tsk);
2646 }
2647
2648 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2649 {
2650 /* Since setuid only affects the current process, and
2651 since the SELinux controls are not based on the Linux
2652 identity attributes, SELinux does not need to control
2653 this operation. However, SELinux does control the use
2654 of the CAP_SETUID and CAP_SETGID capabilities using the
2655 capable hook. */
2656 return 0;
2657 }
2658
2659 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2660 {
2661 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2662 }
2663
2664 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2665 {
2666 /* See the comment for setuid above. */
2667 return 0;
2668 }
2669
2670 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2671 {
2672 return task_has_perm(current, p, PROCESS__SETPGID);
2673 }
2674
2675 static int selinux_task_getpgid(struct task_struct *p)
2676 {
2677 return task_has_perm(current, p, PROCESS__GETPGID);
2678 }
2679
2680 static int selinux_task_getsid(struct task_struct *p)
2681 {
2682 return task_has_perm(current, p, PROCESS__GETSESSION);
2683 }
2684
2685 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2686 {
2687 selinux_get_task_sid(p, secid);
2688 }
2689
2690 static int selinux_task_setgroups(struct group_info *group_info)
2691 {
2692 /* See the comment for setuid above. */
2693 return 0;
2694 }
2695
2696 static int selinux_task_setnice(struct task_struct *p, int nice)
2697 {
2698 int rc;
2699
2700 rc = secondary_ops->task_setnice(p, nice);
2701 if (rc)
2702 return rc;
2703
2704 return task_has_perm(current,p, PROCESS__SETSCHED);
2705 }
2706
2707 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2708 {
2709 return task_has_perm(current, p, PROCESS__SETSCHED);
2710 }
2711
2712 static int selinux_task_getioprio(struct task_struct *p)
2713 {
2714 return task_has_perm(current, p, PROCESS__GETSCHED);
2715 }
2716
2717 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2718 {
2719 struct rlimit *old_rlim = current->signal->rlim + resource;
2720 int rc;
2721
2722 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2723 if (rc)
2724 return rc;
2725
2726 /* Control the ability to change the hard limit (whether
2727 lowering or raising it), so that the hard limit can
2728 later be used as a safe reset point for the soft limit
2729 upon context transitions. See selinux_bprm_apply_creds. */
2730 if (old_rlim->rlim_max != new_rlim->rlim_max)
2731 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2732
2733 return 0;
2734 }
2735
2736 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2737 {
2738 return task_has_perm(current, p, PROCESS__SETSCHED);
2739 }
2740
2741 static int selinux_task_getscheduler(struct task_struct *p)
2742 {
2743 return task_has_perm(current, p, PROCESS__GETSCHED);
2744 }
2745
2746 static int selinux_task_movememory(struct task_struct *p)
2747 {
2748 return task_has_perm(current, p, PROCESS__SETSCHED);
2749 }
2750
2751 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2752 int sig, u32 secid)
2753 {
2754 u32 perm;
2755 int rc;
2756 struct task_security_struct *tsec;
2757
2758 rc = secondary_ops->task_kill(p, info, sig, secid);
2759 if (rc)
2760 return rc;
2761
2762 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2763 return 0;
2764
2765 if (!sig)
2766 perm = PROCESS__SIGNULL; /* null signal; existence test */
2767 else
2768 perm = signal_to_av(sig);
2769 tsec = p->security;
2770 if (secid)
2771 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2772 else
2773 rc = task_has_perm(current, p, perm);
2774 return rc;
2775 }
2776
2777 static int selinux_task_prctl(int option,
2778 unsigned long arg2,
2779 unsigned long arg3,
2780 unsigned long arg4,
2781 unsigned long arg5)
2782 {
2783 /* The current prctl operations do not appear to require
2784 any SELinux controls since they merely observe or modify
2785 the state of the current process. */
2786 return 0;
2787 }
2788
2789 static int selinux_task_wait(struct task_struct *p)
2790 {
2791 u32 perm;
2792
2793 perm = signal_to_av(p->exit_signal);
2794
2795 return task_has_perm(p, current, perm);
2796 }
2797
2798 static void selinux_task_reparent_to_init(struct task_struct *p)
2799 {
2800 struct task_security_struct *tsec;
2801
2802 secondary_ops->task_reparent_to_init(p);
2803
2804 tsec = p->security;
2805 tsec->osid = tsec->sid;
2806 tsec->sid = SECINITSID_KERNEL;
2807 return;
2808 }
2809
2810 static void selinux_task_to_inode(struct task_struct *p,
2811 struct inode *inode)
2812 {
2813 struct task_security_struct *tsec = p->security;
2814 struct inode_security_struct *isec = inode->i_security;
2815
2816 isec->sid = tsec->sid;
2817 isec->initialized = 1;
2818 return;
2819 }
2820
2821 /* Returns error only if unable to parse addresses */
2822 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2823 {
2824 int offset, ihlen, ret = -EINVAL;
2825 struct iphdr _iph, *ih;
2826
2827 offset = skb->nh.raw - skb->data;
2828 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2829 if (ih == NULL)
2830 goto out;
2831
2832 ihlen = ih->ihl * 4;
2833 if (ihlen < sizeof(_iph))
2834 goto out;
2835
2836 ad->u.net.v4info.saddr = ih->saddr;
2837 ad->u.net.v4info.daddr = ih->daddr;
2838 ret = 0;
2839
2840 switch (ih->protocol) {
2841 case IPPROTO_TCP: {
2842 struct tcphdr _tcph, *th;
2843
2844 if (ntohs(ih->frag_off) & IP_OFFSET)
2845 break;
2846
2847 offset += ihlen;
2848 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2849 if (th == NULL)
2850 break;
2851
2852 ad->u.net.sport = th->source;
2853 ad->u.net.dport = th->dest;
2854 break;
2855 }
2856
2857 case IPPROTO_UDP: {
2858 struct udphdr _udph, *uh;
2859
2860 if (ntohs(ih->frag_off) & IP_OFFSET)
2861 break;
2862
2863 offset += ihlen;
2864 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2865 if (uh == NULL)
2866 break;
2867
2868 ad->u.net.sport = uh->source;
2869 ad->u.net.dport = uh->dest;
2870 break;
2871 }
2872
2873 default:
2874 break;
2875 }
2876 out:
2877 return ret;
2878 }
2879
2880 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2881
2882 /* Returns error only if unable to parse addresses */
2883 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2884 {
2885 u8 nexthdr;
2886 int ret = -EINVAL, offset;
2887 struct ipv6hdr _ipv6h, *ip6;
2888
2889 offset = skb->nh.raw - skb->data;
2890 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2891 if (ip6 == NULL)
2892 goto out;
2893
2894 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2895 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2896 ret = 0;
2897
2898 nexthdr = ip6->nexthdr;
2899 offset += sizeof(_ipv6h);
2900 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2901 if (offset < 0)
2902 goto out;
2903
2904 switch (nexthdr) {
2905 case IPPROTO_TCP: {
2906 struct tcphdr _tcph, *th;
2907
2908 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2909 if (th == NULL)
2910 break;
2911
2912 ad->u.net.sport = th->source;
2913 ad->u.net.dport = th->dest;
2914 break;
2915 }
2916
2917 case IPPROTO_UDP: {
2918 struct udphdr _udph, *uh;
2919
2920 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2921 if (uh == NULL)
2922 break;
2923
2924 ad->u.net.sport = uh->source;
2925 ad->u.net.dport = uh->dest;
2926 break;
2927 }
2928
2929 /* includes fragments */
2930 default:
2931 break;
2932 }
2933 out:
2934 return ret;
2935 }
2936
2937 #endif /* IPV6 */
2938
2939 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2940 char **addrp, int *len, int src)
2941 {
2942 int ret = 0;
2943
2944 switch (ad->u.net.family) {
2945 case PF_INET:
2946 ret = selinux_parse_skb_ipv4(skb, ad);
2947 if (ret || !addrp)
2948 break;
2949 *len = 4;
2950 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2951 &ad->u.net.v4info.daddr);
2952 break;
2953
2954 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2955 case PF_INET6:
2956 ret = selinux_parse_skb_ipv6(skb, ad);
2957 if (ret || !addrp)
2958 break;
2959 *len = 16;
2960 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2961 &ad->u.net.v6info.daddr);
2962 break;
2963 #endif /* IPV6 */
2964 default:
2965 break;
2966 }
2967
2968 return ret;
2969 }
2970
2971 /* socket security operations */
2972 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2973 u32 perms)
2974 {
2975 struct inode_security_struct *isec;
2976 struct task_security_struct *tsec;
2977 struct avc_audit_data ad;
2978 int err = 0;
2979
2980 tsec = task->security;
2981 isec = SOCK_INODE(sock)->i_security;
2982
2983 if (isec->sid == SECINITSID_KERNEL)
2984 goto out;
2985
2986 AVC_AUDIT_DATA_INIT(&ad,NET);
2987 ad.u.net.sk = sock->sk;
2988 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2989
2990 out:
2991 return err;
2992 }
2993
2994 static int selinux_socket_create(int family, int type,
2995 int protocol, int kern)
2996 {
2997 int err = 0;
2998 struct task_security_struct *tsec;
2999 u32 newsid;
3000
3001 if (kern)
3002 goto out;
3003
3004 tsec = current->security;
3005 newsid = tsec->sockcreate_sid ? : tsec->sid;
3006 err = avc_has_perm(tsec->sid, newsid,
3007 socket_type_to_security_class(family, type,
3008 protocol), SOCKET__CREATE, NULL);
3009
3010 out:
3011 return err;
3012 }
3013
3014 static void selinux_socket_post_create(struct socket *sock, int family,
3015 int type, int protocol, int kern)
3016 {
3017 struct inode_security_struct *isec;
3018 struct task_security_struct *tsec;
3019 u32 newsid;
3020
3021 isec = SOCK_INODE(sock)->i_security;
3022
3023 tsec = current->security;
3024 newsid = tsec->sockcreate_sid ? : tsec->sid;
3025 isec->sclass = socket_type_to_security_class(family, type, protocol);
3026 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3027 isec->initialized = 1;
3028
3029 return;
3030 }
3031
3032 /* Range of port numbers used to automatically bind.
3033 Need to determine whether we should perform a name_bind
3034 permission check between the socket and the port number. */
3035 #define ip_local_port_range_0 sysctl_local_port_range[0]
3036 #define ip_local_port_range_1 sysctl_local_port_range[1]
3037
3038 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3039 {
3040 u16 family;
3041 int err;
3042
3043 err = socket_has_perm(current, sock, SOCKET__BIND);
3044 if (err)
3045 goto out;
3046
3047 /*
3048 * If PF_INET or PF_INET6, check name_bind permission for the port.
3049 * Multiple address binding for SCTP is not supported yet: we just
3050 * check the first address now.
3051 */
3052 family = sock->sk->sk_family;
3053 if (family == PF_INET || family == PF_INET6) {
3054 char *addrp;
3055 struct inode_security_struct *isec;
3056 struct task_security_struct *tsec;
3057 struct avc_audit_data ad;
3058 struct sockaddr_in *addr4 = NULL;
3059 struct sockaddr_in6 *addr6 = NULL;
3060 unsigned short snum;
3061 struct sock *sk = sock->sk;
3062 u32 sid, node_perm, addrlen;
3063
3064 tsec = current->security;
3065 isec = SOCK_INODE(sock)->i_security;
3066
3067 if (family == PF_INET) {
3068 addr4 = (struct sockaddr_in *)address;
3069 snum = ntohs(addr4->sin_port);
3070 addrlen = sizeof(addr4->sin_addr.s_addr);
3071 addrp = (char *)&addr4->sin_addr.s_addr;
3072 } else {
3073 addr6 = (struct sockaddr_in6 *)address;
3074 snum = ntohs(addr6->sin6_port);
3075 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3076 addrp = (char *)&addr6->sin6_addr.s6_addr;
3077 }
3078
3079 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3080 snum > ip_local_port_range_1)) {
3081 err = security_port_sid(sk->sk_family, sk->sk_type,
3082 sk->sk_protocol, snum, &sid);
3083 if (err)
3084 goto out;
3085 AVC_AUDIT_DATA_INIT(&ad,NET);
3086 ad.u.net.sport = htons(snum);
3087 ad.u.net.family = family;
3088 err = avc_has_perm(isec->sid, sid,
3089 isec->sclass,
3090 SOCKET__NAME_BIND, &ad);
3091 if (err)
3092 goto out;
3093 }
3094
3095 switch(isec->sclass) {
3096 case SECCLASS_TCP_SOCKET:
3097 node_perm = TCP_SOCKET__NODE_BIND;
3098 break;
3099
3100 case SECCLASS_UDP_SOCKET:
3101 node_perm = UDP_SOCKET__NODE_BIND;
3102 break;
3103
3104 default:
3105 node_perm = RAWIP_SOCKET__NODE_BIND;
3106 break;
3107 }
3108
3109 err = security_node_sid(family, addrp, addrlen, &sid);
3110 if (err)
3111 goto out;
3112
3113 AVC_AUDIT_DATA_INIT(&ad,NET);
3114 ad.u.net.sport = htons(snum);
3115 ad.u.net.family = family;
3116
3117 if (family == PF_INET)
3118 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3119 else
3120 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3121
3122 err = avc_has_perm(isec->sid, sid,
3123 isec->sclass, node_perm, &ad);
3124 if (err)
3125 goto out;
3126 }
3127 out:
3128 return err;
3129 }
3130
3131 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3132 {
3133 struct inode_security_struct *isec;
3134 int err;
3135
3136 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3137 if (err)
3138 return err;
3139
3140 /*
3141 * If a TCP socket, check name_connect permission for the port.
3142 */
3143 isec = SOCK_INODE(sock)->i_security;
3144 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3145 struct sock *sk = sock->sk;
3146 struct avc_audit_data ad;
3147 struct sockaddr_in *addr4 = NULL;
3148 struct sockaddr_in6 *addr6 = NULL;
3149 unsigned short snum;
3150 u32 sid;
3151
3152 if (sk->sk_family == PF_INET) {
3153 addr4 = (struct sockaddr_in *)address;
3154 if (addrlen < sizeof(struct sockaddr_in))
3155 return -EINVAL;
3156 snum = ntohs(addr4->sin_port);
3157 } else {
3158 addr6 = (struct sockaddr_in6 *)address;
3159 if (addrlen < SIN6_LEN_RFC2133)
3160 return -EINVAL;
3161 snum = ntohs(addr6->sin6_port);
3162 }
3163
3164 err = security_port_sid(sk->sk_family, sk->sk_type,
3165 sk->sk_protocol, snum, &sid);
3166 if (err)
3167 goto out;
3168
3169 AVC_AUDIT_DATA_INIT(&ad,NET);
3170 ad.u.net.dport = htons(snum);
3171 ad.u.net.family = sk->sk_family;
3172 err = avc_has_perm(isec->sid, sid, isec->sclass,
3173 TCP_SOCKET__NAME_CONNECT, &ad);
3174 if (err)
3175 goto out;
3176 }
3177
3178 out:
3179 return err;
3180 }
3181
3182 static int selinux_socket_listen(struct socket *sock, int backlog)
3183 {
3184 return socket_has_perm(current, sock, SOCKET__LISTEN);
3185 }
3186
3187 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3188 {
3189 int err;
3190 struct inode_security_struct *isec;
3191 struct inode_security_struct *newisec;
3192
3193 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3194 if (err)
3195 return err;
3196
3197 newisec = SOCK_INODE(newsock)->i_security;
3198
3199 isec = SOCK_INODE(sock)->i_security;
3200 newisec->sclass = isec->sclass;
3201 newisec->sid = isec->sid;
3202 newisec->initialized = 1;
3203
3204 return 0;
3205 }
3206
3207 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3208 int size)
3209 {
3210 return socket_has_perm(current, sock, SOCKET__WRITE);
3211 }
3212
3213 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3214 int size, int flags)
3215 {
3216 return socket_has_perm(current, sock, SOCKET__READ);
3217 }
3218
3219 static int selinux_socket_getsockname(struct socket *sock)
3220 {
3221 return socket_has_perm(current, sock, SOCKET__GETATTR);
3222 }
3223
3224 static int selinux_socket_getpeername(struct socket *sock)
3225 {
3226 return socket_has_perm(current, sock, SOCKET__GETATTR);
3227 }
3228
3229 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3230 {
3231 return socket_has_perm(current, sock, SOCKET__SETOPT);
3232 }
3233
3234 static int selinux_socket_getsockopt(struct socket *sock, int level,
3235 int optname)
3236 {
3237 return socket_has_perm(current, sock, SOCKET__GETOPT);
3238 }
3239
3240 static int selinux_socket_shutdown(struct socket *sock, int how)
3241 {
3242 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3243 }
3244
3245 static int selinux_socket_unix_stream_connect(struct socket *sock,
3246 struct socket *other,
3247 struct sock *newsk)
3248 {
3249 struct sk_security_struct *ssec;
3250 struct inode_security_struct *isec;
3251 struct inode_security_struct *other_isec;
3252 struct avc_audit_data ad;
3253 int err;
3254
3255 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3256 if (err)
3257 return err;
3258
3259 isec = SOCK_INODE(sock)->i_security;
3260 other_isec = SOCK_INODE(other)->i_security;
3261
3262 AVC_AUDIT_DATA_INIT(&ad,NET);
3263 ad.u.net.sk = other->sk;
3264
3265 err = avc_has_perm(isec->sid, other_isec->sid,
3266 isec->sclass,
3267 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3268 if (err)
3269 return err;
3270
3271 /* connecting socket */
3272 ssec = sock->sk->sk_security;
3273 ssec->peer_sid = other_isec->sid;
3274
3275 /* server child socket */
3276 ssec = newsk->sk_security;
3277 ssec->peer_sid = isec->sid;
3278
3279 return 0;
3280 }
3281
3282 static int selinux_socket_unix_may_send(struct socket *sock,
3283 struct socket *other)
3284 {
3285 struct inode_security_struct *isec;
3286 struct inode_security_struct *other_isec;
3287 struct avc_audit_data ad;
3288 int err;
3289
3290 isec = SOCK_INODE(sock)->i_security;
3291 other_isec = SOCK_INODE(other)->i_security;
3292
3293 AVC_AUDIT_DATA_INIT(&ad,NET);
3294 ad.u.net.sk = other->sk;
3295
3296 err = avc_has_perm(isec->sid, other_isec->sid,
3297 isec->sclass, SOCKET__SENDTO, &ad);
3298 if (err)
3299 return err;
3300
3301 return 0;
3302 }
3303
3304 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3305 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3306 u16 family, char *addrp, int len)
3307 {
3308 int err = 0;
3309 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3310
3311 if (!skb->dev)
3312 goto out;
3313
3314 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3315 if (err)
3316 goto out;
3317
3318 switch (sock_class) {
3319 case SECCLASS_UDP_SOCKET:
3320 netif_perm = NETIF__UDP_RECV;
3321 node_perm = NODE__UDP_RECV;
3322 recv_perm = UDP_SOCKET__RECV_MSG;
3323 break;
3324
3325 case SECCLASS_TCP_SOCKET:
3326 netif_perm = NETIF__TCP_RECV;
3327 node_perm = NODE__TCP_RECV;
3328 recv_perm = TCP_SOCKET__RECV_MSG;
3329 break;
3330
3331 default:
3332 netif_perm = NETIF__RAWIP_RECV;
3333 node_perm = NODE__RAWIP_RECV;
3334 break;
3335 }
3336
3337 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3338 if (err)
3339 goto out;
3340
3341 err = security_node_sid(family, addrp, len, &node_sid);
3342 if (err)
3343 goto out;
3344
3345 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3346 if (err)
3347 goto out;
3348
3349 if (recv_perm) {
3350 u32 port_sid;
3351
3352 err = security_port_sid(sk->sk_family, sk->sk_type,
3353 sk->sk_protocol, ntohs(ad->u.net.sport),
3354 &port_sid);
3355 if (err)
3356 goto out;
3357
3358 err = avc_has_perm(sock_sid, port_sid,
3359 sock_class, recv_perm, ad);
3360 }
3361
3362 out:
3363 return err;
3364 }
3365
3366 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3367 {
3368 u16 family;
3369 u16 sock_class = 0;
3370 char *addrp;
3371 int len, err = 0;
3372 u32 sock_sid = 0;
3373 struct socket *sock;
3374 struct avc_audit_data ad;
3375
3376 family = sk->sk_family;
3377 if (family != PF_INET && family != PF_INET6)
3378 goto out;
3379
3380 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3381 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3382 family = PF_INET;
3383
3384 read_lock_bh(&sk->sk_callback_lock);
3385 sock = sk->sk_socket;
3386 if (sock) {
3387 struct inode *inode;
3388 inode = SOCK_INODE(sock);
3389 if (inode) {
3390 struct inode_security_struct *isec;
3391 isec = inode->i_security;
3392 sock_sid = isec->sid;
3393 sock_class = isec->sclass;
3394 }
3395 }
3396 read_unlock_bh(&sk->sk_callback_lock);
3397 if (!sock_sid)
3398 goto out;
3399
3400 AVC_AUDIT_DATA_INIT(&ad, NET);
3401 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3402 ad.u.net.family = family;
3403
3404 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3405 if (err)
3406 goto out;
3407
3408 if (selinux_compat_net)
3409 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3410 sock_class, family,
3411 addrp, len);
3412 else
3413 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3414 PACKET__RECV, &ad);
3415 if (err)
3416 goto out;
3417
3418 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3419 out:
3420 return err;
3421 }
3422
3423 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3424 int __user *optlen, unsigned len)
3425 {
3426 int err = 0;
3427 char *scontext;
3428 u32 scontext_len;
3429 struct sk_security_struct *ssec;
3430 struct inode_security_struct *isec;
3431 u32 peer_sid = 0;
3432
3433 isec = SOCK_INODE(sock)->i_security;
3434
3435 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3436 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3437 ssec = sock->sk->sk_security;
3438 peer_sid = ssec->peer_sid;
3439 }
3440 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3441 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3442
3443 if (peer_sid == SECSID_NULL) {
3444 err = -ENOPROTOOPT;
3445 goto out;
3446 }
3447 }
3448 else {
3449 err = -ENOPROTOOPT;
3450 goto out;
3451 }
3452
3453 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3454
3455 if (err)
3456 goto out;
3457
3458 if (scontext_len > len) {
3459 err = -ERANGE;
3460 goto out_len;
3461 }
3462
3463 if (copy_to_user(optval, scontext, scontext_len))
3464 err = -EFAULT;
3465
3466 out_len:
3467 if (put_user(scontext_len, optlen))
3468 err = -EFAULT;
3469
3470 kfree(scontext);
3471 out:
3472 return err;
3473 }
3474
3475 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3476 {
3477 int err = 0;
3478 u32 peer_sid;
3479
3480 if (skb->sk->sk_family == PF_UNIX)
3481 selinux_get_inode_sid(SOCK_INODE(skb->sk->sk_socket),
3482 &peer_sid);
3483 else
3484 peer_sid = selinux_socket_getpeer_dgram(skb);
3485
3486 if (peer_sid == SECSID_NULL)
3487 return -EINVAL;
3488
3489 err = security_sid_to_context(peer_sid, secdata, seclen);
3490 if (err)
3491 return err;
3492
3493 return 0;
3494 }
3495
3496 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3497 {
3498 return sk_alloc_security(sk, family, priority);
3499 }
3500
3501 static void selinux_sk_free_security(struct sock *sk)
3502 {
3503 sk_free_security(sk);
3504 }
3505
3506 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3507 {
3508 struct inode_security_struct *isec;
3509 u32 sock_sid = SECINITSID_ANY_SOCKET;
3510
3511 if (!sk)
3512 return selinux_no_sk_sid(fl);
3513
3514 read_lock_bh(&sk->sk_callback_lock);
3515 isec = get_sock_isec(sk);
3516
3517 if (isec)
3518 sock_sid = isec->sid;
3519
3520 read_unlock_bh(&sk->sk_callback_lock);
3521 return sock_sid;
3522 }
3523
3524 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3525 {
3526 int err = 0;
3527 u32 perm;
3528 struct nlmsghdr *nlh;
3529 struct socket *sock = sk->sk_socket;
3530 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3531
3532 if (skb->len < NLMSG_SPACE(0)) {
3533 err = -EINVAL;
3534 goto out;
3535 }
3536 nlh = (struct nlmsghdr *)skb->data;
3537
3538 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3539 if (err) {
3540 if (err == -EINVAL) {
3541 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3542 "SELinux: unrecognized netlink message"
3543 " type=%hu for sclass=%hu\n",
3544 nlh->nlmsg_type, isec->sclass);
3545 if (!selinux_enforcing)
3546 err = 0;
3547 }
3548
3549 /* Ignore */
3550 if (err == -ENOENT)
3551 err = 0;
3552 goto out;
3553 }
3554
3555 err = socket_has_perm(current, sock, perm);
3556 out:
3557 return err;
3558 }
3559
3560 #ifdef CONFIG_NETFILTER
3561
3562 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3563 struct inode_security_struct *isec,
3564 struct avc_audit_data *ad,
3565 u16 family, char *addrp, int len)
3566 {
3567 int err;
3568 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3569
3570 err = sel_netif_sids(dev, &if_sid, NULL);
3571 if (err)
3572 goto out;
3573
3574 switch (isec->sclass) {
3575 case SECCLASS_UDP_SOCKET:
3576 netif_perm = NETIF__UDP_SEND;
3577 node_perm = NODE__UDP_SEND;
3578 send_perm = UDP_SOCKET__SEND_MSG;
3579 break;
3580
3581 case SECCLASS_TCP_SOCKET:
3582 netif_perm = NETIF__TCP_SEND;
3583 node_perm = NODE__TCP_SEND;
3584 send_perm = TCP_SOCKET__SEND_MSG;
3585 break;
3586
3587 default:
3588 netif_perm = NETIF__RAWIP_SEND;
3589 node_perm = NODE__RAWIP_SEND;
3590 break;
3591 }
3592
3593 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3594 if (err)
3595 goto out;
3596
3597 err = security_node_sid(family, addrp, len, &node_sid);
3598 if (err)
3599 goto out;
3600
3601 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3602 if (err)
3603 goto out;
3604
3605 if (send_perm) {
3606 u32 port_sid;
3607
3608 err = security_port_sid(sk->sk_family,
3609 sk->sk_type,
3610 sk->sk_protocol,
3611 ntohs(ad->u.net.dport),
3612 &port_sid);
3613 if (err)
3614 goto out;
3615
3616 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3617 send_perm, ad);
3618 }
3619 out:
3620 return err;
3621 }
3622
3623 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3624 struct sk_buff **pskb,
3625 const struct net_device *in,
3626 const struct net_device *out,
3627 int (*okfn)(struct sk_buff *),
3628 u16 family)
3629 {
3630 char *addrp;
3631 int len, err = 0;
3632 struct sock *sk;
3633 struct socket *sock;
3634 struct inode *inode;
3635 struct sk_buff *skb = *pskb;
3636 struct inode_security_struct *isec;
3637 struct avc_audit_data ad;
3638 struct net_device *dev = (struct net_device *)out;
3639
3640 sk = skb->sk;
3641 if (!sk)
3642 goto out;
3643
3644 sock = sk->sk_socket;
3645 if (!sock)
3646 goto out;
3647
3648 inode = SOCK_INODE(sock);
3649 if (!inode)
3650 goto out;
3651
3652 isec = inode->i_security;
3653
3654 AVC_AUDIT_DATA_INIT(&ad, NET);
3655 ad.u.net.netif = dev->name;
3656 ad.u.net.family = family;
3657
3658 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3659 if (err)
3660 goto out;
3661
3662 if (selinux_compat_net)
3663 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3664 family, addrp, len);
3665 else
3666 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3667 PACKET__SEND, &ad);
3668
3669 if (err)
3670 goto out;
3671
3672 err = selinux_xfrm_postroute_last(isec->sid, skb);
3673 out:
3674 return err ? NF_DROP : NF_ACCEPT;
3675 }
3676
3677 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3678 struct sk_buff **pskb,
3679 const struct net_device *in,
3680 const struct net_device *out,
3681 int (*okfn)(struct sk_buff *))
3682 {
3683 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3684 }
3685
3686 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3687
3688 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3689 struct sk_buff **pskb,
3690 const struct net_device *in,
3691 const struct net_device *out,
3692 int (*okfn)(struct sk_buff *))
3693 {
3694 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3695 }
3696
3697 #endif /* IPV6 */
3698
3699 #endif /* CONFIG_NETFILTER */
3700
3701 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3702 {
3703 int err;
3704
3705 err = secondary_ops->netlink_send(sk, skb);
3706 if (err)
3707 return err;
3708
3709 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3710 err = selinux_nlmsg_perm(sk, skb);
3711
3712 return err;
3713 }
3714
3715 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3716 {
3717 int err;
3718 struct avc_audit_data ad;
3719
3720 err = secondary_ops->netlink_recv(skb, capability);
3721 if (err)
3722 return err;
3723
3724 AVC_AUDIT_DATA_INIT(&ad, CAP);
3725 ad.u.cap = capability;
3726
3727 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3728 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3729 }
3730
3731 static int ipc_alloc_security(struct task_struct *task,
3732 struct kern_ipc_perm *perm,
3733 u16 sclass)
3734 {
3735 struct task_security_struct *tsec = task->security;
3736 struct ipc_security_struct *isec;
3737
3738 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3739 if (!isec)
3740 return -ENOMEM;
3741
3742 isec->sclass = sclass;
3743 isec->ipc_perm = perm;
3744 isec->sid = tsec->sid;
3745 perm->security = isec;
3746
3747 return 0;
3748 }
3749
3750 static void ipc_free_security(struct kern_ipc_perm *perm)
3751 {
3752 struct ipc_security_struct *isec = perm->security;
3753 perm->security = NULL;
3754 kfree(isec);
3755 }
3756
3757 static int msg_msg_alloc_security(struct msg_msg *msg)
3758 {
3759 struct msg_security_struct *msec;
3760
3761 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3762 if (!msec)
3763 return -ENOMEM;
3764
3765 msec->msg = msg;
3766 msec->sid = SECINITSID_UNLABELED;
3767 msg->security = msec;
3768
3769 return 0;
3770 }
3771
3772 static void msg_msg_free_security(struct msg_msg *msg)
3773 {
3774 struct msg_security_struct *msec = msg->security;
3775
3776 msg->security = NULL;
3777 kfree(msec);
3778 }
3779
3780 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3781 u32 perms)
3782 {
3783 struct task_security_struct *tsec;
3784 struct ipc_security_struct *isec;
3785 struct avc_audit_data ad;
3786
3787 tsec = current->security;
3788 isec = ipc_perms->security;
3789
3790 AVC_AUDIT_DATA_INIT(&ad, IPC);
3791 ad.u.ipc_id = ipc_perms->key;
3792
3793 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3794 }
3795
3796 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3797 {
3798 return msg_msg_alloc_security(msg);
3799 }
3800
3801 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3802 {
3803 msg_msg_free_security(msg);
3804 }
3805
3806 /* message queue security operations */
3807 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3808 {
3809 struct task_security_struct *tsec;
3810 struct ipc_security_struct *isec;
3811 struct avc_audit_data ad;
3812 int rc;
3813
3814 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3815 if (rc)
3816 return rc;
3817
3818 tsec = current->security;
3819 isec = msq->q_perm.security;
3820
3821 AVC_AUDIT_DATA_INIT(&ad, IPC);
3822 ad.u.ipc_id = msq->q_perm.key;
3823
3824 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3825 MSGQ__CREATE, &ad);
3826 if (rc) {
3827 ipc_free_security(&msq->q_perm);
3828 return rc;
3829 }
3830 return 0;
3831 }
3832
3833 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3834 {
3835 ipc_free_security(&msq->q_perm);
3836 }
3837
3838 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3839 {
3840 struct task_security_struct *tsec;
3841 struct ipc_security_struct *isec;
3842 struct avc_audit_data ad;
3843
3844 tsec = current->security;
3845 isec = msq->q_perm.security;
3846
3847 AVC_AUDIT_DATA_INIT(&ad, IPC);
3848 ad.u.ipc_id = msq->q_perm.key;
3849
3850 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3851 MSGQ__ASSOCIATE, &ad);
3852 }
3853
3854 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3855 {
3856 int err;
3857 int perms;
3858
3859 switch(cmd) {
3860 case IPC_INFO:
3861 case MSG_INFO:
3862 /* No specific object, just general system-wide information. */
3863 return task_has_system(current, SYSTEM__IPC_INFO);
3864 case IPC_STAT:
3865 case MSG_STAT:
3866 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3867 break;
3868 case IPC_SET:
3869 perms = MSGQ__SETATTR;
3870 break;
3871 case IPC_RMID:
3872 perms = MSGQ__DESTROY;
3873 break;
3874 default:
3875 return 0;
3876 }
3877
3878 err = ipc_has_perm(&msq->q_perm, perms);
3879 return err;
3880 }
3881
3882 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3883 {
3884 struct task_security_struct *tsec;
3885 struct ipc_security_struct *isec;
3886 struct msg_security_struct *msec;
3887 struct avc_audit_data ad;
3888 int rc;
3889
3890 tsec = current->security;
3891 isec = msq->q_perm.security;
3892 msec = msg->security;
3893
3894 /*
3895 * First time through, need to assign label to the message
3896 */
3897 if (msec->sid == SECINITSID_UNLABELED) {
3898 /*
3899 * Compute new sid based on current process and
3900 * message queue this message will be stored in
3901 */
3902 rc = security_transition_sid(tsec->sid,
3903 isec->sid,
3904 SECCLASS_MSG,
3905 &msec->sid);
3906 if (rc)
3907 return rc;
3908 }
3909
3910 AVC_AUDIT_DATA_INIT(&ad, IPC);
3911 ad.u.ipc_id = msq->q_perm.key;
3912
3913 /* Can this process write to the queue? */
3914 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3915 MSGQ__WRITE, &ad);
3916 if (!rc)
3917 /* Can this process send the message */
3918 rc = avc_has_perm(tsec->sid, msec->sid,
3919 SECCLASS_MSG, MSG__SEND, &ad);
3920 if (!rc)
3921 /* Can the message be put in the queue? */
3922 rc = avc_has_perm(msec->sid, isec->sid,
3923 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3924
3925 return rc;
3926 }
3927
3928 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3929 struct task_struct *target,
3930 long type, int mode)
3931 {
3932 struct task_security_struct *tsec;
3933 struct ipc_security_struct *isec;
3934 struct msg_security_struct *msec;
3935 struct avc_audit_data ad;
3936 int rc;
3937
3938 tsec = target->security;
3939 isec = msq->q_perm.security;
3940 msec = msg->security;
3941
3942 AVC_AUDIT_DATA_INIT(&ad, IPC);
3943 ad.u.ipc_id = msq->q_perm.key;
3944
3945 rc = avc_has_perm(tsec->sid, isec->sid,
3946 SECCLASS_MSGQ, MSGQ__READ, &ad);
3947 if (!rc)
3948 rc = avc_has_perm(tsec->sid, msec->sid,
3949 SECCLASS_MSG, MSG__RECEIVE, &ad);
3950 return rc;
3951 }
3952
3953 /* Shared Memory security operations */
3954 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3955 {
3956 struct task_security_struct *tsec;
3957 struct ipc_security_struct *isec;
3958 struct avc_audit_data ad;
3959 int rc;
3960
3961 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3962 if (rc)
3963 return rc;
3964
3965 tsec = current->security;
3966 isec = shp->shm_perm.security;
3967
3968 AVC_AUDIT_DATA_INIT(&ad, IPC);
3969 ad.u.ipc_id = shp->shm_perm.key;
3970
3971 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3972 SHM__CREATE, &ad);
3973 if (rc) {
3974 ipc_free_security(&shp->shm_perm);
3975 return rc;
3976 }
3977 return 0;
3978 }
3979
3980 static void selinux_shm_free_security(struct shmid_kernel *shp)
3981 {
3982 ipc_free_security(&shp->shm_perm);
3983 }
3984
3985 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3986 {
3987 struct task_security_struct *tsec;
3988 struct ipc_security_struct *isec;
3989 struct avc_audit_data ad;
3990
3991 tsec = current->security;
3992 isec = shp->shm_perm.security;
3993
3994 AVC_AUDIT_DATA_INIT(&ad, IPC);
3995 ad.u.ipc_id = shp->shm_perm.key;
3996
3997 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3998 SHM__ASSOCIATE, &ad);
3999 }
4000
4001 /* Note, at this point, shp is locked down */
4002 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4003 {
4004 int perms;
4005 int err;
4006
4007 switch(cmd) {
4008 case IPC_INFO:
4009 case SHM_INFO:
4010 /* No specific object, just general system-wide information. */
4011 return task_has_system(current, SYSTEM__IPC_INFO);
4012 case IPC_STAT:
4013 case SHM_STAT:
4014 perms = SHM__GETATTR | SHM__ASSOCIATE;
4015 break;
4016 case IPC_SET:
4017 perms = SHM__SETATTR;
4018 break;
4019 case SHM_LOCK:
4020 case SHM_UNLOCK:
4021 perms = SHM__LOCK;
4022 break;
4023 case IPC_RMID:
4024 perms = SHM__DESTROY;
4025 break;
4026 default:
4027 return 0;
4028 }
4029
4030 err = ipc_has_perm(&shp->shm_perm, perms);
4031 return err;
4032 }
4033
4034 static int selinux_shm_shmat(struct shmid_kernel *shp,
4035 char __user *shmaddr, int shmflg)
4036 {
4037 u32 perms;
4038 int rc;
4039
4040 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4041 if (rc)
4042 return rc;
4043
4044 if (shmflg & SHM_RDONLY)
4045 perms = SHM__READ;
4046 else
4047 perms = SHM__READ | SHM__WRITE;
4048
4049 return ipc_has_perm(&shp->shm_perm, perms);
4050 }
4051
4052 /* Semaphore security operations */
4053 static int selinux_sem_alloc_security(struct sem_array *sma)
4054 {
4055 struct task_security_struct *tsec;
4056 struct ipc_security_struct *isec;
4057 struct avc_audit_data ad;
4058 int rc;
4059
4060 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4061 if (rc)
4062 return rc;
4063
4064 tsec = current->security;
4065 isec = sma->sem_perm.security;
4066
4067 AVC_AUDIT_DATA_INIT(&ad, IPC);
4068 ad.u.ipc_id = sma->sem_perm.key;
4069
4070 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4071 SEM__CREATE, &ad);
4072 if (rc) {
4073 ipc_free_security(&sma->sem_perm);
4074 return rc;
4075 }
4076 return 0;
4077 }
4078
4079 static void selinux_sem_free_security(struct sem_array *sma)
4080 {
4081 ipc_free_security(&sma->sem_perm);
4082 }
4083
4084 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4085 {
4086 struct task_security_struct *tsec;
4087 struct ipc_security_struct *isec;
4088 struct avc_audit_data ad;
4089
4090 tsec = current->security;
4091 isec = sma->sem_perm.security;
4092
4093 AVC_AUDIT_DATA_INIT(&ad, IPC);
4094 ad.u.ipc_id = sma->sem_perm.key;
4095
4096 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4097 SEM__ASSOCIATE, &ad);
4098 }
4099
4100 /* Note, at this point, sma is locked down */
4101 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4102 {
4103 int err;
4104 u32 perms;
4105
4106 switch(cmd) {
4107 case IPC_INFO:
4108 case SEM_INFO:
4109 /* No specific object, just general system-wide information. */
4110 return task_has_system(current, SYSTEM__IPC_INFO);
4111 case GETPID:
4112 case GETNCNT:
4113 case GETZCNT:
4114 perms = SEM__GETATTR;
4115 break;
4116 case GETVAL:
4117 case GETALL:
4118 perms = SEM__READ;
4119 break;
4120 case SETVAL:
4121 case SETALL:
4122 perms = SEM__WRITE;
4123 break;
4124 case IPC_RMID:
4125 perms = SEM__DESTROY;
4126 break;
4127 case IPC_SET:
4128 perms = SEM__SETATTR;
4129 break;
4130 case IPC_STAT:
4131 case SEM_STAT:
4132 perms = SEM__GETATTR | SEM__ASSOCIATE;
4133 break;
4134 default:
4135 return 0;
4136 }
4137
4138 err = ipc_has_perm(&sma->sem_perm, perms);
4139 return err;
4140 }
4141
4142 static int selinux_sem_semop(struct sem_array *sma,
4143 struct sembuf *sops, unsigned nsops, int alter)
4144 {
4145 u32 perms;
4146
4147 if (alter)
4148 perms = SEM__READ | SEM__WRITE;
4149 else
4150 perms = SEM__READ;
4151
4152 return ipc_has_perm(&sma->sem_perm, perms);
4153 }
4154
4155 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4156 {
4157 u32 av = 0;
4158
4159 av = 0;
4160 if (flag & S_IRUGO)
4161 av |= IPC__UNIX_READ;
4162 if (flag & S_IWUGO)
4163 av |= IPC__UNIX_WRITE;
4164
4165 if (av == 0)
4166 return 0;
4167
4168 return ipc_has_perm(ipcp, av);
4169 }
4170
4171 /* module stacking operations */
4172 static int selinux_register_security (const char *name, struct security_operations *ops)
4173 {
4174 if (secondary_ops != original_ops) {
4175 printk(KERN_INFO "%s: There is already a secondary security "
4176 "module registered.\n", __FUNCTION__);
4177 return -EINVAL;
4178 }
4179
4180 secondary_ops = ops;
4181
4182 printk(KERN_INFO "%s: Registering secondary module %s\n",
4183 __FUNCTION__,
4184 name);
4185
4186 return 0;
4187 }
4188
4189 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4190 {
4191 if (ops != secondary_ops) {
4192 printk (KERN_INFO "%s: trying to unregister a security module "
4193 "that is not registered.\n", __FUNCTION__);
4194 return -EINVAL;
4195 }
4196
4197 secondary_ops = original_ops;
4198
4199 return 0;
4200 }
4201
4202 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4203 {
4204 if (inode)
4205 inode_doinit_with_dentry(inode, dentry);
4206 }
4207
4208 static int selinux_getprocattr(struct task_struct *p,
4209 char *name, void *value, size_t size)
4210 {
4211 struct task_security_struct *tsec;
4212 u32 sid;
4213 int error;
4214
4215 if (current != p) {
4216 error = task_has_perm(current, p, PROCESS__GETATTR);
4217 if (error)
4218 return error;
4219 }
4220
4221 tsec = p->security;
4222
4223 if (!strcmp(name, "current"))
4224 sid = tsec->sid;
4225 else if (!strcmp(name, "prev"))
4226 sid = tsec->osid;
4227 else if (!strcmp(name, "exec"))
4228 sid = tsec->exec_sid;
4229 else if (!strcmp(name, "fscreate"))
4230 sid = tsec->create_sid;
4231 else if (!strcmp(name, "keycreate"))
4232 sid = tsec->keycreate_sid;
4233 else if (!strcmp(name, "sockcreate"))
4234 sid = tsec->sockcreate_sid;
4235 else
4236 return -EINVAL;
4237
4238 if (!sid)
4239 return 0;
4240
4241 return selinux_getsecurity(sid, value, size);
4242 }
4243
4244 static int selinux_setprocattr(struct task_struct *p,
4245 char *name, void *value, size_t size)
4246 {
4247 struct task_security_struct *tsec;
4248 u32 sid = 0;
4249 int error;
4250 char *str = value;
4251
4252 if (current != p) {
4253 /* SELinux only allows a process to change its own
4254 security attributes. */
4255 return -EACCES;
4256 }
4257
4258 /*
4259 * Basic control over ability to set these attributes at all.
4260 * current == p, but we'll pass them separately in case the
4261 * above restriction is ever removed.
4262 */
4263 if (!strcmp(name, "exec"))
4264 error = task_has_perm(current, p, PROCESS__SETEXEC);
4265 else if (!strcmp(name, "fscreate"))
4266 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4267 else if (!strcmp(name, "keycreate"))
4268 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4269 else if (!strcmp(name, "sockcreate"))
4270 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4271 else if (!strcmp(name, "current"))
4272 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4273 else
4274 error = -EINVAL;
4275 if (error)
4276 return error;
4277
4278 /* Obtain a SID for the context, if one was specified. */
4279 if (size && str[1] && str[1] != '\n') {
4280 if (str[size-1] == '\n') {
4281 str[size-1] = 0;
4282 size--;
4283 }
4284 error = security_context_to_sid(value, size, &sid);
4285 if (error)
4286 return error;
4287 }
4288
4289 /* Permission checking based on the specified context is
4290 performed during the actual operation (execve,
4291 open/mkdir/...), when we know the full context of the
4292 operation. See selinux_bprm_set_security for the execve
4293 checks and may_create for the file creation checks. The
4294 operation will then fail if the context is not permitted. */
4295 tsec = p->security;
4296 if (!strcmp(name, "exec"))
4297 tsec->exec_sid = sid;
4298 else if (!strcmp(name, "fscreate"))
4299 tsec->create_sid = sid;
4300 else if (!strcmp(name, "keycreate")) {
4301 error = may_create_key(sid, p);
4302 if (error)
4303 return error;
4304 tsec->keycreate_sid = sid;
4305 } else if (!strcmp(name, "sockcreate"))
4306 tsec->sockcreate_sid = sid;
4307 else if (!strcmp(name, "current")) {
4308 struct av_decision avd;
4309
4310 if (sid == 0)
4311 return -EINVAL;
4312
4313 /* Only allow single threaded processes to change context */
4314 if (atomic_read(&p->mm->mm_users) != 1) {
4315 struct task_struct *g, *t;
4316 struct mm_struct *mm = p->mm;
4317 read_lock(&tasklist_lock);
4318 do_each_thread(g, t)
4319 if (t->mm == mm && t != p) {
4320 read_unlock(&tasklist_lock);
4321 return -EPERM;
4322 }
4323 while_each_thread(g, t);
4324 read_unlock(&tasklist_lock);
4325 }
4326
4327 /* Check permissions for the transition. */
4328 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4329 PROCESS__DYNTRANSITION, NULL);
4330 if (error)
4331 return error;
4332
4333 /* Check for ptracing, and update the task SID if ok.
4334 Otherwise, leave SID unchanged and fail. */
4335 task_lock(p);
4336 if (p->ptrace & PT_PTRACED) {
4337 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4338 SECCLASS_PROCESS,
4339 PROCESS__PTRACE, &avd);
4340 if (!error)
4341 tsec->sid = sid;
4342 task_unlock(p);
4343 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4344 PROCESS__PTRACE, &avd, error, NULL);
4345 if (error)
4346 return error;
4347 } else {
4348 tsec->sid = sid;
4349 task_unlock(p);
4350 }
4351 }
4352 else
4353 return -EINVAL;
4354
4355 return size;
4356 }
4357
4358 #ifdef CONFIG_KEYS
4359
4360 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4361 unsigned long flags)
4362 {
4363 struct task_security_struct *tsec = tsk->security;
4364 struct key_security_struct *ksec;
4365
4366 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4367 if (!ksec)
4368 return -ENOMEM;
4369
4370 ksec->obj = k;
4371 if (tsec->keycreate_sid)
4372 ksec->sid = tsec->keycreate_sid;
4373 else
4374 ksec->sid = tsec->sid;
4375 k->security = ksec;
4376
4377 return 0;
4378 }
4379
4380 static void selinux_key_free(struct key *k)
4381 {
4382 struct key_security_struct *ksec = k->security;
4383
4384 k->security = NULL;
4385 kfree(ksec);
4386 }
4387
4388 static int selinux_key_permission(key_ref_t key_ref,
4389 struct task_struct *ctx,
4390 key_perm_t perm)
4391 {
4392 struct key *key;
4393 struct task_security_struct *tsec;
4394 struct key_security_struct *ksec;
4395
4396 key = key_ref_to_ptr(key_ref);
4397
4398 tsec = ctx->security;
4399 ksec = key->security;
4400
4401 /* if no specific permissions are requested, we skip the
4402 permission check. No serious, additional covert channels
4403 appear to be created. */
4404 if (perm == 0)
4405 return 0;
4406
4407 return avc_has_perm(tsec->sid, ksec->sid,
4408 SECCLASS_KEY, perm, NULL);
4409 }
4410
4411 #endif
4412
4413 static struct security_operations selinux_ops = {
4414 .ptrace = selinux_ptrace,
4415 .capget = selinux_capget,
4416 .capset_check = selinux_capset_check,
4417 .capset_set = selinux_capset_set,
4418 .sysctl = selinux_sysctl,
4419 .capable = selinux_capable,
4420 .quotactl = selinux_quotactl,
4421 .quota_on = selinux_quota_on,
4422 .syslog = selinux_syslog,
4423 .vm_enough_memory = selinux_vm_enough_memory,
4424
4425 .netlink_send = selinux_netlink_send,
4426 .netlink_recv = selinux_netlink_recv,
4427
4428 .bprm_alloc_security = selinux_bprm_alloc_security,
4429 .bprm_free_security = selinux_bprm_free_security,
4430 .bprm_apply_creds = selinux_bprm_apply_creds,
4431 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4432 .bprm_set_security = selinux_bprm_set_security,
4433 .bprm_check_security = selinux_bprm_check_security,
4434 .bprm_secureexec = selinux_bprm_secureexec,
4435
4436 .sb_alloc_security = selinux_sb_alloc_security,
4437 .sb_free_security = selinux_sb_free_security,
4438 .sb_copy_data = selinux_sb_copy_data,
4439 .sb_kern_mount = selinux_sb_kern_mount,
4440 .sb_statfs = selinux_sb_statfs,
4441 .sb_mount = selinux_mount,
4442 .sb_umount = selinux_umount,
4443
4444 .inode_alloc_security = selinux_inode_alloc_security,
4445 .inode_free_security = selinux_inode_free_security,
4446 .inode_init_security = selinux_inode_init_security,
4447 .inode_create = selinux_inode_create,
4448 .inode_link = selinux_inode_link,
4449 .inode_unlink = selinux_inode_unlink,
4450 .inode_symlink = selinux_inode_symlink,
4451 .inode_mkdir = selinux_inode_mkdir,
4452 .inode_rmdir = selinux_inode_rmdir,
4453 .inode_mknod = selinux_inode_mknod,
4454 .inode_rename = selinux_inode_rename,
4455 .inode_readlink = selinux_inode_readlink,
4456 .inode_follow_link = selinux_inode_follow_link,
4457 .inode_permission = selinux_inode_permission,
4458 .inode_setattr = selinux_inode_setattr,
4459 .inode_getattr = selinux_inode_getattr,
4460 .inode_setxattr = selinux_inode_setxattr,
4461 .inode_post_setxattr = selinux_inode_post_setxattr,
4462 .inode_getxattr = selinux_inode_getxattr,
4463 .inode_listxattr = selinux_inode_listxattr,
4464 .inode_removexattr = selinux_inode_removexattr,
4465 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4466 .inode_getsecurity = selinux_inode_getsecurity,
4467 .inode_setsecurity = selinux_inode_setsecurity,
4468 .inode_listsecurity = selinux_inode_listsecurity,
4469
4470 .file_permission = selinux_file_permission,
4471 .file_alloc_security = selinux_file_alloc_security,
4472 .file_free_security = selinux_file_free_security,
4473 .file_ioctl = selinux_file_ioctl,
4474 .file_mmap = selinux_file_mmap,
4475 .file_mprotect = selinux_file_mprotect,
4476 .file_lock = selinux_file_lock,
4477 .file_fcntl = selinux_file_fcntl,
4478 .file_set_fowner = selinux_file_set_fowner,
4479 .file_send_sigiotask = selinux_file_send_sigiotask,
4480 .file_receive = selinux_file_receive,
4481
4482 .task_create = selinux_task_create,
4483 .task_alloc_security = selinux_task_alloc_security,
4484 .task_free_security = selinux_task_free_security,
4485 .task_setuid = selinux_task_setuid,
4486 .task_post_setuid = selinux_task_post_setuid,
4487 .task_setgid = selinux_task_setgid,
4488 .task_setpgid = selinux_task_setpgid,
4489 .task_getpgid = selinux_task_getpgid,
4490 .task_getsid = selinux_task_getsid,
4491 .task_getsecid = selinux_task_getsecid,
4492 .task_setgroups = selinux_task_setgroups,
4493 .task_setnice = selinux_task_setnice,
4494 .task_setioprio = selinux_task_setioprio,
4495 .task_getioprio = selinux_task_getioprio,
4496 .task_setrlimit = selinux_task_setrlimit,
4497 .task_setscheduler = selinux_task_setscheduler,
4498 .task_getscheduler = selinux_task_getscheduler,
4499 .task_movememory = selinux_task_movememory,
4500 .task_kill = selinux_task_kill,
4501 .task_wait = selinux_task_wait,
4502 .task_prctl = selinux_task_prctl,
4503 .task_reparent_to_init = selinux_task_reparent_to_init,
4504 .task_to_inode = selinux_task_to_inode,
4505
4506 .ipc_permission = selinux_ipc_permission,
4507
4508 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4509 .msg_msg_free_security = selinux_msg_msg_free_security,
4510
4511 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4512 .msg_queue_free_security = selinux_msg_queue_free_security,
4513 .msg_queue_associate = selinux_msg_queue_associate,
4514 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4515 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4516 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4517
4518 .shm_alloc_security = selinux_shm_alloc_security,
4519 .shm_free_security = selinux_shm_free_security,
4520 .shm_associate = selinux_shm_associate,
4521 .shm_shmctl = selinux_shm_shmctl,
4522 .shm_shmat = selinux_shm_shmat,
4523
4524 .sem_alloc_security = selinux_sem_alloc_security,
4525 .sem_free_security = selinux_sem_free_security,
4526 .sem_associate = selinux_sem_associate,
4527 .sem_semctl = selinux_sem_semctl,
4528 .sem_semop = selinux_sem_semop,
4529
4530 .register_security = selinux_register_security,
4531 .unregister_security = selinux_unregister_security,
4532
4533 .d_instantiate = selinux_d_instantiate,
4534
4535 .getprocattr = selinux_getprocattr,
4536 .setprocattr = selinux_setprocattr,
4537
4538 .unix_stream_connect = selinux_socket_unix_stream_connect,
4539 .unix_may_send = selinux_socket_unix_may_send,
4540
4541 .socket_create = selinux_socket_create,
4542 .socket_post_create = selinux_socket_post_create,
4543 .socket_bind = selinux_socket_bind,
4544 .socket_connect = selinux_socket_connect,
4545 .socket_listen = selinux_socket_listen,
4546 .socket_accept = selinux_socket_accept,
4547 .socket_sendmsg = selinux_socket_sendmsg,
4548 .socket_recvmsg = selinux_socket_recvmsg,
4549 .socket_getsockname = selinux_socket_getsockname,
4550 .socket_getpeername = selinux_socket_getpeername,
4551 .socket_getsockopt = selinux_socket_getsockopt,
4552 .socket_setsockopt = selinux_socket_setsockopt,
4553 .socket_shutdown = selinux_socket_shutdown,
4554 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4555 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4556 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4557 .sk_alloc_security = selinux_sk_alloc_security,
4558 .sk_free_security = selinux_sk_free_security,
4559 .sk_getsid = selinux_sk_getsid_security,
4560
4561 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4562 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4563 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4564 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4565 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4566 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4567 .xfrm_state_free_security = selinux_xfrm_state_free,
4568 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4569 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4570 #endif
4571
4572 #ifdef CONFIG_KEYS
4573 .key_alloc = selinux_key_alloc,
4574 .key_free = selinux_key_free,
4575 .key_permission = selinux_key_permission,
4576 #endif
4577 };
4578
4579 static __init int selinux_init(void)
4580 {
4581 struct task_security_struct *tsec;
4582
4583 if (!selinux_enabled) {
4584 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4585 return 0;
4586 }
4587
4588 printk(KERN_INFO "SELinux: Initializing.\n");
4589
4590 /* Set the security state for the initial task. */
4591 if (task_alloc_security(current))
4592 panic("SELinux: Failed to initialize initial task.\n");
4593 tsec = current->security;
4594 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4595
4596 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4597 sizeof(struct inode_security_struct),
4598 0, SLAB_PANIC, NULL, NULL);
4599 avc_init();
4600
4601 original_ops = secondary_ops = security_ops;
4602 if (!secondary_ops)
4603 panic ("SELinux: No initial security operations\n");
4604 if (register_security (&selinux_ops))
4605 panic("SELinux: Unable to register with kernel.\n");
4606
4607 if (selinux_enforcing) {
4608 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4609 } else {
4610 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4611 }
4612
4613 #ifdef CONFIG_KEYS
4614 /* Add security information to initial keyrings */
4615 selinux_key_alloc(&root_user_keyring, current,
4616 KEY_ALLOC_NOT_IN_QUOTA);
4617 selinux_key_alloc(&root_session_keyring, current,
4618 KEY_ALLOC_NOT_IN_QUOTA);
4619 #endif
4620
4621 return 0;
4622 }
4623
4624 void selinux_complete_init(void)
4625 {
4626 printk(KERN_INFO "SELinux: Completing initialization.\n");
4627
4628 /* Set up any superblocks initialized prior to the policy load. */
4629 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4630 spin_lock(&sb_lock);
4631 spin_lock(&sb_security_lock);
4632 next_sb:
4633 if (!list_empty(&superblock_security_head)) {
4634 struct superblock_security_struct *sbsec =
4635 list_entry(superblock_security_head.next,
4636 struct superblock_security_struct,
4637 list);
4638 struct super_block *sb = sbsec->sb;
4639 sb->s_count++;
4640 spin_unlock(&sb_security_lock);
4641 spin_unlock(&sb_lock);
4642 down_read(&sb->s_umount);
4643 if (sb->s_root)
4644 superblock_doinit(sb, NULL);
4645 drop_super(sb);
4646 spin_lock(&sb_lock);
4647 spin_lock(&sb_security_lock);
4648 list_del_init(&sbsec->list);
4649 goto next_sb;
4650 }
4651 spin_unlock(&sb_security_lock);
4652 spin_unlock(&sb_lock);
4653 }
4654
4655 /* SELinux requires early initialization in order to label
4656 all processes and objects when they are created. */
4657 security_initcall(selinux_init);
4658
4659 #if defined(CONFIG_NETFILTER)
4660
4661 static struct nf_hook_ops selinux_ipv4_op = {
4662 .hook = selinux_ipv4_postroute_last,
4663 .owner = THIS_MODULE,
4664 .pf = PF_INET,
4665 .hooknum = NF_IP_POST_ROUTING,
4666 .priority = NF_IP_PRI_SELINUX_LAST,
4667 };
4668
4669 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4670
4671 static struct nf_hook_ops selinux_ipv6_op = {
4672 .hook = selinux_ipv6_postroute_last,
4673 .owner = THIS_MODULE,
4674 .pf = PF_INET6,
4675 .hooknum = NF_IP6_POST_ROUTING,
4676 .priority = NF_IP6_PRI_SELINUX_LAST,
4677 };
4678
4679 #endif /* IPV6 */
4680
4681 static int __init selinux_nf_ip_init(void)
4682 {
4683 int err = 0;
4684
4685 if (!selinux_enabled)
4686 goto out;
4687
4688 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4689
4690 err = nf_register_hook(&selinux_ipv4_op);
4691 if (err)
4692 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4693
4694 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4695
4696 err = nf_register_hook(&selinux_ipv6_op);
4697 if (err)
4698 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4699
4700 #endif /* IPV6 */
4701
4702 out:
4703 return err;
4704 }
4705
4706 __initcall(selinux_nf_ip_init);
4707
4708 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4709 static void selinux_nf_ip_exit(void)
4710 {
4711 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4712
4713 nf_unregister_hook(&selinux_ipv4_op);
4714 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4715 nf_unregister_hook(&selinux_ipv6_op);
4716 #endif /* IPV6 */
4717 }
4718 #endif
4719
4720 #else /* CONFIG_NETFILTER */
4721
4722 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4723 #define selinux_nf_ip_exit()
4724 #endif
4725
4726 #endif /* CONFIG_NETFILTER */
4727
4728 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4729 int selinux_disable(void)
4730 {
4731 extern void exit_sel_fs(void);
4732 static int selinux_disabled = 0;
4733
4734 if (ss_initialized) {
4735 /* Not permitted after initial policy load. */
4736 return -EINVAL;
4737 }
4738
4739 if (selinux_disabled) {
4740 /* Only do this once. */
4741 return -EINVAL;
4742 }
4743
4744 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4745
4746 selinux_disabled = 1;
4747 selinux_enabled = 0;
4748
4749 /* Reset security_ops to the secondary module, dummy or capability. */
4750 security_ops = secondary_ops;
4751
4752 /* Unregister netfilter hooks. */
4753 selinux_nf_ip_exit();
4754
4755 /* Unregister selinuxfs. */
4756 exit_sel_fs();
4757
4758 return 0;
4759 }
4760 #endif
4761
4762
Ubuntu Jammy Linux kernel mirror