2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount
= ATOMIC_INIT(0);
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing
;
103 static int __init
enforcing_setup(char *str
)
105 unsigned long enforcing
;
106 if (!kstrtoul(str
, 0, &enforcing
))
107 selinux_enforcing
= enforcing
? 1 : 0;
110 __setup("enforcing=", enforcing_setup
);
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
116 static int __init
selinux_enabled_setup(char *str
)
118 unsigned long enabled
;
119 if (!kstrtoul(str
, 0, &enabled
))
120 selinux_enabled
= enabled
? 1 : 0;
123 __setup("selinux=", selinux_enabled_setup
);
125 int selinux_enabled
= 1;
128 static struct kmem_cache
*sel_inode_cache
;
129 static struct kmem_cache
*file_security_cache
;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
142 static int selinux_secmark_enabled(void)
144 return (selinux_policycap_alwaysnetwork
|| atomic_read(&selinux_secmark_refcount
));
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
157 static int selinux_peerlbl_enabled(void)
159 return (selinux_policycap_alwaysnetwork
|| netlbl_enabled() || selinux_xfrm_enabled());
162 static int selinux_netcache_avc_callback(u32 event
)
164 if (event
== AVC_CALLBACK_RESET
) {
174 * initialise the security for the init task
176 static void cred_init_security(void)
178 struct cred
*cred
= (struct cred
*) current
->real_cred
;
179 struct task_security_struct
*tsec
;
181 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
183 panic("SELinux: Failed to initialize initial task.\n");
185 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
186 cred
->security
= tsec
;
190 * get the security ID of a set of credentials
192 static inline u32
cred_sid(const struct cred
*cred
)
194 const struct task_security_struct
*tsec
;
196 tsec
= cred
->security
;
201 * get the objective security ID of a task
203 static inline u32
task_sid(const struct task_struct
*task
)
208 sid
= cred_sid(__task_cred(task
));
213 /* Allocate and free functions for each kind of security blob. */
215 static int inode_alloc_security(struct inode
*inode
)
217 struct inode_security_struct
*isec
;
218 u32 sid
= current_sid();
220 isec
= kmem_cache_zalloc(sel_inode_cache
, GFP_NOFS
);
224 spin_lock_init(&isec
->lock
);
225 INIT_LIST_HEAD(&isec
->list
);
227 isec
->sid
= SECINITSID_UNLABELED
;
228 isec
->sclass
= SECCLASS_FILE
;
229 isec
->task_sid
= sid
;
230 isec
->initialized
= LABEL_INVALID
;
231 inode
->i_security
= isec
;
236 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
239 * Try reloading inode security labels that have been marked as invalid. The
240 * @may_sleep parameter indicates when sleeping and thus reloading labels is
241 * allowed; when set to false, returns -ECHILD when the label is
242 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
243 * when no dentry is available, set it to NULL instead.
245 static int __inode_security_revalidate(struct inode
*inode
,
246 struct dentry
*opt_dentry
,
249 struct inode_security_struct
*isec
= inode
->i_security
;
251 might_sleep_if(may_sleep
);
253 if (ss_initialized
&& isec
->initialized
!= LABEL_INITIALIZED
) {
258 * Try reloading the inode security label. This will fail if
259 * @opt_dentry is NULL and no dentry for this inode can be
260 * found; in that case, continue using the old label.
262 inode_doinit_with_dentry(inode
, opt_dentry
);
267 static struct inode_security_struct
*inode_security_novalidate(struct inode
*inode
)
269 return inode
->i_security
;
272 static struct inode_security_struct
*inode_security_rcu(struct inode
*inode
, bool rcu
)
276 error
= __inode_security_revalidate(inode
, NULL
, !rcu
);
278 return ERR_PTR(error
);
279 return inode
->i_security
;
283 * Get the security label of an inode.
285 static struct inode_security_struct
*inode_security(struct inode
*inode
)
287 __inode_security_revalidate(inode
, NULL
, true);
288 return inode
->i_security
;
291 static struct inode_security_struct
*backing_inode_security_novalidate(struct dentry
*dentry
)
293 struct inode
*inode
= d_backing_inode(dentry
);
295 return inode
->i_security
;
299 * Get the security label of a dentry's backing inode.
301 static struct inode_security_struct
*backing_inode_security(struct dentry
*dentry
)
303 struct inode
*inode
= d_backing_inode(dentry
);
305 __inode_security_revalidate(inode
, dentry
, true);
306 return inode
->i_security
;
309 static void inode_free_rcu(struct rcu_head
*head
)
311 struct inode_security_struct
*isec
;
313 isec
= container_of(head
, struct inode_security_struct
, rcu
);
314 kmem_cache_free(sel_inode_cache
, isec
);
317 static void inode_free_security(struct inode
*inode
)
319 struct inode_security_struct
*isec
= inode
->i_security
;
320 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
323 * As not all inode security structures are in a list, we check for
324 * empty list outside of the lock to make sure that we won't waste
325 * time taking a lock doing nothing.
327 * The list_del_init() function can be safely called more than once.
328 * It should not be possible for this function to be called with
329 * concurrent list_add(), but for better safety against future changes
330 * in the code, we use list_empty_careful() here.
332 if (!list_empty_careful(&isec
->list
)) {
333 spin_lock(&sbsec
->isec_lock
);
334 list_del_init(&isec
->list
);
335 spin_unlock(&sbsec
->isec_lock
);
339 * The inode may still be referenced in a path walk and
340 * a call to selinux_inode_permission() can be made
341 * after inode_free_security() is called. Ideally, the VFS
342 * wouldn't do this, but fixing that is a much harder
343 * job. For now, simply free the i_security via RCU, and
344 * leave the current inode->i_security pointer intact.
345 * The inode will be freed after the RCU grace period too.
347 call_rcu(&isec
->rcu
, inode_free_rcu
);
350 static int file_alloc_security(struct file
*file
)
352 struct file_security_struct
*fsec
;
353 u32 sid
= current_sid();
355 fsec
= kmem_cache_zalloc(file_security_cache
, GFP_KERNEL
);
360 fsec
->fown_sid
= sid
;
361 file
->f_security
= fsec
;
366 static void file_free_security(struct file
*file
)
368 struct file_security_struct
*fsec
= file
->f_security
;
369 file
->f_security
= NULL
;
370 kmem_cache_free(file_security_cache
, fsec
);
373 static int superblock_alloc_security(struct super_block
*sb
)
375 struct superblock_security_struct
*sbsec
;
377 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
381 mutex_init(&sbsec
->lock
);
382 INIT_LIST_HEAD(&sbsec
->isec_head
);
383 spin_lock_init(&sbsec
->isec_lock
);
385 sbsec
->sid
= SECINITSID_UNLABELED
;
386 sbsec
->def_sid
= SECINITSID_FILE
;
387 sbsec
->mntpoint_sid
= SECINITSID_UNLABELED
;
388 sb
->s_security
= sbsec
;
393 static void superblock_free_security(struct super_block
*sb
)
395 struct superblock_security_struct
*sbsec
= sb
->s_security
;
396 sb
->s_security
= NULL
;
400 /* The file system's label must be initialized prior to use. */
402 static const char *labeling_behaviors
[7] = {
404 "uses transition SIDs",
406 "uses genfs_contexts",
407 "not configured for labeling",
408 "uses mountpoint labeling",
409 "uses native labeling",
412 static inline int inode_doinit(struct inode
*inode
)
414 return inode_doinit_with_dentry(inode
, NULL
);
423 Opt_labelsupport
= 5,
427 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429 static const match_table_t tokens
= {
430 {Opt_context
, CONTEXT_STR
"%s"},
431 {Opt_fscontext
, FSCONTEXT_STR
"%s"},
432 {Opt_defcontext
, DEFCONTEXT_STR
"%s"},
433 {Opt_rootcontext
, ROOTCONTEXT_STR
"%s"},
434 {Opt_labelsupport
, LABELSUPP_STR
},
438 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440 static int may_context_mount_sb_relabel(u32 sid
,
441 struct superblock_security_struct
*sbsec
,
442 const struct cred
*cred
)
444 const struct task_security_struct
*tsec
= cred
->security
;
447 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
448 FILESYSTEM__RELABELFROM
, NULL
);
452 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
453 FILESYSTEM__RELABELTO
, NULL
);
457 static int may_context_mount_inode_relabel(u32 sid
,
458 struct superblock_security_struct
*sbsec
,
459 const struct cred
*cred
)
461 const struct task_security_struct
*tsec
= cred
->security
;
463 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
464 FILESYSTEM__RELABELFROM
, NULL
);
468 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
469 FILESYSTEM__ASSOCIATE
, NULL
);
473 static int selinux_is_sblabel_mnt(struct super_block
*sb
)
475 struct superblock_security_struct
*sbsec
= sb
->s_security
;
477 return sbsec
->behavior
== SECURITY_FS_USE_XATTR
||
478 sbsec
->behavior
== SECURITY_FS_USE_TRANS
||
479 sbsec
->behavior
== SECURITY_FS_USE_TASK
||
480 sbsec
->behavior
== SECURITY_FS_USE_NATIVE
||
481 /* Special handling. Genfs but also in-core setxattr handler */
482 !strcmp(sb
->s_type
->name
, "sysfs") ||
483 !strcmp(sb
->s_type
->name
, "pstore") ||
484 !strcmp(sb
->s_type
->name
, "debugfs") ||
485 !strcmp(sb
->s_type
->name
, "tracefs") ||
486 !strcmp(sb
->s_type
->name
, "rootfs") ||
487 (selinux_policycap_cgroupseclabel
&&
488 (!strcmp(sb
->s_type
->name
, "cgroup") ||
489 !strcmp(sb
->s_type
->name
, "cgroup2")));
492 static int sb_finish_set_opts(struct super_block
*sb
)
494 struct superblock_security_struct
*sbsec
= sb
->s_security
;
495 struct dentry
*root
= sb
->s_root
;
496 struct inode
*root_inode
= d_backing_inode(root
);
499 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
500 /* Make sure that the xattr handler exists and that no
501 error other than -ENODATA is returned by getxattr on
502 the root directory. -ENODATA is ok, as this may be
503 the first boot of the SELinux kernel before we have
504 assigned xattr values to the filesystem. */
505 if (!(root_inode
->i_opflags
& IOP_XATTR
)) {
506 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
507 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
512 rc
= __vfs_getxattr(root
, root_inode
, XATTR_NAME_SELINUX
, NULL
, 0);
513 if (rc
< 0 && rc
!= -ENODATA
) {
514 if (rc
== -EOPNOTSUPP
)
515 printk(KERN_WARNING
"SELinux: (dev %s, type "
516 "%s) has no security xattr handler\n",
517 sb
->s_id
, sb
->s_type
->name
);
519 printk(KERN_WARNING
"SELinux: (dev %s, type "
520 "%s) getxattr errno %d\n", sb
->s_id
,
521 sb
->s_type
->name
, -rc
);
526 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
))
527 printk(KERN_ERR
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
528 sb
->s_id
, sb
->s_type
->name
);
530 sbsec
->flags
|= SE_SBINITIALIZED
;
531 if (selinux_is_sblabel_mnt(sb
))
532 sbsec
->flags
|= SBLABEL_MNT
;
534 /* Initialize the root inode. */
535 rc
= inode_doinit_with_dentry(root_inode
, root
);
537 /* Initialize any other inodes associated with the superblock, e.g.
538 inodes created prior to initial policy load or inodes created
539 during get_sb by a pseudo filesystem that directly
541 spin_lock(&sbsec
->isec_lock
);
543 if (!list_empty(&sbsec
->isec_head
)) {
544 struct inode_security_struct
*isec
=
545 list_entry(sbsec
->isec_head
.next
,
546 struct inode_security_struct
, list
);
547 struct inode
*inode
= isec
->inode
;
548 list_del_init(&isec
->list
);
549 spin_unlock(&sbsec
->isec_lock
);
550 inode
= igrab(inode
);
552 if (!IS_PRIVATE(inode
))
556 spin_lock(&sbsec
->isec_lock
);
559 spin_unlock(&sbsec
->isec_lock
);
565 * This function should allow an FS to ask what it's mount security
566 * options were so it can use those later for submounts, displaying
567 * mount options, or whatever.
569 static int selinux_get_mnt_opts(const struct super_block
*sb
,
570 struct security_mnt_opts
*opts
)
573 struct superblock_security_struct
*sbsec
= sb
->s_security
;
574 char *context
= NULL
;
578 security_init_mnt_opts(opts
);
580 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
586 /* make sure we always check enough bits to cover the mask */
587 BUILD_BUG_ON(SE_MNTMASK
>= (1 << NUM_SEL_MNT_OPTS
));
589 tmp
= sbsec
->flags
& SE_MNTMASK
;
590 /* count the number of mount options for this sb */
591 for (i
= 0; i
< NUM_SEL_MNT_OPTS
; i
++) {
593 opts
->num_mnt_opts
++;
596 /* Check if the Label support flag is set */
597 if (sbsec
->flags
& SBLABEL_MNT
)
598 opts
->num_mnt_opts
++;
600 opts
->mnt_opts
= kcalloc(opts
->num_mnt_opts
, sizeof(char *), GFP_ATOMIC
);
601 if (!opts
->mnt_opts
) {
606 opts
->mnt_opts_flags
= kcalloc(opts
->num_mnt_opts
, sizeof(int), GFP_ATOMIC
);
607 if (!opts
->mnt_opts_flags
) {
613 if (sbsec
->flags
& FSCONTEXT_MNT
) {
614 rc
= security_sid_to_context(sbsec
->sid
, &context
, &len
);
617 opts
->mnt_opts
[i
] = context
;
618 opts
->mnt_opts_flags
[i
++] = FSCONTEXT_MNT
;
620 if (sbsec
->flags
& CONTEXT_MNT
) {
621 rc
= security_sid_to_context(sbsec
->mntpoint_sid
, &context
, &len
);
624 opts
->mnt_opts
[i
] = context
;
625 opts
->mnt_opts_flags
[i
++] = CONTEXT_MNT
;
627 if (sbsec
->flags
& DEFCONTEXT_MNT
) {
628 rc
= security_sid_to_context(sbsec
->def_sid
, &context
, &len
);
631 opts
->mnt_opts
[i
] = context
;
632 opts
->mnt_opts_flags
[i
++] = DEFCONTEXT_MNT
;
634 if (sbsec
->flags
& ROOTCONTEXT_MNT
) {
635 struct dentry
*root
= sbsec
->sb
->s_root
;
636 struct inode_security_struct
*isec
= backing_inode_security(root
);
638 rc
= security_sid_to_context(isec
->sid
, &context
, &len
);
641 opts
->mnt_opts
[i
] = context
;
642 opts
->mnt_opts_flags
[i
++] = ROOTCONTEXT_MNT
;
644 if (sbsec
->flags
& SBLABEL_MNT
) {
645 opts
->mnt_opts
[i
] = NULL
;
646 opts
->mnt_opts_flags
[i
++] = SBLABEL_MNT
;
649 BUG_ON(i
!= opts
->num_mnt_opts
);
654 security_free_mnt_opts(opts
);
658 static int bad_option(struct superblock_security_struct
*sbsec
, char flag
,
659 u32 old_sid
, u32 new_sid
)
661 char mnt_flags
= sbsec
->flags
& SE_MNTMASK
;
663 /* check if the old mount command had the same options */
664 if (sbsec
->flags
& SE_SBINITIALIZED
)
665 if (!(sbsec
->flags
& flag
) ||
666 (old_sid
!= new_sid
))
669 /* check if we were passed the same options twice,
670 * aka someone passed context=a,context=b
672 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
673 if (mnt_flags
& flag
)
679 * Allow filesystems with binary mount data to explicitly set mount point
680 * labeling information.
682 static int selinux_set_mnt_opts(struct super_block
*sb
,
683 struct security_mnt_opts
*opts
,
684 unsigned long kern_flags
,
685 unsigned long *set_kern_flags
)
687 const struct cred
*cred
= current_cred();
689 struct superblock_security_struct
*sbsec
= sb
->s_security
;
690 const char *name
= sb
->s_type
->name
;
691 struct dentry
*root
= sbsec
->sb
->s_root
;
692 struct inode_security_struct
*root_isec
;
693 u32 fscontext_sid
= 0, context_sid
= 0, rootcontext_sid
= 0;
694 u32 defcontext_sid
= 0;
695 char **mount_options
= opts
->mnt_opts
;
696 int *flags
= opts
->mnt_opts_flags
;
697 int num_opts
= opts
->num_mnt_opts
;
699 mutex_lock(&sbsec
->lock
);
701 if (!ss_initialized
) {
703 /* Defer initialization until selinux_complete_init,
704 after the initial policy is loaded and the security
705 server is ready to handle calls. */
709 printk(KERN_WARNING
"SELinux: Unable to set superblock options "
710 "before the security server is initialized\n");
713 if (kern_flags
&& !set_kern_flags
) {
714 /* Specifying internal flags without providing a place to
715 * place the results is not allowed */
721 * Binary mount data FS will come through this function twice. Once
722 * from an explicit call and once from the generic calls from the vfs.
723 * Since the generic VFS calls will not contain any security mount data
724 * we need to skip the double mount verification.
726 * This does open a hole in which we will not notice if the first
727 * mount using this sb set explict options and a second mount using
728 * this sb does not set any security options. (The first options
729 * will be used for both mounts)
731 if ((sbsec
->flags
& SE_SBINITIALIZED
) && (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
735 root_isec
= backing_inode_security_novalidate(root
);
738 * parse the mount options, check if they are valid sids.
739 * also check if someone is trying to mount the same sb more
740 * than once with different security options.
742 for (i
= 0; i
< num_opts
; i
++) {
745 if (flags
[i
] == SBLABEL_MNT
)
747 rc
= security_context_str_to_sid(mount_options
[i
], &sid
, GFP_KERNEL
);
749 printk(KERN_WARNING
"SELinux: security_context_str_to_sid"
750 "(%s) failed for (dev %s, type %s) errno=%d\n",
751 mount_options
[i
], sb
->s_id
, name
, rc
);
758 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
,
760 goto out_double_mount
;
762 sbsec
->flags
|= FSCONTEXT_MNT
;
767 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
,
769 goto out_double_mount
;
771 sbsec
->flags
|= CONTEXT_MNT
;
773 case ROOTCONTEXT_MNT
:
774 rootcontext_sid
= sid
;
776 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
,
778 goto out_double_mount
;
780 sbsec
->flags
|= ROOTCONTEXT_MNT
;
784 defcontext_sid
= sid
;
786 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
,
788 goto out_double_mount
;
790 sbsec
->flags
|= DEFCONTEXT_MNT
;
799 if (sbsec
->flags
& SE_SBINITIALIZED
) {
800 /* previously mounted with options, but not on this attempt? */
801 if ((sbsec
->flags
& SE_MNTMASK
) && !num_opts
)
802 goto out_double_mount
;
807 if (strcmp(sb
->s_type
->name
, "proc") == 0)
808 sbsec
->flags
|= SE_SBPROC
| SE_SBGENFS
;
810 if (!strcmp(sb
->s_type
->name
, "debugfs") ||
811 !strcmp(sb
->s_type
->name
, "sysfs") ||
812 !strcmp(sb
->s_type
->name
, "pstore"))
813 sbsec
->flags
|= SE_SBGENFS
;
815 if (!sbsec
->behavior
) {
817 * Determine the labeling behavior to use for this
820 rc
= security_fs_use(sb
);
823 "%s: security_fs_use(%s) returned %d\n",
824 __func__
, sb
->s_type
->name
, rc
);
830 * If this is a user namespace mount and the filesystem type is not
831 * explicitly whitelisted, then no contexts are allowed on the command
832 * line and security labels must be ignored.
834 if (sb
->s_user_ns
!= &init_user_ns
&&
835 strcmp(sb
->s_type
->name
, "tmpfs") &&
836 strcmp(sb
->s_type
->name
, "ramfs") &&
837 strcmp(sb
->s_type
->name
, "devpts")) {
838 if (context_sid
|| fscontext_sid
|| rootcontext_sid
||
843 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
844 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
845 rc
= security_transition_sid(current_sid(), current_sid(),
847 &sbsec
->mntpoint_sid
);
854 /* sets the context of the superblock for the fs being mounted. */
856 rc
= may_context_mount_sb_relabel(fscontext_sid
, sbsec
, cred
);
860 sbsec
->sid
= fscontext_sid
;
864 * Switch to using mount point labeling behavior.
865 * sets the label used on all file below the mountpoint, and will set
866 * the superblock context if not already set.
868 if (kern_flags
& SECURITY_LSM_NATIVE_LABELS
&& !context_sid
) {
869 sbsec
->behavior
= SECURITY_FS_USE_NATIVE
;
870 *set_kern_flags
|= SECURITY_LSM_NATIVE_LABELS
;
874 if (!fscontext_sid
) {
875 rc
= may_context_mount_sb_relabel(context_sid
, sbsec
,
879 sbsec
->sid
= context_sid
;
881 rc
= may_context_mount_inode_relabel(context_sid
, sbsec
,
886 if (!rootcontext_sid
)
887 rootcontext_sid
= context_sid
;
889 sbsec
->mntpoint_sid
= context_sid
;
890 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
893 if (rootcontext_sid
) {
894 rc
= may_context_mount_inode_relabel(rootcontext_sid
, sbsec
,
899 root_isec
->sid
= rootcontext_sid
;
900 root_isec
->initialized
= LABEL_INITIALIZED
;
903 if (defcontext_sid
) {
904 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
&&
905 sbsec
->behavior
!= SECURITY_FS_USE_NATIVE
) {
907 printk(KERN_WARNING
"SELinux: defcontext option is "
908 "invalid for this filesystem type\n");
912 if (defcontext_sid
!= sbsec
->def_sid
) {
913 rc
= may_context_mount_inode_relabel(defcontext_sid
,
919 sbsec
->def_sid
= defcontext_sid
;
923 rc
= sb_finish_set_opts(sb
);
925 mutex_unlock(&sbsec
->lock
);
929 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, different "
930 "security settings for (dev %s, type %s)\n", sb
->s_id
, name
);
934 static int selinux_cmp_sb_context(const struct super_block
*oldsb
,
935 const struct super_block
*newsb
)
937 struct superblock_security_struct
*old
= oldsb
->s_security
;
938 struct superblock_security_struct
*new = newsb
->s_security
;
939 char oldflags
= old
->flags
& SE_MNTMASK
;
940 char newflags
= new->flags
& SE_MNTMASK
;
942 if (oldflags
!= newflags
)
944 if ((oldflags
& FSCONTEXT_MNT
) && old
->sid
!= new->sid
)
946 if ((oldflags
& CONTEXT_MNT
) && old
->mntpoint_sid
!= new->mntpoint_sid
)
948 if ((oldflags
& DEFCONTEXT_MNT
) && old
->def_sid
!= new->def_sid
)
950 if (oldflags
& ROOTCONTEXT_MNT
) {
951 struct inode_security_struct
*oldroot
= backing_inode_security(oldsb
->s_root
);
952 struct inode_security_struct
*newroot
= backing_inode_security(newsb
->s_root
);
953 if (oldroot
->sid
!= newroot
->sid
)
958 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, "
959 "different security settings for (dev %s, "
960 "type %s)\n", newsb
->s_id
, newsb
->s_type
->name
);
964 static int selinux_sb_clone_mnt_opts(const struct super_block
*oldsb
,
965 struct super_block
*newsb
)
967 const struct superblock_security_struct
*oldsbsec
= oldsb
->s_security
;
968 struct superblock_security_struct
*newsbsec
= newsb
->s_security
;
970 int set_fscontext
= (oldsbsec
->flags
& FSCONTEXT_MNT
);
971 int set_context
= (oldsbsec
->flags
& CONTEXT_MNT
);
972 int set_rootcontext
= (oldsbsec
->flags
& ROOTCONTEXT_MNT
);
975 * if the parent was able to be mounted it clearly had no special lsm
976 * mount options. thus we can safely deal with this superblock later
981 /* how can we clone if the old one wasn't set up?? */
982 BUG_ON(!(oldsbsec
->flags
& SE_SBINITIALIZED
));
984 /* if fs is reusing a sb, make sure that the contexts match */
985 if (newsbsec
->flags
& SE_SBINITIALIZED
)
986 return selinux_cmp_sb_context(oldsb
, newsb
);
988 mutex_lock(&newsbsec
->lock
);
990 newsbsec
->flags
= oldsbsec
->flags
;
992 newsbsec
->sid
= oldsbsec
->sid
;
993 newsbsec
->def_sid
= oldsbsec
->def_sid
;
994 newsbsec
->behavior
= oldsbsec
->behavior
;
997 u32 sid
= oldsbsec
->mntpoint_sid
;
1000 newsbsec
->sid
= sid
;
1001 if (!set_rootcontext
) {
1002 struct inode_security_struct
*newisec
= backing_inode_security(newsb
->s_root
);
1005 newsbsec
->mntpoint_sid
= sid
;
1007 if (set_rootcontext
) {
1008 const struct inode_security_struct
*oldisec
= backing_inode_security(oldsb
->s_root
);
1009 struct inode_security_struct
*newisec
= backing_inode_security(newsb
->s_root
);
1011 newisec
->sid
= oldisec
->sid
;
1014 sb_finish_set_opts(newsb
);
1015 mutex_unlock(&newsbsec
->lock
);
1019 static int selinux_parse_opts_str(char *options
,
1020 struct security_mnt_opts
*opts
)
1023 char *context
= NULL
, *defcontext
= NULL
;
1024 char *fscontext
= NULL
, *rootcontext
= NULL
;
1025 int rc
, num_mnt_opts
= 0;
1027 opts
->num_mnt_opts
= 0;
1029 /* Standard string-based options. */
1030 while ((p
= strsep(&options
, "|")) != NULL
) {
1032 substring_t args
[MAX_OPT_ARGS
];
1037 token
= match_token(p
, tokens
, args
);
1041 if (context
|| defcontext
) {
1043 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1046 context
= match_strdup(&args
[0]);
1056 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1059 fscontext
= match_strdup(&args
[0]);
1066 case Opt_rootcontext
:
1069 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1072 rootcontext
= match_strdup(&args
[0]);
1079 case Opt_defcontext
:
1080 if (context
|| defcontext
) {
1082 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1085 defcontext
= match_strdup(&args
[0]);
1091 case Opt_labelsupport
:
1095 printk(KERN_WARNING
"SELinux: unknown mount option\n");
1102 opts
->mnt_opts
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(char *), GFP_KERNEL
);
1103 if (!opts
->mnt_opts
)
1106 opts
->mnt_opts_flags
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(int),
1108 if (!opts
->mnt_opts_flags
) {
1109 kfree(opts
->mnt_opts
);
1114 opts
->mnt_opts
[num_mnt_opts
] = fscontext
;
1115 opts
->mnt_opts_flags
[num_mnt_opts
++] = FSCONTEXT_MNT
;
1118 opts
->mnt_opts
[num_mnt_opts
] = context
;
1119 opts
->mnt_opts_flags
[num_mnt_opts
++] = CONTEXT_MNT
;
1122 opts
->mnt_opts
[num_mnt_opts
] = rootcontext
;
1123 opts
->mnt_opts_flags
[num_mnt_opts
++] = ROOTCONTEXT_MNT
;
1126 opts
->mnt_opts
[num_mnt_opts
] = defcontext
;
1127 opts
->mnt_opts_flags
[num_mnt_opts
++] = DEFCONTEXT_MNT
;
1130 opts
->num_mnt_opts
= num_mnt_opts
;
1141 * string mount options parsing and call set the sbsec
1143 static int superblock_doinit(struct super_block
*sb
, void *data
)
1146 char *options
= data
;
1147 struct security_mnt_opts opts
;
1149 security_init_mnt_opts(&opts
);
1154 BUG_ON(sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
);
1156 rc
= selinux_parse_opts_str(options
, &opts
);
1161 rc
= selinux_set_mnt_opts(sb
, &opts
, 0, NULL
);
1164 security_free_mnt_opts(&opts
);
1168 static void selinux_write_opts(struct seq_file
*m
,
1169 struct security_mnt_opts
*opts
)
1174 for (i
= 0; i
< opts
->num_mnt_opts
; i
++) {
1177 if (opts
->mnt_opts
[i
])
1178 has_comma
= strchr(opts
->mnt_opts
[i
], ',');
1182 switch (opts
->mnt_opts_flags
[i
]) {
1184 prefix
= CONTEXT_STR
;
1187 prefix
= FSCONTEXT_STR
;
1189 case ROOTCONTEXT_MNT
:
1190 prefix
= ROOTCONTEXT_STR
;
1192 case DEFCONTEXT_MNT
:
1193 prefix
= DEFCONTEXT_STR
;
1197 seq_puts(m
, LABELSUPP_STR
);
1203 /* we need a comma before each option */
1205 seq_puts(m
, prefix
);
1208 seq_escape(m
, opts
->mnt_opts
[i
], "\"\n\\");
1214 static int selinux_sb_show_options(struct seq_file
*m
, struct super_block
*sb
)
1216 struct security_mnt_opts opts
;
1219 rc
= selinux_get_mnt_opts(sb
, &opts
);
1221 /* before policy load we may get EINVAL, don't show anything */
1227 selinux_write_opts(m
, &opts
);
1229 security_free_mnt_opts(&opts
);
1234 static inline u16
inode_mode_to_security_class(umode_t mode
)
1236 switch (mode
& S_IFMT
) {
1238 return SECCLASS_SOCK_FILE
;
1240 return SECCLASS_LNK_FILE
;
1242 return SECCLASS_FILE
;
1244 return SECCLASS_BLK_FILE
;
1246 return SECCLASS_DIR
;
1248 return SECCLASS_CHR_FILE
;
1250 return SECCLASS_FIFO_FILE
;
1254 return SECCLASS_FILE
;
1257 static inline int default_protocol_stream(int protocol
)
1259 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
1262 static inline int default_protocol_dgram(int protocol
)
1264 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
1267 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
1269 int extsockclass
= selinux_policycap_extsockclass
;
1275 case SOCK_SEQPACKET
:
1276 return SECCLASS_UNIX_STREAM_SOCKET
;
1278 return SECCLASS_UNIX_DGRAM_SOCKET
;
1285 case SOCK_SEQPACKET
:
1286 if (default_protocol_stream(protocol
))
1287 return SECCLASS_TCP_SOCKET
;
1288 else if (extsockclass
&& protocol
== IPPROTO_SCTP
)
1289 return SECCLASS_SCTP_SOCKET
;
1291 return SECCLASS_RAWIP_SOCKET
;
1293 if (default_protocol_dgram(protocol
))
1294 return SECCLASS_UDP_SOCKET
;
1295 else if (extsockclass
&& (protocol
== IPPROTO_ICMP
||
1296 protocol
== IPPROTO_ICMPV6
))
1297 return SECCLASS_ICMP_SOCKET
;
1299 return SECCLASS_RAWIP_SOCKET
;
1301 return SECCLASS_DCCP_SOCKET
;
1303 return SECCLASS_RAWIP_SOCKET
;
1309 return SECCLASS_NETLINK_ROUTE_SOCKET
;
1310 case NETLINK_SOCK_DIAG
:
1311 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
1313 return SECCLASS_NETLINK_NFLOG_SOCKET
;
1315 return SECCLASS_NETLINK_XFRM_SOCKET
;
1316 case NETLINK_SELINUX
:
1317 return SECCLASS_NETLINK_SELINUX_SOCKET
;
1319 return SECCLASS_NETLINK_ISCSI_SOCKET
;
1321 return SECCLASS_NETLINK_AUDIT_SOCKET
;
1322 case NETLINK_FIB_LOOKUP
:
1323 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET
;
1324 case NETLINK_CONNECTOR
:
1325 return SECCLASS_NETLINK_CONNECTOR_SOCKET
;
1326 case NETLINK_NETFILTER
:
1327 return SECCLASS_NETLINK_NETFILTER_SOCKET
;
1328 case NETLINK_DNRTMSG
:
1329 return SECCLASS_NETLINK_DNRT_SOCKET
;
1330 case NETLINK_KOBJECT_UEVENT
:
1331 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
1332 case NETLINK_GENERIC
:
1333 return SECCLASS_NETLINK_GENERIC_SOCKET
;
1334 case NETLINK_SCSITRANSPORT
:
1335 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET
;
1337 return SECCLASS_NETLINK_RDMA_SOCKET
;
1338 case NETLINK_CRYPTO
:
1339 return SECCLASS_NETLINK_CRYPTO_SOCKET
;
1341 return SECCLASS_NETLINK_SOCKET
;
1344 return SECCLASS_PACKET_SOCKET
;
1346 return SECCLASS_KEY_SOCKET
;
1348 return SECCLASS_APPLETALK_SOCKET
;
1354 return SECCLASS_AX25_SOCKET
;
1356 return SECCLASS_IPX_SOCKET
;
1358 return SECCLASS_NETROM_SOCKET
;
1360 return SECCLASS_ATMPVC_SOCKET
;
1362 return SECCLASS_X25_SOCKET
;
1364 return SECCLASS_ROSE_SOCKET
;
1366 return SECCLASS_DECNET_SOCKET
;
1368 return SECCLASS_ATMSVC_SOCKET
;
1370 return SECCLASS_RDS_SOCKET
;
1372 return SECCLASS_IRDA_SOCKET
;
1374 return SECCLASS_PPPOX_SOCKET
;
1376 return SECCLASS_LLC_SOCKET
;
1378 return SECCLASS_CAN_SOCKET
;
1380 return SECCLASS_TIPC_SOCKET
;
1382 return SECCLASS_BLUETOOTH_SOCKET
;
1384 return SECCLASS_IUCV_SOCKET
;
1386 return SECCLASS_RXRPC_SOCKET
;
1388 return SECCLASS_ISDN_SOCKET
;
1390 return SECCLASS_PHONET_SOCKET
;
1392 return SECCLASS_IEEE802154_SOCKET
;
1394 return SECCLASS_CAIF_SOCKET
;
1396 return SECCLASS_ALG_SOCKET
;
1398 return SECCLASS_NFC_SOCKET
;
1400 return SECCLASS_VSOCK_SOCKET
;
1402 return SECCLASS_KCM_SOCKET
;
1404 return SECCLASS_QIPCRTR_SOCKET
;
1406 return SECCLASS_SMC_SOCKET
;
1408 #error New address family defined, please update this function.
1413 return SECCLASS_SOCKET
;
1416 static int selinux_genfs_get_sid(struct dentry
*dentry
,
1422 struct super_block
*sb
= dentry
->d_sb
;
1423 char *buffer
, *path
;
1425 buffer
= (char *)__get_free_page(GFP_KERNEL
);
1429 path
= dentry_path_raw(dentry
, buffer
, PAGE_SIZE
);
1433 if (flags
& SE_SBPROC
) {
1434 /* each process gets a /proc/PID/ entry. Strip off the
1435 * PID part to get a valid selinux labeling.
1436 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1437 while (path
[1] >= '0' && path
[1] <= '9') {
1442 rc
= security_genfs_sid(sb
->s_type
->name
, path
, tclass
, sid
);
1444 free_page((unsigned long)buffer
);
1448 /* The inode's security attributes must be initialized before first use. */
1449 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
1451 struct superblock_security_struct
*sbsec
= NULL
;
1452 struct inode_security_struct
*isec
= inode
->i_security
;
1453 u32 task_sid
, sid
= 0;
1455 struct dentry
*dentry
;
1456 #define INITCONTEXTLEN 255
1457 char *context
= NULL
;
1461 if (isec
->initialized
== LABEL_INITIALIZED
)
1464 spin_lock(&isec
->lock
);
1465 if (isec
->initialized
== LABEL_INITIALIZED
)
1468 if (isec
->sclass
== SECCLASS_FILE
)
1469 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1471 sbsec
= inode
->i_sb
->s_security
;
1472 if (!(sbsec
->flags
& SE_SBINITIALIZED
)) {
1473 /* Defer initialization until selinux_complete_init,
1474 after the initial policy is loaded and the security
1475 server is ready to handle calls. */
1476 spin_lock(&sbsec
->isec_lock
);
1477 if (list_empty(&isec
->list
))
1478 list_add(&isec
->list
, &sbsec
->isec_head
);
1479 spin_unlock(&sbsec
->isec_lock
);
1483 sclass
= isec
->sclass
;
1484 task_sid
= isec
->task_sid
;
1486 isec
->initialized
= LABEL_PENDING
;
1487 spin_unlock(&isec
->lock
);
1489 switch (sbsec
->behavior
) {
1490 case SECURITY_FS_USE_NATIVE
:
1492 case SECURITY_FS_USE_XATTR
:
1493 if (!(inode
->i_opflags
& IOP_XATTR
)) {
1494 sid
= sbsec
->def_sid
;
1497 /* Need a dentry, since the xattr API requires one.
1498 Life would be simpler if we could just pass the inode. */
1500 /* Called from d_instantiate or d_splice_alias. */
1501 dentry
= dget(opt_dentry
);
1503 /* Called from selinux_complete_init, try to find a dentry. */
1504 dentry
= d_find_alias(inode
);
1508 * this is can be hit on boot when a file is accessed
1509 * before the policy is loaded. When we load policy we
1510 * may find inodes that have no dentry on the
1511 * sbsec->isec_head list. No reason to complain as these
1512 * will get fixed up the next time we go through
1513 * inode_doinit with a dentry, before these inodes could
1514 * be used again by userspace.
1519 len
= INITCONTEXTLEN
;
1520 context
= kmalloc(len
+1, GFP_NOFS
);
1526 context
[len
] = '\0';
1527 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, context
, len
);
1528 if (rc
== -ERANGE
) {
1531 /* Need a larger buffer. Query for the right size. */
1532 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, NULL
, 0);
1538 context
= kmalloc(len
+1, GFP_NOFS
);
1544 context
[len
] = '\0';
1545 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, context
, len
);
1549 if (rc
!= -ENODATA
) {
1550 printk(KERN_WARNING
"SELinux: %s: getxattr returned "
1551 "%d for dev=%s ino=%ld\n", __func__
,
1552 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1556 /* Map ENODATA to the default file SID */
1557 sid
= sbsec
->def_sid
;
1560 rc
= security_context_to_sid_default(context
, rc
, &sid
,
1564 char *dev
= inode
->i_sb
->s_id
;
1565 unsigned long ino
= inode
->i_ino
;
1567 if (rc
== -EINVAL
) {
1568 if (printk_ratelimit())
1569 printk(KERN_NOTICE
"SELinux: inode=%lu on dev=%s was found to have an invalid "
1570 "context=%s. This indicates you may need to relabel the inode or the "
1571 "filesystem in question.\n", ino
, dev
, context
);
1573 printk(KERN_WARNING
"SELinux: %s: context_to_sid(%s) "
1574 "returned %d for dev=%s ino=%ld\n",
1575 __func__
, context
, -rc
, dev
, ino
);
1578 /* Leave with the unlabeled SID */
1585 case SECURITY_FS_USE_TASK
:
1588 case SECURITY_FS_USE_TRANS
:
1589 /* Default to the fs SID. */
1592 /* Try to obtain a transition SID. */
1593 rc
= security_transition_sid(task_sid
, sid
, sclass
, NULL
, &sid
);
1597 case SECURITY_FS_USE_MNTPOINT
:
1598 sid
= sbsec
->mntpoint_sid
;
1601 /* Default to the fs superblock SID. */
1604 if ((sbsec
->flags
& SE_SBGENFS
) && !S_ISLNK(inode
->i_mode
)) {
1605 /* We must have a dentry to determine the label on
1608 /* Called from d_instantiate or
1609 * d_splice_alias. */
1610 dentry
= dget(opt_dentry
);
1612 /* Called from selinux_complete_init, try to
1614 dentry
= d_find_alias(inode
);
1616 * This can be hit on boot when a file is accessed
1617 * before the policy is loaded. When we load policy we
1618 * may find inodes that have no dentry on the
1619 * sbsec->isec_head list. No reason to complain as
1620 * these will get fixed up the next time we go through
1621 * inode_doinit() with a dentry, before these inodes
1622 * could be used again by userspace.
1626 rc
= selinux_genfs_get_sid(dentry
, sclass
,
1627 sbsec
->flags
, &sid
);
1636 spin_lock(&isec
->lock
);
1637 if (isec
->initialized
== LABEL_PENDING
) {
1639 isec
->initialized
= LABEL_INVALID
;
1643 isec
->initialized
= LABEL_INITIALIZED
;
1648 spin_unlock(&isec
->lock
);
1652 /* Convert a Linux signal to an access vector. */
1653 static inline u32
signal_to_av(int sig
)
1659 /* Commonly granted from child to parent. */
1660 perm
= PROCESS__SIGCHLD
;
1663 /* Cannot be caught or ignored */
1664 perm
= PROCESS__SIGKILL
;
1667 /* Cannot be caught or ignored */
1668 perm
= PROCESS__SIGSTOP
;
1671 /* All other signals. */
1672 perm
= PROCESS__SIGNAL
;
1679 #if CAP_LAST_CAP > 63
1680 #error Fix SELinux to handle capabilities > 63.
1683 /* Check whether a task is allowed to use a capability. */
1684 static int cred_has_capability(const struct cred
*cred
,
1685 int cap
, int audit
, bool initns
)
1687 struct common_audit_data ad
;
1688 struct av_decision avd
;
1690 u32 sid
= cred_sid(cred
);
1691 u32 av
= CAP_TO_MASK(cap
);
1694 ad
.type
= LSM_AUDIT_DATA_CAP
;
1697 switch (CAP_TO_INDEX(cap
)) {
1699 sclass
= initns
? SECCLASS_CAPABILITY
: SECCLASS_CAP_USERNS
;
1702 sclass
= initns
? SECCLASS_CAPABILITY2
: SECCLASS_CAP2_USERNS
;
1706 "SELinux: out of range capability %d\n", cap
);
1711 rc
= avc_has_perm_noaudit(sid
, sid
, sclass
, av
, 0, &avd
);
1712 if (audit
== SECURITY_CAP_AUDIT
) {
1713 int rc2
= avc_audit(sid
, sid
, sclass
, av
, &avd
, rc
, &ad
, 0);
1720 /* Check whether a task has a particular permission to an inode.
1721 The 'adp' parameter is optional and allows other audit
1722 data to be passed (e.g. the dentry). */
1723 static int inode_has_perm(const struct cred
*cred
,
1724 struct inode
*inode
,
1726 struct common_audit_data
*adp
)
1728 struct inode_security_struct
*isec
;
1731 validate_creds(cred
);
1733 if (unlikely(IS_PRIVATE(inode
)))
1736 sid
= cred_sid(cred
);
1737 isec
= inode
->i_security
;
1739 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
1742 /* Same as inode_has_perm, but pass explicit audit data containing
1743 the dentry to help the auditing code to more easily generate the
1744 pathname if needed. */
1745 static inline int dentry_has_perm(const struct cred
*cred
,
1746 struct dentry
*dentry
,
1749 struct inode
*inode
= d_backing_inode(dentry
);
1750 struct common_audit_data ad
;
1752 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1753 ad
.u
.dentry
= dentry
;
1754 __inode_security_revalidate(inode
, dentry
, true);
1755 return inode_has_perm(cred
, inode
, av
, &ad
);
1758 /* Same as inode_has_perm, but pass explicit audit data containing
1759 the path to help the auditing code to more easily generate the
1760 pathname if needed. */
1761 static inline int path_has_perm(const struct cred
*cred
,
1762 const struct path
*path
,
1765 struct inode
*inode
= d_backing_inode(path
->dentry
);
1766 struct common_audit_data ad
;
1768 ad
.type
= LSM_AUDIT_DATA_PATH
;
1770 __inode_security_revalidate(inode
, path
->dentry
, true);
1771 return inode_has_perm(cred
, inode
, av
, &ad
);
1774 /* Same as path_has_perm, but uses the inode from the file struct. */
1775 static inline int file_path_has_perm(const struct cred
*cred
,
1779 struct common_audit_data ad
;
1781 ad
.type
= LSM_AUDIT_DATA_FILE
;
1783 return inode_has_perm(cred
, file_inode(file
), av
, &ad
);
1786 /* Check whether a task can use an open file descriptor to
1787 access an inode in a given way. Check access to the
1788 descriptor itself, and then use dentry_has_perm to
1789 check a particular permission to the file.
1790 Access to the descriptor is implicitly granted if it
1791 has the same SID as the process. If av is zero, then
1792 access to the file is not checked, e.g. for cases
1793 where only the descriptor is affected like seek. */
1794 static int file_has_perm(const struct cred
*cred
,
1798 struct file_security_struct
*fsec
= file
->f_security
;
1799 struct inode
*inode
= file_inode(file
);
1800 struct common_audit_data ad
;
1801 u32 sid
= cred_sid(cred
);
1804 ad
.type
= LSM_AUDIT_DATA_FILE
;
1807 if (sid
!= fsec
->sid
) {
1808 rc
= avc_has_perm(sid
, fsec
->sid
,
1816 /* av is zero if only checking access to the descriptor. */
1819 rc
= inode_has_perm(cred
, inode
, av
, &ad
);
1826 * Determine the label for an inode that might be unioned.
1829 selinux_determine_inode_label(const struct task_security_struct
*tsec
,
1831 const struct qstr
*name
, u16 tclass
,
1834 const struct superblock_security_struct
*sbsec
= dir
->i_sb
->s_security
;
1836 if ((sbsec
->flags
& SE_SBINITIALIZED
) &&
1837 (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)) {
1838 *_new_isid
= sbsec
->mntpoint_sid
;
1839 } else if ((sbsec
->flags
& SBLABEL_MNT
) &&
1841 *_new_isid
= tsec
->create_sid
;
1843 const struct inode_security_struct
*dsec
= inode_security(dir
);
1844 return security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1851 /* Check whether a task can create a file. */
1852 static int may_create(struct inode
*dir
,
1853 struct dentry
*dentry
,
1856 const struct task_security_struct
*tsec
= current_security();
1857 struct inode_security_struct
*dsec
;
1858 struct superblock_security_struct
*sbsec
;
1860 struct common_audit_data ad
;
1863 dsec
= inode_security(dir
);
1864 sbsec
= dir
->i_sb
->s_security
;
1868 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1869 ad
.u
.dentry
= dentry
;
1871 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
,
1872 DIR__ADD_NAME
| DIR__SEARCH
,
1877 rc
= selinux_determine_inode_label(current_security(), dir
,
1878 &dentry
->d_name
, tclass
, &newsid
);
1882 rc
= avc_has_perm(sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1886 return avc_has_perm(newsid
, sbsec
->sid
,
1887 SECCLASS_FILESYSTEM
,
1888 FILESYSTEM__ASSOCIATE
, &ad
);
1892 #define MAY_UNLINK 1
1895 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1896 static int may_link(struct inode
*dir
,
1897 struct dentry
*dentry
,
1901 struct inode_security_struct
*dsec
, *isec
;
1902 struct common_audit_data ad
;
1903 u32 sid
= current_sid();
1907 dsec
= inode_security(dir
);
1908 isec
= backing_inode_security(dentry
);
1910 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1911 ad
.u
.dentry
= dentry
;
1914 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1915 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1930 printk(KERN_WARNING
"SELinux: %s: unrecognized kind %d\n",
1935 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1939 static inline int may_rename(struct inode
*old_dir
,
1940 struct dentry
*old_dentry
,
1941 struct inode
*new_dir
,
1942 struct dentry
*new_dentry
)
1944 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1945 struct common_audit_data ad
;
1946 u32 sid
= current_sid();
1948 int old_is_dir
, new_is_dir
;
1951 old_dsec
= inode_security(old_dir
);
1952 old_isec
= backing_inode_security(old_dentry
);
1953 old_is_dir
= d_is_dir(old_dentry
);
1954 new_dsec
= inode_security(new_dir
);
1956 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1958 ad
.u
.dentry
= old_dentry
;
1959 rc
= avc_has_perm(sid
, old_dsec
->sid
, SECCLASS_DIR
,
1960 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1963 rc
= avc_has_perm(sid
, old_isec
->sid
,
1964 old_isec
->sclass
, FILE__RENAME
, &ad
);
1967 if (old_is_dir
&& new_dir
!= old_dir
) {
1968 rc
= avc_has_perm(sid
, old_isec
->sid
,
1969 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1974 ad
.u
.dentry
= new_dentry
;
1975 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1976 if (d_is_positive(new_dentry
))
1977 av
|= DIR__REMOVE_NAME
;
1978 rc
= avc_has_perm(sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1981 if (d_is_positive(new_dentry
)) {
1982 new_isec
= backing_inode_security(new_dentry
);
1983 new_is_dir
= d_is_dir(new_dentry
);
1984 rc
= avc_has_perm(sid
, new_isec
->sid
,
1986 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1994 /* Check whether a task can perform a filesystem operation. */
1995 static int superblock_has_perm(const struct cred
*cred
,
1996 struct super_block
*sb
,
1998 struct common_audit_data
*ad
)
2000 struct superblock_security_struct
*sbsec
;
2001 u32 sid
= cred_sid(cred
);
2003 sbsec
= sb
->s_security
;
2004 return avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
, perms
, ad
);
2007 /* Convert a Linux mode and permission mask to an access vector. */
2008 static inline u32
file_mask_to_av(int mode
, int mask
)
2012 if (!S_ISDIR(mode
)) {
2013 if (mask
& MAY_EXEC
)
2014 av
|= FILE__EXECUTE
;
2015 if (mask
& MAY_READ
)
2018 if (mask
& MAY_APPEND
)
2020 else if (mask
& MAY_WRITE
)
2024 if (mask
& MAY_EXEC
)
2026 if (mask
& MAY_WRITE
)
2028 if (mask
& MAY_READ
)
2035 /* Convert a Linux file to an access vector. */
2036 static inline u32
file_to_av(struct file
*file
)
2040 if (file
->f_mode
& FMODE_READ
)
2042 if (file
->f_mode
& FMODE_WRITE
) {
2043 if (file
->f_flags
& O_APPEND
)
2050 * Special file opened with flags 3 for ioctl-only use.
2059 * Convert a file to an access vector and include the correct open
2062 static inline u32
open_file_to_av(struct file
*file
)
2064 u32 av
= file_to_av(file
);
2066 if (selinux_policycap_openperm
)
2072 /* Hook functions begin here. */
2074 static int selinux_binder_set_context_mgr(struct task_struct
*mgr
)
2076 u32 mysid
= current_sid();
2077 u32 mgrsid
= task_sid(mgr
);
2079 return avc_has_perm(mysid
, mgrsid
, SECCLASS_BINDER
,
2080 BINDER__SET_CONTEXT_MGR
, NULL
);
2083 static int selinux_binder_transaction(struct task_struct
*from
,
2084 struct task_struct
*to
)
2086 u32 mysid
= current_sid();
2087 u32 fromsid
= task_sid(from
);
2088 u32 tosid
= task_sid(to
);
2091 if (mysid
!= fromsid
) {
2092 rc
= avc_has_perm(mysid
, fromsid
, SECCLASS_BINDER
,
2093 BINDER__IMPERSONATE
, NULL
);
2098 return avc_has_perm(fromsid
, tosid
, SECCLASS_BINDER
, BINDER__CALL
,
2102 static int selinux_binder_transfer_binder(struct task_struct
*from
,
2103 struct task_struct
*to
)
2105 u32 fromsid
= task_sid(from
);
2106 u32 tosid
= task_sid(to
);
2108 return avc_has_perm(fromsid
, tosid
, SECCLASS_BINDER
, BINDER__TRANSFER
,
2112 static int selinux_binder_transfer_file(struct task_struct
*from
,
2113 struct task_struct
*to
,
2116 u32 sid
= task_sid(to
);
2117 struct file_security_struct
*fsec
= file
->f_security
;
2118 struct dentry
*dentry
= file
->f_path
.dentry
;
2119 struct inode_security_struct
*isec
;
2120 struct common_audit_data ad
;
2123 ad
.type
= LSM_AUDIT_DATA_PATH
;
2124 ad
.u
.path
= file
->f_path
;
2126 if (sid
!= fsec
->sid
) {
2127 rc
= avc_has_perm(sid
, fsec
->sid
,
2135 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2138 isec
= backing_inode_security(dentry
);
2139 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, file_to_av(file
),
2143 static int selinux_ptrace_access_check(struct task_struct
*child
,
2146 u32 sid
= current_sid();
2147 u32 csid
= task_sid(child
);
2149 if (mode
& PTRACE_MODE_READ
)
2150 return avc_has_perm(sid
, csid
, SECCLASS_FILE
, FILE__READ
, NULL
);
2152 return avc_has_perm(sid
, csid
, SECCLASS_PROCESS
, PROCESS__PTRACE
, NULL
);
2155 static int selinux_ptrace_traceme(struct task_struct
*parent
)
2157 return avc_has_perm(task_sid(parent
), current_sid(), SECCLASS_PROCESS
,
2158 PROCESS__PTRACE
, NULL
);
2161 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
2162 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
2164 return avc_has_perm(current_sid(), task_sid(target
), SECCLASS_PROCESS
,
2165 PROCESS__GETCAP
, NULL
);
2168 static int selinux_capset(struct cred
*new, const struct cred
*old
,
2169 const kernel_cap_t
*effective
,
2170 const kernel_cap_t
*inheritable
,
2171 const kernel_cap_t
*permitted
)
2173 return avc_has_perm(cred_sid(old
), cred_sid(new), SECCLASS_PROCESS
,
2174 PROCESS__SETCAP
, NULL
);
2178 * (This comment used to live with the selinux_task_setuid hook,
2179 * which was removed).
2181 * Since setuid only affects the current process, and since the SELinux
2182 * controls are not based on the Linux identity attributes, SELinux does not
2183 * need to control this operation. However, SELinux does control the use of
2184 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2187 static int selinux_capable(const struct cred
*cred
, struct user_namespace
*ns
,
2190 return cred_has_capability(cred
, cap
, audit
, ns
== &init_user_ns
);
2193 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
2195 const struct cred
*cred
= current_cred();
2207 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAMOD
, NULL
);
2212 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAGET
, NULL
);
2215 rc
= 0; /* let the kernel handle invalid cmds */
2221 static int selinux_quota_on(struct dentry
*dentry
)
2223 const struct cred
*cred
= current_cred();
2225 return dentry_has_perm(cred
, dentry
, FILE__QUOTAON
);
2228 static int selinux_syslog(int type
)
2231 case SYSLOG_ACTION_READ_ALL
: /* Read last kernel messages */
2232 case SYSLOG_ACTION_SIZE_BUFFER
: /* Return size of the log buffer */
2233 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2234 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_READ
, NULL
);
2235 case SYSLOG_ACTION_CONSOLE_OFF
: /* Disable logging to console */
2236 case SYSLOG_ACTION_CONSOLE_ON
: /* Enable logging to console */
2237 /* Set level of messages printed to console */
2238 case SYSLOG_ACTION_CONSOLE_LEVEL
:
2239 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2240 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_CONSOLE
,
2243 /* All other syslog types */
2244 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2245 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_MOD
, NULL
);
2249 * Check that a process has enough memory to allocate a new virtual
2250 * mapping. 0 means there is enough memory for the allocation to
2251 * succeed and -ENOMEM implies there is not.
2253 * Do not audit the selinux permission check, as this is applied to all
2254 * processes that allocate mappings.
2256 static int selinux_vm_enough_memory(struct mm_struct
*mm
, long pages
)
2258 int rc
, cap_sys_admin
= 0;
2260 rc
= cred_has_capability(current_cred(), CAP_SYS_ADMIN
,
2261 SECURITY_CAP_NOAUDIT
, true);
2265 return cap_sys_admin
;
2268 /* binprm security operations */
2270 static u32
ptrace_parent_sid(void)
2273 struct task_struct
*tracer
;
2276 tracer
= ptrace_parent(current
);
2278 sid
= task_sid(tracer
);
2284 static int check_nnp_nosuid(const struct linux_binprm
*bprm
,
2285 const struct task_security_struct
*old_tsec
,
2286 const struct task_security_struct
*new_tsec
)
2288 int nnp
= (bprm
->unsafe
& LSM_UNSAFE_NO_NEW_PRIVS
);
2289 int nosuid
= !mnt_may_suid(bprm
->file
->f_path
.mnt
);
2292 if (!nnp
&& !nosuid
)
2293 return 0; /* neither NNP nor nosuid */
2295 if (new_tsec
->sid
== old_tsec
->sid
)
2296 return 0; /* No change in credentials */
2299 * The only transitions we permit under NNP or nosuid
2300 * are transitions to bounded SIDs, i.e. SIDs that are
2301 * guaranteed to only be allowed a subset of the permissions
2302 * of the current SID.
2304 rc
= security_bounded_transition(old_tsec
->sid
, new_tsec
->sid
);
2307 * On failure, preserve the errno values for NNP vs nosuid.
2308 * NNP: Operation not permitted for caller.
2309 * nosuid: Permission denied to file.
2319 static int selinux_bprm_set_creds(struct linux_binprm
*bprm
)
2321 const struct task_security_struct
*old_tsec
;
2322 struct task_security_struct
*new_tsec
;
2323 struct inode_security_struct
*isec
;
2324 struct common_audit_data ad
;
2325 struct inode
*inode
= file_inode(bprm
->file
);
2328 /* SELinux context only depends on initial program or script and not
2329 * the script interpreter */
2330 if (bprm
->cred_prepared
)
2333 old_tsec
= current_security();
2334 new_tsec
= bprm
->cred
->security
;
2335 isec
= inode_security(inode
);
2337 /* Default to the current task SID. */
2338 new_tsec
->sid
= old_tsec
->sid
;
2339 new_tsec
->osid
= old_tsec
->sid
;
2341 /* Reset fs, key, and sock SIDs on execve. */
2342 new_tsec
->create_sid
= 0;
2343 new_tsec
->keycreate_sid
= 0;
2344 new_tsec
->sockcreate_sid
= 0;
2346 if (old_tsec
->exec_sid
) {
2347 new_tsec
->sid
= old_tsec
->exec_sid
;
2348 /* Reset exec SID on execve. */
2349 new_tsec
->exec_sid
= 0;
2351 /* Fail on NNP or nosuid if not an allowed transition. */
2352 rc
= check_nnp_nosuid(bprm
, old_tsec
, new_tsec
);
2356 /* Check for a default transition on this program. */
2357 rc
= security_transition_sid(old_tsec
->sid
, isec
->sid
,
2358 SECCLASS_PROCESS
, NULL
,
2364 * Fallback to old SID on NNP or nosuid if not an allowed
2367 rc
= check_nnp_nosuid(bprm
, old_tsec
, new_tsec
);
2369 new_tsec
->sid
= old_tsec
->sid
;
2372 ad
.type
= LSM_AUDIT_DATA_FILE
;
2373 ad
.u
.file
= bprm
->file
;
2375 if (new_tsec
->sid
== old_tsec
->sid
) {
2376 rc
= avc_has_perm(old_tsec
->sid
, isec
->sid
,
2377 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
2381 /* Check permissions for the transition. */
2382 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2383 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
2387 rc
= avc_has_perm(new_tsec
->sid
, isec
->sid
,
2388 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
2392 /* Check for shared state */
2393 if (bprm
->unsafe
& LSM_UNSAFE_SHARE
) {
2394 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2395 SECCLASS_PROCESS
, PROCESS__SHARE
,
2401 /* Make sure that anyone attempting to ptrace over a task that
2402 * changes its SID has the appropriate permit */
2403 if (bprm
->unsafe
& LSM_UNSAFE_PTRACE
) {
2404 u32 ptsid
= ptrace_parent_sid();
2406 rc
= avc_has_perm(ptsid
, new_tsec
->sid
,
2408 PROCESS__PTRACE
, NULL
);
2414 /* Clear any possibly unsafe personality bits on exec: */
2415 bprm
->per_clear
|= PER_CLEAR_ON_SETID
;
2421 static int selinux_bprm_secureexec(struct linux_binprm
*bprm
)
2423 const struct task_security_struct
*tsec
= current_security();
2431 /* Enable secure mode for SIDs transitions unless
2432 the noatsecure permission is granted between
2433 the two SIDs, i.e. ahp returns 0. */
2434 atsecure
= avc_has_perm(osid
, sid
,
2436 PROCESS__NOATSECURE
, NULL
);
2442 static int match_file(const void *p
, struct file
*file
, unsigned fd
)
2444 return file_has_perm(p
, file
, file_to_av(file
)) ? fd
+ 1 : 0;
2447 /* Derived from fs/exec.c:flush_old_files. */
2448 static inline void flush_unauthorized_files(const struct cred
*cred
,
2449 struct files_struct
*files
)
2451 struct file
*file
, *devnull
= NULL
;
2452 struct tty_struct
*tty
;
2456 tty
= get_current_tty();
2458 spin_lock(&tty
->files_lock
);
2459 if (!list_empty(&tty
->tty_files
)) {
2460 struct tty_file_private
*file_priv
;
2462 /* Revalidate access to controlling tty.
2463 Use file_path_has_perm on the tty path directly
2464 rather than using file_has_perm, as this particular
2465 open file may belong to another process and we are
2466 only interested in the inode-based check here. */
2467 file_priv
= list_first_entry(&tty
->tty_files
,
2468 struct tty_file_private
, list
);
2469 file
= file_priv
->file
;
2470 if (file_path_has_perm(cred
, file
, FILE__READ
| FILE__WRITE
))
2473 spin_unlock(&tty
->files_lock
);
2476 /* Reset controlling tty. */
2480 /* Revalidate access to inherited open files. */
2481 n
= iterate_fd(files
, 0, match_file
, cred
);
2482 if (!n
) /* none found? */
2485 devnull
= dentry_open(&selinux_null
, O_RDWR
, cred
);
2486 if (IS_ERR(devnull
))
2488 /* replace all the matching ones with this */
2490 replace_fd(n
- 1, devnull
, 0);
2491 } while ((n
= iterate_fd(files
, n
, match_file
, cred
)) != 0);
2497 * Prepare a process for imminent new credential changes due to exec
2499 static void selinux_bprm_committing_creds(struct linux_binprm
*bprm
)
2501 struct task_security_struct
*new_tsec
;
2502 struct rlimit
*rlim
, *initrlim
;
2505 new_tsec
= bprm
->cred
->security
;
2506 if (new_tsec
->sid
== new_tsec
->osid
)
2509 /* Close files for which the new task SID is not authorized. */
2510 flush_unauthorized_files(bprm
->cred
, current
->files
);
2512 /* Always clear parent death signal on SID transitions. */
2513 current
->pdeath_signal
= 0;
2515 /* Check whether the new SID can inherit resource limits from the old
2516 * SID. If not, reset all soft limits to the lower of the current
2517 * task's hard limit and the init task's soft limit.
2519 * Note that the setting of hard limits (even to lower them) can be
2520 * controlled by the setrlimit check. The inclusion of the init task's
2521 * soft limit into the computation is to avoid resetting soft limits
2522 * higher than the default soft limit for cases where the default is
2523 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2525 rc
= avc_has_perm(new_tsec
->osid
, new_tsec
->sid
, SECCLASS_PROCESS
,
2526 PROCESS__RLIMITINH
, NULL
);
2528 /* protect against do_prlimit() */
2530 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
2531 rlim
= current
->signal
->rlim
+ i
;
2532 initrlim
= init_task
.signal
->rlim
+ i
;
2533 rlim
->rlim_cur
= min(rlim
->rlim_max
, initrlim
->rlim_cur
);
2535 task_unlock(current
);
2536 if (IS_ENABLED(CONFIG_POSIX_TIMERS
))
2537 update_rlimit_cpu(current
, rlimit(RLIMIT_CPU
));
2542 * Clean up the process immediately after the installation of new credentials
2545 static void selinux_bprm_committed_creds(struct linux_binprm
*bprm
)
2547 const struct task_security_struct
*tsec
= current_security();
2548 struct itimerval itimer
;
2558 /* Check whether the new SID can inherit signal state from the old SID.
2559 * If not, clear itimers to avoid subsequent signal generation and
2560 * flush and unblock signals.
2562 * This must occur _after_ the task SID has been updated so that any
2563 * kill done after the flush will be checked against the new SID.
2565 rc
= avc_has_perm(osid
, sid
, SECCLASS_PROCESS
, PROCESS__SIGINH
, NULL
);
2567 if (IS_ENABLED(CONFIG_POSIX_TIMERS
)) {
2568 memset(&itimer
, 0, sizeof itimer
);
2569 for (i
= 0; i
< 3; i
++)
2570 do_setitimer(i
, &itimer
, NULL
);
2572 spin_lock_irq(¤t
->sighand
->siglock
);
2573 if (!fatal_signal_pending(current
)) {
2574 flush_sigqueue(¤t
->pending
);
2575 flush_sigqueue(¤t
->signal
->shared_pending
);
2576 flush_signal_handlers(current
, 1);
2577 sigemptyset(¤t
->blocked
);
2578 recalc_sigpending();
2580 spin_unlock_irq(¤t
->sighand
->siglock
);
2583 /* Wake up the parent if it is waiting so that it can recheck
2584 * wait permission to the new task SID. */
2585 read_lock(&tasklist_lock
);
2586 __wake_up_parent(current
, current
->real_parent
);
2587 read_unlock(&tasklist_lock
);
2590 /* superblock security operations */
2592 static int selinux_sb_alloc_security(struct super_block
*sb
)
2594 return superblock_alloc_security(sb
);
2597 static void selinux_sb_free_security(struct super_block
*sb
)
2599 superblock_free_security(sb
);
2602 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
2607 return !memcmp(prefix
, option
, plen
);
2610 static inline int selinux_option(char *option
, int len
)
2612 return (match_prefix(CONTEXT_STR
, sizeof(CONTEXT_STR
)-1, option
, len
) ||
2613 match_prefix(FSCONTEXT_STR
, sizeof(FSCONTEXT_STR
)-1, option
, len
) ||
2614 match_prefix(DEFCONTEXT_STR
, sizeof(DEFCONTEXT_STR
)-1, option
, len
) ||
2615 match_prefix(ROOTCONTEXT_STR
, sizeof(ROOTCONTEXT_STR
)-1, option
, len
) ||
2616 match_prefix(LABELSUPP_STR
, sizeof(LABELSUPP_STR
)-1, option
, len
));
2619 static inline void take_option(char **to
, char *from
, int *first
, int len
)
2626 memcpy(*to
, from
, len
);
2630 static inline void take_selinux_option(char **to
, char *from
, int *first
,
2633 int current_size
= 0;
2641 while (current_size
< len
) {
2651 static int selinux_sb_copy_data(char *orig
, char *copy
)
2653 int fnosec
, fsec
, rc
= 0;
2654 char *in_save
, *in_curr
, *in_end
;
2655 char *sec_curr
, *nosec_save
, *nosec
;
2661 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
2669 in_save
= in_end
= orig
;
2673 open_quote
= !open_quote
;
2674 if ((*in_end
== ',' && open_quote
== 0) ||
2676 int len
= in_end
- in_curr
;
2678 if (selinux_option(in_curr
, len
))
2679 take_selinux_option(&sec_curr
, in_curr
, &fsec
, len
);
2681 take_option(&nosec
, in_curr
, &fnosec
, len
);
2683 in_curr
= in_end
+ 1;
2685 } while (*in_end
++);
2687 strcpy(in_save
, nosec_save
);
2688 free_page((unsigned long)nosec_save
);
2693 static int selinux_sb_remount(struct super_block
*sb
, void *data
)
2696 struct security_mnt_opts opts
;
2697 char *secdata
, **mount_options
;
2698 struct superblock_security_struct
*sbsec
= sb
->s_security
;
2700 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
2706 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
2709 security_init_mnt_opts(&opts
);
2710 secdata
= alloc_secdata();
2713 rc
= selinux_sb_copy_data(data
, secdata
);
2715 goto out_free_secdata
;
2717 rc
= selinux_parse_opts_str(secdata
, &opts
);
2719 goto out_free_secdata
;
2721 mount_options
= opts
.mnt_opts
;
2722 flags
= opts
.mnt_opts_flags
;
2724 for (i
= 0; i
< opts
.num_mnt_opts
; i
++) {
2727 if (flags
[i
] == SBLABEL_MNT
)
2729 rc
= security_context_str_to_sid(mount_options
[i
], &sid
, GFP_KERNEL
);
2731 printk(KERN_WARNING
"SELinux: security_context_str_to_sid"
2732 "(%s) failed for (dev %s, type %s) errno=%d\n",
2733 mount_options
[i
], sb
->s_id
, sb
->s_type
->name
, rc
);
2739 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
, sid
))
2740 goto out_bad_option
;
2743 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
, sid
))
2744 goto out_bad_option
;
2746 case ROOTCONTEXT_MNT
: {
2747 struct inode_security_struct
*root_isec
;
2748 root_isec
= backing_inode_security(sb
->s_root
);
2750 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
, sid
))
2751 goto out_bad_option
;
2754 case DEFCONTEXT_MNT
:
2755 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
, sid
))
2756 goto out_bad_option
;
2765 security_free_mnt_opts(&opts
);
2767 free_secdata(secdata
);
2770 printk(KERN_WARNING
"SELinux: unable to change security options "
2771 "during remount (dev %s, type=%s)\n", sb
->s_id
,
2776 static int selinux_sb_kern_mount(struct super_block
*sb
, int flags
, void *data
)
2778 const struct cred
*cred
= current_cred();
2779 struct common_audit_data ad
;
2782 rc
= superblock_doinit(sb
, data
);
2786 /* Allow all mounts performed by the kernel */
2787 if (flags
& MS_KERNMOUNT
)
2790 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2791 ad
.u
.dentry
= sb
->s_root
;
2792 return superblock_has_perm(cred
, sb
, FILESYSTEM__MOUNT
, &ad
);
2795 static int selinux_sb_statfs(struct dentry
*dentry
)
2797 const struct cred
*cred
= current_cred();
2798 struct common_audit_data ad
;
2800 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2801 ad
.u
.dentry
= dentry
->d_sb
->s_root
;
2802 return superblock_has_perm(cred
, dentry
->d_sb
, FILESYSTEM__GETATTR
, &ad
);
2805 static int selinux_mount(const char *dev_name
,
2806 const struct path
*path
,
2808 unsigned long flags
,
2811 const struct cred
*cred
= current_cred();
2813 if (flags
& MS_REMOUNT
)
2814 return superblock_has_perm(cred
, path
->dentry
->d_sb
,
2815 FILESYSTEM__REMOUNT
, NULL
);
2817 return path_has_perm(cred
, path
, FILE__MOUNTON
);
2820 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
2822 const struct cred
*cred
= current_cred();
2824 return superblock_has_perm(cred
, mnt
->mnt_sb
,
2825 FILESYSTEM__UNMOUNT
, NULL
);
2828 /* inode security operations */
2830 static int selinux_inode_alloc_security(struct inode
*inode
)
2832 return inode_alloc_security(inode
);
2835 static void selinux_inode_free_security(struct inode
*inode
)
2837 inode_free_security(inode
);
2840 static int selinux_dentry_init_security(struct dentry
*dentry
, int mode
,
2841 const struct qstr
*name
, void **ctx
,
2847 rc
= selinux_determine_inode_label(current_security(),
2848 d_inode(dentry
->d_parent
), name
,
2849 inode_mode_to_security_class(mode
),
2854 return security_sid_to_context(newsid
, (char **)ctx
, ctxlen
);
2857 static int selinux_dentry_create_files_as(struct dentry
*dentry
, int mode
,
2859 const struct cred
*old
,
2864 struct task_security_struct
*tsec
;
2866 rc
= selinux_determine_inode_label(old
->security
,
2867 d_inode(dentry
->d_parent
), name
,
2868 inode_mode_to_security_class(mode
),
2873 tsec
= new->security
;
2874 tsec
->create_sid
= newsid
;
2878 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
2879 const struct qstr
*qstr
,
2881 void **value
, size_t *len
)
2883 const struct task_security_struct
*tsec
= current_security();
2884 struct superblock_security_struct
*sbsec
;
2885 u32 sid
, newsid
, clen
;
2889 sbsec
= dir
->i_sb
->s_security
;
2892 newsid
= tsec
->create_sid
;
2894 rc
= selinux_determine_inode_label(current_security(),
2896 inode_mode_to_security_class(inode
->i_mode
),
2901 /* Possibly defer initialization to selinux_complete_init. */
2902 if (sbsec
->flags
& SE_SBINITIALIZED
) {
2903 struct inode_security_struct
*isec
= inode
->i_security
;
2904 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
2906 isec
->initialized
= LABEL_INITIALIZED
;
2909 if (!ss_initialized
|| !(sbsec
->flags
& SBLABEL_MNT
))
2913 *name
= XATTR_SELINUX_SUFFIX
;
2916 rc
= security_sid_to_context_force(newsid
, &context
, &clen
);
2926 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
)
2928 return may_create(dir
, dentry
, SECCLASS_FILE
);
2931 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2933 return may_link(dir
, old_dentry
, MAY_LINK
);
2936 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2938 return may_link(dir
, dentry
, MAY_UNLINK
);
2941 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2943 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2946 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, umode_t mask
)
2948 return may_create(dir
, dentry
, SECCLASS_DIR
);
2951 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2953 return may_link(dir
, dentry
, MAY_RMDIR
);
2956 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
, dev_t dev
)
2958 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2961 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2962 struct inode
*new_inode
, struct dentry
*new_dentry
)
2964 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2967 static int selinux_inode_readlink(struct dentry
*dentry
)
2969 const struct cred
*cred
= current_cred();
2971 return dentry_has_perm(cred
, dentry
, FILE__READ
);
2974 static int selinux_inode_follow_link(struct dentry
*dentry
, struct inode
*inode
,
2977 const struct cred
*cred
= current_cred();
2978 struct common_audit_data ad
;
2979 struct inode_security_struct
*isec
;
2982 validate_creds(cred
);
2984 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2985 ad
.u
.dentry
= dentry
;
2986 sid
= cred_sid(cred
);
2987 isec
= inode_security_rcu(inode
, rcu
);
2989 return PTR_ERR(isec
);
2991 return avc_has_perm_flags(sid
, isec
->sid
, isec
->sclass
, FILE__READ
, &ad
,
2992 rcu
? MAY_NOT_BLOCK
: 0);
2995 static noinline
int audit_inode_permission(struct inode
*inode
,
2996 u32 perms
, u32 audited
, u32 denied
,
3000 struct common_audit_data ad
;
3001 struct inode_security_struct
*isec
= inode
->i_security
;
3004 ad
.type
= LSM_AUDIT_DATA_INODE
;
3007 rc
= slow_avc_audit(current_sid(), isec
->sid
, isec
->sclass
, perms
,
3008 audited
, denied
, result
, &ad
, flags
);
3014 static int selinux_inode_permission(struct inode
*inode
, int mask
)
3016 const struct cred
*cred
= current_cred();
3019 unsigned flags
= mask
& MAY_NOT_BLOCK
;
3020 struct inode_security_struct
*isec
;
3022 struct av_decision avd
;
3024 u32 audited
, denied
;
3026 from_access
= mask
& MAY_ACCESS
;
3027 mask
&= (MAY_READ
|MAY_WRITE
|MAY_EXEC
|MAY_APPEND
);
3029 /* No permission to check. Existence test. */
3033 validate_creds(cred
);
3035 if (unlikely(IS_PRIVATE(inode
)))
3038 perms
= file_mask_to_av(inode
->i_mode
, mask
);
3040 sid
= cred_sid(cred
);
3041 isec
= inode_security_rcu(inode
, flags
& MAY_NOT_BLOCK
);
3043 return PTR_ERR(isec
);
3045 rc
= avc_has_perm_noaudit(sid
, isec
->sid
, isec
->sclass
, perms
, 0, &avd
);
3046 audited
= avc_audit_required(perms
, &avd
, rc
,
3047 from_access
? FILE__AUDIT_ACCESS
: 0,
3049 if (likely(!audited
))
3052 rc2
= audit_inode_permission(inode
, perms
, audited
, denied
, rc
, flags
);
3058 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
3060 const struct cred
*cred
= current_cred();
3061 unsigned int ia_valid
= iattr
->ia_valid
;
3062 __u32 av
= FILE__WRITE
;
3064 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3065 if (ia_valid
& ATTR_FORCE
) {
3066 ia_valid
&= ~(ATTR_KILL_SUID
| ATTR_KILL_SGID
| ATTR_MODE
|
3072 if (ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
3073 ATTR_ATIME_SET
| ATTR_MTIME_SET
| ATTR_TIMES_SET
))
3074 return dentry_has_perm(cred
, dentry
, FILE__SETATTR
);
3076 if (selinux_policycap_openperm
&& (ia_valid
& ATTR_SIZE
)
3077 && !(ia_valid
& ATTR_FILE
))
3080 return dentry_has_perm(cred
, dentry
, av
);
3083 static int selinux_inode_getattr(const struct path
*path
)
3085 return path_has_perm(current_cred(), path
, FILE__GETATTR
);
3088 static int selinux_inode_setotherxattr(struct dentry
*dentry
, const char *name
)
3090 const struct cred
*cred
= current_cred();
3092 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
3093 sizeof XATTR_SECURITY_PREFIX
- 1)) {
3094 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
3095 if (!capable(CAP_SETFCAP
))
3097 } else if (!capable(CAP_SYS_ADMIN
)) {
3098 /* A different attribute in the security namespace.
3099 Restrict to administrator. */
3104 /* Not an attribute we recognize, so just check the
3105 ordinary setattr permission. */
3106 return dentry_has_perm(cred
, dentry
, FILE__SETATTR
);
3109 static int selinux_inode_setxattr(struct dentry
*dentry
, const char *name
,
3110 const void *value
, size_t size
, int flags
)
3112 struct inode
*inode
= d_backing_inode(dentry
);
3113 struct inode_security_struct
*isec
;
3114 struct superblock_security_struct
*sbsec
;
3115 struct common_audit_data ad
;
3116 u32 newsid
, sid
= current_sid();
3119 if (strcmp(name
, XATTR_NAME_SELINUX
))
3120 return selinux_inode_setotherxattr(dentry
, name
);
3122 sbsec
= inode
->i_sb
->s_security
;
3123 if (!(sbsec
->flags
& SBLABEL_MNT
))
3126 if (!inode_owner_or_capable(inode
))
3129 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
3130 ad
.u
.dentry
= dentry
;
3132 isec
= backing_inode_security(dentry
);
3133 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
,
3134 FILE__RELABELFROM
, &ad
);
3138 rc
= security_context_to_sid(value
, size
, &newsid
, GFP_KERNEL
);
3139 if (rc
== -EINVAL
) {
3140 if (!capable(CAP_MAC_ADMIN
)) {
3141 struct audit_buffer
*ab
;
3145 /* We strip a nul only if it is at the end, otherwise the
3146 * context contains a nul and we should audit that */
3149 if (str
[size
- 1] == '\0')
3150 audit_size
= size
- 1;
3157 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
);
3158 audit_log_format(ab
, "op=setxattr invalid_context=");
3159 audit_log_n_untrustedstring(ab
, value
, audit_size
);
3164 rc
= security_context_to_sid_force(value
, size
, &newsid
);
3169 rc
= avc_has_perm(sid
, newsid
, isec
->sclass
,
3170 FILE__RELABELTO
, &ad
);
3174 rc
= security_validate_transition(isec
->sid
, newsid
, sid
,
3179 return avc_has_perm(newsid
,
3181 SECCLASS_FILESYSTEM
,
3182 FILESYSTEM__ASSOCIATE
,
3186 static void selinux_inode_post_setxattr(struct dentry
*dentry
, const char *name
,
3187 const void *value
, size_t size
,
3190 struct inode
*inode
= d_backing_inode(dentry
);
3191 struct inode_security_struct
*isec
;
3195 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
3196 /* Not an attribute we recognize, so nothing to do. */
3200 rc
= security_context_to_sid_force(value
, size
, &newsid
);
3202 printk(KERN_ERR
"SELinux: unable to map context to SID"
3203 "for (%s, %lu), rc=%d\n",
3204 inode
->i_sb
->s_id
, inode
->i_ino
, -rc
);
3208 isec
= backing_inode_security(dentry
);
3209 spin_lock(&isec
->lock
);
3210 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3212 isec
->initialized
= LABEL_INITIALIZED
;
3213 spin_unlock(&isec
->lock
);
3218 static int selinux_inode_getxattr(struct dentry
*dentry
, const char *name
)
3220 const struct cred
*cred
= current_cred();
3222 return dentry_has_perm(cred
, dentry
, FILE__GETATTR
);
3225 static int selinux_inode_listxattr(struct dentry
*dentry
)
3227 const struct cred
*cred
= current_cred();
3229 return dentry_has_perm(cred
, dentry
, FILE__GETATTR
);
3232 static int selinux_inode_removexattr(struct dentry
*dentry
, const char *name
)
3234 if (strcmp(name
, XATTR_NAME_SELINUX
))
3235 return selinux_inode_setotherxattr(dentry
, name
);
3237 /* No one is allowed to remove a SELinux security label.
3238 You can change the label, but all data must be labeled. */
3243 * Copy the inode security context value to the user.
3245 * Permission check is handled by selinux_inode_getxattr hook.
3247 static int selinux_inode_getsecurity(struct inode
*inode
, const char *name
, void **buffer
, bool alloc
)
3251 char *context
= NULL
;
3252 struct inode_security_struct
*isec
;
3254 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
3258 * If the caller has CAP_MAC_ADMIN, then get the raw context
3259 * value even if it is not defined by current policy; otherwise,
3260 * use the in-core value under current policy.
3261 * Use the non-auditing forms of the permission checks since
3262 * getxattr may be called by unprivileged processes commonly
3263 * and lack of permission just means that we fall back to the
3264 * in-core context value, not a denial.
3266 error
= cap_capable(current_cred(), &init_user_ns
, CAP_MAC_ADMIN
,
3267 SECURITY_CAP_NOAUDIT
);
3269 error
= cred_has_capability(current_cred(), CAP_MAC_ADMIN
,
3270 SECURITY_CAP_NOAUDIT
, true);
3271 isec
= inode_security(inode
);
3273 error
= security_sid_to_context_force(isec
->sid
, &context
,
3276 error
= security_sid_to_context(isec
->sid
, &context
, &size
);
3289 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
3290 const void *value
, size_t size
, int flags
)
3292 struct inode_security_struct
*isec
= inode_security_novalidate(inode
);
3296 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
3299 if (!value
|| !size
)
3302 rc
= security_context_to_sid(value
, size
, &newsid
, GFP_KERNEL
);
3306 spin_lock(&isec
->lock
);
3307 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3309 isec
->initialized
= LABEL_INITIALIZED
;
3310 spin_unlock(&isec
->lock
);
3314 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
3316 const int len
= sizeof(XATTR_NAME_SELINUX
);
3317 if (buffer
&& len
<= buffer_size
)
3318 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
3322 static void selinux_inode_getsecid(struct inode
*inode
, u32
*secid
)
3324 struct inode_security_struct
*isec
= inode_security_novalidate(inode
);
3328 static int selinux_inode_copy_up(struct dentry
*src
, struct cred
**new)
3331 struct task_security_struct
*tsec
;
3332 struct cred
*new_creds
= *new;
3334 if (new_creds
== NULL
) {
3335 new_creds
= prepare_creds();
3340 tsec
= new_creds
->security
;
3341 /* Get label from overlay inode and set it in create_sid */
3342 selinux_inode_getsecid(d_inode(src
), &sid
);
3343 tsec
->create_sid
= sid
;
3348 static int selinux_inode_copy_up_xattr(const char *name
)
3350 /* The copy_up hook above sets the initial context on an inode, but we
3351 * don't then want to overwrite it by blindly copying all the lower
3352 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3354 if (strcmp(name
, XATTR_NAME_SELINUX
) == 0)
3355 return 1; /* Discard */
3357 * Any other attribute apart from SELINUX is not claimed, supported
3363 /* file security operations */
3365 static int selinux_revalidate_file_permission(struct file
*file
, int mask
)
3367 const struct cred
*cred
= current_cred();
3368 struct inode
*inode
= file_inode(file
);
3370 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3371 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
3374 return file_has_perm(cred
, file
,
3375 file_mask_to_av(inode
->i_mode
, mask
));
3378 static int selinux_file_permission(struct file
*file
, int mask
)
3380 struct inode
*inode
= file_inode(file
);
3381 struct file_security_struct
*fsec
= file
->f_security
;
3382 struct inode_security_struct
*isec
;
3383 u32 sid
= current_sid();
3386 /* No permission to check. Existence test. */
3389 isec
= inode_security(inode
);
3390 if (sid
== fsec
->sid
&& fsec
->isid
== isec
->sid
&&
3391 fsec
->pseqno
== avc_policy_seqno())
3392 /* No change since file_open check. */
3395 return selinux_revalidate_file_permission(file
, mask
);
3398 static int selinux_file_alloc_security(struct file
*file
)
3400 return file_alloc_security(file
);
3403 static void selinux_file_free_security(struct file
*file
)
3405 file_free_security(file
);
3409 * Check whether a task has the ioctl permission and cmd
3410 * operation to an inode.
3412 static int ioctl_has_perm(const struct cred
*cred
, struct file
*file
,
3413 u32 requested
, u16 cmd
)
3415 struct common_audit_data ad
;
3416 struct file_security_struct
*fsec
= file
->f_security
;
3417 struct inode
*inode
= file_inode(file
);
3418 struct inode_security_struct
*isec
;
3419 struct lsm_ioctlop_audit ioctl
;
3420 u32 ssid
= cred_sid(cred
);
3422 u8 driver
= cmd
>> 8;
3423 u8 xperm
= cmd
& 0xff;
3425 ad
.type
= LSM_AUDIT_DATA_IOCTL_OP
;
3428 ad
.u
.op
->path
= file
->f_path
;
3430 if (ssid
!= fsec
->sid
) {
3431 rc
= avc_has_perm(ssid
, fsec
->sid
,
3439 if (unlikely(IS_PRIVATE(inode
)))
3442 isec
= inode_security(inode
);
3443 rc
= avc_has_extended_perms(ssid
, isec
->sid
, isec
->sclass
,
3444 requested
, driver
, xperm
, &ad
);
3449 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
3452 const struct cred
*cred
= current_cred();
3462 case FS_IOC_GETFLAGS
:
3464 case FS_IOC_GETVERSION
:
3465 error
= file_has_perm(cred
, file
, FILE__GETATTR
);
3468 case FS_IOC_SETFLAGS
:
3470 case FS_IOC_SETVERSION
:
3471 error
= file_has_perm(cred
, file
, FILE__SETATTR
);
3474 /* sys_ioctl() checks */
3478 error
= file_has_perm(cred
, file
, 0);
3483 error
= cred_has_capability(cred
, CAP_SYS_TTY_CONFIG
,
3484 SECURITY_CAP_AUDIT
, true);
3487 /* default case assumes that the command will go
3488 * to the file's ioctl() function.
3491 error
= ioctl_has_perm(cred
, file
, FILE__IOCTL
, (u16
) cmd
);
3496 static int default_noexec
;
3498 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
3500 const struct cred
*cred
= current_cred();
3501 u32 sid
= cred_sid(cred
);
3504 if (default_noexec
&&
3505 (prot
& PROT_EXEC
) && (!file
|| IS_PRIVATE(file_inode(file
)) ||
3506 (!shared
&& (prot
& PROT_WRITE
)))) {
3508 * We are making executable an anonymous mapping or a
3509 * private file mapping that will also be writable.
3510 * This has an additional check.
3512 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3513 PROCESS__EXECMEM
, NULL
);
3519 /* read access is always possible with a mapping */
3520 u32 av
= FILE__READ
;
3522 /* write access only matters if the mapping is shared */
3523 if (shared
&& (prot
& PROT_WRITE
))
3526 if (prot
& PROT_EXEC
)
3527 av
|= FILE__EXECUTE
;
3529 return file_has_perm(cred
, file
, av
);
3536 static int selinux_mmap_addr(unsigned long addr
)
3540 if (addr
< CONFIG_LSM_MMAP_MIN_ADDR
) {
3541 u32 sid
= current_sid();
3542 rc
= avc_has_perm(sid
, sid
, SECCLASS_MEMPROTECT
,
3543 MEMPROTECT__MMAP_ZERO
, NULL
);
3549 static int selinux_mmap_file(struct file
*file
, unsigned long reqprot
,
3550 unsigned long prot
, unsigned long flags
)
3552 if (selinux_checkreqprot
)
3555 return file_map_prot_check(file
, prot
,
3556 (flags
& MAP_TYPE
) == MAP_SHARED
);
3559 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
3560 unsigned long reqprot
,
3563 const struct cred
*cred
= current_cred();
3564 u32 sid
= cred_sid(cred
);
3566 if (selinux_checkreqprot
)
3569 if (default_noexec
&&
3570 (prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXEC
)) {
3572 if (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
3573 vma
->vm_end
<= vma
->vm_mm
->brk
) {
3574 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3575 PROCESS__EXECHEAP
, NULL
);
3576 } else if (!vma
->vm_file
&&
3577 ((vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
3578 vma
->vm_end
>= vma
->vm_mm
->start_stack
) ||
3579 vma_is_stack_for_current(vma
))) {
3580 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3581 PROCESS__EXECSTACK
, NULL
);
3582 } else if (vma
->vm_file
&& vma
->anon_vma
) {
3584 * We are making executable a file mapping that has
3585 * had some COW done. Since pages might have been
3586 * written, check ability to execute the possibly
3587 * modified content. This typically should only
3588 * occur for text relocations.
3590 rc
= file_has_perm(cred
, vma
->vm_file
, FILE__EXECMOD
);
3596 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
3599 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
3601 const struct cred
*cred
= current_cred();
3603 return file_has_perm(cred
, file
, FILE__LOCK
);
3606 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
3609 const struct cred
*cred
= current_cred();
3614 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
3615 err
= file_has_perm(cred
, file
, FILE__WRITE
);
3624 case F_GETOWNER_UIDS
:
3625 /* Just check FD__USE permission */
3626 err
= file_has_perm(cred
, file
, 0);
3634 #if BITS_PER_LONG == 32
3639 err
= file_has_perm(cred
, file
, FILE__LOCK
);
3646 static void selinux_file_set_fowner(struct file
*file
)
3648 struct file_security_struct
*fsec
;
3650 fsec
= file
->f_security
;
3651 fsec
->fown_sid
= current_sid();
3654 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
3655 struct fown_struct
*fown
, int signum
)
3658 u32 sid
= task_sid(tsk
);
3660 struct file_security_struct
*fsec
;
3662 /* struct fown_struct is never outside the context of a struct file */
3663 file
= container_of(fown
, struct file
, f_owner
);
3665 fsec
= file
->f_security
;
3668 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
3670 perm
= signal_to_av(signum
);
3672 return avc_has_perm(fsec
->fown_sid
, sid
,
3673 SECCLASS_PROCESS
, perm
, NULL
);
3676 static int selinux_file_receive(struct file
*file
)
3678 const struct cred
*cred
= current_cred();
3680 return file_has_perm(cred
, file
, file_to_av(file
));
3683 static int selinux_file_open(struct file
*file
, const struct cred
*cred
)
3685 struct file_security_struct
*fsec
;
3686 struct inode_security_struct
*isec
;
3688 fsec
= file
->f_security
;
3689 isec
= inode_security(file_inode(file
));
3691 * Save inode label and policy sequence number
3692 * at open-time so that selinux_file_permission
3693 * can determine whether revalidation is necessary.
3694 * Task label is already saved in the file security
3695 * struct as its SID.
3697 fsec
->isid
= isec
->sid
;
3698 fsec
->pseqno
= avc_policy_seqno();
3700 * Since the inode label or policy seqno may have changed
3701 * between the selinux_inode_permission check and the saving
3702 * of state above, recheck that access is still permitted.
3703 * Otherwise, access might never be revalidated against the
3704 * new inode label or new policy.
3705 * This check is not redundant - do not remove.
3707 return file_path_has_perm(cred
, file
, open_file_to_av(file
));
3710 /* task security operations */
3712 static int selinux_task_create(unsigned long clone_flags
)
3714 u32 sid
= current_sid();
3716 return avc_has_perm(sid
, sid
, SECCLASS_PROCESS
, PROCESS__FORK
, NULL
);
3720 * allocate the SELinux part of blank credentials
3722 static int selinux_cred_alloc_blank(struct cred
*cred
, gfp_t gfp
)
3724 struct task_security_struct
*tsec
;
3726 tsec
= kzalloc(sizeof(struct task_security_struct
), gfp
);
3730 cred
->security
= tsec
;
3735 * detach and free the LSM part of a set of credentials
3737 static void selinux_cred_free(struct cred
*cred
)
3739 struct task_security_struct
*tsec
= cred
->security
;
3742 * cred->security == NULL if security_cred_alloc_blank() or
3743 * security_prepare_creds() returned an error.
3745 BUG_ON(cred
->security
&& (unsigned long) cred
->security
< PAGE_SIZE
);
3746 cred
->security
= (void *) 0x7UL
;
3751 * prepare a new set of credentials for modification
3753 static int selinux_cred_prepare(struct cred
*new, const struct cred
*old
,
3756 const struct task_security_struct
*old_tsec
;
3757 struct task_security_struct
*tsec
;
3759 old_tsec
= old
->security
;
3761 tsec
= kmemdup(old_tsec
, sizeof(struct task_security_struct
), gfp
);
3765 new->security
= tsec
;
3770 * transfer the SELinux data to a blank set of creds
3772 static void selinux_cred_transfer(struct cred
*new, const struct cred
*old
)
3774 const struct task_security_struct
*old_tsec
= old
->security
;
3775 struct task_security_struct
*tsec
= new->security
;
3781 * set the security data for a kernel service
3782 * - all the creation contexts are set to unlabelled
3784 static int selinux_kernel_act_as(struct cred
*new, u32 secid
)
3786 struct task_security_struct
*tsec
= new->security
;
3787 u32 sid
= current_sid();
3790 ret
= avc_has_perm(sid
, secid
,
3791 SECCLASS_KERNEL_SERVICE
,
3792 KERNEL_SERVICE__USE_AS_OVERRIDE
,
3796 tsec
->create_sid
= 0;
3797 tsec
->keycreate_sid
= 0;
3798 tsec
->sockcreate_sid
= 0;
3804 * set the file creation context in a security record to the same as the
3805 * objective context of the specified inode
3807 static int selinux_kernel_create_files_as(struct cred
*new, struct inode
*inode
)
3809 struct inode_security_struct
*isec
= inode_security(inode
);
3810 struct task_security_struct
*tsec
= new->security
;
3811 u32 sid
= current_sid();
3814 ret
= avc_has_perm(sid
, isec
->sid
,
3815 SECCLASS_KERNEL_SERVICE
,
3816 KERNEL_SERVICE__CREATE_FILES_AS
,
3820 tsec
->create_sid
= isec
->sid
;
3824 static int selinux_kernel_module_request(char *kmod_name
)
3826 struct common_audit_data ad
;
3828 ad
.type
= LSM_AUDIT_DATA_KMOD
;
3829 ad
.u
.kmod_name
= kmod_name
;
3831 return avc_has_perm(current_sid(), SECINITSID_KERNEL
, SECCLASS_SYSTEM
,
3832 SYSTEM__MODULE_REQUEST
, &ad
);
3835 static int selinux_kernel_module_from_file(struct file
*file
)
3837 struct common_audit_data ad
;
3838 struct inode_security_struct
*isec
;
3839 struct file_security_struct
*fsec
;
3840 u32 sid
= current_sid();
3845 return avc_has_perm(sid
, sid
, SECCLASS_SYSTEM
,
3846 SYSTEM__MODULE_LOAD
, NULL
);
3850 ad
.type
= LSM_AUDIT_DATA_FILE
;
3853 fsec
= file
->f_security
;
3854 if (sid
!= fsec
->sid
) {
3855 rc
= avc_has_perm(sid
, fsec
->sid
, SECCLASS_FD
, FD__USE
, &ad
);
3860 isec
= inode_security(file_inode(file
));
3861 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SYSTEM
,
3862 SYSTEM__MODULE_LOAD
, &ad
);
3865 static int selinux_kernel_read_file(struct file
*file
,
3866 enum kernel_read_file_id id
)
3871 case READING_MODULE
:
3872 rc
= selinux_kernel_module_from_file(file
);
3881 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
3883 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3884 PROCESS__SETPGID
, NULL
);
3887 static int selinux_task_getpgid(struct task_struct
*p
)
3889 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3890 PROCESS__GETPGID
, NULL
);
3893 static int selinux_task_getsid(struct task_struct
*p
)
3895 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3896 PROCESS__GETSESSION
, NULL
);
3899 static void selinux_task_getsecid(struct task_struct
*p
, u32
*secid
)
3901 *secid
= task_sid(p
);
3904 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
3906 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3907 PROCESS__SETSCHED
, NULL
);
3910 static int selinux_task_setioprio(struct task_struct
*p
, int ioprio
)
3912 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3913 PROCESS__SETSCHED
, NULL
);
3916 static int selinux_task_getioprio(struct task_struct
*p
)
3918 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3919 PROCESS__GETSCHED
, NULL
);
3922 static int selinux_task_setrlimit(struct task_struct
*p
, unsigned int resource
,
3923 struct rlimit
*new_rlim
)
3925 struct rlimit
*old_rlim
= p
->signal
->rlim
+ resource
;
3927 /* Control the ability to change the hard limit (whether
3928 lowering or raising it), so that the hard limit can
3929 later be used as a safe reset point for the soft limit
3930 upon context transitions. See selinux_bprm_committing_creds. */
3931 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
3932 return avc_has_perm(current_sid(), task_sid(p
),
3933 SECCLASS_PROCESS
, PROCESS__SETRLIMIT
, NULL
);
3938 static int selinux_task_setscheduler(struct task_struct
*p
)
3940 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3941 PROCESS__SETSCHED
, NULL
);
3944 static int selinux_task_getscheduler(struct task_struct
*p
)
3946 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3947 PROCESS__GETSCHED
, NULL
);
3950 static int selinux_task_movememory(struct task_struct
*p
)
3952 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3953 PROCESS__SETSCHED
, NULL
);
3956 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
,
3962 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
3964 perm
= signal_to_av(sig
);
3966 secid
= current_sid();
3967 return avc_has_perm(secid
, task_sid(p
), SECCLASS_PROCESS
, perm
, NULL
);
3970 static void selinux_task_to_inode(struct task_struct
*p
,
3971 struct inode
*inode
)
3973 struct inode_security_struct
*isec
= inode
->i_security
;
3974 u32 sid
= task_sid(p
);
3976 spin_lock(&isec
->lock
);
3977 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3979 isec
->initialized
= LABEL_INITIALIZED
;
3980 spin_unlock(&isec
->lock
);
3983 /* Returns error only if unable to parse addresses */
3984 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
,
3985 struct common_audit_data
*ad
, u8
*proto
)
3987 int offset
, ihlen
, ret
= -EINVAL
;
3988 struct iphdr _iph
, *ih
;
3990 offset
= skb_network_offset(skb
);
3991 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
3995 ihlen
= ih
->ihl
* 4;
3996 if (ihlen
< sizeof(_iph
))
3999 ad
->u
.net
->v4info
.saddr
= ih
->saddr
;
4000 ad
->u
.net
->v4info
.daddr
= ih
->daddr
;
4004 *proto
= ih
->protocol
;
4006 switch (ih
->protocol
) {
4008 struct tcphdr _tcph
, *th
;
4010 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4014 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
4018 ad
->u
.net
->sport
= th
->source
;
4019 ad
->u
.net
->dport
= th
->dest
;
4024 struct udphdr _udph
, *uh
;
4026 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4030 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
4034 ad
->u
.net
->sport
= uh
->source
;
4035 ad
->u
.net
->dport
= uh
->dest
;
4039 case IPPROTO_DCCP
: {
4040 struct dccp_hdr _dccph
, *dh
;
4042 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4046 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
4050 ad
->u
.net
->sport
= dh
->dccph_sport
;
4051 ad
->u
.net
->dport
= dh
->dccph_dport
;
4062 #if IS_ENABLED(CONFIG_IPV6)
4064 /* Returns error only if unable to parse addresses */
4065 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
,
4066 struct common_audit_data
*ad
, u8
*proto
)
4069 int ret
= -EINVAL
, offset
;
4070 struct ipv6hdr _ipv6h
, *ip6
;
4073 offset
= skb_network_offset(skb
);
4074 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
4078 ad
->u
.net
->v6info
.saddr
= ip6
->saddr
;
4079 ad
->u
.net
->v6info
.daddr
= ip6
->daddr
;
4082 nexthdr
= ip6
->nexthdr
;
4083 offset
+= sizeof(_ipv6h
);
4084 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
, &frag_off
);
4093 struct tcphdr _tcph
, *th
;
4095 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
4099 ad
->u
.net
->sport
= th
->source
;
4100 ad
->u
.net
->dport
= th
->dest
;
4105 struct udphdr _udph
, *uh
;
4107 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
4111 ad
->u
.net
->sport
= uh
->source
;
4112 ad
->u
.net
->dport
= uh
->dest
;
4116 case IPPROTO_DCCP
: {
4117 struct dccp_hdr _dccph
, *dh
;
4119 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
4123 ad
->u
.net
->sport
= dh
->dccph_sport
;
4124 ad
->u
.net
->dport
= dh
->dccph_dport
;
4128 /* includes fragments */
4138 static int selinux_parse_skb(struct sk_buff
*skb
, struct common_audit_data
*ad
,
4139 char **_addrp
, int src
, u8
*proto
)
4144 switch (ad
->u
.net
->family
) {
4146 ret
= selinux_parse_skb_ipv4(skb
, ad
, proto
);
4149 addrp
= (char *)(src
? &ad
->u
.net
->v4info
.saddr
:
4150 &ad
->u
.net
->v4info
.daddr
);
4153 #if IS_ENABLED(CONFIG_IPV6)
4155 ret
= selinux_parse_skb_ipv6(skb
, ad
, proto
);
4158 addrp
= (char *)(src
? &ad
->u
.net
->v6info
.saddr
:
4159 &ad
->u
.net
->v6info
.daddr
);
4169 "SELinux: failure in selinux_parse_skb(),"
4170 " unable to parse packet\n");
4180 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4182 * @family: protocol family
4183 * @sid: the packet's peer label SID
4186 * Check the various different forms of network peer labeling and determine
4187 * the peer label/SID for the packet; most of the magic actually occurs in
4188 * the security server function security_net_peersid_cmp(). The function
4189 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4190 * or -EACCES if @sid is invalid due to inconsistencies with the different
4194 static int selinux_skb_peerlbl_sid(struct sk_buff
*skb
, u16 family
, u32
*sid
)
4201 err
= selinux_xfrm_skb_sid(skb
, &xfrm_sid
);
4204 err
= selinux_netlbl_skbuff_getsid(skb
, family
, &nlbl_type
, &nlbl_sid
);
4208 err
= security_net_peersid_resolve(nlbl_sid
, nlbl_type
, xfrm_sid
, sid
);
4209 if (unlikely(err
)) {
4211 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4212 " unable to determine packet's peer label\n");
4220 * selinux_conn_sid - Determine the child socket label for a connection
4221 * @sk_sid: the parent socket's SID
4222 * @skb_sid: the packet's SID
4223 * @conn_sid: the resulting connection SID
4225 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4226 * combined with the MLS information from @skb_sid in order to create
4227 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4228 * of @sk_sid. Returns zero on success, negative values on failure.
4231 static int selinux_conn_sid(u32 sk_sid
, u32 skb_sid
, u32
*conn_sid
)
4235 if (skb_sid
!= SECSID_NULL
)
4236 err
= security_sid_mls_copy(sk_sid
, skb_sid
, conn_sid
);
4243 /* socket security operations */
4245 static int socket_sockcreate_sid(const struct task_security_struct
*tsec
,
4246 u16 secclass
, u32
*socksid
)
4248 if (tsec
->sockcreate_sid
> SECSID_NULL
) {
4249 *socksid
= tsec
->sockcreate_sid
;
4253 return security_transition_sid(tsec
->sid
, tsec
->sid
, secclass
, NULL
,
4257 static int sock_has_perm(struct sock
*sk
, u32 perms
)
4259 struct sk_security_struct
*sksec
= sk
->sk_security
;
4260 struct common_audit_data ad
;
4261 struct lsm_network_audit net
= {0,};
4263 if (sksec
->sid
== SECINITSID_KERNEL
)
4266 ad
.type
= LSM_AUDIT_DATA_NET
;
4270 return avc_has_perm(current_sid(), sksec
->sid
, sksec
->sclass
, perms
,
4274 static int selinux_socket_create(int family
, int type
,
4275 int protocol
, int kern
)
4277 const struct task_security_struct
*tsec
= current_security();
4285 secclass
= socket_type_to_security_class(family
, type
, protocol
);
4286 rc
= socket_sockcreate_sid(tsec
, secclass
, &newsid
);
4290 return avc_has_perm(tsec
->sid
, newsid
, secclass
, SOCKET__CREATE
, NULL
);
4293 static int selinux_socket_post_create(struct socket
*sock
, int family
,
4294 int type
, int protocol
, int kern
)
4296 const struct task_security_struct
*tsec
= current_security();
4297 struct inode_security_struct
*isec
= inode_security_novalidate(SOCK_INODE(sock
));
4298 struct sk_security_struct
*sksec
;
4299 u16 sclass
= socket_type_to_security_class(family
, type
, protocol
);
4300 u32 sid
= SECINITSID_KERNEL
;
4304 err
= socket_sockcreate_sid(tsec
, sclass
, &sid
);
4309 isec
->sclass
= sclass
;
4311 isec
->initialized
= LABEL_INITIALIZED
;
4314 sksec
= sock
->sk
->sk_security
;
4315 sksec
->sclass
= sclass
;
4317 err
= selinux_netlbl_socket_post_create(sock
->sk
, family
);
4323 /* Range of port numbers used to automatically bind.
4324 Need to determine whether we should perform a name_bind
4325 permission check between the socket and the port number. */
4327 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
4329 struct sock
*sk
= sock
->sk
;
4333 err
= sock_has_perm(sk
, SOCKET__BIND
);
4338 * If PF_INET or PF_INET6, check name_bind permission for the port.
4339 * Multiple address binding for SCTP is not supported yet: we just
4340 * check the first address now.
4342 family
= sk
->sk_family
;
4343 if (family
== PF_INET
|| family
== PF_INET6
) {
4345 struct sk_security_struct
*sksec
= sk
->sk_security
;
4346 struct common_audit_data ad
;
4347 struct lsm_network_audit net
= {0,};
4348 struct sockaddr_in
*addr4
= NULL
;
4349 struct sockaddr_in6
*addr6
= NULL
;
4350 unsigned short snum
;
4353 if (family
== PF_INET
) {
4354 addr4
= (struct sockaddr_in
*)address
;
4355 snum
= ntohs(addr4
->sin_port
);
4356 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
4358 addr6
= (struct sockaddr_in6
*)address
;
4359 snum
= ntohs(addr6
->sin6_port
);
4360 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
4366 inet_get_local_port_range(sock_net(sk
), &low
, &high
);
4368 if (snum
< max(inet_prot_sock(sock_net(sk
)), low
) ||
4370 err
= sel_netport_sid(sk
->sk_protocol
,
4374 ad
.type
= LSM_AUDIT_DATA_NET
;
4376 ad
.u
.net
->sport
= htons(snum
);
4377 ad
.u
.net
->family
= family
;
4378 err
= avc_has_perm(sksec
->sid
, sid
,
4380 SOCKET__NAME_BIND
, &ad
);
4386 switch (sksec
->sclass
) {
4387 case SECCLASS_TCP_SOCKET
:
4388 node_perm
= TCP_SOCKET__NODE_BIND
;
4391 case SECCLASS_UDP_SOCKET
:
4392 node_perm
= UDP_SOCKET__NODE_BIND
;
4395 case SECCLASS_DCCP_SOCKET
:
4396 node_perm
= DCCP_SOCKET__NODE_BIND
;
4400 node_perm
= RAWIP_SOCKET__NODE_BIND
;
4404 err
= sel_netnode_sid(addrp
, family
, &sid
);
4408 ad
.type
= LSM_AUDIT_DATA_NET
;
4410 ad
.u
.net
->sport
= htons(snum
);
4411 ad
.u
.net
->family
= family
;
4413 if (family
== PF_INET
)
4414 ad
.u
.net
->v4info
.saddr
= addr4
->sin_addr
.s_addr
;
4416 ad
.u
.net
->v6info
.saddr
= addr6
->sin6_addr
;
4418 err
= avc_has_perm(sksec
->sid
, sid
,
4419 sksec
->sclass
, node_perm
, &ad
);
4427 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
4429 struct sock
*sk
= sock
->sk
;
4430 struct sk_security_struct
*sksec
= sk
->sk_security
;
4433 err
= sock_has_perm(sk
, SOCKET__CONNECT
);
4438 * If a TCP or DCCP socket, check name_connect permission for the port.
4440 if (sksec
->sclass
== SECCLASS_TCP_SOCKET
||
4441 sksec
->sclass
== SECCLASS_DCCP_SOCKET
) {
4442 struct common_audit_data ad
;
4443 struct lsm_network_audit net
= {0,};
4444 struct sockaddr_in
*addr4
= NULL
;
4445 struct sockaddr_in6
*addr6
= NULL
;
4446 unsigned short snum
;
4449 if (sk
->sk_family
== PF_INET
) {
4450 addr4
= (struct sockaddr_in
*)address
;
4451 if (addrlen
< sizeof(struct sockaddr_in
))
4453 snum
= ntohs(addr4
->sin_port
);
4455 addr6
= (struct sockaddr_in6
*)address
;
4456 if (addrlen
< SIN6_LEN_RFC2133
)
4458 snum
= ntohs(addr6
->sin6_port
);
4461 err
= sel_netport_sid(sk
->sk_protocol
, snum
, &sid
);
4465 perm
= (sksec
->sclass
== SECCLASS_TCP_SOCKET
) ?
4466 TCP_SOCKET__NAME_CONNECT
: DCCP_SOCKET__NAME_CONNECT
;
4468 ad
.type
= LSM_AUDIT_DATA_NET
;
4470 ad
.u
.net
->dport
= htons(snum
);
4471 ad
.u
.net
->family
= sk
->sk_family
;
4472 err
= avc_has_perm(sksec
->sid
, sid
, sksec
->sclass
, perm
, &ad
);
4477 err
= selinux_netlbl_socket_connect(sk
, address
);
4483 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
4485 return sock_has_perm(sock
->sk
, SOCKET__LISTEN
);
4488 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
4491 struct inode_security_struct
*isec
;
4492 struct inode_security_struct
*newisec
;
4496 err
= sock_has_perm(sock
->sk
, SOCKET__ACCEPT
);
4500 isec
= inode_security_novalidate(SOCK_INODE(sock
));
4501 spin_lock(&isec
->lock
);
4502 sclass
= isec
->sclass
;
4504 spin_unlock(&isec
->lock
);
4506 newisec
= inode_security_novalidate(SOCK_INODE(newsock
));
4507 newisec
->sclass
= sclass
;
4509 newisec
->initialized
= LABEL_INITIALIZED
;
4514 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
4517 return sock_has_perm(sock
->sk
, SOCKET__WRITE
);
4520 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
4521 int size
, int flags
)
4523 return sock_has_perm(sock
->sk
, SOCKET__READ
);
4526 static int selinux_socket_getsockname(struct socket
*sock
)
4528 return sock_has_perm(sock
->sk
, SOCKET__GETATTR
);
4531 static int selinux_socket_getpeername(struct socket
*sock
)
4533 return sock_has_perm(sock
->sk
, SOCKET__GETATTR
);
4536 static int selinux_socket_setsockopt(struct socket
*sock
, int level
, int optname
)
4540 err
= sock_has_perm(sock
->sk
, SOCKET__SETOPT
);
4544 return selinux_netlbl_socket_setsockopt(sock
, level
, optname
);
4547 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
4550 return sock_has_perm(sock
->sk
, SOCKET__GETOPT
);
4553 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
4555 return sock_has_perm(sock
->sk
, SOCKET__SHUTDOWN
);
4558 static int selinux_socket_unix_stream_connect(struct sock
*sock
,
4562 struct sk_security_struct
*sksec_sock
= sock
->sk_security
;
4563 struct sk_security_struct
*sksec_other
= other
->sk_security
;
4564 struct sk_security_struct
*sksec_new
= newsk
->sk_security
;
4565 struct common_audit_data ad
;
4566 struct lsm_network_audit net
= {0,};
4569 ad
.type
= LSM_AUDIT_DATA_NET
;
4571 ad
.u
.net
->sk
= other
;
4573 err
= avc_has_perm(sksec_sock
->sid
, sksec_other
->sid
,
4574 sksec_other
->sclass
,
4575 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
4579 /* server child socket */
4580 sksec_new
->peer_sid
= sksec_sock
->sid
;
4581 err
= security_sid_mls_copy(sksec_other
->sid
, sksec_sock
->sid
,
4586 /* connecting socket */
4587 sksec_sock
->peer_sid
= sksec_new
->sid
;
4592 static int selinux_socket_unix_may_send(struct socket
*sock
,
4593 struct socket
*other
)
4595 struct sk_security_struct
*ssec
= sock
->sk
->sk_security
;
4596 struct sk_security_struct
*osec
= other
->sk
->sk_security
;
4597 struct common_audit_data ad
;
4598 struct lsm_network_audit net
= {0,};
4600 ad
.type
= LSM_AUDIT_DATA_NET
;
4602 ad
.u
.net
->sk
= other
->sk
;
4604 return avc_has_perm(ssec
->sid
, osec
->sid
, osec
->sclass
, SOCKET__SENDTO
,
4608 static int selinux_inet_sys_rcv_skb(struct net
*ns
, int ifindex
,
4609 char *addrp
, u16 family
, u32 peer_sid
,
4610 struct common_audit_data
*ad
)
4616 err
= sel_netif_sid(ns
, ifindex
, &if_sid
);
4619 err
= avc_has_perm(peer_sid
, if_sid
,
4620 SECCLASS_NETIF
, NETIF__INGRESS
, ad
);
4624 err
= sel_netnode_sid(addrp
, family
, &node_sid
);
4627 return avc_has_perm(peer_sid
, node_sid
,
4628 SECCLASS_NODE
, NODE__RECVFROM
, ad
);
4631 static int selinux_sock_rcv_skb_compat(struct sock
*sk
, struct sk_buff
*skb
,
4635 struct sk_security_struct
*sksec
= sk
->sk_security
;
4636 u32 sk_sid
= sksec
->sid
;
4637 struct common_audit_data ad
;
4638 struct lsm_network_audit net
= {0,};
4641 ad
.type
= LSM_AUDIT_DATA_NET
;
4643 ad
.u
.net
->netif
= skb
->skb_iif
;
4644 ad
.u
.net
->family
= family
;
4645 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4649 if (selinux_secmark_enabled()) {
4650 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4656 err
= selinux_netlbl_sock_rcv_skb(sksec
, skb
, family
, &ad
);
4659 err
= selinux_xfrm_sock_rcv_skb(sksec
->sid
, skb
, &ad
);
4664 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
4667 struct sk_security_struct
*sksec
= sk
->sk_security
;
4668 u16 family
= sk
->sk_family
;
4669 u32 sk_sid
= sksec
->sid
;
4670 struct common_audit_data ad
;
4671 struct lsm_network_audit net
= {0,};
4676 if (family
!= PF_INET
&& family
!= PF_INET6
)
4679 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4680 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4683 /* If any sort of compatibility mode is enabled then handoff processing
4684 * to the selinux_sock_rcv_skb_compat() function to deal with the
4685 * special handling. We do this in an attempt to keep this function
4686 * as fast and as clean as possible. */
4687 if (!selinux_policycap_netpeer
)
4688 return selinux_sock_rcv_skb_compat(sk
, skb
, family
);
4690 secmark_active
= selinux_secmark_enabled();
4691 peerlbl_active
= selinux_peerlbl_enabled();
4692 if (!secmark_active
&& !peerlbl_active
)
4695 ad
.type
= LSM_AUDIT_DATA_NET
;
4697 ad
.u
.net
->netif
= skb
->skb_iif
;
4698 ad
.u
.net
->family
= family
;
4699 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4703 if (peerlbl_active
) {
4706 err
= selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
);
4709 err
= selinux_inet_sys_rcv_skb(sock_net(sk
), skb
->skb_iif
,
4710 addrp
, family
, peer_sid
, &ad
);
4712 selinux_netlbl_err(skb
, family
, err
, 0);
4715 err
= avc_has_perm(sk_sid
, peer_sid
, SECCLASS_PEER
,
4718 selinux_netlbl_err(skb
, family
, err
, 0);
4723 if (secmark_active
) {
4724 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4733 static int selinux_socket_getpeersec_stream(struct socket
*sock
, char __user
*optval
,
4734 int __user
*optlen
, unsigned len
)
4739 struct sk_security_struct
*sksec
= sock
->sk
->sk_security
;
4740 u32 peer_sid
= SECSID_NULL
;
4742 if (sksec
->sclass
== SECCLASS_UNIX_STREAM_SOCKET
||
4743 sksec
->sclass
== SECCLASS_TCP_SOCKET
)
4744 peer_sid
= sksec
->peer_sid
;
4745 if (peer_sid
== SECSID_NULL
)
4746 return -ENOPROTOOPT
;
4748 err
= security_sid_to_context(peer_sid
, &scontext
, &scontext_len
);
4752 if (scontext_len
> len
) {
4757 if (copy_to_user(optval
, scontext
, scontext_len
))
4761 if (put_user(scontext_len
, optlen
))
4767 static int selinux_socket_getpeersec_dgram(struct socket
*sock
, struct sk_buff
*skb
, u32
*secid
)
4769 u32 peer_secid
= SECSID_NULL
;
4771 struct inode_security_struct
*isec
;
4773 if (skb
&& skb
->protocol
== htons(ETH_P_IP
))
4775 else if (skb
&& skb
->protocol
== htons(ETH_P_IPV6
))
4778 family
= sock
->sk
->sk_family
;
4782 if (sock
&& family
== PF_UNIX
) {
4783 isec
= inode_security_novalidate(SOCK_INODE(sock
));
4784 peer_secid
= isec
->sid
;
4786 selinux_skb_peerlbl_sid(skb
, family
, &peer_secid
);
4789 *secid
= peer_secid
;
4790 if (peer_secid
== SECSID_NULL
)
4795 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
4797 struct sk_security_struct
*sksec
;
4799 sksec
= kzalloc(sizeof(*sksec
), priority
);
4803 sksec
->peer_sid
= SECINITSID_UNLABELED
;
4804 sksec
->sid
= SECINITSID_UNLABELED
;
4805 sksec
->sclass
= SECCLASS_SOCKET
;
4806 selinux_netlbl_sk_security_reset(sksec
);
4807 sk
->sk_security
= sksec
;
4812 static void selinux_sk_free_security(struct sock
*sk
)
4814 struct sk_security_struct
*sksec
= sk
->sk_security
;
4816 sk
->sk_security
= NULL
;
4817 selinux_netlbl_sk_security_free(sksec
);
4821 static void selinux_sk_clone_security(const struct sock
*sk
, struct sock
*newsk
)
4823 struct sk_security_struct
*sksec
= sk
->sk_security
;
4824 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4826 newsksec
->sid
= sksec
->sid
;
4827 newsksec
->peer_sid
= sksec
->peer_sid
;
4828 newsksec
->sclass
= sksec
->sclass
;
4830 selinux_netlbl_sk_security_reset(newsksec
);
4833 static void selinux_sk_getsecid(struct sock
*sk
, u32
*secid
)
4836 *secid
= SECINITSID_ANY_SOCKET
;
4838 struct sk_security_struct
*sksec
= sk
->sk_security
;
4840 *secid
= sksec
->sid
;
4844 static void selinux_sock_graft(struct sock
*sk
, struct socket
*parent
)
4846 struct inode_security_struct
*isec
=
4847 inode_security_novalidate(SOCK_INODE(parent
));
4848 struct sk_security_struct
*sksec
= sk
->sk_security
;
4850 if (sk
->sk_family
== PF_INET
|| sk
->sk_family
== PF_INET6
||
4851 sk
->sk_family
== PF_UNIX
)
4852 isec
->sid
= sksec
->sid
;
4853 sksec
->sclass
= isec
->sclass
;
4856 static int selinux_inet_conn_request(struct sock
*sk
, struct sk_buff
*skb
,
4857 struct request_sock
*req
)
4859 struct sk_security_struct
*sksec
= sk
->sk_security
;
4861 u16 family
= req
->rsk_ops
->family
;
4865 err
= selinux_skb_peerlbl_sid(skb
, family
, &peersid
);
4868 err
= selinux_conn_sid(sksec
->sid
, peersid
, &connsid
);
4871 req
->secid
= connsid
;
4872 req
->peer_secid
= peersid
;
4874 return selinux_netlbl_inet_conn_request(req
, family
);
4877 static void selinux_inet_csk_clone(struct sock
*newsk
,
4878 const struct request_sock
*req
)
4880 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4882 newsksec
->sid
= req
->secid
;
4883 newsksec
->peer_sid
= req
->peer_secid
;
4884 /* NOTE: Ideally, we should also get the isec->sid for the
4885 new socket in sync, but we don't have the isec available yet.
4886 So we will wait until sock_graft to do it, by which
4887 time it will have been created and available. */
4889 /* We don't need to take any sort of lock here as we are the only
4890 * thread with access to newsksec */
4891 selinux_netlbl_inet_csk_clone(newsk
, req
->rsk_ops
->family
);
4894 static void selinux_inet_conn_established(struct sock
*sk
, struct sk_buff
*skb
)
4896 u16 family
= sk
->sk_family
;
4897 struct sk_security_struct
*sksec
= sk
->sk_security
;
4899 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4900 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4903 selinux_skb_peerlbl_sid(skb
, family
, &sksec
->peer_sid
);
4906 static int selinux_secmark_relabel_packet(u32 sid
)
4908 const struct task_security_struct
*__tsec
;
4911 __tsec
= current_security();
4914 return avc_has_perm(tsid
, sid
, SECCLASS_PACKET
, PACKET__RELABELTO
, NULL
);
4917 static void selinux_secmark_refcount_inc(void)
4919 atomic_inc(&selinux_secmark_refcount
);
4922 static void selinux_secmark_refcount_dec(void)
4924 atomic_dec(&selinux_secmark_refcount
);
4927 static void selinux_req_classify_flow(const struct request_sock
*req
,
4930 fl
->flowi_secid
= req
->secid
;
4933 static int selinux_tun_dev_alloc_security(void **security
)
4935 struct tun_security_struct
*tunsec
;
4937 tunsec
= kzalloc(sizeof(*tunsec
), GFP_KERNEL
);
4940 tunsec
->sid
= current_sid();
4946 static void selinux_tun_dev_free_security(void *security
)
4951 static int selinux_tun_dev_create(void)
4953 u32 sid
= current_sid();
4955 /* we aren't taking into account the "sockcreate" SID since the socket
4956 * that is being created here is not a socket in the traditional sense,
4957 * instead it is a private sock, accessible only to the kernel, and
4958 * representing a wide range of network traffic spanning multiple
4959 * connections unlike traditional sockets - check the TUN driver to
4960 * get a better understanding of why this socket is special */
4962 return avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
, TUN_SOCKET__CREATE
,
4966 static int selinux_tun_dev_attach_queue(void *security
)
4968 struct tun_security_struct
*tunsec
= security
;
4970 return avc_has_perm(current_sid(), tunsec
->sid
, SECCLASS_TUN_SOCKET
,
4971 TUN_SOCKET__ATTACH_QUEUE
, NULL
);
4974 static int selinux_tun_dev_attach(struct sock
*sk
, void *security
)
4976 struct tun_security_struct
*tunsec
= security
;
4977 struct sk_security_struct
*sksec
= sk
->sk_security
;
4979 /* we don't currently perform any NetLabel based labeling here and it
4980 * isn't clear that we would want to do so anyway; while we could apply
4981 * labeling without the support of the TUN user the resulting labeled
4982 * traffic from the other end of the connection would almost certainly
4983 * cause confusion to the TUN user that had no idea network labeling
4984 * protocols were being used */
4986 sksec
->sid
= tunsec
->sid
;
4987 sksec
->sclass
= SECCLASS_TUN_SOCKET
;
4992 static int selinux_tun_dev_open(void *security
)
4994 struct tun_security_struct
*tunsec
= security
;
4995 u32 sid
= current_sid();
4998 err
= avc_has_perm(sid
, tunsec
->sid
, SECCLASS_TUN_SOCKET
,
4999 TUN_SOCKET__RELABELFROM
, NULL
);
5002 err
= avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
,
5003 TUN_SOCKET__RELABELTO
, NULL
);
5011 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
5015 struct nlmsghdr
*nlh
;
5016 struct sk_security_struct
*sksec
= sk
->sk_security
;
5018 if (skb
->len
< NLMSG_HDRLEN
) {
5022 nlh
= nlmsg_hdr(skb
);
5024 err
= selinux_nlmsg_lookup(sksec
->sclass
, nlh
->nlmsg_type
, &perm
);
5026 if (err
== -EINVAL
) {
5027 pr_warn_ratelimited("SELinux: unrecognized netlink"
5028 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5029 " pig=%d comm=%s\n",
5030 sk
->sk_protocol
, nlh
->nlmsg_type
,
5031 secclass_map
[sksec
->sclass
- 1].name
,
5032 task_pid_nr(current
), current
->comm
);
5033 if (!selinux_enforcing
|| security_get_allow_unknown())
5043 err
= sock_has_perm(sk
, perm
);
5048 #ifdef CONFIG_NETFILTER
5050 static unsigned int selinux_ip_forward(struct sk_buff
*skb
,
5051 const struct net_device
*indev
,
5057 struct common_audit_data ad
;
5058 struct lsm_network_audit net
= {0,};
5063 if (!selinux_policycap_netpeer
)
5066 secmark_active
= selinux_secmark_enabled();
5067 netlbl_active
= netlbl_enabled();
5068 peerlbl_active
= selinux_peerlbl_enabled();
5069 if (!secmark_active
&& !peerlbl_active
)
5072 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
) != 0)
5075 ad
.type
= LSM_AUDIT_DATA_NET
;
5077 ad
.u
.net
->netif
= indev
->ifindex
;
5078 ad
.u
.net
->family
= family
;
5079 if (selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
) != 0)
5082 if (peerlbl_active
) {
5083 err
= selinux_inet_sys_rcv_skb(dev_net(indev
), indev
->ifindex
,
5084 addrp
, family
, peer_sid
, &ad
);
5086 selinux_netlbl_err(skb
, family
, err
, 1);
5092 if (avc_has_perm(peer_sid
, skb
->secmark
,
5093 SECCLASS_PACKET
, PACKET__FORWARD_IN
, &ad
))
5097 /* we do this in the FORWARD path and not the POST_ROUTING
5098 * path because we want to make sure we apply the necessary
5099 * labeling before IPsec is applied so we can leverage AH
5101 if (selinux_netlbl_skbuff_setsid(skb
, family
, peer_sid
) != 0)
5107 static unsigned int selinux_ipv4_forward(void *priv
,
5108 struct sk_buff
*skb
,
5109 const struct nf_hook_state
*state
)
5111 return selinux_ip_forward(skb
, state
->in
, PF_INET
);
5114 #if IS_ENABLED(CONFIG_IPV6)
5115 static unsigned int selinux_ipv6_forward(void *priv
,
5116 struct sk_buff
*skb
,
5117 const struct nf_hook_state
*state
)
5119 return selinux_ip_forward(skb
, state
->in
, PF_INET6
);
5123 static unsigned int selinux_ip_output(struct sk_buff
*skb
,
5129 if (!netlbl_enabled())
5132 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5133 * because we want to make sure we apply the necessary labeling
5134 * before IPsec is applied so we can leverage AH protection */
5137 struct sk_security_struct
*sksec
;
5139 if (sk_listener(sk
))
5140 /* if the socket is the listening state then this
5141 * packet is a SYN-ACK packet which means it needs to
5142 * be labeled based on the connection/request_sock and
5143 * not the parent socket. unfortunately, we can't
5144 * lookup the request_sock yet as it isn't queued on
5145 * the parent socket until after the SYN-ACK is sent.
5146 * the "solution" is to simply pass the packet as-is
5147 * as any IP option based labeling should be copied
5148 * from the initial connection request (in the IP
5149 * layer). it is far from ideal, but until we get a
5150 * security label in the packet itself this is the
5151 * best we can do. */
5154 /* standard practice, label using the parent socket */
5155 sksec
= sk
->sk_security
;
5158 sid
= SECINITSID_KERNEL
;
5159 if (selinux_netlbl_skbuff_setsid(skb
, family
, sid
) != 0)
5165 static unsigned int selinux_ipv4_output(void *priv
,
5166 struct sk_buff
*skb
,
5167 const struct nf_hook_state
*state
)
5169 return selinux_ip_output(skb
, PF_INET
);
5172 #if IS_ENABLED(CONFIG_IPV6)
5173 static unsigned int selinux_ipv6_output(void *priv
,
5174 struct sk_buff
*skb
,
5175 const struct nf_hook_state
*state
)
5177 return selinux_ip_output(skb
, PF_INET6
);
5181 static unsigned int selinux_ip_postroute_compat(struct sk_buff
*skb
,
5185 struct sock
*sk
= skb_to_full_sk(skb
);
5186 struct sk_security_struct
*sksec
;
5187 struct common_audit_data ad
;
5188 struct lsm_network_audit net
= {0,};
5194 sksec
= sk
->sk_security
;
5196 ad
.type
= LSM_AUDIT_DATA_NET
;
5198 ad
.u
.net
->netif
= ifindex
;
5199 ad
.u
.net
->family
= family
;
5200 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, &proto
))
5203 if (selinux_secmark_enabled())
5204 if (avc_has_perm(sksec
->sid
, skb
->secmark
,
5205 SECCLASS_PACKET
, PACKET__SEND
, &ad
))
5206 return NF_DROP_ERR(-ECONNREFUSED
);
5208 if (selinux_xfrm_postroute_last(sksec
->sid
, skb
, &ad
, proto
))
5209 return NF_DROP_ERR(-ECONNREFUSED
);
5214 static unsigned int selinux_ip_postroute(struct sk_buff
*skb
,
5215 const struct net_device
*outdev
,
5220 int ifindex
= outdev
->ifindex
;
5222 struct common_audit_data ad
;
5223 struct lsm_network_audit net
= {0,};
5228 /* If any sort of compatibility mode is enabled then handoff processing
5229 * to the selinux_ip_postroute_compat() function to deal with the
5230 * special handling. We do this in an attempt to keep this function
5231 * as fast and as clean as possible. */
5232 if (!selinux_policycap_netpeer
)
5233 return selinux_ip_postroute_compat(skb
, ifindex
, family
);
5235 secmark_active
= selinux_secmark_enabled();
5236 peerlbl_active
= selinux_peerlbl_enabled();
5237 if (!secmark_active
&& !peerlbl_active
)
5240 sk
= skb_to_full_sk(skb
);
5243 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5244 * packet transformation so allow the packet to pass without any checks
5245 * since we'll have another chance to perform access control checks
5246 * when the packet is on it's final way out.
5247 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5248 * is NULL, in this case go ahead and apply access control.
5249 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5250 * TCP listening state we cannot wait until the XFRM processing
5251 * is done as we will miss out on the SA label if we do;
5252 * unfortunately, this means more work, but it is only once per
5254 if (skb_dst(skb
) != NULL
&& skb_dst(skb
)->xfrm
!= NULL
&&
5255 !(sk
&& sk_listener(sk
)))
5260 /* Without an associated socket the packet is either coming
5261 * from the kernel or it is being forwarded; check the packet
5262 * to determine which and if the packet is being forwarded
5263 * query the packet directly to determine the security label. */
5265 secmark_perm
= PACKET__FORWARD_OUT
;
5266 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
))
5269 secmark_perm
= PACKET__SEND
;
5270 peer_sid
= SECINITSID_KERNEL
;
5272 } else if (sk_listener(sk
)) {
5273 /* Locally generated packet but the associated socket is in the
5274 * listening state which means this is a SYN-ACK packet. In
5275 * this particular case the correct security label is assigned
5276 * to the connection/request_sock but unfortunately we can't
5277 * query the request_sock as it isn't queued on the parent
5278 * socket until after the SYN-ACK packet is sent; the only
5279 * viable choice is to regenerate the label like we do in
5280 * selinux_inet_conn_request(). See also selinux_ip_output()
5281 * for similar problems. */
5283 struct sk_security_struct
*sksec
;
5285 sksec
= sk
->sk_security
;
5286 if (selinux_skb_peerlbl_sid(skb
, family
, &skb_sid
))
5288 /* At this point, if the returned skb peerlbl is SECSID_NULL
5289 * and the packet has been through at least one XFRM
5290 * transformation then we must be dealing with the "final"
5291 * form of labeled IPsec packet; since we've already applied
5292 * all of our access controls on this packet we can safely
5293 * pass the packet. */
5294 if (skb_sid
== SECSID_NULL
) {
5297 if (IPCB(skb
)->flags
& IPSKB_XFRM_TRANSFORMED
)
5301 if (IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
)
5305 return NF_DROP_ERR(-ECONNREFUSED
);
5308 if (selinux_conn_sid(sksec
->sid
, skb_sid
, &peer_sid
))
5310 secmark_perm
= PACKET__SEND
;
5312 /* Locally generated packet, fetch the security label from the
5313 * associated socket. */
5314 struct sk_security_struct
*sksec
= sk
->sk_security
;
5315 peer_sid
= sksec
->sid
;
5316 secmark_perm
= PACKET__SEND
;
5319 ad
.type
= LSM_AUDIT_DATA_NET
;
5321 ad
.u
.net
->netif
= ifindex
;
5322 ad
.u
.net
->family
= family
;
5323 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, NULL
))
5327 if (avc_has_perm(peer_sid
, skb
->secmark
,
5328 SECCLASS_PACKET
, secmark_perm
, &ad
))
5329 return NF_DROP_ERR(-ECONNREFUSED
);
5331 if (peerlbl_active
) {
5335 if (sel_netif_sid(dev_net(outdev
), ifindex
, &if_sid
))
5337 if (avc_has_perm(peer_sid
, if_sid
,
5338 SECCLASS_NETIF
, NETIF__EGRESS
, &ad
))
5339 return NF_DROP_ERR(-ECONNREFUSED
);
5341 if (sel_netnode_sid(addrp
, family
, &node_sid
))
5343 if (avc_has_perm(peer_sid
, node_sid
,
5344 SECCLASS_NODE
, NODE__SENDTO
, &ad
))
5345 return NF_DROP_ERR(-ECONNREFUSED
);
5351 static unsigned int selinux_ipv4_postroute(void *priv
,
5352 struct sk_buff
*skb
,
5353 const struct nf_hook_state
*state
)
5355 return selinux_ip_postroute(skb
, state
->out
, PF_INET
);
5358 #if IS_ENABLED(CONFIG_IPV6)
5359 static unsigned int selinux_ipv6_postroute(void *priv
,
5360 struct sk_buff
*skb
,
5361 const struct nf_hook_state
*state
)
5363 return selinux_ip_postroute(skb
, state
->out
, PF_INET6
);
5367 #endif /* CONFIG_NETFILTER */
5369 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
5371 return selinux_nlmsg_perm(sk
, skb
);
5374 static int ipc_alloc_security(struct kern_ipc_perm
*perm
,
5377 struct ipc_security_struct
*isec
;
5379 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
5383 isec
->sclass
= sclass
;
5384 isec
->sid
= current_sid();
5385 perm
->security
= isec
;
5390 static void ipc_free_security(struct kern_ipc_perm
*perm
)
5392 struct ipc_security_struct
*isec
= perm
->security
;
5393 perm
->security
= NULL
;
5397 static int msg_msg_alloc_security(struct msg_msg
*msg
)
5399 struct msg_security_struct
*msec
;
5401 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
5405 msec
->sid
= SECINITSID_UNLABELED
;
5406 msg
->security
= msec
;
5411 static void msg_msg_free_security(struct msg_msg
*msg
)
5413 struct msg_security_struct
*msec
= msg
->security
;
5415 msg
->security
= NULL
;
5419 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
5422 struct ipc_security_struct
*isec
;
5423 struct common_audit_data ad
;
5424 u32 sid
= current_sid();
5426 isec
= ipc_perms
->security
;
5428 ad
.type
= LSM_AUDIT_DATA_IPC
;
5429 ad
.u
.ipc_id
= ipc_perms
->key
;
5431 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
5434 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
5436 return msg_msg_alloc_security(msg
);
5439 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
5441 msg_msg_free_security(msg
);
5444 /* message queue security operations */
5445 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
5447 struct ipc_security_struct
*isec
;
5448 struct common_audit_data ad
;
5449 u32 sid
= current_sid();
5452 rc
= ipc_alloc_security(&msq
->q_perm
, SECCLASS_MSGQ
);
5456 isec
= msq
->q_perm
.security
;
5458 ad
.type
= LSM_AUDIT_DATA_IPC
;
5459 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5461 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5464 ipc_free_security(&msq
->q_perm
);
5470 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
5472 ipc_free_security(&msq
->q_perm
);
5475 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
5477 struct ipc_security_struct
*isec
;
5478 struct common_audit_data ad
;
5479 u32 sid
= current_sid();
5481 isec
= msq
->q_perm
.security
;
5483 ad
.type
= LSM_AUDIT_DATA_IPC
;
5484 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5486 return avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5487 MSGQ__ASSOCIATE
, &ad
);
5490 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
5498 /* No specific object, just general system-wide information. */
5499 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5500 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5503 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
5506 perms
= MSGQ__SETATTR
;
5509 perms
= MSGQ__DESTROY
;
5515 err
= ipc_has_perm(&msq
->q_perm
, perms
);
5519 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
5521 struct ipc_security_struct
*isec
;
5522 struct msg_security_struct
*msec
;
5523 struct common_audit_data ad
;
5524 u32 sid
= current_sid();
5527 isec
= msq
->q_perm
.security
;
5528 msec
= msg
->security
;
5531 * First time through, need to assign label to the message
5533 if (msec
->sid
== SECINITSID_UNLABELED
) {
5535 * Compute new sid based on current process and
5536 * message queue this message will be stored in
5538 rc
= security_transition_sid(sid
, isec
->sid
, SECCLASS_MSG
,
5544 ad
.type
= LSM_AUDIT_DATA_IPC
;
5545 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5547 /* Can this process write to the queue? */
5548 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5551 /* Can this process send the message */
5552 rc
= avc_has_perm(sid
, msec
->sid
, SECCLASS_MSG
,
5555 /* Can the message be put in the queue? */
5556 rc
= avc_has_perm(msec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
5557 MSGQ__ENQUEUE
, &ad
);
5562 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
5563 struct task_struct
*target
,
5564 long type
, int mode
)
5566 struct ipc_security_struct
*isec
;
5567 struct msg_security_struct
*msec
;
5568 struct common_audit_data ad
;
5569 u32 sid
= task_sid(target
);
5572 isec
= msq
->q_perm
.security
;
5573 msec
= msg
->security
;
5575 ad
.type
= LSM_AUDIT_DATA_IPC
;
5576 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5578 rc
= avc_has_perm(sid
, isec
->sid
,
5579 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
5581 rc
= avc_has_perm(sid
, msec
->sid
,
5582 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
5586 /* Shared Memory security operations */
5587 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
5589 struct ipc_security_struct
*isec
;
5590 struct common_audit_data ad
;
5591 u32 sid
= current_sid();
5594 rc
= ipc_alloc_security(&shp
->shm_perm
, SECCLASS_SHM
);
5598 isec
= shp
->shm_perm
.security
;
5600 ad
.type
= LSM_AUDIT_DATA_IPC
;
5601 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
5603 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
5606 ipc_free_security(&shp
->shm_perm
);
5612 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
5614 ipc_free_security(&shp
->shm_perm
);
5617 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
5619 struct ipc_security_struct
*isec
;
5620 struct common_audit_data ad
;
5621 u32 sid
= current_sid();
5623 isec
= shp
->shm_perm
.security
;
5625 ad
.type
= LSM_AUDIT_DATA_IPC
;
5626 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
5628 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
5629 SHM__ASSOCIATE
, &ad
);
5632 /* Note, at this point, shp is locked down */
5633 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
5641 /* No specific object, just general system-wide information. */
5642 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5643 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5646 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
5649 perms
= SHM__SETATTR
;
5656 perms
= SHM__DESTROY
;
5662 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
5666 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
5667 char __user
*shmaddr
, int shmflg
)
5671 if (shmflg
& SHM_RDONLY
)
5674 perms
= SHM__READ
| SHM__WRITE
;
5676 return ipc_has_perm(&shp
->shm_perm
, perms
);
5679 /* Semaphore security operations */
5680 static int selinux_sem_alloc_security(struct sem_array
*sma
)
5682 struct ipc_security_struct
*isec
;
5683 struct common_audit_data ad
;
5684 u32 sid
= current_sid();
5687 rc
= ipc_alloc_security(&sma
->sem_perm
, SECCLASS_SEM
);
5691 isec
= sma
->sem_perm
.security
;
5693 ad
.type
= LSM_AUDIT_DATA_IPC
;
5694 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5696 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5699 ipc_free_security(&sma
->sem_perm
);
5705 static void selinux_sem_free_security(struct sem_array
*sma
)
5707 ipc_free_security(&sma
->sem_perm
);
5710 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
5712 struct ipc_security_struct
*isec
;
5713 struct common_audit_data ad
;
5714 u32 sid
= current_sid();
5716 isec
= sma
->sem_perm
.security
;
5718 ad
.type
= LSM_AUDIT_DATA_IPC
;
5719 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5721 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5722 SEM__ASSOCIATE
, &ad
);
5725 /* Note, at this point, sma is locked down */
5726 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
5734 /* No specific object, just general system-wide information. */
5735 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5736 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5740 perms
= SEM__GETATTR
;
5751 perms
= SEM__DESTROY
;
5754 perms
= SEM__SETATTR
;
5758 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
5764 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
5768 static int selinux_sem_semop(struct sem_array
*sma
,
5769 struct sembuf
*sops
, unsigned nsops
, int alter
)
5774 perms
= SEM__READ
| SEM__WRITE
;
5778 return ipc_has_perm(&sma
->sem_perm
, perms
);
5781 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
5787 av
|= IPC__UNIX_READ
;
5789 av
|= IPC__UNIX_WRITE
;
5794 return ipc_has_perm(ipcp
, av
);
5797 static void selinux_ipc_getsecid(struct kern_ipc_perm
*ipcp
, u32
*secid
)
5799 struct ipc_security_struct
*isec
= ipcp
->security
;
5803 static void selinux_d_instantiate(struct dentry
*dentry
, struct inode
*inode
)
5806 inode_doinit_with_dentry(inode
, dentry
);
5809 static int selinux_getprocattr(struct task_struct
*p
,
5810 char *name
, char **value
)
5812 const struct task_security_struct
*__tsec
;
5818 __tsec
= __task_cred(p
)->security
;
5821 error
= avc_has_perm(current_sid(), __tsec
->sid
,
5822 SECCLASS_PROCESS
, PROCESS__GETATTR
, NULL
);
5827 if (!strcmp(name
, "current"))
5829 else if (!strcmp(name
, "prev"))
5831 else if (!strcmp(name
, "exec"))
5832 sid
= __tsec
->exec_sid
;
5833 else if (!strcmp(name
, "fscreate"))
5834 sid
= __tsec
->create_sid
;
5835 else if (!strcmp(name
, "keycreate"))
5836 sid
= __tsec
->keycreate_sid
;
5837 else if (!strcmp(name
, "sockcreate"))
5838 sid
= __tsec
->sockcreate_sid
;
5848 error
= security_sid_to_context(sid
, value
, &len
);
5858 static int selinux_setprocattr(const char *name
, void *value
, size_t size
)
5860 struct task_security_struct
*tsec
;
5862 u32 mysid
= current_sid(), sid
= 0, ptsid
;
5867 * Basic control over ability to set these attributes at all.
5869 if (!strcmp(name
, "exec"))
5870 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5871 PROCESS__SETEXEC
, NULL
);
5872 else if (!strcmp(name
, "fscreate"))
5873 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5874 PROCESS__SETFSCREATE
, NULL
);
5875 else if (!strcmp(name
, "keycreate"))
5876 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5877 PROCESS__SETKEYCREATE
, NULL
);
5878 else if (!strcmp(name
, "sockcreate"))
5879 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5880 PROCESS__SETSOCKCREATE
, NULL
);
5881 else if (!strcmp(name
, "current"))
5882 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5883 PROCESS__SETCURRENT
, NULL
);
5889 /* Obtain a SID for the context, if one was specified. */
5890 if (size
&& str
[0] && str
[0] != '\n') {
5891 if (str
[size
-1] == '\n') {
5895 error
= security_context_to_sid(value
, size
, &sid
, GFP_KERNEL
);
5896 if (error
== -EINVAL
&& !strcmp(name
, "fscreate")) {
5897 if (!capable(CAP_MAC_ADMIN
)) {
5898 struct audit_buffer
*ab
;
5901 /* We strip a nul only if it is at the end, otherwise the
5902 * context contains a nul and we should audit that */
5903 if (str
[size
- 1] == '\0')
5904 audit_size
= size
- 1;
5907 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
);
5908 audit_log_format(ab
, "op=fscreate invalid_context=");
5909 audit_log_n_untrustedstring(ab
, value
, audit_size
);
5914 error
= security_context_to_sid_force(value
, size
,
5921 new = prepare_creds();
5925 /* Permission checking based on the specified context is
5926 performed during the actual operation (execve,
5927 open/mkdir/...), when we know the full context of the
5928 operation. See selinux_bprm_set_creds for the execve
5929 checks and may_create for the file creation checks. The
5930 operation will then fail if the context is not permitted. */
5931 tsec
= new->security
;
5932 if (!strcmp(name
, "exec")) {
5933 tsec
->exec_sid
= sid
;
5934 } else if (!strcmp(name
, "fscreate")) {
5935 tsec
->create_sid
= sid
;
5936 } else if (!strcmp(name
, "keycreate")) {
5937 error
= avc_has_perm(mysid
, sid
, SECCLASS_KEY
, KEY__CREATE
,
5941 tsec
->keycreate_sid
= sid
;
5942 } else if (!strcmp(name
, "sockcreate")) {
5943 tsec
->sockcreate_sid
= sid
;
5944 } else if (!strcmp(name
, "current")) {
5949 /* Only allow single threaded processes to change context */
5951 if (!current_is_single_threaded()) {
5952 error
= security_bounded_transition(tsec
->sid
, sid
);
5957 /* Check permissions for the transition. */
5958 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
5959 PROCESS__DYNTRANSITION
, NULL
);
5963 /* Check for ptracing, and update the task SID if ok.
5964 Otherwise, leave SID unchanged and fail. */
5965 ptsid
= ptrace_parent_sid();
5967 error
= avc_has_perm(ptsid
, sid
, SECCLASS_PROCESS
,
5968 PROCESS__PTRACE
, NULL
);
5987 static int selinux_ismaclabel(const char *name
)
5989 return (strcmp(name
, XATTR_SELINUX_SUFFIX
) == 0);
5992 static int selinux_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
5994 return security_sid_to_context(secid
, secdata
, seclen
);
5997 static int selinux_secctx_to_secid(const char *secdata
, u32 seclen
, u32
*secid
)
5999 return security_context_to_sid(secdata
, seclen
, secid
, GFP_KERNEL
);
6002 static void selinux_release_secctx(char *secdata
, u32 seclen
)
6007 static void selinux_inode_invalidate_secctx(struct inode
*inode
)
6009 struct inode_security_struct
*isec
= inode
->i_security
;
6011 spin_lock(&isec
->lock
);
6012 isec
->initialized
= LABEL_INVALID
;
6013 spin_unlock(&isec
->lock
);
6017 * called with inode->i_mutex locked
6019 static int selinux_inode_notifysecctx(struct inode
*inode
, void *ctx
, u32 ctxlen
)
6021 return selinux_inode_setsecurity(inode
, XATTR_SELINUX_SUFFIX
, ctx
, ctxlen
, 0);
6025 * called with inode->i_mutex locked
6027 static int selinux_inode_setsecctx(struct dentry
*dentry
, void *ctx
, u32 ctxlen
)
6029 return __vfs_setxattr_noperm(dentry
, XATTR_NAME_SELINUX
, ctx
, ctxlen
, 0);
6032 static int selinux_inode_getsecctx(struct inode
*inode
, void **ctx
, u32
*ctxlen
)
6035 len
= selinux_inode_getsecurity(inode
, XATTR_SELINUX_SUFFIX
,
6044 static int selinux_key_alloc(struct key
*k
, const struct cred
*cred
,
6045 unsigned long flags
)
6047 const struct task_security_struct
*tsec
;
6048 struct key_security_struct
*ksec
;
6050 ksec
= kzalloc(sizeof(struct key_security_struct
), GFP_KERNEL
);
6054 tsec
= cred
->security
;
6055 if (tsec
->keycreate_sid
)
6056 ksec
->sid
= tsec
->keycreate_sid
;
6058 ksec
->sid
= tsec
->sid
;
6064 static void selinux_key_free(struct key
*k
)
6066 struct key_security_struct
*ksec
= k
->security
;
6072 static int selinux_key_permission(key_ref_t key_ref
,
6073 const struct cred
*cred
,
6077 struct key_security_struct
*ksec
;
6080 /* if no specific permissions are requested, we skip the
6081 permission check. No serious, additional covert channels
6082 appear to be created. */
6086 sid
= cred_sid(cred
);
6088 key
= key_ref_to_ptr(key_ref
);
6089 ksec
= key
->security
;
6091 return avc_has_perm(sid
, ksec
->sid
, SECCLASS_KEY
, perm
, NULL
);
6094 static int selinux_key_getsecurity(struct key
*key
, char **_buffer
)
6096 struct key_security_struct
*ksec
= key
->security
;
6097 char *context
= NULL
;
6101 rc
= security_sid_to_context(ksec
->sid
, &context
, &len
);
6110 static struct security_hook_list selinux_hooks
[] = {
6111 LSM_HOOK_INIT(binder_set_context_mgr
, selinux_binder_set_context_mgr
),
6112 LSM_HOOK_INIT(binder_transaction
, selinux_binder_transaction
),
6113 LSM_HOOK_INIT(binder_transfer_binder
, selinux_binder_transfer_binder
),
6114 LSM_HOOK_INIT(binder_transfer_file
, selinux_binder_transfer_file
),
6116 LSM_HOOK_INIT(ptrace_access_check
, selinux_ptrace_access_check
),
6117 LSM_HOOK_INIT(ptrace_traceme
, selinux_ptrace_traceme
),
6118 LSM_HOOK_INIT(capget
, selinux_capget
),
6119 LSM_HOOK_INIT(capset
, selinux_capset
),
6120 LSM_HOOK_INIT(capable
, selinux_capable
),
6121 LSM_HOOK_INIT(quotactl
, selinux_quotactl
),
6122 LSM_HOOK_INIT(quota_on
, selinux_quota_on
),
6123 LSM_HOOK_INIT(syslog
, selinux_syslog
),
6124 LSM_HOOK_INIT(vm_enough_memory
, selinux_vm_enough_memory
),
6126 LSM_HOOK_INIT(netlink_send
, selinux_netlink_send
),
6128 LSM_HOOK_INIT(bprm_set_creds
, selinux_bprm_set_creds
),
6129 LSM_HOOK_INIT(bprm_committing_creds
, selinux_bprm_committing_creds
),
6130 LSM_HOOK_INIT(bprm_committed_creds
, selinux_bprm_committed_creds
),
6131 LSM_HOOK_INIT(bprm_secureexec
, selinux_bprm_secureexec
),
6133 LSM_HOOK_INIT(sb_alloc_security
, selinux_sb_alloc_security
),
6134 LSM_HOOK_INIT(sb_free_security
, selinux_sb_free_security
),
6135 LSM_HOOK_INIT(sb_copy_data
, selinux_sb_copy_data
),
6136 LSM_HOOK_INIT(sb_remount
, selinux_sb_remount
),
6137 LSM_HOOK_INIT(sb_kern_mount
, selinux_sb_kern_mount
),
6138 LSM_HOOK_INIT(sb_show_options
, selinux_sb_show_options
),
6139 LSM_HOOK_INIT(sb_statfs
, selinux_sb_statfs
),
6140 LSM_HOOK_INIT(sb_mount
, selinux_mount
),
6141 LSM_HOOK_INIT(sb_umount
, selinux_umount
),
6142 LSM_HOOK_INIT(sb_set_mnt_opts
, selinux_set_mnt_opts
),
6143 LSM_HOOK_INIT(sb_clone_mnt_opts
, selinux_sb_clone_mnt_opts
),
6144 LSM_HOOK_INIT(sb_parse_opts_str
, selinux_parse_opts_str
),
6146 LSM_HOOK_INIT(dentry_init_security
, selinux_dentry_init_security
),
6147 LSM_HOOK_INIT(dentry_create_files_as
, selinux_dentry_create_files_as
),
6149 LSM_HOOK_INIT(inode_alloc_security
, selinux_inode_alloc_security
),
6150 LSM_HOOK_INIT(inode_free_security
, selinux_inode_free_security
),
6151 LSM_HOOK_INIT(inode_init_security
, selinux_inode_init_security
),
6152 LSM_HOOK_INIT(inode_create
, selinux_inode_create
),
6153 LSM_HOOK_INIT(inode_link
, selinux_inode_link
),
6154 LSM_HOOK_INIT(inode_unlink
, selinux_inode_unlink
),
6155 LSM_HOOK_INIT(inode_symlink
, selinux_inode_symlink
),
6156 LSM_HOOK_INIT(inode_mkdir
, selinux_inode_mkdir
),
6157 LSM_HOOK_INIT(inode_rmdir
, selinux_inode_rmdir
),
6158 LSM_HOOK_INIT(inode_mknod
, selinux_inode_mknod
),
6159 LSM_HOOK_INIT(inode_rename
, selinux_inode_rename
),
6160 LSM_HOOK_INIT(inode_readlink
, selinux_inode_readlink
),
6161 LSM_HOOK_INIT(inode_follow_link
, selinux_inode_follow_link
),
6162 LSM_HOOK_INIT(inode_permission
, selinux_inode_permission
),
6163 LSM_HOOK_INIT(inode_setattr
, selinux_inode_setattr
),
6164 LSM_HOOK_INIT(inode_getattr
, selinux_inode_getattr
),
6165 LSM_HOOK_INIT(inode_setxattr
, selinux_inode_setxattr
),
6166 LSM_HOOK_INIT(inode_post_setxattr
, selinux_inode_post_setxattr
),
6167 LSM_HOOK_INIT(inode_getxattr
, selinux_inode_getxattr
),
6168 LSM_HOOK_INIT(inode_listxattr
, selinux_inode_listxattr
),
6169 LSM_HOOK_INIT(inode_removexattr
, selinux_inode_removexattr
),
6170 LSM_HOOK_INIT(inode_getsecurity
, selinux_inode_getsecurity
),
6171 LSM_HOOK_INIT(inode_setsecurity
, selinux_inode_setsecurity
),
6172 LSM_HOOK_INIT(inode_listsecurity
, selinux_inode_listsecurity
),
6173 LSM_HOOK_INIT(inode_getsecid
, selinux_inode_getsecid
),
6174 LSM_HOOK_INIT(inode_copy_up
, selinux_inode_copy_up
),
6175 LSM_HOOK_INIT(inode_copy_up_xattr
, selinux_inode_copy_up_xattr
),
6177 LSM_HOOK_INIT(file_permission
, selinux_file_permission
),
6178 LSM_HOOK_INIT(file_alloc_security
, selinux_file_alloc_security
),
6179 LSM_HOOK_INIT(file_free_security
, selinux_file_free_security
),
6180 LSM_HOOK_INIT(file_ioctl
, selinux_file_ioctl
),
6181 LSM_HOOK_INIT(mmap_file
, selinux_mmap_file
),
6182 LSM_HOOK_INIT(mmap_addr
, selinux_mmap_addr
),
6183 LSM_HOOK_INIT(file_mprotect
, selinux_file_mprotect
),
6184 LSM_HOOK_INIT(file_lock
, selinux_file_lock
),
6185 LSM_HOOK_INIT(file_fcntl
, selinux_file_fcntl
),
6186 LSM_HOOK_INIT(file_set_fowner
, selinux_file_set_fowner
),
6187 LSM_HOOK_INIT(file_send_sigiotask
, selinux_file_send_sigiotask
),
6188 LSM_HOOK_INIT(file_receive
, selinux_file_receive
),
6190 LSM_HOOK_INIT(file_open
, selinux_file_open
),
6192 LSM_HOOK_INIT(task_create
, selinux_task_create
),
6193 LSM_HOOK_INIT(cred_alloc_blank
, selinux_cred_alloc_blank
),
6194 LSM_HOOK_INIT(cred_free
, selinux_cred_free
),
6195 LSM_HOOK_INIT(cred_prepare
, selinux_cred_prepare
),
6196 LSM_HOOK_INIT(cred_transfer
, selinux_cred_transfer
),
6197 LSM_HOOK_INIT(kernel_act_as
, selinux_kernel_act_as
),
6198 LSM_HOOK_INIT(kernel_create_files_as
, selinux_kernel_create_files_as
),
6199 LSM_HOOK_INIT(kernel_module_request
, selinux_kernel_module_request
),
6200 LSM_HOOK_INIT(kernel_read_file
, selinux_kernel_read_file
),
6201 LSM_HOOK_INIT(task_setpgid
, selinux_task_setpgid
),
6202 LSM_HOOK_INIT(task_getpgid
, selinux_task_getpgid
),
6203 LSM_HOOK_INIT(task_getsid
, selinux_task_getsid
),
6204 LSM_HOOK_INIT(task_getsecid
, selinux_task_getsecid
),
6205 LSM_HOOK_INIT(task_setnice
, selinux_task_setnice
),
6206 LSM_HOOK_INIT(task_setioprio
, selinux_task_setioprio
),
6207 LSM_HOOK_INIT(task_getioprio
, selinux_task_getioprio
),
6208 LSM_HOOK_INIT(task_setrlimit
, selinux_task_setrlimit
),
6209 LSM_HOOK_INIT(task_setscheduler
, selinux_task_setscheduler
),
6210 LSM_HOOK_INIT(task_getscheduler
, selinux_task_getscheduler
),
6211 LSM_HOOK_INIT(task_movememory
, selinux_task_movememory
),
6212 LSM_HOOK_INIT(task_kill
, selinux_task_kill
),
6213 LSM_HOOK_INIT(task_to_inode
, selinux_task_to_inode
),
6215 LSM_HOOK_INIT(ipc_permission
, selinux_ipc_permission
),
6216 LSM_HOOK_INIT(ipc_getsecid
, selinux_ipc_getsecid
),
6218 LSM_HOOK_INIT(msg_msg_alloc_security
, selinux_msg_msg_alloc_security
),
6219 LSM_HOOK_INIT(msg_msg_free_security
, selinux_msg_msg_free_security
),
6221 LSM_HOOK_INIT(msg_queue_alloc_security
,
6222 selinux_msg_queue_alloc_security
),
6223 LSM_HOOK_INIT(msg_queue_free_security
, selinux_msg_queue_free_security
),
6224 LSM_HOOK_INIT(msg_queue_associate
, selinux_msg_queue_associate
),
6225 LSM_HOOK_INIT(msg_queue_msgctl
, selinux_msg_queue_msgctl
),
6226 LSM_HOOK_INIT(msg_queue_msgsnd
, selinux_msg_queue_msgsnd
),
6227 LSM_HOOK_INIT(msg_queue_msgrcv
, selinux_msg_queue_msgrcv
),
6229 LSM_HOOK_INIT(shm_alloc_security
, selinux_shm_alloc_security
),
6230 LSM_HOOK_INIT(shm_free_security
, selinux_shm_free_security
),
6231 LSM_HOOK_INIT(shm_associate
, selinux_shm_associate
),
6232 LSM_HOOK_INIT(shm_shmctl
, selinux_shm_shmctl
),
6233 LSM_HOOK_INIT(shm_shmat
, selinux_shm_shmat
),
6235 LSM_HOOK_INIT(sem_alloc_security
, selinux_sem_alloc_security
),
6236 LSM_HOOK_INIT(sem_free_security
, selinux_sem_free_security
),
6237 LSM_HOOK_INIT(sem_associate
, selinux_sem_associate
),
6238 LSM_HOOK_INIT(sem_semctl
, selinux_sem_semctl
),
6239 LSM_HOOK_INIT(sem_semop
, selinux_sem_semop
),
6241 LSM_HOOK_INIT(d_instantiate
, selinux_d_instantiate
),
6243 LSM_HOOK_INIT(getprocattr
, selinux_getprocattr
),
6244 LSM_HOOK_INIT(setprocattr
, selinux_setprocattr
),
6246 LSM_HOOK_INIT(ismaclabel
, selinux_ismaclabel
),
6247 LSM_HOOK_INIT(secid_to_secctx
, selinux_secid_to_secctx
),
6248 LSM_HOOK_INIT(secctx_to_secid
, selinux_secctx_to_secid
),
6249 LSM_HOOK_INIT(release_secctx
, selinux_release_secctx
),
6250 LSM_HOOK_INIT(inode_invalidate_secctx
, selinux_inode_invalidate_secctx
),
6251 LSM_HOOK_INIT(inode_notifysecctx
, selinux_inode_notifysecctx
),
6252 LSM_HOOK_INIT(inode_setsecctx
, selinux_inode_setsecctx
),
6253 LSM_HOOK_INIT(inode_getsecctx
, selinux_inode_getsecctx
),
6255 LSM_HOOK_INIT(unix_stream_connect
, selinux_socket_unix_stream_connect
),
6256 LSM_HOOK_INIT(unix_may_send
, selinux_socket_unix_may_send
),
6258 LSM_HOOK_INIT(socket_create
, selinux_socket_create
),
6259 LSM_HOOK_INIT(socket_post_create
, selinux_socket_post_create
),
6260 LSM_HOOK_INIT(socket_bind
, selinux_socket_bind
),
6261 LSM_HOOK_INIT(socket_connect
, selinux_socket_connect
),
6262 LSM_HOOK_INIT(socket_listen
, selinux_socket_listen
),
6263 LSM_HOOK_INIT(socket_accept
, selinux_socket_accept
),
6264 LSM_HOOK_INIT(socket_sendmsg
, selinux_socket_sendmsg
),
6265 LSM_HOOK_INIT(socket_recvmsg
, selinux_socket_recvmsg
),
6266 LSM_HOOK_INIT(socket_getsockname
, selinux_socket_getsockname
),
6267 LSM_HOOK_INIT(socket_getpeername
, selinux_socket_getpeername
),
6268 LSM_HOOK_INIT(socket_getsockopt
, selinux_socket_getsockopt
),
6269 LSM_HOOK_INIT(socket_setsockopt
, selinux_socket_setsockopt
),
6270 LSM_HOOK_INIT(socket_shutdown
, selinux_socket_shutdown
),
6271 LSM_HOOK_INIT(socket_sock_rcv_skb
, selinux_socket_sock_rcv_skb
),
6272 LSM_HOOK_INIT(socket_getpeersec_stream
,
6273 selinux_socket_getpeersec_stream
),
6274 LSM_HOOK_INIT(socket_getpeersec_dgram
, selinux_socket_getpeersec_dgram
),
6275 LSM_HOOK_INIT(sk_alloc_security
, selinux_sk_alloc_security
),
6276 LSM_HOOK_INIT(sk_free_security
, selinux_sk_free_security
),
6277 LSM_HOOK_INIT(sk_clone_security
, selinux_sk_clone_security
),
6278 LSM_HOOK_INIT(sk_getsecid
, selinux_sk_getsecid
),
6279 LSM_HOOK_INIT(sock_graft
, selinux_sock_graft
),
6280 LSM_HOOK_INIT(inet_conn_request
, selinux_inet_conn_request
),
6281 LSM_HOOK_INIT(inet_csk_clone
, selinux_inet_csk_clone
),
6282 LSM_HOOK_INIT(inet_conn_established
, selinux_inet_conn_established
),
6283 LSM_HOOK_INIT(secmark_relabel_packet
, selinux_secmark_relabel_packet
),
6284 LSM_HOOK_INIT(secmark_refcount_inc
, selinux_secmark_refcount_inc
),
6285 LSM_HOOK_INIT(secmark_refcount_dec
, selinux_secmark_refcount_dec
),
6286 LSM_HOOK_INIT(req_classify_flow
, selinux_req_classify_flow
),
6287 LSM_HOOK_INIT(tun_dev_alloc_security
, selinux_tun_dev_alloc_security
),
6288 LSM_HOOK_INIT(tun_dev_free_security
, selinux_tun_dev_free_security
),
6289 LSM_HOOK_INIT(tun_dev_create
, selinux_tun_dev_create
),
6290 LSM_HOOK_INIT(tun_dev_attach_queue
, selinux_tun_dev_attach_queue
),
6291 LSM_HOOK_INIT(tun_dev_attach
, selinux_tun_dev_attach
),
6292 LSM_HOOK_INIT(tun_dev_open
, selinux_tun_dev_open
),
6294 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6295 LSM_HOOK_INIT(xfrm_policy_alloc_security
, selinux_xfrm_policy_alloc
),
6296 LSM_HOOK_INIT(xfrm_policy_clone_security
, selinux_xfrm_policy_clone
),
6297 LSM_HOOK_INIT(xfrm_policy_free_security
, selinux_xfrm_policy_free
),
6298 LSM_HOOK_INIT(xfrm_policy_delete_security
, selinux_xfrm_policy_delete
),
6299 LSM_HOOK_INIT(xfrm_state_alloc
, selinux_xfrm_state_alloc
),
6300 LSM_HOOK_INIT(xfrm_state_alloc_acquire
,
6301 selinux_xfrm_state_alloc_acquire
),
6302 LSM_HOOK_INIT(xfrm_state_free_security
, selinux_xfrm_state_free
),
6303 LSM_HOOK_INIT(xfrm_state_delete_security
, selinux_xfrm_state_delete
),
6304 LSM_HOOK_INIT(xfrm_policy_lookup
, selinux_xfrm_policy_lookup
),
6305 LSM_HOOK_INIT(xfrm_state_pol_flow_match
,
6306 selinux_xfrm_state_pol_flow_match
),
6307 LSM_HOOK_INIT(xfrm_decode_session
, selinux_xfrm_decode_session
),
6311 LSM_HOOK_INIT(key_alloc
, selinux_key_alloc
),
6312 LSM_HOOK_INIT(key_free
, selinux_key_free
),
6313 LSM_HOOK_INIT(key_permission
, selinux_key_permission
),
6314 LSM_HOOK_INIT(key_getsecurity
, selinux_key_getsecurity
),
6318 LSM_HOOK_INIT(audit_rule_init
, selinux_audit_rule_init
),
6319 LSM_HOOK_INIT(audit_rule_known
, selinux_audit_rule_known
),
6320 LSM_HOOK_INIT(audit_rule_match
, selinux_audit_rule_match
),
6321 LSM_HOOK_INIT(audit_rule_free
, selinux_audit_rule_free
),
6325 static __init
int selinux_init(void)
6327 if (!security_module_enable("selinux")) {
6328 selinux_enabled
= 0;
6332 if (!selinux_enabled
) {
6333 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
6337 printk(KERN_INFO
"SELinux: Initializing.\n");
6339 /* Set the security state for the initial task. */
6340 cred_init_security();
6342 default_noexec
= !(VM_DATA_DEFAULT_FLAGS
& VM_EXEC
);
6344 sel_inode_cache
= kmem_cache_create("selinux_inode_security",
6345 sizeof(struct inode_security_struct
),
6346 0, SLAB_PANIC
, NULL
);
6347 file_security_cache
= kmem_cache_create("selinux_file_security",
6348 sizeof(struct file_security_struct
),
6349 0, SLAB_PANIC
, NULL
);
6352 security_add_hooks(selinux_hooks
, ARRAY_SIZE(selinux_hooks
), "selinux");
6354 if (avc_add_callback(selinux_netcache_avc_callback
, AVC_CALLBACK_RESET
))
6355 panic("SELinux: Unable to register AVC netcache callback\n");
6357 if (selinux_enforcing
)
6358 printk(KERN_DEBUG
"SELinux: Starting in enforcing mode\n");
6360 printk(KERN_DEBUG
"SELinux: Starting in permissive mode\n");
6365 static void delayed_superblock_init(struct super_block
*sb
, void *unused
)
6367 superblock_doinit(sb
, NULL
);
6370 void selinux_complete_init(void)
6372 printk(KERN_DEBUG
"SELinux: Completing initialization.\n");
6374 /* Set up any superblocks initialized prior to the policy load. */
6375 printk(KERN_DEBUG
"SELinux: Setting up existing superblocks.\n");
6376 iterate_supers(delayed_superblock_init
, NULL
);
6379 /* SELinux requires early initialization in order to label
6380 all processes and objects when they are created. */
6381 security_initcall(selinux_init
);
6383 #if defined(CONFIG_NETFILTER)
6385 static struct nf_hook_ops selinux_nf_ops
[] = {
6387 .hook
= selinux_ipv4_postroute
,
6389 .hooknum
= NF_INET_POST_ROUTING
,
6390 .priority
= NF_IP_PRI_SELINUX_LAST
,
6393 .hook
= selinux_ipv4_forward
,
6395 .hooknum
= NF_INET_FORWARD
,
6396 .priority
= NF_IP_PRI_SELINUX_FIRST
,
6399 .hook
= selinux_ipv4_output
,
6401 .hooknum
= NF_INET_LOCAL_OUT
,
6402 .priority
= NF_IP_PRI_SELINUX_FIRST
,
6404 #if IS_ENABLED(CONFIG_IPV6)
6406 .hook
= selinux_ipv6_postroute
,
6408 .hooknum
= NF_INET_POST_ROUTING
,
6409 .priority
= NF_IP6_PRI_SELINUX_LAST
,
6412 .hook
= selinux_ipv6_forward
,
6414 .hooknum
= NF_INET_FORWARD
,
6415 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
6418 .hook
= selinux_ipv6_output
,
6420 .hooknum
= NF_INET_LOCAL_OUT
,
6421 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
6426 static int __init
selinux_nf_ip_init(void)
6430 if (!selinux_enabled
)
6433 printk(KERN_DEBUG
"SELinux: Registering netfilter hooks\n");
6435 err
= nf_register_hooks(selinux_nf_ops
, ARRAY_SIZE(selinux_nf_ops
));
6437 panic("SELinux: nf_register_hooks: error %d\n", err
);
6442 __initcall(selinux_nf_ip_init
);
6444 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6445 static void selinux_nf_ip_exit(void)
6447 printk(KERN_DEBUG
"SELinux: Unregistering netfilter hooks\n");
6449 nf_unregister_hooks(selinux_nf_ops
, ARRAY_SIZE(selinux_nf_ops
));
6453 #else /* CONFIG_NETFILTER */
6455 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6456 #define selinux_nf_ip_exit()
6459 #endif /* CONFIG_NETFILTER */
6461 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6462 static int selinux_disabled
;
6464 int selinux_disable(void)
6466 if (ss_initialized
) {
6467 /* Not permitted after initial policy load. */
6471 if (selinux_disabled
) {
6472 /* Only do this once. */
6476 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
6478 selinux_disabled
= 1;
6479 selinux_enabled
= 0;
6481 security_delete_hooks(selinux_hooks
, ARRAY_SIZE(selinux_hooks
));
6483 /* Try to destroy the avc node cache */
6486 /* Unregister netfilter hooks. */
6487 selinux_nf_ip_exit();
6489 /* Unregister selinuxfs. */