]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-jammy-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'arm-soc/for-5.15/devicetree' of https://github.com/Broadcom/stblinux into...
[mirror_ubuntu-jammy-kernel.git] / security / selinux / hooks.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * NSA Security-Enhanced Linux (SELinux) security module
4 *
5 * This file contains the SELinux hook function implementations.
6 *
7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
11 *
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
22 */
23
24 #include <linux/init.h>
25 #include <linux/kd.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
54 #include <net/icmp.h>
55 #include <net/ip.h> /* for local_port_range[] */
56 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h> /* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h> /* for Unix socket types */
74 #include <net/af_unix.h> /* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
77 #include <net/ipv6.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h> /* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
95
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106
107 struct selinux_state selinux_state;
108
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
114
115 static int __init enforcing_setup(char *str)
116 {
117 unsigned long enforcing;
118 if (!kstrtoul(str, 0, &enforcing))
119 selinux_enforcing_boot = enforcing ? 1 : 0;
120 return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
130 {
131 unsigned long enabled;
132 if (!kstrtoul(str, 0, &enabled))
133 selinux_enabled_boot = enabled ? 1 : 0;
134 return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138
139 static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142 static int __init checkreqprot_setup(char *str)
143 {
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot)) {
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 if (checkreqprot)
149 pr_warn("SELinux: checkreqprot set to 1 via kernel parameter. This is deprecated and will be rejected in a future kernel release.\n");
150 }
151 return 1;
152 }
153 __setup("checkreqprot=", checkreqprot_setup);
154
155 /**
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157 *
158 * Description:
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
164 *
165 */
166 static int selinux_secmark_enabled(void)
167 {
168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
170 }
171
172 /**
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174 *
175 * Description:
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
180 *
181 */
182 static int selinux_peerlbl_enabled(void)
183 {
184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
186 }
187
188 static int selinux_netcache_avc_callback(u32 event)
189 {
190 if (event == AVC_CALLBACK_RESET) {
191 sel_netif_flush();
192 sel_netnode_flush();
193 sel_netport_flush();
194 synchronize_net();
195 }
196 return 0;
197 }
198
199 static int selinux_lsm_notifier_avc_callback(u32 event)
200 {
201 if (event == AVC_CALLBACK_RESET) {
202 sel_ib_pkey_flush();
203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
204 }
205
206 return 0;
207 }
208
209 /*
210 * initialise the security for the init task
211 */
212 static void cred_init_security(void)
213 {
214 struct cred *cred = (struct cred *) current->real_cred;
215 struct task_security_struct *tsec;
216
217 tsec = selinux_cred(cred);
218 tsec->osid = tsec->sid = SECINITSID_KERNEL;
219 }
220
221 /*
222 * get the security ID of a set of credentials
223 */
224 static inline u32 cred_sid(const struct cred *cred)
225 {
226 const struct task_security_struct *tsec;
227
228 tsec = selinux_cred(cred);
229 return tsec->sid;
230 }
231
232 /*
233 * get the subjective security ID of a task
234 */
235 static inline u32 task_sid_subj(const struct task_struct *task)
236 {
237 u32 sid;
238
239 rcu_read_lock();
240 sid = cred_sid(rcu_dereference(task->cred));
241 rcu_read_unlock();
242 return sid;
243 }
244
245 /*
246 * get the objective security ID of a task
247 */
248 static inline u32 task_sid_obj(const struct task_struct *task)
249 {
250 u32 sid;
251
252 rcu_read_lock();
253 sid = cred_sid(__task_cred(task));
254 rcu_read_unlock();
255 return sid;
256 }
257
258 /*
259 * get the security ID of a task for use with binder
260 */
261 static inline u32 task_sid_binder(const struct task_struct *task)
262 {
263 /*
264 * In many case where this function is used we should be using the
265 * task's subjective SID, but we can't reliably access the subjective
266 * creds of a task other than our own so we must use the objective
267 * creds/SID, which are safe to access. The downside is that if a task
268 * is temporarily overriding it's creds it will not be reflected here;
269 * however, it isn't clear that binder would handle that case well
270 * anyway.
271 *
272 * If this ever changes and we can safely reference the subjective
273 * creds/SID of another task, this function will make it easier to
274 * identify the various places where we make use of the task SIDs in
275 * the binder code. It is also likely that we will need to adjust
276 * the main drivers/android binder code as well.
277 */
278 return task_sid_obj(task);
279 }
280
281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
282
283 /*
284 * Try reloading inode security labels that have been marked as invalid. The
285 * @may_sleep parameter indicates when sleeping and thus reloading labels is
286 * allowed; when set to false, returns -ECHILD when the label is
287 * invalid. The @dentry parameter should be set to a dentry of the inode.
288 */
289 static int __inode_security_revalidate(struct inode *inode,
290 struct dentry *dentry,
291 bool may_sleep)
292 {
293 struct inode_security_struct *isec = selinux_inode(inode);
294
295 might_sleep_if(may_sleep);
296
297 if (selinux_initialized(&selinux_state) &&
298 isec->initialized != LABEL_INITIALIZED) {
299 if (!may_sleep)
300 return -ECHILD;
301
302 /*
303 * Try reloading the inode security label. This will fail if
304 * @opt_dentry is NULL and no dentry for this inode can be
305 * found; in that case, continue using the old label.
306 */
307 inode_doinit_with_dentry(inode, dentry);
308 }
309 return 0;
310 }
311
312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
313 {
314 return selinux_inode(inode);
315 }
316
317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
318 {
319 int error;
320
321 error = __inode_security_revalidate(inode, NULL, !rcu);
322 if (error)
323 return ERR_PTR(error);
324 return selinux_inode(inode);
325 }
326
327 /*
328 * Get the security label of an inode.
329 */
330 static struct inode_security_struct *inode_security(struct inode *inode)
331 {
332 __inode_security_revalidate(inode, NULL, true);
333 return selinux_inode(inode);
334 }
335
336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
337 {
338 struct inode *inode = d_backing_inode(dentry);
339
340 return selinux_inode(inode);
341 }
342
343 /*
344 * Get the security label of a dentry's backing inode.
345 */
346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
347 {
348 struct inode *inode = d_backing_inode(dentry);
349
350 __inode_security_revalidate(inode, dentry, true);
351 return selinux_inode(inode);
352 }
353
354 static void inode_free_security(struct inode *inode)
355 {
356 struct inode_security_struct *isec = selinux_inode(inode);
357 struct superblock_security_struct *sbsec;
358
359 if (!isec)
360 return;
361 sbsec = selinux_superblock(inode->i_sb);
362 /*
363 * As not all inode security structures are in a list, we check for
364 * empty list outside of the lock to make sure that we won't waste
365 * time taking a lock doing nothing.
366 *
367 * The list_del_init() function can be safely called more than once.
368 * It should not be possible for this function to be called with
369 * concurrent list_add(), but for better safety against future changes
370 * in the code, we use list_empty_careful() here.
371 */
372 if (!list_empty_careful(&isec->list)) {
373 spin_lock(&sbsec->isec_lock);
374 list_del_init(&isec->list);
375 spin_unlock(&sbsec->isec_lock);
376 }
377 }
378
379 struct selinux_mnt_opts {
380 const char *fscontext, *context, *rootcontext, *defcontext;
381 };
382
383 static void selinux_free_mnt_opts(void *mnt_opts)
384 {
385 struct selinux_mnt_opts *opts = mnt_opts;
386 kfree(opts->fscontext);
387 kfree(opts->context);
388 kfree(opts->rootcontext);
389 kfree(opts->defcontext);
390 kfree(opts);
391 }
392
393 enum {
394 Opt_error = -1,
395 Opt_context = 0,
396 Opt_defcontext = 1,
397 Opt_fscontext = 2,
398 Opt_rootcontext = 3,
399 Opt_seclabel = 4,
400 };
401
402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
403 static struct {
404 const char *name;
405 int len;
406 int opt;
407 bool has_arg;
408 } tokens[] = {
409 A(context, true),
410 A(fscontext, true),
411 A(defcontext, true),
412 A(rootcontext, true),
413 A(seclabel, false),
414 };
415 #undef A
416
417 static int match_opt_prefix(char *s, int l, char **arg)
418 {
419 int i;
420
421 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
422 size_t len = tokens[i].len;
423 if (len > l || memcmp(s, tokens[i].name, len))
424 continue;
425 if (tokens[i].has_arg) {
426 if (len == l || s[len] != '=')
427 continue;
428 *arg = s + len + 1;
429 } else if (len != l)
430 continue;
431 return tokens[i].opt;
432 }
433 return Opt_error;
434 }
435
436 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
437
438 static int may_context_mount_sb_relabel(u32 sid,
439 struct superblock_security_struct *sbsec,
440 const struct cred *cred)
441 {
442 const struct task_security_struct *tsec = selinux_cred(cred);
443 int rc;
444
445 rc = avc_has_perm(&selinux_state,
446 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
447 FILESYSTEM__RELABELFROM, NULL);
448 if (rc)
449 return rc;
450
451 rc = avc_has_perm(&selinux_state,
452 tsec->sid, sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELTO, NULL);
454 return rc;
455 }
456
457 static int may_context_mount_inode_relabel(u32 sid,
458 struct superblock_security_struct *sbsec,
459 const struct cred *cred)
460 {
461 const struct task_security_struct *tsec = selinux_cred(cred);
462 int rc;
463 rc = avc_has_perm(&selinux_state,
464 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
466 if (rc)
467 return rc;
468
469 rc = avc_has_perm(&selinux_state,
470 sid, sbsec->sid, SECCLASS_FILESYSTEM,
471 FILESYSTEM__ASSOCIATE, NULL);
472 return rc;
473 }
474
475 static int selinux_is_genfs_special_handling(struct super_block *sb)
476 {
477 /* Special handling. Genfs but also in-core setxattr handler */
478 return !strcmp(sb->s_type->name, "sysfs") ||
479 !strcmp(sb->s_type->name, "pstore") ||
480 !strcmp(sb->s_type->name, "debugfs") ||
481 !strcmp(sb->s_type->name, "tracefs") ||
482 !strcmp(sb->s_type->name, "rootfs") ||
483 (selinux_policycap_cgroupseclabel() &&
484 (!strcmp(sb->s_type->name, "cgroup") ||
485 !strcmp(sb->s_type->name, "cgroup2")));
486 }
487
488 static int selinux_is_sblabel_mnt(struct super_block *sb)
489 {
490 struct superblock_security_struct *sbsec = selinux_superblock(sb);
491
492 /*
493 * IMPORTANT: Double-check logic in this function when adding a new
494 * SECURITY_FS_USE_* definition!
495 */
496 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
497
498 switch (sbsec->behavior) {
499 case SECURITY_FS_USE_XATTR:
500 case SECURITY_FS_USE_TRANS:
501 case SECURITY_FS_USE_TASK:
502 case SECURITY_FS_USE_NATIVE:
503 return 1;
504
505 case SECURITY_FS_USE_GENFS:
506 return selinux_is_genfs_special_handling(sb);
507
508 /* Never allow relabeling on context mounts */
509 case SECURITY_FS_USE_MNTPOINT:
510 case SECURITY_FS_USE_NONE:
511 default:
512 return 0;
513 }
514 }
515
516 static int sb_check_xattr_support(struct super_block *sb)
517 {
518 struct superblock_security_struct *sbsec = sb->s_security;
519 struct dentry *root = sb->s_root;
520 struct inode *root_inode = d_backing_inode(root);
521 u32 sid;
522 int rc;
523
524 /*
525 * Make sure that the xattr handler exists and that no
526 * error other than -ENODATA is returned by getxattr on
527 * the root directory. -ENODATA is ok, as this may be
528 * the first boot of the SELinux kernel before we have
529 * assigned xattr values to the filesystem.
530 */
531 if (!(root_inode->i_opflags & IOP_XATTR)) {
532 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
533 sb->s_id, sb->s_type->name);
534 goto fallback;
535 }
536
537 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
538 if (rc < 0 && rc != -ENODATA) {
539 if (rc == -EOPNOTSUPP) {
540 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
541 sb->s_id, sb->s_type->name);
542 goto fallback;
543 } else {
544 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
545 sb->s_id, sb->s_type->name, -rc);
546 return rc;
547 }
548 }
549 return 0;
550
551 fallback:
552 /* No xattr support - try to fallback to genfs if possible. */
553 rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
554 SECCLASS_DIR, &sid);
555 if (rc)
556 return -EOPNOTSUPP;
557
558 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
559 sb->s_id, sb->s_type->name);
560 sbsec->behavior = SECURITY_FS_USE_GENFS;
561 sbsec->sid = sid;
562 return 0;
563 }
564
565 static int sb_finish_set_opts(struct super_block *sb)
566 {
567 struct superblock_security_struct *sbsec = selinux_superblock(sb);
568 struct dentry *root = sb->s_root;
569 struct inode *root_inode = d_backing_inode(root);
570 int rc = 0;
571
572 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
573 rc = sb_check_xattr_support(sb);
574 if (rc)
575 return rc;
576 }
577
578 sbsec->flags |= SE_SBINITIALIZED;
579
580 /*
581 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
582 * leave the flag untouched because sb_clone_mnt_opts might be handing
583 * us a superblock that needs the flag to be cleared.
584 */
585 if (selinux_is_sblabel_mnt(sb))
586 sbsec->flags |= SBLABEL_MNT;
587 else
588 sbsec->flags &= ~SBLABEL_MNT;
589
590 /* Initialize the root inode. */
591 rc = inode_doinit_with_dentry(root_inode, root);
592
593 /* Initialize any other inodes associated with the superblock, e.g.
594 inodes created prior to initial policy load or inodes created
595 during get_sb by a pseudo filesystem that directly
596 populates itself. */
597 spin_lock(&sbsec->isec_lock);
598 while (!list_empty(&sbsec->isec_head)) {
599 struct inode_security_struct *isec =
600 list_first_entry(&sbsec->isec_head,
601 struct inode_security_struct, list);
602 struct inode *inode = isec->inode;
603 list_del_init(&isec->list);
604 spin_unlock(&sbsec->isec_lock);
605 inode = igrab(inode);
606 if (inode) {
607 if (!IS_PRIVATE(inode))
608 inode_doinit_with_dentry(inode, NULL);
609 iput(inode);
610 }
611 spin_lock(&sbsec->isec_lock);
612 }
613 spin_unlock(&sbsec->isec_lock);
614 return rc;
615 }
616
617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
618 u32 old_sid, u32 new_sid)
619 {
620 char mnt_flags = sbsec->flags & SE_MNTMASK;
621
622 /* check if the old mount command had the same options */
623 if (sbsec->flags & SE_SBINITIALIZED)
624 if (!(sbsec->flags & flag) ||
625 (old_sid != new_sid))
626 return 1;
627
628 /* check if we were passed the same options twice,
629 * aka someone passed context=a,context=b
630 */
631 if (!(sbsec->flags & SE_SBINITIALIZED))
632 if (mnt_flags & flag)
633 return 1;
634 return 0;
635 }
636
637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
638 {
639 int rc = security_context_str_to_sid(&selinux_state, s,
640 sid, GFP_KERNEL);
641 if (rc)
642 pr_warn("SELinux: security_context_str_to_sid"
643 "(%s) failed for (dev %s, type %s) errno=%d\n",
644 s, sb->s_id, sb->s_type->name, rc);
645 return rc;
646 }
647
648 /*
649 * Allow filesystems with binary mount data to explicitly set mount point
650 * labeling information.
651 */
652 static int selinux_set_mnt_opts(struct super_block *sb,
653 void *mnt_opts,
654 unsigned long kern_flags,
655 unsigned long *set_kern_flags)
656 {
657 const struct cred *cred = current_cred();
658 struct superblock_security_struct *sbsec = selinux_superblock(sb);
659 struct dentry *root = sb->s_root;
660 struct selinux_mnt_opts *opts = mnt_opts;
661 struct inode_security_struct *root_isec;
662 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
663 u32 defcontext_sid = 0;
664 int rc = 0;
665
666 mutex_lock(&sbsec->lock);
667
668 if (!selinux_initialized(&selinux_state)) {
669 if (!opts) {
670 /* Defer initialization until selinux_complete_init,
671 after the initial policy is loaded and the security
672 server is ready to handle calls. */
673 goto out;
674 }
675 rc = -EINVAL;
676 pr_warn("SELinux: Unable to set superblock options "
677 "before the security server is initialized\n");
678 goto out;
679 }
680 if (kern_flags && !set_kern_flags) {
681 /* Specifying internal flags without providing a place to
682 * place the results is not allowed */
683 rc = -EINVAL;
684 goto out;
685 }
686
687 /*
688 * Binary mount data FS will come through this function twice. Once
689 * from an explicit call and once from the generic calls from the vfs.
690 * Since the generic VFS calls will not contain any security mount data
691 * we need to skip the double mount verification.
692 *
693 * This does open a hole in which we will not notice if the first
694 * mount using this sb set explict options and a second mount using
695 * this sb does not set any security options. (The first options
696 * will be used for both mounts)
697 */
698 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
699 && !opts)
700 goto out;
701
702 root_isec = backing_inode_security_novalidate(root);
703
704 /*
705 * parse the mount options, check if they are valid sids.
706 * also check if someone is trying to mount the same sb more
707 * than once with different security options.
708 */
709 if (opts) {
710 if (opts->fscontext) {
711 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
712 if (rc)
713 goto out;
714 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
715 fscontext_sid))
716 goto out_double_mount;
717 sbsec->flags |= FSCONTEXT_MNT;
718 }
719 if (opts->context) {
720 rc = parse_sid(sb, opts->context, &context_sid);
721 if (rc)
722 goto out;
723 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
724 context_sid))
725 goto out_double_mount;
726 sbsec->flags |= CONTEXT_MNT;
727 }
728 if (opts->rootcontext) {
729 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
730 if (rc)
731 goto out;
732 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
733 rootcontext_sid))
734 goto out_double_mount;
735 sbsec->flags |= ROOTCONTEXT_MNT;
736 }
737 if (opts->defcontext) {
738 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
739 if (rc)
740 goto out;
741 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
742 defcontext_sid))
743 goto out_double_mount;
744 sbsec->flags |= DEFCONTEXT_MNT;
745 }
746 }
747
748 if (sbsec->flags & SE_SBINITIALIZED) {
749 /* previously mounted with options, but not on this attempt? */
750 if ((sbsec->flags & SE_MNTMASK) && !opts)
751 goto out_double_mount;
752 rc = 0;
753 goto out;
754 }
755
756 if (strcmp(sb->s_type->name, "proc") == 0)
757 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
758
759 if (!strcmp(sb->s_type->name, "debugfs") ||
760 !strcmp(sb->s_type->name, "tracefs") ||
761 !strcmp(sb->s_type->name, "binder") ||
762 !strcmp(sb->s_type->name, "bpf") ||
763 !strcmp(sb->s_type->name, "pstore"))
764 sbsec->flags |= SE_SBGENFS;
765
766 if (!strcmp(sb->s_type->name, "sysfs") ||
767 !strcmp(sb->s_type->name, "cgroup") ||
768 !strcmp(sb->s_type->name, "cgroup2"))
769 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
770
771 if (!sbsec->behavior) {
772 /*
773 * Determine the labeling behavior to use for this
774 * filesystem type.
775 */
776 rc = security_fs_use(&selinux_state, sb);
777 if (rc) {
778 pr_warn("%s: security_fs_use(%s) returned %d\n",
779 __func__, sb->s_type->name, rc);
780 goto out;
781 }
782 }
783
784 /*
785 * If this is a user namespace mount and the filesystem type is not
786 * explicitly whitelisted, then no contexts are allowed on the command
787 * line and security labels must be ignored.
788 */
789 if (sb->s_user_ns != &init_user_ns &&
790 strcmp(sb->s_type->name, "tmpfs") &&
791 strcmp(sb->s_type->name, "ramfs") &&
792 strcmp(sb->s_type->name, "devpts") &&
793 strcmp(sb->s_type->name, "overlay")) {
794 if (context_sid || fscontext_sid || rootcontext_sid ||
795 defcontext_sid) {
796 rc = -EACCES;
797 goto out;
798 }
799 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
800 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
801 rc = security_transition_sid(&selinux_state,
802 current_sid(),
803 current_sid(),
804 SECCLASS_FILE, NULL,
805 &sbsec->mntpoint_sid);
806 if (rc)
807 goto out;
808 }
809 goto out_set_opts;
810 }
811
812 /* sets the context of the superblock for the fs being mounted. */
813 if (fscontext_sid) {
814 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
815 if (rc)
816 goto out;
817
818 sbsec->sid = fscontext_sid;
819 }
820
821 /*
822 * Switch to using mount point labeling behavior.
823 * sets the label used on all file below the mountpoint, and will set
824 * the superblock context if not already set.
825 */
826 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
827 sbsec->behavior = SECURITY_FS_USE_NATIVE;
828 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
829 }
830
831 if (context_sid) {
832 if (!fscontext_sid) {
833 rc = may_context_mount_sb_relabel(context_sid, sbsec,
834 cred);
835 if (rc)
836 goto out;
837 sbsec->sid = context_sid;
838 } else {
839 rc = may_context_mount_inode_relabel(context_sid, sbsec,
840 cred);
841 if (rc)
842 goto out;
843 }
844 if (!rootcontext_sid)
845 rootcontext_sid = context_sid;
846
847 sbsec->mntpoint_sid = context_sid;
848 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
849 }
850
851 if (rootcontext_sid) {
852 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
853 cred);
854 if (rc)
855 goto out;
856
857 root_isec->sid = rootcontext_sid;
858 root_isec->initialized = LABEL_INITIALIZED;
859 }
860
861 if (defcontext_sid) {
862 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
863 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
864 rc = -EINVAL;
865 pr_warn("SELinux: defcontext option is "
866 "invalid for this filesystem type\n");
867 goto out;
868 }
869
870 if (defcontext_sid != sbsec->def_sid) {
871 rc = may_context_mount_inode_relabel(defcontext_sid,
872 sbsec, cred);
873 if (rc)
874 goto out;
875 }
876
877 sbsec->def_sid = defcontext_sid;
878 }
879
880 out_set_opts:
881 rc = sb_finish_set_opts(sb);
882 out:
883 mutex_unlock(&sbsec->lock);
884 return rc;
885 out_double_mount:
886 rc = -EINVAL;
887 pr_warn("SELinux: mount invalid. Same superblock, different "
888 "security settings for (dev %s, type %s)\n", sb->s_id,
889 sb->s_type->name);
890 goto out;
891 }
892
893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
894 const struct super_block *newsb)
895 {
896 struct superblock_security_struct *old = selinux_superblock(oldsb);
897 struct superblock_security_struct *new = selinux_superblock(newsb);
898 char oldflags = old->flags & SE_MNTMASK;
899 char newflags = new->flags & SE_MNTMASK;
900
901 if (oldflags != newflags)
902 goto mismatch;
903 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
904 goto mismatch;
905 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
906 goto mismatch;
907 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
908 goto mismatch;
909 if (oldflags & ROOTCONTEXT_MNT) {
910 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
911 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
912 if (oldroot->sid != newroot->sid)
913 goto mismatch;
914 }
915 return 0;
916 mismatch:
917 pr_warn("SELinux: mount invalid. Same superblock, "
918 "different security settings for (dev %s, "
919 "type %s)\n", newsb->s_id, newsb->s_type->name);
920 return -EBUSY;
921 }
922
923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
924 struct super_block *newsb,
925 unsigned long kern_flags,
926 unsigned long *set_kern_flags)
927 {
928 int rc = 0;
929 const struct superblock_security_struct *oldsbsec =
930 selinux_superblock(oldsb);
931 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
932
933 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
934 int set_context = (oldsbsec->flags & CONTEXT_MNT);
935 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
936
937 /*
938 * if the parent was able to be mounted it clearly had no special lsm
939 * mount options. thus we can safely deal with this superblock later
940 */
941 if (!selinux_initialized(&selinux_state))
942 return 0;
943
944 /*
945 * Specifying internal flags without providing a place to
946 * place the results is not allowed.
947 */
948 if (kern_flags && !set_kern_flags)
949 return -EINVAL;
950
951 /* how can we clone if the old one wasn't set up?? */
952 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
953
954 /* if fs is reusing a sb, make sure that the contexts match */
955 if (newsbsec->flags & SE_SBINITIALIZED) {
956 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
957 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
958 return selinux_cmp_sb_context(oldsb, newsb);
959 }
960
961 mutex_lock(&newsbsec->lock);
962
963 newsbsec->flags = oldsbsec->flags;
964
965 newsbsec->sid = oldsbsec->sid;
966 newsbsec->def_sid = oldsbsec->def_sid;
967 newsbsec->behavior = oldsbsec->behavior;
968
969 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
970 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
971 rc = security_fs_use(&selinux_state, newsb);
972 if (rc)
973 goto out;
974 }
975
976 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
977 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
978 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
979 }
980
981 if (set_context) {
982 u32 sid = oldsbsec->mntpoint_sid;
983
984 if (!set_fscontext)
985 newsbsec->sid = sid;
986 if (!set_rootcontext) {
987 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
988 newisec->sid = sid;
989 }
990 newsbsec->mntpoint_sid = sid;
991 }
992 if (set_rootcontext) {
993 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
994 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
995
996 newisec->sid = oldisec->sid;
997 }
998
999 sb_finish_set_opts(newsb);
1000 out:
1001 mutex_unlock(&newsbsec->lock);
1002 return rc;
1003 }
1004
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1006 {
1007 struct selinux_mnt_opts *opts = *mnt_opts;
1008
1009 if (token == Opt_seclabel) /* eaten and completely ignored */
1010 return 0;
1011
1012 if (!opts) {
1013 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1014 if (!opts)
1015 return -ENOMEM;
1016 *mnt_opts = opts;
1017 }
1018 if (!s)
1019 return -ENOMEM;
1020 switch (token) {
1021 case Opt_context:
1022 if (opts->context || opts->defcontext)
1023 goto Einval;
1024 opts->context = s;
1025 break;
1026 case Opt_fscontext:
1027 if (opts->fscontext)
1028 goto Einval;
1029 opts->fscontext = s;
1030 break;
1031 case Opt_rootcontext:
1032 if (opts->rootcontext)
1033 goto Einval;
1034 opts->rootcontext = s;
1035 break;
1036 case Opt_defcontext:
1037 if (opts->context || opts->defcontext)
1038 goto Einval;
1039 opts->defcontext = s;
1040 break;
1041 }
1042 return 0;
1043 Einval:
1044 pr_warn(SEL_MOUNT_FAIL_MSG);
1045 return -EINVAL;
1046 }
1047
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1049 void **mnt_opts)
1050 {
1051 int token = Opt_error;
1052 int rc, i;
1053
1054 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055 if (strcmp(option, tokens[i].name) == 0) {
1056 token = tokens[i].opt;
1057 break;
1058 }
1059 }
1060
1061 if (token == Opt_error)
1062 return -EINVAL;
1063
1064 if (token != Opt_seclabel) {
1065 val = kmemdup_nul(val, len, GFP_KERNEL);
1066 if (!val) {
1067 rc = -ENOMEM;
1068 goto free_opt;
1069 }
1070 }
1071 rc = selinux_add_opt(token, val, mnt_opts);
1072 if (unlikely(rc)) {
1073 kfree(val);
1074 goto free_opt;
1075 }
1076 return rc;
1077
1078 free_opt:
1079 if (*mnt_opts) {
1080 selinux_free_mnt_opts(*mnt_opts);
1081 *mnt_opts = NULL;
1082 }
1083 return rc;
1084 }
1085
1086 static int show_sid(struct seq_file *m, u32 sid)
1087 {
1088 char *context = NULL;
1089 u32 len;
1090 int rc;
1091
1092 rc = security_sid_to_context(&selinux_state, sid,
1093 &context, &len);
1094 if (!rc) {
1095 bool has_comma = context && strchr(context, ',');
1096
1097 seq_putc(m, '=');
1098 if (has_comma)
1099 seq_putc(m, '\"');
1100 seq_escape(m, context, "\"\n\\");
1101 if (has_comma)
1102 seq_putc(m, '\"');
1103 }
1104 kfree(context);
1105 return rc;
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1111 int rc;
1112
1113 if (!(sbsec->flags & SE_SBINITIALIZED))
1114 return 0;
1115
1116 if (!selinux_initialized(&selinux_state))
1117 return 0;
1118
1119 if (sbsec->flags & FSCONTEXT_MNT) {
1120 seq_putc(m, ',');
1121 seq_puts(m, FSCONTEXT_STR);
1122 rc = show_sid(m, sbsec->sid);
1123 if (rc)
1124 return rc;
1125 }
1126 if (sbsec->flags & CONTEXT_MNT) {
1127 seq_putc(m, ',');
1128 seq_puts(m, CONTEXT_STR);
1129 rc = show_sid(m, sbsec->mntpoint_sid);
1130 if (rc)
1131 return rc;
1132 }
1133 if (sbsec->flags & DEFCONTEXT_MNT) {
1134 seq_putc(m, ',');
1135 seq_puts(m, DEFCONTEXT_STR);
1136 rc = show_sid(m, sbsec->def_sid);
1137 if (rc)
1138 return rc;
1139 }
1140 if (sbsec->flags & ROOTCONTEXT_MNT) {
1141 struct dentry *root = sb->s_root;
1142 struct inode_security_struct *isec = backing_inode_security(root);
1143 seq_putc(m, ',');
1144 seq_puts(m, ROOTCONTEXT_STR);
1145 rc = show_sid(m, isec->sid);
1146 if (rc)
1147 return rc;
1148 }
1149 if (sbsec->flags & SBLABEL_MNT) {
1150 seq_putc(m, ',');
1151 seq_puts(m, SECLABEL_STR);
1152 }
1153 return 0;
1154 }
1155
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1157 {
1158 switch (mode & S_IFMT) {
1159 case S_IFSOCK:
1160 return SECCLASS_SOCK_FILE;
1161 case S_IFLNK:
1162 return SECCLASS_LNK_FILE;
1163 case S_IFREG:
1164 return SECCLASS_FILE;
1165 case S_IFBLK:
1166 return SECCLASS_BLK_FILE;
1167 case S_IFDIR:
1168 return SECCLASS_DIR;
1169 case S_IFCHR:
1170 return SECCLASS_CHR_FILE;
1171 case S_IFIFO:
1172 return SECCLASS_FIFO_FILE;
1173
1174 }
1175
1176 return SECCLASS_FILE;
1177 }
1178
1179 static inline int default_protocol_stream(int protocol)
1180 {
1181 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182 protocol == IPPROTO_MPTCP);
1183 }
1184
1185 static inline int default_protocol_dgram(int protocol)
1186 {
1187 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1188 }
1189
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1191 {
1192 int extsockclass = selinux_policycap_extsockclass();
1193
1194 switch (family) {
1195 case PF_UNIX:
1196 switch (type) {
1197 case SOCK_STREAM:
1198 case SOCK_SEQPACKET:
1199 return SECCLASS_UNIX_STREAM_SOCKET;
1200 case SOCK_DGRAM:
1201 case SOCK_RAW:
1202 return SECCLASS_UNIX_DGRAM_SOCKET;
1203 }
1204 break;
1205 case PF_INET:
1206 case PF_INET6:
1207 switch (type) {
1208 case SOCK_STREAM:
1209 case SOCK_SEQPACKET:
1210 if (default_protocol_stream(protocol))
1211 return SECCLASS_TCP_SOCKET;
1212 else if (extsockclass && protocol == IPPROTO_SCTP)
1213 return SECCLASS_SCTP_SOCKET;
1214 else
1215 return SECCLASS_RAWIP_SOCKET;
1216 case SOCK_DGRAM:
1217 if (default_protocol_dgram(protocol))
1218 return SECCLASS_UDP_SOCKET;
1219 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220 protocol == IPPROTO_ICMPV6))
1221 return SECCLASS_ICMP_SOCKET;
1222 else
1223 return SECCLASS_RAWIP_SOCKET;
1224 case SOCK_DCCP:
1225 return SECCLASS_DCCP_SOCKET;
1226 default:
1227 return SECCLASS_RAWIP_SOCKET;
1228 }
1229 break;
1230 case PF_NETLINK:
1231 switch (protocol) {
1232 case NETLINK_ROUTE:
1233 return SECCLASS_NETLINK_ROUTE_SOCKET;
1234 case NETLINK_SOCK_DIAG:
1235 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1236 case NETLINK_NFLOG:
1237 return SECCLASS_NETLINK_NFLOG_SOCKET;
1238 case NETLINK_XFRM:
1239 return SECCLASS_NETLINK_XFRM_SOCKET;
1240 case NETLINK_SELINUX:
1241 return SECCLASS_NETLINK_SELINUX_SOCKET;
1242 case NETLINK_ISCSI:
1243 return SECCLASS_NETLINK_ISCSI_SOCKET;
1244 case NETLINK_AUDIT:
1245 return SECCLASS_NETLINK_AUDIT_SOCKET;
1246 case NETLINK_FIB_LOOKUP:
1247 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248 case NETLINK_CONNECTOR:
1249 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250 case NETLINK_NETFILTER:
1251 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252 case NETLINK_DNRTMSG:
1253 return SECCLASS_NETLINK_DNRT_SOCKET;
1254 case NETLINK_KOBJECT_UEVENT:
1255 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256 case NETLINK_GENERIC:
1257 return SECCLASS_NETLINK_GENERIC_SOCKET;
1258 case NETLINK_SCSITRANSPORT:
1259 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1260 case NETLINK_RDMA:
1261 return SECCLASS_NETLINK_RDMA_SOCKET;
1262 case NETLINK_CRYPTO:
1263 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1264 default:
1265 return SECCLASS_NETLINK_SOCKET;
1266 }
1267 case PF_PACKET:
1268 return SECCLASS_PACKET_SOCKET;
1269 case PF_KEY:
1270 return SECCLASS_KEY_SOCKET;
1271 case PF_APPLETALK:
1272 return SECCLASS_APPLETALK_SOCKET;
1273 }
1274
1275 if (extsockclass) {
1276 switch (family) {
1277 case PF_AX25:
1278 return SECCLASS_AX25_SOCKET;
1279 case PF_IPX:
1280 return SECCLASS_IPX_SOCKET;
1281 case PF_NETROM:
1282 return SECCLASS_NETROM_SOCKET;
1283 case PF_ATMPVC:
1284 return SECCLASS_ATMPVC_SOCKET;
1285 case PF_X25:
1286 return SECCLASS_X25_SOCKET;
1287 case PF_ROSE:
1288 return SECCLASS_ROSE_SOCKET;
1289 case PF_DECnet:
1290 return SECCLASS_DECNET_SOCKET;
1291 case PF_ATMSVC:
1292 return SECCLASS_ATMSVC_SOCKET;
1293 case PF_RDS:
1294 return SECCLASS_RDS_SOCKET;
1295 case PF_IRDA:
1296 return SECCLASS_IRDA_SOCKET;
1297 case PF_PPPOX:
1298 return SECCLASS_PPPOX_SOCKET;
1299 case PF_LLC:
1300 return SECCLASS_LLC_SOCKET;
1301 case PF_CAN:
1302 return SECCLASS_CAN_SOCKET;
1303 case PF_TIPC:
1304 return SECCLASS_TIPC_SOCKET;
1305 case PF_BLUETOOTH:
1306 return SECCLASS_BLUETOOTH_SOCKET;
1307 case PF_IUCV:
1308 return SECCLASS_IUCV_SOCKET;
1309 case PF_RXRPC:
1310 return SECCLASS_RXRPC_SOCKET;
1311 case PF_ISDN:
1312 return SECCLASS_ISDN_SOCKET;
1313 case PF_PHONET:
1314 return SECCLASS_PHONET_SOCKET;
1315 case PF_IEEE802154:
1316 return SECCLASS_IEEE802154_SOCKET;
1317 case PF_CAIF:
1318 return SECCLASS_CAIF_SOCKET;
1319 case PF_ALG:
1320 return SECCLASS_ALG_SOCKET;
1321 case PF_NFC:
1322 return SECCLASS_NFC_SOCKET;
1323 case PF_VSOCK:
1324 return SECCLASS_VSOCK_SOCKET;
1325 case PF_KCM:
1326 return SECCLASS_KCM_SOCKET;
1327 case PF_QIPCRTR:
1328 return SECCLASS_QIPCRTR_SOCKET;
1329 case PF_SMC:
1330 return SECCLASS_SMC_SOCKET;
1331 case PF_XDP:
1332 return SECCLASS_XDP_SOCKET;
1333 case PF_MCTP:
1334 return SECCLASS_MCTP_SOCKET;
1335 #if PF_MAX > 46
1336 #error New address family defined, please update this function.
1337 #endif
1338 }
1339 }
1340
1341 return SECCLASS_SOCKET;
1342 }
1343
1344 static int selinux_genfs_get_sid(struct dentry *dentry,
1345 u16 tclass,
1346 u16 flags,
1347 u32 *sid)
1348 {
1349 int rc;
1350 struct super_block *sb = dentry->d_sb;
1351 char *buffer, *path;
1352
1353 buffer = (char *)__get_free_page(GFP_KERNEL);
1354 if (!buffer)
1355 return -ENOMEM;
1356
1357 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1358 if (IS_ERR(path))
1359 rc = PTR_ERR(path);
1360 else {
1361 if (flags & SE_SBPROC) {
1362 /* each process gets a /proc/PID/ entry. Strip off the
1363 * PID part to get a valid selinux labeling.
1364 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1365 while (path[1] >= '0' && path[1] <= '9') {
1366 path[1] = '/';
1367 path++;
1368 }
1369 }
1370 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1371 path, tclass, sid);
1372 if (rc == -ENOENT) {
1373 /* No match in policy, mark as unlabeled. */
1374 *sid = SECINITSID_UNLABELED;
1375 rc = 0;
1376 }
1377 }
1378 free_page((unsigned long)buffer);
1379 return rc;
1380 }
1381
1382 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1383 u32 def_sid, u32 *sid)
1384 {
1385 #define INITCONTEXTLEN 255
1386 char *context;
1387 unsigned int len;
1388 int rc;
1389
1390 len = INITCONTEXTLEN;
1391 context = kmalloc(len + 1, GFP_NOFS);
1392 if (!context)
1393 return -ENOMEM;
1394
1395 context[len] = '\0';
1396 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1397 if (rc == -ERANGE) {
1398 kfree(context);
1399
1400 /* Need a larger buffer. Query for the right size. */
1401 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1402 if (rc < 0)
1403 return rc;
1404
1405 len = rc;
1406 context = kmalloc(len + 1, GFP_NOFS);
1407 if (!context)
1408 return -ENOMEM;
1409
1410 context[len] = '\0';
1411 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1412 context, len);
1413 }
1414 if (rc < 0) {
1415 kfree(context);
1416 if (rc != -ENODATA) {
1417 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1418 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1419 return rc;
1420 }
1421 *sid = def_sid;
1422 return 0;
1423 }
1424
1425 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1426 def_sid, GFP_NOFS);
1427 if (rc) {
1428 char *dev = inode->i_sb->s_id;
1429 unsigned long ino = inode->i_ino;
1430
1431 if (rc == -EINVAL) {
1432 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1433 ino, dev, context);
1434 } else {
1435 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1436 __func__, context, -rc, dev, ino);
1437 }
1438 }
1439 kfree(context);
1440 return 0;
1441 }
1442
1443 /* The inode's security attributes must be initialized before first use. */
1444 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1445 {
1446 struct superblock_security_struct *sbsec = NULL;
1447 struct inode_security_struct *isec = selinux_inode(inode);
1448 u32 task_sid, sid = 0;
1449 u16 sclass;
1450 struct dentry *dentry;
1451 int rc = 0;
1452
1453 if (isec->initialized == LABEL_INITIALIZED)
1454 return 0;
1455
1456 spin_lock(&isec->lock);
1457 if (isec->initialized == LABEL_INITIALIZED)
1458 goto out_unlock;
1459
1460 if (isec->sclass == SECCLASS_FILE)
1461 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462
1463 sbsec = selinux_superblock(inode->i_sb);
1464 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1465 /* Defer initialization until selinux_complete_init,
1466 after the initial policy is loaded and the security
1467 server is ready to handle calls. */
1468 spin_lock(&sbsec->isec_lock);
1469 if (list_empty(&isec->list))
1470 list_add(&isec->list, &sbsec->isec_head);
1471 spin_unlock(&sbsec->isec_lock);
1472 goto out_unlock;
1473 }
1474
1475 sclass = isec->sclass;
1476 task_sid = isec->task_sid;
1477 sid = isec->sid;
1478 isec->initialized = LABEL_PENDING;
1479 spin_unlock(&isec->lock);
1480
1481 switch (sbsec->behavior) {
1482 case SECURITY_FS_USE_NATIVE:
1483 break;
1484 case SECURITY_FS_USE_XATTR:
1485 if (!(inode->i_opflags & IOP_XATTR)) {
1486 sid = sbsec->def_sid;
1487 break;
1488 }
1489 /* Need a dentry, since the xattr API requires one.
1490 Life would be simpler if we could just pass the inode. */
1491 if (opt_dentry) {
1492 /* Called from d_instantiate or d_splice_alias. */
1493 dentry = dget(opt_dentry);
1494 } else {
1495 /*
1496 * Called from selinux_complete_init, try to find a dentry.
1497 * Some filesystems really want a connected one, so try
1498 * that first. We could split SECURITY_FS_USE_XATTR in
1499 * two, depending upon that...
1500 */
1501 dentry = d_find_alias(inode);
1502 if (!dentry)
1503 dentry = d_find_any_alias(inode);
1504 }
1505 if (!dentry) {
1506 /*
1507 * this is can be hit on boot when a file is accessed
1508 * before the policy is loaded. When we load policy we
1509 * may find inodes that have no dentry on the
1510 * sbsec->isec_head list. No reason to complain as these
1511 * will get fixed up the next time we go through
1512 * inode_doinit with a dentry, before these inodes could
1513 * be used again by userspace.
1514 */
1515 goto out_invalid;
1516 }
1517
1518 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1519 &sid);
1520 dput(dentry);
1521 if (rc)
1522 goto out;
1523 break;
1524 case SECURITY_FS_USE_TASK:
1525 sid = task_sid;
1526 break;
1527 case SECURITY_FS_USE_TRANS:
1528 /* Default to the fs SID. */
1529 sid = sbsec->sid;
1530
1531 /* Try to obtain a transition SID. */
1532 rc = security_transition_sid(&selinux_state, task_sid, sid,
1533 sclass, NULL, &sid);
1534 if (rc)
1535 goto out;
1536 break;
1537 case SECURITY_FS_USE_MNTPOINT:
1538 sid = sbsec->mntpoint_sid;
1539 break;
1540 default:
1541 /* Default to the fs superblock SID. */
1542 sid = sbsec->sid;
1543
1544 if ((sbsec->flags & SE_SBGENFS) &&
1545 (!S_ISLNK(inode->i_mode) ||
1546 selinux_policycap_genfs_seclabel_symlinks())) {
1547 /* We must have a dentry to determine the label on
1548 * procfs inodes */
1549 if (opt_dentry) {
1550 /* Called from d_instantiate or
1551 * d_splice_alias. */
1552 dentry = dget(opt_dentry);
1553 } else {
1554 /* Called from selinux_complete_init, try to
1555 * find a dentry. Some filesystems really want
1556 * a connected one, so try that first.
1557 */
1558 dentry = d_find_alias(inode);
1559 if (!dentry)
1560 dentry = d_find_any_alias(inode);
1561 }
1562 /*
1563 * This can be hit on boot when a file is accessed
1564 * before the policy is loaded. When we load policy we
1565 * may find inodes that have no dentry on the
1566 * sbsec->isec_head list. No reason to complain as
1567 * these will get fixed up the next time we go through
1568 * inode_doinit() with a dentry, before these inodes
1569 * could be used again by userspace.
1570 */
1571 if (!dentry)
1572 goto out_invalid;
1573 rc = selinux_genfs_get_sid(dentry, sclass,
1574 sbsec->flags, &sid);
1575 if (rc) {
1576 dput(dentry);
1577 goto out;
1578 }
1579
1580 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1581 (inode->i_opflags & IOP_XATTR)) {
1582 rc = inode_doinit_use_xattr(inode, dentry,
1583 sid, &sid);
1584 if (rc) {
1585 dput(dentry);
1586 goto out;
1587 }
1588 }
1589 dput(dentry);
1590 }
1591 break;
1592 }
1593
1594 out:
1595 spin_lock(&isec->lock);
1596 if (isec->initialized == LABEL_PENDING) {
1597 if (rc) {
1598 isec->initialized = LABEL_INVALID;
1599 goto out_unlock;
1600 }
1601 isec->initialized = LABEL_INITIALIZED;
1602 isec->sid = sid;
1603 }
1604
1605 out_unlock:
1606 spin_unlock(&isec->lock);
1607 return rc;
1608
1609 out_invalid:
1610 spin_lock(&isec->lock);
1611 if (isec->initialized == LABEL_PENDING) {
1612 isec->initialized = LABEL_INVALID;
1613 isec->sid = sid;
1614 }
1615 spin_unlock(&isec->lock);
1616 return 0;
1617 }
1618
1619 /* Convert a Linux signal to an access vector. */
1620 static inline u32 signal_to_av(int sig)
1621 {
1622 u32 perm = 0;
1623
1624 switch (sig) {
1625 case SIGCHLD:
1626 /* Commonly granted from child to parent. */
1627 perm = PROCESS__SIGCHLD;
1628 break;
1629 case SIGKILL:
1630 /* Cannot be caught or ignored */
1631 perm = PROCESS__SIGKILL;
1632 break;
1633 case SIGSTOP:
1634 /* Cannot be caught or ignored */
1635 perm = PROCESS__SIGSTOP;
1636 break;
1637 default:
1638 /* All other signals. */
1639 perm = PROCESS__SIGNAL;
1640 break;
1641 }
1642
1643 return perm;
1644 }
1645
1646 #if CAP_LAST_CAP > 63
1647 #error Fix SELinux to handle capabilities > 63.
1648 #endif
1649
1650 /* Check whether a task is allowed to use a capability. */
1651 static int cred_has_capability(const struct cred *cred,
1652 int cap, unsigned int opts, bool initns)
1653 {
1654 struct common_audit_data ad;
1655 struct av_decision avd;
1656 u16 sclass;
1657 u32 sid = cred_sid(cred);
1658 u32 av = CAP_TO_MASK(cap);
1659 int rc;
1660
1661 ad.type = LSM_AUDIT_DATA_CAP;
1662 ad.u.cap = cap;
1663
1664 switch (CAP_TO_INDEX(cap)) {
1665 case 0:
1666 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1667 break;
1668 case 1:
1669 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1670 break;
1671 default:
1672 pr_err("SELinux: out of range capability %d\n", cap);
1673 BUG();
1674 return -EINVAL;
1675 }
1676
1677 rc = avc_has_perm_noaudit(&selinux_state,
1678 sid, sid, sclass, av, 0, &avd);
1679 if (!(opts & CAP_OPT_NOAUDIT)) {
1680 int rc2 = avc_audit(&selinux_state,
1681 sid, sid, sclass, av, &avd, rc, &ad);
1682 if (rc2)
1683 return rc2;
1684 }
1685 return rc;
1686 }
1687
1688 /* Check whether a task has a particular permission to an inode.
1689 The 'adp' parameter is optional and allows other audit
1690 data to be passed (e.g. the dentry). */
1691 static int inode_has_perm(const struct cred *cred,
1692 struct inode *inode,
1693 u32 perms,
1694 struct common_audit_data *adp)
1695 {
1696 struct inode_security_struct *isec;
1697 u32 sid;
1698
1699 validate_creds(cred);
1700
1701 if (unlikely(IS_PRIVATE(inode)))
1702 return 0;
1703
1704 sid = cred_sid(cred);
1705 isec = selinux_inode(inode);
1706
1707 return avc_has_perm(&selinux_state,
1708 sid, isec->sid, isec->sclass, perms, adp);
1709 }
1710
1711 /* Same as inode_has_perm, but pass explicit audit data containing
1712 the dentry to help the auditing code to more easily generate the
1713 pathname if needed. */
1714 static inline int dentry_has_perm(const struct cred *cred,
1715 struct dentry *dentry,
1716 u32 av)
1717 {
1718 struct inode *inode = d_backing_inode(dentry);
1719 struct common_audit_data ad;
1720
1721 ad.type = LSM_AUDIT_DATA_DENTRY;
1722 ad.u.dentry = dentry;
1723 __inode_security_revalidate(inode, dentry, true);
1724 return inode_has_perm(cred, inode, av, &ad);
1725 }
1726
1727 /* Same as inode_has_perm, but pass explicit audit data containing
1728 the path to help the auditing code to more easily generate the
1729 pathname if needed. */
1730 static inline int path_has_perm(const struct cred *cred,
1731 const struct path *path,
1732 u32 av)
1733 {
1734 struct inode *inode = d_backing_inode(path->dentry);
1735 struct common_audit_data ad;
1736
1737 ad.type = LSM_AUDIT_DATA_PATH;
1738 ad.u.path = *path;
1739 __inode_security_revalidate(inode, path->dentry, true);
1740 return inode_has_perm(cred, inode, av, &ad);
1741 }
1742
1743 /* Same as path_has_perm, but uses the inode from the file struct. */
1744 static inline int file_path_has_perm(const struct cred *cred,
1745 struct file *file,
1746 u32 av)
1747 {
1748 struct common_audit_data ad;
1749
1750 ad.type = LSM_AUDIT_DATA_FILE;
1751 ad.u.file = file;
1752 return inode_has_perm(cred, file_inode(file), av, &ad);
1753 }
1754
1755 #ifdef CONFIG_BPF_SYSCALL
1756 static int bpf_fd_pass(struct file *file, u32 sid);
1757 #endif
1758
1759 /* Check whether a task can use an open file descriptor to
1760 access an inode in a given way. Check access to the
1761 descriptor itself, and then use dentry_has_perm to
1762 check a particular permission to the file.
1763 Access to the descriptor is implicitly granted if it
1764 has the same SID as the process. If av is zero, then
1765 access to the file is not checked, e.g. for cases
1766 where only the descriptor is affected like seek. */
1767 static int file_has_perm(const struct cred *cred,
1768 struct file *file,
1769 u32 av)
1770 {
1771 struct file_security_struct *fsec = selinux_file(file);
1772 struct inode *inode = file_inode(file);
1773 struct common_audit_data ad;
1774 u32 sid = cred_sid(cred);
1775 int rc;
1776
1777 ad.type = LSM_AUDIT_DATA_FILE;
1778 ad.u.file = file;
1779
1780 if (sid != fsec->sid) {
1781 rc = avc_has_perm(&selinux_state,
1782 sid, fsec->sid,
1783 SECCLASS_FD,
1784 FD__USE,
1785 &ad);
1786 if (rc)
1787 goto out;
1788 }
1789
1790 #ifdef CONFIG_BPF_SYSCALL
1791 rc = bpf_fd_pass(file, cred_sid(cred));
1792 if (rc)
1793 return rc;
1794 #endif
1795
1796 /* av is zero if only checking access to the descriptor. */
1797 rc = 0;
1798 if (av)
1799 rc = inode_has_perm(cred, inode, av, &ad);
1800
1801 out:
1802 return rc;
1803 }
1804
1805 /*
1806 * Determine the label for an inode that might be unioned.
1807 */
1808 static int
1809 selinux_determine_inode_label(const struct task_security_struct *tsec,
1810 struct inode *dir,
1811 const struct qstr *name, u16 tclass,
1812 u32 *_new_isid)
1813 {
1814 const struct superblock_security_struct *sbsec =
1815 selinux_superblock(dir->i_sb);
1816
1817 if ((sbsec->flags & SE_SBINITIALIZED) &&
1818 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1819 *_new_isid = sbsec->mntpoint_sid;
1820 } else if ((sbsec->flags & SBLABEL_MNT) &&
1821 tsec->create_sid) {
1822 *_new_isid = tsec->create_sid;
1823 } else {
1824 const struct inode_security_struct *dsec = inode_security(dir);
1825 return security_transition_sid(&selinux_state, tsec->sid,
1826 dsec->sid, tclass,
1827 name, _new_isid);
1828 }
1829
1830 return 0;
1831 }
1832
1833 /* Check whether a task can create a file. */
1834 static int may_create(struct inode *dir,
1835 struct dentry *dentry,
1836 u16 tclass)
1837 {
1838 const struct task_security_struct *tsec = selinux_cred(current_cred());
1839 struct inode_security_struct *dsec;
1840 struct superblock_security_struct *sbsec;
1841 u32 sid, newsid;
1842 struct common_audit_data ad;
1843 int rc;
1844
1845 dsec = inode_security(dir);
1846 sbsec = selinux_superblock(dir->i_sb);
1847
1848 sid = tsec->sid;
1849
1850 ad.type = LSM_AUDIT_DATA_DENTRY;
1851 ad.u.dentry = dentry;
1852
1853 rc = avc_has_perm(&selinux_state,
1854 sid, dsec->sid, SECCLASS_DIR,
1855 DIR__ADD_NAME | DIR__SEARCH,
1856 &ad);
1857 if (rc)
1858 return rc;
1859
1860 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1861 &newsid);
1862 if (rc)
1863 return rc;
1864
1865 rc = avc_has_perm(&selinux_state,
1866 sid, newsid, tclass, FILE__CREATE, &ad);
1867 if (rc)
1868 return rc;
1869
1870 return avc_has_perm(&selinux_state,
1871 newsid, sbsec->sid,
1872 SECCLASS_FILESYSTEM,
1873 FILESYSTEM__ASSOCIATE, &ad);
1874 }
1875
1876 #define MAY_LINK 0
1877 #define MAY_UNLINK 1
1878 #define MAY_RMDIR 2
1879
1880 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1881 static int may_link(struct inode *dir,
1882 struct dentry *dentry,
1883 int kind)
1884
1885 {
1886 struct inode_security_struct *dsec, *isec;
1887 struct common_audit_data ad;
1888 u32 sid = current_sid();
1889 u32 av;
1890 int rc;
1891
1892 dsec = inode_security(dir);
1893 isec = backing_inode_security(dentry);
1894
1895 ad.type = LSM_AUDIT_DATA_DENTRY;
1896 ad.u.dentry = dentry;
1897
1898 av = DIR__SEARCH;
1899 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1900 rc = avc_has_perm(&selinux_state,
1901 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1902 if (rc)
1903 return rc;
1904
1905 switch (kind) {
1906 case MAY_LINK:
1907 av = FILE__LINK;
1908 break;
1909 case MAY_UNLINK:
1910 av = FILE__UNLINK;
1911 break;
1912 case MAY_RMDIR:
1913 av = DIR__RMDIR;
1914 break;
1915 default:
1916 pr_warn("SELinux: %s: unrecognized kind %d\n",
1917 __func__, kind);
1918 return 0;
1919 }
1920
1921 rc = avc_has_perm(&selinux_state,
1922 sid, isec->sid, isec->sclass, av, &ad);
1923 return rc;
1924 }
1925
1926 static inline int may_rename(struct inode *old_dir,
1927 struct dentry *old_dentry,
1928 struct inode *new_dir,
1929 struct dentry *new_dentry)
1930 {
1931 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1932 struct common_audit_data ad;
1933 u32 sid = current_sid();
1934 u32 av;
1935 int old_is_dir, new_is_dir;
1936 int rc;
1937
1938 old_dsec = inode_security(old_dir);
1939 old_isec = backing_inode_security(old_dentry);
1940 old_is_dir = d_is_dir(old_dentry);
1941 new_dsec = inode_security(new_dir);
1942
1943 ad.type = LSM_AUDIT_DATA_DENTRY;
1944
1945 ad.u.dentry = old_dentry;
1946 rc = avc_has_perm(&selinux_state,
1947 sid, old_dsec->sid, SECCLASS_DIR,
1948 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1949 if (rc)
1950 return rc;
1951 rc = avc_has_perm(&selinux_state,
1952 sid, old_isec->sid,
1953 old_isec->sclass, FILE__RENAME, &ad);
1954 if (rc)
1955 return rc;
1956 if (old_is_dir && new_dir != old_dir) {
1957 rc = avc_has_perm(&selinux_state,
1958 sid, old_isec->sid,
1959 old_isec->sclass, DIR__REPARENT, &ad);
1960 if (rc)
1961 return rc;
1962 }
1963
1964 ad.u.dentry = new_dentry;
1965 av = DIR__ADD_NAME | DIR__SEARCH;
1966 if (d_is_positive(new_dentry))
1967 av |= DIR__REMOVE_NAME;
1968 rc = avc_has_perm(&selinux_state,
1969 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1970 if (rc)
1971 return rc;
1972 if (d_is_positive(new_dentry)) {
1973 new_isec = backing_inode_security(new_dentry);
1974 new_is_dir = d_is_dir(new_dentry);
1975 rc = avc_has_perm(&selinux_state,
1976 sid, new_isec->sid,
1977 new_isec->sclass,
1978 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1979 if (rc)
1980 return rc;
1981 }
1982
1983 return 0;
1984 }
1985
1986 /* Check whether a task can perform a filesystem operation. */
1987 static int superblock_has_perm(const struct cred *cred,
1988 struct super_block *sb,
1989 u32 perms,
1990 struct common_audit_data *ad)
1991 {
1992 struct superblock_security_struct *sbsec;
1993 u32 sid = cred_sid(cred);
1994
1995 sbsec = selinux_superblock(sb);
1996 return avc_has_perm(&selinux_state,
1997 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1998 }
1999
2000 /* Convert a Linux mode and permission mask to an access vector. */
2001 static inline u32 file_mask_to_av(int mode, int mask)
2002 {
2003 u32 av = 0;
2004
2005 if (!S_ISDIR(mode)) {
2006 if (mask & MAY_EXEC)
2007 av |= FILE__EXECUTE;
2008 if (mask & MAY_READ)
2009 av |= FILE__READ;
2010
2011 if (mask & MAY_APPEND)
2012 av |= FILE__APPEND;
2013 else if (mask & MAY_WRITE)
2014 av |= FILE__WRITE;
2015
2016 } else {
2017 if (mask & MAY_EXEC)
2018 av |= DIR__SEARCH;
2019 if (mask & MAY_WRITE)
2020 av |= DIR__WRITE;
2021 if (mask & MAY_READ)
2022 av |= DIR__READ;
2023 }
2024
2025 return av;
2026 }
2027
2028 /* Convert a Linux file to an access vector. */
2029 static inline u32 file_to_av(struct file *file)
2030 {
2031 u32 av = 0;
2032
2033 if (file->f_mode & FMODE_READ)
2034 av |= FILE__READ;
2035 if (file->f_mode & FMODE_WRITE) {
2036 if (file->f_flags & O_APPEND)
2037 av |= FILE__APPEND;
2038 else
2039 av |= FILE__WRITE;
2040 }
2041 if (!av) {
2042 /*
2043 * Special file opened with flags 3 for ioctl-only use.
2044 */
2045 av = FILE__IOCTL;
2046 }
2047
2048 return av;
2049 }
2050
2051 /*
2052 * Convert a file to an access vector and include the correct
2053 * open permission.
2054 */
2055 static inline u32 open_file_to_av(struct file *file)
2056 {
2057 u32 av = file_to_av(file);
2058 struct inode *inode = file_inode(file);
2059
2060 if (selinux_policycap_openperm() &&
2061 inode->i_sb->s_magic != SOCKFS_MAGIC)
2062 av |= FILE__OPEN;
2063
2064 return av;
2065 }
2066
2067 /* Hook functions begin here. */
2068
2069 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2070 {
2071 return avc_has_perm(&selinux_state,
2072 current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2073 BINDER__SET_CONTEXT_MGR, NULL);
2074 }
2075
2076 static int selinux_binder_transaction(struct task_struct *from,
2077 struct task_struct *to)
2078 {
2079 u32 mysid = current_sid();
2080 u32 fromsid = task_sid_binder(from);
2081 int rc;
2082
2083 if (mysid != fromsid) {
2084 rc = avc_has_perm(&selinux_state,
2085 mysid, fromsid, SECCLASS_BINDER,
2086 BINDER__IMPERSONATE, NULL);
2087 if (rc)
2088 return rc;
2089 }
2090
2091 return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2092 SECCLASS_BINDER, BINDER__CALL, NULL);
2093 }
2094
2095 static int selinux_binder_transfer_binder(struct task_struct *from,
2096 struct task_struct *to)
2097 {
2098 return avc_has_perm(&selinux_state,
2099 task_sid_binder(from), task_sid_binder(to),
2100 SECCLASS_BINDER, BINDER__TRANSFER,
2101 NULL);
2102 }
2103
2104 static int selinux_binder_transfer_file(struct task_struct *from,
2105 struct task_struct *to,
2106 struct file *file)
2107 {
2108 u32 sid = task_sid_binder(to);
2109 struct file_security_struct *fsec = selinux_file(file);
2110 struct dentry *dentry = file->f_path.dentry;
2111 struct inode_security_struct *isec;
2112 struct common_audit_data ad;
2113 int rc;
2114
2115 ad.type = LSM_AUDIT_DATA_PATH;
2116 ad.u.path = file->f_path;
2117
2118 if (sid != fsec->sid) {
2119 rc = avc_has_perm(&selinux_state,
2120 sid, fsec->sid,
2121 SECCLASS_FD,
2122 FD__USE,
2123 &ad);
2124 if (rc)
2125 return rc;
2126 }
2127
2128 #ifdef CONFIG_BPF_SYSCALL
2129 rc = bpf_fd_pass(file, sid);
2130 if (rc)
2131 return rc;
2132 #endif
2133
2134 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135 return 0;
2136
2137 isec = backing_inode_security(dentry);
2138 return avc_has_perm(&selinux_state,
2139 sid, isec->sid, isec->sclass, file_to_av(file),
2140 &ad);
2141 }
2142
2143 static int selinux_ptrace_access_check(struct task_struct *child,
2144 unsigned int mode)
2145 {
2146 u32 sid = current_sid();
2147 u32 csid = task_sid_obj(child);
2148
2149 if (mode & PTRACE_MODE_READ)
2150 return avc_has_perm(&selinux_state,
2151 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2152
2153 return avc_has_perm(&selinux_state,
2154 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2155 }
2156
2157 static int selinux_ptrace_traceme(struct task_struct *parent)
2158 {
2159 return avc_has_perm(&selinux_state,
2160 task_sid_obj(parent), task_sid_obj(current),
2161 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2162 }
2163
2164 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2165 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2166 {
2167 return avc_has_perm(&selinux_state,
2168 current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2169 PROCESS__GETCAP, NULL);
2170 }
2171
2172 static int selinux_capset(struct cred *new, const struct cred *old,
2173 const kernel_cap_t *effective,
2174 const kernel_cap_t *inheritable,
2175 const kernel_cap_t *permitted)
2176 {
2177 return avc_has_perm(&selinux_state,
2178 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2179 PROCESS__SETCAP, NULL);
2180 }
2181
2182 /*
2183 * (This comment used to live with the selinux_task_setuid hook,
2184 * which was removed).
2185 *
2186 * Since setuid only affects the current process, and since the SELinux
2187 * controls are not based on the Linux identity attributes, SELinux does not
2188 * need to control this operation. However, SELinux does control the use of
2189 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2190 */
2191
2192 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2193 int cap, unsigned int opts)
2194 {
2195 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2196 }
2197
2198 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2199 {
2200 const struct cred *cred = current_cred();
2201 int rc = 0;
2202
2203 if (!sb)
2204 return 0;
2205
2206 switch (cmds) {
2207 case Q_SYNC:
2208 case Q_QUOTAON:
2209 case Q_QUOTAOFF:
2210 case Q_SETINFO:
2211 case Q_SETQUOTA:
2212 case Q_XQUOTAOFF:
2213 case Q_XQUOTAON:
2214 case Q_XSETQLIM:
2215 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2216 break;
2217 case Q_GETFMT:
2218 case Q_GETINFO:
2219 case Q_GETQUOTA:
2220 case Q_XGETQUOTA:
2221 case Q_XGETQSTAT:
2222 case Q_XGETQSTATV:
2223 case Q_XGETNEXTQUOTA:
2224 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2225 break;
2226 default:
2227 rc = 0; /* let the kernel handle invalid cmds */
2228 break;
2229 }
2230 return rc;
2231 }
2232
2233 static int selinux_quota_on(struct dentry *dentry)
2234 {
2235 const struct cred *cred = current_cred();
2236
2237 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2238 }
2239
2240 static int selinux_syslog(int type)
2241 {
2242 switch (type) {
2243 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2244 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2245 return avc_has_perm(&selinux_state,
2246 current_sid(), SECINITSID_KERNEL,
2247 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2248 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2249 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2250 /* Set level of messages printed to console */
2251 case SYSLOG_ACTION_CONSOLE_LEVEL:
2252 return avc_has_perm(&selinux_state,
2253 current_sid(), SECINITSID_KERNEL,
2254 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2255 NULL);
2256 }
2257 /* All other syslog types */
2258 return avc_has_perm(&selinux_state,
2259 current_sid(), SECINITSID_KERNEL,
2260 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2261 }
2262
2263 /*
2264 * Check that a process has enough memory to allocate a new virtual
2265 * mapping. 0 means there is enough memory for the allocation to
2266 * succeed and -ENOMEM implies there is not.
2267 *
2268 * Do not audit the selinux permission check, as this is applied to all
2269 * processes that allocate mappings.
2270 */
2271 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2272 {
2273 int rc, cap_sys_admin = 0;
2274
2275 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2276 CAP_OPT_NOAUDIT, true);
2277 if (rc == 0)
2278 cap_sys_admin = 1;
2279
2280 return cap_sys_admin;
2281 }
2282
2283 /* binprm security operations */
2284
2285 static u32 ptrace_parent_sid(void)
2286 {
2287 u32 sid = 0;
2288 struct task_struct *tracer;
2289
2290 rcu_read_lock();
2291 tracer = ptrace_parent(current);
2292 if (tracer)
2293 sid = task_sid_obj(tracer);
2294 rcu_read_unlock();
2295
2296 return sid;
2297 }
2298
2299 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2300 const struct task_security_struct *old_tsec,
2301 const struct task_security_struct *new_tsec)
2302 {
2303 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2304 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2305 int rc;
2306 u32 av;
2307
2308 if (!nnp && !nosuid)
2309 return 0; /* neither NNP nor nosuid */
2310
2311 if (new_tsec->sid == old_tsec->sid)
2312 return 0; /* No change in credentials */
2313
2314 /*
2315 * If the policy enables the nnp_nosuid_transition policy capability,
2316 * then we permit transitions under NNP or nosuid if the
2317 * policy allows the corresponding permission between
2318 * the old and new contexts.
2319 */
2320 if (selinux_policycap_nnp_nosuid_transition()) {
2321 av = 0;
2322 if (nnp)
2323 av |= PROCESS2__NNP_TRANSITION;
2324 if (nosuid)
2325 av |= PROCESS2__NOSUID_TRANSITION;
2326 rc = avc_has_perm(&selinux_state,
2327 old_tsec->sid, new_tsec->sid,
2328 SECCLASS_PROCESS2, av, NULL);
2329 if (!rc)
2330 return 0;
2331 }
2332
2333 /*
2334 * We also permit NNP or nosuid transitions to bounded SIDs,
2335 * i.e. SIDs that are guaranteed to only be allowed a subset
2336 * of the permissions of the current SID.
2337 */
2338 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2339 new_tsec->sid);
2340 if (!rc)
2341 return 0;
2342
2343 /*
2344 * On failure, preserve the errno values for NNP vs nosuid.
2345 * NNP: Operation not permitted for caller.
2346 * nosuid: Permission denied to file.
2347 */
2348 if (nnp)
2349 return -EPERM;
2350 return -EACCES;
2351 }
2352
2353 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2354 {
2355 const struct task_security_struct *old_tsec;
2356 struct task_security_struct *new_tsec;
2357 struct inode_security_struct *isec;
2358 struct common_audit_data ad;
2359 struct inode *inode = file_inode(bprm->file);
2360 int rc;
2361
2362 /* SELinux context only depends on initial program or script and not
2363 * the script interpreter */
2364
2365 old_tsec = selinux_cred(current_cred());
2366 new_tsec = selinux_cred(bprm->cred);
2367 isec = inode_security(inode);
2368
2369 /* Default to the current task SID. */
2370 new_tsec->sid = old_tsec->sid;
2371 new_tsec->osid = old_tsec->sid;
2372
2373 /* Reset fs, key, and sock SIDs on execve. */
2374 new_tsec->create_sid = 0;
2375 new_tsec->keycreate_sid = 0;
2376 new_tsec->sockcreate_sid = 0;
2377
2378 if (old_tsec->exec_sid) {
2379 new_tsec->sid = old_tsec->exec_sid;
2380 /* Reset exec SID on execve. */
2381 new_tsec->exec_sid = 0;
2382
2383 /* Fail on NNP or nosuid if not an allowed transition. */
2384 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2385 if (rc)
2386 return rc;
2387 } else {
2388 /* Check for a default transition on this program. */
2389 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2390 isec->sid, SECCLASS_PROCESS, NULL,
2391 &new_tsec->sid);
2392 if (rc)
2393 return rc;
2394
2395 /*
2396 * Fallback to old SID on NNP or nosuid if not an allowed
2397 * transition.
2398 */
2399 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2400 if (rc)
2401 new_tsec->sid = old_tsec->sid;
2402 }
2403
2404 ad.type = LSM_AUDIT_DATA_FILE;
2405 ad.u.file = bprm->file;
2406
2407 if (new_tsec->sid == old_tsec->sid) {
2408 rc = avc_has_perm(&selinux_state,
2409 old_tsec->sid, isec->sid,
2410 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2411 if (rc)
2412 return rc;
2413 } else {
2414 /* Check permissions for the transition. */
2415 rc = avc_has_perm(&selinux_state,
2416 old_tsec->sid, new_tsec->sid,
2417 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2418 if (rc)
2419 return rc;
2420
2421 rc = avc_has_perm(&selinux_state,
2422 new_tsec->sid, isec->sid,
2423 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2424 if (rc)
2425 return rc;
2426
2427 /* Check for shared state */
2428 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2429 rc = avc_has_perm(&selinux_state,
2430 old_tsec->sid, new_tsec->sid,
2431 SECCLASS_PROCESS, PROCESS__SHARE,
2432 NULL);
2433 if (rc)
2434 return -EPERM;
2435 }
2436
2437 /* Make sure that anyone attempting to ptrace over a task that
2438 * changes its SID has the appropriate permit */
2439 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2440 u32 ptsid = ptrace_parent_sid();
2441 if (ptsid != 0) {
2442 rc = avc_has_perm(&selinux_state,
2443 ptsid, new_tsec->sid,
2444 SECCLASS_PROCESS,
2445 PROCESS__PTRACE, NULL);
2446 if (rc)
2447 return -EPERM;
2448 }
2449 }
2450
2451 /* Clear any possibly unsafe personality bits on exec: */
2452 bprm->per_clear |= PER_CLEAR_ON_SETID;
2453
2454 /* Enable secure mode for SIDs transitions unless
2455 the noatsecure permission is granted between
2456 the two SIDs, i.e. ahp returns 0. */
2457 rc = avc_has_perm(&selinux_state,
2458 old_tsec->sid, new_tsec->sid,
2459 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2460 NULL);
2461 bprm->secureexec |= !!rc;
2462 }
2463
2464 return 0;
2465 }
2466
2467 static int match_file(const void *p, struct file *file, unsigned fd)
2468 {
2469 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2470 }
2471
2472 /* Derived from fs/exec.c:flush_old_files. */
2473 static inline void flush_unauthorized_files(const struct cred *cred,
2474 struct files_struct *files)
2475 {
2476 struct file *file, *devnull = NULL;
2477 struct tty_struct *tty;
2478 int drop_tty = 0;
2479 unsigned n;
2480
2481 tty = get_current_tty();
2482 if (tty) {
2483 spin_lock(&tty->files_lock);
2484 if (!list_empty(&tty->tty_files)) {
2485 struct tty_file_private *file_priv;
2486
2487 /* Revalidate access to controlling tty.
2488 Use file_path_has_perm on the tty path directly
2489 rather than using file_has_perm, as this particular
2490 open file may belong to another process and we are
2491 only interested in the inode-based check here. */
2492 file_priv = list_first_entry(&tty->tty_files,
2493 struct tty_file_private, list);
2494 file = file_priv->file;
2495 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2496 drop_tty = 1;
2497 }
2498 spin_unlock(&tty->files_lock);
2499 tty_kref_put(tty);
2500 }
2501 /* Reset controlling tty. */
2502 if (drop_tty)
2503 no_tty();
2504
2505 /* Revalidate access to inherited open files. */
2506 n = iterate_fd(files, 0, match_file, cred);
2507 if (!n) /* none found? */
2508 return;
2509
2510 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2511 if (IS_ERR(devnull))
2512 devnull = NULL;
2513 /* replace all the matching ones with this */
2514 do {
2515 replace_fd(n - 1, devnull, 0);
2516 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2517 if (devnull)
2518 fput(devnull);
2519 }
2520
2521 /*
2522 * Prepare a process for imminent new credential changes due to exec
2523 */
2524 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2525 {
2526 struct task_security_struct *new_tsec;
2527 struct rlimit *rlim, *initrlim;
2528 int rc, i;
2529
2530 new_tsec = selinux_cred(bprm->cred);
2531 if (new_tsec->sid == new_tsec->osid)
2532 return;
2533
2534 /* Close files for which the new task SID is not authorized. */
2535 flush_unauthorized_files(bprm->cred, current->files);
2536
2537 /* Always clear parent death signal on SID transitions. */
2538 current->pdeath_signal = 0;
2539
2540 /* Check whether the new SID can inherit resource limits from the old
2541 * SID. If not, reset all soft limits to the lower of the current
2542 * task's hard limit and the init task's soft limit.
2543 *
2544 * Note that the setting of hard limits (even to lower them) can be
2545 * controlled by the setrlimit check. The inclusion of the init task's
2546 * soft limit into the computation is to avoid resetting soft limits
2547 * higher than the default soft limit for cases where the default is
2548 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2549 */
2550 rc = avc_has_perm(&selinux_state,
2551 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2552 PROCESS__RLIMITINH, NULL);
2553 if (rc) {
2554 /* protect against do_prlimit() */
2555 task_lock(current);
2556 for (i = 0; i < RLIM_NLIMITS; i++) {
2557 rlim = current->signal->rlim + i;
2558 initrlim = init_task.signal->rlim + i;
2559 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2560 }
2561 task_unlock(current);
2562 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2563 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2564 }
2565 }
2566
2567 /*
2568 * Clean up the process immediately after the installation of new credentials
2569 * due to exec
2570 */
2571 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2572 {
2573 const struct task_security_struct *tsec = selinux_cred(current_cred());
2574 u32 osid, sid;
2575 int rc;
2576
2577 osid = tsec->osid;
2578 sid = tsec->sid;
2579
2580 if (sid == osid)
2581 return;
2582
2583 /* Check whether the new SID can inherit signal state from the old SID.
2584 * If not, clear itimers to avoid subsequent signal generation and
2585 * flush and unblock signals.
2586 *
2587 * This must occur _after_ the task SID has been updated so that any
2588 * kill done after the flush will be checked against the new SID.
2589 */
2590 rc = avc_has_perm(&selinux_state,
2591 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2592 if (rc) {
2593 clear_itimer();
2594
2595 spin_lock_irq(&current->sighand->siglock);
2596 if (!fatal_signal_pending(current)) {
2597 flush_sigqueue(&current->pending);
2598 flush_sigqueue(&current->signal->shared_pending);
2599 flush_signal_handlers(current, 1);
2600 sigemptyset(&current->blocked);
2601 recalc_sigpending();
2602 }
2603 spin_unlock_irq(&current->sighand->siglock);
2604 }
2605
2606 /* Wake up the parent if it is waiting so that it can recheck
2607 * wait permission to the new task SID. */
2608 read_lock(&tasklist_lock);
2609 __wake_up_parent(current, current->real_parent);
2610 read_unlock(&tasklist_lock);
2611 }
2612
2613 /* superblock security operations */
2614
2615 static int selinux_sb_alloc_security(struct super_block *sb)
2616 {
2617 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2618
2619 mutex_init(&sbsec->lock);
2620 INIT_LIST_HEAD(&sbsec->isec_head);
2621 spin_lock_init(&sbsec->isec_lock);
2622 sbsec->sid = SECINITSID_UNLABELED;
2623 sbsec->def_sid = SECINITSID_FILE;
2624 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2625
2626 return 0;
2627 }
2628
2629 static inline int opt_len(const char *s)
2630 {
2631 bool open_quote = false;
2632 int len;
2633 char c;
2634
2635 for (len = 0; (c = s[len]) != '\0'; len++) {
2636 if (c == '"')
2637 open_quote = !open_quote;
2638 if (c == ',' && !open_quote)
2639 break;
2640 }
2641 return len;
2642 }
2643
2644 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2645 {
2646 char *from = options;
2647 char *to = options;
2648 bool first = true;
2649 int rc;
2650
2651 while (1) {
2652 int len = opt_len(from);
2653 int token;
2654 char *arg = NULL;
2655
2656 token = match_opt_prefix(from, len, &arg);
2657
2658 if (token != Opt_error) {
2659 char *p, *q;
2660
2661 /* strip quotes */
2662 if (arg) {
2663 for (p = q = arg; p < from + len; p++) {
2664 char c = *p;
2665 if (c != '"')
2666 *q++ = c;
2667 }
2668 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2669 if (!arg) {
2670 rc = -ENOMEM;
2671 goto free_opt;
2672 }
2673 }
2674 rc = selinux_add_opt(token, arg, mnt_opts);
2675 if (unlikely(rc)) {
2676 kfree(arg);
2677 goto free_opt;
2678 }
2679 } else {
2680 if (!first) { // copy with preceding comma
2681 from--;
2682 len++;
2683 }
2684 if (to != from)
2685 memmove(to, from, len);
2686 to += len;
2687 first = false;
2688 }
2689 if (!from[len])
2690 break;
2691 from += len + 1;
2692 }
2693 *to = '\0';
2694 return 0;
2695
2696 free_opt:
2697 if (*mnt_opts) {
2698 selinux_free_mnt_opts(*mnt_opts);
2699 *mnt_opts = NULL;
2700 }
2701 return rc;
2702 }
2703
2704 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2705 {
2706 struct selinux_mnt_opts *opts = mnt_opts;
2707 struct superblock_security_struct *sbsec = sb->s_security;
2708 u32 sid;
2709 int rc;
2710
2711 /*
2712 * Superblock not initialized (i.e. no options) - reject if any
2713 * options specified, otherwise accept.
2714 */
2715 if (!(sbsec->flags & SE_SBINITIALIZED))
2716 return opts ? 1 : 0;
2717
2718 /*
2719 * Superblock initialized and no options specified - reject if
2720 * superblock has any options set, otherwise accept.
2721 */
2722 if (!opts)
2723 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2724
2725 if (opts->fscontext) {
2726 rc = parse_sid(sb, opts->fscontext, &sid);
2727 if (rc)
2728 return 1;
2729 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2730 return 1;
2731 }
2732 if (opts->context) {
2733 rc = parse_sid(sb, opts->context, &sid);
2734 if (rc)
2735 return 1;
2736 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2737 return 1;
2738 }
2739 if (opts->rootcontext) {
2740 struct inode_security_struct *root_isec;
2741
2742 root_isec = backing_inode_security(sb->s_root);
2743 rc = parse_sid(sb, opts->rootcontext, &sid);
2744 if (rc)
2745 return 1;
2746 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2747 return 1;
2748 }
2749 if (opts->defcontext) {
2750 rc = parse_sid(sb, opts->defcontext, &sid);
2751 if (rc)
2752 return 1;
2753 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2754 return 1;
2755 }
2756 return 0;
2757 }
2758
2759 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2760 {
2761 struct selinux_mnt_opts *opts = mnt_opts;
2762 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2763 u32 sid;
2764 int rc;
2765
2766 if (!(sbsec->flags & SE_SBINITIALIZED))
2767 return 0;
2768
2769 if (!opts)
2770 return 0;
2771
2772 if (opts->fscontext) {
2773 rc = parse_sid(sb, opts->fscontext, &sid);
2774 if (rc)
2775 return rc;
2776 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2777 goto out_bad_option;
2778 }
2779 if (opts->context) {
2780 rc = parse_sid(sb, opts->context, &sid);
2781 if (rc)
2782 return rc;
2783 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2784 goto out_bad_option;
2785 }
2786 if (opts->rootcontext) {
2787 struct inode_security_struct *root_isec;
2788 root_isec = backing_inode_security(sb->s_root);
2789 rc = parse_sid(sb, opts->rootcontext, &sid);
2790 if (rc)
2791 return rc;
2792 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2793 goto out_bad_option;
2794 }
2795 if (opts->defcontext) {
2796 rc = parse_sid(sb, opts->defcontext, &sid);
2797 if (rc)
2798 return rc;
2799 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2800 goto out_bad_option;
2801 }
2802 return 0;
2803
2804 out_bad_option:
2805 pr_warn("SELinux: unable to change security options "
2806 "during remount (dev %s, type=%s)\n", sb->s_id,
2807 sb->s_type->name);
2808 return -EINVAL;
2809 }
2810
2811 static int selinux_sb_kern_mount(struct super_block *sb)
2812 {
2813 const struct cred *cred = current_cred();
2814 struct common_audit_data ad;
2815
2816 ad.type = LSM_AUDIT_DATA_DENTRY;
2817 ad.u.dentry = sb->s_root;
2818 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2819 }
2820
2821 static int selinux_sb_statfs(struct dentry *dentry)
2822 {
2823 const struct cred *cred = current_cred();
2824 struct common_audit_data ad;
2825
2826 ad.type = LSM_AUDIT_DATA_DENTRY;
2827 ad.u.dentry = dentry->d_sb->s_root;
2828 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2829 }
2830
2831 static int selinux_mount(const char *dev_name,
2832 const struct path *path,
2833 const char *type,
2834 unsigned long flags,
2835 void *data)
2836 {
2837 const struct cred *cred = current_cred();
2838
2839 if (flags & MS_REMOUNT)
2840 return superblock_has_perm(cred, path->dentry->d_sb,
2841 FILESYSTEM__REMOUNT, NULL);
2842 else
2843 return path_has_perm(cred, path, FILE__MOUNTON);
2844 }
2845
2846 static int selinux_move_mount(const struct path *from_path,
2847 const struct path *to_path)
2848 {
2849 const struct cred *cred = current_cred();
2850
2851 return path_has_perm(cred, to_path, FILE__MOUNTON);
2852 }
2853
2854 static int selinux_umount(struct vfsmount *mnt, int flags)
2855 {
2856 const struct cred *cred = current_cred();
2857
2858 return superblock_has_perm(cred, mnt->mnt_sb,
2859 FILESYSTEM__UNMOUNT, NULL);
2860 }
2861
2862 static int selinux_fs_context_dup(struct fs_context *fc,
2863 struct fs_context *src_fc)
2864 {
2865 const struct selinux_mnt_opts *src = src_fc->security;
2866 struct selinux_mnt_opts *opts;
2867
2868 if (!src)
2869 return 0;
2870
2871 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2872 if (!fc->security)
2873 return -ENOMEM;
2874
2875 opts = fc->security;
2876
2877 if (src->fscontext) {
2878 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2879 if (!opts->fscontext)
2880 return -ENOMEM;
2881 }
2882 if (src->context) {
2883 opts->context = kstrdup(src->context, GFP_KERNEL);
2884 if (!opts->context)
2885 return -ENOMEM;
2886 }
2887 if (src->rootcontext) {
2888 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2889 if (!opts->rootcontext)
2890 return -ENOMEM;
2891 }
2892 if (src->defcontext) {
2893 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2894 if (!opts->defcontext)
2895 return -ENOMEM;
2896 }
2897 return 0;
2898 }
2899
2900 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2901 fsparam_string(CONTEXT_STR, Opt_context),
2902 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2903 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2904 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2905 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2906 {}
2907 };
2908
2909 static int selinux_fs_context_parse_param(struct fs_context *fc,
2910 struct fs_parameter *param)
2911 {
2912 struct fs_parse_result result;
2913 int opt, rc;
2914
2915 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2916 if (opt < 0)
2917 return opt;
2918
2919 rc = selinux_add_opt(opt, param->string, &fc->security);
2920 if (!rc) {
2921 param->string = NULL;
2922 rc = 1;
2923 }
2924 return rc;
2925 }
2926
2927 /* inode security operations */
2928
2929 static int selinux_inode_alloc_security(struct inode *inode)
2930 {
2931 struct inode_security_struct *isec = selinux_inode(inode);
2932 u32 sid = current_sid();
2933
2934 spin_lock_init(&isec->lock);
2935 INIT_LIST_HEAD(&isec->list);
2936 isec->inode = inode;
2937 isec->sid = SECINITSID_UNLABELED;
2938 isec->sclass = SECCLASS_FILE;
2939 isec->task_sid = sid;
2940 isec->initialized = LABEL_INVALID;
2941
2942 return 0;
2943 }
2944
2945 static void selinux_inode_free_security(struct inode *inode)
2946 {
2947 inode_free_security(inode);
2948 }
2949
2950 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2951 const struct qstr *name, void **ctx,
2952 u32 *ctxlen)
2953 {
2954 u32 newsid;
2955 int rc;
2956
2957 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2958 d_inode(dentry->d_parent), name,
2959 inode_mode_to_security_class(mode),
2960 &newsid);
2961 if (rc)
2962 return rc;
2963
2964 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2965 ctxlen);
2966 }
2967
2968 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2969 struct qstr *name,
2970 const struct cred *old,
2971 struct cred *new)
2972 {
2973 u32 newsid;
2974 int rc;
2975 struct task_security_struct *tsec;
2976
2977 rc = selinux_determine_inode_label(selinux_cred(old),
2978 d_inode(dentry->d_parent), name,
2979 inode_mode_to_security_class(mode),
2980 &newsid);
2981 if (rc)
2982 return rc;
2983
2984 tsec = selinux_cred(new);
2985 tsec->create_sid = newsid;
2986 return 0;
2987 }
2988
2989 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2990 const struct qstr *qstr,
2991 const char **name,
2992 void **value, size_t *len)
2993 {
2994 const struct task_security_struct *tsec = selinux_cred(current_cred());
2995 struct superblock_security_struct *sbsec;
2996 u32 newsid, clen;
2997 int rc;
2998 char *context;
2999
3000 sbsec = selinux_superblock(dir->i_sb);
3001
3002 newsid = tsec->create_sid;
3003
3004 rc = selinux_determine_inode_label(tsec, dir, qstr,
3005 inode_mode_to_security_class(inode->i_mode),
3006 &newsid);
3007 if (rc)
3008 return rc;
3009
3010 /* Possibly defer initialization to selinux_complete_init. */
3011 if (sbsec->flags & SE_SBINITIALIZED) {
3012 struct inode_security_struct *isec = selinux_inode(inode);
3013 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3014 isec->sid = newsid;
3015 isec->initialized = LABEL_INITIALIZED;
3016 }
3017
3018 if (!selinux_initialized(&selinux_state) ||
3019 !(sbsec->flags & SBLABEL_MNT))
3020 return -EOPNOTSUPP;
3021
3022 if (name)
3023 *name = XATTR_SELINUX_SUFFIX;
3024
3025 if (value && len) {
3026 rc = security_sid_to_context_force(&selinux_state, newsid,
3027 &context, &clen);
3028 if (rc)
3029 return rc;
3030 *value = context;
3031 *len = clen;
3032 }
3033
3034 return 0;
3035 }
3036
3037 static int selinux_inode_init_security_anon(struct inode *inode,
3038 const struct qstr *name,
3039 const struct inode *context_inode)
3040 {
3041 const struct task_security_struct *tsec = selinux_cred(current_cred());
3042 struct common_audit_data ad;
3043 struct inode_security_struct *isec;
3044 int rc;
3045
3046 if (unlikely(!selinux_initialized(&selinux_state)))
3047 return 0;
3048
3049 isec = selinux_inode(inode);
3050
3051 /*
3052 * We only get here once per ephemeral inode. The inode has
3053 * been initialized via inode_alloc_security but is otherwise
3054 * untouched.
3055 */
3056
3057 if (context_inode) {
3058 struct inode_security_struct *context_isec =
3059 selinux_inode(context_inode);
3060 if (context_isec->initialized != LABEL_INITIALIZED) {
3061 pr_err("SELinux: context_inode is not initialized");
3062 return -EACCES;
3063 }
3064
3065 isec->sclass = context_isec->sclass;
3066 isec->sid = context_isec->sid;
3067 } else {
3068 isec->sclass = SECCLASS_ANON_INODE;
3069 rc = security_transition_sid(
3070 &selinux_state, tsec->sid, tsec->sid,
3071 isec->sclass, name, &isec->sid);
3072 if (rc)
3073 return rc;
3074 }
3075
3076 isec->initialized = LABEL_INITIALIZED;
3077 /*
3078 * Now that we've initialized security, check whether we're
3079 * allowed to actually create this type of anonymous inode.
3080 */
3081
3082 ad.type = LSM_AUDIT_DATA_INODE;
3083 ad.u.inode = inode;
3084
3085 return avc_has_perm(&selinux_state,
3086 tsec->sid,
3087 isec->sid,
3088 isec->sclass,
3089 FILE__CREATE,
3090 &ad);
3091 }
3092
3093 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3094 {
3095 return may_create(dir, dentry, SECCLASS_FILE);
3096 }
3097
3098 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3099 {
3100 return may_link(dir, old_dentry, MAY_LINK);
3101 }
3102
3103 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3104 {
3105 return may_link(dir, dentry, MAY_UNLINK);
3106 }
3107
3108 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3109 {
3110 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3111 }
3112
3113 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3114 {
3115 return may_create(dir, dentry, SECCLASS_DIR);
3116 }
3117
3118 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3119 {
3120 return may_link(dir, dentry, MAY_RMDIR);
3121 }
3122
3123 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3124 {
3125 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3126 }
3127
3128 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3129 struct inode *new_inode, struct dentry *new_dentry)
3130 {
3131 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3132 }
3133
3134 static int selinux_inode_readlink(struct dentry *dentry)
3135 {
3136 const struct cred *cred = current_cred();
3137
3138 return dentry_has_perm(cred, dentry, FILE__READ);
3139 }
3140
3141 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3142 bool rcu)
3143 {
3144 const struct cred *cred = current_cred();
3145 struct common_audit_data ad;
3146 struct inode_security_struct *isec;
3147 u32 sid;
3148
3149 validate_creds(cred);
3150
3151 ad.type = LSM_AUDIT_DATA_DENTRY;
3152 ad.u.dentry = dentry;
3153 sid = cred_sid(cred);
3154 isec = inode_security_rcu(inode, rcu);
3155 if (IS_ERR(isec))
3156 return PTR_ERR(isec);
3157
3158 return avc_has_perm(&selinux_state,
3159 sid, isec->sid, isec->sclass, FILE__READ, &ad);
3160 }
3161
3162 static noinline int audit_inode_permission(struct inode *inode,
3163 u32 perms, u32 audited, u32 denied,
3164 int result)
3165 {
3166 struct common_audit_data ad;
3167 struct inode_security_struct *isec = selinux_inode(inode);
3168
3169 ad.type = LSM_AUDIT_DATA_INODE;
3170 ad.u.inode = inode;
3171
3172 return slow_avc_audit(&selinux_state,
3173 current_sid(), isec->sid, isec->sclass, perms,
3174 audited, denied, result, &ad);
3175 }
3176
3177 static int selinux_inode_permission(struct inode *inode, int mask)
3178 {
3179 const struct cred *cred = current_cred();
3180 u32 perms;
3181 bool from_access;
3182 bool no_block = mask & MAY_NOT_BLOCK;
3183 struct inode_security_struct *isec;
3184 u32 sid;
3185 struct av_decision avd;
3186 int rc, rc2;
3187 u32 audited, denied;
3188
3189 from_access = mask & MAY_ACCESS;
3190 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3191
3192 /* No permission to check. Existence test. */
3193 if (!mask)
3194 return 0;
3195
3196 validate_creds(cred);
3197
3198 if (unlikely(IS_PRIVATE(inode)))
3199 return 0;
3200
3201 perms = file_mask_to_av(inode->i_mode, mask);
3202
3203 sid = cred_sid(cred);
3204 isec = inode_security_rcu(inode, no_block);
3205 if (IS_ERR(isec))
3206 return PTR_ERR(isec);
3207
3208 rc = avc_has_perm_noaudit(&selinux_state,
3209 sid, isec->sid, isec->sclass, perms, 0,
3210 &avd);
3211 audited = avc_audit_required(perms, &avd, rc,
3212 from_access ? FILE__AUDIT_ACCESS : 0,
3213 &denied);
3214 if (likely(!audited))
3215 return rc;
3216
3217 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3218 if (rc2)
3219 return rc2;
3220 return rc;
3221 }
3222
3223 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3224 {
3225 const struct cred *cred = current_cred();
3226 struct inode *inode = d_backing_inode(dentry);
3227 unsigned int ia_valid = iattr->ia_valid;
3228 __u32 av = FILE__WRITE;
3229
3230 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3231 if (ia_valid & ATTR_FORCE) {
3232 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3233 ATTR_FORCE);
3234 if (!ia_valid)
3235 return 0;
3236 }
3237
3238 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3239 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3240 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3241
3242 if (selinux_policycap_openperm() &&
3243 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3244 (ia_valid & ATTR_SIZE) &&
3245 !(ia_valid & ATTR_FILE))
3246 av |= FILE__OPEN;
3247
3248 return dentry_has_perm(cred, dentry, av);
3249 }
3250
3251 static int selinux_inode_getattr(const struct path *path)
3252 {
3253 return path_has_perm(current_cred(), path, FILE__GETATTR);
3254 }
3255
3256 static bool has_cap_mac_admin(bool audit)
3257 {
3258 const struct cred *cred = current_cred();
3259 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3260
3261 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3262 return false;
3263 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3264 return false;
3265 return true;
3266 }
3267
3268 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3269 struct dentry *dentry, const char *name,
3270 const void *value, size_t size, int flags)
3271 {
3272 struct inode *inode = d_backing_inode(dentry);
3273 struct inode_security_struct *isec;
3274 struct superblock_security_struct *sbsec;
3275 struct common_audit_data ad;
3276 u32 newsid, sid = current_sid();
3277 int rc = 0;
3278
3279 if (strcmp(name, XATTR_NAME_SELINUX)) {
3280 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3281 if (rc)
3282 return rc;
3283
3284 /* Not an attribute we recognize, so just check the
3285 ordinary setattr permission. */
3286 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3287 }
3288
3289 if (!selinux_initialized(&selinux_state))
3290 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3291
3292 sbsec = selinux_superblock(inode->i_sb);
3293 if (!(sbsec->flags & SBLABEL_MNT))
3294 return -EOPNOTSUPP;
3295
3296 if (!inode_owner_or_capable(mnt_userns, inode))
3297 return -EPERM;
3298
3299 ad.type = LSM_AUDIT_DATA_DENTRY;
3300 ad.u.dentry = dentry;
3301
3302 isec = backing_inode_security(dentry);
3303 rc = avc_has_perm(&selinux_state,
3304 sid, isec->sid, isec->sclass,
3305 FILE__RELABELFROM, &ad);
3306 if (rc)
3307 return rc;
3308
3309 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3310 GFP_KERNEL);
3311 if (rc == -EINVAL) {
3312 if (!has_cap_mac_admin(true)) {
3313 struct audit_buffer *ab;
3314 size_t audit_size;
3315
3316 /* We strip a nul only if it is at the end, otherwise the
3317 * context contains a nul and we should audit that */
3318 if (value) {
3319 const char *str = value;
3320
3321 if (str[size - 1] == '\0')
3322 audit_size = size - 1;
3323 else
3324 audit_size = size;
3325 } else {
3326 audit_size = 0;
3327 }
3328 ab = audit_log_start(audit_context(),
3329 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3330 if (!ab)
3331 return rc;
3332 audit_log_format(ab, "op=setxattr invalid_context=");
3333 audit_log_n_untrustedstring(ab, value, audit_size);
3334 audit_log_end(ab);
3335
3336 return rc;
3337 }
3338 rc = security_context_to_sid_force(&selinux_state, value,
3339 size, &newsid);
3340 }
3341 if (rc)
3342 return rc;
3343
3344 rc = avc_has_perm(&selinux_state,
3345 sid, newsid, isec->sclass,
3346 FILE__RELABELTO, &ad);
3347 if (rc)
3348 return rc;
3349
3350 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3351 sid, isec->sclass);
3352 if (rc)
3353 return rc;
3354
3355 return avc_has_perm(&selinux_state,
3356 newsid,
3357 sbsec->sid,
3358 SECCLASS_FILESYSTEM,
3359 FILESYSTEM__ASSOCIATE,
3360 &ad);
3361 }
3362
3363 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3364 const void *value, size_t size,
3365 int flags)
3366 {
3367 struct inode *inode = d_backing_inode(dentry);
3368 struct inode_security_struct *isec;
3369 u32 newsid;
3370 int rc;
3371
3372 if (strcmp(name, XATTR_NAME_SELINUX)) {
3373 /* Not an attribute we recognize, so nothing to do. */
3374 return;
3375 }
3376
3377 if (!selinux_initialized(&selinux_state)) {
3378 /* If we haven't even been initialized, then we can't validate
3379 * against a policy, so leave the label as invalid. It may
3380 * resolve to a valid label on the next revalidation try if
3381 * we've since initialized.
3382 */
3383 return;
3384 }
3385
3386 rc = security_context_to_sid_force(&selinux_state, value, size,
3387 &newsid);
3388 if (rc) {
3389 pr_err("SELinux: unable to map context to SID"
3390 "for (%s, %lu), rc=%d\n",
3391 inode->i_sb->s_id, inode->i_ino, -rc);
3392 return;
3393 }
3394
3395 isec = backing_inode_security(dentry);
3396 spin_lock(&isec->lock);
3397 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3398 isec->sid = newsid;
3399 isec->initialized = LABEL_INITIALIZED;
3400 spin_unlock(&isec->lock);
3401
3402 return;
3403 }
3404
3405 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3406 {
3407 const struct cred *cred = current_cred();
3408
3409 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3410 }
3411
3412 static int selinux_inode_listxattr(struct dentry *dentry)
3413 {
3414 const struct cred *cred = current_cred();
3415
3416 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3417 }
3418
3419 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3420 struct dentry *dentry, const char *name)
3421 {
3422 if (strcmp(name, XATTR_NAME_SELINUX)) {
3423 int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3424 if (rc)
3425 return rc;
3426
3427 /* Not an attribute we recognize, so just check the
3428 ordinary setattr permission. */
3429 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3430 }
3431
3432 if (!selinux_initialized(&selinux_state))
3433 return 0;
3434
3435 /* No one is allowed to remove a SELinux security label.
3436 You can change the label, but all data must be labeled. */
3437 return -EACCES;
3438 }
3439
3440 static int selinux_path_notify(const struct path *path, u64 mask,
3441 unsigned int obj_type)
3442 {
3443 int ret;
3444 u32 perm;
3445
3446 struct common_audit_data ad;
3447
3448 ad.type = LSM_AUDIT_DATA_PATH;
3449 ad.u.path = *path;
3450
3451 /*
3452 * Set permission needed based on the type of mark being set.
3453 * Performs an additional check for sb watches.
3454 */
3455 switch (obj_type) {
3456 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3457 perm = FILE__WATCH_MOUNT;
3458 break;
3459 case FSNOTIFY_OBJ_TYPE_SB:
3460 perm = FILE__WATCH_SB;
3461 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3462 FILESYSTEM__WATCH, &ad);
3463 if (ret)
3464 return ret;
3465 break;
3466 case FSNOTIFY_OBJ_TYPE_INODE:
3467 perm = FILE__WATCH;
3468 break;
3469 default:
3470 return -EINVAL;
3471 }
3472
3473 /* blocking watches require the file:watch_with_perm permission */
3474 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3475 perm |= FILE__WATCH_WITH_PERM;
3476
3477 /* watches on read-like events need the file:watch_reads permission */
3478 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3479 perm |= FILE__WATCH_READS;
3480
3481 return path_has_perm(current_cred(), path, perm);
3482 }
3483
3484 /*
3485 * Copy the inode security context value to the user.
3486 *
3487 * Permission check is handled by selinux_inode_getxattr hook.
3488 */
3489 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3490 struct inode *inode, const char *name,
3491 void **buffer, bool alloc)
3492 {
3493 u32 size;
3494 int error;
3495 char *context = NULL;
3496 struct inode_security_struct *isec;
3497
3498 /*
3499 * If we're not initialized yet, then we can't validate contexts, so
3500 * just let vfs_getxattr fall back to using the on-disk xattr.
3501 */
3502 if (!selinux_initialized(&selinux_state) ||
3503 strcmp(name, XATTR_SELINUX_SUFFIX))
3504 return -EOPNOTSUPP;
3505
3506 /*
3507 * If the caller has CAP_MAC_ADMIN, then get the raw context
3508 * value even if it is not defined by current policy; otherwise,
3509 * use the in-core value under current policy.
3510 * Use the non-auditing forms of the permission checks since
3511 * getxattr may be called by unprivileged processes commonly
3512 * and lack of permission just means that we fall back to the
3513 * in-core context value, not a denial.
3514 */
3515 isec = inode_security(inode);
3516 if (has_cap_mac_admin(false))
3517 error = security_sid_to_context_force(&selinux_state,
3518 isec->sid, &context,
3519 &size);
3520 else
3521 error = security_sid_to_context(&selinux_state, isec->sid,
3522 &context, &size);
3523 if (error)
3524 return error;
3525 error = size;
3526 if (alloc) {
3527 *buffer = context;
3528 goto out_nofree;
3529 }
3530 kfree(context);
3531 out_nofree:
3532 return error;
3533 }
3534
3535 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3536 const void *value, size_t size, int flags)
3537 {
3538 struct inode_security_struct *isec = inode_security_novalidate(inode);
3539 struct superblock_security_struct *sbsec;
3540 u32 newsid;
3541 int rc;
3542
3543 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3544 return -EOPNOTSUPP;
3545
3546 sbsec = selinux_superblock(inode->i_sb);
3547 if (!(sbsec->flags & SBLABEL_MNT))
3548 return -EOPNOTSUPP;
3549
3550 if (!value || !size)
3551 return -EACCES;
3552
3553 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3554 GFP_KERNEL);
3555 if (rc)
3556 return rc;
3557
3558 spin_lock(&isec->lock);
3559 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3560 isec->sid = newsid;
3561 isec->initialized = LABEL_INITIALIZED;
3562 spin_unlock(&isec->lock);
3563 return 0;
3564 }
3565
3566 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3567 {
3568 const int len = sizeof(XATTR_NAME_SELINUX);
3569
3570 if (!selinux_initialized(&selinux_state))
3571 return 0;
3572
3573 if (buffer && len <= buffer_size)
3574 memcpy(buffer, XATTR_NAME_SELINUX, len);
3575 return len;
3576 }
3577
3578 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3579 {
3580 struct inode_security_struct *isec = inode_security_novalidate(inode);
3581 *secid = isec->sid;
3582 }
3583
3584 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3585 {
3586 u32 sid;
3587 struct task_security_struct *tsec;
3588 struct cred *new_creds = *new;
3589
3590 if (new_creds == NULL) {
3591 new_creds = prepare_creds();
3592 if (!new_creds)
3593 return -ENOMEM;
3594 }
3595
3596 tsec = selinux_cred(new_creds);
3597 /* Get label from overlay inode and set it in create_sid */
3598 selinux_inode_getsecid(d_inode(src), &sid);
3599 tsec->create_sid = sid;
3600 *new = new_creds;
3601 return 0;
3602 }
3603
3604 static int selinux_inode_copy_up_xattr(const char *name)
3605 {
3606 /* The copy_up hook above sets the initial context on an inode, but we
3607 * don't then want to overwrite it by blindly copying all the lower
3608 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3609 */
3610 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3611 return 1; /* Discard */
3612 /*
3613 * Any other attribute apart from SELINUX is not claimed, supported
3614 * by selinux.
3615 */
3616 return -EOPNOTSUPP;
3617 }
3618
3619 /* kernfs node operations */
3620
3621 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3622 struct kernfs_node *kn)
3623 {
3624 const struct task_security_struct *tsec = selinux_cred(current_cred());
3625 u32 parent_sid, newsid, clen;
3626 int rc;
3627 char *context;
3628
3629 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3630 if (rc == -ENODATA)
3631 return 0;
3632 else if (rc < 0)
3633 return rc;
3634
3635 clen = (u32)rc;
3636 context = kmalloc(clen, GFP_KERNEL);
3637 if (!context)
3638 return -ENOMEM;
3639
3640 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3641 if (rc < 0) {
3642 kfree(context);
3643 return rc;
3644 }
3645
3646 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3647 GFP_KERNEL);
3648 kfree(context);
3649 if (rc)
3650 return rc;
3651
3652 if (tsec->create_sid) {
3653 newsid = tsec->create_sid;
3654 } else {
3655 u16 secclass = inode_mode_to_security_class(kn->mode);
3656 struct qstr q;
3657
3658 q.name = kn->name;
3659 q.hash_len = hashlen_string(kn_dir, kn->name);
3660
3661 rc = security_transition_sid(&selinux_state, tsec->sid,
3662 parent_sid, secclass, &q,
3663 &newsid);
3664 if (rc)
3665 return rc;
3666 }
3667
3668 rc = security_sid_to_context_force(&selinux_state, newsid,
3669 &context, &clen);
3670 if (rc)
3671 return rc;
3672
3673 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3674 XATTR_CREATE);
3675 kfree(context);
3676 return rc;
3677 }
3678
3679
3680 /* file security operations */
3681
3682 static int selinux_revalidate_file_permission(struct file *file, int mask)
3683 {
3684 const struct cred *cred = current_cred();
3685 struct inode *inode = file_inode(file);
3686
3687 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3688 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3689 mask |= MAY_APPEND;
3690
3691 return file_has_perm(cred, file,
3692 file_mask_to_av(inode->i_mode, mask));
3693 }
3694
3695 static int selinux_file_permission(struct file *file, int mask)
3696 {
3697 struct inode *inode = file_inode(file);
3698 struct file_security_struct *fsec = selinux_file(file);
3699 struct inode_security_struct *isec;
3700 u32 sid = current_sid();
3701
3702 if (!mask)
3703 /* No permission to check. Existence test. */
3704 return 0;
3705
3706 isec = inode_security(inode);
3707 if (sid == fsec->sid && fsec->isid == isec->sid &&
3708 fsec->pseqno == avc_policy_seqno(&selinux_state))
3709 /* No change since file_open check. */
3710 return 0;
3711
3712 return selinux_revalidate_file_permission(file, mask);
3713 }
3714
3715 static int selinux_file_alloc_security(struct file *file)
3716 {
3717 struct file_security_struct *fsec = selinux_file(file);
3718 u32 sid = current_sid();
3719
3720 fsec->sid = sid;
3721 fsec->fown_sid = sid;
3722
3723 return 0;
3724 }
3725
3726 /*
3727 * Check whether a task has the ioctl permission and cmd
3728 * operation to an inode.
3729 */
3730 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3731 u32 requested, u16 cmd)
3732 {
3733 struct common_audit_data ad;
3734 struct file_security_struct *fsec = selinux_file(file);
3735 struct inode *inode = file_inode(file);
3736 struct inode_security_struct *isec;
3737 struct lsm_ioctlop_audit ioctl;
3738 u32 ssid = cred_sid(cred);
3739 int rc;
3740 u8 driver = cmd >> 8;
3741 u8 xperm = cmd & 0xff;
3742
3743 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3744 ad.u.op = &ioctl;
3745 ad.u.op->cmd = cmd;
3746 ad.u.op->path = file->f_path;
3747
3748 if (ssid != fsec->sid) {
3749 rc = avc_has_perm(&selinux_state,
3750 ssid, fsec->sid,
3751 SECCLASS_FD,
3752 FD__USE,
3753 &ad);
3754 if (rc)
3755 goto out;
3756 }
3757
3758 if (unlikely(IS_PRIVATE(inode)))
3759 return 0;
3760
3761 isec = inode_security(inode);
3762 rc = avc_has_extended_perms(&selinux_state,
3763 ssid, isec->sid, isec->sclass,
3764 requested, driver, xperm, &ad);
3765 out:
3766 return rc;
3767 }
3768
3769 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3770 unsigned long arg)
3771 {
3772 const struct cred *cred = current_cred();
3773 int error = 0;
3774
3775 switch (cmd) {
3776 case FIONREAD:
3777 case FIBMAP:
3778 case FIGETBSZ:
3779 case FS_IOC_GETFLAGS:
3780 case FS_IOC_GETVERSION:
3781 error = file_has_perm(cred, file, FILE__GETATTR);
3782 break;
3783
3784 case FS_IOC_SETFLAGS:
3785 case FS_IOC_SETVERSION:
3786 error = file_has_perm(cred, file, FILE__SETATTR);
3787 break;
3788
3789 /* sys_ioctl() checks */
3790 case FIONBIO:
3791 case FIOASYNC:
3792 error = file_has_perm(cred, file, 0);
3793 break;
3794
3795 case KDSKBENT:
3796 case KDSKBSENT:
3797 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3798 CAP_OPT_NONE, true);
3799 break;
3800
3801 /* default case assumes that the command will go
3802 * to the file's ioctl() function.
3803 */
3804 default:
3805 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3806 }
3807 return error;
3808 }
3809
3810 static int default_noexec __ro_after_init;
3811
3812 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3813 {
3814 const struct cred *cred = current_cred();
3815 u32 sid = cred_sid(cred);
3816 int rc = 0;
3817
3818 if (default_noexec &&
3819 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3820 (!shared && (prot & PROT_WRITE)))) {
3821 /*
3822 * We are making executable an anonymous mapping or a
3823 * private file mapping that will also be writable.
3824 * This has an additional check.
3825 */
3826 rc = avc_has_perm(&selinux_state,
3827 sid, sid, SECCLASS_PROCESS,
3828 PROCESS__EXECMEM, NULL);
3829 if (rc)
3830 goto error;
3831 }
3832
3833 if (file) {
3834 /* read access is always possible with a mapping */
3835 u32 av = FILE__READ;
3836
3837 /* write access only matters if the mapping is shared */
3838 if (shared && (prot & PROT_WRITE))
3839 av |= FILE__WRITE;
3840
3841 if (prot & PROT_EXEC)
3842 av |= FILE__EXECUTE;
3843
3844 return file_has_perm(cred, file, av);
3845 }
3846
3847 error:
3848 return rc;
3849 }
3850
3851 static int selinux_mmap_addr(unsigned long addr)
3852 {
3853 int rc = 0;
3854
3855 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3856 u32 sid = current_sid();
3857 rc = avc_has_perm(&selinux_state,
3858 sid, sid, SECCLASS_MEMPROTECT,
3859 MEMPROTECT__MMAP_ZERO, NULL);
3860 }
3861
3862 return rc;
3863 }
3864
3865 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3866 unsigned long prot, unsigned long flags)
3867 {
3868 struct common_audit_data ad;
3869 int rc;
3870
3871 if (file) {
3872 ad.type = LSM_AUDIT_DATA_FILE;
3873 ad.u.file = file;
3874 rc = inode_has_perm(current_cred(), file_inode(file),
3875 FILE__MAP, &ad);
3876 if (rc)
3877 return rc;
3878 }
3879
3880 if (checkreqprot_get(&selinux_state))
3881 prot = reqprot;
3882
3883 return file_map_prot_check(file, prot,
3884 (flags & MAP_TYPE) == MAP_SHARED);
3885 }
3886
3887 static int selinux_file_mprotect(struct vm_area_struct *vma,
3888 unsigned long reqprot,
3889 unsigned long prot)
3890 {
3891 const struct cred *cred = current_cred();
3892 u32 sid = cred_sid(cred);
3893
3894 if (checkreqprot_get(&selinux_state))
3895 prot = reqprot;
3896
3897 if (default_noexec &&
3898 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3899 int rc = 0;
3900 if (vma->vm_start >= vma->vm_mm->start_brk &&
3901 vma->vm_end <= vma->vm_mm->brk) {
3902 rc = avc_has_perm(&selinux_state,
3903 sid, sid, SECCLASS_PROCESS,
3904 PROCESS__EXECHEAP, NULL);
3905 } else if (!vma->vm_file &&
3906 ((vma->vm_start <= vma->vm_mm->start_stack &&
3907 vma->vm_end >= vma->vm_mm->start_stack) ||
3908 vma_is_stack_for_current(vma))) {
3909 rc = avc_has_perm(&selinux_state,
3910 sid, sid, SECCLASS_PROCESS,
3911 PROCESS__EXECSTACK, NULL);
3912 } else if (vma->vm_file && vma->anon_vma) {
3913 /*
3914 * We are making executable a file mapping that has
3915 * had some COW done. Since pages might have been
3916 * written, check ability to execute the possibly
3917 * modified content. This typically should only
3918 * occur for text relocations.
3919 */
3920 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3921 }
3922 if (rc)
3923 return rc;
3924 }
3925
3926 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3927 }
3928
3929 static int selinux_file_lock(struct file *file, unsigned int cmd)
3930 {
3931 const struct cred *cred = current_cred();
3932
3933 return file_has_perm(cred, file, FILE__LOCK);
3934 }
3935
3936 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3937 unsigned long arg)
3938 {
3939 const struct cred *cred = current_cred();
3940 int err = 0;
3941
3942 switch (cmd) {
3943 case F_SETFL:
3944 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3945 err = file_has_perm(cred, file, FILE__WRITE);
3946 break;
3947 }
3948 fallthrough;
3949 case F_SETOWN:
3950 case F_SETSIG:
3951 case F_GETFL:
3952 case F_GETOWN:
3953 case F_GETSIG:
3954 case F_GETOWNER_UIDS:
3955 /* Just check FD__USE permission */
3956 err = file_has_perm(cred, file, 0);
3957 break;
3958 case F_GETLK:
3959 case F_SETLK:
3960 case F_SETLKW:
3961 case F_OFD_GETLK:
3962 case F_OFD_SETLK:
3963 case F_OFD_SETLKW:
3964 #if BITS_PER_LONG == 32
3965 case F_GETLK64:
3966 case F_SETLK64:
3967 case F_SETLKW64:
3968 #endif
3969 err = file_has_perm(cred, file, FILE__LOCK);
3970 break;
3971 }
3972
3973 return err;
3974 }
3975
3976 static void selinux_file_set_fowner(struct file *file)
3977 {
3978 struct file_security_struct *fsec;
3979
3980 fsec = selinux_file(file);
3981 fsec->fown_sid = current_sid();
3982 }
3983
3984 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3985 struct fown_struct *fown, int signum)
3986 {
3987 struct file *file;
3988 u32 sid = task_sid_obj(tsk);
3989 u32 perm;
3990 struct file_security_struct *fsec;
3991
3992 /* struct fown_struct is never outside the context of a struct file */
3993 file = container_of(fown, struct file, f_owner);
3994
3995 fsec = selinux_file(file);
3996
3997 if (!signum)
3998 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3999 else
4000 perm = signal_to_av(signum);
4001
4002 return avc_has_perm(&selinux_state,
4003 fsec->fown_sid, sid,
4004 SECCLASS_PROCESS, perm, NULL);
4005 }
4006
4007 static int selinux_file_receive(struct file *file)
4008 {
4009 const struct cred *cred = current_cred();
4010
4011 return file_has_perm(cred, file, file_to_av(file));
4012 }
4013
4014 static int selinux_file_open(struct file *file)
4015 {
4016 struct file_security_struct *fsec;
4017 struct inode_security_struct *isec;
4018
4019 fsec = selinux_file(file);
4020 isec = inode_security(file_inode(file));
4021 /*
4022 * Save inode label and policy sequence number
4023 * at open-time so that selinux_file_permission
4024 * can determine whether revalidation is necessary.
4025 * Task label is already saved in the file security
4026 * struct as its SID.
4027 */
4028 fsec->isid = isec->sid;
4029 fsec->pseqno = avc_policy_seqno(&selinux_state);
4030 /*
4031 * Since the inode label or policy seqno may have changed
4032 * between the selinux_inode_permission check and the saving
4033 * of state above, recheck that access is still permitted.
4034 * Otherwise, access might never be revalidated against the
4035 * new inode label or new policy.
4036 * This check is not redundant - do not remove.
4037 */
4038 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4039 }
4040
4041 /* task security operations */
4042
4043 static int selinux_task_alloc(struct task_struct *task,
4044 unsigned long clone_flags)
4045 {
4046 u32 sid = current_sid();
4047
4048 return avc_has_perm(&selinux_state,
4049 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4050 }
4051
4052 /*
4053 * prepare a new set of credentials for modification
4054 */
4055 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4056 gfp_t gfp)
4057 {
4058 const struct task_security_struct *old_tsec = selinux_cred(old);
4059 struct task_security_struct *tsec = selinux_cred(new);
4060
4061 *tsec = *old_tsec;
4062 return 0;
4063 }
4064
4065 /*
4066 * transfer the SELinux data to a blank set of creds
4067 */
4068 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4069 {
4070 const struct task_security_struct *old_tsec = selinux_cred(old);
4071 struct task_security_struct *tsec = selinux_cred(new);
4072
4073 *tsec = *old_tsec;
4074 }
4075
4076 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4077 {
4078 *secid = cred_sid(c);
4079 }
4080
4081 /*
4082 * set the security data for a kernel service
4083 * - all the creation contexts are set to unlabelled
4084 */
4085 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4086 {
4087 struct task_security_struct *tsec = selinux_cred(new);
4088 u32 sid = current_sid();
4089 int ret;
4090
4091 ret = avc_has_perm(&selinux_state,
4092 sid, secid,
4093 SECCLASS_KERNEL_SERVICE,
4094 KERNEL_SERVICE__USE_AS_OVERRIDE,
4095 NULL);
4096 if (ret == 0) {
4097 tsec->sid = secid;
4098 tsec->create_sid = 0;
4099 tsec->keycreate_sid = 0;
4100 tsec->sockcreate_sid = 0;
4101 }
4102 return ret;
4103 }
4104
4105 /*
4106 * set the file creation context in a security record to the same as the
4107 * objective context of the specified inode
4108 */
4109 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4110 {
4111 struct inode_security_struct *isec = inode_security(inode);
4112 struct task_security_struct *tsec = selinux_cred(new);
4113 u32 sid = current_sid();
4114 int ret;
4115
4116 ret = avc_has_perm(&selinux_state,
4117 sid, isec->sid,
4118 SECCLASS_KERNEL_SERVICE,
4119 KERNEL_SERVICE__CREATE_FILES_AS,
4120 NULL);
4121
4122 if (ret == 0)
4123 tsec->create_sid = isec->sid;
4124 return ret;
4125 }
4126
4127 static int selinux_kernel_module_request(char *kmod_name)
4128 {
4129 struct common_audit_data ad;
4130
4131 ad.type = LSM_AUDIT_DATA_KMOD;
4132 ad.u.kmod_name = kmod_name;
4133
4134 return avc_has_perm(&selinux_state,
4135 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4136 SYSTEM__MODULE_REQUEST, &ad);
4137 }
4138
4139 static int selinux_kernel_module_from_file(struct file *file)
4140 {
4141 struct common_audit_data ad;
4142 struct inode_security_struct *isec;
4143 struct file_security_struct *fsec;
4144 u32 sid = current_sid();
4145 int rc;
4146
4147 /* init_module */
4148 if (file == NULL)
4149 return avc_has_perm(&selinux_state,
4150 sid, sid, SECCLASS_SYSTEM,
4151 SYSTEM__MODULE_LOAD, NULL);
4152
4153 /* finit_module */
4154
4155 ad.type = LSM_AUDIT_DATA_FILE;
4156 ad.u.file = file;
4157
4158 fsec = selinux_file(file);
4159 if (sid != fsec->sid) {
4160 rc = avc_has_perm(&selinux_state,
4161 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4162 if (rc)
4163 return rc;
4164 }
4165
4166 isec = inode_security(file_inode(file));
4167 return avc_has_perm(&selinux_state,
4168 sid, isec->sid, SECCLASS_SYSTEM,
4169 SYSTEM__MODULE_LOAD, &ad);
4170 }
4171
4172 static int selinux_kernel_read_file(struct file *file,
4173 enum kernel_read_file_id id,
4174 bool contents)
4175 {
4176 int rc = 0;
4177
4178 switch (id) {
4179 case READING_MODULE:
4180 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4181 break;
4182 default:
4183 break;
4184 }
4185
4186 return rc;
4187 }
4188
4189 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4190 {
4191 int rc = 0;
4192
4193 switch (id) {
4194 case LOADING_MODULE:
4195 rc = selinux_kernel_module_from_file(NULL);
4196 break;
4197 default:
4198 break;
4199 }
4200
4201 return rc;
4202 }
4203
4204 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4205 {
4206 return avc_has_perm(&selinux_state,
4207 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4208 PROCESS__SETPGID, NULL);
4209 }
4210
4211 static int selinux_task_getpgid(struct task_struct *p)
4212 {
4213 return avc_has_perm(&selinux_state,
4214 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4215 PROCESS__GETPGID, NULL);
4216 }
4217
4218 static int selinux_task_getsid(struct task_struct *p)
4219 {
4220 return avc_has_perm(&selinux_state,
4221 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4222 PROCESS__GETSESSION, NULL);
4223 }
4224
4225 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4226 {
4227 *secid = task_sid_subj(p);
4228 }
4229
4230 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4231 {
4232 *secid = task_sid_obj(p);
4233 }
4234
4235 static int selinux_task_setnice(struct task_struct *p, int nice)
4236 {
4237 return avc_has_perm(&selinux_state,
4238 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4239 PROCESS__SETSCHED, NULL);
4240 }
4241
4242 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4243 {
4244 return avc_has_perm(&selinux_state,
4245 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4246 PROCESS__SETSCHED, NULL);
4247 }
4248
4249 static int selinux_task_getioprio(struct task_struct *p)
4250 {
4251 return avc_has_perm(&selinux_state,
4252 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4253 PROCESS__GETSCHED, NULL);
4254 }
4255
4256 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4257 unsigned int flags)
4258 {
4259 u32 av = 0;
4260
4261 if (!flags)
4262 return 0;
4263 if (flags & LSM_PRLIMIT_WRITE)
4264 av |= PROCESS__SETRLIMIT;
4265 if (flags & LSM_PRLIMIT_READ)
4266 av |= PROCESS__GETRLIMIT;
4267 return avc_has_perm(&selinux_state,
4268 cred_sid(cred), cred_sid(tcred),
4269 SECCLASS_PROCESS, av, NULL);
4270 }
4271
4272 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4273 struct rlimit *new_rlim)
4274 {
4275 struct rlimit *old_rlim = p->signal->rlim + resource;
4276
4277 /* Control the ability to change the hard limit (whether
4278 lowering or raising it), so that the hard limit can
4279 later be used as a safe reset point for the soft limit
4280 upon context transitions. See selinux_bprm_committing_creds. */
4281 if (old_rlim->rlim_max != new_rlim->rlim_max)
4282 return avc_has_perm(&selinux_state,
4283 current_sid(), task_sid_obj(p),
4284 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4285
4286 return 0;
4287 }
4288
4289 static int selinux_task_setscheduler(struct task_struct *p)
4290 {
4291 return avc_has_perm(&selinux_state,
4292 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4293 PROCESS__SETSCHED, NULL);
4294 }
4295
4296 static int selinux_task_getscheduler(struct task_struct *p)
4297 {
4298 return avc_has_perm(&selinux_state,
4299 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4300 PROCESS__GETSCHED, NULL);
4301 }
4302
4303 static int selinux_task_movememory(struct task_struct *p)
4304 {
4305 return avc_has_perm(&selinux_state,
4306 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4307 PROCESS__SETSCHED, NULL);
4308 }
4309
4310 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4311 int sig, const struct cred *cred)
4312 {
4313 u32 secid;
4314 u32 perm;
4315
4316 if (!sig)
4317 perm = PROCESS__SIGNULL; /* null signal; existence test */
4318 else
4319 perm = signal_to_av(sig);
4320 if (!cred)
4321 secid = current_sid();
4322 else
4323 secid = cred_sid(cred);
4324 return avc_has_perm(&selinux_state,
4325 secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4326 }
4327
4328 static void selinux_task_to_inode(struct task_struct *p,
4329 struct inode *inode)
4330 {
4331 struct inode_security_struct *isec = selinux_inode(inode);
4332 u32 sid = task_sid_obj(p);
4333
4334 spin_lock(&isec->lock);
4335 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4336 isec->sid = sid;
4337 isec->initialized = LABEL_INITIALIZED;
4338 spin_unlock(&isec->lock);
4339 }
4340
4341 /* Returns error only if unable to parse addresses */
4342 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4343 struct common_audit_data *ad, u8 *proto)
4344 {
4345 int offset, ihlen, ret = -EINVAL;
4346 struct iphdr _iph, *ih;
4347
4348 offset = skb_network_offset(skb);
4349 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4350 if (ih == NULL)
4351 goto out;
4352
4353 ihlen = ih->ihl * 4;
4354 if (ihlen < sizeof(_iph))
4355 goto out;
4356
4357 ad->u.net->v4info.saddr = ih->saddr;
4358 ad->u.net->v4info.daddr = ih->daddr;
4359 ret = 0;
4360
4361 if (proto)
4362 *proto = ih->protocol;
4363
4364 switch (ih->protocol) {
4365 case IPPROTO_TCP: {
4366 struct tcphdr _tcph, *th;
4367
4368 if (ntohs(ih->frag_off) & IP_OFFSET)
4369 break;
4370
4371 offset += ihlen;
4372 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4373 if (th == NULL)
4374 break;
4375
4376 ad->u.net->sport = th->source;
4377 ad->u.net->dport = th->dest;
4378 break;
4379 }
4380
4381 case IPPROTO_UDP: {
4382 struct udphdr _udph, *uh;
4383
4384 if (ntohs(ih->frag_off) & IP_OFFSET)
4385 break;
4386
4387 offset += ihlen;
4388 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4389 if (uh == NULL)
4390 break;
4391
4392 ad->u.net->sport = uh->source;
4393 ad->u.net->dport = uh->dest;
4394 break;
4395 }
4396
4397 case IPPROTO_DCCP: {
4398 struct dccp_hdr _dccph, *dh;
4399
4400 if (ntohs(ih->frag_off) & IP_OFFSET)
4401 break;
4402
4403 offset += ihlen;
4404 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4405 if (dh == NULL)
4406 break;
4407
4408 ad->u.net->sport = dh->dccph_sport;
4409 ad->u.net->dport = dh->dccph_dport;
4410 break;
4411 }
4412
4413 #if IS_ENABLED(CONFIG_IP_SCTP)
4414 case IPPROTO_SCTP: {
4415 struct sctphdr _sctph, *sh;
4416
4417 if (ntohs(ih->frag_off) & IP_OFFSET)
4418 break;
4419
4420 offset += ihlen;
4421 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4422 if (sh == NULL)
4423 break;
4424
4425 ad->u.net->sport = sh->source;
4426 ad->u.net->dport = sh->dest;
4427 break;
4428 }
4429 #endif
4430 default:
4431 break;
4432 }
4433 out:
4434 return ret;
4435 }
4436
4437 #if IS_ENABLED(CONFIG_IPV6)
4438
4439 /* Returns error only if unable to parse addresses */
4440 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4441 struct common_audit_data *ad, u8 *proto)
4442 {
4443 u8 nexthdr;
4444 int ret = -EINVAL, offset;
4445 struct ipv6hdr _ipv6h, *ip6;
4446 __be16 frag_off;
4447
4448 offset = skb_network_offset(skb);
4449 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4450 if (ip6 == NULL)
4451 goto out;
4452
4453 ad->u.net->v6info.saddr = ip6->saddr;
4454 ad->u.net->v6info.daddr = ip6->daddr;
4455 ret = 0;
4456
4457 nexthdr = ip6->nexthdr;
4458 offset += sizeof(_ipv6h);
4459 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4460 if (offset < 0)
4461 goto out;
4462
4463 if (proto)
4464 *proto = nexthdr;
4465
4466 switch (nexthdr) {
4467 case IPPROTO_TCP: {
4468 struct tcphdr _tcph, *th;
4469
4470 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4471 if (th == NULL)
4472 break;
4473
4474 ad->u.net->sport = th->source;
4475 ad->u.net->dport = th->dest;
4476 break;
4477 }
4478
4479 case IPPROTO_UDP: {
4480 struct udphdr _udph, *uh;
4481
4482 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4483 if (uh == NULL)
4484 break;
4485
4486 ad->u.net->sport = uh->source;
4487 ad->u.net->dport = uh->dest;
4488 break;
4489 }
4490
4491 case IPPROTO_DCCP: {
4492 struct dccp_hdr _dccph, *dh;
4493
4494 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4495 if (dh == NULL)
4496 break;
4497
4498 ad->u.net->sport = dh->dccph_sport;
4499 ad->u.net->dport = dh->dccph_dport;
4500 break;
4501 }
4502
4503 #if IS_ENABLED(CONFIG_IP_SCTP)
4504 case IPPROTO_SCTP: {
4505 struct sctphdr _sctph, *sh;
4506
4507 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4508 if (sh == NULL)
4509 break;
4510
4511 ad->u.net->sport = sh->source;
4512 ad->u.net->dport = sh->dest;
4513 break;
4514 }
4515 #endif
4516 /* includes fragments */
4517 default:
4518 break;
4519 }
4520 out:
4521 return ret;
4522 }
4523
4524 #endif /* IPV6 */
4525
4526 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4527 char **_addrp, int src, u8 *proto)
4528 {
4529 char *addrp;
4530 int ret;
4531
4532 switch (ad->u.net->family) {
4533 case PF_INET:
4534 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4535 if (ret)
4536 goto parse_error;
4537 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4538 &ad->u.net->v4info.daddr);
4539 goto okay;
4540
4541 #if IS_ENABLED(CONFIG_IPV6)
4542 case PF_INET6:
4543 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4544 if (ret)
4545 goto parse_error;
4546 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4547 &ad->u.net->v6info.daddr);
4548 goto okay;
4549 #endif /* IPV6 */
4550 default:
4551 addrp = NULL;
4552 goto okay;
4553 }
4554
4555 parse_error:
4556 pr_warn(
4557 "SELinux: failure in selinux_parse_skb(),"
4558 " unable to parse packet\n");
4559 return ret;
4560
4561 okay:
4562 if (_addrp)
4563 *_addrp = addrp;
4564 return 0;
4565 }
4566
4567 /**
4568 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4569 * @skb: the packet
4570 * @family: protocol family
4571 * @sid: the packet's peer label SID
4572 *
4573 * Description:
4574 * Check the various different forms of network peer labeling and determine
4575 * the peer label/SID for the packet; most of the magic actually occurs in
4576 * the security server function security_net_peersid_cmp(). The function
4577 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4578 * or -EACCES if @sid is invalid due to inconsistencies with the different
4579 * peer labels.
4580 *
4581 */
4582 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4583 {
4584 int err;
4585 u32 xfrm_sid;
4586 u32 nlbl_sid;
4587 u32 nlbl_type;
4588
4589 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4590 if (unlikely(err))
4591 return -EACCES;
4592 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4593 if (unlikely(err))
4594 return -EACCES;
4595
4596 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4597 nlbl_type, xfrm_sid, sid);
4598 if (unlikely(err)) {
4599 pr_warn(
4600 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4601 " unable to determine packet's peer label\n");
4602 return -EACCES;
4603 }
4604
4605 return 0;
4606 }
4607
4608 /**
4609 * selinux_conn_sid - Determine the child socket label for a connection
4610 * @sk_sid: the parent socket's SID
4611 * @skb_sid: the packet's SID
4612 * @conn_sid: the resulting connection SID
4613 *
4614 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4615 * combined with the MLS information from @skb_sid in order to create
4616 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4617 * of @sk_sid. Returns zero on success, negative values on failure.
4618 *
4619 */
4620 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4621 {
4622 int err = 0;
4623
4624 if (skb_sid != SECSID_NULL)
4625 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4626 conn_sid);
4627 else
4628 *conn_sid = sk_sid;
4629
4630 return err;
4631 }
4632
4633 /* socket security operations */
4634
4635 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4636 u16 secclass, u32 *socksid)
4637 {
4638 if (tsec->sockcreate_sid > SECSID_NULL) {
4639 *socksid = tsec->sockcreate_sid;
4640 return 0;
4641 }
4642
4643 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4644 secclass, NULL, socksid);
4645 }
4646
4647 static int sock_has_perm(struct sock *sk, u32 perms)
4648 {
4649 struct sk_security_struct *sksec = sk->sk_security;
4650 struct common_audit_data ad;
4651 struct lsm_network_audit net = {0,};
4652
4653 if (sksec->sid == SECINITSID_KERNEL)
4654 return 0;
4655
4656 ad.type = LSM_AUDIT_DATA_NET;
4657 ad.u.net = &net;
4658 ad.u.net->sk = sk;
4659
4660 return avc_has_perm(&selinux_state,
4661 current_sid(), sksec->sid, sksec->sclass, perms,
4662 &ad);
4663 }
4664
4665 static int selinux_socket_create(int family, int type,
4666 int protocol, int kern)
4667 {
4668 const struct task_security_struct *tsec = selinux_cred(current_cred());
4669 u32 newsid;
4670 u16 secclass;
4671 int rc;
4672
4673 if (kern)
4674 return 0;
4675
4676 secclass = socket_type_to_security_class(family, type, protocol);
4677 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4678 if (rc)
4679 return rc;
4680
4681 return avc_has_perm(&selinux_state,
4682 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4683 }
4684
4685 static int selinux_socket_post_create(struct socket *sock, int family,
4686 int type, int protocol, int kern)
4687 {
4688 const struct task_security_struct *tsec = selinux_cred(current_cred());
4689 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4690 struct sk_security_struct *sksec;
4691 u16 sclass = socket_type_to_security_class(family, type, protocol);
4692 u32 sid = SECINITSID_KERNEL;
4693 int err = 0;
4694
4695 if (!kern) {
4696 err = socket_sockcreate_sid(tsec, sclass, &sid);
4697 if (err)
4698 return err;
4699 }
4700
4701 isec->sclass = sclass;
4702 isec->sid = sid;
4703 isec->initialized = LABEL_INITIALIZED;
4704
4705 if (sock->sk) {
4706 sksec = sock->sk->sk_security;
4707 sksec->sclass = sclass;
4708 sksec->sid = sid;
4709 /* Allows detection of the first association on this socket */
4710 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4711 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4712
4713 err = selinux_netlbl_socket_post_create(sock->sk, family);
4714 }
4715
4716 return err;
4717 }
4718
4719 static int selinux_socket_socketpair(struct socket *socka,
4720 struct socket *sockb)
4721 {
4722 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4723 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4724
4725 sksec_a->peer_sid = sksec_b->sid;
4726 sksec_b->peer_sid = sksec_a->sid;
4727
4728 return 0;
4729 }
4730
4731 /* Range of port numbers used to automatically bind.
4732 Need to determine whether we should perform a name_bind
4733 permission check between the socket and the port number. */
4734
4735 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4736 {
4737 struct sock *sk = sock->sk;
4738 struct sk_security_struct *sksec = sk->sk_security;
4739 u16 family;
4740 int err;
4741
4742 err = sock_has_perm(sk, SOCKET__BIND);
4743 if (err)
4744 goto out;
4745
4746 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4747 family = sk->sk_family;
4748 if (family == PF_INET || family == PF_INET6) {
4749 char *addrp;
4750 struct common_audit_data ad;
4751 struct lsm_network_audit net = {0,};
4752 struct sockaddr_in *addr4 = NULL;
4753 struct sockaddr_in6 *addr6 = NULL;
4754 u16 family_sa;
4755 unsigned short snum;
4756 u32 sid, node_perm;
4757
4758 /*
4759 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4760 * that validates multiple binding addresses. Because of this
4761 * need to check address->sa_family as it is possible to have
4762 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4763 */
4764 if (addrlen < offsetofend(struct sockaddr, sa_family))
4765 return -EINVAL;
4766 family_sa = address->sa_family;
4767 switch (family_sa) {
4768 case AF_UNSPEC:
4769 case AF_INET:
4770 if (addrlen < sizeof(struct sockaddr_in))
4771 return -EINVAL;
4772 addr4 = (struct sockaddr_in *)address;
4773 if (family_sa == AF_UNSPEC) {
4774 /* see __inet_bind(), we only want to allow
4775 * AF_UNSPEC if the address is INADDR_ANY
4776 */
4777 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4778 goto err_af;
4779 family_sa = AF_INET;
4780 }
4781 snum = ntohs(addr4->sin_port);
4782 addrp = (char *)&addr4->sin_addr.s_addr;
4783 break;
4784 case AF_INET6:
4785 if (addrlen < SIN6_LEN_RFC2133)
4786 return -EINVAL;
4787 addr6 = (struct sockaddr_in6 *)address;
4788 snum = ntohs(addr6->sin6_port);
4789 addrp = (char *)&addr6->sin6_addr.s6_addr;
4790 break;
4791 default:
4792 goto err_af;
4793 }
4794
4795 ad.type = LSM_AUDIT_DATA_NET;
4796 ad.u.net = &net;
4797 ad.u.net->sport = htons(snum);
4798 ad.u.net->family = family_sa;
4799
4800 if (snum) {
4801 int low, high;
4802
4803 inet_get_local_port_range(sock_net(sk), &low, &high);
4804
4805 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4806 snum < low || snum > high) {
4807 err = sel_netport_sid(sk->sk_protocol,
4808 snum, &sid);
4809 if (err)
4810 goto out;
4811 err = avc_has_perm(&selinux_state,
4812 sksec->sid, sid,
4813 sksec->sclass,
4814 SOCKET__NAME_BIND, &ad);
4815 if (err)
4816 goto out;
4817 }
4818 }
4819
4820 switch (sksec->sclass) {
4821 case SECCLASS_TCP_SOCKET:
4822 node_perm = TCP_SOCKET__NODE_BIND;
4823 break;
4824
4825 case SECCLASS_UDP_SOCKET:
4826 node_perm = UDP_SOCKET__NODE_BIND;
4827 break;
4828
4829 case SECCLASS_DCCP_SOCKET:
4830 node_perm = DCCP_SOCKET__NODE_BIND;
4831 break;
4832
4833 case SECCLASS_SCTP_SOCKET:
4834 node_perm = SCTP_SOCKET__NODE_BIND;
4835 break;
4836
4837 default:
4838 node_perm = RAWIP_SOCKET__NODE_BIND;
4839 break;
4840 }
4841
4842 err = sel_netnode_sid(addrp, family_sa, &sid);
4843 if (err)
4844 goto out;
4845
4846 if (family_sa == AF_INET)
4847 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4848 else
4849 ad.u.net->v6info.saddr = addr6->sin6_addr;
4850
4851 err = avc_has_perm(&selinux_state,
4852 sksec->sid, sid,
4853 sksec->sclass, node_perm, &ad);
4854 if (err)
4855 goto out;
4856 }
4857 out:
4858 return err;
4859 err_af:
4860 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4861 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4862 return -EINVAL;
4863 return -EAFNOSUPPORT;
4864 }
4865
4866 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4867 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4868 */
4869 static int selinux_socket_connect_helper(struct socket *sock,
4870 struct sockaddr *address, int addrlen)
4871 {
4872 struct sock *sk = sock->sk;
4873 struct sk_security_struct *sksec = sk->sk_security;
4874 int err;
4875
4876 err = sock_has_perm(sk, SOCKET__CONNECT);
4877 if (err)
4878 return err;
4879 if (addrlen < offsetofend(struct sockaddr, sa_family))
4880 return -EINVAL;
4881
4882 /* connect(AF_UNSPEC) has special handling, as it is a documented
4883 * way to disconnect the socket
4884 */
4885 if (address->sa_family == AF_UNSPEC)
4886 return 0;
4887
4888 /*
4889 * If a TCP, DCCP or SCTP socket, check name_connect permission
4890 * for the port.
4891 */
4892 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4893 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4894 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4895 struct common_audit_data ad;
4896 struct lsm_network_audit net = {0,};
4897 struct sockaddr_in *addr4 = NULL;
4898 struct sockaddr_in6 *addr6 = NULL;
4899 unsigned short snum;
4900 u32 sid, perm;
4901
4902 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4903 * that validates multiple connect addresses. Because of this
4904 * need to check address->sa_family as it is possible to have
4905 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4906 */
4907 switch (address->sa_family) {
4908 case AF_INET:
4909 addr4 = (struct sockaddr_in *)address;
4910 if (addrlen < sizeof(struct sockaddr_in))
4911 return -EINVAL;
4912 snum = ntohs(addr4->sin_port);
4913 break;
4914 case AF_INET6:
4915 addr6 = (struct sockaddr_in6 *)address;
4916 if (addrlen < SIN6_LEN_RFC2133)
4917 return -EINVAL;
4918 snum = ntohs(addr6->sin6_port);
4919 break;
4920 default:
4921 /* Note that SCTP services expect -EINVAL, whereas
4922 * others expect -EAFNOSUPPORT.
4923 */
4924 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4925 return -EINVAL;
4926 else
4927 return -EAFNOSUPPORT;
4928 }
4929
4930 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4931 if (err)
4932 return err;
4933
4934 switch (sksec->sclass) {
4935 case SECCLASS_TCP_SOCKET:
4936 perm = TCP_SOCKET__NAME_CONNECT;
4937 break;
4938 case SECCLASS_DCCP_SOCKET:
4939 perm = DCCP_SOCKET__NAME_CONNECT;
4940 break;
4941 case SECCLASS_SCTP_SOCKET:
4942 perm = SCTP_SOCKET__NAME_CONNECT;
4943 break;
4944 }
4945
4946 ad.type = LSM_AUDIT_DATA_NET;
4947 ad.u.net = &net;
4948 ad.u.net->dport = htons(snum);
4949 ad.u.net->family = address->sa_family;
4950 err = avc_has_perm(&selinux_state,
4951 sksec->sid, sid, sksec->sclass, perm, &ad);
4952 if (err)
4953 return err;
4954 }
4955
4956 return 0;
4957 }
4958
4959 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4960 static int selinux_socket_connect(struct socket *sock,
4961 struct sockaddr *address, int addrlen)
4962 {
4963 int err;
4964 struct sock *sk = sock->sk;
4965
4966 err = selinux_socket_connect_helper(sock, address, addrlen);
4967 if (err)
4968 return err;
4969
4970 return selinux_netlbl_socket_connect(sk, address);
4971 }
4972
4973 static int selinux_socket_listen(struct socket *sock, int backlog)
4974 {
4975 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4976 }
4977
4978 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4979 {
4980 int err;
4981 struct inode_security_struct *isec;
4982 struct inode_security_struct *newisec;
4983 u16 sclass;
4984 u32 sid;
4985
4986 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4987 if (err)
4988 return err;
4989
4990 isec = inode_security_novalidate(SOCK_INODE(sock));
4991 spin_lock(&isec->lock);
4992 sclass = isec->sclass;
4993 sid = isec->sid;
4994 spin_unlock(&isec->lock);
4995
4996 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4997 newisec->sclass = sclass;
4998 newisec->sid = sid;
4999 newisec->initialized = LABEL_INITIALIZED;
5000
5001 return 0;
5002 }
5003
5004 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5005 int size)
5006 {
5007 return sock_has_perm(sock->sk, SOCKET__WRITE);
5008 }
5009
5010 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5011 int size, int flags)
5012 {
5013 return sock_has_perm(sock->sk, SOCKET__READ);
5014 }
5015
5016 static int selinux_socket_getsockname(struct socket *sock)
5017 {
5018 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5019 }
5020
5021 static int selinux_socket_getpeername(struct socket *sock)
5022 {
5023 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5024 }
5025
5026 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5027 {
5028 int err;
5029
5030 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5031 if (err)
5032 return err;
5033
5034 return selinux_netlbl_socket_setsockopt(sock, level, optname);
5035 }
5036
5037 static int selinux_socket_getsockopt(struct socket *sock, int level,
5038 int optname)
5039 {
5040 return sock_has_perm(sock->sk, SOCKET__GETOPT);
5041 }
5042
5043 static int selinux_socket_shutdown(struct socket *sock, int how)
5044 {
5045 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5046 }
5047
5048 static int selinux_socket_unix_stream_connect(struct sock *sock,
5049 struct sock *other,
5050 struct sock *newsk)
5051 {
5052 struct sk_security_struct *sksec_sock = sock->sk_security;
5053 struct sk_security_struct *sksec_other = other->sk_security;
5054 struct sk_security_struct *sksec_new = newsk->sk_security;
5055 struct common_audit_data ad;
5056 struct lsm_network_audit net = {0,};
5057 int err;
5058
5059 ad.type = LSM_AUDIT_DATA_NET;
5060 ad.u.net = &net;
5061 ad.u.net->sk = other;
5062
5063 err = avc_has_perm(&selinux_state,
5064 sksec_sock->sid, sksec_other->sid,
5065 sksec_other->sclass,
5066 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5067 if (err)
5068 return err;
5069
5070 /* server child socket */
5071 sksec_new->peer_sid = sksec_sock->sid;
5072 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5073 sksec_sock->sid, &sksec_new->sid);
5074 if (err)
5075 return err;
5076
5077 /* connecting socket */
5078 sksec_sock->peer_sid = sksec_new->sid;
5079
5080 return 0;
5081 }
5082
5083 static int selinux_socket_unix_may_send(struct socket *sock,
5084 struct socket *other)
5085 {
5086 struct sk_security_struct *ssec = sock->sk->sk_security;
5087 struct sk_security_struct *osec = other->sk->sk_security;
5088 struct common_audit_data ad;
5089 struct lsm_network_audit net = {0,};
5090
5091 ad.type = LSM_AUDIT_DATA_NET;
5092 ad.u.net = &net;
5093 ad.u.net->sk = other->sk;
5094
5095 return avc_has_perm(&selinux_state,
5096 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5097 &ad);
5098 }
5099
5100 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5101 char *addrp, u16 family, u32 peer_sid,
5102 struct common_audit_data *ad)
5103 {
5104 int err;
5105 u32 if_sid;
5106 u32 node_sid;
5107
5108 err = sel_netif_sid(ns, ifindex, &if_sid);
5109 if (err)
5110 return err;
5111 err = avc_has_perm(&selinux_state,
5112 peer_sid, if_sid,
5113 SECCLASS_NETIF, NETIF__INGRESS, ad);
5114 if (err)
5115 return err;
5116
5117 err = sel_netnode_sid(addrp, family, &node_sid);
5118 if (err)
5119 return err;
5120 return avc_has_perm(&selinux_state,
5121 peer_sid, node_sid,
5122 SECCLASS_NODE, NODE__RECVFROM, ad);
5123 }
5124
5125 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5126 u16 family)
5127 {
5128 int err = 0;
5129 struct sk_security_struct *sksec = sk->sk_security;
5130 u32 sk_sid = sksec->sid;
5131 struct common_audit_data ad;
5132 struct lsm_network_audit net = {0,};
5133 char *addrp;
5134
5135 ad.type = LSM_AUDIT_DATA_NET;
5136 ad.u.net = &net;
5137 ad.u.net->netif = skb->skb_iif;
5138 ad.u.net->family = family;
5139 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5140 if (err)
5141 return err;
5142
5143 if (selinux_secmark_enabled()) {
5144 err = avc_has_perm(&selinux_state,
5145 sk_sid, skb->secmark, SECCLASS_PACKET,
5146 PACKET__RECV, &ad);
5147 if (err)
5148 return err;
5149 }
5150
5151 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5152 if (err)
5153 return err;
5154 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5155
5156 return err;
5157 }
5158
5159 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5160 {
5161 int err;
5162 struct sk_security_struct *sksec = sk->sk_security;
5163 u16 family = sk->sk_family;
5164 u32 sk_sid = sksec->sid;
5165 struct common_audit_data ad;
5166 struct lsm_network_audit net = {0,};
5167 char *addrp;
5168 u8 secmark_active;
5169 u8 peerlbl_active;
5170
5171 if (family != PF_INET && family != PF_INET6)
5172 return 0;
5173
5174 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5175 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5176 family = PF_INET;
5177
5178 /* If any sort of compatibility mode is enabled then handoff processing
5179 * to the selinux_sock_rcv_skb_compat() function to deal with the
5180 * special handling. We do this in an attempt to keep this function
5181 * as fast and as clean as possible. */
5182 if (!selinux_policycap_netpeer())
5183 return selinux_sock_rcv_skb_compat(sk, skb, family);
5184
5185 secmark_active = selinux_secmark_enabled();
5186 peerlbl_active = selinux_peerlbl_enabled();
5187 if (!secmark_active && !peerlbl_active)
5188 return 0;
5189
5190 ad.type = LSM_AUDIT_DATA_NET;
5191 ad.u.net = &net;
5192 ad.u.net->netif = skb->skb_iif;
5193 ad.u.net->family = family;
5194 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5195 if (err)
5196 return err;
5197
5198 if (peerlbl_active) {
5199 u32 peer_sid;
5200
5201 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5202 if (err)
5203 return err;
5204 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5205 addrp, family, peer_sid, &ad);
5206 if (err) {
5207 selinux_netlbl_err(skb, family, err, 0);
5208 return err;
5209 }
5210 err = avc_has_perm(&selinux_state,
5211 sk_sid, peer_sid, SECCLASS_PEER,
5212 PEER__RECV, &ad);
5213 if (err) {
5214 selinux_netlbl_err(skb, family, err, 0);
5215 return err;
5216 }
5217 }
5218
5219 if (secmark_active) {
5220 err = avc_has_perm(&selinux_state,
5221 sk_sid, skb->secmark, SECCLASS_PACKET,
5222 PACKET__RECV, &ad);
5223 if (err)
5224 return err;
5225 }
5226
5227 return err;
5228 }
5229
5230 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5231 int __user *optlen, unsigned len)
5232 {
5233 int err = 0;
5234 char *scontext;
5235 u32 scontext_len;
5236 struct sk_security_struct *sksec = sock->sk->sk_security;
5237 u32 peer_sid = SECSID_NULL;
5238
5239 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5240 sksec->sclass == SECCLASS_TCP_SOCKET ||
5241 sksec->sclass == SECCLASS_SCTP_SOCKET)
5242 peer_sid = sksec->peer_sid;
5243 if (peer_sid == SECSID_NULL)
5244 return -ENOPROTOOPT;
5245
5246 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5247 &scontext_len);
5248 if (err)
5249 return err;
5250
5251 if (scontext_len > len) {
5252 err = -ERANGE;
5253 goto out_len;
5254 }
5255
5256 if (copy_to_user(optval, scontext, scontext_len))
5257 err = -EFAULT;
5258
5259 out_len:
5260 if (put_user(scontext_len, optlen))
5261 err = -EFAULT;
5262 kfree(scontext);
5263 return err;
5264 }
5265
5266 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5267 {
5268 u32 peer_secid = SECSID_NULL;
5269 u16 family;
5270 struct inode_security_struct *isec;
5271
5272 if (skb && skb->protocol == htons(ETH_P_IP))
5273 family = PF_INET;
5274 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5275 family = PF_INET6;
5276 else if (sock)
5277 family = sock->sk->sk_family;
5278 else
5279 goto out;
5280
5281 if (sock && family == PF_UNIX) {
5282 isec = inode_security_novalidate(SOCK_INODE(sock));
5283 peer_secid = isec->sid;
5284 } else if (skb)
5285 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5286
5287 out:
5288 *secid = peer_secid;
5289 if (peer_secid == SECSID_NULL)
5290 return -EINVAL;
5291 return 0;
5292 }
5293
5294 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5295 {
5296 struct sk_security_struct *sksec;
5297
5298 sksec = kzalloc(sizeof(*sksec), priority);
5299 if (!sksec)
5300 return -ENOMEM;
5301
5302 sksec->peer_sid = SECINITSID_UNLABELED;
5303 sksec->sid = SECINITSID_UNLABELED;
5304 sksec->sclass = SECCLASS_SOCKET;
5305 selinux_netlbl_sk_security_reset(sksec);
5306 sk->sk_security = sksec;
5307
5308 return 0;
5309 }
5310
5311 static void selinux_sk_free_security(struct sock *sk)
5312 {
5313 struct sk_security_struct *sksec = sk->sk_security;
5314
5315 sk->sk_security = NULL;
5316 selinux_netlbl_sk_security_free(sksec);
5317 kfree(sksec);
5318 }
5319
5320 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5321 {
5322 struct sk_security_struct *sksec = sk->sk_security;
5323 struct sk_security_struct *newsksec = newsk->sk_security;
5324
5325 newsksec->sid = sksec->sid;
5326 newsksec->peer_sid = sksec->peer_sid;
5327 newsksec->sclass = sksec->sclass;
5328
5329 selinux_netlbl_sk_security_reset(newsksec);
5330 }
5331
5332 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5333 {
5334 if (!sk)
5335 *secid = SECINITSID_ANY_SOCKET;
5336 else {
5337 struct sk_security_struct *sksec = sk->sk_security;
5338
5339 *secid = sksec->sid;
5340 }
5341 }
5342
5343 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5344 {
5345 struct inode_security_struct *isec =
5346 inode_security_novalidate(SOCK_INODE(parent));
5347 struct sk_security_struct *sksec = sk->sk_security;
5348
5349 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5350 sk->sk_family == PF_UNIX)
5351 isec->sid = sksec->sid;
5352 sksec->sclass = isec->sclass;
5353 }
5354
5355 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5356 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5357 * already present).
5358 */
5359 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5360 struct sk_buff *skb)
5361 {
5362 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5363 struct common_audit_data ad;
5364 struct lsm_network_audit net = {0,};
5365 u8 peerlbl_active;
5366 u32 peer_sid = SECINITSID_UNLABELED;
5367 u32 conn_sid;
5368 int err = 0;
5369
5370 if (!selinux_policycap_extsockclass())
5371 return 0;
5372
5373 peerlbl_active = selinux_peerlbl_enabled();
5374
5375 if (peerlbl_active) {
5376 /* This will return peer_sid = SECSID_NULL if there are
5377 * no peer labels, see security_net_peersid_resolve().
5378 */
5379 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5380 &peer_sid);
5381 if (err)
5382 return err;
5383
5384 if (peer_sid == SECSID_NULL)
5385 peer_sid = SECINITSID_UNLABELED;
5386 }
5387
5388 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5389 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5390
5391 /* Here as first association on socket. As the peer SID
5392 * was allowed by peer recv (and the netif/node checks),
5393 * then it is approved by policy and used as the primary
5394 * peer SID for getpeercon(3).
5395 */
5396 sksec->peer_sid = peer_sid;
5397 } else if (sksec->peer_sid != peer_sid) {
5398 /* Other association peer SIDs are checked to enforce
5399 * consistency among the peer SIDs.
5400 */
5401 ad.type = LSM_AUDIT_DATA_NET;
5402 ad.u.net = &net;
5403 ad.u.net->sk = ep->base.sk;
5404 err = avc_has_perm(&selinux_state,
5405 sksec->peer_sid, peer_sid, sksec->sclass,
5406 SCTP_SOCKET__ASSOCIATION, &ad);
5407 if (err)
5408 return err;
5409 }
5410
5411 /* Compute the MLS component for the connection and store
5412 * the information in ep. This will be used by SCTP TCP type
5413 * sockets and peeled off connections as they cause a new
5414 * socket to be generated. selinux_sctp_sk_clone() will then
5415 * plug this into the new socket.
5416 */
5417 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5418 if (err)
5419 return err;
5420
5421 ep->secid = conn_sid;
5422 ep->peer_secid = peer_sid;
5423
5424 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5425 return selinux_netlbl_sctp_assoc_request(ep, skb);
5426 }
5427
5428 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5429 * based on their @optname.
5430 */
5431 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5432 struct sockaddr *address,
5433 int addrlen)
5434 {
5435 int len, err = 0, walk_size = 0;
5436 void *addr_buf;
5437 struct sockaddr *addr;
5438 struct socket *sock;
5439
5440 if (!selinux_policycap_extsockclass())
5441 return 0;
5442
5443 /* Process one or more addresses that may be IPv4 or IPv6 */
5444 sock = sk->sk_socket;
5445 addr_buf = address;
5446
5447 while (walk_size < addrlen) {
5448 if (walk_size + sizeof(sa_family_t) > addrlen)
5449 return -EINVAL;
5450
5451 addr = addr_buf;
5452 switch (addr->sa_family) {
5453 case AF_UNSPEC:
5454 case AF_INET:
5455 len = sizeof(struct sockaddr_in);
5456 break;
5457 case AF_INET6:
5458 len = sizeof(struct sockaddr_in6);
5459 break;
5460 default:
5461 return -EINVAL;
5462 }
5463
5464 if (walk_size + len > addrlen)
5465 return -EINVAL;
5466
5467 err = -EINVAL;
5468 switch (optname) {
5469 /* Bind checks */
5470 case SCTP_PRIMARY_ADDR:
5471 case SCTP_SET_PEER_PRIMARY_ADDR:
5472 case SCTP_SOCKOPT_BINDX_ADD:
5473 err = selinux_socket_bind(sock, addr, len);
5474 break;
5475 /* Connect checks */
5476 case SCTP_SOCKOPT_CONNECTX:
5477 case SCTP_PARAM_SET_PRIMARY:
5478 case SCTP_PARAM_ADD_IP:
5479 case SCTP_SENDMSG_CONNECT:
5480 err = selinux_socket_connect_helper(sock, addr, len);
5481 if (err)
5482 return err;
5483
5484 /* As selinux_sctp_bind_connect() is called by the
5485 * SCTP protocol layer, the socket is already locked,
5486 * therefore selinux_netlbl_socket_connect_locked()
5487 * is called here. The situations handled are:
5488 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5489 * whenever a new IP address is added or when a new
5490 * primary address is selected.
5491 * Note that an SCTP connect(2) call happens before
5492 * the SCTP protocol layer and is handled via
5493 * selinux_socket_connect().
5494 */
5495 err = selinux_netlbl_socket_connect_locked(sk, addr);
5496 break;
5497 }
5498
5499 if (err)
5500 return err;
5501
5502 addr_buf += len;
5503 walk_size += len;
5504 }
5505
5506 return 0;
5507 }
5508
5509 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5510 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5511 struct sock *newsk)
5512 {
5513 struct sk_security_struct *sksec = sk->sk_security;
5514 struct sk_security_struct *newsksec = newsk->sk_security;
5515
5516 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5517 * the non-sctp clone version.
5518 */
5519 if (!selinux_policycap_extsockclass())
5520 return selinux_sk_clone_security(sk, newsk);
5521
5522 newsksec->sid = ep->secid;
5523 newsksec->peer_sid = ep->peer_secid;
5524 newsksec->sclass = sksec->sclass;
5525 selinux_netlbl_sctp_sk_clone(sk, newsk);
5526 }
5527
5528 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5529 struct request_sock *req)
5530 {
5531 struct sk_security_struct *sksec = sk->sk_security;
5532 int err;
5533 u16 family = req->rsk_ops->family;
5534 u32 connsid;
5535 u32 peersid;
5536
5537 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5538 if (err)
5539 return err;
5540 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5541 if (err)
5542 return err;
5543 req->secid = connsid;
5544 req->peer_secid = peersid;
5545
5546 return selinux_netlbl_inet_conn_request(req, family);
5547 }
5548
5549 static void selinux_inet_csk_clone(struct sock *newsk,
5550 const struct request_sock *req)
5551 {
5552 struct sk_security_struct *newsksec = newsk->sk_security;
5553
5554 newsksec->sid = req->secid;
5555 newsksec->peer_sid = req->peer_secid;
5556 /* NOTE: Ideally, we should also get the isec->sid for the
5557 new socket in sync, but we don't have the isec available yet.
5558 So we will wait until sock_graft to do it, by which
5559 time it will have been created and available. */
5560
5561 /* We don't need to take any sort of lock here as we are the only
5562 * thread with access to newsksec */
5563 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5564 }
5565
5566 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5567 {
5568 u16 family = sk->sk_family;
5569 struct sk_security_struct *sksec = sk->sk_security;
5570
5571 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5572 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5573 family = PF_INET;
5574
5575 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5576 }
5577
5578 static int selinux_secmark_relabel_packet(u32 sid)
5579 {
5580 const struct task_security_struct *__tsec;
5581 u32 tsid;
5582
5583 __tsec = selinux_cred(current_cred());
5584 tsid = __tsec->sid;
5585
5586 return avc_has_perm(&selinux_state,
5587 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5588 NULL);
5589 }
5590
5591 static void selinux_secmark_refcount_inc(void)
5592 {
5593 atomic_inc(&selinux_secmark_refcount);
5594 }
5595
5596 static void selinux_secmark_refcount_dec(void)
5597 {
5598 atomic_dec(&selinux_secmark_refcount);
5599 }
5600
5601 static void selinux_req_classify_flow(const struct request_sock *req,
5602 struct flowi_common *flic)
5603 {
5604 flic->flowic_secid = req->secid;
5605 }
5606
5607 static int selinux_tun_dev_alloc_security(void **security)
5608 {
5609 struct tun_security_struct *tunsec;
5610
5611 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5612 if (!tunsec)
5613 return -ENOMEM;
5614 tunsec->sid = current_sid();
5615
5616 *security = tunsec;
5617 return 0;
5618 }
5619
5620 static void selinux_tun_dev_free_security(void *security)
5621 {
5622 kfree(security);
5623 }
5624
5625 static int selinux_tun_dev_create(void)
5626 {
5627 u32 sid = current_sid();
5628
5629 /* we aren't taking into account the "sockcreate" SID since the socket
5630 * that is being created here is not a socket in the traditional sense,
5631 * instead it is a private sock, accessible only to the kernel, and
5632 * representing a wide range of network traffic spanning multiple
5633 * connections unlike traditional sockets - check the TUN driver to
5634 * get a better understanding of why this socket is special */
5635
5636 return avc_has_perm(&selinux_state,
5637 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5638 NULL);
5639 }
5640
5641 static int selinux_tun_dev_attach_queue(void *security)
5642 {
5643 struct tun_security_struct *tunsec = security;
5644
5645 return avc_has_perm(&selinux_state,
5646 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5647 TUN_SOCKET__ATTACH_QUEUE, NULL);
5648 }
5649
5650 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5651 {
5652 struct tun_security_struct *tunsec = security;
5653 struct sk_security_struct *sksec = sk->sk_security;
5654
5655 /* we don't currently perform any NetLabel based labeling here and it
5656 * isn't clear that we would want to do so anyway; while we could apply
5657 * labeling without the support of the TUN user the resulting labeled
5658 * traffic from the other end of the connection would almost certainly
5659 * cause confusion to the TUN user that had no idea network labeling
5660 * protocols were being used */
5661
5662 sksec->sid = tunsec->sid;
5663 sksec->sclass = SECCLASS_TUN_SOCKET;
5664
5665 return 0;
5666 }
5667
5668 static int selinux_tun_dev_open(void *security)
5669 {
5670 struct tun_security_struct *tunsec = security;
5671 u32 sid = current_sid();
5672 int err;
5673
5674 err = avc_has_perm(&selinux_state,
5675 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5676 TUN_SOCKET__RELABELFROM, NULL);
5677 if (err)
5678 return err;
5679 err = avc_has_perm(&selinux_state,
5680 sid, sid, SECCLASS_TUN_SOCKET,
5681 TUN_SOCKET__RELABELTO, NULL);
5682 if (err)
5683 return err;
5684 tunsec->sid = sid;
5685
5686 return 0;
5687 }
5688
5689 #ifdef CONFIG_NETFILTER
5690
5691 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5692 const struct net_device *indev,
5693 u16 family)
5694 {
5695 int err;
5696 char *addrp;
5697 u32 peer_sid;
5698 struct common_audit_data ad;
5699 struct lsm_network_audit net = {0,};
5700 u8 secmark_active;
5701 u8 netlbl_active;
5702 u8 peerlbl_active;
5703
5704 if (!selinux_policycap_netpeer())
5705 return NF_ACCEPT;
5706
5707 secmark_active = selinux_secmark_enabled();
5708 netlbl_active = netlbl_enabled();
5709 peerlbl_active = selinux_peerlbl_enabled();
5710 if (!secmark_active && !peerlbl_active)
5711 return NF_ACCEPT;
5712
5713 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5714 return NF_DROP;
5715
5716 ad.type = LSM_AUDIT_DATA_NET;
5717 ad.u.net = &net;
5718 ad.u.net->netif = indev->ifindex;
5719 ad.u.net->family = family;
5720 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5721 return NF_DROP;
5722
5723 if (peerlbl_active) {
5724 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5725 addrp, family, peer_sid, &ad);
5726 if (err) {
5727 selinux_netlbl_err(skb, family, err, 1);
5728 return NF_DROP;
5729 }
5730 }
5731
5732 if (secmark_active)
5733 if (avc_has_perm(&selinux_state,
5734 peer_sid, skb->secmark,
5735 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5736 return NF_DROP;
5737
5738 if (netlbl_active)
5739 /* we do this in the FORWARD path and not the POST_ROUTING
5740 * path because we want to make sure we apply the necessary
5741 * labeling before IPsec is applied so we can leverage AH
5742 * protection */
5743 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5744 return NF_DROP;
5745
5746 return NF_ACCEPT;
5747 }
5748
5749 static unsigned int selinux_ipv4_forward(void *priv,
5750 struct sk_buff *skb,
5751 const struct nf_hook_state *state)
5752 {
5753 return selinux_ip_forward(skb, state->in, PF_INET);
5754 }
5755
5756 #if IS_ENABLED(CONFIG_IPV6)
5757 static unsigned int selinux_ipv6_forward(void *priv,
5758 struct sk_buff *skb,
5759 const struct nf_hook_state *state)
5760 {
5761 return selinux_ip_forward(skb, state->in, PF_INET6);
5762 }
5763 #endif /* IPV6 */
5764
5765 static unsigned int selinux_ip_output(struct sk_buff *skb,
5766 u16 family)
5767 {
5768 struct sock *sk;
5769 u32 sid;
5770
5771 if (!netlbl_enabled())
5772 return NF_ACCEPT;
5773
5774 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5775 * because we want to make sure we apply the necessary labeling
5776 * before IPsec is applied so we can leverage AH protection */
5777 sk = skb->sk;
5778 if (sk) {
5779 struct sk_security_struct *sksec;
5780
5781 if (sk_listener(sk))
5782 /* if the socket is the listening state then this
5783 * packet is a SYN-ACK packet which means it needs to
5784 * be labeled based on the connection/request_sock and
5785 * not the parent socket. unfortunately, we can't
5786 * lookup the request_sock yet as it isn't queued on
5787 * the parent socket until after the SYN-ACK is sent.
5788 * the "solution" is to simply pass the packet as-is
5789 * as any IP option based labeling should be copied
5790 * from the initial connection request (in the IP
5791 * layer). it is far from ideal, but until we get a
5792 * security label in the packet itself this is the
5793 * best we can do. */
5794 return NF_ACCEPT;
5795
5796 /* standard practice, label using the parent socket */
5797 sksec = sk->sk_security;
5798 sid = sksec->sid;
5799 } else
5800 sid = SECINITSID_KERNEL;
5801 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5802 return NF_DROP;
5803
5804 return NF_ACCEPT;
5805 }
5806
5807 static unsigned int selinux_ipv4_output(void *priv,
5808 struct sk_buff *skb,
5809 const struct nf_hook_state *state)
5810 {
5811 return selinux_ip_output(skb, PF_INET);
5812 }
5813
5814 #if IS_ENABLED(CONFIG_IPV6)
5815 static unsigned int selinux_ipv6_output(void *priv,
5816 struct sk_buff *skb,
5817 const struct nf_hook_state *state)
5818 {
5819 return selinux_ip_output(skb, PF_INET6);
5820 }
5821 #endif /* IPV6 */
5822
5823 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5824 int ifindex,
5825 u16 family)
5826 {
5827 struct sock *sk = skb_to_full_sk(skb);
5828 struct sk_security_struct *sksec;
5829 struct common_audit_data ad;
5830 struct lsm_network_audit net = {0,};
5831 char *addrp;
5832 u8 proto;
5833
5834 if (sk == NULL)
5835 return NF_ACCEPT;
5836 sksec = sk->sk_security;
5837
5838 ad.type = LSM_AUDIT_DATA_NET;
5839 ad.u.net = &net;
5840 ad.u.net->netif = ifindex;
5841 ad.u.net->family = family;
5842 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5843 return NF_DROP;
5844
5845 if (selinux_secmark_enabled())
5846 if (avc_has_perm(&selinux_state,
5847 sksec->sid, skb->secmark,
5848 SECCLASS_PACKET, PACKET__SEND, &ad))
5849 return NF_DROP_ERR(-ECONNREFUSED);
5850
5851 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5852 return NF_DROP_ERR(-ECONNREFUSED);
5853
5854 return NF_ACCEPT;
5855 }
5856
5857 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5858 const struct net_device *outdev,
5859 u16 family)
5860 {
5861 u32 secmark_perm;
5862 u32 peer_sid;
5863 int ifindex = outdev->ifindex;
5864 struct sock *sk;
5865 struct common_audit_data ad;
5866 struct lsm_network_audit net = {0,};
5867 char *addrp;
5868 u8 secmark_active;
5869 u8 peerlbl_active;
5870
5871 /* If any sort of compatibility mode is enabled then handoff processing
5872 * to the selinux_ip_postroute_compat() function to deal with the
5873 * special handling. We do this in an attempt to keep this function
5874 * as fast and as clean as possible. */
5875 if (!selinux_policycap_netpeer())
5876 return selinux_ip_postroute_compat(skb, ifindex, family);
5877
5878 secmark_active = selinux_secmark_enabled();
5879 peerlbl_active = selinux_peerlbl_enabled();
5880 if (!secmark_active && !peerlbl_active)
5881 return NF_ACCEPT;
5882
5883 sk = skb_to_full_sk(skb);
5884
5885 #ifdef CONFIG_XFRM
5886 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5887 * packet transformation so allow the packet to pass without any checks
5888 * since we'll have another chance to perform access control checks
5889 * when the packet is on it's final way out.
5890 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5891 * is NULL, in this case go ahead and apply access control.
5892 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5893 * TCP listening state we cannot wait until the XFRM processing
5894 * is done as we will miss out on the SA label if we do;
5895 * unfortunately, this means more work, but it is only once per
5896 * connection. */
5897 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5898 !(sk && sk_listener(sk)))
5899 return NF_ACCEPT;
5900 #endif
5901
5902 if (sk == NULL) {
5903 /* Without an associated socket the packet is either coming
5904 * from the kernel or it is being forwarded; check the packet
5905 * to determine which and if the packet is being forwarded
5906 * query the packet directly to determine the security label. */
5907 if (skb->skb_iif) {
5908 secmark_perm = PACKET__FORWARD_OUT;
5909 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5910 return NF_DROP;
5911 } else {
5912 secmark_perm = PACKET__SEND;
5913 peer_sid = SECINITSID_KERNEL;
5914 }
5915 } else if (sk_listener(sk)) {
5916 /* Locally generated packet but the associated socket is in the
5917 * listening state which means this is a SYN-ACK packet. In
5918 * this particular case the correct security label is assigned
5919 * to the connection/request_sock but unfortunately we can't
5920 * query the request_sock as it isn't queued on the parent
5921 * socket until after the SYN-ACK packet is sent; the only
5922 * viable choice is to regenerate the label like we do in
5923 * selinux_inet_conn_request(). See also selinux_ip_output()
5924 * for similar problems. */
5925 u32 skb_sid;
5926 struct sk_security_struct *sksec;
5927
5928 sksec = sk->sk_security;
5929 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5930 return NF_DROP;
5931 /* At this point, if the returned skb peerlbl is SECSID_NULL
5932 * and the packet has been through at least one XFRM
5933 * transformation then we must be dealing with the "final"
5934 * form of labeled IPsec packet; since we've already applied
5935 * all of our access controls on this packet we can safely
5936 * pass the packet. */
5937 if (skb_sid == SECSID_NULL) {
5938 switch (family) {
5939 case PF_INET:
5940 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5941 return NF_ACCEPT;
5942 break;
5943 case PF_INET6:
5944 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5945 return NF_ACCEPT;
5946 break;
5947 default:
5948 return NF_DROP_ERR(-ECONNREFUSED);
5949 }
5950 }
5951 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5952 return NF_DROP;
5953 secmark_perm = PACKET__SEND;
5954 } else {
5955 /* Locally generated packet, fetch the security label from the
5956 * associated socket. */
5957 struct sk_security_struct *sksec = sk->sk_security;
5958 peer_sid = sksec->sid;
5959 secmark_perm = PACKET__SEND;
5960 }
5961
5962 ad.type = LSM_AUDIT_DATA_NET;
5963 ad.u.net = &net;
5964 ad.u.net->netif = ifindex;
5965 ad.u.net->family = family;
5966 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5967 return NF_DROP;
5968
5969 if (secmark_active)
5970 if (avc_has_perm(&selinux_state,
5971 peer_sid, skb->secmark,
5972 SECCLASS_PACKET, secmark_perm, &ad))
5973 return NF_DROP_ERR(-ECONNREFUSED);
5974
5975 if (peerlbl_active) {
5976 u32 if_sid;
5977 u32 node_sid;
5978
5979 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5980 return NF_DROP;
5981 if (avc_has_perm(&selinux_state,
5982 peer_sid, if_sid,
5983 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5984 return NF_DROP_ERR(-ECONNREFUSED);
5985
5986 if (sel_netnode_sid(addrp, family, &node_sid))
5987 return NF_DROP;
5988 if (avc_has_perm(&selinux_state,
5989 peer_sid, node_sid,
5990 SECCLASS_NODE, NODE__SENDTO, &ad))
5991 return NF_DROP_ERR(-ECONNREFUSED);
5992 }
5993
5994 return NF_ACCEPT;
5995 }
5996
5997 static unsigned int selinux_ipv4_postroute(void *priv,
5998 struct sk_buff *skb,
5999 const struct nf_hook_state *state)
6000 {
6001 return selinux_ip_postroute(skb, state->out, PF_INET);
6002 }
6003
6004 #if IS_ENABLED(CONFIG_IPV6)
6005 static unsigned int selinux_ipv6_postroute(void *priv,
6006 struct sk_buff *skb,
6007 const struct nf_hook_state *state)
6008 {
6009 return selinux_ip_postroute(skb, state->out, PF_INET6);
6010 }
6011 #endif /* IPV6 */
6012
6013 #endif /* CONFIG_NETFILTER */
6014
6015 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6016 {
6017 int rc = 0;
6018 unsigned int msg_len;
6019 unsigned int data_len = skb->len;
6020 unsigned char *data = skb->data;
6021 struct nlmsghdr *nlh;
6022 struct sk_security_struct *sksec = sk->sk_security;
6023 u16 sclass = sksec->sclass;
6024 u32 perm;
6025
6026 while (data_len >= nlmsg_total_size(0)) {
6027 nlh = (struct nlmsghdr *)data;
6028
6029 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
6030 * users which means we can't reject skb's with bogus
6031 * length fields; our solution is to follow what
6032 * netlink_rcv_skb() does and simply skip processing at
6033 * messages with length fields that are clearly junk
6034 */
6035 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6036 return 0;
6037
6038 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6039 if (rc == 0) {
6040 rc = sock_has_perm(sk, perm);
6041 if (rc)
6042 return rc;
6043 } else if (rc == -EINVAL) {
6044 /* -EINVAL is a missing msg/perm mapping */
6045 pr_warn_ratelimited("SELinux: unrecognized netlink"
6046 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
6047 " pid=%d comm=%s\n",
6048 sk->sk_protocol, nlh->nlmsg_type,
6049 secclass_map[sclass - 1].name,
6050 task_pid_nr(current), current->comm);
6051 if (enforcing_enabled(&selinux_state) &&
6052 !security_get_allow_unknown(&selinux_state))
6053 return rc;
6054 rc = 0;
6055 } else if (rc == -ENOENT) {
6056 /* -ENOENT is a missing socket/class mapping, ignore */
6057 rc = 0;
6058 } else {
6059 return rc;
6060 }
6061
6062 /* move to the next message after applying netlink padding */
6063 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6064 if (msg_len >= data_len)
6065 return 0;
6066 data_len -= msg_len;
6067 data += msg_len;
6068 }
6069
6070 return rc;
6071 }
6072
6073 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6074 {
6075 isec->sclass = sclass;
6076 isec->sid = current_sid();
6077 }
6078
6079 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6080 u32 perms)
6081 {
6082 struct ipc_security_struct *isec;
6083 struct common_audit_data ad;
6084 u32 sid = current_sid();
6085
6086 isec = selinux_ipc(ipc_perms);
6087
6088 ad.type = LSM_AUDIT_DATA_IPC;
6089 ad.u.ipc_id = ipc_perms->key;
6090
6091 return avc_has_perm(&selinux_state,
6092 sid, isec->sid, isec->sclass, perms, &ad);
6093 }
6094
6095 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6096 {
6097 struct msg_security_struct *msec;
6098
6099 msec = selinux_msg_msg(msg);
6100 msec->sid = SECINITSID_UNLABELED;
6101
6102 return 0;
6103 }
6104
6105 /* message queue security operations */
6106 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6107 {
6108 struct ipc_security_struct *isec;
6109 struct common_audit_data ad;
6110 u32 sid = current_sid();
6111 int rc;
6112
6113 isec = selinux_ipc(msq);
6114 ipc_init_security(isec, SECCLASS_MSGQ);
6115
6116 ad.type = LSM_AUDIT_DATA_IPC;
6117 ad.u.ipc_id = msq->key;
6118
6119 rc = avc_has_perm(&selinux_state,
6120 sid, isec->sid, SECCLASS_MSGQ,
6121 MSGQ__CREATE, &ad);
6122 return rc;
6123 }
6124
6125 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6126 {
6127 struct ipc_security_struct *isec;
6128 struct common_audit_data ad;
6129 u32 sid = current_sid();
6130
6131 isec = selinux_ipc(msq);
6132
6133 ad.type = LSM_AUDIT_DATA_IPC;
6134 ad.u.ipc_id = msq->key;
6135
6136 return avc_has_perm(&selinux_state,
6137 sid, isec->sid, SECCLASS_MSGQ,
6138 MSGQ__ASSOCIATE, &ad);
6139 }
6140
6141 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6142 {
6143 int err;
6144 int perms;
6145
6146 switch (cmd) {
6147 case IPC_INFO:
6148 case MSG_INFO:
6149 /* No specific object, just general system-wide information. */
6150 return avc_has_perm(&selinux_state,
6151 current_sid(), SECINITSID_KERNEL,
6152 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6153 case IPC_STAT:
6154 case MSG_STAT:
6155 case MSG_STAT_ANY:
6156 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6157 break;
6158 case IPC_SET:
6159 perms = MSGQ__SETATTR;
6160 break;
6161 case IPC_RMID:
6162 perms = MSGQ__DESTROY;
6163 break;
6164 default:
6165 return 0;
6166 }
6167
6168 err = ipc_has_perm(msq, perms);
6169 return err;
6170 }
6171
6172 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6173 {
6174 struct ipc_security_struct *isec;
6175 struct msg_security_struct *msec;
6176 struct common_audit_data ad;
6177 u32 sid = current_sid();
6178 int rc;
6179
6180 isec = selinux_ipc(msq);
6181 msec = selinux_msg_msg(msg);
6182
6183 /*
6184 * First time through, need to assign label to the message
6185 */
6186 if (msec->sid == SECINITSID_UNLABELED) {
6187 /*
6188 * Compute new sid based on current process and
6189 * message queue this message will be stored in
6190 */
6191 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6192 SECCLASS_MSG, NULL, &msec->sid);
6193 if (rc)
6194 return rc;
6195 }
6196
6197 ad.type = LSM_AUDIT_DATA_IPC;
6198 ad.u.ipc_id = msq->key;
6199
6200 /* Can this process write to the queue? */
6201 rc = avc_has_perm(&selinux_state,
6202 sid, isec->sid, SECCLASS_MSGQ,
6203 MSGQ__WRITE, &ad);
6204 if (!rc)
6205 /* Can this process send the message */
6206 rc = avc_has_perm(&selinux_state,
6207 sid, msec->sid, SECCLASS_MSG,
6208 MSG__SEND, &ad);
6209 if (!rc)
6210 /* Can the message be put in the queue? */
6211 rc = avc_has_perm(&selinux_state,
6212 msec->sid, isec->sid, SECCLASS_MSGQ,
6213 MSGQ__ENQUEUE, &ad);
6214
6215 return rc;
6216 }
6217
6218 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6219 struct task_struct *target,
6220 long type, int mode)
6221 {
6222 struct ipc_security_struct *isec;
6223 struct msg_security_struct *msec;
6224 struct common_audit_data ad;
6225 u32 sid = task_sid_obj(target);
6226 int rc;
6227
6228 isec = selinux_ipc(msq);
6229 msec = selinux_msg_msg(msg);
6230
6231 ad.type = LSM_AUDIT_DATA_IPC;
6232 ad.u.ipc_id = msq->key;
6233
6234 rc = avc_has_perm(&selinux_state,
6235 sid, isec->sid,
6236 SECCLASS_MSGQ, MSGQ__READ, &ad);
6237 if (!rc)
6238 rc = avc_has_perm(&selinux_state,
6239 sid, msec->sid,
6240 SECCLASS_MSG, MSG__RECEIVE, &ad);
6241 return rc;
6242 }
6243
6244 /* Shared Memory security operations */
6245 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6246 {
6247 struct ipc_security_struct *isec;
6248 struct common_audit_data ad;
6249 u32 sid = current_sid();
6250 int rc;
6251
6252 isec = selinux_ipc(shp);
6253 ipc_init_security(isec, SECCLASS_SHM);
6254
6255 ad.type = LSM_AUDIT_DATA_IPC;
6256 ad.u.ipc_id = shp->key;
6257
6258 rc = avc_has_perm(&selinux_state,
6259 sid, isec->sid, SECCLASS_SHM,
6260 SHM__CREATE, &ad);
6261 return rc;
6262 }
6263
6264 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6265 {
6266 struct ipc_security_struct *isec;
6267 struct common_audit_data ad;
6268 u32 sid = current_sid();
6269
6270 isec = selinux_ipc(shp);
6271
6272 ad.type = LSM_AUDIT_DATA_IPC;
6273 ad.u.ipc_id = shp->key;
6274
6275 return avc_has_perm(&selinux_state,
6276 sid, isec->sid, SECCLASS_SHM,
6277 SHM__ASSOCIATE, &ad);
6278 }
6279
6280 /* Note, at this point, shp is locked down */
6281 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6282 {
6283 int perms;
6284 int err;
6285
6286 switch (cmd) {
6287 case IPC_INFO:
6288 case SHM_INFO:
6289 /* No specific object, just general system-wide information. */
6290 return avc_has_perm(&selinux_state,
6291 current_sid(), SECINITSID_KERNEL,
6292 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6293 case IPC_STAT:
6294 case SHM_STAT:
6295 case SHM_STAT_ANY:
6296 perms = SHM__GETATTR | SHM__ASSOCIATE;
6297 break;
6298 case IPC_SET:
6299 perms = SHM__SETATTR;
6300 break;
6301 case SHM_LOCK:
6302 case SHM_UNLOCK:
6303 perms = SHM__LOCK;
6304 break;
6305 case IPC_RMID:
6306 perms = SHM__DESTROY;
6307 break;
6308 default:
6309 return 0;
6310 }
6311
6312 err = ipc_has_perm(shp, perms);
6313 return err;
6314 }
6315
6316 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6317 char __user *shmaddr, int shmflg)
6318 {
6319 u32 perms;
6320
6321 if (shmflg & SHM_RDONLY)
6322 perms = SHM__READ;
6323 else
6324 perms = SHM__READ | SHM__WRITE;
6325
6326 return ipc_has_perm(shp, perms);
6327 }
6328
6329 /* Semaphore security operations */
6330 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6331 {
6332 struct ipc_security_struct *isec;
6333 struct common_audit_data ad;
6334 u32 sid = current_sid();
6335 int rc;
6336
6337 isec = selinux_ipc(sma);
6338 ipc_init_security(isec, SECCLASS_SEM);
6339
6340 ad.type = LSM_AUDIT_DATA_IPC;
6341 ad.u.ipc_id = sma->key;
6342
6343 rc = avc_has_perm(&selinux_state,
6344 sid, isec->sid, SECCLASS_SEM,
6345 SEM__CREATE, &ad);
6346 return rc;
6347 }
6348
6349 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6350 {
6351 struct ipc_security_struct *isec;
6352 struct common_audit_data ad;
6353 u32 sid = current_sid();
6354
6355 isec = selinux_ipc(sma);
6356
6357 ad.type = LSM_AUDIT_DATA_IPC;
6358 ad.u.ipc_id = sma->key;
6359
6360 return avc_has_perm(&selinux_state,
6361 sid, isec->sid, SECCLASS_SEM,
6362 SEM__ASSOCIATE, &ad);
6363 }
6364
6365 /* Note, at this point, sma is locked down */
6366 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6367 {
6368 int err;
6369 u32 perms;
6370
6371 switch (cmd) {
6372 case IPC_INFO:
6373 case SEM_INFO:
6374 /* No specific object, just general system-wide information. */
6375 return avc_has_perm(&selinux_state,
6376 current_sid(), SECINITSID_KERNEL,
6377 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6378 case GETPID:
6379 case GETNCNT:
6380 case GETZCNT:
6381 perms = SEM__GETATTR;
6382 break;
6383 case GETVAL:
6384 case GETALL:
6385 perms = SEM__READ;
6386 break;
6387 case SETVAL:
6388 case SETALL:
6389 perms = SEM__WRITE;
6390 break;
6391 case IPC_RMID:
6392 perms = SEM__DESTROY;
6393 break;
6394 case IPC_SET:
6395 perms = SEM__SETATTR;
6396 break;
6397 case IPC_STAT:
6398 case SEM_STAT:
6399 case SEM_STAT_ANY:
6400 perms = SEM__GETATTR | SEM__ASSOCIATE;
6401 break;
6402 default:
6403 return 0;
6404 }
6405
6406 err = ipc_has_perm(sma, perms);
6407 return err;
6408 }
6409
6410 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6411 struct sembuf *sops, unsigned nsops, int alter)
6412 {
6413 u32 perms;
6414
6415 if (alter)
6416 perms = SEM__READ | SEM__WRITE;
6417 else
6418 perms = SEM__READ;
6419
6420 return ipc_has_perm(sma, perms);
6421 }
6422
6423 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6424 {
6425 u32 av = 0;
6426
6427 av = 0;
6428 if (flag & S_IRUGO)
6429 av |= IPC__UNIX_READ;
6430 if (flag & S_IWUGO)
6431 av |= IPC__UNIX_WRITE;
6432
6433 if (av == 0)
6434 return 0;
6435
6436 return ipc_has_perm(ipcp, av);
6437 }
6438
6439 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6440 {
6441 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6442 *secid = isec->sid;
6443 }
6444
6445 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6446 {
6447 if (inode)
6448 inode_doinit_with_dentry(inode, dentry);
6449 }
6450
6451 static int selinux_getprocattr(struct task_struct *p,
6452 char *name, char **value)
6453 {
6454 const struct task_security_struct *__tsec;
6455 u32 sid;
6456 int error;
6457 unsigned len;
6458
6459 rcu_read_lock();
6460 __tsec = selinux_cred(__task_cred(p));
6461
6462 if (current != p) {
6463 error = avc_has_perm(&selinux_state,
6464 current_sid(), __tsec->sid,
6465 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6466 if (error)
6467 goto bad;
6468 }
6469
6470 if (!strcmp(name, "current"))
6471 sid = __tsec->sid;
6472 else if (!strcmp(name, "prev"))
6473 sid = __tsec->osid;
6474 else if (!strcmp(name, "exec"))
6475 sid = __tsec->exec_sid;
6476 else if (!strcmp(name, "fscreate"))
6477 sid = __tsec->create_sid;
6478 else if (!strcmp(name, "keycreate"))
6479 sid = __tsec->keycreate_sid;
6480 else if (!strcmp(name, "sockcreate"))
6481 sid = __tsec->sockcreate_sid;
6482 else {
6483 error = -EINVAL;
6484 goto bad;
6485 }
6486 rcu_read_unlock();
6487
6488 if (!sid)
6489 return 0;
6490
6491 error = security_sid_to_context(&selinux_state, sid, value, &len);
6492 if (error)
6493 return error;
6494 return len;
6495
6496 bad:
6497 rcu_read_unlock();
6498 return error;
6499 }
6500
6501 static int selinux_setprocattr(const char *name, void *value, size_t size)
6502 {
6503 struct task_security_struct *tsec;
6504 struct cred *new;
6505 u32 mysid = current_sid(), sid = 0, ptsid;
6506 int error;
6507 char *str = value;
6508
6509 /*
6510 * Basic control over ability to set these attributes at all.
6511 */
6512 if (!strcmp(name, "exec"))
6513 error = avc_has_perm(&selinux_state,
6514 mysid, mysid, SECCLASS_PROCESS,
6515 PROCESS__SETEXEC, NULL);
6516 else if (!strcmp(name, "fscreate"))
6517 error = avc_has_perm(&selinux_state,
6518 mysid, mysid, SECCLASS_PROCESS,
6519 PROCESS__SETFSCREATE, NULL);
6520 else if (!strcmp(name, "keycreate"))
6521 error = avc_has_perm(&selinux_state,
6522 mysid, mysid, SECCLASS_PROCESS,
6523 PROCESS__SETKEYCREATE, NULL);
6524 else if (!strcmp(name, "sockcreate"))
6525 error = avc_has_perm(&selinux_state,
6526 mysid, mysid, SECCLASS_PROCESS,
6527 PROCESS__SETSOCKCREATE, NULL);
6528 else if (!strcmp(name, "current"))
6529 error = avc_has_perm(&selinux_state,
6530 mysid, mysid, SECCLASS_PROCESS,
6531 PROCESS__SETCURRENT, NULL);
6532 else
6533 error = -EINVAL;
6534 if (error)
6535 return error;
6536
6537 /* Obtain a SID for the context, if one was specified. */
6538 if (size && str[0] && str[0] != '\n') {
6539 if (str[size-1] == '\n') {
6540 str[size-1] = 0;
6541 size--;
6542 }
6543 error = security_context_to_sid(&selinux_state, value, size,
6544 &sid, GFP_KERNEL);
6545 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6546 if (!has_cap_mac_admin(true)) {
6547 struct audit_buffer *ab;
6548 size_t audit_size;
6549
6550 /* We strip a nul only if it is at the end, otherwise the
6551 * context contains a nul and we should audit that */
6552 if (str[size - 1] == '\0')
6553 audit_size = size - 1;
6554 else
6555 audit_size = size;
6556 ab = audit_log_start(audit_context(),
6557 GFP_ATOMIC,
6558 AUDIT_SELINUX_ERR);
6559 if (!ab)
6560 return error;
6561 audit_log_format(ab, "op=fscreate invalid_context=");
6562 audit_log_n_untrustedstring(ab, value, audit_size);
6563 audit_log_end(ab);
6564
6565 return error;
6566 }
6567 error = security_context_to_sid_force(
6568 &selinux_state,
6569 value, size, &sid);
6570 }
6571 if (error)
6572 return error;
6573 }
6574
6575 new = prepare_creds();
6576 if (!new)
6577 return -ENOMEM;
6578
6579 /* Permission checking based on the specified context is
6580 performed during the actual operation (execve,
6581 open/mkdir/...), when we know the full context of the
6582 operation. See selinux_bprm_creds_for_exec for the execve
6583 checks and may_create for the file creation checks. The
6584 operation will then fail if the context is not permitted. */
6585 tsec = selinux_cred(new);
6586 if (!strcmp(name, "exec")) {
6587 tsec->exec_sid = sid;
6588 } else if (!strcmp(name, "fscreate")) {
6589 tsec->create_sid = sid;
6590 } else if (!strcmp(name, "keycreate")) {
6591 if (sid) {
6592 error = avc_has_perm(&selinux_state, mysid, sid,
6593 SECCLASS_KEY, KEY__CREATE, NULL);
6594 if (error)
6595 goto abort_change;
6596 }
6597 tsec->keycreate_sid = sid;
6598 } else if (!strcmp(name, "sockcreate")) {
6599 tsec->sockcreate_sid = sid;
6600 } else if (!strcmp(name, "current")) {
6601 error = -EINVAL;
6602 if (sid == 0)
6603 goto abort_change;
6604
6605 /* Only allow single threaded processes to change context */
6606 error = -EPERM;
6607 if (!current_is_single_threaded()) {
6608 error = security_bounded_transition(&selinux_state,
6609 tsec->sid, sid);
6610 if (error)
6611 goto abort_change;
6612 }
6613
6614 /* Check permissions for the transition. */
6615 error = avc_has_perm(&selinux_state,
6616 tsec->sid, sid, SECCLASS_PROCESS,
6617 PROCESS__DYNTRANSITION, NULL);
6618 if (error)
6619 goto abort_change;
6620
6621 /* Check for ptracing, and update the task SID if ok.
6622 Otherwise, leave SID unchanged and fail. */
6623 ptsid = ptrace_parent_sid();
6624 if (ptsid != 0) {
6625 error = avc_has_perm(&selinux_state,
6626 ptsid, sid, SECCLASS_PROCESS,
6627 PROCESS__PTRACE, NULL);
6628 if (error)
6629 goto abort_change;
6630 }
6631
6632 tsec->sid = sid;
6633 } else {
6634 error = -EINVAL;
6635 goto abort_change;
6636 }
6637
6638 commit_creds(new);
6639 return size;
6640
6641 abort_change:
6642 abort_creds(new);
6643 return error;
6644 }
6645
6646 static int selinux_ismaclabel(const char *name)
6647 {
6648 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6649 }
6650
6651 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6652 {
6653 return security_sid_to_context(&selinux_state, secid,
6654 secdata, seclen);
6655 }
6656
6657 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6658 {
6659 return security_context_to_sid(&selinux_state, secdata, seclen,
6660 secid, GFP_KERNEL);
6661 }
6662
6663 static void selinux_release_secctx(char *secdata, u32 seclen)
6664 {
6665 kfree(secdata);
6666 }
6667
6668 static void selinux_inode_invalidate_secctx(struct inode *inode)
6669 {
6670 struct inode_security_struct *isec = selinux_inode(inode);
6671
6672 spin_lock(&isec->lock);
6673 isec->initialized = LABEL_INVALID;
6674 spin_unlock(&isec->lock);
6675 }
6676
6677 /*
6678 * called with inode->i_mutex locked
6679 */
6680 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6681 {
6682 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6683 ctx, ctxlen, 0);
6684 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6685 return rc == -EOPNOTSUPP ? 0 : rc;
6686 }
6687
6688 /*
6689 * called with inode->i_mutex locked
6690 */
6691 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6692 {
6693 return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6694 ctx, ctxlen, 0);
6695 }
6696
6697 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6698 {
6699 int len = 0;
6700 len = selinux_inode_getsecurity(&init_user_ns, inode,
6701 XATTR_SELINUX_SUFFIX, ctx, true);
6702 if (len < 0)
6703 return len;
6704 *ctxlen = len;
6705 return 0;
6706 }
6707 #ifdef CONFIG_KEYS
6708
6709 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6710 unsigned long flags)
6711 {
6712 const struct task_security_struct *tsec;
6713 struct key_security_struct *ksec;
6714
6715 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6716 if (!ksec)
6717 return -ENOMEM;
6718
6719 tsec = selinux_cred(cred);
6720 if (tsec->keycreate_sid)
6721 ksec->sid = tsec->keycreate_sid;
6722 else
6723 ksec->sid = tsec->sid;
6724
6725 k->security = ksec;
6726 return 0;
6727 }
6728
6729 static void selinux_key_free(struct key *k)
6730 {
6731 struct key_security_struct *ksec = k->security;
6732
6733 k->security = NULL;
6734 kfree(ksec);
6735 }
6736
6737 static int selinux_key_permission(key_ref_t key_ref,
6738 const struct cred *cred,
6739 enum key_need_perm need_perm)
6740 {
6741 struct key *key;
6742 struct key_security_struct *ksec;
6743 u32 perm, sid;
6744
6745 switch (need_perm) {
6746 case KEY_NEED_VIEW:
6747 perm = KEY__VIEW;
6748 break;
6749 case KEY_NEED_READ:
6750 perm = KEY__READ;
6751 break;
6752 case KEY_NEED_WRITE:
6753 perm = KEY__WRITE;
6754 break;
6755 case KEY_NEED_SEARCH:
6756 perm = KEY__SEARCH;
6757 break;
6758 case KEY_NEED_LINK:
6759 perm = KEY__LINK;
6760 break;
6761 case KEY_NEED_SETATTR:
6762 perm = KEY__SETATTR;
6763 break;
6764 case KEY_NEED_UNLINK:
6765 case KEY_SYSADMIN_OVERRIDE:
6766 case KEY_AUTHTOKEN_OVERRIDE:
6767 case KEY_DEFER_PERM_CHECK:
6768 return 0;
6769 default:
6770 WARN_ON(1);
6771 return -EPERM;
6772
6773 }
6774
6775 sid = cred_sid(cred);
6776 key = key_ref_to_ptr(key_ref);
6777 ksec = key->security;
6778
6779 return avc_has_perm(&selinux_state,
6780 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6781 }
6782
6783 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6784 {
6785 struct key_security_struct *ksec = key->security;
6786 char *context = NULL;
6787 unsigned len;
6788 int rc;
6789
6790 rc = security_sid_to_context(&selinux_state, ksec->sid,
6791 &context, &len);
6792 if (!rc)
6793 rc = len;
6794 *_buffer = context;
6795 return rc;
6796 }
6797
6798 #ifdef CONFIG_KEY_NOTIFICATIONS
6799 static int selinux_watch_key(struct key *key)
6800 {
6801 struct key_security_struct *ksec = key->security;
6802 u32 sid = current_sid();
6803
6804 return avc_has_perm(&selinux_state,
6805 sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6806 }
6807 #endif
6808 #endif
6809
6810 #ifdef CONFIG_SECURITY_INFINIBAND
6811 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6812 {
6813 struct common_audit_data ad;
6814 int err;
6815 u32 sid = 0;
6816 struct ib_security_struct *sec = ib_sec;
6817 struct lsm_ibpkey_audit ibpkey;
6818
6819 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6820 if (err)
6821 return err;
6822
6823 ad.type = LSM_AUDIT_DATA_IBPKEY;
6824 ibpkey.subnet_prefix = subnet_prefix;
6825 ibpkey.pkey = pkey_val;
6826 ad.u.ibpkey = &ibpkey;
6827 return avc_has_perm(&selinux_state,
6828 sec->sid, sid,
6829 SECCLASS_INFINIBAND_PKEY,
6830 INFINIBAND_PKEY__ACCESS, &ad);
6831 }
6832
6833 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6834 u8 port_num)
6835 {
6836 struct common_audit_data ad;
6837 int err;
6838 u32 sid = 0;
6839 struct ib_security_struct *sec = ib_sec;
6840 struct lsm_ibendport_audit ibendport;
6841
6842 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6843 &sid);
6844
6845 if (err)
6846 return err;
6847
6848 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6849 ibendport.dev_name = dev_name;
6850 ibendport.port = port_num;
6851 ad.u.ibendport = &ibendport;
6852 return avc_has_perm(&selinux_state,
6853 sec->sid, sid,
6854 SECCLASS_INFINIBAND_ENDPORT,
6855 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6856 }
6857
6858 static int selinux_ib_alloc_security(void **ib_sec)
6859 {
6860 struct ib_security_struct *sec;
6861
6862 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6863 if (!sec)
6864 return -ENOMEM;
6865 sec->sid = current_sid();
6866
6867 *ib_sec = sec;
6868 return 0;
6869 }
6870
6871 static void selinux_ib_free_security(void *ib_sec)
6872 {
6873 kfree(ib_sec);
6874 }
6875 #endif
6876
6877 #ifdef CONFIG_BPF_SYSCALL
6878 static int selinux_bpf(int cmd, union bpf_attr *attr,
6879 unsigned int size)
6880 {
6881 u32 sid = current_sid();
6882 int ret;
6883
6884 switch (cmd) {
6885 case BPF_MAP_CREATE:
6886 ret = avc_has_perm(&selinux_state,
6887 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6888 NULL);
6889 break;
6890 case BPF_PROG_LOAD:
6891 ret = avc_has_perm(&selinux_state,
6892 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6893 NULL);
6894 break;
6895 default:
6896 ret = 0;
6897 break;
6898 }
6899
6900 return ret;
6901 }
6902
6903 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6904 {
6905 u32 av = 0;
6906
6907 if (fmode & FMODE_READ)
6908 av |= BPF__MAP_READ;
6909 if (fmode & FMODE_WRITE)
6910 av |= BPF__MAP_WRITE;
6911 return av;
6912 }
6913
6914 /* This function will check the file pass through unix socket or binder to see
6915 * if it is a bpf related object. And apply correspinding checks on the bpf
6916 * object based on the type. The bpf maps and programs, not like other files and
6917 * socket, are using a shared anonymous inode inside the kernel as their inode.
6918 * So checking that inode cannot identify if the process have privilege to
6919 * access the bpf object and that's why we have to add this additional check in
6920 * selinux_file_receive and selinux_binder_transfer_files.
6921 */
6922 static int bpf_fd_pass(struct file *file, u32 sid)
6923 {
6924 struct bpf_security_struct *bpfsec;
6925 struct bpf_prog *prog;
6926 struct bpf_map *map;
6927 int ret;
6928
6929 if (file->f_op == &bpf_map_fops) {
6930 map = file->private_data;
6931 bpfsec = map->security;
6932 ret = avc_has_perm(&selinux_state,
6933 sid, bpfsec->sid, SECCLASS_BPF,
6934 bpf_map_fmode_to_av(file->f_mode), NULL);
6935 if (ret)
6936 return ret;
6937 } else if (file->f_op == &bpf_prog_fops) {
6938 prog = file->private_data;
6939 bpfsec = prog->aux->security;
6940 ret = avc_has_perm(&selinux_state,
6941 sid, bpfsec->sid, SECCLASS_BPF,
6942 BPF__PROG_RUN, NULL);
6943 if (ret)
6944 return ret;
6945 }
6946 return 0;
6947 }
6948
6949 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6950 {
6951 u32 sid = current_sid();
6952 struct bpf_security_struct *bpfsec;
6953
6954 bpfsec = map->security;
6955 return avc_has_perm(&selinux_state,
6956 sid, bpfsec->sid, SECCLASS_BPF,
6957 bpf_map_fmode_to_av(fmode), NULL);
6958 }
6959
6960 static int selinux_bpf_prog(struct bpf_prog *prog)
6961 {
6962 u32 sid = current_sid();
6963 struct bpf_security_struct *bpfsec;
6964
6965 bpfsec = prog->aux->security;
6966 return avc_has_perm(&selinux_state,
6967 sid, bpfsec->sid, SECCLASS_BPF,
6968 BPF__PROG_RUN, NULL);
6969 }
6970
6971 static int selinux_bpf_map_alloc(struct bpf_map *map)
6972 {
6973 struct bpf_security_struct *bpfsec;
6974
6975 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6976 if (!bpfsec)
6977 return -ENOMEM;
6978
6979 bpfsec->sid = current_sid();
6980 map->security = bpfsec;
6981
6982 return 0;
6983 }
6984
6985 static void selinux_bpf_map_free(struct bpf_map *map)
6986 {
6987 struct bpf_security_struct *bpfsec = map->security;
6988
6989 map->security = NULL;
6990 kfree(bpfsec);
6991 }
6992
6993 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6994 {
6995 struct bpf_security_struct *bpfsec;
6996
6997 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6998 if (!bpfsec)
6999 return -ENOMEM;
7000
7001 bpfsec->sid = current_sid();
7002 aux->security = bpfsec;
7003
7004 return 0;
7005 }
7006
7007 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7008 {
7009 struct bpf_security_struct *bpfsec = aux->security;
7010
7011 aux->security = NULL;
7012 kfree(bpfsec);
7013 }
7014 #endif
7015
7016 static int selinux_lockdown(enum lockdown_reason what)
7017 {
7018 struct common_audit_data ad;
7019 u32 sid = current_sid();
7020 int invalid_reason = (what <= LOCKDOWN_NONE) ||
7021 (what == LOCKDOWN_INTEGRITY_MAX) ||
7022 (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7023
7024 if (WARN(invalid_reason, "Invalid lockdown reason")) {
7025 audit_log(audit_context(),
7026 GFP_ATOMIC, AUDIT_SELINUX_ERR,
7027 "lockdown_reason=invalid");
7028 return -EINVAL;
7029 }
7030
7031 ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7032 ad.u.reason = what;
7033
7034 if (what <= LOCKDOWN_INTEGRITY_MAX)
7035 return avc_has_perm(&selinux_state,
7036 sid, sid, SECCLASS_LOCKDOWN,
7037 LOCKDOWN__INTEGRITY, &ad);
7038 else
7039 return avc_has_perm(&selinux_state,
7040 sid, sid, SECCLASS_LOCKDOWN,
7041 LOCKDOWN__CONFIDENTIALITY, &ad);
7042 }
7043
7044 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7045 .lbs_cred = sizeof(struct task_security_struct),
7046 .lbs_file = sizeof(struct file_security_struct),
7047 .lbs_inode = sizeof(struct inode_security_struct),
7048 .lbs_ipc = sizeof(struct ipc_security_struct),
7049 .lbs_msg_msg = sizeof(struct msg_security_struct),
7050 .lbs_superblock = sizeof(struct superblock_security_struct),
7051 };
7052
7053 #ifdef CONFIG_PERF_EVENTS
7054 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7055 {
7056 u32 requested, sid = current_sid();
7057
7058 if (type == PERF_SECURITY_OPEN)
7059 requested = PERF_EVENT__OPEN;
7060 else if (type == PERF_SECURITY_CPU)
7061 requested = PERF_EVENT__CPU;
7062 else if (type == PERF_SECURITY_KERNEL)
7063 requested = PERF_EVENT__KERNEL;
7064 else if (type == PERF_SECURITY_TRACEPOINT)
7065 requested = PERF_EVENT__TRACEPOINT;
7066 else
7067 return -EINVAL;
7068
7069 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7070 requested, NULL);
7071 }
7072
7073 static int selinux_perf_event_alloc(struct perf_event *event)
7074 {
7075 struct perf_event_security_struct *perfsec;
7076
7077 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7078 if (!perfsec)
7079 return -ENOMEM;
7080
7081 perfsec->sid = current_sid();
7082 event->security = perfsec;
7083
7084 return 0;
7085 }
7086
7087 static void selinux_perf_event_free(struct perf_event *event)
7088 {
7089 struct perf_event_security_struct *perfsec = event->security;
7090
7091 event->security = NULL;
7092 kfree(perfsec);
7093 }
7094
7095 static int selinux_perf_event_read(struct perf_event *event)
7096 {
7097 struct perf_event_security_struct *perfsec = event->security;
7098 u32 sid = current_sid();
7099
7100 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7101 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7102 }
7103
7104 static int selinux_perf_event_write(struct perf_event *event)
7105 {
7106 struct perf_event_security_struct *perfsec = event->security;
7107 u32 sid = current_sid();
7108
7109 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7110 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7111 }
7112 #endif
7113
7114 /*
7115 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7116 * 1. any hooks that don't belong to (2.) or (3.) below,
7117 * 2. hooks that both access structures allocated by other hooks, and allocate
7118 * structures that can be later accessed by other hooks (mostly "cloning"
7119 * hooks),
7120 * 3. hooks that only allocate structures that can be later accessed by other
7121 * hooks ("allocating" hooks).
7122 *
7123 * Please follow block comment delimiters in the list to keep this order.
7124 *
7125 * This ordering is needed for SELinux runtime disable to work at least somewhat
7126 * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7127 * when disabling SELinux at runtime.
7128 */
7129 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7130 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7131 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7132 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7133 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7134
7135 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7136 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7137 LSM_HOOK_INIT(capget, selinux_capget),
7138 LSM_HOOK_INIT(capset, selinux_capset),
7139 LSM_HOOK_INIT(capable, selinux_capable),
7140 LSM_HOOK_INIT(quotactl, selinux_quotactl),
7141 LSM_HOOK_INIT(quota_on, selinux_quota_on),
7142 LSM_HOOK_INIT(syslog, selinux_syslog),
7143 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7144
7145 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7146
7147 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7148 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7149 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7150
7151 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7152 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7153 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7154 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7155 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7156 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7157 LSM_HOOK_INIT(sb_mount, selinux_mount),
7158 LSM_HOOK_INIT(sb_umount, selinux_umount),
7159 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7160 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7161
7162 LSM_HOOK_INIT(move_mount, selinux_move_mount),
7163
7164 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7165 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7166
7167 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7168 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7169 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7170 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7171 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7172 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7173 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7174 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7175 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7176 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7177 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7178 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7179 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7180 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7181 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7182 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7183 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7184 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7185 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7186 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7187 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7188 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7189 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7190 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7191 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7192 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7193 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7194 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7195
7196 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7197
7198 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7199 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7200 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7201 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7202 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7203 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7204 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7205 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7206 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7207 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7208 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7209
7210 LSM_HOOK_INIT(file_open, selinux_file_open),
7211
7212 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7213 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7214 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7215 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7216 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7217 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7218 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7219 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7220 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7221 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7222 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7223 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7224 LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7225 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7226 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7227 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7228 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7229 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7230 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7231 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7232 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7233 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7234 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7235 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7236
7237 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7238 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7239
7240 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7241 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7242 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7243 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7244
7245 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7246 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7247 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7248
7249 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7250 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7251 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7252
7253 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7254
7255 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7256 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7257
7258 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7259 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7260 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7261 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7262 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7263 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7264
7265 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7266 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7267
7268 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7269 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7270 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7271 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7272 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7273 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7274 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7275 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7276 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7277 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7278 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7279 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7280 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7281 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7282 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7283 LSM_HOOK_INIT(socket_getpeersec_stream,
7284 selinux_socket_getpeersec_stream),
7285 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7286 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7287 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7288 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7289 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7290 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7291 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7292 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7293 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7294 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7295 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7296 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7297 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7298 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7299 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7300 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7301 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7302 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7303 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7304 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7305 #ifdef CONFIG_SECURITY_INFINIBAND
7306 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7307 LSM_HOOK_INIT(ib_endport_manage_subnet,
7308 selinux_ib_endport_manage_subnet),
7309 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7310 #endif
7311 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7312 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7313 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7314 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7315 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7316 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7317 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7318 selinux_xfrm_state_pol_flow_match),
7319 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7320 #endif
7321
7322 #ifdef CONFIG_KEYS
7323 LSM_HOOK_INIT(key_free, selinux_key_free),
7324 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7325 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7326 #ifdef CONFIG_KEY_NOTIFICATIONS
7327 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7328 #endif
7329 #endif
7330
7331 #ifdef CONFIG_AUDIT
7332 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7333 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7334 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7335 #endif
7336
7337 #ifdef CONFIG_BPF_SYSCALL
7338 LSM_HOOK_INIT(bpf, selinux_bpf),
7339 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7340 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7341 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7342 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7343 #endif
7344
7345 #ifdef CONFIG_PERF_EVENTS
7346 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7347 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7348 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7349 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7350 #endif
7351
7352 LSM_HOOK_INIT(locked_down, selinux_lockdown),
7353
7354 /*
7355 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7356 */
7357 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7358 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7359 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7360 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7361 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7362 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7363 #endif
7364
7365 /*
7366 * PUT "ALLOCATING" HOOKS HERE
7367 */
7368 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7369 LSM_HOOK_INIT(msg_queue_alloc_security,
7370 selinux_msg_queue_alloc_security),
7371 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7372 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7373 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7374 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7375 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7376 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7377 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7378 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7379 #ifdef CONFIG_SECURITY_INFINIBAND
7380 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7381 #endif
7382 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7383 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7384 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7385 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7386 selinux_xfrm_state_alloc_acquire),
7387 #endif
7388 #ifdef CONFIG_KEYS
7389 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7390 #endif
7391 #ifdef CONFIG_AUDIT
7392 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7393 #endif
7394 #ifdef CONFIG_BPF_SYSCALL
7395 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7396 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7397 #endif
7398 #ifdef CONFIG_PERF_EVENTS
7399 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7400 #endif
7401 };
7402
7403 static __init int selinux_init(void)
7404 {
7405 pr_info("SELinux: Initializing.\n");
7406
7407 memset(&selinux_state, 0, sizeof(selinux_state));
7408 enforcing_set(&selinux_state, selinux_enforcing_boot);
7409 checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7410 selinux_avc_init(&selinux_state.avc);
7411 mutex_init(&selinux_state.status_lock);
7412 mutex_init(&selinux_state.policy_mutex);
7413
7414 /* Set the security state for the initial task. */
7415 cred_init_security();
7416
7417 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7418
7419 avc_init();
7420
7421 avtab_cache_init();
7422
7423 ebitmap_cache_init();
7424
7425 hashtab_cache_init();
7426
7427 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7428
7429 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7430 panic("SELinux: Unable to register AVC netcache callback\n");
7431
7432 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7433 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7434
7435 if (selinux_enforcing_boot)
7436 pr_debug("SELinux: Starting in enforcing mode\n");
7437 else
7438 pr_debug("SELinux: Starting in permissive mode\n");
7439
7440 fs_validate_description("selinux", selinux_fs_parameters);
7441
7442 return 0;
7443 }
7444
7445 static void delayed_superblock_init(struct super_block *sb, void *unused)
7446 {
7447 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7448 }
7449
7450 void selinux_complete_init(void)
7451 {
7452 pr_debug("SELinux: Completing initialization.\n");
7453
7454 /* Set up any superblocks initialized prior to the policy load. */
7455 pr_debug("SELinux: Setting up existing superblocks.\n");
7456 iterate_supers(delayed_superblock_init, NULL);
7457 }
7458
7459 /* SELinux requires early initialization in order to label
7460 all processes and objects when they are created. */
7461 DEFINE_LSM(selinux) = {
7462 .name = "selinux",
7463 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7464 .enabled = &selinux_enabled_boot,
7465 .blobs = &selinux_blob_sizes,
7466 .init = selinux_init,
7467 };
7468
7469 #if defined(CONFIG_NETFILTER)
7470
7471 static const struct nf_hook_ops selinux_nf_ops[] = {
7472 {
7473 .hook = selinux_ipv4_postroute,
7474 .pf = NFPROTO_IPV4,
7475 .hooknum = NF_INET_POST_ROUTING,
7476 .priority = NF_IP_PRI_SELINUX_LAST,
7477 },
7478 {
7479 .hook = selinux_ipv4_forward,
7480 .pf = NFPROTO_IPV4,
7481 .hooknum = NF_INET_FORWARD,
7482 .priority = NF_IP_PRI_SELINUX_FIRST,
7483 },
7484 {
7485 .hook = selinux_ipv4_output,
7486 .pf = NFPROTO_IPV4,
7487 .hooknum = NF_INET_LOCAL_OUT,
7488 .priority = NF_IP_PRI_SELINUX_FIRST,
7489 },
7490 #if IS_ENABLED(CONFIG_IPV6)
7491 {
7492 .hook = selinux_ipv6_postroute,
7493 .pf = NFPROTO_IPV6,
7494 .hooknum = NF_INET_POST_ROUTING,
7495 .priority = NF_IP6_PRI_SELINUX_LAST,
7496 },
7497 {
7498 .hook = selinux_ipv6_forward,
7499 .pf = NFPROTO_IPV6,
7500 .hooknum = NF_INET_FORWARD,
7501 .priority = NF_IP6_PRI_SELINUX_FIRST,
7502 },
7503 {
7504 .hook = selinux_ipv6_output,
7505 .pf = NFPROTO_IPV6,
7506 .hooknum = NF_INET_LOCAL_OUT,
7507 .priority = NF_IP6_PRI_SELINUX_FIRST,
7508 },
7509 #endif /* IPV6 */
7510 };
7511
7512 static int __net_init selinux_nf_register(struct net *net)
7513 {
7514 return nf_register_net_hooks(net, selinux_nf_ops,
7515 ARRAY_SIZE(selinux_nf_ops));
7516 }
7517
7518 static void __net_exit selinux_nf_unregister(struct net *net)
7519 {
7520 nf_unregister_net_hooks(net, selinux_nf_ops,
7521 ARRAY_SIZE(selinux_nf_ops));
7522 }
7523
7524 static struct pernet_operations selinux_net_ops = {
7525 .init = selinux_nf_register,
7526 .exit = selinux_nf_unregister,
7527 };
7528
7529 static int __init selinux_nf_ip_init(void)
7530 {
7531 int err;
7532
7533 if (!selinux_enabled_boot)
7534 return 0;
7535
7536 pr_debug("SELinux: Registering netfilter hooks\n");
7537
7538 err = register_pernet_subsys(&selinux_net_ops);
7539 if (err)
7540 panic("SELinux: register_pernet_subsys: error %d\n", err);
7541
7542 return 0;
7543 }
7544 __initcall(selinux_nf_ip_init);
7545
7546 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7547 static void selinux_nf_ip_exit(void)
7548 {
7549 pr_debug("SELinux: Unregistering netfilter hooks\n");
7550
7551 unregister_pernet_subsys(&selinux_net_ops);
7552 }
7553 #endif
7554
7555 #else /* CONFIG_NETFILTER */
7556
7557 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7558 #define selinux_nf_ip_exit()
7559 #endif
7560
7561 #endif /* CONFIG_NETFILTER */
7562
7563 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7564 int selinux_disable(struct selinux_state *state)
7565 {
7566 if (selinux_initialized(state)) {
7567 /* Not permitted after initial policy load. */
7568 return -EINVAL;
7569 }
7570
7571 if (selinux_disabled(state)) {
7572 /* Only do this once. */
7573 return -EINVAL;
7574 }
7575
7576 selinux_mark_disabled(state);
7577
7578 pr_info("SELinux: Disabled at runtime.\n");
7579
7580 /*
7581 * Unregister netfilter hooks.
7582 * Must be done before security_delete_hooks() to avoid breaking
7583 * runtime disable.
7584 */
7585 selinux_nf_ip_exit();
7586
7587 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7588
7589 /* Try to destroy the avc node cache */
7590 avc_disable();
7591
7592 /* Unregister selinuxfs. */
7593 exit_sel_fs();
7594
7595 return 0;
7596 }
7597 #endif
Ubuntu Jammy Linux kernel mirror