2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount
= ATOMIC_INIT(0);
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing
;
103 static int __init
enforcing_setup(char *str
)
105 unsigned long enforcing
;
106 if (!kstrtoul(str
, 0, &enforcing
))
107 selinux_enforcing
= enforcing
? 1 : 0;
110 __setup("enforcing=", enforcing_setup
);
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
116 static int __init
selinux_enabled_setup(char *str
)
118 unsigned long enabled
;
119 if (!kstrtoul(str
, 0, &enabled
))
120 selinux_enabled
= enabled
? 1 : 0;
123 __setup("selinux=", selinux_enabled_setup
);
125 int selinux_enabled
= 1;
128 static struct kmem_cache
*sel_inode_cache
;
129 static struct kmem_cache
*file_security_cache
;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
142 static int selinux_secmark_enabled(void)
144 return (selinux_policycap_alwaysnetwork
|| atomic_read(&selinux_secmark_refcount
));
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
157 static int selinux_peerlbl_enabled(void)
159 return (selinux_policycap_alwaysnetwork
|| netlbl_enabled() || selinux_xfrm_enabled());
162 static int selinux_netcache_avc_callback(u32 event
)
164 if (event
== AVC_CALLBACK_RESET
) {
174 * initialise the security for the init task
176 static void cred_init_security(void)
178 struct cred
*cred
= (struct cred
*) current
->real_cred
;
179 struct task_security_struct
*tsec
;
181 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
183 panic("SELinux: Failed to initialize initial task.\n");
185 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
186 cred
->security
= tsec
;
190 * get the security ID of a set of credentials
192 static inline u32
cred_sid(const struct cred
*cred
)
194 const struct task_security_struct
*tsec
;
196 tsec
= cred
->security
;
201 * get the objective security ID of a task
203 static inline u32
task_sid(const struct task_struct
*task
)
208 sid
= cred_sid(__task_cred(task
));
213 /* Allocate and free functions for each kind of security blob. */
215 static int inode_alloc_security(struct inode
*inode
)
217 struct inode_security_struct
*isec
;
218 u32 sid
= current_sid();
220 isec
= kmem_cache_zalloc(sel_inode_cache
, GFP_NOFS
);
224 spin_lock_init(&isec
->lock
);
225 INIT_LIST_HEAD(&isec
->list
);
227 isec
->sid
= SECINITSID_UNLABELED
;
228 isec
->sclass
= SECCLASS_FILE
;
229 isec
->task_sid
= sid
;
230 isec
->initialized
= LABEL_INVALID
;
231 inode
->i_security
= isec
;
236 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
239 * Try reloading inode security labels that have been marked as invalid. The
240 * @may_sleep parameter indicates when sleeping and thus reloading labels is
241 * allowed; when set to false, returns -ECHILD when the label is
242 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
243 * when no dentry is available, set it to NULL instead.
245 static int __inode_security_revalidate(struct inode
*inode
,
246 struct dentry
*opt_dentry
,
249 struct inode_security_struct
*isec
= inode
->i_security
;
251 might_sleep_if(may_sleep
);
253 if (ss_initialized
&& isec
->initialized
!= LABEL_INITIALIZED
) {
258 * Try reloading the inode security label. This will fail if
259 * @opt_dentry is NULL and no dentry for this inode can be
260 * found; in that case, continue using the old label.
262 inode_doinit_with_dentry(inode
, opt_dentry
);
267 static struct inode_security_struct
*inode_security_novalidate(struct inode
*inode
)
269 return inode
->i_security
;
272 static struct inode_security_struct
*inode_security_rcu(struct inode
*inode
, bool rcu
)
276 error
= __inode_security_revalidate(inode
, NULL
, !rcu
);
278 return ERR_PTR(error
);
279 return inode
->i_security
;
283 * Get the security label of an inode.
285 static struct inode_security_struct
*inode_security(struct inode
*inode
)
287 __inode_security_revalidate(inode
, NULL
, true);
288 return inode
->i_security
;
291 static struct inode_security_struct
*backing_inode_security_novalidate(struct dentry
*dentry
)
293 struct inode
*inode
= d_backing_inode(dentry
);
295 return inode
->i_security
;
299 * Get the security label of a dentry's backing inode.
301 static struct inode_security_struct
*backing_inode_security(struct dentry
*dentry
)
303 struct inode
*inode
= d_backing_inode(dentry
);
305 __inode_security_revalidate(inode
, dentry
, true);
306 return inode
->i_security
;
309 static void inode_free_rcu(struct rcu_head
*head
)
311 struct inode_security_struct
*isec
;
313 isec
= container_of(head
, struct inode_security_struct
, rcu
);
314 kmem_cache_free(sel_inode_cache
, isec
);
317 static void inode_free_security(struct inode
*inode
)
319 struct inode_security_struct
*isec
= inode
->i_security
;
320 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
323 * As not all inode security structures are in a list, we check for
324 * empty list outside of the lock to make sure that we won't waste
325 * time taking a lock doing nothing.
327 * The list_del_init() function can be safely called more than once.
328 * It should not be possible for this function to be called with
329 * concurrent list_add(), but for better safety against future changes
330 * in the code, we use list_empty_careful() here.
332 if (!list_empty_careful(&isec
->list
)) {
333 spin_lock(&sbsec
->isec_lock
);
334 list_del_init(&isec
->list
);
335 spin_unlock(&sbsec
->isec_lock
);
339 * The inode may still be referenced in a path walk and
340 * a call to selinux_inode_permission() can be made
341 * after inode_free_security() is called. Ideally, the VFS
342 * wouldn't do this, but fixing that is a much harder
343 * job. For now, simply free the i_security via RCU, and
344 * leave the current inode->i_security pointer intact.
345 * The inode will be freed after the RCU grace period too.
347 call_rcu(&isec
->rcu
, inode_free_rcu
);
350 static int file_alloc_security(struct file
*file
)
352 struct file_security_struct
*fsec
;
353 u32 sid
= current_sid();
355 fsec
= kmem_cache_zalloc(file_security_cache
, GFP_KERNEL
);
360 fsec
->fown_sid
= sid
;
361 file
->f_security
= fsec
;
366 static void file_free_security(struct file
*file
)
368 struct file_security_struct
*fsec
= file
->f_security
;
369 file
->f_security
= NULL
;
370 kmem_cache_free(file_security_cache
, fsec
);
373 static int superblock_alloc_security(struct super_block
*sb
)
375 struct superblock_security_struct
*sbsec
;
377 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
381 mutex_init(&sbsec
->lock
);
382 INIT_LIST_HEAD(&sbsec
->isec_head
);
383 spin_lock_init(&sbsec
->isec_lock
);
385 sbsec
->sid
= SECINITSID_UNLABELED
;
386 sbsec
->def_sid
= SECINITSID_FILE
;
387 sbsec
->mntpoint_sid
= SECINITSID_UNLABELED
;
388 sb
->s_security
= sbsec
;
393 static void superblock_free_security(struct super_block
*sb
)
395 struct superblock_security_struct
*sbsec
= sb
->s_security
;
396 sb
->s_security
= NULL
;
400 /* The file system's label must be initialized prior to use. */
402 static const char *labeling_behaviors
[7] = {
404 "uses transition SIDs",
406 "uses genfs_contexts",
407 "not configured for labeling",
408 "uses mountpoint labeling",
409 "uses native labeling",
412 static inline int inode_doinit(struct inode
*inode
)
414 return inode_doinit_with_dentry(inode
, NULL
);
423 Opt_labelsupport
= 5,
427 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429 static const match_table_t tokens
= {
430 {Opt_context
, CONTEXT_STR
"%s"},
431 {Opt_fscontext
, FSCONTEXT_STR
"%s"},
432 {Opt_defcontext
, DEFCONTEXT_STR
"%s"},
433 {Opt_rootcontext
, ROOTCONTEXT_STR
"%s"},
434 {Opt_labelsupport
, LABELSUPP_STR
},
438 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440 static int may_context_mount_sb_relabel(u32 sid
,
441 struct superblock_security_struct
*sbsec
,
442 const struct cred
*cred
)
444 const struct task_security_struct
*tsec
= cred
->security
;
447 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
448 FILESYSTEM__RELABELFROM
, NULL
);
452 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
453 FILESYSTEM__RELABELTO
, NULL
);
457 static int may_context_mount_inode_relabel(u32 sid
,
458 struct superblock_security_struct
*sbsec
,
459 const struct cred
*cred
)
461 const struct task_security_struct
*tsec
= cred
->security
;
463 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
464 FILESYSTEM__RELABELFROM
, NULL
);
468 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
469 FILESYSTEM__ASSOCIATE
, NULL
);
473 static int selinux_is_sblabel_mnt(struct super_block
*sb
)
475 struct superblock_security_struct
*sbsec
= sb
->s_security
;
477 return sbsec
->behavior
== SECURITY_FS_USE_XATTR
||
478 sbsec
->behavior
== SECURITY_FS_USE_TRANS
||
479 sbsec
->behavior
== SECURITY_FS_USE_TASK
||
480 sbsec
->behavior
== SECURITY_FS_USE_NATIVE
||
481 /* Special handling. Genfs but also in-core setxattr handler */
482 !strcmp(sb
->s_type
->name
, "sysfs") ||
483 !strcmp(sb
->s_type
->name
, "cgroup") ||
484 !strcmp(sb
->s_type
->name
, "cgroup2") ||
485 !strcmp(sb
->s_type
->name
, "pstore") ||
486 !strcmp(sb
->s_type
->name
, "debugfs") ||
487 !strcmp(sb
->s_type
->name
, "tracefs") ||
488 !strcmp(sb
->s_type
->name
, "rootfs");
491 static int sb_finish_set_opts(struct super_block
*sb
)
493 struct superblock_security_struct
*sbsec
= sb
->s_security
;
494 struct dentry
*root
= sb
->s_root
;
495 struct inode
*root_inode
= d_backing_inode(root
);
498 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
499 /* Make sure that the xattr handler exists and that no
500 error other than -ENODATA is returned by getxattr on
501 the root directory. -ENODATA is ok, as this may be
502 the first boot of the SELinux kernel before we have
503 assigned xattr values to the filesystem. */
504 if (!(root_inode
->i_opflags
& IOP_XATTR
)) {
505 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
506 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
511 rc
= __vfs_getxattr(root
, root_inode
, XATTR_NAME_SELINUX
, NULL
, 0);
512 if (rc
< 0 && rc
!= -ENODATA
) {
513 if (rc
== -EOPNOTSUPP
)
514 printk(KERN_WARNING
"SELinux: (dev %s, type "
515 "%s) has no security xattr handler\n",
516 sb
->s_id
, sb
->s_type
->name
);
518 printk(KERN_WARNING
"SELinux: (dev %s, type "
519 "%s) getxattr errno %d\n", sb
->s_id
,
520 sb
->s_type
->name
, -rc
);
525 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
))
526 printk(KERN_ERR
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
527 sb
->s_id
, sb
->s_type
->name
);
529 sbsec
->flags
|= SE_SBINITIALIZED
;
530 if (selinux_is_sblabel_mnt(sb
))
531 sbsec
->flags
|= SBLABEL_MNT
;
533 /* Initialize the root inode. */
534 rc
= inode_doinit_with_dentry(root_inode
, root
);
536 /* Initialize any other inodes associated with the superblock, e.g.
537 inodes created prior to initial policy load or inodes created
538 during get_sb by a pseudo filesystem that directly
540 spin_lock(&sbsec
->isec_lock
);
542 if (!list_empty(&sbsec
->isec_head
)) {
543 struct inode_security_struct
*isec
=
544 list_entry(sbsec
->isec_head
.next
,
545 struct inode_security_struct
, list
);
546 struct inode
*inode
= isec
->inode
;
547 list_del_init(&isec
->list
);
548 spin_unlock(&sbsec
->isec_lock
);
549 inode
= igrab(inode
);
551 if (!IS_PRIVATE(inode
))
555 spin_lock(&sbsec
->isec_lock
);
558 spin_unlock(&sbsec
->isec_lock
);
564 * This function should allow an FS to ask what it's mount security
565 * options were so it can use those later for submounts, displaying
566 * mount options, or whatever.
568 static int selinux_get_mnt_opts(const struct super_block
*sb
,
569 struct security_mnt_opts
*opts
)
572 struct superblock_security_struct
*sbsec
= sb
->s_security
;
573 char *context
= NULL
;
577 security_init_mnt_opts(opts
);
579 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
585 /* make sure we always check enough bits to cover the mask */
586 BUILD_BUG_ON(SE_MNTMASK
>= (1 << NUM_SEL_MNT_OPTS
));
588 tmp
= sbsec
->flags
& SE_MNTMASK
;
589 /* count the number of mount options for this sb */
590 for (i
= 0; i
< NUM_SEL_MNT_OPTS
; i
++) {
592 opts
->num_mnt_opts
++;
595 /* Check if the Label support flag is set */
596 if (sbsec
->flags
& SBLABEL_MNT
)
597 opts
->num_mnt_opts
++;
599 opts
->mnt_opts
= kcalloc(opts
->num_mnt_opts
, sizeof(char *), GFP_ATOMIC
);
600 if (!opts
->mnt_opts
) {
605 opts
->mnt_opts_flags
= kcalloc(opts
->num_mnt_opts
, sizeof(int), GFP_ATOMIC
);
606 if (!opts
->mnt_opts_flags
) {
612 if (sbsec
->flags
& FSCONTEXT_MNT
) {
613 rc
= security_sid_to_context(sbsec
->sid
, &context
, &len
);
616 opts
->mnt_opts
[i
] = context
;
617 opts
->mnt_opts_flags
[i
++] = FSCONTEXT_MNT
;
619 if (sbsec
->flags
& CONTEXT_MNT
) {
620 rc
= security_sid_to_context(sbsec
->mntpoint_sid
, &context
, &len
);
623 opts
->mnt_opts
[i
] = context
;
624 opts
->mnt_opts_flags
[i
++] = CONTEXT_MNT
;
626 if (sbsec
->flags
& DEFCONTEXT_MNT
) {
627 rc
= security_sid_to_context(sbsec
->def_sid
, &context
, &len
);
630 opts
->mnt_opts
[i
] = context
;
631 opts
->mnt_opts_flags
[i
++] = DEFCONTEXT_MNT
;
633 if (sbsec
->flags
& ROOTCONTEXT_MNT
) {
634 struct dentry
*root
= sbsec
->sb
->s_root
;
635 struct inode_security_struct
*isec
= backing_inode_security(root
);
637 rc
= security_sid_to_context(isec
->sid
, &context
, &len
);
640 opts
->mnt_opts
[i
] = context
;
641 opts
->mnt_opts_flags
[i
++] = ROOTCONTEXT_MNT
;
643 if (sbsec
->flags
& SBLABEL_MNT
) {
644 opts
->mnt_opts
[i
] = NULL
;
645 opts
->mnt_opts_flags
[i
++] = SBLABEL_MNT
;
648 BUG_ON(i
!= opts
->num_mnt_opts
);
653 security_free_mnt_opts(opts
);
657 static int bad_option(struct superblock_security_struct
*sbsec
, char flag
,
658 u32 old_sid
, u32 new_sid
)
660 char mnt_flags
= sbsec
->flags
& SE_MNTMASK
;
662 /* check if the old mount command had the same options */
663 if (sbsec
->flags
& SE_SBINITIALIZED
)
664 if (!(sbsec
->flags
& flag
) ||
665 (old_sid
!= new_sid
))
668 /* check if we were passed the same options twice,
669 * aka someone passed context=a,context=b
671 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
672 if (mnt_flags
& flag
)
678 * Allow filesystems with binary mount data to explicitly set mount point
679 * labeling information.
681 static int selinux_set_mnt_opts(struct super_block
*sb
,
682 struct security_mnt_opts
*opts
,
683 unsigned long kern_flags
,
684 unsigned long *set_kern_flags
)
686 const struct cred
*cred
= current_cred();
688 struct superblock_security_struct
*sbsec
= sb
->s_security
;
689 const char *name
= sb
->s_type
->name
;
690 struct dentry
*root
= sbsec
->sb
->s_root
;
691 struct inode_security_struct
*root_isec
;
692 u32 fscontext_sid
= 0, context_sid
= 0, rootcontext_sid
= 0;
693 u32 defcontext_sid
= 0;
694 char **mount_options
= opts
->mnt_opts
;
695 int *flags
= opts
->mnt_opts_flags
;
696 int num_opts
= opts
->num_mnt_opts
;
698 mutex_lock(&sbsec
->lock
);
700 if (!ss_initialized
) {
702 /* Defer initialization until selinux_complete_init,
703 after the initial policy is loaded and the security
704 server is ready to handle calls. */
708 printk(KERN_WARNING
"SELinux: Unable to set superblock options "
709 "before the security server is initialized\n");
712 if (kern_flags
&& !set_kern_flags
) {
713 /* Specifying internal flags without providing a place to
714 * place the results is not allowed */
720 * Binary mount data FS will come through this function twice. Once
721 * from an explicit call and once from the generic calls from the vfs.
722 * Since the generic VFS calls will not contain any security mount data
723 * we need to skip the double mount verification.
725 * This does open a hole in which we will not notice if the first
726 * mount using this sb set explict options and a second mount using
727 * this sb does not set any security options. (The first options
728 * will be used for both mounts)
730 if ((sbsec
->flags
& SE_SBINITIALIZED
) && (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
734 root_isec
= backing_inode_security_novalidate(root
);
737 * parse the mount options, check if they are valid sids.
738 * also check if someone is trying to mount the same sb more
739 * than once with different security options.
741 for (i
= 0; i
< num_opts
; i
++) {
744 if (flags
[i
] == SBLABEL_MNT
)
746 rc
= security_context_str_to_sid(mount_options
[i
], &sid
, GFP_KERNEL
);
748 printk(KERN_WARNING
"SELinux: security_context_str_to_sid"
749 "(%s) failed for (dev %s, type %s) errno=%d\n",
750 mount_options
[i
], sb
->s_id
, name
, rc
);
757 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
,
759 goto out_double_mount
;
761 sbsec
->flags
|= FSCONTEXT_MNT
;
766 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
,
768 goto out_double_mount
;
770 sbsec
->flags
|= CONTEXT_MNT
;
772 case ROOTCONTEXT_MNT
:
773 rootcontext_sid
= sid
;
775 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
,
777 goto out_double_mount
;
779 sbsec
->flags
|= ROOTCONTEXT_MNT
;
783 defcontext_sid
= sid
;
785 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
,
787 goto out_double_mount
;
789 sbsec
->flags
|= DEFCONTEXT_MNT
;
798 if (sbsec
->flags
& SE_SBINITIALIZED
) {
799 /* previously mounted with options, but not on this attempt? */
800 if ((sbsec
->flags
& SE_MNTMASK
) && !num_opts
)
801 goto out_double_mount
;
806 if (strcmp(sb
->s_type
->name
, "proc") == 0)
807 sbsec
->flags
|= SE_SBPROC
| SE_SBGENFS
;
809 if (!strcmp(sb
->s_type
->name
, "debugfs") ||
810 !strcmp(sb
->s_type
->name
, "sysfs") ||
811 !strcmp(sb
->s_type
->name
, "pstore"))
812 sbsec
->flags
|= SE_SBGENFS
;
814 if (!sbsec
->behavior
) {
816 * Determine the labeling behavior to use for this
819 rc
= security_fs_use(sb
);
822 "%s: security_fs_use(%s) returned %d\n",
823 __func__
, sb
->s_type
->name
, rc
);
829 * If this is a user namespace mount and the filesystem type is not
830 * explicitly whitelisted, then no contexts are allowed on the command
831 * line and security labels must be ignored.
833 if (sb
->s_user_ns
!= &init_user_ns
&&
834 strcmp(sb
->s_type
->name
, "tmpfs") &&
835 strcmp(sb
->s_type
->name
, "ramfs") &&
836 strcmp(sb
->s_type
->name
, "devpts")) {
837 if (context_sid
|| fscontext_sid
|| rootcontext_sid
||
842 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
843 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
844 rc
= security_transition_sid(current_sid(), current_sid(),
846 &sbsec
->mntpoint_sid
);
853 /* sets the context of the superblock for the fs being mounted. */
855 rc
= may_context_mount_sb_relabel(fscontext_sid
, sbsec
, cred
);
859 sbsec
->sid
= fscontext_sid
;
863 * Switch to using mount point labeling behavior.
864 * sets the label used on all file below the mountpoint, and will set
865 * the superblock context if not already set.
867 if (kern_flags
& SECURITY_LSM_NATIVE_LABELS
&& !context_sid
) {
868 sbsec
->behavior
= SECURITY_FS_USE_NATIVE
;
869 *set_kern_flags
|= SECURITY_LSM_NATIVE_LABELS
;
873 if (!fscontext_sid
) {
874 rc
= may_context_mount_sb_relabel(context_sid
, sbsec
,
878 sbsec
->sid
= context_sid
;
880 rc
= may_context_mount_inode_relabel(context_sid
, sbsec
,
885 if (!rootcontext_sid
)
886 rootcontext_sid
= context_sid
;
888 sbsec
->mntpoint_sid
= context_sid
;
889 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
892 if (rootcontext_sid
) {
893 rc
= may_context_mount_inode_relabel(rootcontext_sid
, sbsec
,
898 root_isec
->sid
= rootcontext_sid
;
899 root_isec
->initialized
= LABEL_INITIALIZED
;
902 if (defcontext_sid
) {
903 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
&&
904 sbsec
->behavior
!= SECURITY_FS_USE_NATIVE
) {
906 printk(KERN_WARNING
"SELinux: defcontext option is "
907 "invalid for this filesystem type\n");
911 if (defcontext_sid
!= sbsec
->def_sid
) {
912 rc
= may_context_mount_inode_relabel(defcontext_sid
,
918 sbsec
->def_sid
= defcontext_sid
;
922 rc
= sb_finish_set_opts(sb
);
924 mutex_unlock(&sbsec
->lock
);
928 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, different "
929 "security settings for (dev %s, type %s)\n", sb
->s_id
, name
);
933 static int selinux_cmp_sb_context(const struct super_block
*oldsb
,
934 const struct super_block
*newsb
)
936 struct superblock_security_struct
*old
= oldsb
->s_security
;
937 struct superblock_security_struct
*new = newsb
->s_security
;
938 char oldflags
= old
->flags
& SE_MNTMASK
;
939 char newflags
= new->flags
& SE_MNTMASK
;
941 if (oldflags
!= newflags
)
943 if ((oldflags
& FSCONTEXT_MNT
) && old
->sid
!= new->sid
)
945 if ((oldflags
& CONTEXT_MNT
) && old
->mntpoint_sid
!= new->mntpoint_sid
)
947 if ((oldflags
& DEFCONTEXT_MNT
) && old
->def_sid
!= new->def_sid
)
949 if (oldflags
& ROOTCONTEXT_MNT
) {
950 struct inode_security_struct
*oldroot
= backing_inode_security(oldsb
->s_root
);
951 struct inode_security_struct
*newroot
= backing_inode_security(newsb
->s_root
);
952 if (oldroot
->sid
!= newroot
->sid
)
957 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, "
958 "different security settings for (dev %s, "
959 "type %s)\n", newsb
->s_id
, newsb
->s_type
->name
);
963 static int selinux_sb_clone_mnt_opts(const struct super_block
*oldsb
,
964 struct super_block
*newsb
)
966 const struct superblock_security_struct
*oldsbsec
= oldsb
->s_security
;
967 struct superblock_security_struct
*newsbsec
= newsb
->s_security
;
969 int set_fscontext
= (oldsbsec
->flags
& FSCONTEXT_MNT
);
970 int set_context
= (oldsbsec
->flags
& CONTEXT_MNT
);
971 int set_rootcontext
= (oldsbsec
->flags
& ROOTCONTEXT_MNT
);
974 * if the parent was able to be mounted it clearly had no special lsm
975 * mount options. thus we can safely deal with this superblock later
980 /* how can we clone if the old one wasn't set up?? */
981 BUG_ON(!(oldsbsec
->flags
& SE_SBINITIALIZED
));
983 /* if fs is reusing a sb, make sure that the contexts match */
984 if (newsbsec
->flags
& SE_SBINITIALIZED
)
985 return selinux_cmp_sb_context(oldsb
, newsb
);
987 mutex_lock(&newsbsec
->lock
);
989 newsbsec
->flags
= oldsbsec
->flags
;
991 newsbsec
->sid
= oldsbsec
->sid
;
992 newsbsec
->def_sid
= oldsbsec
->def_sid
;
993 newsbsec
->behavior
= oldsbsec
->behavior
;
996 u32 sid
= oldsbsec
->mntpoint_sid
;
1000 if (!set_rootcontext
) {
1001 struct inode_security_struct
*newisec
= backing_inode_security(newsb
->s_root
);
1004 newsbsec
->mntpoint_sid
= sid
;
1006 if (set_rootcontext
) {
1007 const struct inode_security_struct
*oldisec
= backing_inode_security(oldsb
->s_root
);
1008 struct inode_security_struct
*newisec
= backing_inode_security(newsb
->s_root
);
1010 newisec
->sid
= oldisec
->sid
;
1013 sb_finish_set_opts(newsb
);
1014 mutex_unlock(&newsbsec
->lock
);
1018 static int selinux_parse_opts_str(char *options
,
1019 struct security_mnt_opts
*opts
)
1022 char *context
= NULL
, *defcontext
= NULL
;
1023 char *fscontext
= NULL
, *rootcontext
= NULL
;
1024 int rc
, num_mnt_opts
= 0;
1026 opts
->num_mnt_opts
= 0;
1028 /* Standard string-based options. */
1029 while ((p
= strsep(&options
, "|")) != NULL
) {
1031 substring_t args
[MAX_OPT_ARGS
];
1036 token
= match_token(p
, tokens
, args
);
1040 if (context
|| defcontext
) {
1042 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1045 context
= match_strdup(&args
[0]);
1055 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1058 fscontext
= match_strdup(&args
[0]);
1065 case Opt_rootcontext
:
1068 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1071 rootcontext
= match_strdup(&args
[0]);
1078 case Opt_defcontext
:
1079 if (context
|| defcontext
) {
1081 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1084 defcontext
= match_strdup(&args
[0]);
1090 case Opt_labelsupport
:
1094 printk(KERN_WARNING
"SELinux: unknown mount option\n");
1101 opts
->mnt_opts
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(char *), GFP_KERNEL
);
1102 if (!opts
->mnt_opts
)
1105 opts
->mnt_opts_flags
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(int),
1107 if (!opts
->mnt_opts_flags
) {
1108 kfree(opts
->mnt_opts
);
1113 opts
->mnt_opts
[num_mnt_opts
] = fscontext
;
1114 opts
->mnt_opts_flags
[num_mnt_opts
++] = FSCONTEXT_MNT
;
1117 opts
->mnt_opts
[num_mnt_opts
] = context
;
1118 opts
->mnt_opts_flags
[num_mnt_opts
++] = CONTEXT_MNT
;
1121 opts
->mnt_opts
[num_mnt_opts
] = rootcontext
;
1122 opts
->mnt_opts_flags
[num_mnt_opts
++] = ROOTCONTEXT_MNT
;
1125 opts
->mnt_opts
[num_mnt_opts
] = defcontext
;
1126 opts
->mnt_opts_flags
[num_mnt_opts
++] = DEFCONTEXT_MNT
;
1129 opts
->num_mnt_opts
= num_mnt_opts
;
1140 * string mount options parsing and call set the sbsec
1142 static int superblock_doinit(struct super_block
*sb
, void *data
)
1145 char *options
= data
;
1146 struct security_mnt_opts opts
;
1148 security_init_mnt_opts(&opts
);
1153 BUG_ON(sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
);
1155 rc
= selinux_parse_opts_str(options
, &opts
);
1160 rc
= selinux_set_mnt_opts(sb
, &opts
, 0, NULL
);
1163 security_free_mnt_opts(&opts
);
1167 static void selinux_write_opts(struct seq_file
*m
,
1168 struct security_mnt_opts
*opts
)
1173 for (i
= 0; i
< opts
->num_mnt_opts
; i
++) {
1176 if (opts
->mnt_opts
[i
])
1177 has_comma
= strchr(opts
->mnt_opts
[i
], ',');
1181 switch (opts
->mnt_opts_flags
[i
]) {
1183 prefix
= CONTEXT_STR
;
1186 prefix
= FSCONTEXT_STR
;
1188 case ROOTCONTEXT_MNT
:
1189 prefix
= ROOTCONTEXT_STR
;
1191 case DEFCONTEXT_MNT
:
1192 prefix
= DEFCONTEXT_STR
;
1196 seq_puts(m
, LABELSUPP_STR
);
1202 /* we need a comma before each option */
1204 seq_puts(m
, prefix
);
1207 seq_escape(m
, opts
->mnt_opts
[i
], "\"\n\\");
1213 static int selinux_sb_show_options(struct seq_file
*m
, struct super_block
*sb
)
1215 struct security_mnt_opts opts
;
1218 rc
= selinux_get_mnt_opts(sb
, &opts
);
1220 /* before policy load we may get EINVAL, don't show anything */
1226 selinux_write_opts(m
, &opts
);
1228 security_free_mnt_opts(&opts
);
1233 static inline u16
inode_mode_to_security_class(umode_t mode
)
1235 switch (mode
& S_IFMT
) {
1237 return SECCLASS_SOCK_FILE
;
1239 return SECCLASS_LNK_FILE
;
1241 return SECCLASS_FILE
;
1243 return SECCLASS_BLK_FILE
;
1245 return SECCLASS_DIR
;
1247 return SECCLASS_CHR_FILE
;
1249 return SECCLASS_FIFO_FILE
;
1253 return SECCLASS_FILE
;
1256 static inline int default_protocol_stream(int protocol
)
1258 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
1261 static inline int default_protocol_dgram(int protocol
)
1263 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
1266 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
1268 int extsockclass
= selinux_policycap_extsockclass
;
1274 case SOCK_SEQPACKET
:
1275 return SECCLASS_UNIX_STREAM_SOCKET
;
1277 return SECCLASS_UNIX_DGRAM_SOCKET
;
1284 case SOCK_SEQPACKET
:
1285 if (default_protocol_stream(protocol
))
1286 return SECCLASS_TCP_SOCKET
;
1287 else if (extsockclass
&& protocol
== IPPROTO_SCTP
)
1288 return SECCLASS_SCTP_SOCKET
;
1290 return SECCLASS_RAWIP_SOCKET
;
1292 if (default_protocol_dgram(protocol
))
1293 return SECCLASS_UDP_SOCKET
;
1294 else if (extsockclass
&& (protocol
== IPPROTO_ICMP
||
1295 protocol
== IPPROTO_ICMPV6
))
1296 return SECCLASS_ICMP_SOCKET
;
1298 return SECCLASS_RAWIP_SOCKET
;
1300 return SECCLASS_DCCP_SOCKET
;
1302 return SECCLASS_RAWIP_SOCKET
;
1308 return SECCLASS_NETLINK_ROUTE_SOCKET
;
1309 case NETLINK_SOCK_DIAG
:
1310 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
1312 return SECCLASS_NETLINK_NFLOG_SOCKET
;
1314 return SECCLASS_NETLINK_XFRM_SOCKET
;
1315 case NETLINK_SELINUX
:
1316 return SECCLASS_NETLINK_SELINUX_SOCKET
;
1318 return SECCLASS_NETLINK_ISCSI_SOCKET
;
1320 return SECCLASS_NETLINK_AUDIT_SOCKET
;
1321 case NETLINK_FIB_LOOKUP
:
1322 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET
;
1323 case NETLINK_CONNECTOR
:
1324 return SECCLASS_NETLINK_CONNECTOR_SOCKET
;
1325 case NETLINK_NETFILTER
:
1326 return SECCLASS_NETLINK_NETFILTER_SOCKET
;
1327 case NETLINK_DNRTMSG
:
1328 return SECCLASS_NETLINK_DNRT_SOCKET
;
1329 case NETLINK_KOBJECT_UEVENT
:
1330 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
1331 case NETLINK_GENERIC
:
1332 return SECCLASS_NETLINK_GENERIC_SOCKET
;
1333 case NETLINK_SCSITRANSPORT
:
1334 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET
;
1336 return SECCLASS_NETLINK_RDMA_SOCKET
;
1337 case NETLINK_CRYPTO
:
1338 return SECCLASS_NETLINK_CRYPTO_SOCKET
;
1340 return SECCLASS_NETLINK_SOCKET
;
1343 return SECCLASS_PACKET_SOCKET
;
1345 return SECCLASS_KEY_SOCKET
;
1347 return SECCLASS_APPLETALK_SOCKET
;
1353 return SECCLASS_AX25_SOCKET
;
1355 return SECCLASS_IPX_SOCKET
;
1357 return SECCLASS_NETROM_SOCKET
;
1359 return SECCLASS_ATMPVC_SOCKET
;
1361 return SECCLASS_X25_SOCKET
;
1363 return SECCLASS_ROSE_SOCKET
;
1365 return SECCLASS_DECNET_SOCKET
;
1367 return SECCLASS_ATMSVC_SOCKET
;
1369 return SECCLASS_RDS_SOCKET
;
1371 return SECCLASS_IRDA_SOCKET
;
1373 return SECCLASS_PPPOX_SOCKET
;
1375 return SECCLASS_LLC_SOCKET
;
1377 return SECCLASS_CAN_SOCKET
;
1379 return SECCLASS_TIPC_SOCKET
;
1381 return SECCLASS_BLUETOOTH_SOCKET
;
1383 return SECCLASS_IUCV_SOCKET
;
1385 return SECCLASS_RXRPC_SOCKET
;
1387 return SECCLASS_ISDN_SOCKET
;
1389 return SECCLASS_PHONET_SOCKET
;
1391 return SECCLASS_IEEE802154_SOCKET
;
1393 return SECCLASS_CAIF_SOCKET
;
1395 return SECCLASS_ALG_SOCKET
;
1397 return SECCLASS_NFC_SOCKET
;
1399 return SECCLASS_VSOCK_SOCKET
;
1401 return SECCLASS_KCM_SOCKET
;
1403 return SECCLASS_QIPCRTR_SOCKET
;
1405 return SECCLASS_SMC_SOCKET
;
1407 #error New address family defined, please update this function.
1412 return SECCLASS_SOCKET
;
1415 static int selinux_genfs_get_sid(struct dentry
*dentry
,
1421 struct super_block
*sb
= dentry
->d_sb
;
1422 char *buffer
, *path
;
1424 buffer
= (char *)__get_free_page(GFP_KERNEL
);
1428 path
= dentry_path_raw(dentry
, buffer
, PAGE_SIZE
);
1432 if (flags
& SE_SBPROC
) {
1433 /* each process gets a /proc/PID/ entry. Strip off the
1434 * PID part to get a valid selinux labeling.
1435 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1436 while (path
[1] >= '0' && path
[1] <= '9') {
1441 rc
= security_genfs_sid(sb
->s_type
->name
, path
, tclass
, sid
);
1443 free_page((unsigned long)buffer
);
1447 /* The inode's security attributes must be initialized before first use. */
1448 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
1450 struct superblock_security_struct
*sbsec
= NULL
;
1451 struct inode_security_struct
*isec
= inode
->i_security
;
1452 u32 task_sid
, sid
= 0;
1454 struct dentry
*dentry
;
1455 #define INITCONTEXTLEN 255
1456 char *context
= NULL
;
1460 if (isec
->initialized
== LABEL_INITIALIZED
)
1463 spin_lock(&isec
->lock
);
1464 if (isec
->initialized
== LABEL_INITIALIZED
)
1467 if (isec
->sclass
== SECCLASS_FILE
)
1468 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1470 sbsec
= inode
->i_sb
->s_security
;
1471 if (!(sbsec
->flags
& SE_SBINITIALIZED
)) {
1472 /* Defer initialization until selinux_complete_init,
1473 after the initial policy is loaded and the security
1474 server is ready to handle calls. */
1475 spin_lock(&sbsec
->isec_lock
);
1476 if (list_empty(&isec
->list
))
1477 list_add(&isec
->list
, &sbsec
->isec_head
);
1478 spin_unlock(&sbsec
->isec_lock
);
1482 sclass
= isec
->sclass
;
1483 task_sid
= isec
->task_sid
;
1485 isec
->initialized
= LABEL_PENDING
;
1486 spin_unlock(&isec
->lock
);
1488 switch (sbsec
->behavior
) {
1489 case SECURITY_FS_USE_NATIVE
:
1491 case SECURITY_FS_USE_XATTR
:
1492 if (!(inode
->i_opflags
& IOP_XATTR
)) {
1493 sid
= sbsec
->def_sid
;
1496 /* Need a dentry, since the xattr API requires one.
1497 Life would be simpler if we could just pass the inode. */
1499 /* Called from d_instantiate or d_splice_alias. */
1500 dentry
= dget(opt_dentry
);
1502 /* Called from selinux_complete_init, try to find a dentry. */
1503 dentry
= d_find_alias(inode
);
1507 * this is can be hit on boot when a file is accessed
1508 * before the policy is loaded. When we load policy we
1509 * may find inodes that have no dentry on the
1510 * sbsec->isec_head list. No reason to complain as these
1511 * will get fixed up the next time we go through
1512 * inode_doinit with a dentry, before these inodes could
1513 * be used again by userspace.
1518 len
= INITCONTEXTLEN
;
1519 context
= kmalloc(len
+1, GFP_NOFS
);
1525 context
[len
] = '\0';
1526 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, context
, len
);
1527 if (rc
== -ERANGE
) {
1530 /* Need a larger buffer. Query for the right size. */
1531 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, NULL
, 0);
1537 context
= kmalloc(len
+1, GFP_NOFS
);
1543 context
[len
] = '\0';
1544 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, context
, len
);
1548 if (rc
!= -ENODATA
) {
1549 printk(KERN_WARNING
"SELinux: %s: getxattr returned "
1550 "%d for dev=%s ino=%ld\n", __func__
,
1551 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1555 /* Map ENODATA to the default file SID */
1556 sid
= sbsec
->def_sid
;
1559 rc
= security_context_to_sid_default(context
, rc
, &sid
,
1563 char *dev
= inode
->i_sb
->s_id
;
1564 unsigned long ino
= inode
->i_ino
;
1566 if (rc
== -EINVAL
) {
1567 if (printk_ratelimit())
1568 printk(KERN_NOTICE
"SELinux: inode=%lu on dev=%s was found to have an invalid "
1569 "context=%s. This indicates you may need to relabel the inode or the "
1570 "filesystem in question.\n", ino
, dev
, context
);
1572 printk(KERN_WARNING
"SELinux: %s: context_to_sid(%s) "
1573 "returned %d for dev=%s ino=%ld\n",
1574 __func__
, context
, -rc
, dev
, ino
);
1577 /* Leave with the unlabeled SID */
1584 case SECURITY_FS_USE_TASK
:
1587 case SECURITY_FS_USE_TRANS
:
1588 /* Default to the fs SID. */
1591 /* Try to obtain a transition SID. */
1592 rc
= security_transition_sid(task_sid
, sid
, sclass
, NULL
, &sid
);
1596 case SECURITY_FS_USE_MNTPOINT
:
1597 sid
= sbsec
->mntpoint_sid
;
1600 /* Default to the fs superblock SID. */
1603 if ((sbsec
->flags
& SE_SBGENFS
) && !S_ISLNK(inode
->i_mode
)) {
1604 /* We must have a dentry to determine the label on
1607 /* Called from d_instantiate or
1608 * d_splice_alias. */
1609 dentry
= dget(opt_dentry
);
1611 /* Called from selinux_complete_init, try to
1613 dentry
= d_find_alias(inode
);
1615 * This can be hit on boot when a file is accessed
1616 * before the policy is loaded. When we load policy we
1617 * may find inodes that have no dentry on the
1618 * sbsec->isec_head list. No reason to complain as
1619 * these will get fixed up the next time we go through
1620 * inode_doinit() with a dentry, before these inodes
1621 * could be used again by userspace.
1625 rc
= selinux_genfs_get_sid(dentry
, sclass
,
1626 sbsec
->flags
, &sid
);
1635 spin_lock(&isec
->lock
);
1636 if (isec
->initialized
== LABEL_PENDING
) {
1638 isec
->initialized
= LABEL_INVALID
;
1642 isec
->initialized
= LABEL_INITIALIZED
;
1647 spin_unlock(&isec
->lock
);
1651 /* Convert a Linux signal to an access vector. */
1652 static inline u32
signal_to_av(int sig
)
1658 /* Commonly granted from child to parent. */
1659 perm
= PROCESS__SIGCHLD
;
1662 /* Cannot be caught or ignored */
1663 perm
= PROCESS__SIGKILL
;
1666 /* Cannot be caught or ignored */
1667 perm
= PROCESS__SIGSTOP
;
1670 /* All other signals. */
1671 perm
= PROCESS__SIGNAL
;
1678 #if CAP_LAST_CAP > 63
1679 #error Fix SELinux to handle capabilities > 63.
1682 /* Check whether a task is allowed to use a capability. */
1683 static int cred_has_capability(const struct cred
*cred
,
1684 int cap
, int audit
, bool initns
)
1686 struct common_audit_data ad
;
1687 struct av_decision avd
;
1689 u32 sid
= cred_sid(cred
);
1690 u32 av
= CAP_TO_MASK(cap
);
1693 ad
.type
= LSM_AUDIT_DATA_CAP
;
1696 switch (CAP_TO_INDEX(cap
)) {
1698 sclass
= initns
? SECCLASS_CAPABILITY
: SECCLASS_CAP_USERNS
;
1701 sclass
= initns
? SECCLASS_CAPABILITY2
: SECCLASS_CAP2_USERNS
;
1705 "SELinux: out of range capability %d\n", cap
);
1710 rc
= avc_has_perm_noaudit(sid
, sid
, sclass
, av
, 0, &avd
);
1711 if (audit
== SECURITY_CAP_AUDIT
) {
1712 int rc2
= avc_audit(sid
, sid
, sclass
, av
, &avd
, rc
, &ad
, 0);
1719 /* Check whether a task has a particular permission to an inode.
1720 The 'adp' parameter is optional and allows other audit
1721 data to be passed (e.g. the dentry). */
1722 static int inode_has_perm(const struct cred
*cred
,
1723 struct inode
*inode
,
1725 struct common_audit_data
*adp
)
1727 struct inode_security_struct
*isec
;
1730 validate_creds(cred
);
1732 if (unlikely(IS_PRIVATE(inode
)))
1735 sid
= cred_sid(cred
);
1736 isec
= inode
->i_security
;
1738 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742 the dentry to help the auditing code to more easily generate the
1743 pathname if needed. */
1744 static inline int dentry_has_perm(const struct cred
*cred
,
1745 struct dentry
*dentry
,
1748 struct inode
*inode
= d_backing_inode(dentry
);
1749 struct common_audit_data ad
;
1751 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1752 ad
.u
.dentry
= dentry
;
1753 __inode_security_revalidate(inode
, dentry
, true);
1754 return inode_has_perm(cred
, inode
, av
, &ad
);
1757 /* Same as inode_has_perm, but pass explicit audit data containing
1758 the path to help the auditing code to more easily generate the
1759 pathname if needed. */
1760 static inline int path_has_perm(const struct cred
*cred
,
1761 const struct path
*path
,
1764 struct inode
*inode
= d_backing_inode(path
->dentry
);
1765 struct common_audit_data ad
;
1767 ad
.type
= LSM_AUDIT_DATA_PATH
;
1769 __inode_security_revalidate(inode
, path
->dentry
, true);
1770 return inode_has_perm(cred
, inode
, av
, &ad
);
1773 /* Same as path_has_perm, but uses the inode from the file struct. */
1774 static inline int file_path_has_perm(const struct cred
*cred
,
1778 struct common_audit_data ad
;
1780 ad
.type
= LSM_AUDIT_DATA_FILE
;
1782 return inode_has_perm(cred
, file_inode(file
), av
, &ad
);
1785 /* Check whether a task can use an open file descriptor to
1786 access an inode in a given way. Check access to the
1787 descriptor itself, and then use dentry_has_perm to
1788 check a particular permission to the file.
1789 Access to the descriptor is implicitly granted if it
1790 has the same SID as the process. If av is zero, then
1791 access to the file is not checked, e.g. for cases
1792 where only the descriptor is affected like seek. */
1793 static int file_has_perm(const struct cred
*cred
,
1797 struct file_security_struct
*fsec
= file
->f_security
;
1798 struct inode
*inode
= file_inode(file
);
1799 struct common_audit_data ad
;
1800 u32 sid
= cred_sid(cred
);
1803 ad
.type
= LSM_AUDIT_DATA_FILE
;
1806 if (sid
!= fsec
->sid
) {
1807 rc
= avc_has_perm(sid
, fsec
->sid
,
1815 /* av is zero if only checking access to the descriptor. */
1818 rc
= inode_has_perm(cred
, inode
, av
, &ad
);
1825 * Determine the label for an inode that might be unioned.
1828 selinux_determine_inode_label(const struct task_security_struct
*tsec
,
1830 const struct qstr
*name
, u16 tclass
,
1833 const struct superblock_security_struct
*sbsec
= dir
->i_sb
->s_security
;
1835 if ((sbsec
->flags
& SE_SBINITIALIZED
) &&
1836 (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)) {
1837 *_new_isid
= sbsec
->mntpoint_sid
;
1838 } else if ((sbsec
->flags
& SBLABEL_MNT
) &&
1840 *_new_isid
= tsec
->create_sid
;
1842 const struct inode_security_struct
*dsec
= inode_security(dir
);
1843 return security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1850 /* Check whether a task can create a file. */
1851 static int may_create(struct inode
*dir
,
1852 struct dentry
*dentry
,
1855 const struct task_security_struct
*tsec
= current_security();
1856 struct inode_security_struct
*dsec
;
1857 struct superblock_security_struct
*sbsec
;
1859 struct common_audit_data ad
;
1862 dsec
= inode_security(dir
);
1863 sbsec
= dir
->i_sb
->s_security
;
1867 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1868 ad
.u
.dentry
= dentry
;
1870 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
,
1871 DIR__ADD_NAME
| DIR__SEARCH
,
1876 rc
= selinux_determine_inode_label(current_security(), dir
,
1877 &dentry
->d_name
, tclass
, &newsid
);
1881 rc
= avc_has_perm(sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1885 return avc_has_perm(newsid
, sbsec
->sid
,
1886 SECCLASS_FILESYSTEM
,
1887 FILESYSTEM__ASSOCIATE
, &ad
);
1891 #define MAY_UNLINK 1
1894 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1895 static int may_link(struct inode
*dir
,
1896 struct dentry
*dentry
,
1900 struct inode_security_struct
*dsec
, *isec
;
1901 struct common_audit_data ad
;
1902 u32 sid
= current_sid();
1906 dsec
= inode_security(dir
);
1907 isec
= backing_inode_security(dentry
);
1909 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1910 ad
.u
.dentry
= dentry
;
1913 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1914 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1929 printk(KERN_WARNING
"SELinux: %s: unrecognized kind %d\n",
1934 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1938 static inline int may_rename(struct inode
*old_dir
,
1939 struct dentry
*old_dentry
,
1940 struct inode
*new_dir
,
1941 struct dentry
*new_dentry
)
1943 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1944 struct common_audit_data ad
;
1945 u32 sid
= current_sid();
1947 int old_is_dir
, new_is_dir
;
1950 old_dsec
= inode_security(old_dir
);
1951 old_isec
= backing_inode_security(old_dentry
);
1952 old_is_dir
= d_is_dir(old_dentry
);
1953 new_dsec
= inode_security(new_dir
);
1955 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1957 ad
.u
.dentry
= old_dentry
;
1958 rc
= avc_has_perm(sid
, old_dsec
->sid
, SECCLASS_DIR
,
1959 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1962 rc
= avc_has_perm(sid
, old_isec
->sid
,
1963 old_isec
->sclass
, FILE__RENAME
, &ad
);
1966 if (old_is_dir
&& new_dir
!= old_dir
) {
1967 rc
= avc_has_perm(sid
, old_isec
->sid
,
1968 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1973 ad
.u
.dentry
= new_dentry
;
1974 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1975 if (d_is_positive(new_dentry
))
1976 av
|= DIR__REMOVE_NAME
;
1977 rc
= avc_has_perm(sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1980 if (d_is_positive(new_dentry
)) {
1981 new_isec
= backing_inode_security(new_dentry
);
1982 new_is_dir
= d_is_dir(new_dentry
);
1983 rc
= avc_has_perm(sid
, new_isec
->sid
,
1985 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1993 /* Check whether a task can perform a filesystem operation. */
1994 static int superblock_has_perm(const struct cred
*cred
,
1995 struct super_block
*sb
,
1997 struct common_audit_data
*ad
)
1999 struct superblock_security_struct
*sbsec
;
2000 u32 sid
= cred_sid(cred
);
2002 sbsec
= sb
->s_security
;
2003 return avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
, perms
, ad
);
2006 /* Convert a Linux mode and permission mask to an access vector. */
2007 static inline u32
file_mask_to_av(int mode
, int mask
)
2011 if (!S_ISDIR(mode
)) {
2012 if (mask
& MAY_EXEC
)
2013 av
|= FILE__EXECUTE
;
2014 if (mask
& MAY_READ
)
2017 if (mask
& MAY_APPEND
)
2019 else if (mask
& MAY_WRITE
)
2023 if (mask
& MAY_EXEC
)
2025 if (mask
& MAY_WRITE
)
2027 if (mask
& MAY_READ
)
2034 /* Convert a Linux file to an access vector. */
2035 static inline u32
file_to_av(struct file
*file
)
2039 if (file
->f_mode
& FMODE_READ
)
2041 if (file
->f_mode
& FMODE_WRITE
) {
2042 if (file
->f_flags
& O_APPEND
)
2049 * Special file opened with flags 3 for ioctl-only use.
2058 * Convert a file to an access vector and include the correct open
2061 static inline u32
open_file_to_av(struct file
*file
)
2063 u32 av
= file_to_av(file
);
2065 if (selinux_policycap_openperm
)
2071 /* Hook functions begin here. */
2073 static int selinux_binder_set_context_mgr(struct task_struct
*mgr
)
2075 u32 mysid
= current_sid();
2076 u32 mgrsid
= task_sid(mgr
);
2078 return avc_has_perm(mysid
, mgrsid
, SECCLASS_BINDER
,
2079 BINDER__SET_CONTEXT_MGR
, NULL
);
2082 static int selinux_binder_transaction(struct task_struct
*from
,
2083 struct task_struct
*to
)
2085 u32 mysid
= current_sid();
2086 u32 fromsid
= task_sid(from
);
2087 u32 tosid
= task_sid(to
);
2090 if (mysid
!= fromsid
) {
2091 rc
= avc_has_perm(mysid
, fromsid
, SECCLASS_BINDER
,
2092 BINDER__IMPERSONATE
, NULL
);
2097 return avc_has_perm(fromsid
, tosid
, SECCLASS_BINDER
, BINDER__CALL
,
2101 static int selinux_binder_transfer_binder(struct task_struct
*from
,
2102 struct task_struct
*to
)
2104 u32 fromsid
= task_sid(from
);
2105 u32 tosid
= task_sid(to
);
2107 return avc_has_perm(fromsid
, tosid
, SECCLASS_BINDER
, BINDER__TRANSFER
,
2111 static int selinux_binder_transfer_file(struct task_struct
*from
,
2112 struct task_struct
*to
,
2115 u32 sid
= task_sid(to
);
2116 struct file_security_struct
*fsec
= file
->f_security
;
2117 struct dentry
*dentry
= file
->f_path
.dentry
;
2118 struct inode_security_struct
*isec
;
2119 struct common_audit_data ad
;
2122 ad
.type
= LSM_AUDIT_DATA_PATH
;
2123 ad
.u
.path
= file
->f_path
;
2125 if (sid
!= fsec
->sid
) {
2126 rc
= avc_has_perm(sid
, fsec
->sid
,
2134 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2137 isec
= backing_inode_security(dentry
);
2138 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, file_to_av(file
),
2142 static int selinux_ptrace_access_check(struct task_struct
*child
,
2145 u32 sid
= current_sid();
2146 u32 csid
= task_sid(child
);
2148 if (mode
& PTRACE_MODE_READ
)
2149 return avc_has_perm(sid
, csid
, SECCLASS_FILE
, FILE__READ
, NULL
);
2151 return avc_has_perm(sid
, csid
, SECCLASS_PROCESS
, PROCESS__PTRACE
, NULL
);
2154 static int selinux_ptrace_traceme(struct task_struct
*parent
)
2156 return avc_has_perm(task_sid(parent
), current_sid(), SECCLASS_PROCESS
,
2157 PROCESS__PTRACE
, NULL
);
2160 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
2161 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
2163 return avc_has_perm(current_sid(), task_sid(target
), SECCLASS_PROCESS
,
2164 PROCESS__GETCAP
, NULL
);
2167 static int selinux_capset(struct cred
*new, const struct cred
*old
,
2168 const kernel_cap_t
*effective
,
2169 const kernel_cap_t
*inheritable
,
2170 const kernel_cap_t
*permitted
)
2172 return avc_has_perm(cred_sid(old
), cred_sid(new), SECCLASS_PROCESS
,
2173 PROCESS__SETCAP
, NULL
);
2177 * (This comment used to live with the selinux_task_setuid hook,
2178 * which was removed).
2180 * Since setuid only affects the current process, and since the SELinux
2181 * controls are not based on the Linux identity attributes, SELinux does not
2182 * need to control this operation. However, SELinux does control the use of
2183 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2186 static int selinux_capable(const struct cred
*cred
, struct user_namespace
*ns
,
2189 return cred_has_capability(cred
, cap
, audit
, ns
== &init_user_ns
);
2192 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
2194 const struct cred
*cred
= current_cred();
2206 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAMOD
, NULL
);
2211 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAGET
, NULL
);
2214 rc
= 0; /* let the kernel handle invalid cmds */
2220 static int selinux_quota_on(struct dentry
*dentry
)
2222 const struct cred
*cred
= current_cred();
2224 return dentry_has_perm(cred
, dentry
, FILE__QUOTAON
);
2227 static int selinux_syslog(int type
)
2230 case SYSLOG_ACTION_READ_ALL
: /* Read last kernel messages */
2231 case SYSLOG_ACTION_SIZE_BUFFER
: /* Return size of the log buffer */
2232 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2233 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_READ
, NULL
);
2234 case SYSLOG_ACTION_CONSOLE_OFF
: /* Disable logging to console */
2235 case SYSLOG_ACTION_CONSOLE_ON
: /* Enable logging to console */
2236 /* Set level of messages printed to console */
2237 case SYSLOG_ACTION_CONSOLE_LEVEL
:
2238 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2239 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_CONSOLE
,
2242 /* All other syslog types */
2243 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2244 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_MOD
, NULL
);
2248 * Check that a process has enough memory to allocate a new virtual
2249 * mapping. 0 means there is enough memory for the allocation to
2250 * succeed and -ENOMEM implies there is not.
2252 * Do not audit the selinux permission check, as this is applied to all
2253 * processes that allocate mappings.
2255 static int selinux_vm_enough_memory(struct mm_struct
*mm
, long pages
)
2257 int rc
, cap_sys_admin
= 0;
2259 rc
= cred_has_capability(current_cred(), CAP_SYS_ADMIN
,
2260 SECURITY_CAP_NOAUDIT
, true);
2264 return cap_sys_admin
;
2267 /* binprm security operations */
2269 static u32
ptrace_parent_sid(void)
2272 struct task_struct
*tracer
;
2275 tracer
= ptrace_parent(current
);
2277 sid
= task_sid(tracer
);
2283 static int check_nnp_nosuid(const struct linux_binprm
*bprm
,
2284 const struct task_security_struct
*old_tsec
,
2285 const struct task_security_struct
*new_tsec
)
2287 int nnp
= (bprm
->unsafe
& LSM_UNSAFE_NO_NEW_PRIVS
);
2288 int nosuid
= !mnt_may_suid(bprm
->file
->f_path
.mnt
);
2291 if (!nnp
&& !nosuid
)
2292 return 0; /* neither NNP nor nosuid */
2294 if (new_tsec
->sid
== old_tsec
->sid
)
2295 return 0; /* No change in credentials */
2298 * The only transitions we permit under NNP or nosuid
2299 * are transitions to bounded SIDs, i.e. SIDs that are
2300 * guaranteed to only be allowed a subset of the permissions
2301 * of the current SID.
2303 rc
= security_bounded_transition(old_tsec
->sid
, new_tsec
->sid
);
2306 * On failure, preserve the errno values for NNP vs nosuid.
2307 * NNP: Operation not permitted for caller.
2308 * nosuid: Permission denied to file.
2318 static int selinux_bprm_set_creds(struct linux_binprm
*bprm
)
2320 const struct task_security_struct
*old_tsec
;
2321 struct task_security_struct
*new_tsec
;
2322 struct inode_security_struct
*isec
;
2323 struct common_audit_data ad
;
2324 struct inode
*inode
= file_inode(bprm
->file
);
2327 /* SELinux context only depends on initial program or script and not
2328 * the script interpreter */
2329 if (bprm
->cred_prepared
)
2332 old_tsec
= current_security();
2333 new_tsec
= bprm
->cred
->security
;
2334 isec
= inode_security(inode
);
2336 /* Default to the current task SID. */
2337 new_tsec
->sid
= old_tsec
->sid
;
2338 new_tsec
->osid
= old_tsec
->sid
;
2340 /* Reset fs, key, and sock SIDs on execve. */
2341 new_tsec
->create_sid
= 0;
2342 new_tsec
->keycreate_sid
= 0;
2343 new_tsec
->sockcreate_sid
= 0;
2345 if (old_tsec
->exec_sid
) {
2346 new_tsec
->sid
= old_tsec
->exec_sid
;
2347 /* Reset exec SID on execve. */
2348 new_tsec
->exec_sid
= 0;
2350 /* Fail on NNP or nosuid if not an allowed transition. */
2351 rc
= check_nnp_nosuid(bprm
, old_tsec
, new_tsec
);
2355 /* Check for a default transition on this program. */
2356 rc
= security_transition_sid(old_tsec
->sid
, isec
->sid
,
2357 SECCLASS_PROCESS
, NULL
,
2363 * Fallback to old SID on NNP or nosuid if not an allowed
2366 rc
= check_nnp_nosuid(bprm
, old_tsec
, new_tsec
);
2368 new_tsec
->sid
= old_tsec
->sid
;
2371 ad
.type
= LSM_AUDIT_DATA_FILE
;
2372 ad
.u
.file
= bprm
->file
;
2374 if (new_tsec
->sid
== old_tsec
->sid
) {
2375 rc
= avc_has_perm(old_tsec
->sid
, isec
->sid
,
2376 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
2380 /* Check permissions for the transition. */
2381 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2382 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
2386 rc
= avc_has_perm(new_tsec
->sid
, isec
->sid
,
2387 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
2391 /* Check for shared state */
2392 if (bprm
->unsafe
& LSM_UNSAFE_SHARE
) {
2393 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2394 SECCLASS_PROCESS
, PROCESS__SHARE
,
2400 /* Make sure that anyone attempting to ptrace over a task that
2401 * changes its SID has the appropriate permit */
2402 if (bprm
->unsafe
& LSM_UNSAFE_PTRACE
) {
2403 u32 ptsid
= ptrace_parent_sid();
2405 rc
= avc_has_perm(ptsid
, new_tsec
->sid
,
2407 PROCESS__PTRACE
, NULL
);
2413 /* Clear any possibly unsafe personality bits on exec: */
2414 bprm
->per_clear
|= PER_CLEAR_ON_SETID
;
2420 static int selinux_bprm_secureexec(struct linux_binprm
*bprm
)
2422 const struct task_security_struct
*tsec
= current_security();
2430 /* Enable secure mode for SIDs transitions unless
2431 the noatsecure permission is granted between
2432 the two SIDs, i.e. ahp returns 0. */
2433 atsecure
= avc_has_perm(osid
, sid
,
2435 PROCESS__NOATSECURE
, NULL
);
2441 static int match_file(const void *p
, struct file
*file
, unsigned fd
)
2443 return file_has_perm(p
, file
, file_to_av(file
)) ? fd
+ 1 : 0;
2446 /* Derived from fs/exec.c:flush_old_files. */
2447 static inline void flush_unauthorized_files(const struct cred
*cred
,
2448 struct files_struct
*files
)
2450 struct file
*file
, *devnull
= NULL
;
2451 struct tty_struct
*tty
;
2455 tty
= get_current_tty();
2457 spin_lock(&tty
->files_lock
);
2458 if (!list_empty(&tty
->tty_files
)) {
2459 struct tty_file_private
*file_priv
;
2461 /* Revalidate access to controlling tty.
2462 Use file_path_has_perm on the tty path directly
2463 rather than using file_has_perm, as this particular
2464 open file may belong to another process and we are
2465 only interested in the inode-based check here. */
2466 file_priv
= list_first_entry(&tty
->tty_files
,
2467 struct tty_file_private
, list
);
2468 file
= file_priv
->file
;
2469 if (file_path_has_perm(cred
, file
, FILE__READ
| FILE__WRITE
))
2472 spin_unlock(&tty
->files_lock
);
2475 /* Reset controlling tty. */
2479 /* Revalidate access to inherited open files. */
2480 n
= iterate_fd(files
, 0, match_file
, cred
);
2481 if (!n
) /* none found? */
2484 devnull
= dentry_open(&selinux_null
, O_RDWR
, cred
);
2485 if (IS_ERR(devnull
))
2487 /* replace all the matching ones with this */
2489 replace_fd(n
- 1, devnull
, 0);
2490 } while ((n
= iterate_fd(files
, n
, match_file
, cred
)) != 0);
2496 * Prepare a process for imminent new credential changes due to exec
2498 static void selinux_bprm_committing_creds(struct linux_binprm
*bprm
)
2500 struct task_security_struct
*new_tsec
;
2501 struct rlimit
*rlim
, *initrlim
;
2504 new_tsec
= bprm
->cred
->security
;
2505 if (new_tsec
->sid
== new_tsec
->osid
)
2508 /* Close files for which the new task SID is not authorized. */
2509 flush_unauthorized_files(bprm
->cred
, current
->files
);
2511 /* Always clear parent death signal on SID transitions. */
2512 current
->pdeath_signal
= 0;
2514 /* Check whether the new SID can inherit resource limits from the old
2515 * SID. If not, reset all soft limits to the lower of the current
2516 * task's hard limit and the init task's soft limit.
2518 * Note that the setting of hard limits (even to lower them) can be
2519 * controlled by the setrlimit check. The inclusion of the init task's
2520 * soft limit into the computation is to avoid resetting soft limits
2521 * higher than the default soft limit for cases where the default is
2522 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2524 rc
= avc_has_perm(new_tsec
->osid
, new_tsec
->sid
, SECCLASS_PROCESS
,
2525 PROCESS__RLIMITINH
, NULL
);
2527 /* protect against do_prlimit() */
2529 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
2530 rlim
= current
->signal
->rlim
+ i
;
2531 initrlim
= init_task
.signal
->rlim
+ i
;
2532 rlim
->rlim_cur
= min(rlim
->rlim_max
, initrlim
->rlim_cur
);
2534 task_unlock(current
);
2535 if (IS_ENABLED(CONFIG_POSIX_TIMERS
))
2536 update_rlimit_cpu(current
, rlimit(RLIMIT_CPU
));
2541 * Clean up the process immediately after the installation of new credentials
2544 static void selinux_bprm_committed_creds(struct linux_binprm
*bprm
)
2546 const struct task_security_struct
*tsec
= current_security();
2547 struct itimerval itimer
;
2557 /* Check whether the new SID can inherit signal state from the old SID.
2558 * If not, clear itimers to avoid subsequent signal generation and
2559 * flush and unblock signals.
2561 * This must occur _after_ the task SID has been updated so that any
2562 * kill done after the flush will be checked against the new SID.
2564 rc
= avc_has_perm(osid
, sid
, SECCLASS_PROCESS
, PROCESS__SIGINH
, NULL
);
2566 if (IS_ENABLED(CONFIG_POSIX_TIMERS
)) {
2567 memset(&itimer
, 0, sizeof itimer
);
2568 for (i
= 0; i
< 3; i
++)
2569 do_setitimer(i
, &itimer
, NULL
);
2571 spin_lock_irq(¤t
->sighand
->siglock
);
2572 if (!fatal_signal_pending(current
)) {
2573 flush_sigqueue(¤t
->pending
);
2574 flush_sigqueue(¤t
->signal
->shared_pending
);
2575 flush_signal_handlers(current
, 1);
2576 sigemptyset(¤t
->blocked
);
2577 recalc_sigpending();
2579 spin_unlock_irq(¤t
->sighand
->siglock
);
2582 /* Wake up the parent if it is waiting so that it can recheck
2583 * wait permission to the new task SID. */
2584 read_lock(&tasklist_lock
);
2585 __wake_up_parent(current
, current
->real_parent
);
2586 read_unlock(&tasklist_lock
);
2589 /* superblock security operations */
2591 static int selinux_sb_alloc_security(struct super_block
*sb
)
2593 return superblock_alloc_security(sb
);
2596 static void selinux_sb_free_security(struct super_block
*sb
)
2598 superblock_free_security(sb
);
2601 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
2606 return !memcmp(prefix
, option
, plen
);
2609 static inline int selinux_option(char *option
, int len
)
2611 return (match_prefix(CONTEXT_STR
, sizeof(CONTEXT_STR
)-1, option
, len
) ||
2612 match_prefix(FSCONTEXT_STR
, sizeof(FSCONTEXT_STR
)-1, option
, len
) ||
2613 match_prefix(DEFCONTEXT_STR
, sizeof(DEFCONTEXT_STR
)-1, option
, len
) ||
2614 match_prefix(ROOTCONTEXT_STR
, sizeof(ROOTCONTEXT_STR
)-1, option
, len
) ||
2615 match_prefix(LABELSUPP_STR
, sizeof(LABELSUPP_STR
)-1, option
, len
));
2618 static inline void take_option(char **to
, char *from
, int *first
, int len
)
2625 memcpy(*to
, from
, len
);
2629 static inline void take_selinux_option(char **to
, char *from
, int *first
,
2632 int current_size
= 0;
2640 while (current_size
< len
) {
2650 static int selinux_sb_copy_data(char *orig
, char *copy
)
2652 int fnosec
, fsec
, rc
= 0;
2653 char *in_save
, *in_curr
, *in_end
;
2654 char *sec_curr
, *nosec_save
, *nosec
;
2660 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
2668 in_save
= in_end
= orig
;
2672 open_quote
= !open_quote
;
2673 if ((*in_end
== ',' && open_quote
== 0) ||
2675 int len
= in_end
- in_curr
;
2677 if (selinux_option(in_curr
, len
))
2678 take_selinux_option(&sec_curr
, in_curr
, &fsec
, len
);
2680 take_option(&nosec
, in_curr
, &fnosec
, len
);
2682 in_curr
= in_end
+ 1;
2684 } while (*in_end
++);
2686 strcpy(in_save
, nosec_save
);
2687 free_page((unsigned long)nosec_save
);
2692 static int selinux_sb_remount(struct super_block
*sb
, void *data
)
2695 struct security_mnt_opts opts
;
2696 char *secdata
, **mount_options
;
2697 struct superblock_security_struct
*sbsec
= sb
->s_security
;
2699 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
2705 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
2708 security_init_mnt_opts(&opts
);
2709 secdata
= alloc_secdata();
2712 rc
= selinux_sb_copy_data(data
, secdata
);
2714 goto out_free_secdata
;
2716 rc
= selinux_parse_opts_str(secdata
, &opts
);
2718 goto out_free_secdata
;
2720 mount_options
= opts
.mnt_opts
;
2721 flags
= opts
.mnt_opts_flags
;
2723 for (i
= 0; i
< opts
.num_mnt_opts
; i
++) {
2726 if (flags
[i
] == SBLABEL_MNT
)
2728 rc
= security_context_str_to_sid(mount_options
[i
], &sid
, GFP_KERNEL
);
2730 printk(KERN_WARNING
"SELinux: security_context_str_to_sid"
2731 "(%s) failed for (dev %s, type %s) errno=%d\n",
2732 mount_options
[i
], sb
->s_id
, sb
->s_type
->name
, rc
);
2738 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
, sid
))
2739 goto out_bad_option
;
2742 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
, sid
))
2743 goto out_bad_option
;
2745 case ROOTCONTEXT_MNT
: {
2746 struct inode_security_struct
*root_isec
;
2747 root_isec
= backing_inode_security(sb
->s_root
);
2749 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
, sid
))
2750 goto out_bad_option
;
2753 case DEFCONTEXT_MNT
:
2754 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
, sid
))
2755 goto out_bad_option
;
2764 security_free_mnt_opts(&opts
);
2766 free_secdata(secdata
);
2769 printk(KERN_WARNING
"SELinux: unable to change security options "
2770 "during remount (dev %s, type=%s)\n", sb
->s_id
,
2775 static int selinux_sb_kern_mount(struct super_block
*sb
, int flags
, void *data
)
2777 const struct cred
*cred
= current_cred();
2778 struct common_audit_data ad
;
2781 rc
= superblock_doinit(sb
, data
);
2785 /* Allow all mounts performed by the kernel */
2786 if (flags
& MS_KERNMOUNT
)
2789 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2790 ad
.u
.dentry
= sb
->s_root
;
2791 return superblock_has_perm(cred
, sb
, FILESYSTEM__MOUNT
, &ad
);
2794 static int selinux_sb_statfs(struct dentry
*dentry
)
2796 const struct cred
*cred
= current_cred();
2797 struct common_audit_data ad
;
2799 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2800 ad
.u
.dentry
= dentry
->d_sb
->s_root
;
2801 return superblock_has_perm(cred
, dentry
->d_sb
, FILESYSTEM__GETATTR
, &ad
);
2804 static int selinux_mount(const char *dev_name
,
2805 const struct path
*path
,
2807 unsigned long flags
,
2810 const struct cred
*cred
= current_cred();
2812 if (flags
& MS_REMOUNT
)
2813 return superblock_has_perm(cred
, path
->dentry
->d_sb
,
2814 FILESYSTEM__REMOUNT
, NULL
);
2816 return path_has_perm(cred
, path
, FILE__MOUNTON
);
2819 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
2821 const struct cred
*cred
= current_cred();
2823 return superblock_has_perm(cred
, mnt
->mnt_sb
,
2824 FILESYSTEM__UNMOUNT
, NULL
);
2827 /* inode security operations */
2829 static int selinux_inode_alloc_security(struct inode
*inode
)
2831 return inode_alloc_security(inode
);
2834 static void selinux_inode_free_security(struct inode
*inode
)
2836 inode_free_security(inode
);
2839 static int selinux_dentry_init_security(struct dentry
*dentry
, int mode
,
2840 const struct qstr
*name
, void **ctx
,
2846 rc
= selinux_determine_inode_label(current_security(),
2847 d_inode(dentry
->d_parent
), name
,
2848 inode_mode_to_security_class(mode
),
2853 return security_sid_to_context(newsid
, (char **)ctx
, ctxlen
);
2856 static int selinux_dentry_create_files_as(struct dentry
*dentry
, int mode
,
2858 const struct cred
*old
,
2863 struct task_security_struct
*tsec
;
2865 rc
= selinux_determine_inode_label(old
->security
,
2866 d_inode(dentry
->d_parent
), name
,
2867 inode_mode_to_security_class(mode
),
2872 tsec
= new->security
;
2873 tsec
->create_sid
= newsid
;
2877 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
2878 const struct qstr
*qstr
,
2880 void **value
, size_t *len
)
2882 const struct task_security_struct
*tsec
= current_security();
2883 struct superblock_security_struct
*sbsec
;
2884 u32 sid
, newsid
, clen
;
2888 sbsec
= dir
->i_sb
->s_security
;
2891 newsid
= tsec
->create_sid
;
2893 rc
= selinux_determine_inode_label(current_security(),
2895 inode_mode_to_security_class(inode
->i_mode
),
2900 /* Possibly defer initialization to selinux_complete_init. */
2901 if (sbsec
->flags
& SE_SBINITIALIZED
) {
2902 struct inode_security_struct
*isec
= inode
->i_security
;
2903 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
2905 isec
->initialized
= LABEL_INITIALIZED
;
2908 if (!ss_initialized
|| !(sbsec
->flags
& SBLABEL_MNT
))
2912 *name
= XATTR_SELINUX_SUFFIX
;
2915 rc
= security_sid_to_context_force(newsid
, &context
, &clen
);
2925 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
)
2927 return may_create(dir
, dentry
, SECCLASS_FILE
);
2930 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2932 return may_link(dir
, old_dentry
, MAY_LINK
);
2935 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2937 return may_link(dir
, dentry
, MAY_UNLINK
);
2940 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2942 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2945 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, umode_t mask
)
2947 return may_create(dir
, dentry
, SECCLASS_DIR
);
2950 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2952 return may_link(dir
, dentry
, MAY_RMDIR
);
2955 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
, dev_t dev
)
2957 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2960 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2961 struct inode
*new_inode
, struct dentry
*new_dentry
)
2963 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2966 static int selinux_inode_readlink(struct dentry
*dentry
)
2968 const struct cred
*cred
= current_cred();
2970 return dentry_has_perm(cred
, dentry
, FILE__READ
);
2973 static int selinux_inode_follow_link(struct dentry
*dentry
, struct inode
*inode
,
2976 const struct cred
*cred
= current_cred();
2977 struct common_audit_data ad
;
2978 struct inode_security_struct
*isec
;
2981 validate_creds(cred
);
2983 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2984 ad
.u
.dentry
= dentry
;
2985 sid
= cred_sid(cred
);
2986 isec
= inode_security_rcu(inode
, rcu
);
2988 return PTR_ERR(isec
);
2990 return avc_has_perm_flags(sid
, isec
->sid
, isec
->sclass
, FILE__READ
, &ad
,
2991 rcu
? MAY_NOT_BLOCK
: 0);
2994 static noinline
int audit_inode_permission(struct inode
*inode
,
2995 u32 perms
, u32 audited
, u32 denied
,
2999 struct common_audit_data ad
;
3000 struct inode_security_struct
*isec
= inode
->i_security
;
3003 ad
.type
= LSM_AUDIT_DATA_INODE
;
3006 rc
= slow_avc_audit(current_sid(), isec
->sid
, isec
->sclass
, perms
,
3007 audited
, denied
, result
, &ad
, flags
);
3013 static int selinux_inode_permission(struct inode
*inode
, int mask
)
3015 const struct cred
*cred
= current_cred();
3018 unsigned flags
= mask
& MAY_NOT_BLOCK
;
3019 struct inode_security_struct
*isec
;
3021 struct av_decision avd
;
3023 u32 audited
, denied
;
3025 from_access
= mask
& MAY_ACCESS
;
3026 mask
&= (MAY_READ
|MAY_WRITE
|MAY_EXEC
|MAY_APPEND
);
3028 /* No permission to check. Existence test. */
3032 validate_creds(cred
);
3034 if (unlikely(IS_PRIVATE(inode
)))
3037 perms
= file_mask_to_av(inode
->i_mode
, mask
);
3039 sid
= cred_sid(cred
);
3040 isec
= inode_security_rcu(inode
, flags
& MAY_NOT_BLOCK
);
3042 return PTR_ERR(isec
);
3044 rc
= avc_has_perm_noaudit(sid
, isec
->sid
, isec
->sclass
, perms
, 0, &avd
);
3045 audited
= avc_audit_required(perms
, &avd
, rc
,
3046 from_access
? FILE__AUDIT_ACCESS
: 0,
3048 if (likely(!audited
))
3051 rc2
= audit_inode_permission(inode
, perms
, audited
, denied
, rc
, flags
);
3057 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
3059 const struct cred
*cred
= current_cred();
3060 unsigned int ia_valid
= iattr
->ia_valid
;
3061 __u32 av
= FILE__WRITE
;
3063 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3064 if (ia_valid
& ATTR_FORCE
) {
3065 ia_valid
&= ~(ATTR_KILL_SUID
| ATTR_KILL_SGID
| ATTR_MODE
|
3071 if (ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
3072 ATTR_ATIME_SET
| ATTR_MTIME_SET
| ATTR_TIMES_SET
))
3073 return dentry_has_perm(cred
, dentry
, FILE__SETATTR
);
3075 if (selinux_policycap_openperm
&& (ia_valid
& ATTR_SIZE
)
3076 && !(ia_valid
& ATTR_FILE
))
3079 return dentry_has_perm(cred
, dentry
, av
);
3082 static int selinux_inode_getattr(const struct path
*path
)
3084 return path_has_perm(current_cred(), path
, FILE__GETATTR
);
3087 static int selinux_inode_setotherxattr(struct dentry
*dentry
, const char *name
)
3089 const struct cred
*cred
= current_cred();
3091 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
3092 sizeof XATTR_SECURITY_PREFIX
- 1)) {
3093 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
3094 if (!capable(CAP_SETFCAP
))
3096 } else if (!capable(CAP_SYS_ADMIN
)) {
3097 /* A different attribute in the security namespace.
3098 Restrict to administrator. */
3103 /* Not an attribute we recognize, so just check the
3104 ordinary setattr permission. */
3105 return dentry_has_perm(cred
, dentry
, FILE__SETATTR
);
3108 static int selinux_inode_setxattr(struct dentry
*dentry
, const char *name
,
3109 const void *value
, size_t size
, int flags
)
3111 struct inode
*inode
= d_backing_inode(dentry
);
3112 struct inode_security_struct
*isec
;
3113 struct superblock_security_struct
*sbsec
;
3114 struct common_audit_data ad
;
3115 u32 newsid
, sid
= current_sid();
3118 if (strcmp(name
, XATTR_NAME_SELINUX
))
3119 return selinux_inode_setotherxattr(dentry
, name
);
3121 sbsec
= inode
->i_sb
->s_security
;
3122 if (!(sbsec
->flags
& SBLABEL_MNT
))
3125 if (!inode_owner_or_capable(inode
))
3128 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
3129 ad
.u
.dentry
= dentry
;
3131 isec
= backing_inode_security(dentry
);
3132 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
,
3133 FILE__RELABELFROM
, &ad
);
3137 rc
= security_context_to_sid(value
, size
, &newsid
, GFP_KERNEL
);
3138 if (rc
== -EINVAL
) {
3139 if (!capable(CAP_MAC_ADMIN
)) {
3140 struct audit_buffer
*ab
;
3144 /* We strip a nul only if it is at the end, otherwise the
3145 * context contains a nul and we should audit that */
3148 if (str
[size
- 1] == '\0')
3149 audit_size
= size
- 1;
3156 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
);
3157 audit_log_format(ab
, "op=setxattr invalid_context=");
3158 audit_log_n_untrustedstring(ab
, value
, audit_size
);
3163 rc
= security_context_to_sid_force(value
, size
, &newsid
);
3168 rc
= avc_has_perm(sid
, newsid
, isec
->sclass
,
3169 FILE__RELABELTO
, &ad
);
3173 rc
= security_validate_transition(isec
->sid
, newsid
, sid
,
3178 return avc_has_perm(newsid
,
3180 SECCLASS_FILESYSTEM
,
3181 FILESYSTEM__ASSOCIATE
,
3185 static void selinux_inode_post_setxattr(struct dentry
*dentry
, const char *name
,
3186 const void *value
, size_t size
,
3189 struct inode
*inode
= d_backing_inode(dentry
);
3190 struct inode_security_struct
*isec
;
3194 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
3195 /* Not an attribute we recognize, so nothing to do. */
3199 rc
= security_context_to_sid_force(value
, size
, &newsid
);
3201 printk(KERN_ERR
"SELinux: unable to map context to SID"
3202 "for (%s, %lu), rc=%d\n",
3203 inode
->i_sb
->s_id
, inode
->i_ino
, -rc
);
3207 isec
= backing_inode_security(dentry
);
3208 spin_lock(&isec
->lock
);
3209 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3211 isec
->initialized
= LABEL_INITIALIZED
;
3212 spin_unlock(&isec
->lock
);
3217 static int selinux_inode_getxattr(struct dentry
*dentry
, const char *name
)
3219 const struct cred
*cred
= current_cred();
3221 return dentry_has_perm(cred
, dentry
, FILE__GETATTR
);
3224 static int selinux_inode_listxattr(struct dentry
*dentry
)
3226 const struct cred
*cred
= current_cred();
3228 return dentry_has_perm(cred
, dentry
, FILE__GETATTR
);
3231 static int selinux_inode_removexattr(struct dentry
*dentry
, const char *name
)
3233 if (strcmp(name
, XATTR_NAME_SELINUX
))
3234 return selinux_inode_setotherxattr(dentry
, name
);
3236 /* No one is allowed to remove a SELinux security label.
3237 You can change the label, but all data must be labeled. */
3242 * Copy the inode security context value to the user.
3244 * Permission check is handled by selinux_inode_getxattr hook.
3246 static int selinux_inode_getsecurity(struct inode
*inode
, const char *name
, void **buffer
, bool alloc
)
3250 char *context
= NULL
;
3251 struct inode_security_struct
*isec
;
3253 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
3257 * If the caller has CAP_MAC_ADMIN, then get the raw context
3258 * value even if it is not defined by current policy; otherwise,
3259 * use the in-core value under current policy.
3260 * Use the non-auditing forms of the permission checks since
3261 * getxattr may be called by unprivileged processes commonly
3262 * and lack of permission just means that we fall back to the
3263 * in-core context value, not a denial.
3265 error
= cap_capable(current_cred(), &init_user_ns
, CAP_MAC_ADMIN
,
3266 SECURITY_CAP_NOAUDIT
);
3268 error
= cred_has_capability(current_cred(), CAP_MAC_ADMIN
,
3269 SECURITY_CAP_NOAUDIT
, true);
3270 isec
= inode_security(inode
);
3272 error
= security_sid_to_context_force(isec
->sid
, &context
,
3275 error
= security_sid_to_context(isec
->sid
, &context
, &size
);
3288 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
3289 const void *value
, size_t size
, int flags
)
3291 struct inode_security_struct
*isec
= inode_security_novalidate(inode
);
3295 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
3298 if (!value
|| !size
)
3301 rc
= security_context_to_sid(value
, size
, &newsid
, GFP_KERNEL
);
3305 spin_lock(&isec
->lock
);
3306 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3308 isec
->initialized
= LABEL_INITIALIZED
;
3309 spin_unlock(&isec
->lock
);
3313 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
3315 const int len
= sizeof(XATTR_NAME_SELINUX
);
3316 if (buffer
&& len
<= buffer_size
)
3317 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
3321 static void selinux_inode_getsecid(struct inode
*inode
, u32
*secid
)
3323 struct inode_security_struct
*isec
= inode_security_novalidate(inode
);
3327 static int selinux_inode_copy_up(struct dentry
*src
, struct cred
**new)
3330 struct task_security_struct
*tsec
;
3331 struct cred
*new_creds
= *new;
3333 if (new_creds
== NULL
) {
3334 new_creds
= prepare_creds();
3339 tsec
= new_creds
->security
;
3340 /* Get label from overlay inode and set it in create_sid */
3341 selinux_inode_getsecid(d_inode(src
), &sid
);
3342 tsec
->create_sid
= sid
;
3347 static int selinux_inode_copy_up_xattr(const char *name
)
3349 /* The copy_up hook above sets the initial context on an inode, but we
3350 * don't then want to overwrite it by blindly copying all the lower
3351 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3353 if (strcmp(name
, XATTR_NAME_SELINUX
) == 0)
3354 return 1; /* Discard */
3356 * Any other attribute apart from SELINUX is not claimed, supported
3362 /* file security operations */
3364 static int selinux_revalidate_file_permission(struct file
*file
, int mask
)
3366 const struct cred
*cred
= current_cred();
3367 struct inode
*inode
= file_inode(file
);
3369 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3370 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
3373 return file_has_perm(cred
, file
,
3374 file_mask_to_av(inode
->i_mode
, mask
));
3377 static int selinux_file_permission(struct file
*file
, int mask
)
3379 struct inode
*inode
= file_inode(file
);
3380 struct file_security_struct
*fsec
= file
->f_security
;
3381 struct inode_security_struct
*isec
;
3382 u32 sid
= current_sid();
3385 /* No permission to check. Existence test. */
3388 isec
= inode_security(inode
);
3389 if (sid
== fsec
->sid
&& fsec
->isid
== isec
->sid
&&
3390 fsec
->pseqno
== avc_policy_seqno())
3391 /* No change since file_open check. */
3394 return selinux_revalidate_file_permission(file
, mask
);
3397 static int selinux_file_alloc_security(struct file
*file
)
3399 return file_alloc_security(file
);
3402 static void selinux_file_free_security(struct file
*file
)
3404 file_free_security(file
);
3408 * Check whether a task has the ioctl permission and cmd
3409 * operation to an inode.
3411 static int ioctl_has_perm(const struct cred
*cred
, struct file
*file
,
3412 u32 requested
, u16 cmd
)
3414 struct common_audit_data ad
;
3415 struct file_security_struct
*fsec
= file
->f_security
;
3416 struct inode
*inode
= file_inode(file
);
3417 struct inode_security_struct
*isec
;
3418 struct lsm_ioctlop_audit ioctl
;
3419 u32 ssid
= cred_sid(cred
);
3421 u8 driver
= cmd
>> 8;
3422 u8 xperm
= cmd
& 0xff;
3424 ad
.type
= LSM_AUDIT_DATA_IOCTL_OP
;
3427 ad
.u
.op
->path
= file
->f_path
;
3429 if (ssid
!= fsec
->sid
) {
3430 rc
= avc_has_perm(ssid
, fsec
->sid
,
3438 if (unlikely(IS_PRIVATE(inode
)))
3441 isec
= inode_security(inode
);
3442 rc
= avc_has_extended_perms(ssid
, isec
->sid
, isec
->sclass
,
3443 requested
, driver
, xperm
, &ad
);
3448 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
3451 const struct cred
*cred
= current_cred();
3461 case FS_IOC_GETFLAGS
:
3463 case FS_IOC_GETVERSION
:
3464 error
= file_has_perm(cred
, file
, FILE__GETATTR
);
3467 case FS_IOC_SETFLAGS
:
3469 case FS_IOC_SETVERSION
:
3470 error
= file_has_perm(cred
, file
, FILE__SETATTR
);
3473 /* sys_ioctl() checks */
3477 error
= file_has_perm(cred
, file
, 0);
3482 error
= cred_has_capability(cred
, CAP_SYS_TTY_CONFIG
,
3483 SECURITY_CAP_AUDIT
, true);
3486 /* default case assumes that the command will go
3487 * to the file's ioctl() function.
3490 error
= ioctl_has_perm(cred
, file
, FILE__IOCTL
, (u16
) cmd
);
3495 static int default_noexec
;
3497 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
3499 const struct cred
*cred
= current_cred();
3500 u32 sid
= cred_sid(cred
);
3503 if (default_noexec
&&
3504 (prot
& PROT_EXEC
) && (!file
|| IS_PRIVATE(file_inode(file
)) ||
3505 (!shared
&& (prot
& PROT_WRITE
)))) {
3507 * We are making executable an anonymous mapping or a
3508 * private file mapping that will also be writable.
3509 * This has an additional check.
3511 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3512 PROCESS__EXECMEM
, NULL
);
3518 /* read access is always possible with a mapping */
3519 u32 av
= FILE__READ
;
3521 /* write access only matters if the mapping is shared */
3522 if (shared
&& (prot
& PROT_WRITE
))
3525 if (prot
& PROT_EXEC
)
3526 av
|= FILE__EXECUTE
;
3528 return file_has_perm(cred
, file
, av
);
3535 static int selinux_mmap_addr(unsigned long addr
)
3539 if (addr
< CONFIG_LSM_MMAP_MIN_ADDR
) {
3540 u32 sid
= current_sid();
3541 rc
= avc_has_perm(sid
, sid
, SECCLASS_MEMPROTECT
,
3542 MEMPROTECT__MMAP_ZERO
, NULL
);
3548 static int selinux_mmap_file(struct file
*file
, unsigned long reqprot
,
3549 unsigned long prot
, unsigned long flags
)
3551 if (selinux_checkreqprot
)
3554 return file_map_prot_check(file
, prot
,
3555 (flags
& MAP_TYPE
) == MAP_SHARED
);
3558 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
3559 unsigned long reqprot
,
3562 const struct cred
*cred
= current_cred();
3563 u32 sid
= cred_sid(cred
);
3565 if (selinux_checkreqprot
)
3568 if (default_noexec
&&
3569 (prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXEC
)) {
3571 if (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
3572 vma
->vm_end
<= vma
->vm_mm
->brk
) {
3573 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3574 PROCESS__EXECHEAP
, NULL
);
3575 } else if (!vma
->vm_file
&&
3576 ((vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
3577 vma
->vm_end
>= vma
->vm_mm
->start_stack
) ||
3578 vma_is_stack_for_current(vma
))) {
3579 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3580 PROCESS__EXECSTACK
, NULL
);
3581 } else if (vma
->vm_file
&& vma
->anon_vma
) {
3583 * We are making executable a file mapping that has
3584 * had some COW done. Since pages might have been
3585 * written, check ability to execute the possibly
3586 * modified content. This typically should only
3587 * occur for text relocations.
3589 rc
= file_has_perm(cred
, vma
->vm_file
, FILE__EXECMOD
);
3595 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
3598 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
3600 const struct cred
*cred
= current_cred();
3602 return file_has_perm(cred
, file
, FILE__LOCK
);
3605 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
3608 const struct cred
*cred
= current_cred();
3613 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
3614 err
= file_has_perm(cred
, file
, FILE__WRITE
);
3623 case F_GETOWNER_UIDS
:
3624 /* Just check FD__USE permission */
3625 err
= file_has_perm(cred
, file
, 0);
3633 #if BITS_PER_LONG == 32
3638 err
= file_has_perm(cred
, file
, FILE__LOCK
);
3645 static void selinux_file_set_fowner(struct file
*file
)
3647 struct file_security_struct
*fsec
;
3649 fsec
= file
->f_security
;
3650 fsec
->fown_sid
= current_sid();
3653 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
3654 struct fown_struct
*fown
, int signum
)
3657 u32 sid
= task_sid(tsk
);
3659 struct file_security_struct
*fsec
;
3661 /* struct fown_struct is never outside the context of a struct file */
3662 file
= container_of(fown
, struct file
, f_owner
);
3664 fsec
= file
->f_security
;
3667 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
3669 perm
= signal_to_av(signum
);
3671 return avc_has_perm(fsec
->fown_sid
, sid
,
3672 SECCLASS_PROCESS
, perm
, NULL
);
3675 static int selinux_file_receive(struct file
*file
)
3677 const struct cred
*cred
= current_cred();
3679 return file_has_perm(cred
, file
, file_to_av(file
));
3682 static int selinux_file_open(struct file
*file
, const struct cred
*cred
)
3684 struct file_security_struct
*fsec
;
3685 struct inode_security_struct
*isec
;
3687 fsec
= file
->f_security
;
3688 isec
= inode_security(file_inode(file
));
3690 * Save inode label and policy sequence number
3691 * at open-time so that selinux_file_permission
3692 * can determine whether revalidation is necessary.
3693 * Task label is already saved in the file security
3694 * struct as its SID.
3696 fsec
->isid
= isec
->sid
;
3697 fsec
->pseqno
= avc_policy_seqno();
3699 * Since the inode label or policy seqno may have changed
3700 * between the selinux_inode_permission check and the saving
3701 * of state above, recheck that access is still permitted.
3702 * Otherwise, access might never be revalidated against the
3703 * new inode label or new policy.
3704 * This check is not redundant - do not remove.
3706 return file_path_has_perm(cred
, file
, open_file_to_av(file
));
3709 /* task security operations */
3711 static int selinux_task_create(unsigned long clone_flags
)
3713 u32 sid
= current_sid();
3715 return avc_has_perm(sid
, sid
, SECCLASS_PROCESS
, PROCESS__FORK
, NULL
);
3719 * allocate the SELinux part of blank credentials
3721 static int selinux_cred_alloc_blank(struct cred
*cred
, gfp_t gfp
)
3723 struct task_security_struct
*tsec
;
3725 tsec
= kzalloc(sizeof(struct task_security_struct
), gfp
);
3729 cred
->security
= tsec
;
3734 * detach and free the LSM part of a set of credentials
3736 static void selinux_cred_free(struct cred
*cred
)
3738 struct task_security_struct
*tsec
= cred
->security
;
3741 * cred->security == NULL if security_cred_alloc_blank() or
3742 * security_prepare_creds() returned an error.
3744 BUG_ON(cred
->security
&& (unsigned long) cred
->security
< PAGE_SIZE
);
3745 cred
->security
= (void *) 0x7UL
;
3750 * prepare a new set of credentials for modification
3752 static int selinux_cred_prepare(struct cred
*new, const struct cred
*old
,
3755 const struct task_security_struct
*old_tsec
;
3756 struct task_security_struct
*tsec
;
3758 old_tsec
= old
->security
;
3760 tsec
= kmemdup(old_tsec
, sizeof(struct task_security_struct
), gfp
);
3764 new->security
= tsec
;
3769 * transfer the SELinux data to a blank set of creds
3771 static void selinux_cred_transfer(struct cred
*new, const struct cred
*old
)
3773 const struct task_security_struct
*old_tsec
= old
->security
;
3774 struct task_security_struct
*tsec
= new->security
;
3780 * set the security data for a kernel service
3781 * - all the creation contexts are set to unlabelled
3783 static int selinux_kernel_act_as(struct cred
*new, u32 secid
)
3785 struct task_security_struct
*tsec
= new->security
;
3786 u32 sid
= current_sid();
3789 ret
= avc_has_perm(sid
, secid
,
3790 SECCLASS_KERNEL_SERVICE
,
3791 KERNEL_SERVICE__USE_AS_OVERRIDE
,
3795 tsec
->create_sid
= 0;
3796 tsec
->keycreate_sid
= 0;
3797 tsec
->sockcreate_sid
= 0;
3803 * set the file creation context in a security record to the same as the
3804 * objective context of the specified inode
3806 static int selinux_kernel_create_files_as(struct cred
*new, struct inode
*inode
)
3808 struct inode_security_struct
*isec
= inode_security(inode
);
3809 struct task_security_struct
*tsec
= new->security
;
3810 u32 sid
= current_sid();
3813 ret
= avc_has_perm(sid
, isec
->sid
,
3814 SECCLASS_KERNEL_SERVICE
,
3815 KERNEL_SERVICE__CREATE_FILES_AS
,
3819 tsec
->create_sid
= isec
->sid
;
3823 static int selinux_kernel_module_request(char *kmod_name
)
3825 struct common_audit_data ad
;
3827 ad
.type
= LSM_AUDIT_DATA_KMOD
;
3828 ad
.u
.kmod_name
= kmod_name
;
3830 return avc_has_perm(current_sid(), SECINITSID_KERNEL
, SECCLASS_SYSTEM
,
3831 SYSTEM__MODULE_REQUEST
, &ad
);
3834 static int selinux_kernel_module_from_file(struct file
*file
)
3836 struct common_audit_data ad
;
3837 struct inode_security_struct
*isec
;
3838 struct file_security_struct
*fsec
;
3839 u32 sid
= current_sid();
3844 return avc_has_perm(sid
, sid
, SECCLASS_SYSTEM
,
3845 SYSTEM__MODULE_LOAD
, NULL
);
3849 ad
.type
= LSM_AUDIT_DATA_FILE
;
3852 fsec
= file
->f_security
;
3853 if (sid
!= fsec
->sid
) {
3854 rc
= avc_has_perm(sid
, fsec
->sid
, SECCLASS_FD
, FD__USE
, &ad
);
3859 isec
= inode_security(file_inode(file
));
3860 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SYSTEM
,
3861 SYSTEM__MODULE_LOAD
, &ad
);
3864 static int selinux_kernel_read_file(struct file
*file
,
3865 enum kernel_read_file_id id
)
3870 case READING_MODULE
:
3871 rc
= selinux_kernel_module_from_file(file
);
3880 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
3882 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3883 PROCESS__SETPGID
, NULL
);
3886 static int selinux_task_getpgid(struct task_struct
*p
)
3888 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3889 PROCESS__GETPGID
, NULL
);
3892 static int selinux_task_getsid(struct task_struct
*p
)
3894 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3895 PROCESS__GETSESSION
, NULL
);
3898 static void selinux_task_getsecid(struct task_struct
*p
, u32
*secid
)
3900 *secid
= task_sid(p
);
3903 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
3905 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3906 PROCESS__SETSCHED
, NULL
);
3909 static int selinux_task_setioprio(struct task_struct
*p
, int ioprio
)
3911 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3912 PROCESS__SETSCHED
, NULL
);
3915 static int selinux_task_getioprio(struct task_struct
*p
)
3917 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3918 PROCESS__GETSCHED
, NULL
);
3921 static int selinux_task_setrlimit(struct task_struct
*p
, unsigned int resource
,
3922 struct rlimit
*new_rlim
)
3924 struct rlimit
*old_rlim
= p
->signal
->rlim
+ resource
;
3926 /* Control the ability to change the hard limit (whether
3927 lowering or raising it), so that the hard limit can
3928 later be used as a safe reset point for the soft limit
3929 upon context transitions. See selinux_bprm_committing_creds. */
3930 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
3931 return avc_has_perm(current_sid(), task_sid(p
),
3932 SECCLASS_PROCESS
, PROCESS__SETRLIMIT
, NULL
);
3937 static int selinux_task_setscheduler(struct task_struct
*p
)
3939 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3940 PROCESS__SETSCHED
, NULL
);
3943 static int selinux_task_getscheduler(struct task_struct
*p
)
3945 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3946 PROCESS__GETSCHED
, NULL
);
3949 static int selinux_task_movememory(struct task_struct
*p
)
3951 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3952 PROCESS__SETSCHED
, NULL
);
3955 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
,
3961 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
3963 perm
= signal_to_av(sig
);
3965 secid
= current_sid();
3966 return avc_has_perm(secid
, task_sid(p
), SECCLASS_PROCESS
, perm
, NULL
);
3969 static void selinux_task_to_inode(struct task_struct
*p
,
3970 struct inode
*inode
)
3972 struct inode_security_struct
*isec
= inode
->i_security
;
3973 u32 sid
= task_sid(p
);
3975 spin_lock(&isec
->lock
);
3976 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3978 isec
->initialized
= LABEL_INITIALIZED
;
3979 spin_unlock(&isec
->lock
);
3982 /* Returns error only if unable to parse addresses */
3983 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
,
3984 struct common_audit_data
*ad
, u8
*proto
)
3986 int offset
, ihlen
, ret
= -EINVAL
;
3987 struct iphdr _iph
, *ih
;
3989 offset
= skb_network_offset(skb
);
3990 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
3994 ihlen
= ih
->ihl
* 4;
3995 if (ihlen
< sizeof(_iph
))
3998 ad
->u
.net
->v4info
.saddr
= ih
->saddr
;
3999 ad
->u
.net
->v4info
.daddr
= ih
->daddr
;
4003 *proto
= ih
->protocol
;
4005 switch (ih
->protocol
) {
4007 struct tcphdr _tcph
, *th
;
4009 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4013 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
4017 ad
->u
.net
->sport
= th
->source
;
4018 ad
->u
.net
->dport
= th
->dest
;
4023 struct udphdr _udph
, *uh
;
4025 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4029 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
4033 ad
->u
.net
->sport
= uh
->source
;
4034 ad
->u
.net
->dport
= uh
->dest
;
4038 case IPPROTO_DCCP
: {
4039 struct dccp_hdr _dccph
, *dh
;
4041 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4045 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
4049 ad
->u
.net
->sport
= dh
->dccph_sport
;
4050 ad
->u
.net
->dport
= dh
->dccph_dport
;
4061 #if IS_ENABLED(CONFIG_IPV6)
4063 /* Returns error only if unable to parse addresses */
4064 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
,
4065 struct common_audit_data
*ad
, u8
*proto
)
4068 int ret
= -EINVAL
, offset
;
4069 struct ipv6hdr _ipv6h
, *ip6
;
4072 offset
= skb_network_offset(skb
);
4073 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
4077 ad
->u
.net
->v6info
.saddr
= ip6
->saddr
;
4078 ad
->u
.net
->v6info
.daddr
= ip6
->daddr
;
4081 nexthdr
= ip6
->nexthdr
;
4082 offset
+= sizeof(_ipv6h
);
4083 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
, &frag_off
);
4092 struct tcphdr _tcph
, *th
;
4094 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
4098 ad
->u
.net
->sport
= th
->source
;
4099 ad
->u
.net
->dport
= th
->dest
;
4104 struct udphdr _udph
, *uh
;
4106 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
4110 ad
->u
.net
->sport
= uh
->source
;
4111 ad
->u
.net
->dport
= uh
->dest
;
4115 case IPPROTO_DCCP
: {
4116 struct dccp_hdr _dccph
, *dh
;
4118 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
4122 ad
->u
.net
->sport
= dh
->dccph_sport
;
4123 ad
->u
.net
->dport
= dh
->dccph_dport
;
4127 /* includes fragments */
4137 static int selinux_parse_skb(struct sk_buff
*skb
, struct common_audit_data
*ad
,
4138 char **_addrp
, int src
, u8
*proto
)
4143 switch (ad
->u
.net
->family
) {
4145 ret
= selinux_parse_skb_ipv4(skb
, ad
, proto
);
4148 addrp
= (char *)(src
? &ad
->u
.net
->v4info
.saddr
:
4149 &ad
->u
.net
->v4info
.daddr
);
4152 #if IS_ENABLED(CONFIG_IPV6)
4154 ret
= selinux_parse_skb_ipv6(skb
, ad
, proto
);
4157 addrp
= (char *)(src
? &ad
->u
.net
->v6info
.saddr
:
4158 &ad
->u
.net
->v6info
.daddr
);
4168 "SELinux: failure in selinux_parse_skb(),"
4169 " unable to parse packet\n");
4179 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4181 * @family: protocol family
4182 * @sid: the packet's peer label SID
4185 * Check the various different forms of network peer labeling and determine
4186 * the peer label/SID for the packet; most of the magic actually occurs in
4187 * the security server function security_net_peersid_cmp(). The function
4188 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4189 * or -EACCES if @sid is invalid due to inconsistencies with the different
4193 static int selinux_skb_peerlbl_sid(struct sk_buff
*skb
, u16 family
, u32
*sid
)
4200 err
= selinux_xfrm_skb_sid(skb
, &xfrm_sid
);
4203 err
= selinux_netlbl_skbuff_getsid(skb
, family
, &nlbl_type
, &nlbl_sid
);
4207 err
= security_net_peersid_resolve(nlbl_sid
, nlbl_type
, xfrm_sid
, sid
);
4208 if (unlikely(err
)) {
4210 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4211 " unable to determine packet's peer label\n");
4219 * selinux_conn_sid - Determine the child socket label for a connection
4220 * @sk_sid: the parent socket's SID
4221 * @skb_sid: the packet's SID
4222 * @conn_sid: the resulting connection SID
4224 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4225 * combined with the MLS information from @skb_sid in order to create
4226 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4227 * of @sk_sid. Returns zero on success, negative values on failure.
4230 static int selinux_conn_sid(u32 sk_sid
, u32 skb_sid
, u32
*conn_sid
)
4234 if (skb_sid
!= SECSID_NULL
)
4235 err
= security_sid_mls_copy(sk_sid
, skb_sid
, conn_sid
);
4242 /* socket security operations */
4244 static int socket_sockcreate_sid(const struct task_security_struct
*tsec
,
4245 u16 secclass
, u32
*socksid
)
4247 if (tsec
->sockcreate_sid
> SECSID_NULL
) {
4248 *socksid
= tsec
->sockcreate_sid
;
4252 return security_transition_sid(tsec
->sid
, tsec
->sid
, secclass
, NULL
,
4256 static int sock_has_perm(struct sock
*sk
, u32 perms
)
4258 struct sk_security_struct
*sksec
= sk
->sk_security
;
4259 struct common_audit_data ad
;
4260 struct lsm_network_audit net
= {0,};
4262 if (sksec
->sid
== SECINITSID_KERNEL
)
4265 ad
.type
= LSM_AUDIT_DATA_NET
;
4269 return avc_has_perm(current_sid(), sksec
->sid
, sksec
->sclass
, perms
,
4273 static int selinux_socket_create(int family
, int type
,
4274 int protocol
, int kern
)
4276 const struct task_security_struct
*tsec
= current_security();
4284 secclass
= socket_type_to_security_class(family
, type
, protocol
);
4285 rc
= socket_sockcreate_sid(tsec
, secclass
, &newsid
);
4289 return avc_has_perm(tsec
->sid
, newsid
, secclass
, SOCKET__CREATE
, NULL
);
4292 static int selinux_socket_post_create(struct socket
*sock
, int family
,
4293 int type
, int protocol
, int kern
)
4295 const struct task_security_struct
*tsec
= current_security();
4296 struct inode_security_struct
*isec
= inode_security_novalidate(SOCK_INODE(sock
));
4297 struct sk_security_struct
*sksec
;
4298 u16 sclass
= socket_type_to_security_class(family
, type
, protocol
);
4299 u32 sid
= SECINITSID_KERNEL
;
4303 err
= socket_sockcreate_sid(tsec
, sclass
, &sid
);
4308 isec
->sclass
= sclass
;
4310 isec
->initialized
= LABEL_INITIALIZED
;
4313 sksec
= sock
->sk
->sk_security
;
4314 sksec
->sclass
= sclass
;
4316 err
= selinux_netlbl_socket_post_create(sock
->sk
, family
);
4322 /* Range of port numbers used to automatically bind.
4323 Need to determine whether we should perform a name_bind
4324 permission check between the socket and the port number. */
4326 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
4328 struct sock
*sk
= sock
->sk
;
4332 err
= sock_has_perm(sk
, SOCKET__BIND
);
4337 * If PF_INET or PF_INET6, check name_bind permission for the port.
4338 * Multiple address binding for SCTP is not supported yet: we just
4339 * check the first address now.
4341 family
= sk
->sk_family
;
4342 if (family
== PF_INET
|| family
== PF_INET6
) {
4344 struct sk_security_struct
*sksec
= sk
->sk_security
;
4345 struct common_audit_data ad
;
4346 struct lsm_network_audit net
= {0,};
4347 struct sockaddr_in
*addr4
= NULL
;
4348 struct sockaddr_in6
*addr6
= NULL
;
4349 unsigned short snum
;
4352 if (family
== PF_INET
) {
4353 addr4
= (struct sockaddr_in
*)address
;
4354 snum
= ntohs(addr4
->sin_port
);
4355 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
4357 addr6
= (struct sockaddr_in6
*)address
;
4358 snum
= ntohs(addr6
->sin6_port
);
4359 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
4365 inet_get_local_port_range(sock_net(sk
), &low
, &high
);
4367 if (snum
< max(inet_prot_sock(sock_net(sk
)), low
) ||
4369 err
= sel_netport_sid(sk
->sk_protocol
,
4373 ad
.type
= LSM_AUDIT_DATA_NET
;
4375 ad
.u
.net
->sport
= htons(snum
);
4376 ad
.u
.net
->family
= family
;
4377 err
= avc_has_perm(sksec
->sid
, sid
,
4379 SOCKET__NAME_BIND
, &ad
);
4385 switch (sksec
->sclass
) {
4386 case SECCLASS_TCP_SOCKET
:
4387 node_perm
= TCP_SOCKET__NODE_BIND
;
4390 case SECCLASS_UDP_SOCKET
:
4391 node_perm
= UDP_SOCKET__NODE_BIND
;
4394 case SECCLASS_DCCP_SOCKET
:
4395 node_perm
= DCCP_SOCKET__NODE_BIND
;
4399 node_perm
= RAWIP_SOCKET__NODE_BIND
;
4403 err
= sel_netnode_sid(addrp
, family
, &sid
);
4407 ad
.type
= LSM_AUDIT_DATA_NET
;
4409 ad
.u
.net
->sport
= htons(snum
);
4410 ad
.u
.net
->family
= family
;
4412 if (family
== PF_INET
)
4413 ad
.u
.net
->v4info
.saddr
= addr4
->sin_addr
.s_addr
;
4415 ad
.u
.net
->v6info
.saddr
= addr6
->sin6_addr
;
4417 err
= avc_has_perm(sksec
->sid
, sid
,
4418 sksec
->sclass
, node_perm
, &ad
);
4426 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
4428 struct sock
*sk
= sock
->sk
;
4429 struct sk_security_struct
*sksec
= sk
->sk_security
;
4432 err
= sock_has_perm(sk
, SOCKET__CONNECT
);
4437 * If a TCP or DCCP socket, check name_connect permission for the port.
4439 if (sksec
->sclass
== SECCLASS_TCP_SOCKET
||
4440 sksec
->sclass
== SECCLASS_DCCP_SOCKET
) {
4441 struct common_audit_data ad
;
4442 struct lsm_network_audit net
= {0,};
4443 struct sockaddr_in
*addr4
= NULL
;
4444 struct sockaddr_in6
*addr6
= NULL
;
4445 unsigned short snum
;
4448 if (sk
->sk_family
== PF_INET
) {
4449 addr4
= (struct sockaddr_in
*)address
;
4450 if (addrlen
< sizeof(struct sockaddr_in
))
4452 snum
= ntohs(addr4
->sin_port
);
4454 addr6
= (struct sockaddr_in6
*)address
;
4455 if (addrlen
< SIN6_LEN_RFC2133
)
4457 snum
= ntohs(addr6
->sin6_port
);
4460 err
= sel_netport_sid(sk
->sk_protocol
, snum
, &sid
);
4464 perm
= (sksec
->sclass
== SECCLASS_TCP_SOCKET
) ?
4465 TCP_SOCKET__NAME_CONNECT
: DCCP_SOCKET__NAME_CONNECT
;
4467 ad
.type
= LSM_AUDIT_DATA_NET
;
4469 ad
.u
.net
->dport
= htons(snum
);
4470 ad
.u
.net
->family
= sk
->sk_family
;
4471 err
= avc_has_perm(sksec
->sid
, sid
, sksec
->sclass
, perm
, &ad
);
4476 err
= selinux_netlbl_socket_connect(sk
, address
);
4482 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
4484 return sock_has_perm(sock
->sk
, SOCKET__LISTEN
);
4487 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
4490 struct inode_security_struct
*isec
;
4491 struct inode_security_struct
*newisec
;
4495 err
= sock_has_perm(sock
->sk
, SOCKET__ACCEPT
);
4499 isec
= inode_security_novalidate(SOCK_INODE(sock
));
4500 spin_lock(&isec
->lock
);
4501 sclass
= isec
->sclass
;
4503 spin_unlock(&isec
->lock
);
4505 newisec
= inode_security_novalidate(SOCK_INODE(newsock
));
4506 newisec
->sclass
= sclass
;
4508 newisec
->initialized
= LABEL_INITIALIZED
;
4513 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
4516 return sock_has_perm(sock
->sk
, SOCKET__WRITE
);
4519 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
4520 int size
, int flags
)
4522 return sock_has_perm(sock
->sk
, SOCKET__READ
);
4525 static int selinux_socket_getsockname(struct socket
*sock
)
4527 return sock_has_perm(sock
->sk
, SOCKET__GETATTR
);
4530 static int selinux_socket_getpeername(struct socket
*sock
)
4532 return sock_has_perm(sock
->sk
, SOCKET__GETATTR
);
4535 static int selinux_socket_setsockopt(struct socket
*sock
, int level
, int optname
)
4539 err
= sock_has_perm(sock
->sk
, SOCKET__SETOPT
);
4543 return selinux_netlbl_socket_setsockopt(sock
, level
, optname
);
4546 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
4549 return sock_has_perm(sock
->sk
, SOCKET__GETOPT
);
4552 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
4554 return sock_has_perm(sock
->sk
, SOCKET__SHUTDOWN
);
4557 static int selinux_socket_unix_stream_connect(struct sock
*sock
,
4561 struct sk_security_struct
*sksec_sock
= sock
->sk_security
;
4562 struct sk_security_struct
*sksec_other
= other
->sk_security
;
4563 struct sk_security_struct
*sksec_new
= newsk
->sk_security
;
4564 struct common_audit_data ad
;
4565 struct lsm_network_audit net
= {0,};
4568 ad
.type
= LSM_AUDIT_DATA_NET
;
4570 ad
.u
.net
->sk
= other
;
4572 err
= avc_has_perm(sksec_sock
->sid
, sksec_other
->sid
,
4573 sksec_other
->sclass
,
4574 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
4578 /* server child socket */
4579 sksec_new
->peer_sid
= sksec_sock
->sid
;
4580 err
= security_sid_mls_copy(sksec_other
->sid
, sksec_sock
->sid
,
4585 /* connecting socket */
4586 sksec_sock
->peer_sid
= sksec_new
->sid
;
4591 static int selinux_socket_unix_may_send(struct socket
*sock
,
4592 struct socket
*other
)
4594 struct sk_security_struct
*ssec
= sock
->sk
->sk_security
;
4595 struct sk_security_struct
*osec
= other
->sk
->sk_security
;
4596 struct common_audit_data ad
;
4597 struct lsm_network_audit net
= {0,};
4599 ad
.type
= LSM_AUDIT_DATA_NET
;
4601 ad
.u
.net
->sk
= other
->sk
;
4603 return avc_has_perm(ssec
->sid
, osec
->sid
, osec
->sclass
, SOCKET__SENDTO
,
4607 static int selinux_inet_sys_rcv_skb(struct net
*ns
, int ifindex
,
4608 char *addrp
, u16 family
, u32 peer_sid
,
4609 struct common_audit_data
*ad
)
4615 err
= sel_netif_sid(ns
, ifindex
, &if_sid
);
4618 err
= avc_has_perm(peer_sid
, if_sid
,
4619 SECCLASS_NETIF
, NETIF__INGRESS
, ad
);
4623 err
= sel_netnode_sid(addrp
, family
, &node_sid
);
4626 return avc_has_perm(peer_sid
, node_sid
,
4627 SECCLASS_NODE
, NODE__RECVFROM
, ad
);
4630 static int selinux_sock_rcv_skb_compat(struct sock
*sk
, struct sk_buff
*skb
,
4634 struct sk_security_struct
*sksec
= sk
->sk_security
;
4635 u32 sk_sid
= sksec
->sid
;
4636 struct common_audit_data ad
;
4637 struct lsm_network_audit net
= {0,};
4640 ad
.type
= LSM_AUDIT_DATA_NET
;
4642 ad
.u
.net
->netif
= skb
->skb_iif
;
4643 ad
.u
.net
->family
= family
;
4644 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4648 if (selinux_secmark_enabled()) {
4649 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4655 err
= selinux_netlbl_sock_rcv_skb(sksec
, skb
, family
, &ad
);
4658 err
= selinux_xfrm_sock_rcv_skb(sksec
->sid
, skb
, &ad
);
4663 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
4666 struct sk_security_struct
*sksec
= sk
->sk_security
;
4667 u16 family
= sk
->sk_family
;
4668 u32 sk_sid
= sksec
->sid
;
4669 struct common_audit_data ad
;
4670 struct lsm_network_audit net
= {0,};
4675 if (family
!= PF_INET
&& family
!= PF_INET6
)
4678 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4679 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4682 /* If any sort of compatibility mode is enabled then handoff processing
4683 * to the selinux_sock_rcv_skb_compat() function to deal with the
4684 * special handling. We do this in an attempt to keep this function
4685 * as fast and as clean as possible. */
4686 if (!selinux_policycap_netpeer
)
4687 return selinux_sock_rcv_skb_compat(sk
, skb
, family
);
4689 secmark_active
= selinux_secmark_enabled();
4690 peerlbl_active
= selinux_peerlbl_enabled();
4691 if (!secmark_active
&& !peerlbl_active
)
4694 ad
.type
= LSM_AUDIT_DATA_NET
;
4696 ad
.u
.net
->netif
= skb
->skb_iif
;
4697 ad
.u
.net
->family
= family
;
4698 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4702 if (peerlbl_active
) {
4705 err
= selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
);
4708 err
= selinux_inet_sys_rcv_skb(sock_net(sk
), skb
->skb_iif
,
4709 addrp
, family
, peer_sid
, &ad
);
4711 selinux_netlbl_err(skb
, family
, err
, 0);
4714 err
= avc_has_perm(sk_sid
, peer_sid
, SECCLASS_PEER
,
4717 selinux_netlbl_err(skb
, family
, err
, 0);
4722 if (secmark_active
) {
4723 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4732 static int selinux_socket_getpeersec_stream(struct socket
*sock
, char __user
*optval
,
4733 int __user
*optlen
, unsigned len
)
4738 struct sk_security_struct
*sksec
= sock
->sk
->sk_security
;
4739 u32 peer_sid
= SECSID_NULL
;
4741 if (sksec
->sclass
== SECCLASS_UNIX_STREAM_SOCKET
||
4742 sksec
->sclass
== SECCLASS_TCP_SOCKET
)
4743 peer_sid
= sksec
->peer_sid
;
4744 if (peer_sid
== SECSID_NULL
)
4745 return -ENOPROTOOPT
;
4747 err
= security_sid_to_context(peer_sid
, &scontext
, &scontext_len
);
4751 if (scontext_len
> len
) {
4756 if (copy_to_user(optval
, scontext
, scontext_len
))
4760 if (put_user(scontext_len
, optlen
))
4766 static int selinux_socket_getpeersec_dgram(struct socket
*sock
, struct sk_buff
*skb
, u32
*secid
)
4768 u32 peer_secid
= SECSID_NULL
;
4770 struct inode_security_struct
*isec
;
4772 if (skb
&& skb
->protocol
== htons(ETH_P_IP
))
4774 else if (skb
&& skb
->protocol
== htons(ETH_P_IPV6
))
4777 family
= sock
->sk
->sk_family
;
4781 if (sock
&& family
== PF_UNIX
) {
4782 isec
= inode_security_novalidate(SOCK_INODE(sock
));
4783 peer_secid
= isec
->sid
;
4785 selinux_skb_peerlbl_sid(skb
, family
, &peer_secid
);
4788 *secid
= peer_secid
;
4789 if (peer_secid
== SECSID_NULL
)
4794 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
4796 struct sk_security_struct
*sksec
;
4798 sksec
= kzalloc(sizeof(*sksec
), priority
);
4802 sksec
->peer_sid
= SECINITSID_UNLABELED
;
4803 sksec
->sid
= SECINITSID_UNLABELED
;
4804 sksec
->sclass
= SECCLASS_SOCKET
;
4805 selinux_netlbl_sk_security_reset(sksec
);
4806 sk
->sk_security
= sksec
;
4811 static void selinux_sk_free_security(struct sock
*sk
)
4813 struct sk_security_struct
*sksec
= sk
->sk_security
;
4815 sk
->sk_security
= NULL
;
4816 selinux_netlbl_sk_security_free(sksec
);
4820 static void selinux_sk_clone_security(const struct sock
*sk
, struct sock
*newsk
)
4822 struct sk_security_struct
*sksec
= sk
->sk_security
;
4823 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4825 newsksec
->sid
= sksec
->sid
;
4826 newsksec
->peer_sid
= sksec
->peer_sid
;
4827 newsksec
->sclass
= sksec
->sclass
;
4829 selinux_netlbl_sk_security_reset(newsksec
);
4832 static void selinux_sk_getsecid(struct sock
*sk
, u32
*secid
)
4835 *secid
= SECINITSID_ANY_SOCKET
;
4837 struct sk_security_struct
*sksec
= sk
->sk_security
;
4839 *secid
= sksec
->sid
;
4843 static void selinux_sock_graft(struct sock
*sk
, struct socket
*parent
)
4845 struct inode_security_struct
*isec
=
4846 inode_security_novalidate(SOCK_INODE(parent
));
4847 struct sk_security_struct
*sksec
= sk
->sk_security
;
4849 if (sk
->sk_family
== PF_INET
|| sk
->sk_family
== PF_INET6
||
4850 sk
->sk_family
== PF_UNIX
)
4851 isec
->sid
= sksec
->sid
;
4852 sksec
->sclass
= isec
->sclass
;
4855 static int selinux_inet_conn_request(struct sock
*sk
, struct sk_buff
*skb
,
4856 struct request_sock
*req
)
4858 struct sk_security_struct
*sksec
= sk
->sk_security
;
4860 u16 family
= req
->rsk_ops
->family
;
4864 err
= selinux_skb_peerlbl_sid(skb
, family
, &peersid
);
4867 err
= selinux_conn_sid(sksec
->sid
, peersid
, &connsid
);
4870 req
->secid
= connsid
;
4871 req
->peer_secid
= peersid
;
4873 return selinux_netlbl_inet_conn_request(req
, family
);
4876 static void selinux_inet_csk_clone(struct sock
*newsk
,
4877 const struct request_sock
*req
)
4879 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4881 newsksec
->sid
= req
->secid
;
4882 newsksec
->peer_sid
= req
->peer_secid
;
4883 /* NOTE: Ideally, we should also get the isec->sid for the
4884 new socket in sync, but we don't have the isec available yet.
4885 So we will wait until sock_graft to do it, by which
4886 time it will have been created and available. */
4888 /* We don't need to take any sort of lock here as we are the only
4889 * thread with access to newsksec */
4890 selinux_netlbl_inet_csk_clone(newsk
, req
->rsk_ops
->family
);
4893 static void selinux_inet_conn_established(struct sock
*sk
, struct sk_buff
*skb
)
4895 u16 family
= sk
->sk_family
;
4896 struct sk_security_struct
*sksec
= sk
->sk_security
;
4898 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4899 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4902 selinux_skb_peerlbl_sid(skb
, family
, &sksec
->peer_sid
);
4905 static int selinux_secmark_relabel_packet(u32 sid
)
4907 const struct task_security_struct
*__tsec
;
4910 __tsec
= current_security();
4913 return avc_has_perm(tsid
, sid
, SECCLASS_PACKET
, PACKET__RELABELTO
, NULL
);
4916 static void selinux_secmark_refcount_inc(void)
4918 atomic_inc(&selinux_secmark_refcount
);
4921 static void selinux_secmark_refcount_dec(void)
4923 atomic_dec(&selinux_secmark_refcount
);
4926 static void selinux_req_classify_flow(const struct request_sock
*req
,
4929 fl
->flowi_secid
= req
->secid
;
4932 static int selinux_tun_dev_alloc_security(void **security
)
4934 struct tun_security_struct
*tunsec
;
4936 tunsec
= kzalloc(sizeof(*tunsec
), GFP_KERNEL
);
4939 tunsec
->sid
= current_sid();
4945 static void selinux_tun_dev_free_security(void *security
)
4950 static int selinux_tun_dev_create(void)
4952 u32 sid
= current_sid();
4954 /* we aren't taking into account the "sockcreate" SID since the socket
4955 * that is being created here is not a socket in the traditional sense,
4956 * instead it is a private sock, accessible only to the kernel, and
4957 * representing a wide range of network traffic spanning multiple
4958 * connections unlike traditional sockets - check the TUN driver to
4959 * get a better understanding of why this socket is special */
4961 return avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
, TUN_SOCKET__CREATE
,
4965 static int selinux_tun_dev_attach_queue(void *security
)
4967 struct tun_security_struct
*tunsec
= security
;
4969 return avc_has_perm(current_sid(), tunsec
->sid
, SECCLASS_TUN_SOCKET
,
4970 TUN_SOCKET__ATTACH_QUEUE
, NULL
);
4973 static int selinux_tun_dev_attach(struct sock
*sk
, void *security
)
4975 struct tun_security_struct
*tunsec
= security
;
4976 struct sk_security_struct
*sksec
= sk
->sk_security
;
4978 /* we don't currently perform any NetLabel based labeling here and it
4979 * isn't clear that we would want to do so anyway; while we could apply
4980 * labeling without the support of the TUN user the resulting labeled
4981 * traffic from the other end of the connection would almost certainly
4982 * cause confusion to the TUN user that had no idea network labeling
4983 * protocols were being used */
4985 sksec
->sid
= tunsec
->sid
;
4986 sksec
->sclass
= SECCLASS_TUN_SOCKET
;
4991 static int selinux_tun_dev_open(void *security
)
4993 struct tun_security_struct
*tunsec
= security
;
4994 u32 sid
= current_sid();
4997 err
= avc_has_perm(sid
, tunsec
->sid
, SECCLASS_TUN_SOCKET
,
4998 TUN_SOCKET__RELABELFROM
, NULL
);
5001 err
= avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
,
5002 TUN_SOCKET__RELABELTO
, NULL
);
5010 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
5014 struct nlmsghdr
*nlh
;
5015 struct sk_security_struct
*sksec
= sk
->sk_security
;
5017 if (skb
->len
< NLMSG_HDRLEN
) {
5021 nlh
= nlmsg_hdr(skb
);
5023 err
= selinux_nlmsg_lookup(sksec
->sclass
, nlh
->nlmsg_type
, &perm
);
5025 if (err
== -EINVAL
) {
5026 pr_warn_ratelimited("SELinux: unrecognized netlink"
5027 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5028 " pig=%d comm=%s\n",
5029 sk
->sk_protocol
, nlh
->nlmsg_type
,
5030 secclass_map
[sksec
->sclass
- 1].name
,
5031 task_pid_nr(current
), current
->comm
);
5032 if (!selinux_enforcing
|| security_get_allow_unknown())
5042 err
= sock_has_perm(sk
, perm
);
5047 #ifdef CONFIG_NETFILTER
5049 static unsigned int selinux_ip_forward(struct sk_buff
*skb
,
5050 const struct net_device
*indev
,
5056 struct common_audit_data ad
;
5057 struct lsm_network_audit net
= {0,};
5062 if (!selinux_policycap_netpeer
)
5065 secmark_active
= selinux_secmark_enabled();
5066 netlbl_active
= netlbl_enabled();
5067 peerlbl_active
= selinux_peerlbl_enabled();
5068 if (!secmark_active
&& !peerlbl_active
)
5071 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
) != 0)
5074 ad
.type
= LSM_AUDIT_DATA_NET
;
5076 ad
.u
.net
->netif
= indev
->ifindex
;
5077 ad
.u
.net
->family
= family
;
5078 if (selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
) != 0)
5081 if (peerlbl_active
) {
5082 err
= selinux_inet_sys_rcv_skb(dev_net(indev
), indev
->ifindex
,
5083 addrp
, family
, peer_sid
, &ad
);
5085 selinux_netlbl_err(skb
, family
, err
, 1);
5091 if (avc_has_perm(peer_sid
, skb
->secmark
,
5092 SECCLASS_PACKET
, PACKET__FORWARD_IN
, &ad
))
5096 /* we do this in the FORWARD path and not the POST_ROUTING
5097 * path because we want to make sure we apply the necessary
5098 * labeling before IPsec is applied so we can leverage AH
5100 if (selinux_netlbl_skbuff_setsid(skb
, family
, peer_sid
) != 0)
5106 static unsigned int selinux_ipv4_forward(void *priv
,
5107 struct sk_buff
*skb
,
5108 const struct nf_hook_state
*state
)
5110 return selinux_ip_forward(skb
, state
->in
, PF_INET
);
5113 #if IS_ENABLED(CONFIG_IPV6)
5114 static unsigned int selinux_ipv6_forward(void *priv
,
5115 struct sk_buff
*skb
,
5116 const struct nf_hook_state
*state
)
5118 return selinux_ip_forward(skb
, state
->in
, PF_INET6
);
5122 static unsigned int selinux_ip_output(struct sk_buff
*skb
,
5128 if (!netlbl_enabled())
5131 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5132 * because we want to make sure we apply the necessary labeling
5133 * before IPsec is applied so we can leverage AH protection */
5136 struct sk_security_struct
*sksec
;
5138 if (sk_listener(sk
))
5139 /* if the socket is the listening state then this
5140 * packet is a SYN-ACK packet which means it needs to
5141 * be labeled based on the connection/request_sock and
5142 * not the parent socket. unfortunately, we can't
5143 * lookup the request_sock yet as it isn't queued on
5144 * the parent socket until after the SYN-ACK is sent.
5145 * the "solution" is to simply pass the packet as-is
5146 * as any IP option based labeling should be copied
5147 * from the initial connection request (in the IP
5148 * layer). it is far from ideal, but until we get a
5149 * security label in the packet itself this is the
5150 * best we can do. */
5153 /* standard practice, label using the parent socket */
5154 sksec
= sk
->sk_security
;
5157 sid
= SECINITSID_KERNEL
;
5158 if (selinux_netlbl_skbuff_setsid(skb
, family
, sid
) != 0)
5164 static unsigned int selinux_ipv4_output(void *priv
,
5165 struct sk_buff
*skb
,
5166 const struct nf_hook_state
*state
)
5168 return selinux_ip_output(skb
, PF_INET
);
5171 #if IS_ENABLED(CONFIG_IPV6)
5172 static unsigned int selinux_ipv6_output(void *priv
,
5173 struct sk_buff
*skb
,
5174 const struct nf_hook_state
*state
)
5176 return selinux_ip_output(skb
, PF_INET6
);
5180 static unsigned int selinux_ip_postroute_compat(struct sk_buff
*skb
,
5184 struct sock
*sk
= skb_to_full_sk(skb
);
5185 struct sk_security_struct
*sksec
;
5186 struct common_audit_data ad
;
5187 struct lsm_network_audit net
= {0,};
5193 sksec
= sk
->sk_security
;
5195 ad
.type
= LSM_AUDIT_DATA_NET
;
5197 ad
.u
.net
->netif
= ifindex
;
5198 ad
.u
.net
->family
= family
;
5199 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, &proto
))
5202 if (selinux_secmark_enabled())
5203 if (avc_has_perm(sksec
->sid
, skb
->secmark
,
5204 SECCLASS_PACKET
, PACKET__SEND
, &ad
))
5205 return NF_DROP_ERR(-ECONNREFUSED
);
5207 if (selinux_xfrm_postroute_last(sksec
->sid
, skb
, &ad
, proto
))
5208 return NF_DROP_ERR(-ECONNREFUSED
);
5213 static unsigned int selinux_ip_postroute(struct sk_buff
*skb
,
5214 const struct net_device
*outdev
,
5219 int ifindex
= outdev
->ifindex
;
5221 struct common_audit_data ad
;
5222 struct lsm_network_audit net
= {0,};
5227 /* If any sort of compatibility mode is enabled then handoff processing
5228 * to the selinux_ip_postroute_compat() function to deal with the
5229 * special handling. We do this in an attempt to keep this function
5230 * as fast and as clean as possible. */
5231 if (!selinux_policycap_netpeer
)
5232 return selinux_ip_postroute_compat(skb
, ifindex
, family
);
5234 secmark_active
= selinux_secmark_enabled();
5235 peerlbl_active
= selinux_peerlbl_enabled();
5236 if (!secmark_active
&& !peerlbl_active
)
5239 sk
= skb_to_full_sk(skb
);
5242 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5243 * packet transformation so allow the packet to pass without any checks
5244 * since we'll have another chance to perform access control checks
5245 * when the packet is on it's final way out.
5246 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5247 * is NULL, in this case go ahead and apply access control.
5248 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5249 * TCP listening state we cannot wait until the XFRM processing
5250 * is done as we will miss out on the SA label if we do;
5251 * unfortunately, this means more work, but it is only once per
5253 if (skb_dst(skb
) != NULL
&& skb_dst(skb
)->xfrm
!= NULL
&&
5254 !(sk
&& sk_listener(sk
)))
5259 /* Without an associated socket the packet is either coming
5260 * from the kernel or it is being forwarded; check the packet
5261 * to determine which and if the packet is being forwarded
5262 * query the packet directly to determine the security label. */
5264 secmark_perm
= PACKET__FORWARD_OUT
;
5265 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
))
5268 secmark_perm
= PACKET__SEND
;
5269 peer_sid
= SECINITSID_KERNEL
;
5271 } else if (sk_listener(sk
)) {
5272 /* Locally generated packet but the associated socket is in the
5273 * listening state which means this is a SYN-ACK packet. In
5274 * this particular case the correct security label is assigned
5275 * to the connection/request_sock but unfortunately we can't
5276 * query the request_sock as it isn't queued on the parent
5277 * socket until after the SYN-ACK packet is sent; the only
5278 * viable choice is to regenerate the label like we do in
5279 * selinux_inet_conn_request(). See also selinux_ip_output()
5280 * for similar problems. */
5282 struct sk_security_struct
*sksec
;
5284 sksec
= sk
->sk_security
;
5285 if (selinux_skb_peerlbl_sid(skb
, family
, &skb_sid
))
5287 /* At this point, if the returned skb peerlbl is SECSID_NULL
5288 * and the packet has been through at least one XFRM
5289 * transformation then we must be dealing with the "final"
5290 * form of labeled IPsec packet; since we've already applied
5291 * all of our access controls on this packet we can safely
5292 * pass the packet. */
5293 if (skb_sid
== SECSID_NULL
) {
5296 if (IPCB(skb
)->flags
& IPSKB_XFRM_TRANSFORMED
)
5300 if (IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
)
5304 return NF_DROP_ERR(-ECONNREFUSED
);
5307 if (selinux_conn_sid(sksec
->sid
, skb_sid
, &peer_sid
))
5309 secmark_perm
= PACKET__SEND
;
5311 /* Locally generated packet, fetch the security label from the
5312 * associated socket. */
5313 struct sk_security_struct
*sksec
= sk
->sk_security
;
5314 peer_sid
= sksec
->sid
;
5315 secmark_perm
= PACKET__SEND
;
5318 ad
.type
= LSM_AUDIT_DATA_NET
;
5320 ad
.u
.net
->netif
= ifindex
;
5321 ad
.u
.net
->family
= family
;
5322 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, NULL
))
5326 if (avc_has_perm(peer_sid
, skb
->secmark
,
5327 SECCLASS_PACKET
, secmark_perm
, &ad
))
5328 return NF_DROP_ERR(-ECONNREFUSED
);
5330 if (peerlbl_active
) {
5334 if (sel_netif_sid(dev_net(outdev
), ifindex
, &if_sid
))
5336 if (avc_has_perm(peer_sid
, if_sid
,
5337 SECCLASS_NETIF
, NETIF__EGRESS
, &ad
))
5338 return NF_DROP_ERR(-ECONNREFUSED
);
5340 if (sel_netnode_sid(addrp
, family
, &node_sid
))
5342 if (avc_has_perm(peer_sid
, node_sid
,
5343 SECCLASS_NODE
, NODE__SENDTO
, &ad
))
5344 return NF_DROP_ERR(-ECONNREFUSED
);
5350 static unsigned int selinux_ipv4_postroute(void *priv
,
5351 struct sk_buff
*skb
,
5352 const struct nf_hook_state
*state
)
5354 return selinux_ip_postroute(skb
, state
->out
, PF_INET
);
5357 #if IS_ENABLED(CONFIG_IPV6)
5358 static unsigned int selinux_ipv6_postroute(void *priv
,
5359 struct sk_buff
*skb
,
5360 const struct nf_hook_state
*state
)
5362 return selinux_ip_postroute(skb
, state
->out
, PF_INET6
);
5366 #endif /* CONFIG_NETFILTER */
5368 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
5370 return selinux_nlmsg_perm(sk
, skb
);
5373 static int ipc_alloc_security(struct kern_ipc_perm
*perm
,
5376 struct ipc_security_struct
*isec
;
5378 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
5382 isec
->sclass
= sclass
;
5383 isec
->sid
= current_sid();
5384 perm
->security
= isec
;
5389 static void ipc_free_security(struct kern_ipc_perm
*perm
)
5391 struct ipc_security_struct
*isec
= perm
->security
;
5392 perm
->security
= NULL
;
5396 static int msg_msg_alloc_security(struct msg_msg
*msg
)
5398 struct msg_security_struct
*msec
;
5400 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
5404 msec
->sid
= SECINITSID_UNLABELED
;
5405 msg
->security
= msec
;
5410 static void msg_msg_free_security(struct msg_msg
*msg
)
5412 struct msg_security_struct
*msec
= msg
->security
;
5414 msg
->security
= NULL
;
5418 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
5421 struct ipc_security_struct
*isec
;
5422 struct common_audit_data ad
;
5423 u32 sid
= current_sid();
5425 isec
= ipc_perms
->security
;
5427 ad
.type
= LSM_AUDIT_DATA_IPC
;
5428 ad
.u
.ipc_id
= ipc_perms
->key
;
5430 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
5433 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
5435 return msg_msg_alloc_security(msg
);
5438 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
5440 msg_msg_free_security(msg
);
5443 /* message queue security operations */
5444 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
5446 struct ipc_security_struct
*isec
;
5447 struct common_audit_data ad
;
5448 u32 sid
= current_sid();
5451 rc
= ipc_alloc_security(&msq
->q_perm
, SECCLASS_MSGQ
);
5455 isec
= msq
->q_perm
.security
;
5457 ad
.type
= LSM_AUDIT_DATA_IPC
;
5458 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5460 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5463 ipc_free_security(&msq
->q_perm
);
5469 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
5471 ipc_free_security(&msq
->q_perm
);
5474 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
5476 struct ipc_security_struct
*isec
;
5477 struct common_audit_data ad
;
5478 u32 sid
= current_sid();
5480 isec
= msq
->q_perm
.security
;
5482 ad
.type
= LSM_AUDIT_DATA_IPC
;
5483 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5485 return avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5486 MSGQ__ASSOCIATE
, &ad
);
5489 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
5497 /* No specific object, just general system-wide information. */
5498 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5499 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5502 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
5505 perms
= MSGQ__SETATTR
;
5508 perms
= MSGQ__DESTROY
;
5514 err
= ipc_has_perm(&msq
->q_perm
, perms
);
5518 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
5520 struct ipc_security_struct
*isec
;
5521 struct msg_security_struct
*msec
;
5522 struct common_audit_data ad
;
5523 u32 sid
= current_sid();
5526 isec
= msq
->q_perm
.security
;
5527 msec
= msg
->security
;
5530 * First time through, need to assign label to the message
5532 if (msec
->sid
== SECINITSID_UNLABELED
) {
5534 * Compute new sid based on current process and
5535 * message queue this message will be stored in
5537 rc
= security_transition_sid(sid
, isec
->sid
, SECCLASS_MSG
,
5543 ad
.type
= LSM_AUDIT_DATA_IPC
;
5544 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5546 /* Can this process write to the queue? */
5547 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5550 /* Can this process send the message */
5551 rc
= avc_has_perm(sid
, msec
->sid
, SECCLASS_MSG
,
5554 /* Can the message be put in the queue? */
5555 rc
= avc_has_perm(msec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
5556 MSGQ__ENQUEUE
, &ad
);
5561 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
5562 struct task_struct
*target
,
5563 long type
, int mode
)
5565 struct ipc_security_struct
*isec
;
5566 struct msg_security_struct
*msec
;
5567 struct common_audit_data ad
;
5568 u32 sid
= task_sid(target
);
5571 isec
= msq
->q_perm
.security
;
5572 msec
= msg
->security
;
5574 ad
.type
= LSM_AUDIT_DATA_IPC
;
5575 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5577 rc
= avc_has_perm(sid
, isec
->sid
,
5578 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
5580 rc
= avc_has_perm(sid
, msec
->sid
,
5581 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
5585 /* Shared Memory security operations */
5586 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
5588 struct ipc_security_struct
*isec
;
5589 struct common_audit_data ad
;
5590 u32 sid
= current_sid();
5593 rc
= ipc_alloc_security(&shp
->shm_perm
, SECCLASS_SHM
);
5597 isec
= shp
->shm_perm
.security
;
5599 ad
.type
= LSM_AUDIT_DATA_IPC
;
5600 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
5602 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
5605 ipc_free_security(&shp
->shm_perm
);
5611 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
5613 ipc_free_security(&shp
->shm_perm
);
5616 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
5618 struct ipc_security_struct
*isec
;
5619 struct common_audit_data ad
;
5620 u32 sid
= current_sid();
5622 isec
= shp
->shm_perm
.security
;
5624 ad
.type
= LSM_AUDIT_DATA_IPC
;
5625 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
5627 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
5628 SHM__ASSOCIATE
, &ad
);
5631 /* Note, at this point, shp is locked down */
5632 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
5640 /* No specific object, just general system-wide information. */
5641 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5642 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5645 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
5648 perms
= SHM__SETATTR
;
5655 perms
= SHM__DESTROY
;
5661 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
5665 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
5666 char __user
*shmaddr
, int shmflg
)
5670 if (shmflg
& SHM_RDONLY
)
5673 perms
= SHM__READ
| SHM__WRITE
;
5675 return ipc_has_perm(&shp
->shm_perm
, perms
);
5678 /* Semaphore security operations */
5679 static int selinux_sem_alloc_security(struct sem_array
*sma
)
5681 struct ipc_security_struct
*isec
;
5682 struct common_audit_data ad
;
5683 u32 sid
= current_sid();
5686 rc
= ipc_alloc_security(&sma
->sem_perm
, SECCLASS_SEM
);
5690 isec
= sma
->sem_perm
.security
;
5692 ad
.type
= LSM_AUDIT_DATA_IPC
;
5693 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5695 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5698 ipc_free_security(&sma
->sem_perm
);
5704 static void selinux_sem_free_security(struct sem_array
*sma
)
5706 ipc_free_security(&sma
->sem_perm
);
5709 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
5711 struct ipc_security_struct
*isec
;
5712 struct common_audit_data ad
;
5713 u32 sid
= current_sid();
5715 isec
= sma
->sem_perm
.security
;
5717 ad
.type
= LSM_AUDIT_DATA_IPC
;
5718 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5720 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5721 SEM__ASSOCIATE
, &ad
);
5724 /* Note, at this point, sma is locked down */
5725 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
5733 /* No specific object, just general system-wide information. */
5734 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5735 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5739 perms
= SEM__GETATTR
;
5750 perms
= SEM__DESTROY
;
5753 perms
= SEM__SETATTR
;
5757 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
5763 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
5767 static int selinux_sem_semop(struct sem_array
*sma
,
5768 struct sembuf
*sops
, unsigned nsops
, int alter
)
5773 perms
= SEM__READ
| SEM__WRITE
;
5777 return ipc_has_perm(&sma
->sem_perm
, perms
);
5780 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
5786 av
|= IPC__UNIX_READ
;
5788 av
|= IPC__UNIX_WRITE
;
5793 return ipc_has_perm(ipcp
, av
);
5796 static void selinux_ipc_getsecid(struct kern_ipc_perm
*ipcp
, u32
*secid
)
5798 struct ipc_security_struct
*isec
= ipcp
->security
;
5802 static void selinux_d_instantiate(struct dentry
*dentry
, struct inode
*inode
)
5805 inode_doinit_with_dentry(inode
, dentry
);
5808 static int selinux_getprocattr(struct task_struct
*p
,
5809 char *name
, char **value
)
5811 const struct task_security_struct
*__tsec
;
5817 __tsec
= __task_cred(p
)->security
;
5820 error
= avc_has_perm(current_sid(), __tsec
->sid
,
5821 SECCLASS_PROCESS
, PROCESS__GETATTR
, NULL
);
5826 if (!strcmp(name
, "current"))
5828 else if (!strcmp(name
, "prev"))
5830 else if (!strcmp(name
, "exec"))
5831 sid
= __tsec
->exec_sid
;
5832 else if (!strcmp(name
, "fscreate"))
5833 sid
= __tsec
->create_sid
;
5834 else if (!strcmp(name
, "keycreate"))
5835 sid
= __tsec
->keycreate_sid
;
5836 else if (!strcmp(name
, "sockcreate"))
5837 sid
= __tsec
->sockcreate_sid
;
5847 error
= security_sid_to_context(sid
, value
, &len
);
5857 static int selinux_setprocattr(const char *name
, void *value
, size_t size
)
5859 struct task_security_struct
*tsec
;
5861 u32 mysid
= current_sid(), sid
= 0, ptsid
;
5866 * Basic control over ability to set these attributes at all.
5868 if (!strcmp(name
, "exec"))
5869 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5870 PROCESS__SETEXEC
, NULL
);
5871 else if (!strcmp(name
, "fscreate"))
5872 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5873 PROCESS__SETFSCREATE
, NULL
);
5874 else if (!strcmp(name
, "keycreate"))
5875 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5876 PROCESS__SETKEYCREATE
, NULL
);
5877 else if (!strcmp(name
, "sockcreate"))
5878 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5879 PROCESS__SETSOCKCREATE
, NULL
);
5880 else if (!strcmp(name
, "current"))
5881 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5882 PROCESS__SETCURRENT
, NULL
);
5888 /* Obtain a SID for the context, if one was specified. */
5889 if (size
&& str
[0] && str
[0] != '\n') {
5890 if (str
[size
-1] == '\n') {
5894 error
= security_context_to_sid(value
, size
, &sid
, GFP_KERNEL
);
5895 if (error
== -EINVAL
&& !strcmp(name
, "fscreate")) {
5896 if (!capable(CAP_MAC_ADMIN
)) {
5897 struct audit_buffer
*ab
;
5900 /* We strip a nul only if it is at the end, otherwise the
5901 * context contains a nul and we should audit that */
5902 if (str
[size
- 1] == '\0')
5903 audit_size
= size
- 1;
5906 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
);
5907 audit_log_format(ab
, "op=fscreate invalid_context=");
5908 audit_log_n_untrustedstring(ab
, value
, audit_size
);
5913 error
= security_context_to_sid_force(value
, size
,
5920 new = prepare_creds();
5924 /* Permission checking based on the specified context is
5925 performed during the actual operation (execve,
5926 open/mkdir/...), when we know the full context of the
5927 operation. See selinux_bprm_set_creds for the execve
5928 checks and may_create for the file creation checks. The
5929 operation will then fail if the context is not permitted. */
5930 tsec
= new->security
;
5931 if (!strcmp(name
, "exec")) {
5932 tsec
->exec_sid
= sid
;
5933 } else if (!strcmp(name
, "fscreate")) {
5934 tsec
->create_sid
= sid
;
5935 } else if (!strcmp(name
, "keycreate")) {
5936 error
= avc_has_perm(mysid
, sid
, SECCLASS_KEY
, KEY__CREATE
,
5940 tsec
->keycreate_sid
= sid
;
5941 } else if (!strcmp(name
, "sockcreate")) {
5942 tsec
->sockcreate_sid
= sid
;
5943 } else if (!strcmp(name
, "current")) {
5948 /* Only allow single threaded processes to change context */
5950 if (!current_is_single_threaded()) {
5951 error
= security_bounded_transition(tsec
->sid
, sid
);
5956 /* Check permissions for the transition. */
5957 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
5958 PROCESS__DYNTRANSITION
, NULL
);
5962 /* Check for ptracing, and update the task SID if ok.
5963 Otherwise, leave SID unchanged and fail. */
5964 ptsid
= ptrace_parent_sid();
5966 error
= avc_has_perm(ptsid
, sid
, SECCLASS_PROCESS
,
5967 PROCESS__PTRACE
, NULL
);
5986 static int selinux_ismaclabel(const char *name
)
5988 return (strcmp(name
, XATTR_SELINUX_SUFFIX
) == 0);
5991 static int selinux_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
5993 return security_sid_to_context(secid
, secdata
, seclen
);
5996 static int selinux_secctx_to_secid(const char *secdata
, u32 seclen
, u32
*secid
)
5998 return security_context_to_sid(secdata
, seclen
, secid
, GFP_KERNEL
);
6001 static void selinux_release_secctx(char *secdata
, u32 seclen
)
6006 static void selinux_inode_invalidate_secctx(struct inode
*inode
)
6008 struct inode_security_struct
*isec
= inode
->i_security
;
6010 spin_lock(&isec
->lock
);
6011 isec
->initialized
= LABEL_INVALID
;
6012 spin_unlock(&isec
->lock
);
6016 * called with inode->i_mutex locked
6018 static int selinux_inode_notifysecctx(struct inode
*inode
, void *ctx
, u32 ctxlen
)
6020 return selinux_inode_setsecurity(inode
, XATTR_SELINUX_SUFFIX
, ctx
, ctxlen
, 0);
6024 * called with inode->i_mutex locked
6026 static int selinux_inode_setsecctx(struct dentry
*dentry
, void *ctx
, u32 ctxlen
)
6028 return __vfs_setxattr_noperm(dentry
, XATTR_NAME_SELINUX
, ctx
, ctxlen
, 0);
6031 static int selinux_inode_getsecctx(struct inode
*inode
, void **ctx
, u32
*ctxlen
)
6034 len
= selinux_inode_getsecurity(inode
, XATTR_SELINUX_SUFFIX
,
6043 static int selinux_key_alloc(struct key
*k
, const struct cred
*cred
,
6044 unsigned long flags
)
6046 const struct task_security_struct
*tsec
;
6047 struct key_security_struct
*ksec
;
6049 ksec
= kzalloc(sizeof(struct key_security_struct
), GFP_KERNEL
);
6053 tsec
= cred
->security
;
6054 if (tsec
->keycreate_sid
)
6055 ksec
->sid
= tsec
->keycreate_sid
;
6057 ksec
->sid
= tsec
->sid
;
6063 static void selinux_key_free(struct key
*k
)
6065 struct key_security_struct
*ksec
= k
->security
;
6071 static int selinux_key_permission(key_ref_t key_ref
,
6072 const struct cred
*cred
,
6076 struct key_security_struct
*ksec
;
6079 /* if no specific permissions are requested, we skip the
6080 permission check. No serious, additional covert channels
6081 appear to be created. */
6085 sid
= cred_sid(cred
);
6087 key
= key_ref_to_ptr(key_ref
);
6088 ksec
= key
->security
;
6090 return avc_has_perm(sid
, ksec
->sid
, SECCLASS_KEY
, perm
, NULL
);
6093 static int selinux_key_getsecurity(struct key
*key
, char **_buffer
)
6095 struct key_security_struct
*ksec
= key
->security
;
6096 char *context
= NULL
;
6100 rc
= security_sid_to_context(ksec
->sid
, &context
, &len
);
6109 static struct security_hook_list selinux_hooks
[] = {
6110 LSM_HOOK_INIT(binder_set_context_mgr
, selinux_binder_set_context_mgr
),
6111 LSM_HOOK_INIT(binder_transaction
, selinux_binder_transaction
),
6112 LSM_HOOK_INIT(binder_transfer_binder
, selinux_binder_transfer_binder
),
6113 LSM_HOOK_INIT(binder_transfer_file
, selinux_binder_transfer_file
),
6115 LSM_HOOK_INIT(ptrace_access_check
, selinux_ptrace_access_check
),
6116 LSM_HOOK_INIT(ptrace_traceme
, selinux_ptrace_traceme
),
6117 LSM_HOOK_INIT(capget
, selinux_capget
),
6118 LSM_HOOK_INIT(capset
, selinux_capset
),
6119 LSM_HOOK_INIT(capable
, selinux_capable
),
6120 LSM_HOOK_INIT(quotactl
, selinux_quotactl
),
6121 LSM_HOOK_INIT(quota_on
, selinux_quota_on
),
6122 LSM_HOOK_INIT(syslog
, selinux_syslog
),
6123 LSM_HOOK_INIT(vm_enough_memory
, selinux_vm_enough_memory
),
6125 LSM_HOOK_INIT(netlink_send
, selinux_netlink_send
),
6127 LSM_HOOK_INIT(bprm_set_creds
, selinux_bprm_set_creds
),
6128 LSM_HOOK_INIT(bprm_committing_creds
, selinux_bprm_committing_creds
),
6129 LSM_HOOK_INIT(bprm_committed_creds
, selinux_bprm_committed_creds
),
6130 LSM_HOOK_INIT(bprm_secureexec
, selinux_bprm_secureexec
),
6132 LSM_HOOK_INIT(sb_alloc_security
, selinux_sb_alloc_security
),
6133 LSM_HOOK_INIT(sb_free_security
, selinux_sb_free_security
),
6134 LSM_HOOK_INIT(sb_copy_data
, selinux_sb_copy_data
),
6135 LSM_HOOK_INIT(sb_remount
, selinux_sb_remount
),
6136 LSM_HOOK_INIT(sb_kern_mount
, selinux_sb_kern_mount
),
6137 LSM_HOOK_INIT(sb_show_options
, selinux_sb_show_options
),
6138 LSM_HOOK_INIT(sb_statfs
, selinux_sb_statfs
),
6139 LSM_HOOK_INIT(sb_mount
, selinux_mount
),
6140 LSM_HOOK_INIT(sb_umount
, selinux_umount
),
6141 LSM_HOOK_INIT(sb_set_mnt_opts
, selinux_set_mnt_opts
),
6142 LSM_HOOK_INIT(sb_clone_mnt_opts
, selinux_sb_clone_mnt_opts
),
6143 LSM_HOOK_INIT(sb_parse_opts_str
, selinux_parse_opts_str
),
6145 LSM_HOOK_INIT(dentry_init_security
, selinux_dentry_init_security
),
6146 LSM_HOOK_INIT(dentry_create_files_as
, selinux_dentry_create_files_as
),
6148 LSM_HOOK_INIT(inode_alloc_security
, selinux_inode_alloc_security
),
6149 LSM_HOOK_INIT(inode_free_security
, selinux_inode_free_security
),
6150 LSM_HOOK_INIT(inode_init_security
, selinux_inode_init_security
),
6151 LSM_HOOK_INIT(inode_create
, selinux_inode_create
),
6152 LSM_HOOK_INIT(inode_link
, selinux_inode_link
),
6153 LSM_HOOK_INIT(inode_unlink
, selinux_inode_unlink
),
6154 LSM_HOOK_INIT(inode_symlink
, selinux_inode_symlink
),
6155 LSM_HOOK_INIT(inode_mkdir
, selinux_inode_mkdir
),
6156 LSM_HOOK_INIT(inode_rmdir
, selinux_inode_rmdir
),
6157 LSM_HOOK_INIT(inode_mknod
, selinux_inode_mknod
),
6158 LSM_HOOK_INIT(inode_rename
, selinux_inode_rename
),
6159 LSM_HOOK_INIT(inode_readlink
, selinux_inode_readlink
),
6160 LSM_HOOK_INIT(inode_follow_link
, selinux_inode_follow_link
),
6161 LSM_HOOK_INIT(inode_permission
, selinux_inode_permission
),
6162 LSM_HOOK_INIT(inode_setattr
, selinux_inode_setattr
),
6163 LSM_HOOK_INIT(inode_getattr
, selinux_inode_getattr
),
6164 LSM_HOOK_INIT(inode_setxattr
, selinux_inode_setxattr
),
6165 LSM_HOOK_INIT(inode_post_setxattr
, selinux_inode_post_setxattr
),
6166 LSM_HOOK_INIT(inode_getxattr
, selinux_inode_getxattr
),
6167 LSM_HOOK_INIT(inode_listxattr
, selinux_inode_listxattr
),
6168 LSM_HOOK_INIT(inode_removexattr
, selinux_inode_removexattr
),
6169 LSM_HOOK_INIT(inode_getsecurity
, selinux_inode_getsecurity
),
6170 LSM_HOOK_INIT(inode_setsecurity
, selinux_inode_setsecurity
),
6171 LSM_HOOK_INIT(inode_listsecurity
, selinux_inode_listsecurity
),
6172 LSM_HOOK_INIT(inode_getsecid
, selinux_inode_getsecid
),
6173 LSM_HOOK_INIT(inode_copy_up
, selinux_inode_copy_up
),
6174 LSM_HOOK_INIT(inode_copy_up_xattr
, selinux_inode_copy_up_xattr
),
6176 LSM_HOOK_INIT(file_permission
, selinux_file_permission
),
6177 LSM_HOOK_INIT(file_alloc_security
, selinux_file_alloc_security
),
6178 LSM_HOOK_INIT(file_free_security
, selinux_file_free_security
),
6179 LSM_HOOK_INIT(file_ioctl
, selinux_file_ioctl
),
6180 LSM_HOOK_INIT(mmap_file
, selinux_mmap_file
),
6181 LSM_HOOK_INIT(mmap_addr
, selinux_mmap_addr
),
6182 LSM_HOOK_INIT(file_mprotect
, selinux_file_mprotect
),
6183 LSM_HOOK_INIT(file_lock
, selinux_file_lock
),
6184 LSM_HOOK_INIT(file_fcntl
, selinux_file_fcntl
),
6185 LSM_HOOK_INIT(file_set_fowner
, selinux_file_set_fowner
),
6186 LSM_HOOK_INIT(file_send_sigiotask
, selinux_file_send_sigiotask
),
6187 LSM_HOOK_INIT(file_receive
, selinux_file_receive
),
6189 LSM_HOOK_INIT(file_open
, selinux_file_open
),
6191 LSM_HOOK_INIT(task_create
, selinux_task_create
),
6192 LSM_HOOK_INIT(cred_alloc_blank
, selinux_cred_alloc_blank
),
6193 LSM_HOOK_INIT(cred_free
, selinux_cred_free
),
6194 LSM_HOOK_INIT(cred_prepare
, selinux_cred_prepare
),
6195 LSM_HOOK_INIT(cred_transfer
, selinux_cred_transfer
),
6196 LSM_HOOK_INIT(kernel_act_as
, selinux_kernel_act_as
),
6197 LSM_HOOK_INIT(kernel_create_files_as
, selinux_kernel_create_files_as
),
6198 LSM_HOOK_INIT(kernel_module_request
, selinux_kernel_module_request
),
6199 LSM_HOOK_INIT(kernel_read_file
, selinux_kernel_read_file
),
6200 LSM_HOOK_INIT(task_setpgid
, selinux_task_setpgid
),
6201 LSM_HOOK_INIT(task_getpgid
, selinux_task_getpgid
),
6202 LSM_HOOK_INIT(task_getsid
, selinux_task_getsid
),
6203 LSM_HOOK_INIT(task_getsecid
, selinux_task_getsecid
),
6204 LSM_HOOK_INIT(task_setnice
, selinux_task_setnice
),
6205 LSM_HOOK_INIT(task_setioprio
, selinux_task_setioprio
),
6206 LSM_HOOK_INIT(task_getioprio
, selinux_task_getioprio
),
6207 LSM_HOOK_INIT(task_setrlimit
, selinux_task_setrlimit
),
6208 LSM_HOOK_INIT(task_setscheduler
, selinux_task_setscheduler
),
6209 LSM_HOOK_INIT(task_getscheduler
, selinux_task_getscheduler
),
6210 LSM_HOOK_INIT(task_movememory
, selinux_task_movememory
),
6211 LSM_HOOK_INIT(task_kill
, selinux_task_kill
),
6212 LSM_HOOK_INIT(task_to_inode
, selinux_task_to_inode
),
6214 LSM_HOOK_INIT(ipc_permission
, selinux_ipc_permission
),
6215 LSM_HOOK_INIT(ipc_getsecid
, selinux_ipc_getsecid
),
6217 LSM_HOOK_INIT(msg_msg_alloc_security
, selinux_msg_msg_alloc_security
),
6218 LSM_HOOK_INIT(msg_msg_free_security
, selinux_msg_msg_free_security
),
6220 LSM_HOOK_INIT(msg_queue_alloc_security
,
6221 selinux_msg_queue_alloc_security
),
6222 LSM_HOOK_INIT(msg_queue_free_security
, selinux_msg_queue_free_security
),
6223 LSM_HOOK_INIT(msg_queue_associate
, selinux_msg_queue_associate
),
6224 LSM_HOOK_INIT(msg_queue_msgctl
, selinux_msg_queue_msgctl
),
6225 LSM_HOOK_INIT(msg_queue_msgsnd
, selinux_msg_queue_msgsnd
),
6226 LSM_HOOK_INIT(msg_queue_msgrcv
, selinux_msg_queue_msgrcv
),
6228 LSM_HOOK_INIT(shm_alloc_security
, selinux_shm_alloc_security
),
6229 LSM_HOOK_INIT(shm_free_security
, selinux_shm_free_security
),
6230 LSM_HOOK_INIT(shm_associate
, selinux_shm_associate
),
6231 LSM_HOOK_INIT(shm_shmctl
, selinux_shm_shmctl
),
6232 LSM_HOOK_INIT(shm_shmat
, selinux_shm_shmat
),
6234 LSM_HOOK_INIT(sem_alloc_security
, selinux_sem_alloc_security
),
6235 LSM_HOOK_INIT(sem_free_security
, selinux_sem_free_security
),
6236 LSM_HOOK_INIT(sem_associate
, selinux_sem_associate
),
6237 LSM_HOOK_INIT(sem_semctl
, selinux_sem_semctl
),
6238 LSM_HOOK_INIT(sem_semop
, selinux_sem_semop
),
6240 LSM_HOOK_INIT(d_instantiate
, selinux_d_instantiate
),
6242 LSM_HOOK_INIT(getprocattr
, selinux_getprocattr
),
6243 LSM_HOOK_INIT(setprocattr
, selinux_setprocattr
),
6245 LSM_HOOK_INIT(ismaclabel
, selinux_ismaclabel
),
6246 LSM_HOOK_INIT(secid_to_secctx
, selinux_secid_to_secctx
),
6247 LSM_HOOK_INIT(secctx_to_secid
, selinux_secctx_to_secid
),
6248 LSM_HOOK_INIT(release_secctx
, selinux_release_secctx
),
6249 LSM_HOOK_INIT(inode_invalidate_secctx
, selinux_inode_invalidate_secctx
),
6250 LSM_HOOK_INIT(inode_notifysecctx
, selinux_inode_notifysecctx
),
6251 LSM_HOOK_INIT(inode_setsecctx
, selinux_inode_setsecctx
),
6252 LSM_HOOK_INIT(inode_getsecctx
, selinux_inode_getsecctx
),
6254 LSM_HOOK_INIT(unix_stream_connect
, selinux_socket_unix_stream_connect
),
6255 LSM_HOOK_INIT(unix_may_send
, selinux_socket_unix_may_send
),
6257 LSM_HOOK_INIT(socket_create
, selinux_socket_create
),
6258 LSM_HOOK_INIT(socket_post_create
, selinux_socket_post_create
),
6259 LSM_HOOK_INIT(socket_bind
, selinux_socket_bind
),
6260 LSM_HOOK_INIT(socket_connect
, selinux_socket_connect
),
6261 LSM_HOOK_INIT(socket_listen
, selinux_socket_listen
),
6262 LSM_HOOK_INIT(socket_accept
, selinux_socket_accept
),
6263 LSM_HOOK_INIT(socket_sendmsg
, selinux_socket_sendmsg
),
6264 LSM_HOOK_INIT(socket_recvmsg
, selinux_socket_recvmsg
),
6265 LSM_HOOK_INIT(socket_getsockname
, selinux_socket_getsockname
),
6266 LSM_HOOK_INIT(socket_getpeername
, selinux_socket_getpeername
),
6267 LSM_HOOK_INIT(socket_getsockopt
, selinux_socket_getsockopt
),
6268 LSM_HOOK_INIT(socket_setsockopt
, selinux_socket_setsockopt
),
6269 LSM_HOOK_INIT(socket_shutdown
, selinux_socket_shutdown
),
6270 LSM_HOOK_INIT(socket_sock_rcv_skb
, selinux_socket_sock_rcv_skb
),
6271 LSM_HOOK_INIT(socket_getpeersec_stream
,
6272 selinux_socket_getpeersec_stream
),
6273 LSM_HOOK_INIT(socket_getpeersec_dgram
, selinux_socket_getpeersec_dgram
),
6274 LSM_HOOK_INIT(sk_alloc_security
, selinux_sk_alloc_security
),
6275 LSM_HOOK_INIT(sk_free_security
, selinux_sk_free_security
),
6276 LSM_HOOK_INIT(sk_clone_security
, selinux_sk_clone_security
),
6277 LSM_HOOK_INIT(sk_getsecid
, selinux_sk_getsecid
),
6278 LSM_HOOK_INIT(sock_graft
, selinux_sock_graft
),
6279 LSM_HOOK_INIT(inet_conn_request
, selinux_inet_conn_request
),
6280 LSM_HOOK_INIT(inet_csk_clone
, selinux_inet_csk_clone
),
6281 LSM_HOOK_INIT(inet_conn_established
, selinux_inet_conn_established
),
6282 LSM_HOOK_INIT(secmark_relabel_packet
, selinux_secmark_relabel_packet
),
6283 LSM_HOOK_INIT(secmark_refcount_inc
, selinux_secmark_refcount_inc
),
6284 LSM_HOOK_INIT(secmark_refcount_dec
, selinux_secmark_refcount_dec
),
6285 LSM_HOOK_INIT(req_classify_flow
, selinux_req_classify_flow
),
6286 LSM_HOOK_INIT(tun_dev_alloc_security
, selinux_tun_dev_alloc_security
),
6287 LSM_HOOK_INIT(tun_dev_free_security
, selinux_tun_dev_free_security
),
6288 LSM_HOOK_INIT(tun_dev_create
, selinux_tun_dev_create
),
6289 LSM_HOOK_INIT(tun_dev_attach_queue
, selinux_tun_dev_attach_queue
),
6290 LSM_HOOK_INIT(tun_dev_attach
, selinux_tun_dev_attach
),
6291 LSM_HOOK_INIT(tun_dev_open
, selinux_tun_dev_open
),
6293 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6294 LSM_HOOK_INIT(xfrm_policy_alloc_security
, selinux_xfrm_policy_alloc
),
6295 LSM_HOOK_INIT(xfrm_policy_clone_security
, selinux_xfrm_policy_clone
),
6296 LSM_HOOK_INIT(xfrm_policy_free_security
, selinux_xfrm_policy_free
),
6297 LSM_HOOK_INIT(xfrm_policy_delete_security
, selinux_xfrm_policy_delete
),
6298 LSM_HOOK_INIT(xfrm_state_alloc
, selinux_xfrm_state_alloc
),
6299 LSM_HOOK_INIT(xfrm_state_alloc_acquire
,
6300 selinux_xfrm_state_alloc_acquire
),
6301 LSM_HOOK_INIT(xfrm_state_free_security
, selinux_xfrm_state_free
),
6302 LSM_HOOK_INIT(xfrm_state_delete_security
, selinux_xfrm_state_delete
),
6303 LSM_HOOK_INIT(xfrm_policy_lookup
, selinux_xfrm_policy_lookup
),
6304 LSM_HOOK_INIT(xfrm_state_pol_flow_match
,
6305 selinux_xfrm_state_pol_flow_match
),
6306 LSM_HOOK_INIT(xfrm_decode_session
, selinux_xfrm_decode_session
),
6310 LSM_HOOK_INIT(key_alloc
, selinux_key_alloc
),
6311 LSM_HOOK_INIT(key_free
, selinux_key_free
),
6312 LSM_HOOK_INIT(key_permission
, selinux_key_permission
),
6313 LSM_HOOK_INIT(key_getsecurity
, selinux_key_getsecurity
),
6317 LSM_HOOK_INIT(audit_rule_init
, selinux_audit_rule_init
),
6318 LSM_HOOK_INIT(audit_rule_known
, selinux_audit_rule_known
),
6319 LSM_HOOK_INIT(audit_rule_match
, selinux_audit_rule_match
),
6320 LSM_HOOK_INIT(audit_rule_free
, selinux_audit_rule_free
),
6324 static __init
int selinux_init(void)
6326 if (!security_module_enable("selinux")) {
6327 selinux_enabled
= 0;
6331 if (!selinux_enabled
) {
6332 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
6336 printk(KERN_INFO
"SELinux: Initializing.\n");
6338 /* Set the security state for the initial task. */
6339 cred_init_security();
6341 default_noexec
= !(VM_DATA_DEFAULT_FLAGS
& VM_EXEC
);
6343 sel_inode_cache
= kmem_cache_create("selinux_inode_security",
6344 sizeof(struct inode_security_struct
),
6345 0, SLAB_PANIC
, NULL
);
6346 file_security_cache
= kmem_cache_create("selinux_file_security",
6347 sizeof(struct file_security_struct
),
6348 0, SLAB_PANIC
, NULL
);
6351 security_add_hooks(selinux_hooks
, ARRAY_SIZE(selinux_hooks
), "selinux");
6353 if (avc_add_callback(selinux_netcache_avc_callback
, AVC_CALLBACK_RESET
))
6354 panic("SELinux: Unable to register AVC netcache callback\n");
6356 if (selinux_enforcing
)
6357 printk(KERN_DEBUG
"SELinux: Starting in enforcing mode\n");
6359 printk(KERN_DEBUG
"SELinux: Starting in permissive mode\n");
6364 static void delayed_superblock_init(struct super_block
*sb
, void *unused
)
6366 superblock_doinit(sb
, NULL
);
6369 void selinux_complete_init(void)
6371 printk(KERN_DEBUG
"SELinux: Completing initialization.\n");
6373 /* Set up any superblocks initialized prior to the policy load. */
6374 printk(KERN_DEBUG
"SELinux: Setting up existing superblocks.\n");
6375 iterate_supers(delayed_superblock_init
, NULL
);
6378 /* SELinux requires early initialization in order to label
6379 all processes and objects when they are created. */
6380 security_initcall(selinux_init
);
6382 #if defined(CONFIG_NETFILTER)
6384 static struct nf_hook_ops selinux_nf_ops
[] = {
6386 .hook
= selinux_ipv4_postroute
,
6388 .hooknum
= NF_INET_POST_ROUTING
,
6389 .priority
= NF_IP_PRI_SELINUX_LAST
,
6392 .hook
= selinux_ipv4_forward
,
6394 .hooknum
= NF_INET_FORWARD
,
6395 .priority
= NF_IP_PRI_SELINUX_FIRST
,
6398 .hook
= selinux_ipv4_output
,
6400 .hooknum
= NF_INET_LOCAL_OUT
,
6401 .priority
= NF_IP_PRI_SELINUX_FIRST
,
6403 #if IS_ENABLED(CONFIG_IPV6)
6405 .hook
= selinux_ipv6_postroute
,
6407 .hooknum
= NF_INET_POST_ROUTING
,
6408 .priority
= NF_IP6_PRI_SELINUX_LAST
,
6411 .hook
= selinux_ipv6_forward
,
6413 .hooknum
= NF_INET_FORWARD
,
6414 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
6417 .hook
= selinux_ipv6_output
,
6419 .hooknum
= NF_INET_LOCAL_OUT
,
6420 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
6425 static int __init
selinux_nf_ip_init(void)
6429 if (!selinux_enabled
)
6432 printk(KERN_DEBUG
"SELinux: Registering netfilter hooks\n");
6434 err
= nf_register_hooks(selinux_nf_ops
, ARRAY_SIZE(selinux_nf_ops
));
6436 panic("SELinux: nf_register_hooks: error %d\n", err
);
6441 __initcall(selinux_nf_ip_init
);
6443 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6444 static void selinux_nf_ip_exit(void)
6446 printk(KERN_DEBUG
"SELinux: Unregistering netfilter hooks\n");
6448 nf_unregister_hooks(selinux_nf_ops
, ARRAY_SIZE(selinux_nf_ops
));
6452 #else /* CONFIG_NETFILTER */
6454 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6455 #define selinux_nf_ip_exit()
6458 #endif /* CONFIG_NETFILTER */
6460 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6461 static int selinux_disabled
;
6463 int selinux_disable(void)
6465 if (ss_initialized
) {
6466 /* Not permitted after initial policy load. */
6470 if (selinux_disabled
) {
6471 /* Only do this once. */
6475 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
6477 selinux_disabled
= 1;
6478 selinux_enabled
= 0;
6480 security_delete_hooks(selinux_hooks
, ARRAY_SIZE(selinux_hooks
));
6482 /* Try to destroy the avc node cache */
6485 /* Unregister netfilter hooks. */
6486 selinux_nf_ip_exit();
6488 /* Unregister selinuxfs. */