]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-artful-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'nfs-for-4.12-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs
[mirror_ubuntu-artful-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched/signal.h>
32 #include <linux/sched/task.h>
33 #include <linux/lsm_hooks.h>
34 #include <linux/xattr.h>
35 #include <linux/capability.h>
36 #include <linux/unistd.h>
37 #include <linux/mm.h>
38 #include <linux/mman.h>
39 #include <linux/slab.h>
40 #include <linux/pagemap.h>
41 #include <linux/proc_fs.h>
42 #include <linux/swap.h>
43 #include <linux/spinlock.h>
44 #include <linux/syscalls.h>
45 #include <linux/dcache.h>
46 #include <linux/file.h>
47 #include <linux/fdtable.h>
48 #include <linux/namei.h>
49 #include <linux/mount.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
53 #include <net/icmp.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 /* SECMARK reference count */
99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
103
104 static int __init enforcing_setup(char *str)
105 {
106 unsigned long enforcing;
107 if (!kstrtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
109 return 1;
110 }
111 __setup("enforcing=", enforcing_setup);
112 #endif
113
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117 static int __init selinux_enabled_setup(char *str)
118 {
119 unsigned long enabled;
120 if (!kstrtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
122 return 1;
123 }
124 __setup("selinux=", selinux_enabled_setup);
125 #else
126 int selinux_enabled = 1;
127 #endif
128
129 static struct kmem_cache *sel_inode_cache;
130 static struct kmem_cache *file_security_cache;
131
132 /**
133 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
134 *
135 * Description:
136 * This function checks the SECMARK reference counter to see if any SECMARK
137 * targets are currently configured, if the reference counter is greater than
138 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
139 * enabled, false (0) if SECMARK is disabled. If the always_check_network
140 * policy capability is enabled, SECMARK is always considered enabled.
141 *
142 */
143 static int selinux_secmark_enabled(void)
144 {
145 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
146 }
147
148 /**
149 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
150 *
151 * Description:
152 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
153 * (1) if any are enabled or false (0) if neither are enabled. If the
154 * always_check_network policy capability is enabled, peer labeling
155 * is always considered enabled.
156 *
157 */
158 static int selinux_peerlbl_enabled(void)
159 {
160 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
161 }
162
163 static int selinux_netcache_avc_callback(u32 event)
164 {
165 if (event == AVC_CALLBACK_RESET) {
166 sel_netif_flush();
167 sel_netnode_flush();
168 sel_netport_flush();
169 synchronize_net();
170 }
171 return 0;
172 }
173
174 /*
175 * initialise the security for the init task
176 */
177 static void cred_init_security(void)
178 {
179 struct cred *cred = (struct cred *) current->real_cred;
180 struct task_security_struct *tsec;
181
182 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
183 if (!tsec)
184 panic("SELinux: Failed to initialize initial task.\n");
185
186 tsec->osid = tsec->sid = SECINITSID_KERNEL;
187 cred->security = tsec;
188 }
189
190 /*
191 * get the security ID of a set of credentials
192 */
193 static inline u32 cred_sid(const struct cred *cred)
194 {
195 const struct task_security_struct *tsec;
196
197 tsec = cred->security;
198 return tsec->sid;
199 }
200
201 /*
202 * get the objective security ID of a task
203 */
204 static inline u32 task_sid(const struct task_struct *task)
205 {
206 u32 sid;
207
208 rcu_read_lock();
209 sid = cred_sid(__task_cred(task));
210 rcu_read_unlock();
211 return sid;
212 }
213
214 /* Allocate and free functions for each kind of security blob. */
215
216 static int inode_alloc_security(struct inode *inode)
217 {
218 struct inode_security_struct *isec;
219 u32 sid = current_sid();
220
221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
222 if (!isec)
223 return -ENOMEM;
224
225 spin_lock_init(&isec->lock);
226 INIT_LIST_HEAD(&isec->list);
227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
230 isec->task_sid = sid;
231 isec->initialized = LABEL_INVALID;
232 inode->i_security = isec;
233
234 return 0;
235 }
236
237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
238
239 /*
240 * Try reloading inode security labels that have been marked as invalid. The
241 * @may_sleep parameter indicates when sleeping and thus reloading labels is
242 * allowed; when set to false, returns -ECHILD when the label is
243 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
244 * when no dentry is available, set it to NULL instead.
245 */
246 static int __inode_security_revalidate(struct inode *inode,
247 struct dentry *opt_dentry,
248 bool may_sleep)
249 {
250 struct inode_security_struct *isec = inode->i_security;
251
252 might_sleep_if(may_sleep);
253
254 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
255 if (!may_sleep)
256 return -ECHILD;
257
258 /*
259 * Try reloading the inode security label. This will fail if
260 * @opt_dentry is NULL and no dentry for this inode can be
261 * found; in that case, continue using the old label.
262 */
263 inode_doinit_with_dentry(inode, opt_dentry);
264 }
265 return 0;
266 }
267
268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
269 {
270 return inode->i_security;
271 }
272
273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
274 {
275 int error;
276
277 error = __inode_security_revalidate(inode, NULL, !rcu);
278 if (error)
279 return ERR_PTR(error);
280 return inode->i_security;
281 }
282
283 /*
284 * Get the security label of an inode.
285 */
286 static struct inode_security_struct *inode_security(struct inode *inode)
287 {
288 __inode_security_revalidate(inode, NULL, true);
289 return inode->i_security;
290 }
291
292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
293 {
294 struct inode *inode = d_backing_inode(dentry);
295
296 return inode->i_security;
297 }
298
299 /*
300 * Get the security label of a dentry's backing inode.
301 */
302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
303 {
304 struct inode *inode = d_backing_inode(dentry);
305
306 __inode_security_revalidate(inode, dentry, true);
307 return inode->i_security;
308 }
309
310 static void inode_free_rcu(struct rcu_head *head)
311 {
312 struct inode_security_struct *isec;
313
314 isec = container_of(head, struct inode_security_struct, rcu);
315 kmem_cache_free(sel_inode_cache, isec);
316 }
317
318 static void inode_free_security(struct inode *inode)
319 {
320 struct inode_security_struct *isec = inode->i_security;
321 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
322
323 /*
324 * As not all inode security structures are in a list, we check for
325 * empty list outside of the lock to make sure that we won't waste
326 * time taking a lock doing nothing.
327 *
328 * The list_del_init() function can be safely called more than once.
329 * It should not be possible for this function to be called with
330 * concurrent list_add(), but for better safety against future changes
331 * in the code, we use list_empty_careful() here.
332 */
333 if (!list_empty_careful(&isec->list)) {
334 spin_lock(&sbsec->isec_lock);
335 list_del_init(&isec->list);
336 spin_unlock(&sbsec->isec_lock);
337 }
338
339 /*
340 * The inode may still be referenced in a path walk and
341 * a call to selinux_inode_permission() can be made
342 * after inode_free_security() is called. Ideally, the VFS
343 * wouldn't do this, but fixing that is a much harder
344 * job. For now, simply free the i_security via RCU, and
345 * leave the current inode->i_security pointer intact.
346 * The inode will be freed after the RCU grace period too.
347 */
348 call_rcu(&isec->rcu, inode_free_rcu);
349 }
350
351 static int file_alloc_security(struct file *file)
352 {
353 struct file_security_struct *fsec;
354 u32 sid = current_sid();
355
356 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
357 if (!fsec)
358 return -ENOMEM;
359
360 fsec->sid = sid;
361 fsec->fown_sid = sid;
362 file->f_security = fsec;
363
364 return 0;
365 }
366
367 static void file_free_security(struct file *file)
368 {
369 struct file_security_struct *fsec = file->f_security;
370 file->f_security = NULL;
371 kmem_cache_free(file_security_cache, fsec);
372 }
373
374 static int superblock_alloc_security(struct super_block *sb)
375 {
376 struct superblock_security_struct *sbsec;
377
378 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
379 if (!sbsec)
380 return -ENOMEM;
381
382 mutex_init(&sbsec->lock);
383 INIT_LIST_HEAD(&sbsec->isec_head);
384 spin_lock_init(&sbsec->isec_lock);
385 sbsec->sb = sb;
386 sbsec->sid = SECINITSID_UNLABELED;
387 sbsec->def_sid = SECINITSID_FILE;
388 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
389 sb->s_security = sbsec;
390
391 return 0;
392 }
393
394 static void superblock_free_security(struct super_block *sb)
395 {
396 struct superblock_security_struct *sbsec = sb->s_security;
397 sb->s_security = NULL;
398 kfree(sbsec);
399 }
400
401 /* The file system's label must be initialized prior to use. */
402
403 static const char *labeling_behaviors[7] = {
404 "uses xattr",
405 "uses transition SIDs",
406 "uses task SIDs",
407 "uses genfs_contexts",
408 "not configured for labeling",
409 "uses mountpoint labeling",
410 "uses native labeling",
411 };
412
413 static inline int inode_doinit(struct inode *inode)
414 {
415 return inode_doinit_with_dentry(inode, NULL);
416 }
417
418 enum {
419 Opt_error = -1,
420 Opt_context = 1,
421 Opt_fscontext = 2,
422 Opt_defcontext = 3,
423 Opt_rootcontext = 4,
424 Opt_labelsupport = 5,
425 Opt_nextmntopt = 6,
426 };
427
428 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429
430 static const match_table_t tokens = {
431 {Opt_context, CONTEXT_STR "%s"},
432 {Opt_fscontext, FSCONTEXT_STR "%s"},
433 {Opt_defcontext, DEFCONTEXT_STR "%s"},
434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
435 {Opt_labelsupport, LABELSUPP_STR},
436 {Opt_error, NULL},
437 };
438
439 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440
441 static int may_context_mount_sb_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
443 const struct cred *cred)
444 {
445 const struct task_security_struct *tsec = cred->security;
446 int rc;
447
448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
449 FILESYSTEM__RELABELFROM, NULL);
450 if (rc)
451 return rc;
452
453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELTO, NULL);
455 return rc;
456 }
457
458 static int may_context_mount_inode_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
460 const struct cred *cred)
461 {
462 const struct task_security_struct *tsec = cred->security;
463 int rc;
464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
466 if (rc)
467 return rc;
468
469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
470 FILESYSTEM__ASSOCIATE, NULL);
471 return rc;
472 }
473
474 static int selinux_is_sblabel_mnt(struct super_block *sb)
475 {
476 struct superblock_security_struct *sbsec = sb->s_security;
477
478 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
479 sbsec->behavior == SECURITY_FS_USE_TRANS ||
480 sbsec->behavior == SECURITY_FS_USE_TASK ||
481 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
482 /* Special handling. Genfs but also in-core setxattr handler */
483 !strcmp(sb->s_type->name, "sysfs") ||
484 !strcmp(sb->s_type->name, "pstore") ||
485 !strcmp(sb->s_type->name, "debugfs") ||
486 !strcmp(sb->s_type->name, "tracefs") ||
487 !strcmp(sb->s_type->name, "rootfs") ||
488 (selinux_policycap_cgroupseclabel &&
489 (!strcmp(sb->s_type->name, "cgroup") ||
490 !strcmp(sb->s_type->name, "cgroup2")));
491 }
492
493 static int sb_finish_set_opts(struct super_block *sb)
494 {
495 struct superblock_security_struct *sbsec = sb->s_security;
496 struct dentry *root = sb->s_root;
497 struct inode *root_inode = d_backing_inode(root);
498 int rc = 0;
499
500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
501 /* Make sure that the xattr handler exists and that no
502 error other than -ENODATA is returned by getxattr on
503 the root directory. -ENODATA is ok, as this may be
504 the first boot of the SELinux kernel before we have
505 assigned xattr values to the filesystem. */
506 if (!(root_inode->i_opflags & IOP_XATTR)) {
507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
508 "xattr support\n", sb->s_id, sb->s_type->name);
509 rc = -EOPNOTSUPP;
510 goto out;
511 }
512
513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
514 if (rc < 0 && rc != -ENODATA) {
515 if (rc == -EOPNOTSUPP)
516 printk(KERN_WARNING "SELinux: (dev %s, type "
517 "%s) has no security xattr handler\n",
518 sb->s_id, sb->s_type->name);
519 else
520 printk(KERN_WARNING "SELinux: (dev %s, type "
521 "%s) getxattr errno %d\n", sb->s_id,
522 sb->s_type->name, -rc);
523 goto out;
524 }
525 }
526
527 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
528 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
529 sb->s_id, sb->s_type->name);
530
531 sbsec->flags |= SE_SBINITIALIZED;
532 if (selinux_is_sblabel_mnt(sb))
533 sbsec->flags |= SBLABEL_MNT;
534
535 /* Initialize the root inode. */
536 rc = inode_doinit_with_dentry(root_inode, root);
537
538 /* Initialize any other inodes associated with the superblock, e.g.
539 inodes created prior to initial policy load or inodes created
540 during get_sb by a pseudo filesystem that directly
541 populates itself. */
542 spin_lock(&sbsec->isec_lock);
543 next_inode:
544 if (!list_empty(&sbsec->isec_head)) {
545 struct inode_security_struct *isec =
546 list_entry(sbsec->isec_head.next,
547 struct inode_security_struct, list);
548 struct inode *inode = isec->inode;
549 list_del_init(&isec->list);
550 spin_unlock(&sbsec->isec_lock);
551 inode = igrab(inode);
552 if (inode) {
553 if (!IS_PRIVATE(inode))
554 inode_doinit(inode);
555 iput(inode);
556 }
557 spin_lock(&sbsec->isec_lock);
558 goto next_inode;
559 }
560 spin_unlock(&sbsec->isec_lock);
561 out:
562 return rc;
563 }
564
565 /*
566 * This function should allow an FS to ask what it's mount security
567 * options were so it can use those later for submounts, displaying
568 * mount options, or whatever.
569 */
570 static int selinux_get_mnt_opts(const struct super_block *sb,
571 struct security_mnt_opts *opts)
572 {
573 int rc = 0, i;
574 struct superblock_security_struct *sbsec = sb->s_security;
575 char *context = NULL;
576 u32 len;
577 char tmp;
578
579 security_init_mnt_opts(opts);
580
581 if (!(sbsec->flags & SE_SBINITIALIZED))
582 return -EINVAL;
583
584 if (!ss_initialized)
585 return -EINVAL;
586
587 /* make sure we always check enough bits to cover the mask */
588 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
589
590 tmp = sbsec->flags & SE_MNTMASK;
591 /* count the number of mount options for this sb */
592 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
593 if (tmp & 0x01)
594 opts->num_mnt_opts++;
595 tmp >>= 1;
596 }
597 /* Check if the Label support flag is set */
598 if (sbsec->flags & SBLABEL_MNT)
599 opts->num_mnt_opts++;
600
601 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
602 if (!opts->mnt_opts) {
603 rc = -ENOMEM;
604 goto out_free;
605 }
606
607 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
608 if (!opts->mnt_opts_flags) {
609 rc = -ENOMEM;
610 goto out_free;
611 }
612
613 i = 0;
614 if (sbsec->flags & FSCONTEXT_MNT) {
615 rc = security_sid_to_context(sbsec->sid, &context, &len);
616 if (rc)
617 goto out_free;
618 opts->mnt_opts[i] = context;
619 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
620 }
621 if (sbsec->flags & CONTEXT_MNT) {
622 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
623 if (rc)
624 goto out_free;
625 opts->mnt_opts[i] = context;
626 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
627 }
628 if (sbsec->flags & DEFCONTEXT_MNT) {
629 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
630 if (rc)
631 goto out_free;
632 opts->mnt_opts[i] = context;
633 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
634 }
635 if (sbsec->flags & ROOTCONTEXT_MNT) {
636 struct dentry *root = sbsec->sb->s_root;
637 struct inode_security_struct *isec = backing_inode_security(root);
638
639 rc = security_sid_to_context(isec->sid, &context, &len);
640 if (rc)
641 goto out_free;
642 opts->mnt_opts[i] = context;
643 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
644 }
645 if (sbsec->flags & SBLABEL_MNT) {
646 opts->mnt_opts[i] = NULL;
647 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
648 }
649
650 BUG_ON(i != opts->num_mnt_opts);
651
652 return 0;
653
654 out_free:
655 security_free_mnt_opts(opts);
656 return rc;
657 }
658
659 static int bad_option(struct superblock_security_struct *sbsec, char flag,
660 u32 old_sid, u32 new_sid)
661 {
662 char mnt_flags = sbsec->flags & SE_MNTMASK;
663
664 /* check if the old mount command had the same options */
665 if (sbsec->flags & SE_SBINITIALIZED)
666 if (!(sbsec->flags & flag) ||
667 (old_sid != new_sid))
668 return 1;
669
670 /* check if we were passed the same options twice,
671 * aka someone passed context=a,context=b
672 */
673 if (!(sbsec->flags & SE_SBINITIALIZED))
674 if (mnt_flags & flag)
675 return 1;
676 return 0;
677 }
678
679 /*
680 * Allow filesystems with binary mount data to explicitly set mount point
681 * labeling information.
682 */
683 static int selinux_set_mnt_opts(struct super_block *sb,
684 struct security_mnt_opts *opts,
685 unsigned long kern_flags,
686 unsigned long *set_kern_flags)
687 {
688 const struct cred *cred = current_cred();
689 int rc = 0, i;
690 struct superblock_security_struct *sbsec = sb->s_security;
691 const char *name = sb->s_type->name;
692 struct dentry *root = sbsec->sb->s_root;
693 struct inode_security_struct *root_isec;
694 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
695 u32 defcontext_sid = 0;
696 char **mount_options = opts->mnt_opts;
697 int *flags = opts->mnt_opts_flags;
698 int num_opts = opts->num_mnt_opts;
699
700 mutex_lock(&sbsec->lock);
701
702 if (!ss_initialized) {
703 if (!num_opts) {
704 /* Defer initialization until selinux_complete_init,
705 after the initial policy is loaded and the security
706 server is ready to handle calls. */
707 goto out;
708 }
709 rc = -EINVAL;
710 printk(KERN_WARNING "SELinux: Unable to set superblock options "
711 "before the security server is initialized\n");
712 goto out;
713 }
714 if (kern_flags && !set_kern_flags) {
715 /* Specifying internal flags without providing a place to
716 * place the results is not allowed */
717 rc = -EINVAL;
718 goto out;
719 }
720
721 /*
722 * Binary mount data FS will come through this function twice. Once
723 * from an explicit call and once from the generic calls from the vfs.
724 * Since the generic VFS calls will not contain any security mount data
725 * we need to skip the double mount verification.
726 *
727 * This does open a hole in which we will not notice if the first
728 * mount using this sb set explict options and a second mount using
729 * this sb does not set any security options. (The first options
730 * will be used for both mounts)
731 */
732 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
733 && (num_opts == 0))
734 goto out;
735
736 root_isec = backing_inode_security_novalidate(root);
737
738 /*
739 * parse the mount options, check if they are valid sids.
740 * also check if someone is trying to mount the same sb more
741 * than once with different security options.
742 */
743 for (i = 0; i < num_opts; i++) {
744 u32 sid;
745
746 if (flags[i] == SBLABEL_MNT)
747 continue;
748 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
749 if (rc) {
750 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
751 "(%s) failed for (dev %s, type %s) errno=%d\n",
752 mount_options[i], sb->s_id, name, rc);
753 goto out;
754 }
755 switch (flags[i]) {
756 case FSCONTEXT_MNT:
757 fscontext_sid = sid;
758
759 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
760 fscontext_sid))
761 goto out_double_mount;
762
763 sbsec->flags |= FSCONTEXT_MNT;
764 break;
765 case CONTEXT_MNT:
766 context_sid = sid;
767
768 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
769 context_sid))
770 goto out_double_mount;
771
772 sbsec->flags |= CONTEXT_MNT;
773 break;
774 case ROOTCONTEXT_MNT:
775 rootcontext_sid = sid;
776
777 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
778 rootcontext_sid))
779 goto out_double_mount;
780
781 sbsec->flags |= ROOTCONTEXT_MNT;
782
783 break;
784 case DEFCONTEXT_MNT:
785 defcontext_sid = sid;
786
787 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
788 defcontext_sid))
789 goto out_double_mount;
790
791 sbsec->flags |= DEFCONTEXT_MNT;
792
793 break;
794 default:
795 rc = -EINVAL;
796 goto out;
797 }
798 }
799
800 if (sbsec->flags & SE_SBINITIALIZED) {
801 /* previously mounted with options, but not on this attempt? */
802 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
803 goto out_double_mount;
804 rc = 0;
805 goto out;
806 }
807
808 if (strcmp(sb->s_type->name, "proc") == 0)
809 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
810
811 if (!strcmp(sb->s_type->name, "debugfs") ||
812 !strcmp(sb->s_type->name, "sysfs") ||
813 !strcmp(sb->s_type->name, "pstore"))
814 sbsec->flags |= SE_SBGENFS;
815
816 if (!sbsec->behavior) {
817 /*
818 * Determine the labeling behavior to use for this
819 * filesystem type.
820 */
821 rc = security_fs_use(sb);
822 if (rc) {
823 printk(KERN_WARNING
824 "%s: security_fs_use(%s) returned %d\n",
825 __func__, sb->s_type->name, rc);
826 goto out;
827 }
828 }
829
830 /*
831 * If this is a user namespace mount and the filesystem type is not
832 * explicitly whitelisted, then no contexts are allowed on the command
833 * line and security labels must be ignored.
834 */
835 if (sb->s_user_ns != &init_user_ns &&
836 strcmp(sb->s_type->name, "tmpfs") &&
837 strcmp(sb->s_type->name, "ramfs") &&
838 strcmp(sb->s_type->name, "devpts")) {
839 if (context_sid || fscontext_sid || rootcontext_sid ||
840 defcontext_sid) {
841 rc = -EACCES;
842 goto out;
843 }
844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 rc = security_transition_sid(current_sid(), current_sid(),
847 SECCLASS_FILE, NULL,
848 &sbsec->mntpoint_sid);
849 if (rc)
850 goto out;
851 }
852 goto out_set_opts;
853 }
854
855 /* sets the context of the superblock for the fs being mounted. */
856 if (fscontext_sid) {
857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
858 if (rc)
859 goto out;
860
861 sbsec->sid = fscontext_sid;
862 }
863
864 /*
865 * Switch to using mount point labeling behavior.
866 * sets the label used on all file below the mountpoint, and will set
867 * the superblock context if not already set.
868 */
869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
872 }
873
874 if (context_sid) {
875 if (!fscontext_sid) {
876 rc = may_context_mount_sb_relabel(context_sid, sbsec,
877 cred);
878 if (rc)
879 goto out;
880 sbsec->sid = context_sid;
881 } else {
882 rc = may_context_mount_inode_relabel(context_sid, sbsec,
883 cred);
884 if (rc)
885 goto out;
886 }
887 if (!rootcontext_sid)
888 rootcontext_sid = context_sid;
889
890 sbsec->mntpoint_sid = context_sid;
891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
892 }
893
894 if (rootcontext_sid) {
895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
896 cred);
897 if (rc)
898 goto out;
899
900 root_isec->sid = rootcontext_sid;
901 root_isec->initialized = LABEL_INITIALIZED;
902 }
903
904 if (defcontext_sid) {
905 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
907 rc = -EINVAL;
908 printk(KERN_WARNING "SELinux: defcontext option is "
909 "invalid for this filesystem type\n");
910 goto out;
911 }
912
913 if (defcontext_sid != sbsec->def_sid) {
914 rc = may_context_mount_inode_relabel(defcontext_sid,
915 sbsec, cred);
916 if (rc)
917 goto out;
918 }
919
920 sbsec->def_sid = defcontext_sid;
921 }
922
923 out_set_opts:
924 rc = sb_finish_set_opts(sb);
925 out:
926 mutex_unlock(&sbsec->lock);
927 return rc;
928 out_double_mount:
929 rc = -EINVAL;
930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
931 "security settings for (dev %s, type %s)\n", sb->s_id, name);
932 goto out;
933 }
934
935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 const struct super_block *newsb)
937 {
938 struct superblock_security_struct *old = oldsb->s_security;
939 struct superblock_security_struct *new = newsb->s_security;
940 char oldflags = old->flags & SE_MNTMASK;
941 char newflags = new->flags & SE_MNTMASK;
942
943 if (oldflags != newflags)
944 goto mismatch;
945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
946 goto mismatch;
947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
948 goto mismatch;
949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
950 goto mismatch;
951 if (oldflags & ROOTCONTEXT_MNT) {
952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
954 if (oldroot->sid != newroot->sid)
955 goto mismatch;
956 }
957 return 0;
958 mismatch:
959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
960 "different security settings for (dev %s, "
961 "type %s)\n", newsb->s_id, newsb->s_type->name);
962 return -EBUSY;
963 }
964
965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
966 struct super_block *newsb)
967 {
968 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 struct superblock_security_struct *newsbsec = newsb->s_security;
970
971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
972 int set_context = (oldsbsec->flags & CONTEXT_MNT);
973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
974
975 /*
976 * if the parent was able to be mounted it clearly had no special lsm
977 * mount options. thus we can safely deal with this superblock later
978 */
979 if (!ss_initialized)
980 return 0;
981
982 /* how can we clone if the old one wasn't set up?? */
983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
984
985 /* if fs is reusing a sb, make sure that the contexts match */
986 if (newsbsec->flags & SE_SBINITIALIZED)
987 return selinux_cmp_sb_context(oldsb, newsb);
988
989 mutex_lock(&newsbsec->lock);
990
991 newsbsec->flags = oldsbsec->flags;
992
993 newsbsec->sid = oldsbsec->sid;
994 newsbsec->def_sid = oldsbsec->def_sid;
995 newsbsec->behavior = oldsbsec->behavior;
996
997 if (set_context) {
998 u32 sid = oldsbsec->mntpoint_sid;
999
1000 if (!set_fscontext)
1001 newsbsec->sid = sid;
1002 if (!set_rootcontext) {
1003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004 newisec->sid = sid;
1005 }
1006 newsbsec->mntpoint_sid = sid;
1007 }
1008 if (set_rootcontext) {
1009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012 newisec->sid = oldisec->sid;
1013 }
1014
1015 sb_finish_set_opts(newsb);
1016 mutex_unlock(&newsbsec->lock);
1017 return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021 struct security_mnt_opts *opts)
1022 {
1023 char *p;
1024 char *context = NULL, *defcontext = NULL;
1025 char *fscontext = NULL, *rootcontext = NULL;
1026 int rc, num_mnt_opts = 0;
1027
1028 opts->num_mnt_opts = 0;
1029
1030 /* Standard string-based options. */
1031 while ((p = strsep(&options, "|")) != NULL) {
1032 int token;
1033 substring_t args[MAX_OPT_ARGS];
1034
1035 if (!*p)
1036 continue;
1037
1038 token = match_token(p, tokens, args);
1039
1040 switch (token) {
1041 case Opt_context:
1042 if (context || defcontext) {
1043 rc = -EINVAL;
1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045 goto out_err;
1046 }
1047 context = match_strdup(&args[0]);
1048 if (!context) {
1049 rc = -ENOMEM;
1050 goto out_err;
1051 }
1052 break;
1053
1054 case Opt_fscontext:
1055 if (fscontext) {
1056 rc = -EINVAL;
1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058 goto out_err;
1059 }
1060 fscontext = match_strdup(&args[0]);
1061 if (!fscontext) {
1062 rc = -ENOMEM;
1063 goto out_err;
1064 }
1065 break;
1066
1067 case Opt_rootcontext:
1068 if (rootcontext) {
1069 rc = -EINVAL;
1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071 goto out_err;
1072 }
1073 rootcontext = match_strdup(&args[0]);
1074 if (!rootcontext) {
1075 rc = -ENOMEM;
1076 goto out_err;
1077 }
1078 break;
1079
1080 case Opt_defcontext:
1081 if (context || defcontext) {
1082 rc = -EINVAL;
1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084 goto out_err;
1085 }
1086 defcontext = match_strdup(&args[0]);
1087 if (!defcontext) {
1088 rc = -ENOMEM;
1089 goto out_err;
1090 }
1091 break;
1092 case Opt_labelsupport:
1093 break;
1094 default:
1095 rc = -EINVAL;
1096 printk(KERN_WARNING "SELinux: unknown mount option\n");
1097 goto out_err;
1098
1099 }
1100 }
1101
1102 rc = -ENOMEM;
1103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1104 if (!opts->mnt_opts)
1105 goto out_err;
1106
1107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1108 GFP_KERNEL);
1109 if (!opts->mnt_opts_flags)
1110 goto out_err;
1111
1112 if (fscontext) {
1113 opts->mnt_opts[num_mnt_opts] = fscontext;
1114 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1115 }
1116 if (context) {
1117 opts->mnt_opts[num_mnt_opts] = context;
1118 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1119 }
1120 if (rootcontext) {
1121 opts->mnt_opts[num_mnt_opts] = rootcontext;
1122 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1123 }
1124 if (defcontext) {
1125 opts->mnt_opts[num_mnt_opts] = defcontext;
1126 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1127 }
1128
1129 opts->num_mnt_opts = num_mnt_opts;
1130 return 0;
1131
1132 out_err:
1133 security_free_mnt_opts(opts);
1134 kfree(context);
1135 kfree(defcontext);
1136 kfree(fscontext);
1137 kfree(rootcontext);
1138 return rc;
1139 }
1140 /*
1141 * string mount options parsing and call set the sbsec
1142 */
1143 static int superblock_doinit(struct super_block *sb, void *data)
1144 {
1145 int rc = 0;
1146 char *options = data;
1147 struct security_mnt_opts opts;
1148
1149 security_init_mnt_opts(&opts);
1150
1151 if (!data)
1152 goto out;
1153
1154 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1155
1156 rc = selinux_parse_opts_str(options, &opts);
1157 if (rc)
1158 goto out_err;
1159
1160 out:
1161 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1162
1163 out_err:
1164 security_free_mnt_opts(&opts);
1165 return rc;
1166 }
1167
1168 static void selinux_write_opts(struct seq_file *m,
1169 struct security_mnt_opts *opts)
1170 {
1171 int i;
1172 char *prefix;
1173
1174 for (i = 0; i < opts->num_mnt_opts; i++) {
1175 char *has_comma;
1176
1177 if (opts->mnt_opts[i])
1178 has_comma = strchr(opts->mnt_opts[i], ',');
1179 else
1180 has_comma = NULL;
1181
1182 switch (opts->mnt_opts_flags[i]) {
1183 case CONTEXT_MNT:
1184 prefix = CONTEXT_STR;
1185 break;
1186 case FSCONTEXT_MNT:
1187 prefix = FSCONTEXT_STR;
1188 break;
1189 case ROOTCONTEXT_MNT:
1190 prefix = ROOTCONTEXT_STR;
1191 break;
1192 case DEFCONTEXT_MNT:
1193 prefix = DEFCONTEXT_STR;
1194 break;
1195 case SBLABEL_MNT:
1196 seq_putc(m, ',');
1197 seq_puts(m, LABELSUPP_STR);
1198 continue;
1199 default:
1200 BUG();
1201 return;
1202 };
1203 /* we need a comma before each option */
1204 seq_putc(m, ',');
1205 seq_puts(m, prefix);
1206 if (has_comma)
1207 seq_putc(m, '\"');
1208 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1209 if (has_comma)
1210 seq_putc(m, '\"');
1211 }
1212 }
1213
1214 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1215 {
1216 struct security_mnt_opts opts;
1217 int rc;
1218
1219 rc = selinux_get_mnt_opts(sb, &opts);
1220 if (rc) {
1221 /* before policy load we may get EINVAL, don't show anything */
1222 if (rc == -EINVAL)
1223 rc = 0;
1224 return rc;
1225 }
1226
1227 selinux_write_opts(m, &opts);
1228
1229 security_free_mnt_opts(&opts);
1230
1231 return rc;
1232 }
1233
1234 static inline u16 inode_mode_to_security_class(umode_t mode)
1235 {
1236 switch (mode & S_IFMT) {
1237 case S_IFSOCK:
1238 return SECCLASS_SOCK_FILE;
1239 case S_IFLNK:
1240 return SECCLASS_LNK_FILE;
1241 case S_IFREG:
1242 return SECCLASS_FILE;
1243 case S_IFBLK:
1244 return SECCLASS_BLK_FILE;
1245 case S_IFDIR:
1246 return SECCLASS_DIR;
1247 case S_IFCHR:
1248 return SECCLASS_CHR_FILE;
1249 case S_IFIFO:
1250 return SECCLASS_FIFO_FILE;
1251
1252 }
1253
1254 return SECCLASS_FILE;
1255 }
1256
1257 static inline int default_protocol_stream(int protocol)
1258 {
1259 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1260 }
1261
1262 static inline int default_protocol_dgram(int protocol)
1263 {
1264 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1265 }
1266
1267 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1268 {
1269 int extsockclass = selinux_policycap_extsockclass;
1270
1271 switch (family) {
1272 case PF_UNIX:
1273 switch (type) {
1274 case SOCK_STREAM:
1275 case SOCK_SEQPACKET:
1276 return SECCLASS_UNIX_STREAM_SOCKET;
1277 case SOCK_DGRAM:
1278 return SECCLASS_UNIX_DGRAM_SOCKET;
1279 }
1280 break;
1281 case PF_INET:
1282 case PF_INET6:
1283 switch (type) {
1284 case SOCK_STREAM:
1285 case SOCK_SEQPACKET:
1286 if (default_protocol_stream(protocol))
1287 return SECCLASS_TCP_SOCKET;
1288 else if (extsockclass && protocol == IPPROTO_SCTP)
1289 return SECCLASS_SCTP_SOCKET;
1290 else
1291 return SECCLASS_RAWIP_SOCKET;
1292 case SOCK_DGRAM:
1293 if (default_protocol_dgram(protocol))
1294 return SECCLASS_UDP_SOCKET;
1295 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1296 protocol == IPPROTO_ICMPV6))
1297 return SECCLASS_ICMP_SOCKET;
1298 else
1299 return SECCLASS_RAWIP_SOCKET;
1300 case SOCK_DCCP:
1301 return SECCLASS_DCCP_SOCKET;
1302 default:
1303 return SECCLASS_RAWIP_SOCKET;
1304 }
1305 break;
1306 case PF_NETLINK:
1307 switch (protocol) {
1308 case NETLINK_ROUTE:
1309 return SECCLASS_NETLINK_ROUTE_SOCKET;
1310 case NETLINK_SOCK_DIAG:
1311 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1312 case NETLINK_NFLOG:
1313 return SECCLASS_NETLINK_NFLOG_SOCKET;
1314 case NETLINK_XFRM:
1315 return SECCLASS_NETLINK_XFRM_SOCKET;
1316 case NETLINK_SELINUX:
1317 return SECCLASS_NETLINK_SELINUX_SOCKET;
1318 case NETLINK_ISCSI:
1319 return SECCLASS_NETLINK_ISCSI_SOCKET;
1320 case NETLINK_AUDIT:
1321 return SECCLASS_NETLINK_AUDIT_SOCKET;
1322 case NETLINK_FIB_LOOKUP:
1323 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1324 case NETLINK_CONNECTOR:
1325 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1326 case NETLINK_NETFILTER:
1327 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1328 case NETLINK_DNRTMSG:
1329 return SECCLASS_NETLINK_DNRT_SOCKET;
1330 case NETLINK_KOBJECT_UEVENT:
1331 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1332 case NETLINK_GENERIC:
1333 return SECCLASS_NETLINK_GENERIC_SOCKET;
1334 case NETLINK_SCSITRANSPORT:
1335 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1336 case NETLINK_RDMA:
1337 return SECCLASS_NETLINK_RDMA_SOCKET;
1338 case NETLINK_CRYPTO:
1339 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1340 default:
1341 return SECCLASS_NETLINK_SOCKET;
1342 }
1343 case PF_PACKET:
1344 return SECCLASS_PACKET_SOCKET;
1345 case PF_KEY:
1346 return SECCLASS_KEY_SOCKET;
1347 case PF_APPLETALK:
1348 return SECCLASS_APPLETALK_SOCKET;
1349 }
1350
1351 if (extsockclass) {
1352 switch (family) {
1353 case PF_AX25:
1354 return SECCLASS_AX25_SOCKET;
1355 case PF_IPX:
1356 return SECCLASS_IPX_SOCKET;
1357 case PF_NETROM:
1358 return SECCLASS_NETROM_SOCKET;
1359 case PF_ATMPVC:
1360 return SECCLASS_ATMPVC_SOCKET;
1361 case PF_X25:
1362 return SECCLASS_X25_SOCKET;
1363 case PF_ROSE:
1364 return SECCLASS_ROSE_SOCKET;
1365 case PF_DECnet:
1366 return SECCLASS_DECNET_SOCKET;
1367 case PF_ATMSVC:
1368 return SECCLASS_ATMSVC_SOCKET;
1369 case PF_RDS:
1370 return SECCLASS_RDS_SOCKET;
1371 case PF_IRDA:
1372 return SECCLASS_IRDA_SOCKET;
1373 case PF_PPPOX:
1374 return SECCLASS_PPPOX_SOCKET;
1375 case PF_LLC:
1376 return SECCLASS_LLC_SOCKET;
1377 case PF_CAN:
1378 return SECCLASS_CAN_SOCKET;
1379 case PF_TIPC:
1380 return SECCLASS_TIPC_SOCKET;
1381 case PF_BLUETOOTH:
1382 return SECCLASS_BLUETOOTH_SOCKET;
1383 case PF_IUCV:
1384 return SECCLASS_IUCV_SOCKET;
1385 case PF_RXRPC:
1386 return SECCLASS_RXRPC_SOCKET;
1387 case PF_ISDN:
1388 return SECCLASS_ISDN_SOCKET;
1389 case PF_PHONET:
1390 return SECCLASS_PHONET_SOCKET;
1391 case PF_IEEE802154:
1392 return SECCLASS_IEEE802154_SOCKET;
1393 case PF_CAIF:
1394 return SECCLASS_CAIF_SOCKET;
1395 case PF_ALG:
1396 return SECCLASS_ALG_SOCKET;
1397 case PF_NFC:
1398 return SECCLASS_NFC_SOCKET;
1399 case PF_VSOCK:
1400 return SECCLASS_VSOCK_SOCKET;
1401 case PF_KCM:
1402 return SECCLASS_KCM_SOCKET;
1403 case PF_QIPCRTR:
1404 return SECCLASS_QIPCRTR_SOCKET;
1405 case PF_SMC:
1406 return SECCLASS_SMC_SOCKET;
1407 #if PF_MAX > 44
1408 #error New address family defined, please update this function.
1409 #endif
1410 }
1411 }
1412
1413 return SECCLASS_SOCKET;
1414 }
1415
1416 static int selinux_genfs_get_sid(struct dentry *dentry,
1417 u16 tclass,
1418 u16 flags,
1419 u32 *sid)
1420 {
1421 int rc;
1422 struct super_block *sb = dentry->d_sb;
1423 char *buffer, *path;
1424
1425 buffer = (char *)__get_free_page(GFP_KERNEL);
1426 if (!buffer)
1427 return -ENOMEM;
1428
1429 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1430 if (IS_ERR(path))
1431 rc = PTR_ERR(path);
1432 else {
1433 if (flags & SE_SBPROC) {
1434 /* each process gets a /proc/PID/ entry. Strip off the
1435 * PID part to get a valid selinux labeling.
1436 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1437 while (path[1] >= '0' && path[1] <= '9') {
1438 path[1] = '/';
1439 path++;
1440 }
1441 }
1442 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1443 }
1444 free_page((unsigned long)buffer);
1445 return rc;
1446 }
1447
1448 /* The inode's security attributes must be initialized before first use. */
1449 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1450 {
1451 struct superblock_security_struct *sbsec = NULL;
1452 struct inode_security_struct *isec = inode->i_security;
1453 u32 task_sid, sid = 0;
1454 u16 sclass;
1455 struct dentry *dentry;
1456 #define INITCONTEXTLEN 255
1457 char *context = NULL;
1458 unsigned len = 0;
1459 int rc = 0;
1460
1461 if (isec->initialized == LABEL_INITIALIZED)
1462 return 0;
1463
1464 spin_lock(&isec->lock);
1465 if (isec->initialized == LABEL_INITIALIZED)
1466 goto out_unlock;
1467
1468 if (isec->sclass == SECCLASS_FILE)
1469 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1470
1471 sbsec = inode->i_sb->s_security;
1472 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1473 /* Defer initialization until selinux_complete_init,
1474 after the initial policy is loaded and the security
1475 server is ready to handle calls. */
1476 spin_lock(&sbsec->isec_lock);
1477 if (list_empty(&isec->list))
1478 list_add(&isec->list, &sbsec->isec_head);
1479 spin_unlock(&sbsec->isec_lock);
1480 goto out_unlock;
1481 }
1482
1483 sclass = isec->sclass;
1484 task_sid = isec->task_sid;
1485 sid = isec->sid;
1486 isec->initialized = LABEL_PENDING;
1487 spin_unlock(&isec->lock);
1488
1489 switch (sbsec->behavior) {
1490 case SECURITY_FS_USE_NATIVE:
1491 break;
1492 case SECURITY_FS_USE_XATTR:
1493 if (!(inode->i_opflags & IOP_XATTR)) {
1494 sid = sbsec->def_sid;
1495 break;
1496 }
1497 /* Need a dentry, since the xattr API requires one.
1498 Life would be simpler if we could just pass the inode. */
1499 if (opt_dentry) {
1500 /* Called from d_instantiate or d_splice_alias. */
1501 dentry = dget(opt_dentry);
1502 } else {
1503 /* Called from selinux_complete_init, try to find a dentry. */
1504 dentry = d_find_alias(inode);
1505 }
1506 if (!dentry) {
1507 /*
1508 * this is can be hit on boot when a file is accessed
1509 * before the policy is loaded. When we load policy we
1510 * may find inodes that have no dentry on the
1511 * sbsec->isec_head list. No reason to complain as these
1512 * will get fixed up the next time we go through
1513 * inode_doinit with a dentry, before these inodes could
1514 * be used again by userspace.
1515 */
1516 goto out;
1517 }
1518
1519 len = INITCONTEXTLEN;
1520 context = kmalloc(len+1, GFP_NOFS);
1521 if (!context) {
1522 rc = -ENOMEM;
1523 dput(dentry);
1524 goto out;
1525 }
1526 context[len] = '\0';
1527 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1528 if (rc == -ERANGE) {
1529 kfree(context);
1530
1531 /* Need a larger buffer. Query for the right size. */
1532 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1533 if (rc < 0) {
1534 dput(dentry);
1535 goto out;
1536 }
1537 len = rc;
1538 context = kmalloc(len+1, GFP_NOFS);
1539 if (!context) {
1540 rc = -ENOMEM;
1541 dput(dentry);
1542 goto out;
1543 }
1544 context[len] = '\0';
1545 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1546 }
1547 dput(dentry);
1548 if (rc < 0) {
1549 if (rc != -ENODATA) {
1550 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1551 "%d for dev=%s ino=%ld\n", __func__,
1552 -rc, inode->i_sb->s_id, inode->i_ino);
1553 kfree(context);
1554 goto out;
1555 }
1556 /* Map ENODATA to the default file SID */
1557 sid = sbsec->def_sid;
1558 rc = 0;
1559 } else {
1560 rc = security_context_to_sid_default(context, rc, &sid,
1561 sbsec->def_sid,
1562 GFP_NOFS);
1563 if (rc) {
1564 char *dev = inode->i_sb->s_id;
1565 unsigned long ino = inode->i_ino;
1566
1567 if (rc == -EINVAL) {
1568 if (printk_ratelimit())
1569 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1570 "context=%s. This indicates you may need to relabel the inode or the "
1571 "filesystem in question.\n", ino, dev, context);
1572 } else {
1573 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1574 "returned %d for dev=%s ino=%ld\n",
1575 __func__, context, -rc, dev, ino);
1576 }
1577 kfree(context);
1578 /* Leave with the unlabeled SID */
1579 rc = 0;
1580 break;
1581 }
1582 }
1583 kfree(context);
1584 break;
1585 case SECURITY_FS_USE_TASK:
1586 sid = task_sid;
1587 break;
1588 case SECURITY_FS_USE_TRANS:
1589 /* Default to the fs SID. */
1590 sid = sbsec->sid;
1591
1592 /* Try to obtain a transition SID. */
1593 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1594 if (rc)
1595 goto out;
1596 break;
1597 case SECURITY_FS_USE_MNTPOINT:
1598 sid = sbsec->mntpoint_sid;
1599 break;
1600 default:
1601 /* Default to the fs superblock SID. */
1602 sid = sbsec->sid;
1603
1604 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1605 /* We must have a dentry to determine the label on
1606 * procfs inodes */
1607 if (opt_dentry)
1608 /* Called from d_instantiate or
1609 * d_splice_alias. */
1610 dentry = dget(opt_dentry);
1611 else
1612 /* Called from selinux_complete_init, try to
1613 * find a dentry. */
1614 dentry = d_find_alias(inode);
1615 /*
1616 * This can be hit on boot when a file is accessed
1617 * before the policy is loaded. When we load policy we
1618 * may find inodes that have no dentry on the
1619 * sbsec->isec_head list. No reason to complain as
1620 * these will get fixed up the next time we go through
1621 * inode_doinit() with a dentry, before these inodes
1622 * could be used again by userspace.
1623 */
1624 if (!dentry)
1625 goto out;
1626 rc = selinux_genfs_get_sid(dentry, sclass,
1627 sbsec->flags, &sid);
1628 dput(dentry);
1629 if (rc)
1630 goto out;
1631 }
1632 break;
1633 }
1634
1635 out:
1636 spin_lock(&isec->lock);
1637 if (isec->initialized == LABEL_PENDING) {
1638 if (!sid || rc) {
1639 isec->initialized = LABEL_INVALID;
1640 goto out_unlock;
1641 }
1642
1643 isec->initialized = LABEL_INITIALIZED;
1644 isec->sid = sid;
1645 }
1646
1647 out_unlock:
1648 spin_unlock(&isec->lock);
1649 return rc;
1650 }
1651
1652 /* Convert a Linux signal to an access vector. */
1653 static inline u32 signal_to_av(int sig)
1654 {
1655 u32 perm = 0;
1656
1657 switch (sig) {
1658 case SIGCHLD:
1659 /* Commonly granted from child to parent. */
1660 perm = PROCESS__SIGCHLD;
1661 break;
1662 case SIGKILL:
1663 /* Cannot be caught or ignored */
1664 perm = PROCESS__SIGKILL;
1665 break;
1666 case SIGSTOP:
1667 /* Cannot be caught or ignored */
1668 perm = PROCESS__SIGSTOP;
1669 break;
1670 default:
1671 /* All other signals. */
1672 perm = PROCESS__SIGNAL;
1673 break;
1674 }
1675
1676 return perm;
1677 }
1678
1679 #if CAP_LAST_CAP > 63
1680 #error Fix SELinux to handle capabilities > 63.
1681 #endif
1682
1683 /* Check whether a task is allowed to use a capability. */
1684 static int cred_has_capability(const struct cred *cred,
1685 int cap, int audit, bool initns)
1686 {
1687 struct common_audit_data ad;
1688 struct av_decision avd;
1689 u16 sclass;
1690 u32 sid = cred_sid(cred);
1691 u32 av = CAP_TO_MASK(cap);
1692 int rc;
1693
1694 ad.type = LSM_AUDIT_DATA_CAP;
1695 ad.u.cap = cap;
1696
1697 switch (CAP_TO_INDEX(cap)) {
1698 case 0:
1699 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1700 break;
1701 case 1:
1702 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1703 break;
1704 default:
1705 printk(KERN_ERR
1706 "SELinux: out of range capability %d\n", cap);
1707 BUG();
1708 return -EINVAL;
1709 }
1710
1711 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1712 if (audit == SECURITY_CAP_AUDIT) {
1713 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1714 if (rc2)
1715 return rc2;
1716 }
1717 return rc;
1718 }
1719
1720 /* Check whether a task has a particular permission to an inode.
1721 The 'adp' parameter is optional and allows other audit
1722 data to be passed (e.g. the dentry). */
1723 static int inode_has_perm(const struct cred *cred,
1724 struct inode *inode,
1725 u32 perms,
1726 struct common_audit_data *adp)
1727 {
1728 struct inode_security_struct *isec;
1729 u32 sid;
1730
1731 validate_creds(cred);
1732
1733 if (unlikely(IS_PRIVATE(inode)))
1734 return 0;
1735
1736 sid = cred_sid(cred);
1737 isec = inode->i_security;
1738
1739 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1740 }
1741
1742 /* Same as inode_has_perm, but pass explicit audit data containing
1743 the dentry to help the auditing code to more easily generate the
1744 pathname if needed. */
1745 static inline int dentry_has_perm(const struct cred *cred,
1746 struct dentry *dentry,
1747 u32 av)
1748 {
1749 struct inode *inode = d_backing_inode(dentry);
1750 struct common_audit_data ad;
1751
1752 ad.type = LSM_AUDIT_DATA_DENTRY;
1753 ad.u.dentry = dentry;
1754 __inode_security_revalidate(inode, dentry, true);
1755 return inode_has_perm(cred, inode, av, &ad);
1756 }
1757
1758 /* Same as inode_has_perm, but pass explicit audit data containing
1759 the path to help the auditing code to more easily generate the
1760 pathname if needed. */
1761 static inline int path_has_perm(const struct cred *cred,
1762 const struct path *path,
1763 u32 av)
1764 {
1765 struct inode *inode = d_backing_inode(path->dentry);
1766 struct common_audit_data ad;
1767
1768 ad.type = LSM_AUDIT_DATA_PATH;
1769 ad.u.path = *path;
1770 __inode_security_revalidate(inode, path->dentry, true);
1771 return inode_has_perm(cred, inode, av, &ad);
1772 }
1773
1774 /* Same as path_has_perm, but uses the inode from the file struct. */
1775 static inline int file_path_has_perm(const struct cred *cred,
1776 struct file *file,
1777 u32 av)
1778 {
1779 struct common_audit_data ad;
1780
1781 ad.type = LSM_AUDIT_DATA_FILE;
1782 ad.u.file = file;
1783 return inode_has_perm(cred, file_inode(file), av, &ad);
1784 }
1785
1786 /* Check whether a task can use an open file descriptor to
1787 access an inode in a given way. Check access to the
1788 descriptor itself, and then use dentry_has_perm to
1789 check a particular permission to the file.
1790 Access to the descriptor is implicitly granted if it
1791 has the same SID as the process. If av is zero, then
1792 access to the file is not checked, e.g. for cases
1793 where only the descriptor is affected like seek. */
1794 static int file_has_perm(const struct cred *cred,
1795 struct file *file,
1796 u32 av)
1797 {
1798 struct file_security_struct *fsec = file->f_security;
1799 struct inode *inode = file_inode(file);
1800 struct common_audit_data ad;
1801 u32 sid = cred_sid(cred);
1802 int rc;
1803
1804 ad.type = LSM_AUDIT_DATA_FILE;
1805 ad.u.file = file;
1806
1807 if (sid != fsec->sid) {
1808 rc = avc_has_perm(sid, fsec->sid,
1809 SECCLASS_FD,
1810 FD__USE,
1811 &ad);
1812 if (rc)
1813 goto out;
1814 }
1815
1816 /* av is zero if only checking access to the descriptor. */
1817 rc = 0;
1818 if (av)
1819 rc = inode_has_perm(cred, inode, av, &ad);
1820
1821 out:
1822 return rc;
1823 }
1824
1825 /*
1826 * Determine the label for an inode that might be unioned.
1827 */
1828 static int
1829 selinux_determine_inode_label(const struct task_security_struct *tsec,
1830 struct inode *dir,
1831 const struct qstr *name, u16 tclass,
1832 u32 *_new_isid)
1833 {
1834 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1835
1836 if ((sbsec->flags & SE_SBINITIALIZED) &&
1837 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1838 *_new_isid = sbsec->mntpoint_sid;
1839 } else if ((sbsec->flags & SBLABEL_MNT) &&
1840 tsec->create_sid) {
1841 *_new_isid = tsec->create_sid;
1842 } else {
1843 const struct inode_security_struct *dsec = inode_security(dir);
1844 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1845 name, _new_isid);
1846 }
1847
1848 return 0;
1849 }
1850
1851 /* Check whether a task can create a file. */
1852 static int may_create(struct inode *dir,
1853 struct dentry *dentry,
1854 u16 tclass)
1855 {
1856 const struct task_security_struct *tsec = current_security();
1857 struct inode_security_struct *dsec;
1858 struct superblock_security_struct *sbsec;
1859 u32 sid, newsid;
1860 struct common_audit_data ad;
1861 int rc;
1862
1863 dsec = inode_security(dir);
1864 sbsec = dir->i_sb->s_security;
1865
1866 sid = tsec->sid;
1867
1868 ad.type = LSM_AUDIT_DATA_DENTRY;
1869 ad.u.dentry = dentry;
1870
1871 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1872 DIR__ADD_NAME | DIR__SEARCH,
1873 &ad);
1874 if (rc)
1875 return rc;
1876
1877 rc = selinux_determine_inode_label(current_security(), dir,
1878 &dentry->d_name, tclass, &newsid);
1879 if (rc)
1880 return rc;
1881
1882 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1883 if (rc)
1884 return rc;
1885
1886 return avc_has_perm(newsid, sbsec->sid,
1887 SECCLASS_FILESYSTEM,
1888 FILESYSTEM__ASSOCIATE, &ad);
1889 }
1890
1891 #define MAY_LINK 0
1892 #define MAY_UNLINK 1
1893 #define MAY_RMDIR 2
1894
1895 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1896 static int may_link(struct inode *dir,
1897 struct dentry *dentry,
1898 int kind)
1899
1900 {
1901 struct inode_security_struct *dsec, *isec;
1902 struct common_audit_data ad;
1903 u32 sid = current_sid();
1904 u32 av;
1905 int rc;
1906
1907 dsec = inode_security(dir);
1908 isec = backing_inode_security(dentry);
1909
1910 ad.type = LSM_AUDIT_DATA_DENTRY;
1911 ad.u.dentry = dentry;
1912
1913 av = DIR__SEARCH;
1914 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1915 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1916 if (rc)
1917 return rc;
1918
1919 switch (kind) {
1920 case MAY_LINK:
1921 av = FILE__LINK;
1922 break;
1923 case MAY_UNLINK:
1924 av = FILE__UNLINK;
1925 break;
1926 case MAY_RMDIR:
1927 av = DIR__RMDIR;
1928 break;
1929 default:
1930 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1931 __func__, kind);
1932 return 0;
1933 }
1934
1935 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1936 return rc;
1937 }
1938
1939 static inline int may_rename(struct inode *old_dir,
1940 struct dentry *old_dentry,
1941 struct inode *new_dir,
1942 struct dentry *new_dentry)
1943 {
1944 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1945 struct common_audit_data ad;
1946 u32 sid = current_sid();
1947 u32 av;
1948 int old_is_dir, new_is_dir;
1949 int rc;
1950
1951 old_dsec = inode_security(old_dir);
1952 old_isec = backing_inode_security(old_dentry);
1953 old_is_dir = d_is_dir(old_dentry);
1954 new_dsec = inode_security(new_dir);
1955
1956 ad.type = LSM_AUDIT_DATA_DENTRY;
1957
1958 ad.u.dentry = old_dentry;
1959 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1960 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1961 if (rc)
1962 return rc;
1963 rc = avc_has_perm(sid, old_isec->sid,
1964 old_isec->sclass, FILE__RENAME, &ad);
1965 if (rc)
1966 return rc;
1967 if (old_is_dir && new_dir != old_dir) {
1968 rc = avc_has_perm(sid, old_isec->sid,
1969 old_isec->sclass, DIR__REPARENT, &ad);
1970 if (rc)
1971 return rc;
1972 }
1973
1974 ad.u.dentry = new_dentry;
1975 av = DIR__ADD_NAME | DIR__SEARCH;
1976 if (d_is_positive(new_dentry))
1977 av |= DIR__REMOVE_NAME;
1978 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1979 if (rc)
1980 return rc;
1981 if (d_is_positive(new_dentry)) {
1982 new_isec = backing_inode_security(new_dentry);
1983 new_is_dir = d_is_dir(new_dentry);
1984 rc = avc_has_perm(sid, new_isec->sid,
1985 new_isec->sclass,
1986 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1987 if (rc)
1988 return rc;
1989 }
1990
1991 return 0;
1992 }
1993
1994 /* Check whether a task can perform a filesystem operation. */
1995 static int superblock_has_perm(const struct cred *cred,
1996 struct super_block *sb,
1997 u32 perms,
1998 struct common_audit_data *ad)
1999 {
2000 struct superblock_security_struct *sbsec;
2001 u32 sid = cred_sid(cred);
2002
2003 sbsec = sb->s_security;
2004 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2005 }
2006
2007 /* Convert a Linux mode and permission mask to an access vector. */
2008 static inline u32 file_mask_to_av(int mode, int mask)
2009 {
2010 u32 av = 0;
2011
2012 if (!S_ISDIR(mode)) {
2013 if (mask & MAY_EXEC)
2014 av |= FILE__EXECUTE;
2015 if (mask & MAY_READ)
2016 av |= FILE__READ;
2017
2018 if (mask & MAY_APPEND)
2019 av |= FILE__APPEND;
2020 else if (mask & MAY_WRITE)
2021 av |= FILE__WRITE;
2022
2023 } else {
2024 if (mask & MAY_EXEC)
2025 av |= DIR__SEARCH;
2026 if (mask & MAY_WRITE)
2027 av |= DIR__WRITE;
2028 if (mask & MAY_READ)
2029 av |= DIR__READ;
2030 }
2031
2032 return av;
2033 }
2034
2035 /* Convert a Linux file to an access vector. */
2036 static inline u32 file_to_av(struct file *file)
2037 {
2038 u32 av = 0;
2039
2040 if (file->f_mode & FMODE_READ)
2041 av |= FILE__READ;
2042 if (file->f_mode & FMODE_WRITE) {
2043 if (file->f_flags & O_APPEND)
2044 av |= FILE__APPEND;
2045 else
2046 av |= FILE__WRITE;
2047 }
2048 if (!av) {
2049 /*
2050 * Special file opened with flags 3 for ioctl-only use.
2051 */
2052 av = FILE__IOCTL;
2053 }
2054
2055 return av;
2056 }
2057
2058 /*
2059 * Convert a file to an access vector and include the correct open
2060 * open permission.
2061 */
2062 static inline u32 open_file_to_av(struct file *file)
2063 {
2064 u32 av = file_to_av(file);
2065
2066 if (selinux_policycap_openperm)
2067 av |= FILE__OPEN;
2068
2069 return av;
2070 }
2071
2072 /* Hook functions begin here. */
2073
2074 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2075 {
2076 u32 mysid = current_sid();
2077 u32 mgrsid = task_sid(mgr);
2078
2079 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2080 BINDER__SET_CONTEXT_MGR, NULL);
2081 }
2082
2083 static int selinux_binder_transaction(struct task_struct *from,
2084 struct task_struct *to)
2085 {
2086 u32 mysid = current_sid();
2087 u32 fromsid = task_sid(from);
2088 u32 tosid = task_sid(to);
2089 int rc;
2090
2091 if (mysid != fromsid) {
2092 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2093 BINDER__IMPERSONATE, NULL);
2094 if (rc)
2095 return rc;
2096 }
2097
2098 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2099 NULL);
2100 }
2101
2102 static int selinux_binder_transfer_binder(struct task_struct *from,
2103 struct task_struct *to)
2104 {
2105 u32 fromsid = task_sid(from);
2106 u32 tosid = task_sid(to);
2107
2108 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2109 NULL);
2110 }
2111
2112 static int selinux_binder_transfer_file(struct task_struct *from,
2113 struct task_struct *to,
2114 struct file *file)
2115 {
2116 u32 sid = task_sid(to);
2117 struct file_security_struct *fsec = file->f_security;
2118 struct dentry *dentry = file->f_path.dentry;
2119 struct inode_security_struct *isec;
2120 struct common_audit_data ad;
2121 int rc;
2122
2123 ad.type = LSM_AUDIT_DATA_PATH;
2124 ad.u.path = file->f_path;
2125
2126 if (sid != fsec->sid) {
2127 rc = avc_has_perm(sid, fsec->sid,
2128 SECCLASS_FD,
2129 FD__USE,
2130 &ad);
2131 if (rc)
2132 return rc;
2133 }
2134
2135 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2136 return 0;
2137
2138 isec = backing_inode_security(dentry);
2139 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2140 &ad);
2141 }
2142
2143 static int selinux_ptrace_access_check(struct task_struct *child,
2144 unsigned int mode)
2145 {
2146 u32 sid = current_sid();
2147 u32 csid = task_sid(child);
2148
2149 if (mode & PTRACE_MODE_READ)
2150 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2151
2152 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2153 }
2154
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2156 {
2157 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2158 PROCESS__PTRACE, NULL);
2159 }
2160
2161 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2162 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2163 {
2164 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2165 PROCESS__GETCAP, NULL);
2166 }
2167
2168 static int selinux_capset(struct cred *new, const struct cred *old,
2169 const kernel_cap_t *effective,
2170 const kernel_cap_t *inheritable,
2171 const kernel_cap_t *permitted)
2172 {
2173 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2174 PROCESS__SETCAP, NULL);
2175 }
2176
2177 /*
2178 * (This comment used to live with the selinux_task_setuid hook,
2179 * which was removed).
2180 *
2181 * Since setuid only affects the current process, and since the SELinux
2182 * controls are not based on the Linux identity attributes, SELinux does not
2183 * need to control this operation. However, SELinux does control the use of
2184 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2185 */
2186
2187 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2188 int cap, int audit)
2189 {
2190 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2191 }
2192
2193 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2194 {
2195 const struct cred *cred = current_cred();
2196 int rc = 0;
2197
2198 if (!sb)
2199 return 0;
2200
2201 switch (cmds) {
2202 case Q_SYNC:
2203 case Q_QUOTAON:
2204 case Q_QUOTAOFF:
2205 case Q_SETINFO:
2206 case Q_SETQUOTA:
2207 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2208 break;
2209 case Q_GETFMT:
2210 case Q_GETINFO:
2211 case Q_GETQUOTA:
2212 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2213 break;
2214 default:
2215 rc = 0; /* let the kernel handle invalid cmds */
2216 break;
2217 }
2218 return rc;
2219 }
2220
2221 static int selinux_quota_on(struct dentry *dentry)
2222 {
2223 const struct cred *cred = current_cred();
2224
2225 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2226 }
2227
2228 static int selinux_syslog(int type)
2229 {
2230 switch (type) {
2231 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2232 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2233 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2234 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2235 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2236 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2237 /* Set level of messages printed to console */
2238 case SYSLOG_ACTION_CONSOLE_LEVEL:
2239 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2240 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2241 NULL);
2242 }
2243 /* All other syslog types */
2244 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2245 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2246 }
2247
2248 /*
2249 * Check that a process has enough memory to allocate a new virtual
2250 * mapping. 0 means there is enough memory for the allocation to
2251 * succeed and -ENOMEM implies there is not.
2252 *
2253 * Do not audit the selinux permission check, as this is applied to all
2254 * processes that allocate mappings.
2255 */
2256 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2257 {
2258 int rc, cap_sys_admin = 0;
2259
2260 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2261 SECURITY_CAP_NOAUDIT, true);
2262 if (rc == 0)
2263 cap_sys_admin = 1;
2264
2265 return cap_sys_admin;
2266 }
2267
2268 /* binprm security operations */
2269
2270 static u32 ptrace_parent_sid(void)
2271 {
2272 u32 sid = 0;
2273 struct task_struct *tracer;
2274
2275 rcu_read_lock();
2276 tracer = ptrace_parent(current);
2277 if (tracer)
2278 sid = task_sid(tracer);
2279 rcu_read_unlock();
2280
2281 return sid;
2282 }
2283
2284 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2285 const struct task_security_struct *old_tsec,
2286 const struct task_security_struct *new_tsec)
2287 {
2288 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2289 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2290 int rc;
2291
2292 if (!nnp && !nosuid)
2293 return 0; /* neither NNP nor nosuid */
2294
2295 if (new_tsec->sid == old_tsec->sid)
2296 return 0; /* No change in credentials */
2297
2298 /*
2299 * The only transitions we permit under NNP or nosuid
2300 * are transitions to bounded SIDs, i.e. SIDs that are
2301 * guaranteed to only be allowed a subset of the permissions
2302 * of the current SID.
2303 */
2304 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2305 if (rc) {
2306 /*
2307 * On failure, preserve the errno values for NNP vs nosuid.
2308 * NNP: Operation not permitted for caller.
2309 * nosuid: Permission denied to file.
2310 */
2311 if (nnp)
2312 return -EPERM;
2313 else
2314 return -EACCES;
2315 }
2316 return 0;
2317 }
2318
2319 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2320 {
2321 const struct task_security_struct *old_tsec;
2322 struct task_security_struct *new_tsec;
2323 struct inode_security_struct *isec;
2324 struct common_audit_data ad;
2325 struct inode *inode = file_inode(bprm->file);
2326 int rc;
2327
2328 /* SELinux context only depends on initial program or script and not
2329 * the script interpreter */
2330 if (bprm->cred_prepared)
2331 return 0;
2332
2333 old_tsec = current_security();
2334 new_tsec = bprm->cred->security;
2335 isec = inode_security(inode);
2336
2337 /* Default to the current task SID. */
2338 new_tsec->sid = old_tsec->sid;
2339 new_tsec->osid = old_tsec->sid;
2340
2341 /* Reset fs, key, and sock SIDs on execve. */
2342 new_tsec->create_sid = 0;
2343 new_tsec->keycreate_sid = 0;
2344 new_tsec->sockcreate_sid = 0;
2345
2346 if (old_tsec->exec_sid) {
2347 new_tsec->sid = old_tsec->exec_sid;
2348 /* Reset exec SID on execve. */
2349 new_tsec->exec_sid = 0;
2350
2351 /* Fail on NNP or nosuid if not an allowed transition. */
2352 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2353 if (rc)
2354 return rc;
2355 } else {
2356 /* Check for a default transition on this program. */
2357 rc = security_transition_sid(old_tsec->sid, isec->sid,
2358 SECCLASS_PROCESS, NULL,
2359 &new_tsec->sid);
2360 if (rc)
2361 return rc;
2362
2363 /*
2364 * Fallback to old SID on NNP or nosuid if not an allowed
2365 * transition.
2366 */
2367 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2368 if (rc)
2369 new_tsec->sid = old_tsec->sid;
2370 }
2371
2372 ad.type = LSM_AUDIT_DATA_FILE;
2373 ad.u.file = bprm->file;
2374
2375 if (new_tsec->sid == old_tsec->sid) {
2376 rc = avc_has_perm(old_tsec->sid, isec->sid,
2377 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2378 if (rc)
2379 return rc;
2380 } else {
2381 /* Check permissions for the transition. */
2382 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2383 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2384 if (rc)
2385 return rc;
2386
2387 rc = avc_has_perm(new_tsec->sid, isec->sid,
2388 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2389 if (rc)
2390 return rc;
2391
2392 /* Check for shared state */
2393 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2394 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2395 SECCLASS_PROCESS, PROCESS__SHARE,
2396 NULL);
2397 if (rc)
2398 return -EPERM;
2399 }
2400
2401 /* Make sure that anyone attempting to ptrace over a task that
2402 * changes its SID has the appropriate permit */
2403 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2404 u32 ptsid = ptrace_parent_sid();
2405 if (ptsid != 0) {
2406 rc = avc_has_perm(ptsid, new_tsec->sid,
2407 SECCLASS_PROCESS,
2408 PROCESS__PTRACE, NULL);
2409 if (rc)
2410 return -EPERM;
2411 }
2412 }
2413
2414 /* Clear any possibly unsafe personality bits on exec: */
2415 bprm->per_clear |= PER_CLEAR_ON_SETID;
2416 }
2417
2418 return 0;
2419 }
2420
2421 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2422 {
2423 const struct task_security_struct *tsec = current_security();
2424 u32 sid, osid;
2425 int atsecure = 0;
2426
2427 sid = tsec->sid;
2428 osid = tsec->osid;
2429
2430 if (osid != sid) {
2431 /* Enable secure mode for SIDs transitions unless
2432 the noatsecure permission is granted between
2433 the two SIDs, i.e. ahp returns 0. */
2434 atsecure = avc_has_perm(osid, sid,
2435 SECCLASS_PROCESS,
2436 PROCESS__NOATSECURE, NULL);
2437 }
2438
2439 return !!atsecure;
2440 }
2441
2442 static int match_file(const void *p, struct file *file, unsigned fd)
2443 {
2444 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2445 }
2446
2447 /* Derived from fs/exec.c:flush_old_files. */
2448 static inline void flush_unauthorized_files(const struct cred *cred,
2449 struct files_struct *files)
2450 {
2451 struct file *file, *devnull = NULL;
2452 struct tty_struct *tty;
2453 int drop_tty = 0;
2454 unsigned n;
2455
2456 tty = get_current_tty();
2457 if (tty) {
2458 spin_lock(&tty->files_lock);
2459 if (!list_empty(&tty->tty_files)) {
2460 struct tty_file_private *file_priv;
2461
2462 /* Revalidate access to controlling tty.
2463 Use file_path_has_perm on the tty path directly
2464 rather than using file_has_perm, as this particular
2465 open file may belong to another process and we are
2466 only interested in the inode-based check here. */
2467 file_priv = list_first_entry(&tty->tty_files,
2468 struct tty_file_private, list);
2469 file = file_priv->file;
2470 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2471 drop_tty = 1;
2472 }
2473 spin_unlock(&tty->files_lock);
2474 tty_kref_put(tty);
2475 }
2476 /* Reset controlling tty. */
2477 if (drop_tty)
2478 no_tty();
2479
2480 /* Revalidate access to inherited open files. */
2481 n = iterate_fd(files, 0, match_file, cred);
2482 if (!n) /* none found? */
2483 return;
2484
2485 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2486 if (IS_ERR(devnull))
2487 devnull = NULL;
2488 /* replace all the matching ones with this */
2489 do {
2490 replace_fd(n - 1, devnull, 0);
2491 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2492 if (devnull)
2493 fput(devnull);
2494 }
2495
2496 /*
2497 * Prepare a process for imminent new credential changes due to exec
2498 */
2499 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2500 {
2501 struct task_security_struct *new_tsec;
2502 struct rlimit *rlim, *initrlim;
2503 int rc, i;
2504
2505 new_tsec = bprm->cred->security;
2506 if (new_tsec->sid == new_tsec->osid)
2507 return;
2508
2509 /* Close files for which the new task SID is not authorized. */
2510 flush_unauthorized_files(bprm->cred, current->files);
2511
2512 /* Always clear parent death signal on SID transitions. */
2513 current->pdeath_signal = 0;
2514
2515 /* Check whether the new SID can inherit resource limits from the old
2516 * SID. If not, reset all soft limits to the lower of the current
2517 * task's hard limit and the init task's soft limit.
2518 *
2519 * Note that the setting of hard limits (even to lower them) can be
2520 * controlled by the setrlimit check. The inclusion of the init task's
2521 * soft limit into the computation is to avoid resetting soft limits
2522 * higher than the default soft limit for cases where the default is
2523 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2524 */
2525 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2526 PROCESS__RLIMITINH, NULL);
2527 if (rc) {
2528 /* protect against do_prlimit() */
2529 task_lock(current);
2530 for (i = 0; i < RLIM_NLIMITS; i++) {
2531 rlim = current->signal->rlim + i;
2532 initrlim = init_task.signal->rlim + i;
2533 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2534 }
2535 task_unlock(current);
2536 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2537 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2538 }
2539 }
2540
2541 /*
2542 * Clean up the process immediately after the installation of new credentials
2543 * due to exec
2544 */
2545 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2546 {
2547 const struct task_security_struct *tsec = current_security();
2548 struct itimerval itimer;
2549 u32 osid, sid;
2550 int rc, i;
2551
2552 osid = tsec->osid;
2553 sid = tsec->sid;
2554
2555 if (sid == osid)
2556 return;
2557
2558 /* Check whether the new SID can inherit signal state from the old SID.
2559 * If not, clear itimers to avoid subsequent signal generation and
2560 * flush and unblock signals.
2561 *
2562 * This must occur _after_ the task SID has been updated so that any
2563 * kill done after the flush will be checked against the new SID.
2564 */
2565 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2566 if (rc) {
2567 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2568 memset(&itimer, 0, sizeof itimer);
2569 for (i = 0; i < 3; i++)
2570 do_setitimer(i, &itimer, NULL);
2571 }
2572 spin_lock_irq(&current->sighand->siglock);
2573 if (!fatal_signal_pending(current)) {
2574 flush_sigqueue(&current->pending);
2575 flush_sigqueue(&current->signal->shared_pending);
2576 flush_signal_handlers(current, 1);
2577 sigemptyset(&current->blocked);
2578 recalc_sigpending();
2579 }
2580 spin_unlock_irq(&current->sighand->siglock);
2581 }
2582
2583 /* Wake up the parent if it is waiting so that it can recheck
2584 * wait permission to the new task SID. */
2585 read_lock(&tasklist_lock);
2586 __wake_up_parent(current, current->real_parent);
2587 read_unlock(&tasklist_lock);
2588 }
2589
2590 /* superblock security operations */
2591
2592 static int selinux_sb_alloc_security(struct super_block *sb)
2593 {
2594 return superblock_alloc_security(sb);
2595 }
2596
2597 static void selinux_sb_free_security(struct super_block *sb)
2598 {
2599 superblock_free_security(sb);
2600 }
2601
2602 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2603 {
2604 if (plen > olen)
2605 return 0;
2606
2607 return !memcmp(prefix, option, plen);
2608 }
2609
2610 static inline int selinux_option(char *option, int len)
2611 {
2612 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2613 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2614 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2615 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2616 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2617 }
2618
2619 static inline void take_option(char **to, char *from, int *first, int len)
2620 {
2621 if (!*first) {
2622 **to = ',';
2623 *to += 1;
2624 } else
2625 *first = 0;
2626 memcpy(*to, from, len);
2627 *to += len;
2628 }
2629
2630 static inline void take_selinux_option(char **to, char *from, int *first,
2631 int len)
2632 {
2633 int current_size = 0;
2634
2635 if (!*first) {
2636 **to = '|';
2637 *to += 1;
2638 } else
2639 *first = 0;
2640
2641 while (current_size < len) {
2642 if (*from != '"') {
2643 **to = *from;
2644 *to += 1;
2645 }
2646 from += 1;
2647 current_size += 1;
2648 }
2649 }
2650
2651 static int selinux_sb_copy_data(char *orig, char *copy)
2652 {
2653 int fnosec, fsec, rc = 0;
2654 char *in_save, *in_curr, *in_end;
2655 char *sec_curr, *nosec_save, *nosec;
2656 int open_quote = 0;
2657
2658 in_curr = orig;
2659 sec_curr = copy;
2660
2661 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2662 if (!nosec) {
2663 rc = -ENOMEM;
2664 goto out;
2665 }
2666
2667 nosec_save = nosec;
2668 fnosec = fsec = 1;
2669 in_save = in_end = orig;
2670
2671 do {
2672 if (*in_end == '"')
2673 open_quote = !open_quote;
2674 if ((*in_end == ',' && open_quote == 0) ||
2675 *in_end == '\0') {
2676 int len = in_end - in_curr;
2677
2678 if (selinux_option(in_curr, len))
2679 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2680 else
2681 take_option(&nosec, in_curr, &fnosec, len);
2682
2683 in_curr = in_end + 1;
2684 }
2685 } while (*in_end++);
2686
2687 strcpy(in_save, nosec_save);
2688 free_page((unsigned long)nosec_save);
2689 out:
2690 return rc;
2691 }
2692
2693 static int selinux_sb_remount(struct super_block *sb, void *data)
2694 {
2695 int rc, i, *flags;
2696 struct security_mnt_opts opts;
2697 char *secdata, **mount_options;
2698 struct superblock_security_struct *sbsec = sb->s_security;
2699
2700 if (!(sbsec->flags & SE_SBINITIALIZED))
2701 return 0;
2702
2703 if (!data)
2704 return 0;
2705
2706 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2707 return 0;
2708
2709 security_init_mnt_opts(&opts);
2710 secdata = alloc_secdata();
2711 if (!secdata)
2712 return -ENOMEM;
2713 rc = selinux_sb_copy_data(data, secdata);
2714 if (rc)
2715 goto out_free_secdata;
2716
2717 rc = selinux_parse_opts_str(secdata, &opts);
2718 if (rc)
2719 goto out_free_secdata;
2720
2721 mount_options = opts.mnt_opts;
2722 flags = opts.mnt_opts_flags;
2723
2724 for (i = 0; i < opts.num_mnt_opts; i++) {
2725 u32 sid;
2726
2727 if (flags[i] == SBLABEL_MNT)
2728 continue;
2729 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2730 if (rc) {
2731 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2732 "(%s) failed for (dev %s, type %s) errno=%d\n",
2733 mount_options[i], sb->s_id, sb->s_type->name, rc);
2734 goto out_free_opts;
2735 }
2736 rc = -EINVAL;
2737 switch (flags[i]) {
2738 case FSCONTEXT_MNT:
2739 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2740 goto out_bad_option;
2741 break;
2742 case CONTEXT_MNT:
2743 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2744 goto out_bad_option;
2745 break;
2746 case ROOTCONTEXT_MNT: {
2747 struct inode_security_struct *root_isec;
2748 root_isec = backing_inode_security(sb->s_root);
2749
2750 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2751 goto out_bad_option;
2752 break;
2753 }
2754 case DEFCONTEXT_MNT:
2755 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2756 goto out_bad_option;
2757 break;
2758 default:
2759 goto out_free_opts;
2760 }
2761 }
2762
2763 rc = 0;
2764 out_free_opts:
2765 security_free_mnt_opts(&opts);
2766 out_free_secdata:
2767 free_secdata(secdata);
2768 return rc;
2769 out_bad_option:
2770 printk(KERN_WARNING "SELinux: unable to change security options "
2771 "during remount (dev %s, type=%s)\n", sb->s_id,
2772 sb->s_type->name);
2773 goto out_free_opts;
2774 }
2775
2776 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2777 {
2778 const struct cred *cred = current_cred();
2779 struct common_audit_data ad;
2780 int rc;
2781
2782 rc = superblock_doinit(sb, data);
2783 if (rc)
2784 return rc;
2785
2786 /* Allow all mounts performed by the kernel */
2787 if (flags & MS_KERNMOUNT)
2788 return 0;
2789
2790 ad.type = LSM_AUDIT_DATA_DENTRY;
2791 ad.u.dentry = sb->s_root;
2792 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2793 }
2794
2795 static int selinux_sb_statfs(struct dentry *dentry)
2796 {
2797 const struct cred *cred = current_cred();
2798 struct common_audit_data ad;
2799
2800 ad.type = LSM_AUDIT_DATA_DENTRY;
2801 ad.u.dentry = dentry->d_sb->s_root;
2802 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2803 }
2804
2805 static int selinux_mount(const char *dev_name,
2806 const struct path *path,
2807 const char *type,
2808 unsigned long flags,
2809 void *data)
2810 {
2811 const struct cred *cred = current_cred();
2812
2813 if (flags & MS_REMOUNT)
2814 return superblock_has_perm(cred, path->dentry->d_sb,
2815 FILESYSTEM__REMOUNT, NULL);
2816 else
2817 return path_has_perm(cred, path, FILE__MOUNTON);
2818 }
2819
2820 static int selinux_umount(struct vfsmount *mnt, int flags)
2821 {
2822 const struct cred *cred = current_cred();
2823
2824 return superblock_has_perm(cred, mnt->mnt_sb,
2825 FILESYSTEM__UNMOUNT, NULL);
2826 }
2827
2828 /* inode security operations */
2829
2830 static int selinux_inode_alloc_security(struct inode *inode)
2831 {
2832 return inode_alloc_security(inode);
2833 }
2834
2835 static void selinux_inode_free_security(struct inode *inode)
2836 {
2837 inode_free_security(inode);
2838 }
2839
2840 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2841 const struct qstr *name, void **ctx,
2842 u32 *ctxlen)
2843 {
2844 u32 newsid;
2845 int rc;
2846
2847 rc = selinux_determine_inode_label(current_security(),
2848 d_inode(dentry->d_parent), name,
2849 inode_mode_to_security_class(mode),
2850 &newsid);
2851 if (rc)
2852 return rc;
2853
2854 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2855 }
2856
2857 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2858 struct qstr *name,
2859 const struct cred *old,
2860 struct cred *new)
2861 {
2862 u32 newsid;
2863 int rc;
2864 struct task_security_struct *tsec;
2865
2866 rc = selinux_determine_inode_label(old->security,
2867 d_inode(dentry->d_parent), name,
2868 inode_mode_to_security_class(mode),
2869 &newsid);
2870 if (rc)
2871 return rc;
2872
2873 tsec = new->security;
2874 tsec->create_sid = newsid;
2875 return 0;
2876 }
2877
2878 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2879 const struct qstr *qstr,
2880 const char **name,
2881 void **value, size_t *len)
2882 {
2883 const struct task_security_struct *tsec = current_security();
2884 struct superblock_security_struct *sbsec;
2885 u32 sid, newsid, clen;
2886 int rc;
2887 char *context;
2888
2889 sbsec = dir->i_sb->s_security;
2890
2891 sid = tsec->sid;
2892 newsid = tsec->create_sid;
2893
2894 rc = selinux_determine_inode_label(current_security(),
2895 dir, qstr,
2896 inode_mode_to_security_class(inode->i_mode),
2897 &newsid);
2898 if (rc)
2899 return rc;
2900
2901 /* Possibly defer initialization to selinux_complete_init. */
2902 if (sbsec->flags & SE_SBINITIALIZED) {
2903 struct inode_security_struct *isec = inode->i_security;
2904 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2905 isec->sid = newsid;
2906 isec->initialized = LABEL_INITIALIZED;
2907 }
2908
2909 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2910 return -EOPNOTSUPP;
2911
2912 if (name)
2913 *name = XATTR_SELINUX_SUFFIX;
2914
2915 if (value && len) {
2916 rc = security_sid_to_context_force(newsid, &context, &clen);
2917 if (rc)
2918 return rc;
2919 *value = context;
2920 *len = clen;
2921 }
2922
2923 return 0;
2924 }
2925
2926 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2927 {
2928 return may_create(dir, dentry, SECCLASS_FILE);
2929 }
2930
2931 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2932 {
2933 return may_link(dir, old_dentry, MAY_LINK);
2934 }
2935
2936 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2937 {
2938 return may_link(dir, dentry, MAY_UNLINK);
2939 }
2940
2941 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2942 {
2943 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2944 }
2945
2946 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2947 {
2948 return may_create(dir, dentry, SECCLASS_DIR);
2949 }
2950
2951 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2952 {
2953 return may_link(dir, dentry, MAY_RMDIR);
2954 }
2955
2956 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2957 {
2958 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2959 }
2960
2961 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2962 struct inode *new_inode, struct dentry *new_dentry)
2963 {
2964 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2965 }
2966
2967 static int selinux_inode_readlink(struct dentry *dentry)
2968 {
2969 const struct cred *cred = current_cred();
2970
2971 return dentry_has_perm(cred, dentry, FILE__READ);
2972 }
2973
2974 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2975 bool rcu)
2976 {
2977 const struct cred *cred = current_cred();
2978 struct common_audit_data ad;
2979 struct inode_security_struct *isec;
2980 u32 sid;
2981
2982 validate_creds(cred);
2983
2984 ad.type = LSM_AUDIT_DATA_DENTRY;
2985 ad.u.dentry = dentry;
2986 sid = cred_sid(cred);
2987 isec = inode_security_rcu(inode, rcu);
2988 if (IS_ERR(isec))
2989 return PTR_ERR(isec);
2990
2991 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2992 rcu ? MAY_NOT_BLOCK : 0);
2993 }
2994
2995 static noinline int audit_inode_permission(struct inode *inode,
2996 u32 perms, u32 audited, u32 denied,
2997 int result,
2998 unsigned flags)
2999 {
3000 struct common_audit_data ad;
3001 struct inode_security_struct *isec = inode->i_security;
3002 int rc;
3003
3004 ad.type = LSM_AUDIT_DATA_INODE;
3005 ad.u.inode = inode;
3006
3007 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3008 audited, denied, result, &ad, flags);
3009 if (rc)
3010 return rc;
3011 return 0;
3012 }
3013
3014 static int selinux_inode_permission(struct inode *inode, int mask)
3015 {
3016 const struct cred *cred = current_cred();
3017 u32 perms;
3018 bool from_access;
3019 unsigned flags = mask & MAY_NOT_BLOCK;
3020 struct inode_security_struct *isec;
3021 u32 sid;
3022 struct av_decision avd;
3023 int rc, rc2;
3024 u32 audited, denied;
3025
3026 from_access = mask & MAY_ACCESS;
3027 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3028
3029 /* No permission to check. Existence test. */
3030 if (!mask)
3031 return 0;
3032
3033 validate_creds(cred);
3034
3035 if (unlikely(IS_PRIVATE(inode)))
3036 return 0;
3037
3038 perms = file_mask_to_av(inode->i_mode, mask);
3039
3040 sid = cred_sid(cred);
3041 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3042 if (IS_ERR(isec))
3043 return PTR_ERR(isec);
3044
3045 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3046 audited = avc_audit_required(perms, &avd, rc,
3047 from_access ? FILE__AUDIT_ACCESS : 0,
3048 &denied);
3049 if (likely(!audited))
3050 return rc;
3051
3052 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3053 if (rc2)
3054 return rc2;
3055 return rc;
3056 }
3057
3058 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3059 {
3060 const struct cred *cred = current_cred();
3061 unsigned int ia_valid = iattr->ia_valid;
3062 __u32 av = FILE__WRITE;
3063
3064 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3065 if (ia_valid & ATTR_FORCE) {
3066 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3067 ATTR_FORCE);
3068 if (!ia_valid)
3069 return 0;
3070 }
3071
3072 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3073 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3074 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3075
3076 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3077 && !(ia_valid & ATTR_FILE))
3078 av |= FILE__OPEN;
3079
3080 return dentry_has_perm(cred, dentry, av);
3081 }
3082
3083 static int selinux_inode_getattr(const struct path *path)
3084 {
3085 return path_has_perm(current_cred(), path, FILE__GETATTR);
3086 }
3087
3088 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3089 {
3090 const struct cred *cred = current_cred();
3091
3092 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3093 sizeof XATTR_SECURITY_PREFIX - 1)) {
3094 if (!strcmp(name, XATTR_NAME_CAPS)) {
3095 if (!capable(CAP_SETFCAP))
3096 return -EPERM;
3097 } else if (!capable(CAP_SYS_ADMIN)) {
3098 /* A different attribute in the security namespace.
3099 Restrict to administrator. */
3100 return -EPERM;
3101 }
3102 }
3103
3104 /* Not an attribute we recognize, so just check the
3105 ordinary setattr permission. */
3106 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3107 }
3108
3109 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3110 const void *value, size_t size, int flags)
3111 {
3112 struct inode *inode = d_backing_inode(dentry);
3113 struct inode_security_struct *isec;
3114 struct superblock_security_struct *sbsec;
3115 struct common_audit_data ad;
3116 u32 newsid, sid = current_sid();
3117 int rc = 0;
3118
3119 if (strcmp(name, XATTR_NAME_SELINUX))
3120 return selinux_inode_setotherxattr(dentry, name);
3121
3122 sbsec = inode->i_sb->s_security;
3123 if (!(sbsec->flags & SBLABEL_MNT))
3124 return -EOPNOTSUPP;
3125
3126 if (!inode_owner_or_capable(inode))
3127 return -EPERM;
3128
3129 ad.type = LSM_AUDIT_DATA_DENTRY;
3130 ad.u.dentry = dentry;
3131
3132 isec = backing_inode_security(dentry);
3133 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3134 FILE__RELABELFROM, &ad);
3135 if (rc)
3136 return rc;
3137
3138 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3139 if (rc == -EINVAL) {
3140 if (!capable(CAP_MAC_ADMIN)) {
3141 struct audit_buffer *ab;
3142 size_t audit_size;
3143 const char *str;
3144
3145 /* We strip a nul only if it is at the end, otherwise the
3146 * context contains a nul and we should audit that */
3147 if (value) {
3148 str = value;
3149 if (str[size - 1] == '\0')
3150 audit_size = size - 1;
3151 else
3152 audit_size = size;
3153 } else {
3154 str = "";
3155 audit_size = 0;
3156 }
3157 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3158 audit_log_format(ab, "op=setxattr invalid_context=");
3159 audit_log_n_untrustedstring(ab, value, audit_size);
3160 audit_log_end(ab);
3161
3162 return rc;
3163 }
3164 rc = security_context_to_sid_force(value, size, &newsid);
3165 }
3166 if (rc)
3167 return rc;
3168
3169 rc = avc_has_perm(sid, newsid, isec->sclass,
3170 FILE__RELABELTO, &ad);
3171 if (rc)
3172 return rc;
3173
3174 rc = security_validate_transition(isec->sid, newsid, sid,
3175 isec->sclass);
3176 if (rc)
3177 return rc;
3178
3179 return avc_has_perm(newsid,
3180 sbsec->sid,
3181 SECCLASS_FILESYSTEM,
3182 FILESYSTEM__ASSOCIATE,
3183 &ad);
3184 }
3185
3186 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3187 const void *value, size_t size,
3188 int flags)
3189 {
3190 struct inode *inode = d_backing_inode(dentry);
3191 struct inode_security_struct *isec;
3192 u32 newsid;
3193 int rc;
3194
3195 if (strcmp(name, XATTR_NAME_SELINUX)) {
3196 /* Not an attribute we recognize, so nothing to do. */
3197 return;
3198 }
3199
3200 rc = security_context_to_sid_force(value, size, &newsid);
3201 if (rc) {
3202 printk(KERN_ERR "SELinux: unable to map context to SID"
3203 "for (%s, %lu), rc=%d\n",
3204 inode->i_sb->s_id, inode->i_ino, -rc);
3205 return;
3206 }
3207
3208 isec = backing_inode_security(dentry);
3209 spin_lock(&isec->lock);
3210 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3211 isec->sid = newsid;
3212 isec->initialized = LABEL_INITIALIZED;
3213 spin_unlock(&isec->lock);
3214
3215 return;
3216 }
3217
3218 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3219 {
3220 const struct cred *cred = current_cred();
3221
3222 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3223 }
3224
3225 static int selinux_inode_listxattr(struct dentry *dentry)
3226 {
3227 const struct cred *cred = current_cred();
3228
3229 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3230 }
3231
3232 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3233 {
3234 if (strcmp(name, XATTR_NAME_SELINUX))
3235 return selinux_inode_setotherxattr(dentry, name);
3236
3237 /* No one is allowed to remove a SELinux security label.
3238 You can change the label, but all data must be labeled. */
3239 return -EACCES;
3240 }
3241
3242 /*
3243 * Copy the inode security context value to the user.
3244 *
3245 * Permission check is handled by selinux_inode_getxattr hook.
3246 */
3247 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3248 {
3249 u32 size;
3250 int error;
3251 char *context = NULL;
3252 struct inode_security_struct *isec;
3253
3254 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3255 return -EOPNOTSUPP;
3256
3257 /*
3258 * If the caller has CAP_MAC_ADMIN, then get the raw context
3259 * value even if it is not defined by current policy; otherwise,
3260 * use the in-core value under current policy.
3261 * Use the non-auditing forms of the permission checks since
3262 * getxattr may be called by unprivileged processes commonly
3263 * and lack of permission just means that we fall back to the
3264 * in-core context value, not a denial.
3265 */
3266 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3267 SECURITY_CAP_NOAUDIT);
3268 if (!error)
3269 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3270 SECURITY_CAP_NOAUDIT, true);
3271 isec = inode_security(inode);
3272 if (!error)
3273 error = security_sid_to_context_force(isec->sid, &context,
3274 &size);
3275 else
3276 error = security_sid_to_context(isec->sid, &context, &size);
3277 if (error)
3278 return error;
3279 error = size;
3280 if (alloc) {
3281 *buffer = context;
3282 goto out_nofree;
3283 }
3284 kfree(context);
3285 out_nofree:
3286 return error;
3287 }
3288
3289 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3290 const void *value, size_t size, int flags)
3291 {
3292 struct inode_security_struct *isec = inode_security_novalidate(inode);
3293 u32 newsid;
3294 int rc;
3295
3296 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3297 return -EOPNOTSUPP;
3298
3299 if (!value || !size)
3300 return -EACCES;
3301
3302 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3303 if (rc)
3304 return rc;
3305
3306 spin_lock(&isec->lock);
3307 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3308 isec->sid = newsid;
3309 isec->initialized = LABEL_INITIALIZED;
3310 spin_unlock(&isec->lock);
3311 return 0;
3312 }
3313
3314 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3315 {
3316 const int len = sizeof(XATTR_NAME_SELINUX);
3317 if (buffer && len <= buffer_size)
3318 memcpy(buffer, XATTR_NAME_SELINUX, len);
3319 return len;
3320 }
3321
3322 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3323 {
3324 struct inode_security_struct *isec = inode_security_novalidate(inode);
3325 *secid = isec->sid;
3326 }
3327
3328 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3329 {
3330 u32 sid;
3331 struct task_security_struct *tsec;
3332 struct cred *new_creds = *new;
3333
3334 if (new_creds == NULL) {
3335 new_creds = prepare_creds();
3336 if (!new_creds)
3337 return -ENOMEM;
3338 }
3339
3340 tsec = new_creds->security;
3341 /* Get label from overlay inode and set it in create_sid */
3342 selinux_inode_getsecid(d_inode(src), &sid);
3343 tsec->create_sid = sid;
3344 *new = new_creds;
3345 return 0;
3346 }
3347
3348 static int selinux_inode_copy_up_xattr(const char *name)
3349 {
3350 /* The copy_up hook above sets the initial context on an inode, but we
3351 * don't then want to overwrite it by blindly copying all the lower
3352 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3353 */
3354 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3355 return 1; /* Discard */
3356 /*
3357 * Any other attribute apart from SELINUX is not claimed, supported
3358 * by selinux.
3359 */
3360 return -EOPNOTSUPP;
3361 }
3362
3363 /* file security operations */
3364
3365 static int selinux_revalidate_file_permission(struct file *file, int mask)
3366 {
3367 const struct cred *cred = current_cred();
3368 struct inode *inode = file_inode(file);
3369
3370 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3371 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3372 mask |= MAY_APPEND;
3373
3374 return file_has_perm(cred, file,
3375 file_mask_to_av(inode->i_mode, mask));
3376 }
3377
3378 static int selinux_file_permission(struct file *file, int mask)
3379 {
3380 struct inode *inode = file_inode(file);
3381 struct file_security_struct *fsec = file->f_security;
3382 struct inode_security_struct *isec;
3383 u32 sid = current_sid();
3384
3385 if (!mask)
3386 /* No permission to check. Existence test. */
3387 return 0;
3388
3389 isec = inode_security(inode);
3390 if (sid == fsec->sid && fsec->isid == isec->sid &&
3391 fsec->pseqno == avc_policy_seqno())
3392 /* No change since file_open check. */
3393 return 0;
3394
3395 return selinux_revalidate_file_permission(file, mask);
3396 }
3397
3398 static int selinux_file_alloc_security(struct file *file)
3399 {
3400 return file_alloc_security(file);
3401 }
3402
3403 static void selinux_file_free_security(struct file *file)
3404 {
3405 file_free_security(file);
3406 }
3407
3408 /*
3409 * Check whether a task has the ioctl permission and cmd
3410 * operation to an inode.
3411 */
3412 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3413 u32 requested, u16 cmd)
3414 {
3415 struct common_audit_data ad;
3416 struct file_security_struct *fsec = file->f_security;
3417 struct inode *inode = file_inode(file);
3418 struct inode_security_struct *isec;
3419 struct lsm_ioctlop_audit ioctl;
3420 u32 ssid = cred_sid(cred);
3421 int rc;
3422 u8 driver = cmd >> 8;
3423 u8 xperm = cmd & 0xff;
3424
3425 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3426 ad.u.op = &ioctl;
3427 ad.u.op->cmd = cmd;
3428 ad.u.op->path = file->f_path;
3429
3430 if (ssid != fsec->sid) {
3431 rc = avc_has_perm(ssid, fsec->sid,
3432 SECCLASS_FD,
3433 FD__USE,
3434 &ad);
3435 if (rc)
3436 goto out;
3437 }
3438
3439 if (unlikely(IS_PRIVATE(inode)))
3440 return 0;
3441
3442 isec = inode_security(inode);
3443 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3444 requested, driver, xperm, &ad);
3445 out:
3446 return rc;
3447 }
3448
3449 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3450 unsigned long arg)
3451 {
3452 const struct cred *cred = current_cred();
3453 int error = 0;
3454
3455 switch (cmd) {
3456 case FIONREAD:
3457 /* fall through */
3458 case FIBMAP:
3459 /* fall through */
3460 case FIGETBSZ:
3461 /* fall through */
3462 case FS_IOC_GETFLAGS:
3463 /* fall through */
3464 case FS_IOC_GETVERSION:
3465 error = file_has_perm(cred, file, FILE__GETATTR);
3466 break;
3467
3468 case FS_IOC_SETFLAGS:
3469 /* fall through */
3470 case FS_IOC_SETVERSION:
3471 error = file_has_perm(cred, file, FILE__SETATTR);
3472 break;
3473
3474 /* sys_ioctl() checks */
3475 case FIONBIO:
3476 /* fall through */
3477 case FIOASYNC:
3478 error = file_has_perm(cred, file, 0);
3479 break;
3480
3481 case KDSKBENT:
3482 case KDSKBSENT:
3483 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3484 SECURITY_CAP_AUDIT, true);
3485 break;
3486
3487 /* default case assumes that the command will go
3488 * to the file's ioctl() function.
3489 */
3490 default:
3491 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3492 }
3493 return error;
3494 }
3495
3496 static int default_noexec;
3497
3498 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3499 {
3500 const struct cred *cred = current_cred();
3501 u32 sid = cred_sid(cred);
3502 int rc = 0;
3503
3504 if (default_noexec &&
3505 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3506 (!shared && (prot & PROT_WRITE)))) {
3507 /*
3508 * We are making executable an anonymous mapping or a
3509 * private file mapping that will also be writable.
3510 * This has an additional check.
3511 */
3512 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3513 PROCESS__EXECMEM, NULL);
3514 if (rc)
3515 goto error;
3516 }
3517
3518 if (file) {
3519 /* read access is always possible with a mapping */
3520 u32 av = FILE__READ;
3521
3522 /* write access only matters if the mapping is shared */
3523 if (shared && (prot & PROT_WRITE))
3524 av |= FILE__WRITE;
3525
3526 if (prot & PROT_EXEC)
3527 av |= FILE__EXECUTE;
3528
3529 return file_has_perm(cred, file, av);
3530 }
3531
3532 error:
3533 return rc;
3534 }
3535
3536 static int selinux_mmap_addr(unsigned long addr)
3537 {
3538 int rc = 0;
3539
3540 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3541 u32 sid = current_sid();
3542 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3543 MEMPROTECT__MMAP_ZERO, NULL);
3544 }
3545
3546 return rc;
3547 }
3548
3549 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3550 unsigned long prot, unsigned long flags)
3551 {
3552 if (selinux_checkreqprot)
3553 prot = reqprot;
3554
3555 return file_map_prot_check(file, prot,
3556 (flags & MAP_TYPE) == MAP_SHARED);
3557 }
3558
3559 static int selinux_file_mprotect(struct vm_area_struct *vma,
3560 unsigned long reqprot,
3561 unsigned long prot)
3562 {
3563 const struct cred *cred = current_cred();
3564 u32 sid = cred_sid(cred);
3565
3566 if (selinux_checkreqprot)
3567 prot = reqprot;
3568
3569 if (default_noexec &&
3570 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3571 int rc = 0;
3572 if (vma->vm_start >= vma->vm_mm->start_brk &&
3573 vma->vm_end <= vma->vm_mm->brk) {
3574 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3575 PROCESS__EXECHEAP, NULL);
3576 } else if (!vma->vm_file &&
3577 ((vma->vm_start <= vma->vm_mm->start_stack &&
3578 vma->vm_end >= vma->vm_mm->start_stack) ||
3579 vma_is_stack_for_current(vma))) {
3580 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3581 PROCESS__EXECSTACK, NULL);
3582 } else if (vma->vm_file && vma->anon_vma) {
3583 /*
3584 * We are making executable a file mapping that has
3585 * had some COW done. Since pages might have been
3586 * written, check ability to execute the possibly
3587 * modified content. This typically should only
3588 * occur for text relocations.
3589 */
3590 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3591 }
3592 if (rc)
3593 return rc;
3594 }
3595
3596 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3597 }
3598
3599 static int selinux_file_lock(struct file *file, unsigned int cmd)
3600 {
3601 const struct cred *cred = current_cred();
3602
3603 return file_has_perm(cred, file, FILE__LOCK);
3604 }
3605
3606 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3607 unsigned long arg)
3608 {
3609 const struct cred *cred = current_cred();
3610 int err = 0;
3611
3612 switch (cmd) {
3613 case F_SETFL:
3614 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3615 err = file_has_perm(cred, file, FILE__WRITE);
3616 break;
3617 }
3618 /* fall through */
3619 case F_SETOWN:
3620 case F_SETSIG:
3621 case F_GETFL:
3622 case F_GETOWN:
3623 case F_GETSIG:
3624 case F_GETOWNER_UIDS:
3625 /* Just check FD__USE permission */
3626 err = file_has_perm(cred, file, 0);
3627 break;
3628 case F_GETLK:
3629 case F_SETLK:
3630 case F_SETLKW:
3631 case F_OFD_GETLK:
3632 case F_OFD_SETLK:
3633 case F_OFD_SETLKW:
3634 #if BITS_PER_LONG == 32
3635 case F_GETLK64:
3636 case F_SETLK64:
3637 case F_SETLKW64:
3638 #endif
3639 err = file_has_perm(cred, file, FILE__LOCK);
3640 break;
3641 }
3642
3643 return err;
3644 }
3645
3646 static void selinux_file_set_fowner(struct file *file)
3647 {
3648 struct file_security_struct *fsec;
3649
3650 fsec = file->f_security;
3651 fsec->fown_sid = current_sid();
3652 }
3653
3654 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3655 struct fown_struct *fown, int signum)
3656 {
3657 struct file *file;
3658 u32 sid = task_sid(tsk);
3659 u32 perm;
3660 struct file_security_struct *fsec;
3661
3662 /* struct fown_struct is never outside the context of a struct file */
3663 file = container_of(fown, struct file, f_owner);
3664
3665 fsec = file->f_security;
3666
3667 if (!signum)
3668 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3669 else
3670 perm = signal_to_av(signum);
3671
3672 return avc_has_perm(fsec->fown_sid, sid,
3673 SECCLASS_PROCESS, perm, NULL);
3674 }
3675
3676 static int selinux_file_receive(struct file *file)
3677 {
3678 const struct cred *cred = current_cred();
3679
3680 return file_has_perm(cred, file, file_to_av(file));
3681 }
3682
3683 static int selinux_file_open(struct file *file, const struct cred *cred)
3684 {
3685 struct file_security_struct *fsec;
3686 struct inode_security_struct *isec;
3687
3688 fsec = file->f_security;
3689 isec = inode_security(file_inode(file));
3690 /*
3691 * Save inode label and policy sequence number
3692 * at open-time so that selinux_file_permission
3693 * can determine whether revalidation is necessary.
3694 * Task label is already saved in the file security
3695 * struct as its SID.
3696 */
3697 fsec->isid = isec->sid;
3698 fsec->pseqno = avc_policy_seqno();
3699 /*
3700 * Since the inode label or policy seqno may have changed
3701 * between the selinux_inode_permission check and the saving
3702 * of state above, recheck that access is still permitted.
3703 * Otherwise, access might never be revalidated against the
3704 * new inode label or new policy.
3705 * This check is not redundant - do not remove.
3706 */
3707 return file_path_has_perm(cred, file, open_file_to_av(file));
3708 }
3709
3710 /* task security operations */
3711
3712 static int selinux_task_create(unsigned long clone_flags)
3713 {
3714 u32 sid = current_sid();
3715
3716 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3717 }
3718
3719 /*
3720 * allocate the SELinux part of blank credentials
3721 */
3722 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3723 {
3724 struct task_security_struct *tsec;
3725
3726 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3727 if (!tsec)
3728 return -ENOMEM;
3729
3730 cred->security = tsec;
3731 return 0;
3732 }
3733
3734 /*
3735 * detach and free the LSM part of a set of credentials
3736 */
3737 static void selinux_cred_free(struct cred *cred)
3738 {
3739 struct task_security_struct *tsec = cred->security;
3740
3741 /*
3742 * cred->security == NULL if security_cred_alloc_blank() or
3743 * security_prepare_creds() returned an error.
3744 */
3745 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3746 cred->security = (void *) 0x7UL;
3747 kfree(tsec);
3748 }
3749
3750 /*
3751 * prepare a new set of credentials for modification
3752 */
3753 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3754 gfp_t gfp)
3755 {
3756 const struct task_security_struct *old_tsec;
3757 struct task_security_struct *tsec;
3758
3759 old_tsec = old->security;
3760
3761 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3762 if (!tsec)
3763 return -ENOMEM;
3764
3765 new->security = tsec;
3766 return 0;
3767 }
3768
3769 /*
3770 * transfer the SELinux data to a blank set of creds
3771 */
3772 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3773 {
3774 const struct task_security_struct *old_tsec = old->security;
3775 struct task_security_struct *tsec = new->security;
3776
3777 *tsec = *old_tsec;
3778 }
3779
3780 /*
3781 * set the security data for a kernel service
3782 * - all the creation contexts are set to unlabelled
3783 */
3784 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3785 {
3786 struct task_security_struct *tsec = new->security;
3787 u32 sid = current_sid();
3788 int ret;
3789
3790 ret = avc_has_perm(sid, secid,
3791 SECCLASS_KERNEL_SERVICE,
3792 KERNEL_SERVICE__USE_AS_OVERRIDE,
3793 NULL);
3794 if (ret == 0) {
3795 tsec->sid = secid;
3796 tsec->create_sid = 0;
3797 tsec->keycreate_sid = 0;
3798 tsec->sockcreate_sid = 0;
3799 }
3800 return ret;
3801 }
3802
3803 /*
3804 * set the file creation context in a security record to the same as the
3805 * objective context of the specified inode
3806 */
3807 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3808 {
3809 struct inode_security_struct *isec = inode_security(inode);
3810 struct task_security_struct *tsec = new->security;
3811 u32 sid = current_sid();
3812 int ret;
3813
3814 ret = avc_has_perm(sid, isec->sid,
3815 SECCLASS_KERNEL_SERVICE,
3816 KERNEL_SERVICE__CREATE_FILES_AS,
3817 NULL);
3818
3819 if (ret == 0)
3820 tsec->create_sid = isec->sid;
3821 return ret;
3822 }
3823
3824 static int selinux_kernel_module_request(char *kmod_name)
3825 {
3826 struct common_audit_data ad;
3827
3828 ad.type = LSM_AUDIT_DATA_KMOD;
3829 ad.u.kmod_name = kmod_name;
3830
3831 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3832 SYSTEM__MODULE_REQUEST, &ad);
3833 }
3834
3835 static int selinux_kernel_module_from_file(struct file *file)
3836 {
3837 struct common_audit_data ad;
3838 struct inode_security_struct *isec;
3839 struct file_security_struct *fsec;
3840 u32 sid = current_sid();
3841 int rc;
3842
3843 /* init_module */
3844 if (file == NULL)
3845 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3846 SYSTEM__MODULE_LOAD, NULL);
3847
3848 /* finit_module */
3849
3850 ad.type = LSM_AUDIT_DATA_FILE;
3851 ad.u.file = file;
3852
3853 fsec = file->f_security;
3854 if (sid != fsec->sid) {
3855 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3856 if (rc)
3857 return rc;
3858 }
3859
3860 isec = inode_security(file_inode(file));
3861 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3862 SYSTEM__MODULE_LOAD, &ad);
3863 }
3864
3865 static int selinux_kernel_read_file(struct file *file,
3866 enum kernel_read_file_id id)
3867 {
3868 int rc = 0;
3869
3870 switch (id) {
3871 case READING_MODULE:
3872 rc = selinux_kernel_module_from_file(file);
3873 break;
3874 default:
3875 break;
3876 }
3877
3878 return rc;
3879 }
3880
3881 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3882 {
3883 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3884 PROCESS__SETPGID, NULL);
3885 }
3886
3887 static int selinux_task_getpgid(struct task_struct *p)
3888 {
3889 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3890 PROCESS__GETPGID, NULL);
3891 }
3892
3893 static int selinux_task_getsid(struct task_struct *p)
3894 {
3895 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3896 PROCESS__GETSESSION, NULL);
3897 }
3898
3899 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3900 {
3901 *secid = task_sid(p);
3902 }
3903
3904 static int selinux_task_setnice(struct task_struct *p, int nice)
3905 {
3906 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3907 PROCESS__SETSCHED, NULL);
3908 }
3909
3910 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3911 {
3912 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3913 PROCESS__SETSCHED, NULL);
3914 }
3915
3916 static int selinux_task_getioprio(struct task_struct *p)
3917 {
3918 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3919 PROCESS__GETSCHED, NULL);
3920 }
3921
3922 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3923 unsigned int flags)
3924 {
3925 u32 av = 0;
3926
3927 if (!flags)
3928 return 0;
3929 if (flags & LSM_PRLIMIT_WRITE)
3930 av |= PROCESS__SETRLIMIT;
3931 if (flags & LSM_PRLIMIT_READ)
3932 av |= PROCESS__GETRLIMIT;
3933 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3934 SECCLASS_PROCESS, av, NULL);
3935 }
3936
3937 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3938 struct rlimit *new_rlim)
3939 {
3940 struct rlimit *old_rlim = p->signal->rlim + resource;
3941
3942 /* Control the ability to change the hard limit (whether
3943 lowering or raising it), so that the hard limit can
3944 later be used as a safe reset point for the soft limit
3945 upon context transitions. See selinux_bprm_committing_creds. */
3946 if (old_rlim->rlim_max != new_rlim->rlim_max)
3947 return avc_has_perm(current_sid(), task_sid(p),
3948 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3949
3950 return 0;
3951 }
3952
3953 static int selinux_task_setscheduler(struct task_struct *p)
3954 {
3955 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3956 PROCESS__SETSCHED, NULL);
3957 }
3958
3959 static int selinux_task_getscheduler(struct task_struct *p)
3960 {
3961 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3962 PROCESS__GETSCHED, NULL);
3963 }
3964
3965 static int selinux_task_movememory(struct task_struct *p)
3966 {
3967 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3968 PROCESS__SETSCHED, NULL);
3969 }
3970
3971 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3972 int sig, u32 secid)
3973 {
3974 u32 perm;
3975
3976 if (!sig)
3977 perm = PROCESS__SIGNULL; /* null signal; existence test */
3978 else
3979 perm = signal_to_av(sig);
3980 if (!secid)
3981 secid = current_sid();
3982 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3983 }
3984
3985 static void selinux_task_to_inode(struct task_struct *p,
3986 struct inode *inode)
3987 {
3988 struct inode_security_struct *isec = inode->i_security;
3989 u32 sid = task_sid(p);
3990
3991 spin_lock(&isec->lock);
3992 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3993 isec->sid = sid;
3994 isec->initialized = LABEL_INITIALIZED;
3995 spin_unlock(&isec->lock);
3996 }
3997
3998 /* Returns error only if unable to parse addresses */
3999 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4000 struct common_audit_data *ad, u8 *proto)
4001 {
4002 int offset, ihlen, ret = -EINVAL;
4003 struct iphdr _iph, *ih;
4004
4005 offset = skb_network_offset(skb);
4006 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4007 if (ih == NULL)
4008 goto out;
4009
4010 ihlen = ih->ihl * 4;
4011 if (ihlen < sizeof(_iph))
4012 goto out;
4013
4014 ad->u.net->v4info.saddr = ih->saddr;
4015 ad->u.net->v4info.daddr = ih->daddr;
4016 ret = 0;
4017
4018 if (proto)
4019 *proto = ih->protocol;
4020
4021 switch (ih->protocol) {
4022 case IPPROTO_TCP: {
4023 struct tcphdr _tcph, *th;
4024
4025 if (ntohs(ih->frag_off) & IP_OFFSET)
4026 break;
4027
4028 offset += ihlen;
4029 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4030 if (th == NULL)
4031 break;
4032
4033 ad->u.net->sport = th->source;
4034 ad->u.net->dport = th->dest;
4035 break;
4036 }
4037
4038 case IPPROTO_UDP: {
4039 struct udphdr _udph, *uh;
4040
4041 if (ntohs(ih->frag_off) & IP_OFFSET)
4042 break;
4043
4044 offset += ihlen;
4045 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4046 if (uh == NULL)
4047 break;
4048
4049 ad->u.net->sport = uh->source;
4050 ad->u.net->dport = uh->dest;
4051 break;
4052 }
4053
4054 case IPPROTO_DCCP: {
4055 struct dccp_hdr _dccph, *dh;
4056
4057 if (ntohs(ih->frag_off) & IP_OFFSET)
4058 break;
4059
4060 offset += ihlen;
4061 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4062 if (dh == NULL)
4063 break;
4064
4065 ad->u.net->sport = dh->dccph_sport;
4066 ad->u.net->dport = dh->dccph_dport;
4067 break;
4068 }
4069
4070 default:
4071 break;
4072 }
4073 out:
4074 return ret;
4075 }
4076
4077 #if IS_ENABLED(CONFIG_IPV6)
4078
4079 /* Returns error only if unable to parse addresses */
4080 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4081 struct common_audit_data *ad, u8 *proto)
4082 {
4083 u8 nexthdr;
4084 int ret = -EINVAL, offset;
4085 struct ipv6hdr _ipv6h, *ip6;
4086 __be16 frag_off;
4087
4088 offset = skb_network_offset(skb);
4089 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4090 if (ip6 == NULL)
4091 goto out;
4092
4093 ad->u.net->v6info.saddr = ip6->saddr;
4094 ad->u.net->v6info.daddr = ip6->daddr;
4095 ret = 0;
4096
4097 nexthdr = ip6->nexthdr;
4098 offset += sizeof(_ipv6h);
4099 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4100 if (offset < 0)
4101 goto out;
4102
4103 if (proto)
4104 *proto = nexthdr;
4105
4106 switch (nexthdr) {
4107 case IPPROTO_TCP: {
4108 struct tcphdr _tcph, *th;
4109
4110 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4111 if (th == NULL)
4112 break;
4113
4114 ad->u.net->sport = th->source;
4115 ad->u.net->dport = th->dest;
4116 break;
4117 }
4118
4119 case IPPROTO_UDP: {
4120 struct udphdr _udph, *uh;
4121
4122 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4123 if (uh == NULL)
4124 break;
4125
4126 ad->u.net->sport = uh->source;
4127 ad->u.net->dport = uh->dest;
4128 break;
4129 }
4130
4131 case IPPROTO_DCCP: {
4132 struct dccp_hdr _dccph, *dh;
4133
4134 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4135 if (dh == NULL)
4136 break;
4137
4138 ad->u.net->sport = dh->dccph_sport;
4139 ad->u.net->dport = dh->dccph_dport;
4140 break;
4141 }
4142
4143 /* includes fragments */
4144 default:
4145 break;
4146 }
4147 out:
4148 return ret;
4149 }
4150
4151 #endif /* IPV6 */
4152
4153 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4154 char **_addrp, int src, u8 *proto)
4155 {
4156 char *addrp;
4157 int ret;
4158
4159 switch (ad->u.net->family) {
4160 case PF_INET:
4161 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4162 if (ret)
4163 goto parse_error;
4164 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4165 &ad->u.net->v4info.daddr);
4166 goto okay;
4167
4168 #if IS_ENABLED(CONFIG_IPV6)
4169 case PF_INET6:
4170 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4171 if (ret)
4172 goto parse_error;
4173 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4174 &ad->u.net->v6info.daddr);
4175 goto okay;
4176 #endif /* IPV6 */
4177 default:
4178 addrp = NULL;
4179 goto okay;
4180 }
4181
4182 parse_error:
4183 printk(KERN_WARNING
4184 "SELinux: failure in selinux_parse_skb(),"
4185 " unable to parse packet\n");
4186 return ret;
4187
4188 okay:
4189 if (_addrp)
4190 *_addrp = addrp;
4191 return 0;
4192 }
4193
4194 /**
4195 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4196 * @skb: the packet
4197 * @family: protocol family
4198 * @sid: the packet's peer label SID
4199 *
4200 * Description:
4201 * Check the various different forms of network peer labeling and determine
4202 * the peer label/SID for the packet; most of the magic actually occurs in
4203 * the security server function security_net_peersid_cmp(). The function
4204 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4205 * or -EACCES if @sid is invalid due to inconsistencies with the different
4206 * peer labels.
4207 *
4208 */
4209 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4210 {
4211 int err;
4212 u32 xfrm_sid;
4213 u32 nlbl_sid;
4214 u32 nlbl_type;
4215
4216 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4217 if (unlikely(err))
4218 return -EACCES;
4219 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4220 if (unlikely(err))
4221 return -EACCES;
4222
4223 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4224 if (unlikely(err)) {
4225 printk(KERN_WARNING
4226 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4227 " unable to determine packet's peer label\n");
4228 return -EACCES;
4229 }
4230
4231 return 0;
4232 }
4233
4234 /**
4235 * selinux_conn_sid - Determine the child socket label for a connection
4236 * @sk_sid: the parent socket's SID
4237 * @skb_sid: the packet's SID
4238 * @conn_sid: the resulting connection SID
4239 *
4240 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4241 * combined with the MLS information from @skb_sid in order to create
4242 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4243 * of @sk_sid. Returns zero on success, negative values on failure.
4244 *
4245 */
4246 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4247 {
4248 int err = 0;
4249
4250 if (skb_sid != SECSID_NULL)
4251 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4252 else
4253 *conn_sid = sk_sid;
4254
4255 return err;
4256 }
4257
4258 /* socket security operations */
4259
4260 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4261 u16 secclass, u32 *socksid)
4262 {
4263 if (tsec->sockcreate_sid > SECSID_NULL) {
4264 *socksid = tsec->sockcreate_sid;
4265 return 0;
4266 }
4267
4268 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4269 socksid);
4270 }
4271
4272 static int sock_has_perm(struct sock *sk, u32 perms)
4273 {
4274 struct sk_security_struct *sksec = sk->sk_security;
4275 struct common_audit_data ad;
4276 struct lsm_network_audit net = {0,};
4277
4278 if (sksec->sid == SECINITSID_KERNEL)
4279 return 0;
4280
4281 ad.type = LSM_AUDIT_DATA_NET;
4282 ad.u.net = &net;
4283 ad.u.net->sk = sk;
4284
4285 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4286 &ad);
4287 }
4288
4289 static int selinux_socket_create(int family, int type,
4290 int protocol, int kern)
4291 {
4292 const struct task_security_struct *tsec = current_security();
4293 u32 newsid;
4294 u16 secclass;
4295 int rc;
4296
4297 if (kern)
4298 return 0;
4299
4300 secclass = socket_type_to_security_class(family, type, protocol);
4301 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4302 if (rc)
4303 return rc;
4304
4305 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4306 }
4307
4308 static int selinux_socket_post_create(struct socket *sock, int family,
4309 int type, int protocol, int kern)
4310 {
4311 const struct task_security_struct *tsec = current_security();
4312 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4313 struct sk_security_struct *sksec;
4314 u16 sclass = socket_type_to_security_class(family, type, protocol);
4315 u32 sid = SECINITSID_KERNEL;
4316 int err = 0;
4317
4318 if (!kern) {
4319 err = socket_sockcreate_sid(tsec, sclass, &sid);
4320 if (err)
4321 return err;
4322 }
4323
4324 isec->sclass = sclass;
4325 isec->sid = sid;
4326 isec->initialized = LABEL_INITIALIZED;
4327
4328 if (sock->sk) {
4329 sksec = sock->sk->sk_security;
4330 sksec->sclass = sclass;
4331 sksec->sid = sid;
4332 err = selinux_netlbl_socket_post_create(sock->sk, family);
4333 }
4334
4335 return err;
4336 }
4337
4338 /* Range of port numbers used to automatically bind.
4339 Need to determine whether we should perform a name_bind
4340 permission check between the socket and the port number. */
4341
4342 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4343 {
4344 struct sock *sk = sock->sk;
4345 u16 family;
4346 int err;
4347
4348 err = sock_has_perm(sk, SOCKET__BIND);
4349 if (err)
4350 goto out;
4351
4352 /*
4353 * If PF_INET or PF_INET6, check name_bind permission for the port.
4354 * Multiple address binding for SCTP is not supported yet: we just
4355 * check the first address now.
4356 */
4357 family = sk->sk_family;
4358 if (family == PF_INET || family == PF_INET6) {
4359 char *addrp;
4360 struct sk_security_struct *sksec = sk->sk_security;
4361 struct common_audit_data ad;
4362 struct lsm_network_audit net = {0,};
4363 struct sockaddr_in *addr4 = NULL;
4364 struct sockaddr_in6 *addr6 = NULL;
4365 unsigned short snum;
4366 u32 sid, node_perm;
4367
4368 if (family == PF_INET) {
4369 if (addrlen < sizeof(struct sockaddr_in)) {
4370 err = -EINVAL;
4371 goto out;
4372 }
4373 addr4 = (struct sockaddr_in *)address;
4374 snum = ntohs(addr4->sin_port);
4375 addrp = (char *)&addr4->sin_addr.s_addr;
4376 } else {
4377 if (addrlen < SIN6_LEN_RFC2133) {
4378 err = -EINVAL;
4379 goto out;
4380 }
4381 addr6 = (struct sockaddr_in6 *)address;
4382 snum = ntohs(addr6->sin6_port);
4383 addrp = (char *)&addr6->sin6_addr.s6_addr;
4384 }
4385
4386 if (snum) {
4387 int low, high;
4388
4389 inet_get_local_port_range(sock_net(sk), &low, &high);
4390
4391 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4392 snum > high) {
4393 err = sel_netport_sid(sk->sk_protocol,
4394 snum, &sid);
4395 if (err)
4396 goto out;
4397 ad.type = LSM_AUDIT_DATA_NET;
4398 ad.u.net = &net;
4399 ad.u.net->sport = htons(snum);
4400 ad.u.net->family = family;
4401 err = avc_has_perm(sksec->sid, sid,
4402 sksec->sclass,
4403 SOCKET__NAME_BIND, &ad);
4404 if (err)
4405 goto out;
4406 }
4407 }
4408
4409 switch (sksec->sclass) {
4410 case SECCLASS_TCP_SOCKET:
4411 node_perm = TCP_SOCKET__NODE_BIND;
4412 break;
4413
4414 case SECCLASS_UDP_SOCKET:
4415 node_perm = UDP_SOCKET__NODE_BIND;
4416 break;
4417
4418 case SECCLASS_DCCP_SOCKET:
4419 node_perm = DCCP_SOCKET__NODE_BIND;
4420 break;
4421
4422 default:
4423 node_perm = RAWIP_SOCKET__NODE_BIND;
4424 break;
4425 }
4426
4427 err = sel_netnode_sid(addrp, family, &sid);
4428 if (err)
4429 goto out;
4430
4431 ad.type = LSM_AUDIT_DATA_NET;
4432 ad.u.net = &net;
4433 ad.u.net->sport = htons(snum);
4434 ad.u.net->family = family;
4435
4436 if (family == PF_INET)
4437 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4438 else
4439 ad.u.net->v6info.saddr = addr6->sin6_addr;
4440
4441 err = avc_has_perm(sksec->sid, sid,
4442 sksec->sclass, node_perm, &ad);
4443 if (err)
4444 goto out;
4445 }
4446 out:
4447 return err;
4448 }
4449
4450 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4451 {
4452 struct sock *sk = sock->sk;
4453 struct sk_security_struct *sksec = sk->sk_security;
4454 int err;
4455
4456 err = sock_has_perm(sk, SOCKET__CONNECT);
4457 if (err)
4458 return err;
4459
4460 /*
4461 * If a TCP or DCCP socket, check name_connect permission for the port.
4462 */
4463 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4464 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4465 struct common_audit_data ad;
4466 struct lsm_network_audit net = {0,};
4467 struct sockaddr_in *addr4 = NULL;
4468 struct sockaddr_in6 *addr6 = NULL;
4469 unsigned short snum;
4470 u32 sid, perm;
4471
4472 if (sk->sk_family == PF_INET) {
4473 addr4 = (struct sockaddr_in *)address;
4474 if (addrlen < sizeof(struct sockaddr_in))
4475 return -EINVAL;
4476 snum = ntohs(addr4->sin_port);
4477 } else {
4478 addr6 = (struct sockaddr_in6 *)address;
4479 if (addrlen < SIN6_LEN_RFC2133)
4480 return -EINVAL;
4481 snum = ntohs(addr6->sin6_port);
4482 }
4483
4484 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4485 if (err)
4486 goto out;
4487
4488 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4489 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4490
4491 ad.type = LSM_AUDIT_DATA_NET;
4492 ad.u.net = &net;
4493 ad.u.net->dport = htons(snum);
4494 ad.u.net->family = sk->sk_family;
4495 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4496 if (err)
4497 goto out;
4498 }
4499
4500 err = selinux_netlbl_socket_connect(sk, address);
4501
4502 out:
4503 return err;
4504 }
4505
4506 static int selinux_socket_listen(struct socket *sock, int backlog)
4507 {
4508 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4509 }
4510
4511 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4512 {
4513 int err;
4514 struct inode_security_struct *isec;
4515 struct inode_security_struct *newisec;
4516 u16 sclass;
4517 u32 sid;
4518
4519 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4520 if (err)
4521 return err;
4522
4523 isec = inode_security_novalidate(SOCK_INODE(sock));
4524 spin_lock(&isec->lock);
4525 sclass = isec->sclass;
4526 sid = isec->sid;
4527 spin_unlock(&isec->lock);
4528
4529 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4530 newisec->sclass = sclass;
4531 newisec->sid = sid;
4532 newisec->initialized = LABEL_INITIALIZED;
4533
4534 return 0;
4535 }
4536
4537 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4538 int size)
4539 {
4540 return sock_has_perm(sock->sk, SOCKET__WRITE);
4541 }
4542
4543 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4544 int size, int flags)
4545 {
4546 return sock_has_perm(sock->sk, SOCKET__READ);
4547 }
4548
4549 static int selinux_socket_getsockname(struct socket *sock)
4550 {
4551 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4552 }
4553
4554 static int selinux_socket_getpeername(struct socket *sock)
4555 {
4556 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4557 }
4558
4559 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4560 {
4561 int err;
4562
4563 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4564 if (err)
4565 return err;
4566
4567 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4568 }
4569
4570 static int selinux_socket_getsockopt(struct socket *sock, int level,
4571 int optname)
4572 {
4573 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4574 }
4575
4576 static int selinux_socket_shutdown(struct socket *sock, int how)
4577 {
4578 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4579 }
4580
4581 static int selinux_socket_unix_stream_connect(struct sock *sock,
4582 struct sock *other,
4583 struct sock *newsk)
4584 {
4585 struct sk_security_struct *sksec_sock = sock->sk_security;
4586 struct sk_security_struct *sksec_other = other->sk_security;
4587 struct sk_security_struct *sksec_new = newsk->sk_security;
4588 struct common_audit_data ad;
4589 struct lsm_network_audit net = {0,};
4590 int err;
4591
4592 ad.type = LSM_AUDIT_DATA_NET;
4593 ad.u.net = &net;
4594 ad.u.net->sk = other;
4595
4596 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4597 sksec_other->sclass,
4598 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4599 if (err)
4600 return err;
4601
4602 /* server child socket */
4603 sksec_new->peer_sid = sksec_sock->sid;
4604 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4605 &sksec_new->sid);
4606 if (err)
4607 return err;
4608
4609 /* connecting socket */
4610 sksec_sock->peer_sid = sksec_new->sid;
4611
4612 return 0;
4613 }
4614
4615 static int selinux_socket_unix_may_send(struct socket *sock,
4616 struct socket *other)
4617 {
4618 struct sk_security_struct *ssec = sock->sk->sk_security;
4619 struct sk_security_struct *osec = other->sk->sk_security;
4620 struct common_audit_data ad;
4621 struct lsm_network_audit net = {0,};
4622
4623 ad.type = LSM_AUDIT_DATA_NET;
4624 ad.u.net = &net;
4625 ad.u.net->sk = other->sk;
4626
4627 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4628 &ad);
4629 }
4630
4631 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4632 char *addrp, u16 family, u32 peer_sid,
4633 struct common_audit_data *ad)
4634 {
4635 int err;
4636 u32 if_sid;
4637 u32 node_sid;
4638
4639 err = sel_netif_sid(ns, ifindex, &if_sid);
4640 if (err)
4641 return err;
4642 err = avc_has_perm(peer_sid, if_sid,
4643 SECCLASS_NETIF, NETIF__INGRESS, ad);
4644 if (err)
4645 return err;
4646
4647 err = sel_netnode_sid(addrp, family, &node_sid);
4648 if (err)
4649 return err;
4650 return avc_has_perm(peer_sid, node_sid,
4651 SECCLASS_NODE, NODE__RECVFROM, ad);
4652 }
4653
4654 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4655 u16 family)
4656 {
4657 int err = 0;
4658 struct sk_security_struct *sksec = sk->sk_security;
4659 u32 sk_sid = sksec->sid;
4660 struct common_audit_data ad;
4661 struct lsm_network_audit net = {0,};
4662 char *addrp;
4663
4664 ad.type = LSM_AUDIT_DATA_NET;
4665 ad.u.net = &net;
4666 ad.u.net->netif = skb->skb_iif;
4667 ad.u.net->family = family;
4668 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4669 if (err)
4670 return err;
4671
4672 if (selinux_secmark_enabled()) {
4673 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4674 PACKET__RECV, &ad);
4675 if (err)
4676 return err;
4677 }
4678
4679 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4680 if (err)
4681 return err;
4682 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4683
4684 return err;
4685 }
4686
4687 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4688 {
4689 int err;
4690 struct sk_security_struct *sksec = sk->sk_security;
4691 u16 family = sk->sk_family;
4692 u32 sk_sid = sksec->sid;
4693 struct common_audit_data ad;
4694 struct lsm_network_audit net = {0,};
4695 char *addrp;
4696 u8 secmark_active;
4697 u8 peerlbl_active;
4698
4699 if (family != PF_INET && family != PF_INET6)
4700 return 0;
4701
4702 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4703 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4704 family = PF_INET;
4705
4706 /* If any sort of compatibility mode is enabled then handoff processing
4707 * to the selinux_sock_rcv_skb_compat() function to deal with the
4708 * special handling. We do this in an attempt to keep this function
4709 * as fast and as clean as possible. */
4710 if (!selinux_policycap_netpeer)
4711 return selinux_sock_rcv_skb_compat(sk, skb, family);
4712
4713 secmark_active = selinux_secmark_enabled();
4714 peerlbl_active = selinux_peerlbl_enabled();
4715 if (!secmark_active && !peerlbl_active)
4716 return 0;
4717
4718 ad.type = LSM_AUDIT_DATA_NET;
4719 ad.u.net = &net;
4720 ad.u.net->netif = skb->skb_iif;
4721 ad.u.net->family = family;
4722 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4723 if (err)
4724 return err;
4725
4726 if (peerlbl_active) {
4727 u32 peer_sid;
4728
4729 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4730 if (err)
4731 return err;
4732 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4733 addrp, family, peer_sid, &ad);
4734 if (err) {
4735 selinux_netlbl_err(skb, family, err, 0);
4736 return err;
4737 }
4738 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4739 PEER__RECV, &ad);
4740 if (err) {
4741 selinux_netlbl_err(skb, family, err, 0);
4742 return err;
4743 }
4744 }
4745
4746 if (secmark_active) {
4747 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4748 PACKET__RECV, &ad);
4749 if (err)
4750 return err;
4751 }
4752
4753 return err;
4754 }
4755
4756 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4757 int __user *optlen, unsigned len)
4758 {
4759 int err = 0;
4760 char *scontext;
4761 u32 scontext_len;
4762 struct sk_security_struct *sksec = sock->sk->sk_security;
4763 u32 peer_sid = SECSID_NULL;
4764
4765 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4766 sksec->sclass == SECCLASS_TCP_SOCKET)
4767 peer_sid = sksec->peer_sid;
4768 if (peer_sid == SECSID_NULL)
4769 return -ENOPROTOOPT;
4770
4771 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4772 if (err)
4773 return err;
4774
4775 if (scontext_len > len) {
4776 err = -ERANGE;
4777 goto out_len;
4778 }
4779
4780 if (copy_to_user(optval, scontext, scontext_len))
4781 err = -EFAULT;
4782
4783 out_len:
4784 if (put_user(scontext_len, optlen))
4785 err = -EFAULT;
4786 kfree(scontext);
4787 return err;
4788 }
4789
4790 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4791 {
4792 u32 peer_secid = SECSID_NULL;
4793 u16 family;
4794 struct inode_security_struct *isec;
4795
4796 if (skb && skb->protocol == htons(ETH_P_IP))
4797 family = PF_INET;
4798 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4799 family = PF_INET6;
4800 else if (sock)
4801 family = sock->sk->sk_family;
4802 else
4803 goto out;
4804
4805 if (sock && family == PF_UNIX) {
4806 isec = inode_security_novalidate(SOCK_INODE(sock));
4807 peer_secid = isec->sid;
4808 } else if (skb)
4809 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4810
4811 out:
4812 *secid = peer_secid;
4813 if (peer_secid == SECSID_NULL)
4814 return -EINVAL;
4815 return 0;
4816 }
4817
4818 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4819 {
4820 struct sk_security_struct *sksec;
4821
4822 sksec = kzalloc(sizeof(*sksec), priority);
4823 if (!sksec)
4824 return -ENOMEM;
4825
4826 sksec->peer_sid = SECINITSID_UNLABELED;
4827 sksec->sid = SECINITSID_UNLABELED;
4828 sksec->sclass = SECCLASS_SOCKET;
4829 selinux_netlbl_sk_security_reset(sksec);
4830 sk->sk_security = sksec;
4831
4832 return 0;
4833 }
4834
4835 static void selinux_sk_free_security(struct sock *sk)
4836 {
4837 struct sk_security_struct *sksec = sk->sk_security;
4838
4839 sk->sk_security = NULL;
4840 selinux_netlbl_sk_security_free(sksec);
4841 kfree(sksec);
4842 }
4843
4844 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4845 {
4846 struct sk_security_struct *sksec = sk->sk_security;
4847 struct sk_security_struct *newsksec = newsk->sk_security;
4848
4849 newsksec->sid = sksec->sid;
4850 newsksec->peer_sid = sksec->peer_sid;
4851 newsksec->sclass = sksec->sclass;
4852
4853 selinux_netlbl_sk_security_reset(newsksec);
4854 }
4855
4856 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4857 {
4858 if (!sk)
4859 *secid = SECINITSID_ANY_SOCKET;
4860 else {
4861 struct sk_security_struct *sksec = sk->sk_security;
4862
4863 *secid = sksec->sid;
4864 }
4865 }
4866
4867 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4868 {
4869 struct inode_security_struct *isec =
4870 inode_security_novalidate(SOCK_INODE(parent));
4871 struct sk_security_struct *sksec = sk->sk_security;
4872
4873 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4874 sk->sk_family == PF_UNIX)
4875 isec->sid = sksec->sid;
4876 sksec->sclass = isec->sclass;
4877 }
4878
4879 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4880 struct request_sock *req)
4881 {
4882 struct sk_security_struct *sksec = sk->sk_security;
4883 int err;
4884 u16 family = req->rsk_ops->family;
4885 u32 connsid;
4886 u32 peersid;
4887
4888 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4889 if (err)
4890 return err;
4891 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4892 if (err)
4893 return err;
4894 req->secid = connsid;
4895 req->peer_secid = peersid;
4896
4897 return selinux_netlbl_inet_conn_request(req, family);
4898 }
4899
4900 static void selinux_inet_csk_clone(struct sock *newsk,
4901 const struct request_sock *req)
4902 {
4903 struct sk_security_struct *newsksec = newsk->sk_security;
4904
4905 newsksec->sid = req->secid;
4906 newsksec->peer_sid = req->peer_secid;
4907 /* NOTE: Ideally, we should also get the isec->sid for the
4908 new socket in sync, but we don't have the isec available yet.
4909 So we will wait until sock_graft to do it, by which
4910 time it will have been created and available. */
4911
4912 /* We don't need to take any sort of lock here as we are the only
4913 * thread with access to newsksec */
4914 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4915 }
4916
4917 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4918 {
4919 u16 family = sk->sk_family;
4920 struct sk_security_struct *sksec = sk->sk_security;
4921
4922 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4923 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4924 family = PF_INET;
4925
4926 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4927 }
4928
4929 static int selinux_secmark_relabel_packet(u32 sid)
4930 {
4931 const struct task_security_struct *__tsec;
4932 u32 tsid;
4933
4934 __tsec = current_security();
4935 tsid = __tsec->sid;
4936
4937 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4938 }
4939
4940 static void selinux_secmark_refcount_inc(void)
4941 {
4942 atomic_inc(&selinux_secmark_refcount);
4943 }
4944
4945 static void selinux_secmark_refcount_dec(void)
4946 {
4947 atomic_dec(&selinux_secmark_refcount);
4948 }
4949
4950 static void selinux_req_classify_flow(const struct request_sock *req,
4951 struct flowi *fl)
4952 {
4953 fl->flowi_secid = req->secid;
4954 }
4955
4956 static int selinux_tun_dev_alloc_security(void **security)
4957 {
4958 struct tun_security_struct *tunsec;
4959
4960 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4961 if (!tunsec)
4962 return -ENOMEM;
4963 tunsec->sid = current_sid();
4964
4965 *security = tunsec;
4966 return 0;
4967 }
4968
4969 static void selinux_tun_dev_free_security(void *security)
4970 {
4971 kfree(security);
4972 }
4973
4974 static int selinux_tun_dev_create(void)
4975 {
4976 u32 sid = current_sid();
4977
4978 /* we aren't taking into account the "sockcreate" SID since the socket
4979 * that is being created here is not a socket in the traditional sense,
4980 * instead it is a private sock, accessible only to the kernel, and
4981 * representing a wide range of network traffic spanning multiple
4982 * connections unlike traditional sockets - check the TUN driver to
4983 * get a better understanding of why this socket is special */
4984
4985 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4986 NULL);
4987 }
4988
4989 static int selinux_tun_dev_attach_queue(void *security)
4990 {
4991 struct tun_security_struct *tunsec = security;
4992
4993 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4994 TUN_SOCKET__ATTACH_QUEUE, NULL);
4995 }
4996
4997 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4998 {
4999 struct tun_security_struct *tunsec = security;
5000 struct sk_security_struct *sksec = sk->sk_security;
5001
5002 /* we don't currently perform any NetLabel based labeling here and it
5003 * isn't clear that we would want to do so anyway; while we could apply
5004 * labeling without the support of the TUN user the resulting labeled
5005 * traffic from the other end of the connection would almost certainly
5006 * cause confusion to the TUN user that had no idea network labeling
5007 * protocols were being used */
5008
5009 sksec->sid = tunsec->sid;
5010 sksec->sclass = SECCLASS_TUN_SOCKET;
5011
5012 return 0;
5013 }
5014
5015 static int selinux_tun_dev_open(void *security)
5016 {
5017 struct tun_security_struct *tunsec = security;
5018 u32 sid = current_sid();
5019 int err;
5020
5021 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5022 TUN_SOCKET__RELABELFROM, NULL);
5023 if (err)
5024 return err;
5025 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5026 TUN_SOCKET__RELABELTO, NULL);
5027 if (err)
5028 return err;
5029 tunsec->sid = sid;
5030
5031 return 0;
5032 }
5033
5034 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5035 {
5036 int err = 0;
5037 u32 perm;
5038 struct nlmsghdr *nlh;
5039 struct sk_security_struct *sksec = sk->sk_security;
5040
5041 if (skb->len < NLMSG_HDRLEN) {
5042 err = -EINVAL;
5043 goto out;
5044 }
5045 nlh = nlmsg_hdr(skb);
5046
5047 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5048 if (err) {
5049 if (err == -EINVAL) {
5050 pr_warn_ratelimited("SELinux: unrecognized netlink"
5051 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5052 " pig=%d comm=%s\n",
5053 sk->sk_protocol, nlh->nlmsg_type,
5054 secclass_map[sksec->sclass - 1].name,
5055 task_pid_nr(current), current->comm);
5056 if (!selinux_enforcing || security_get_allow_unknown())
5057 err = 0;
5058 }
5059
5060 /* Ignore */
5061 if (err == -ENOENT)
5062 err = 0;
5063 goto out;
5064 }
5065
5066 err = sock_has_perm(sk, perm);
5067 out:
5068 return err;
5069 }
5070
5071 #ifdef CONFIG_NETFILTER
5072
5073 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5074 const struct net_device *indev,
5075 u16 family)
5076 {
5077 int err;
5078 char *addrp;
5079 u32 peer_sid;
5080 struct common_audit_data ad;
5081 struct lsm_network_audit net = {0,};
5082 u8 secmark_active;
5083 u8 netlbl_active;
5084 u8 peerlbl_active;
5085
5086 if (!selinux_policycap_netpeer)
5087 return NF_ACCEPT;
5088
5089 secmark_active = selinux_secmark_enabled();
5090 netlbl_active = netlbl_enabled();
5091 peerlbl_active = selinux_peerlbl_enabled();
5092 if (!secmark_active && !peerlbl_active)
5093 return NF_ACCEPT;
5094
5095 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5096 return NF_DROP;
5097
5098 ad.type = LSM_AUDIT_DATA_NET;
5099 ad.u.net = &net;
5100 ad.u.net->netif = indev->ifindex;
5101 ad.u.net->family = family;
5102 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5103 return NF_DROP;
5104
5105 if (peerlbl_active) {
5106 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5107 addrp, family, peer_sid, &ad);
5108 if (err) {
5109 selinux_netlbl_err(skb, family, err, 1);
5110 return NF_DROP;
5111 }
5112 }
5113
5114 if (secmark_active)
5115 if (avc_has_perm(peer_sid, skb->secmark,
5116 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5117 return NF_DROP;
5118
5119 if (netlbl_active)
5120 /* we do this in the FORWARD path and not the POST_ROUTING
5121 * path because we want to make sure we apply the necessary
5122 * labeling before IPsec is applied so we can leverage AH
5123 * protection */
5124 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5125 return NF_DROP;
5126
5127 return NF_ACCEPT;
5128 }
5129
5130 static unsigned int selinux_ipv4_forward(void *priv,
5131 struct sk_buff *skb,
5132 const struct nf_hook_state *state)
5133 {
5134 return selinux_ip_forward(skb, state->in, PF_INET);
5135 }
5136
5137 #if IS_ENABLED(CONFIG_IPV6)
5138 static unsigned int selinux_ipv6_forward(void *priv,
5139 struct sk_buff *skb,
5140 const struct nf_hook_state *state)
5141 {
5142 return selinux_ip_forward(skb, state->in, PF_INET6);
5143 }
5144 #endif /* IPV6 */
5145
5146 static unsigned int selinux_ip_output(struct sk_buff *skb,
5147 u16 family)
5148 {
5149 struct sock *sk;
5150 u32 sid;
5151
5152 if (!netlbl_enabled())
5153 return NF_ACCEPT;
5154
5155 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5156 * because we want to make sure we apply the necessary labeling
5157 * before IPsec is applied so we can leverage AH protection */
5158 sk = skb->sk;
5159 if (sk) {
5160 struct sk_security_struct *sksec;
5161
5162 if (sk_listener(sk))
5163 /* if the socket is the listening state then this
5164 * packet is a SYN-ACK packet which means it needs to
5165 * be labeled based on the connection/request_sock and
5166 * not the parent socket. unfortunately, we can't
5167 * lookup the request_sock yet as it isn't queued on
5168 * the parent socket until after the SYN-ACK is sent.
5169 * the "solution" is to simply pass the packet as-is
5170 * as any IP option based labeling should be copied
5171 * from the initial connection request (in the IP
5172 * layer). it is far from ideal, but until we get a
5173 * security label in the packet itself this is the
5174 * best we can do. */
5175 return NF_ACCEPT;
5176
5177 /* standard practice, label using the parent socket */
5178 sksec = sk->sk_security;
5179 sid = sksec->sid;
5180 } else
5181 sid = SECINITSID_KERNEL;
5182 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5183 return NF_DROP;
5184
5185 return NF_ACCEPT;
5186 }
5187
5188 static unsigned int selinux_ipv4_output(void *priv,
5189 struct sk_buff *skb,
5190 const struct nf_hook_state *state)
5191 {
5192 return selinux_ip_output(skb, PF_INET);
5193 }
5194
5195 #if IS_ENABLED(CONFIG_IPV6)
5196 static unsigned int selinux_ipv6_output(void *priv,
5197 struct sk_buff *skb,
5198 const struct nf_hook_state *state)
5199 {
5200 return selinux_ip_output(skb, PF_INET6);
5201 }
5202 #endif /* IPV6 */
5203
5204 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5205 int ifindex,
5206 u16 family)
5207 {
5208 struct sock *sk = skb_to_full_sk(skb);
5209 struct sk_security_struct *sksec;
5210 struct common_audit_data ad;
5211 struct lsm_network_audit net = {0,};
5212 char *addrp;
5213 u8 proto;
5214
5215 if (sk == NULL)
5216 return NF_ACCEPT;
5217 sksec = sk->sk_security;
5218
5219 ad.type = LSM_AUDIT_DATA_NET;
5220 ad.u.net = &net;
5221 ad.u.net->netif = ifindex;
5222 ad.u.net->family = family;
5223 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5224 return NF_DROP;
5225
5226 if (selinux_secmark_enabled())
5227 if (avc_has_perm(sksec->sid, skb->secmark,
5228 SECCLASS_PACKET, PACKET__SEND, &ad))
5229 return NF_DROP_ERR(-ECONNREFUSED);
5230
5231 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5232 return NF_DROP_ERR(-ECONNREFUSED);
5233
5234 return NF_ACCEPT;
5235 }
5236
5237 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5238 const struct net_device *outdev,
5239 u16 family)
5240 {
5241 u32 secmark_perm;
5242 u32 peer_sid;
5243 int ifindex = outdev->ifindex;
5244 struct sock *sk;
5245 struct common_audit_data ad;
5246 struct lsm_network_audit net = {0,};
5247 char *addrp;
5248 u8 secmark_active;
5249 u8 peerlbl_active;
5250
5251 /* If any sort of compatibility mode is enabled then handoff processing
5252 * to the selinux_ip_postroute_compat() function to deal with the
5253 * special handling. We do this in an attempt to keep this function
5254 * as fast and as clean as possible. */
5255 if (!selinux_policycap_netpeer)
5256 return selinux_ip_postroute_compat(skb, ifindex, family);
5257
5258 secmark_active = selinux_secmark_enabled();
5259 peerlbl_active = selinux_peerlbl_enabled();
5260 if (!secmark_active && !peerlbl_active)
5261 return NF_ACCEPT;
5262
5263 sk = skb_to_full_sk(skb);
5264
5265 #ifdef CONFIG_XFRM
5266 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5267 * packet transformation so allow the packet to pass without any checks
5268 * since we'll have another chance to perform access control checks
5269 * when the packet is on it's final way out.
5270 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5271 * is NULL, in this case go ahead and apply access control.
5272 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5273 * TCP listening state we cannot wait until the XFRM processing
5274 * is done as we will miss out on the SA label if we do;
5275 * unfortunately, this means more work, but it is only once per
5276 * connection. */
5277 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5278 !(sk && sk_listener(sk)))
5279 return NF_ACCEPT;
5280 #endif
5281
5282 if (sk == NULL) {
5283 /* Without an associated socket the packet is either coming
5284 * from the kernel or it is being forwarded; check the packet
5285 * to determine which and if the packet is being forwarded
5286 * query the packet directly to determine the security label. */
5287 if (skb->skb_iif) {
5288 secmark_perm = PACKET__FORWARD_OUT;
5289 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5290 return NF_DROP;
5291 } else {
5292 secmark_perm = PACKET__SEND;
5293 peer_sid = SECINITSID_KERNEL;
5294 }
5295 } else if (sk_listener(sk)) {
5296 /* Locally generated packet but the associated socket is in the
5297 * listening state which means this is a SYN-ACK packet. In
5298 * this particular case the correct security label is assigned
5299 * to the connection/request_sock but unfortunately we can't
5300 * query the request_sock as it isn't queued on the parent
5301 * socket until after the SYN-ACK packet is sent; the only
5302 * viable choice is to regenerate the label like we do in
5303 * selinux_inet_conn_request(). See also selinux_ip_output()
5304 * for similar problems. */
5305 u32 skb_sid;
5306 struct sk_security_struct *sksec;
5307
5308 sksec = sk->sk_security;
5309 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5310 return NF_DROP;
5311 /* At this point, if the returned skb peerlbl is SECSID_NULL
5312 * and the packet has been through at least one XFRM
5313 * transformation then we must be dealing with the "final"
5314 * form of labeled IPsec packet; since we've already applied
5315 * all of our access controls on this packet we can safely
5316 * pass the packet. */
5317 if (skb_sid == SECSID_NULL) {
5318 switch (family) {
5319 case PF_INET:
5320 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5321 return NF_ACCEPT;
5322 break;
5323 case PF_INET6:
5324 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5325 return NF_ACCEPT;
5326 break;
5327 default:
5328 return NF_DROP_ERR(-ECONNREFUSED);
5329 }
5330 }
5331 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5332 return NF_DROP;
5333 secmark_perm = PACKET__SEND;
5334 } else {
5335 /* Locally generated packet, fetch the security label from the
5336 * associated socket. */
5337 struct sk_security_struct *sksec = sk->sk_security;
5338 peer_sid = sksec->sid;
5339 secmark_perm = PACKET__SEND;
5340 }
5341
5342 ad.type = LSM_AUDIT_DATA_NET;
5343 ad.u.net = &net;
5344 ad.u.net->netif = ifindex;
5345 ad.u.net->family = family;
5346 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5347 return NF_DROP;
5348
5349 if (secmark_active)
5350 if (avc_has_perm(peer_sid, skb->secmark,
5351 SECCLASS_PACKET, secmark_perm, &ad))
5352 return NF_DROP_ERR(-ECONNREFUSED);
5353
5354 if (peerlbl_active) {
5355 u32 if_sid;
5356 u32 node_sid;
5357
5358 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5359 return NF_DROP;
5360 if (avc_has_perm(peer_sid, if_sid,
5361 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5362 return NF_DROP_ERR(-ECONNREFUSED);
5363
5364 if (sel_netnode_sid(addrp, family, &node_sid))
5365 return NF_DROP;
5366 if (avc_has_perm(peer_sid, node_sid,
5367 SECCLASS_NODE, NODE__SENDTO, &ad))
5368 return NF_DROP_ERR(-ECONNREFUSED);
5369 }
5370
5371 return NF_ACCEPT;
5372 }
5373
5374 static unsigned int selinux_ipv4_postroute(void *priv,
5375 struct sk_buff *skb,
5376 const struct nf_hook_state *state)
5377 {
5378 return selinux_ip_postroute(skb, state->out, PF_INET);
5379 }
5380
5381 #if IS_ENABLED(CONFIG_IPV6)
5382 static unsigned int selinux_ipv6_postroute(void *priv,
5383 struct sk_buff *skb,
5384 const struct nf_hook_state *state)
5385 {
5386 return selinux_ip_postroute(skb, state->out, PF_INET6);
5387 }
5388 #endif /* IPV6 */
5389
5390 #endif /* CONFIG_NETFILTER */
5391
5392 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5393 {
5394 return selinux_nlmsg_perm(sk, skb);
5395 }
5396
5397 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5398 u16 sclass)
5399 {
5400 struct ipc_security_struct *isec;
5401
5402 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5403 if (!isec)
5404 return -ENOMEM;
5405
5406 isec->sclass = sclass;
5407 isec->sid = current_sid();
5408 perm->security = isec;
5409
5410 return 0;
5411 }
5412
5413 static void ipc_free_security(struct kern_ipc_perm *perm)
5414 {
5415 struct ipc_security_struct *isec = perm->security;
5416 perm->security = NULL;
5417 kfree(isec);
5418 }
5419
5420 static int msg_msg_alloc_security(struct msg_msg *msg)
5421 {
5422 struct msg_security_struct *msec;
5423
5424 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5425 if (!msec)
5426 return -ENOMEM;
5427
5428 msec->sid = SECINITSID_UNLABELED;
5429 msg->security = msec;
5430
5431 return 0;
5432 }
5433
5434 static void msg_msg_free_security(struct msg_msg *msg)
5435 {
5436 struct msg_security_struct *msec = msg->security;
5437
5438 msg->security = NULL;
5439 kfree(msec);
5440 }
5441
5442 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5443 u32 perms)
5444 {
5445 struct ipc_security_struct *isec;
5446 struct common_audit_data ad;
5447 u32 sid = current_sid();
5448
5449 isec = ipc_perms->security;
5450
5451 ad.type = LSM_AUDIT_DATA_IPC;
5452 ad.u.ipc_id = ipc_perms->key;
5453
5454 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5455 }
5456
5457 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5458 {
5459 return msg_msg_alloc_security(msg);
5460 }
5461
5462 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5463 {
5464 msg_msg_free_security(msg);
5465 }
5466
5467 /* message queue security operations */
5468 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5469 {
5470 struct ipc_security_struct *isec;
5471 struct common_audit_data ad;
5472 u32 sid = current_sid();
5473 int rc;
5474
5475 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5476 if (rc)
5477 return rc;
5478
5479 isec = msq->q_perm.security;
5480
5481 ad.type = LSM_AUDIT_DATA_IPC;
5482 ad.u.ipc_id = msq->q_perm.key;
5483
5484 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5485 MSGQ__CREATE, &ad);
5486 if (rc) {
5487 ipc_free_security(&msq->q_perm);
5488 return rc;
5489 }
5490 return 0;
5491 }
5492
5493 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5494 {
5495 ipc_free_security(&msq->q_perm);
5496 }
5497
5498 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5499 {
5500 struct ipc_security_struct *isec;
5501 struct common_audit_data ad;
5502 u32 sid = current_sid();
5503
5504 isec = msq->q_perm.security;
5505
5506 ad.type = LSM_AUDIT_DATA_IPC;
5507 ad.u.ipc_id = msq->q_perm.key;
5508
5509 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5510 MSGQ__ASSOCIATE, &ad);
5511 }
5512
5513 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5514 {
5515 int err;
5516 int perms;
5517
5518 switch (cmd) {
5519 case IPC_INFO:
5520 case MSG_INFO:
5521 /* No specific object, just general system-wide information. */
5522 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5523 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5524 case IPC_STAT:
5525 case MSG_STAT:
5526 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5527 break;
5528 case IPC_SET:
5529 perms = MSGQ__SETATTR;
5530 break;
5531 case IPC_RMID:
5532 perms = MSGQ__DESTROY;
5533 break;
5534 default:
5535 return 0;
5536 }
5537
5538 err = ipc_has_perm(&msq->q_perm, perms);
5539 return err;
5540 }
5541
5542 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5543 {
5544 struct ipc_security_struct *isec;
5545 struct msg_security_struct *msec;
5546 struct common_audit_data ad;
5547 u32 sid = current_sid();
5548 int rc;
5549
5550 isec = msq->q_perm.security;
5551 msec = msg->security;
5552
5553 /*
5554 * First time through, need to assign label to the message
5555 */
5556 if (msec->sid == SECINITSID_UNLABELED) {
5557 /*
5558 * Compute new sid based on current process and
5559 * message queue this message will be stored in
5560 */
5561 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5562 NULL, &msec->sid);
5563 if (rc)
5564 return rc;
5565 }
5566
5567 ad.type = LSM_AUDIT_DATA_IPC;
5568 ad.u.ipc_id = msq->q_perm.key;
5569
5570 /* Can this process write to the queue? */
5571 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5572 MSGQ__WRITE, &ad);
5573 if (!rc)
5574 /* Can this process send the message */
5575 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5576 MSG__SEND, &ad);
5577 if (!rc)
5578 /* Can the message be put in the queue? */
5579 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5580 MSGQ__ENQUEUE, &ad);
5581
5582 return rc;
5583 }
5584
5585 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5586 struct task_struct *target,
5587 long type, int mode)
5588 {
5589 struct ipc_security_struct *isec;
5590 struct msg_security_struct *msec;
5591 struct common_audit_data ad;
5592 u32 sid = task_sid(target);
5593 int rc;
5594
5595 isec = msq->q_perm.security;
5596 msec = msg->security;
5597
5598 ad.type = LSM_AUDIT_DATA_IPC;
5599 ad.u.ipc_id = msq->q_perm.key;
5600
5601 rc = avc_has_perm(sid, isec->sid,
5602 SECCLASS_MSGQ, MSGQ__READ, &ad);
5603 if (!rc)
5604 rc = avc_has_perm(sid, msec->sid,
5605 SECCLASS_MSG, MSG__RECEIVE, &ad);
5606 return rc;
5607 }
5608
5609 /* Shared Memory security operations */
5610 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5611 {
5612 struct ipc_security_struct *isec;
5613 struct common_audit_data ad;
5614 u32 sid = current_sid();
5615 int rc;
5616
5617 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5618 if (rc)
5619 return rc;
5620
5621 isec = shp->shm_perm.security;
5622
5623 ad.type = LSM_AUDIT_DATA_IPC;
5624 ad.u.ipc_id = shp->shm_perm.key;
5625
5626 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5627 SHM__CREATE, &ad);
5628 if (rc) {
5629 ipc_free_security(&shp->shm_perm);
5630 return rc;
5631 }
5632 return 0;
5633 }
5634
5635 static void selinux_shm_free_security(struct shmid_kernel *shp)
5636 {
5637 ipc_free_security(&shp->shm_perm);
5638 }
5639
5640 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5641 {
5642 struct ipc_security_struct *isec;
5643 struct common_audit_data ad;
5644 u32 sid = current_sid();
5645
5646 isec = shp->shm_perm.security;
5647
5648 ad.type = LSM_AUDIT_DATA_IPC;
5649 ad.u.ipc_id = shp->shm_perm.key;
5650
5651 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5652 SHM__ASSOCIATE, &ad);
5653 }
5654
5655 /* Note, at this point, shp is locked down */
5656 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5657 {
5658 int perms;
5659 int err;
5660
5661 switch (cmd) {
5662 case IPC_INFO:
5663 case SHM_INFO:
5664 /* No specific object, just general system-wide information. */
5665 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5666 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5667 case IPC_STAT:
5668 case SHM_STAT:
5669 perms = SHM__GETATTR | SHM__ASSOCIATE;
5670 break;
5671 case IPC_SET:
5672 perms = SHM__SETATTR;
5673 break;
5674 case SHM_LOCK:
5675 case SHM_UNLOCK:
5676 perms = SHM__LOCK;
5677 break;
5678 case IPC_RMID:
5679 perms = SHM__DESTROY;
5680 break;
5681 default:
5682 return 0;
5683 }
5684
5685 err = ipc_has_perm(&shp->shm_perm, perms);
5686 return err;
5687 }
5688
5689 static int selinux_shm_shmat(struct shmid_kernel *shp,
5690 char __user *shmaddr, int shmflg)
5691 {
5692 u32 perms;
5693
5694 if (shmflg & SHM_RDONLY)
5695 perms = SHM__READ;
5696 else
5697 perms = SHM__READ | SHM__WRITE;
5698
5699 return ipc_has_perm(&shp->shm_perm, perms);
5700 }
5701
5702 /* Semaphore security operations */
5703 static int selinux_sem_alloc_security(struct sem_array *sma)
5704 {
5705 struct ipc_security_struct *isec;
5706 struct common_audit_data ad;
5707 u32 sid = current_sid();
5708 int rc;
5709
5710 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5711 if (rc)
5712 return rc;
5713
5714 isec = sma->sem_perm.security;
5715
5716 ad.type = LSM_AUDIT_DATA_IPC;
5717 ad.u.ipc_id = sma->sem_perm.key;
5718
5719 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5720 SEM__CREATE, &ad);
5721 if (rc) {
5722 ipc_free_security(&sma->sem_perm);
5723 return rc;
5724 }
5725 return 0;
5726 }
5727
5728 static void selinux_sem_free_security(struct sem_array *sma)
5729 {
5730 ipc_free_security(&sma->sem_perm);
5731 }
5732
5733 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5734 {
5735 struct ipc_security_struct *isec;
5736 struct common_audit_data ad;
5737 u32 sid = current_sid();
5738
5739 isec = sma->sem_perm.security;
5740
5741 ad.type = LSM_AUDIT_DATA_IPC;
5742 ad.u.ipc_id = sma->sem_perm.key;
5743
5744 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5745 SEM__ASSOCIATE, &ad);
5746 }
5747
5748 /* Note, at this point, sma is locked down */
5749 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5750 {
5751 int err;
5752 u32 perms;
5753
5754 switch (cmd) {
5755 case IPC_INFO:
5756 case SEM_INFO:
5757 /* No specific object, just general system-wide information. */
5758 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5759 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5760 case GETPID:
5761 case GETNCNT:
5762 case GETZCNT:
5763 perms = SEM__GETATTR;
5764 break;
5765 case GETVAL:
5766 case GETALL:
5767 perms = SEM__READ;
5768 break;
5769 case SETVAL:
5770 case SETALL:
5771 perms = SEM__WRITE;
5772 break;
5773 case IPC_RMID:
5774 perms = SEM__DESTROY;
5775 break;
5776 case IPC_SET:
5777 perms = SEM__SETATTR;
5778 break;
5779 case IPC_STAT:
5780 case SEM_STAT:
5781 perms = SEM__GETATTR | SEM__ASSOCIATE;
5782 break;
5783 default:
5784 return 0;
5785 }
5786
5787 err = ipc_has_perm(&sma->sem_perm, perms);
5788 return err;
5789 }
5790
5791 static int selinux_sem_semop(struct sem_array *sma,
5792 struct sembuf *sops, unsigned nsops, int alter)
5793 {
5794 u32 perms;
5795
5796 if (alter)
5797 perms = SEM__READ | SEM__WRITE;
5798 else
5799 perms = SEM__READ;
5800
5801 return ipc_has_perm(&sma->sem_perm, perms);
5802 }
5803
5804 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5805 {
5806 u32 av = 0;
5807
5808 av = 0;
5809 if (flag & S_IRUGO)
5810 av |= IPC__UNIX_READ;
5811 if (flag & S_IWUGO)
5812 av |= IPC__UNIX_WRITE;
5813
5814 if (av == 0)
5815 return 0;
5816
5817 return ipc_has_perm(ipcp, av);
5818 }
5819
5820 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5821 {
5822 struct ipc_security_struct *isec = ipcp->security;
5823 *secid = isec->sid;
5824 }
5825
5826 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5827 {
5828 if (inode)
5829 inode_doinit_with_dentry(inode, dentry);
5830 }
5831
5832 static int selinux_getprocattr(struct task_struct *p,
5833 char *name, char **value)
5834 {
5835 const struct task_security_struct *__tsec;
5836 u32 sid;
5837 int error;
5838 unsigned len;
5839
5840 rcu_read_lock();
5841 __tsec = __task_cred(p)->security;
5842
5843 if (current != p) {
5844 error = avc_has_perm(current_sid(), __tsec->sid,
5845 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5846 if (error)
5847 goto bad;
5848 }
5849
5850 if (!strcmp(name, "current"))
5851 sid = __tsec->sid;
5852 else if (!strcmp(name, "prev"))
5853 sid = __tsec->osid;
5854 else if (!strcmp(name, "exec"))
5855 sid = __tsec->exec_sid;
5856 else if (!strcmp(name, "fscreate"))
5857 sid = __tsec->create_sid;
5858 else if (!strcmp(name, "keycreate"))
5859 sid = __tsec->keycreate_sid;
5860 else if (!strcmp(name, "sockcreate"))
5861 sid = __tsec->sockcreate_sid;
5862 else {
5863 error = -EINVAL;
5864 goto bad;
5865 }
5866 rcu_read_unlock();
5867
5868 if (!sid)
5869 return 0;
5870
5871 error = security_sid_to_context(sid, value, &len);
5872 if (error)
5873 return error;
5874 return len;
5875
5876 bad:
5877 rcu_read_unlock();
5878 return error;
5879 }
5880
5881 static int selinux_setprocattr(const char *name, void *value, size_t size)
5882 {
5883 struct task_security_struct *tsec;
5884 struct cred *new;
5885 u32 mysid = current_sid(), sid = 0, ptsid;
5886 int error;
5887 char *str = value;
5888
5889 /*
5890 * Basic control over ability to set these attributes at all.
5891 */
5892 if (!strcmp(name, "exec"))
5893 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5894 PROCESS__SETEXEC, NULL);
5895 else if (!strcmp(name, "fscreate"))
5896 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5897 PROCESS__SETFSCREATE, NULL);
5898 else if (!strcmp(name, "keycreate"))
5899 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5900 PROCESS__SETKEYCREATE, NULL);
5901 else if (!strcmp(name, "sockcreate"))
5902 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5903 PROCESS__SETSOCKCREATE, NULL);
5904 else if (!strcmp(name, "current"))
5905 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5906 PROCESS__SETCURRENT, NULL);
5907 else
5908 error = -EINVAL;
5909 if (error)
5910 return error;
5911
5912 /* Obtain a SID for the context, if one was specified. */
5913 if (size && str[0] && str[0] != '\n') {
5914 if (str[size-1] == '\n') {
5915 str[size-1] = 0;
5916 size--;
5917 }
5918 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5919 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5920 if (!capable(CAP_MAC_ADMIN)) {
5921 struct audit_buffer *ab;
5922 size_t audit_size;
5923
5924 /* We strip a nul only if it is at the end, otherwise the
5925 * context contains a nul and we should audit that */
5926 if (str[size - 1] == '\0')
5927 audit_size = size - 1;
5928 else
5929 audit_size = size;
5930 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5931 audit_log_format(ab, "op=fscreate invalid_context=");
5932 audit_log_n_untrustedstring(ab, value, audit_size);
5933 audit_log_end(ab);
5934
5935 return error;
5936 }
5937 error = security_context_to_sid_force(value, size,
5938 &sid);
5939 }
5940 if (error)
5941 return error;
5942 }
5943
5944 new = prepare_creds();
5945 if (!new)
5946 return -ENOMEM;
5947
5948 /* Permission checking based on the specified context is
5949 performed during the actual operation (execve,
5950 open/mkdir/...), when we know the full context of the
5951 operation. See selinux_bprm_set_creds for the execve
5952 checks and may_create for the file creation checks. The
5953 operation will then fail if the context is not permitted. */
5954 tsec = new->security;
5955 if (!strcmp(name, "exec")) {
5956 tsec->exec_sid = sid;
5957 } else if (!strcmp(name, "fscreate")) {
5958 tsec->create_sid = sid;
5959 } else if (!strcmp(name, "keycreate")) {
5960 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5961 NULL);
5962 if (error)
5963 goto abort_change;
5964 tsec->keycreate_sid = sid;
5965 } else if (!strcmp(name, "sockcreate")) {
5966 tsec->sockcreate_sid = sid;
5967 } else if (!strcmp(name, "current")) {
5968 error = -EINVAL;
5969 if (sid == 0)
5970 goto abort_change;
5971
5972 /* Only allow single threaded processes to change context */
5973 error = -EPERM;
5974 if (!current_is_single_threaded()) {
5975 error = security_bounded_transition(tsec->sid, sid);
5976 if (error)
5977 goto abort_change;
5978 }
5979
5980 /* Check permissions for the transition. */
5981 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5982 PROCESS__DYNTRANSITION, NULL);
5983 if (error)
5984 goto abort_change;
5985
5986 /* Check for ptracing, and update the task SID if ok.
5987 Otherwise, leave SID unchanged and fail. */
5988 ptsid = ptrace_parent_sid();
5989 if (ptsid != 0) {
5990 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5991 PROCESS__PTRACE, NULL);
5992 if (error)
5993 goto abort_change;
5994 }
5995
5996 tsec->sid = sid;
5997 } else {
5998 error = -EINVAL;
5999 goto abort_change;
6000 }
6001
6002 commit_creds(new);
6003 return size;
6004
6005 abort_change:
6006 abort_creds(new);
6007 return error;
6008 }
6009
6010 static int selinux_ismaclabel(const char *name)
6011 {
6012 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6013 }
6014
6015 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6016 {
6017 return security_sid_to_context(secid, secdata, seclen);
6018 }
6019
6020 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6021 {
6022 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6023 }
6024
6025 static void selinux_release_secctx(char *secdata, u32 seclen)
6026 {
6027 kfree(secdata);
6028 }
6029
6030 static void selinux_inode_invalidate_secctx(struct inode *inode)
6031 {
6032 struct inode_security_struct *isec = inode->i_security;
6033
6034 spin_lock(&isec->lock);
6035 isec->initialized = LABEL_INVALID;
6036 spin_unlock(&isec->lock);
6037 }
6038
6039 /*
6040 * called with inode->i_mutex locked
6041 */
6042 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6043 {
6044 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6045 }
6046
6047 /*
6048 * called with inode->i_mutex locked
6049 */
6050 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6051 {
6052 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6053 }
6054
6055 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6056 {
6057 int len = 0;
6058 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6059 ctx, true);
6060 if (len < 0)
6061 return len;
6062 *ctxlen = len;
6063 return 0;
6064 }
6065 #ifdef CONFIG_KEYS
6066
6067 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6068 unsigned long flags)
6069 {
6070 const struct task_security_struct *tsec;
6071 struct key_security_struct *ksec;
6072
6073 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6074 if (!ksec)
6075 return -ENOMEM;
6076
6077 tsec = cred->security;
6078 if (tsec->keycreate_sid)
6079 ksec->sid = tsec->keycreate_sid;
6080 else
6081 ksec->sid = tsec->sid;
6082
6083 k->security = ksec;
6084 return 0;
6085 }
6086
6087 static void selinux_key_free(struct key *k)
6088 {
6089 struct key_security_struct *ksec = k->security;
6090
6091 k->security = NULL;
6092 kfree(ksec);
6093 }
6094
6095 static int selinux_key_permission(key_ref_t key_ref,
6096 const struct cred *cred,
6097 unsigned perm)
6098 {
6099 struct key *key;
6100 struct key_security_struct *ksec;
6101 u32 sid;
6102
6103 /* if no specific permissions are requested, we skip the
6104 permission check. No serious, additional covert channels
6105 appear to be created. */
6106 if (perm == 0)
6107 return 0;
6108
6109 sid = cred_sid(cred);
6110
6111 key = key_ref_to_ptr(key_ref);
6112 ksec = key->security;
6113
6114 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6115 }
6116
6117 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6118 {
6119 struct key_security_struct *ksec = key->security;
6120 char *context = NULL;
6121 unsigned len;
6122 int rc;
6123
6124 rc = security_sid_to_context(ksec->sid, &context, &len);
6125 if (!rc)
6126 rc = len;
6127 *_buffer = context;
6128 return rc;
6129 }
6130
6131 #endif
6132
6133 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6134 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6135 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6136 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6137 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6138
6139 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6140 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6141 LSM_HOOK_INIT(capget, selinux_capget),
6142 LSM_HOOK_INIT(capset, selinux_capset),
6143 LSM_HOOK_INIT(capable, selinux_capable),
6144 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6145 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6146 LSM_HOOK_INIT(syslog, selinux_syslog),
6147 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6148
6149 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6150
6151 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6152 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6153 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6154 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6155
6156 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6157 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6158 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6159 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6160 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6161 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6162 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6163 LSM_HOOK_INIT(sb_mount, selinux_mount),
6164 LSM_HOOK_INIT(sb_umount, selinux_umount),
6165 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6166 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6167 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6168
6169 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6170 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6171
6172 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6173 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6174 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6175 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6176 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6177 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6178 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6179 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6180 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6181 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6182 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6183 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6184 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6185 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6186 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6187 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6188 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6189 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6190 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6191 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6192 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6193 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6194 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6195 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6196 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6197 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6198 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6199
6200 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6201 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6202 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6203 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6204 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6205 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6206 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6207 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6208 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6209 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6210 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6211 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6212
6213 LSM_HOOK_INIT(file_open, selinux_file_open),
6214
6215 LSM_HOOK_INIT(task_create, selinux_task_create),
6216 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6217 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6218 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6219 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6220 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6221 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6222 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6223 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6224 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6225 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6226 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6227 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6228 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6229 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6230 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6231 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6232 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6233 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6234 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6235 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6236 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6237 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6238
6239 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6240 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6241
6242 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6243 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6244
6245 LSM_HOOK_INIT(msg_queue_alloc_security,
6246 selinux_msg_queue_alloc_security),
6247 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6248 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6249 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6250 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6251 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6252
6253 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6254 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6255 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6256 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6257 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6258
6259 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6260 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6261 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6262 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6263 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6264
6265 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6266
6267 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6268 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6269
6270 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6271 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6272 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6273 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6274 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6275 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6276 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6277 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6278
6279 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6280 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6281
6282 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6283 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6284 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6285 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6286 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6287 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6288 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6289 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6290 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6291 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6292 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6293 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6294 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6295 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6296 LSM_HOOK_INIT(socket_getpeersec_stream,
6297 selinux_socket_getpeersec_stream),
6298 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6299 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6300 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6301 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6302 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6303 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6304 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6305 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6306 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6307 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6308 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6309 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6310 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6311 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6312 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6313 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6314 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6315 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6316 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6317
6318 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6319 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6320 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6321 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6322 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6323 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6324 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6325 selinux_xfrm_state_alloc_acquire),
6326 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6327 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6328 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6329 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6330 selinux_xfrm_state_pol_flow_match),
6331 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6332 #endif
6333
6334 #ifdef CONFIG_KEYS
6335 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6336 LSM_HOOK_INIT(key_free, selinux_key_free),
6337 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6338 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6339 #endif
6340
6341 #ifdef CONFIG_AUDIT
6342 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6343 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6344 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6345 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6346 #endif
6347 };
6348
6349 static __init int selinux_init(void)
6350 {
6351 if (!security_module_enable("selinux")) {
6352 selinux_enabled = 0;
6353 return 0;
6354 }
6355
6356 if (!selinux_enabled) {
6357 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6358 return 0;
6359 }
6360
6361 printk(KERN_INFO "SELinux: Initializing.\n");
6362
6363 /* Set the security state for the initial task. */
6364 cred_init_security();
6365
6366 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6367
6368 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6369 sizeof(struct inode_security_struct),
6370 0, SLAB_PANIC, NULL);
6371 file_security_cache = kmem_cache_create("selinux_file_security",
6372 sizeof(struct file_security_struct),
6373 0, SLAB_PANIC, NULL);
6374 avc_init();
6375
6376 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6377
6378 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6379 panic("SELinux: Unable to register AVC netcache callback\n");
6380
6381 if (selinux_enforcing)
6382 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6383 else
6384 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6385
6386 return 0;
6387 }
6388
6389 static void delayed_superblock_init(struct super_block *sb, void *unused)
6390 {
6391 superblock_doinit(sb, NULL);
6392 }
6393
6394 void selinux_complete_init(void)
6395 {
6396 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6397
6398 /* Set up any superblocks initialized prior to the policy load. */
6399 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6400 iterate_supers(delayed_superblock_init, NULL);
6401 }
6402
6403 /* SELinux requires early initialization in order to label
6404 all processes and objects when they are created. */
6405 security_initcall(selinux_init);
6406
6407 #if defined(CONFIG_NETFILTER)
6408
6409 static struct nf_hook_ops selinux_nf_ops[] = {
6410 {
6411 .hook = selinux_ipv4_postroute,
6412 .pf = NFPROTO_IPV4,
6413 .hooknum = NF_INET_POST_ROUTING,
6414 .priority = NF_IP_PRI_SELINUX_LAST,
6415 },
6416 {
6417 .hook = selinux_ipv4_forward,
6418 .pf = NFPROTO_IPV4,
6419 .hooknum = NF_INET_FORWARD,
6420 .priority = NF_IP_PRI_SELINUX_FIRST,
6421 },
6422 {
6423 .hook = selinux_ipv4_output,
6424 .pf = NFPROTO_IPV4,
6425 .hooknum = NF_INET_LOCAL_OUT,
6426 .priority = NF_IP_PRI_SELINUX_FIRST,
6427 },
6428 #if IS_ENABLED(CONFIG_IPV6)
6429 {
6430 .hook = selinux_ipv6_postroute,
6431 .pf = NFPROTO_IPV6,
6432 .hooknum = NF_INET_POST_ROUTING,
6433 .priority = NF_IP6_PRI_SELINUX_LAST,
6434 },
6435 {
6436 .hook = selinux_ipv6_forward,
6437 .pf = NFPROTO_IPV6,
6438 .hooknum = NF_INET_FORWARD,
6439 .priority = NF_IP6_PRI_SELINUX_FIRST,
6440 },
6441 {
6442 .hook = selinux_ipv6_output,
6443 .pf = NFPROTO_IPV6,
6444 .hooknum = NF_INET_LOCAL_OUT,
6445 .priority = NF_IP6_PRI_SELINUX_FIRST,
6446 },
6447 #endif /* IPV6 */
6448 };
6449
6450 static int __init selinux_nf_ip_init(void)
6451 {
6452 int err;
6453
6454 if (!selinux_enabled)
6455 return 0;
6456
6457 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6458
6459 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6460 if (err)
6461 panic("SELinux: nf_register_hooks: error %d\n", err);
6462
6463 return 0;
6464 }
6465
6466 __initcall(selinux_nf_ip_init);
6467
6468 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6469 static void selinux_nf_ip_exit(void)
6470 {
6471 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6472
6473 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6474 }
6475 #endif
6476
6477 #else /* CONFIG_NETFILTER */
6478
6479 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6480 #define selinux_nf_ip_exit()
6481 #endif
6482
6483 #endif /* CONFIG_NETFILTER */
6484
6485 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6486 static int selinux_disabled;
6487
6488 int selinux_disable(void)
6489 {
6490 if (ss_initialized) {
6491 /* Not permitted after initial policy load. */
6492 return -EINVAL;
6493 }
6494
6495 if (selinux_disabled) {
6496 /* Only do this once. */
6497 return -EINVAL;
6498 }
6499
6500 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6501
6502 selinux_disabled = 1;
6503 selinux_enabled = 0;
6504
6505 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6506
6507 /* Try to destroy the avc node cache */
6508 avc_disable();
6509
6510 /* Unregister netfilter hooks. */
6511 selinux_nf_ip_exit();
6512
6513 /* Unregister selinuxfs. */
6514 exit_sel_fs();
6515
6516 return 0;
6517 }
6518 #endif
Ubuntu Artful kernel mirror