2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount
= ATOMIC_INIT(0);
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing
;
103 static int __init
enforcing_setup(char *str
)
105 unsigned long enforcing
;
106 if (!kstrtoul(str
, 0, &enforcing
))
107 selinux_enforcing
= enforcing
? 1 : 0;
110 __setup("enforcing=", enforcing_setup
);
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
116 static int __init
selinux_enabled_setup(char *str
)
118 unsigned long enabled
;
119 if (!kstrtoul(str
, 0, &enabled
))
120 selinux_enabled
= enabled
? 1 : 0;
123 __setup("selinux=", selinux_enabled_setup
);
125 int selinux_enabled
= 1;
128 static struct kmem_cache
*sel_inode_cache
;
129 static struct kmem_cache
*file_security_cache
;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
142 static int selinux_secmark_enabled(void)
144 return (selinux_policycap_alwaysnetwork
|| atomic_read(&selinux_secmark_refcount
));
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
157 static int selinux_peerlbl_enabled(void)
159 return (selinux_policycap_alwaysnetwork
|| netlbl_enabled() || selinux_xfrm_enabled());
162 static int selinux_netcache_avc_callback(u32 event
)
164 if (event
== AVC_CALLBACK_RESET
) {
174 * initialise the security for the init task
176 static void cred_init_security(void)
178 struct cred
*cred
= (struct cred
*) current
->real_cred
;
179 struct task_security_struct
*tsec
;
181 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
183 panic("SELinux: Failed to initialize initial task.\n");
185 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
186 cred
->security
= tsec
;
190 * get the security ID of a set of credentials
192 static inline u32
cred_sid(const struct cred
*cred
)
194 const struct task_security_struct
*tsec
;
196 tsec
= cred
->security
;
201 * get the objective security ID of a task
203 static inline u32
task_sid(const struct task_struct
*task
)
208 sid
= cred_sid(__task_cred(task
));
213 /* Allocate and free functions for each kind of security blob. */
215 static int inode_alloc_security(struct inode
*inode
)
217 struct inode_security_struct
*isec
;
218 u32 sid
= current_sid();
220 isec
= kmem_cache_zalloc(sel_inode_cache
, GFP_NOFS
);
224 spin_lock_init(&isec
->lock
);
225 INIT_LIST_HEAD(&isec
->list
);
227 isec
->sid
= SECINITSID_UNLABELED
;
228 isec
->sclass
= SECCLASS_FILE
;
229 isec
->task_sid
= sid
;
230 isec
->initialized
= LABEL_INVALID
;
231 inode
->i_security
= isec
;
236 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
239 * Try reloading inode security labels that have been marked as invalid. The
240 * @may_sleep parameter indicates when sleeping and thus reloading labels is
241 * allowed; when set to false, returns -ECHILD when the label is
242 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
243 * when no dentry is available, set it to NULL instead.
245 static int __inode_security_revalidate(struct inode
*inode
,
246 struct dentry
*opt_dentry
,
249 struct inode_security_struct
*isec
= inode
->i_security
;
251 might_sleep_if(may_sleep
);
253 if (ss_initialized
&& isec
->initialized
!= LABEL_INITIALIZED
) {
258 * Try reloading the inode security label. This will fail if
259 * @opt_dentry is NULL and no dentry for this inode can be
260 * found; in that case, continue using the old label.
262 inode_doinit_with_dentry(inode
, opt_dentry
);
267 static struct inode_security_struct
*inode_security_novalidate(struct inode
*inode
)
269 return inode
->i_security
;
272 static struct inode_security_struct
*inode_security_rcu(struct inode
*inode
, bool rcu
)
276 error
= __inode_security_revalidate(inode
, NULL
, !rcu
);
278 return ERR_PTR(error
);
279 return inode
->i_security
;
283 * Get the security label of an inode.
285 static struct inode_security_struct
*inode_security(struct inode
*inode
)
287 __inode_security_revalidate(inode
, NULL
, true);
288 return inode
->i_security
;
291 static struct inode_security_struct
*backing_inode_security_novalidate(struct dentry
*dentry
)
293 struct inode
*inode
= d_backing_inode(dentry
);
295 return inode
->i_security
;
299 * Get the security label of a dentry's backing inode.
301 static struct inode_security_struct
*backing_inode_security(struct dentry
*dentry
)
303 struct inode
*inode
= d_backing_inode(dentry
);
305 __inode_security_revalidate(inode
, dentry
, true);
306 return inode
->i_security
;
309 static void inode_free_rcu(struct rcu_head
*head
)
311 struct inode_security_struct
*isec
;
313 isec
= container_of(head
, struct inode_security_struct
, rcu
);
314 kmem_cache_free(sel_inode_cache
, isec
);
317 static void inode_free_security(struct inode
*inode
)
319 struct inode_security_struct
*isec
= inode
->i_security
;
320 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
323 * As not all inode security structures are in a list, we check for
324 * empty list outside of the lock to make sure that we won't waste
325 * time taking a lock doing nothing.
327 * The list_del_init() function can be safely called more than once.
328 * It should not be possible for this function to be called with
329 * concurrent list_add(), but for better safety against future changes
330 * in the code, we use list_empty_careful() here.
332 if (!list_empty_careful(&isec
->list
)) {
333 spin_lock(&sbsec
->isec_lock
);
334 list_del_init(&isec
->list
);
335 spin_unlock(&sbsec
->isec_lock
);
339 * The inode may still be referenced in a path walk and
340 * a call to selinux_inode_permission() can be made
341 * after inode_free_security() is called. Ideally, the VFS
342 * wouldn't do this, but fixing that is a much harder
343 * job. For now, simply free the i_security via RCU, and
344 * leave the current inode->i_security pointer intact.
345 * The inode will be freed after the RCU grace period too.
347 call_rcu(&isec
->rcu
, inode_free_rcu
);
350 static int file_alloc_security(struct file
*file
)
352 struct file_security_struct
*fsec
;
353 u32 sid
= current_sid();
355 fsec
= kmem_cache_zalloc(file_security_cache
, GFP_KERNEL
);
360 fsec
->fown_sid
= sid
;
361 file
->f_security
= fsec
;
366 static void file_free_security(struct file
*file
)
368 struct file_security_struct
*fsec
= file
->f_security
;
369 file
->f_security
= NULL
;
370 kmem_cache_free(file_security_cache
, fsec
);
373 static int superblock_alloc_security(struct super_block
*sb
)
375 struct superblock_security_struct
*sbsec
;
377 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
381 mutex_init(&sbsec
->lock
);
382 INIT_LIST_HEAD(&sbsec
->isec_head
);
383 spin_lock_init(&sbsec
->isec_lock
);
385 sbsec
->sid
= SECINITSID_UNLABELED
;
386 sbsec
->def_sid
= SECINITSID_FILE
;
387 sbsec
->mntpoint_sid
= SECINITSID_UNLABELED
;
388 sb
->s_security
= sbsec
;
393 static void superblock_free_security(struct super_block
*sb
)
395 struct superblock_security_struct
*sbsec
= sb
->s_security
;
396 sb
->s_security
= NULL
;
400 /* The file system's label must be initialized prior to use. */
402 static const char *labeling_behaviors
[7] = {
404 "uses transition SIDs",
406 "uses genfs_contexts",
407 "not configured for labeling",
408 "uses mountpoint labeling",
409 "uses native labeling",
412 static inline int inode_doinit(struct inode
*inode
)
414 return inode_doinit_with_dentry(inode
, NULL
);
423 Opt_labelsupport
= 5,
427 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429 static const match_table_t tokens
= {
430 {Opt_context
, CONTEXT_STR
"%s"},
431 {Opt_fscontext
, FSCONTEXT_STR
"%s"},
432 {Opt_defcontext
, DEFCONTEXT_STR
"%s"},
433 {Opt_rootcontext
, ROOTCONTEXT_STR
"%s"},
434 {Opt_labelsupport
, LABELSUPP_STR
},
438 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440 static int may_context_mount_sb_relabel(u32 sid
,
441 struct superblock_security_struct
*sbsec
,
442 const struct cred
*cred
)
444 const struct task_security_struct
*tsec
= cred
->security
;
447 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
448 FILESYSTEM__RELABELFROM
, NULL
);
452 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
453 FILESYSTEM__RELABELTO
, NULL
);
457 static int may_context_mount_inode_relabel(u32 sid
,
458 struct superblock_security_struct
*sbsec
,
459 const struct cred
*cred
)
461 const struct task_security_struct
*tsec
= cred
->security
;
463 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
464 FILESYSTEM__RELABELFROM
, NULL
);
468 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
469 FILESYSTEM__ASSOCIATE
, NULL
);
473 static int selinux_is_sblabel_mnt(struct super_block
*sb
)
475 struct superblock_security_struct
*sbsec
= sb
->s_security
;
477 return sbsec
->behavior
== SECURITY_FS_USE_XATTR
||
478 sbsec
->behavior
== SECURITY_FS_USE_TRANS
||
479 sbsec
->behavior
== SECURITY_FS_USE_TASK
||
480 sbsec
->behavior
== SECURITY_FS_USE_NATIVE
||
481 /* Special handling. Genfs but also in-core setxattr handler */
482 !strcmp(sb
->s_type
->name
, "sysfs") ||
483 !strcmp(sb
->s_type
->name
, "cgroup") ||
484 !strcmp(sb
->s_type
->name
, "cgroup2") ||
485 !strcmp(sb
->s_type
->name
, "pstore") ||
486 !strcmp(sb
->s_type
->name
, "debugfs") ||
487 !strcmp(sb
->s_type
->name
, "tracefs") ||
488 !strcmp(sb
->s_type
->name
, "rootfs");
491 static int sb_finish_set_opts(struct super_block
*sb
)
493 struct superblock_security_struct
*sbsec
= sb
->s_security
;
494 struct dentry
*root
= sb
->s_root
;
495 struct inode
*root_inode
= d_backing_inode(root
);
498 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
499 /* Make sure that the xattr handler exists and that no
500 error other than -ENODATA is returned by getxattr on
501 the root directory. -ENODATA is ok, as this may be
502 the first boot of the SELinux kernel before we have
503 assigned xattr values to the filesystem. */
504 if (!(root_inode
->i_opflags
& IOP_XATTR
)) {
505 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
506 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
511 rc
= __vfs_getxattr(root
, root_inode
, XATTR_NAME_SELINUX
, NULL
, 0);
512 if (rc
< 0 && rc
!= -ENODATA
) {
513 if (rc
== -EOPNOTSUPP
)
514 printk(KERN_WARNING
"SELinux: (dev %s, type "
515 "%s) has no security xattr handler\n",
516 sb
->s_id
, sb
->s_type
->name
);
518 printk(KERN_WARNING
"SELinux: (dev %s, type "
519 "%s) getxattr errno %d\n", sb
->s_id
,
520 sb
->s_type
->name
, -rc
);
525 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
))
526 printk(KERN_ERR
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
527 sb
->s_id
, sb
->s_type
->name
);
529 sbsec
->flags
|= SE_SBINITIALIZED
;
530 if (selinux_is_sblabel_mnt(sb
))
531 sbsec
->flags
|= SBLABEL_MNT
;
533 /* Initialize the root inode. */
534 rc
= inode_doinit_with_dentry(root_inode
, root
);
536 /* Initialize any other inodes associated with the superblock, e.g.
537 inodes created prior to initial policy load or inodes created
538 during get_sb by a pseudo filesystem that directly
540 spin_lock(&sbsec
->isec_lock
);
542 if (!list_empty(&sbsec
->isec_head
)) {
543 struct inode_security_struct
*isec
=
544 list_entry(sbsec
->isec_head
.next
,
545 struct inode_security_struct
, list
);
546 struct inode
*inode
= isec
->inode
;
547 list_del_init(&isec
->list
);
548 spin_unlock(&sbsec
->isec_lock
);
549 inode
= igrab(inode
);
551 if (!IS_PRIVATE(inode
))
555 spin_lock(&sbsec
->isec_lock
);
558 spin_unlock(&sbsec
->isec_lock
);
564 * This function should allow an FS to ask what it's mount security
565 * options were so it can use those later for submounts, displaying
566 * mount options, or whatever.
568 static int selinux_get_mnt_opts(const struct super_block
*sb
,
569 struct security_mnt_opts
*opts
)
572 struct superblock_security_struct
*sbsec
= sb
->s_security
;
573 char *context
= NULL
;
577 security_init_mnt_opts(opts
);
579 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
585 /* make sure we always check enough bits to cover the mask */
586 BUILD_BUG_ON(SE_MNTMASK
>= (1 << NUM_SEL_MNT_OPTS
));
588 tmp
= sbsec
->flags
& SE_MNTMASK
;
589 /* count the number of mount options for this sb */
590 for (i
= 0; i
< NUM_SEL_MNT_OPTS
; i
++) {
592 opts
->num_mnt_opts
++;
595 /* Check if the Label support flag is set */
596 if (sbsec
->flags
& SBLABEL_MNT
)
597 opts
->num_mnt_opts
++;
599 opts
->mnt_opts
= kcalloc(opts
->num_mnt_opts
, sizeof(char *), GFP_ATOMIC
);
600 if (!opts
->mnt_opts
) {
605 opts
->mnt_opts_flags
= kcalloc(opts
->num_mnt_opts
, sizeof(int), GFP_ATOMIC
);
606 if (!opts
->mnt_opts_flags
) {
612 if (sbsec
->flags
& FSCONTEXT_MNT
) {
613 rc
= security_sid_to_context(sbsec
->sid
, &context
, &len
);
616 opts
->mnt_opts
[i
] = context
;
617 opts
->mnt_opts_flags
[i
++] = FSCONTEXT_MNT
;
619 if (sbsec
->flags
& CONTEXT_MNT
) {
620 rc
= security_sid_to_context(sbsec
->mntpoint_sid
, &context
, &len
);
623 opts
->mnt_opts
[i
] = context
;
624 opts
->mnt_opts_flags
[i
++] = CONTEXT_MNT
;
626 if (sbsec
->flags
& DEFCONTEXT_MNT
) {
627 rc
= security_sid_to_context(sbsec
->def_sid
, &context
, &len
);
630 opts
->mnt_opts
[i
] = context
;
631 opts
->mnt_opts_flags
[i
++] = DEFCONTEXT_MNT
;
633 if (sbsec
->flags
& ROOTCONTEXT_MNT
) {
634 struct dentry
*root
= sbsec
->sb
->s_root
;
635 struct inode_security_struct
*isec
= backing_inode_security(root
);
637 rc
= security_sid_to_context(isec
->sid
, &context
, &len
);
640 opts
->mnt_opts
[i
] = context
;
641 opts
->mnt_opts_flags
[i
++] = ROOTCONTEXT_MNT
;
643 if (sbsec
->flags
& SBLABEL_MNT
) {
644 opts
->mnt_opts
[i
] = NULL
;
645 opts
->mnt_opts_flags
[i
++] = SBLABEL_MNT
;
648 BUG_ON(i
!= opts
->num_mnt_opts
);
653 security_free_mnt_opts(opts
);
657 static int bad_option(struct superblock_security_struct
*sbsec
, char flag
,
658 u32 old_sid
, u32 new_sid
)
660 char mnt_flags
= sbsec
->flags
& SE_MNTMASK
;
662 /* check if the old mount command had the same options */
663 if (sbsec
->flags
& SE_SBINITIALIZED
)
664 if (!(sbsec
->flags
& flag
) ||
665 (old_sid
!= new_sid
))
668 /* check if we were passed the same options twice,
669 * aka someone passed context=a,context=b
671 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
672 if (mnt_flags
& flag
)
678 * Allow filesystems with binary mount data to explicitly set mount point
679 * labeling information.
681 static int selinux_set_mnt_opts(struct super_block
*sb
,
682 struct security_mnt_opts
*opts
,
683 unsigned long kern_flags
,
684 unsigned long *set_kern_flags
)
686 const struct cred
*cred
= current_cred();
688 struct superblock_security_struct
*sbsec
= sb
->s_security
;
689 const char *name
= sb
->s_type
->name
;
690 struct dentry
*root
= sbsec
->sb
->s_root
;
691 struct inode_security_struct
*root_isec
;
692 u32 fscontext_sid
= 0, context_sid
= 0, rootcontext_sid
= 0;
693 u32 defcontext_sid
= 0;
694 char **mount_options
= opts
->mnt_opts
;
695 int *flags
= opts
->mnt_opts_flags
;
696 int num_opts
= opts
->num_mnt_opts
;
698 mutex_lock(&sbsec
->lock
);
700 if (!ss_initialized
) {
702 /* Defer initialization until selinux_complete_init,
703 after the initial policy is loaded and the security
704 server is ready to handle calls. */
708 printk(KERN_WARNING
"SELinux: Unable to set superblock options "
709 "before the security server is initialized\n");
712 if (kern_flags
&& !set_kern_flags
) {
713 /* Specifying internal flags without providing a place to
714 * place the results is not allowed */
720 * Binary mount data FS will come through this function twice. Once
721 * from an explicit call and once from the generic calls from the vfs.
722 * Since the generic VFS calls will not contain any security mount data
723 * we need to skip the double mount verification.
725 * This does open a hole in which we will not notice if the first
726 * mount using this sb set explict options and a second mount using
727 * this sb does not set any security options. (The first options
728 * will be used for both mounts)
730 if ((sbsec
->flags
& SE_SBINITIALIZED
) && (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
734 root_isec
= backing_inode_security_novalidate(root
);
737 * parse the mount options, check if they are valid sids.
738 * also check if someone is trying to mount the same sb more
739 * than once with different security options.
741 for (i
= 0; i
< num_opts
; i
++) {
744 if (flags
[i
] == SBLABEL_MNT
)
746 rc
= security_context_str_to_sid(mount_options
[i
], &sid
, GFP_KERNEL
);
748 printk(KERN_WARNING
"SELinux: security_context_str_to_sid"
749 "(%s) failed for (dev %s, type %s) errno=%d\n",
750 mount_options
[i
], sb
->s_id
, name
, rc
);
757 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
,
759 goto out_double_mount
;
761 sbsec
->flags
|= FSCONTEXT_MNT
;
766 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
,
768 goto out_double_mount
;
770 sbsec
->flags
|= CONTEXT_MNT
;
772 case ROOTCONTEXT_MNT
:
773 rootcontext_sid
= sid
;
775 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
,
777 goto out_double_mount
;
779 sbsec
->flags
|= ROOTCONTEXT_MNT
;
783 defcontext_sid
= sid
;
785 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
,
787 goto out_double_mount
;
789 sbsec
->flags
|= DEFCONTEXT_MNT
;
798 if (sbsec
->flags
& SE_SBINITIALIZED
) {
799 /* previously mounted with options, but not on this attempt? */
800 if ((sbsec
->flags
& SE_MNTMASK
) && !num_opts
)
801 goto out_double_mount
;
806 if (strcmp(sb
->s_type
->name
, "proc") == 0)
807 sbsec
->flags
|= SE_SBPROC
| SE_SBGENFS
;
809 if (!strcmp(sb
->s_type
->name
, "debugfs") ||
810 !strcmp(sb
->s_type
->name
, "sysfs") ||
811 !strcmp(sb
->s_type
->name
, "pstore"))
812 sbsec
->flags
|= SE_SBGENFS
;
814 if (!sbsec
->behavior
) {
816 * Determine the labeling behavior to use for this
819 rc
= security_fs_use(sb
);
822 "%s: security_fs_use(%s) returned %d\n",
823 __func__
, sb
->s_type
->name
, rc
);
829 * If this is a user namespace mount and the filesystem type is not
830 * explicitly whitelisted, then no contexts are allowed on the command
831 * line and security labels must be ignored.
833 if (sb
->s_user_ns
!= &init_user_ns
&&
834 strcmp(sb
->s_type
->name
, "tmpfs") &&
835 strcmp(sb
->s_type
->name
, "ramfs") &&
836 strcmp(sb
->s_type
->name
, "devpts")) {
837 if (context_sid
|| fscontext_sid
|| rootcontext_sid
||
842 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
843 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
844 rc
= security_transition_sid(current_sid(), current_sid(),
846 &sbsec
->mntpoint_sid
);
853 /* sets the context of the superblock for the fs being mounted. */
855 rc
= may_context_mount_sb_relabel(fscontext_sid
, sbsec
, cred
);
859 sbsec
->sid
= fscontext_sid
;
863 * Switch to using mount point labeling behavior.
864 * sets the label used on all file below the mountpoint, and will set
865 * the superblock context if not already set.
867 if (kern_flags
& SECURITY_LSM_NATIVE_LABELS
&& !context_sid
) {
868 sbsec
->behavior
= SECURITY_FS_USE_NATIVE
;
869 *set_kern_flags
|= SECURITY_LSM_NATIVE_LABELS
;
873 if (!fscontext_sid
) {
874 rc
= may_context_mount_sb_relabel(context_sid
, sbsec
,
878 sbsec
->sid
= context_sid
;
880 rc
= may_context_mount_inode_relabel(context_sid
, sbsec
,
885 if (!rootcontext_sid
)
886 rootcontext_sid
= context_sid
;
888 sbsec
->mntpoint_sid
= context_sid
;
889 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
892 if (rootcontext_sid
) {
893 rc
= may_context_mount_inode_relabel(rootcontext_sid
, sbsec
,
898 root_isec
->sid
= rootcontext_sid
;
899 root_isec
->initialized
= LABEL_INITIALIZED
;
902 if (defcontext_sid
) {
903 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
&&
904 sbsec
->behavior
!= SECURITY_FS_USE_NATIVE
) {
906 printk(KERN_WARNING
"SELinux: defcontext option is "
907 "invalid for this filesystem type\n");
911 if (defcontext_sid
!= sbsec
->def_sid
) {
912 rc
= may_context_mount_inode_relabel(defcontext_sid
,
918 sbsec
->def_sid
= defcontext_sid
;
922 rc
= sb_finish_set_opts(sb
);
924 mutex_unlock(&sbsec
->lock
);
928 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, different "
929 "security settings for (dev %s, type %s)\n", sb
->s_id
, name
);
933 static int selinux_cmp_sb_context(const struct super_block
*oldsb
,
934 const struct super_block
*newsb
)
936 struct superblock_security_struct
*old
= oldsb
->s_security
;
937 struct superblock_security_struct
*new = newsb
->s_security
;
938 char oldflags
= old
->flags
& SE_MNTMASK
;
939 char newflags
= new->flags
& SE_MNTMASK
;
941 if (oldflags
!= newflags
)
943 if ((oldflags
& FSCONTEXT_MNT
) && old
->sid
!= new->sid
)
945 if ((oldflags
& CONTEXT_MNT
) && old
->mntpoint_sid
!= new->mntpoint_sid
)
947 if ((oldflags
& DEFCONTEXT_MNT
) && old
->def_sid
!= new->def_sid
)
949 if (oldflags
& ROOTCONTEXT_MNT
) {
950 struct inode_security_struct
*oldroot
= backing_inode_security(oldsb
->s_root
);
951 struct inode_security_struct
*newroot
= backing_inode_security(newsb
->s_root
);
952 if (oldroot
->sid
!= newroot
->sid
)
957 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, "
958 "different security settings for (dev %s, "
959 "type %s)\n", newsb
->s_id
, newsb
->s_type
->name
);
963 static int selinux_sb_clone_mnt_opts(const struct super_block
*oldsb
,
964 struct super_block
*newsb
)
966 const struct superblock_security_struct
*oldsbsec
= oldsb
->s_security
;
967 struct superblock_security_struct
*newsbsec
= newsb
->s_security
;
969 int set_fscontext
= (oldsbsec
->flags
& FSCONTEXT_MNT
);
970 int set_context
= (oldsbsec
->flags
& CONTEXT_MNT
);
971 int set_rootcontext
= (oldsbsec
->flags
& ROOTCONTEXT_MNT
);
974 * if the parent was able to be mounted it clearly had no special lsm
975 * mount options. thus we can safely deal with this superblock later
980 /* how can we clone if the old one wasn't set up?? */
981 BUG_ON(!(oldsbsec
->flags
& SE_SBINITIALIZED
));
983 /* if fs is reusing a sb, make sure that the contexts match */
984 if (newsbsec
->flags
& SE_SBINITIALIZED
)
985 return selinux_cmp_sb_context(oldsb
, newsb
);
987 mutex_lock(&newsbsec
->lock
);
989 newsbsec
->flags
= oldsbsec
->flags
;
991 newsbsec
->sid
= oldsbsec
->sid
;
992 newsbsec
->def_sid
= oldsbsec
->def_sid
;
993 newsbsec
->behavior
= oldsbsec
->behavior
;
996 u32 sid
= oldsbsec
->mntpoint_sid
;
1000 if (!set_rootcontext
) {
1001 struct inode_security_struct
*newisec
= backing_inode_security(newsb
->s_root
);
1004 newsbsec
->mntpoint_sid
= sid
;
1006 if (set_rootcontext
) {
1007 const struct inode_security_struct
*oldisec
= backing_inode_security(oldsb
->s_root
);
1008 struct inode_security_struct
*newisec
= backing_inode_security(newsb
->s_root
);
1010 newisec
->sid
= oldisec
->sid
;
1013 sb_finish_set_opts(newsb
);
1014 mutex_unlock(&newsbsec
->lock
);
1018 static int selinux_parse_opts_str(char *options
,
1019 struct security_mnt_opts
*opts
)
1022 char *context
= NULL
, *defcontext
= NULL
;
1023 char *fscontext
= NULL
, *rootcontext
= NULL
;
1024 int rc
, num_mnt_opts
= 0;
1026 opts
->num_mnt_opts
= 0;
1028 /* Standard string-based options. */
1029 while ((p
= strsep(&options
, "|")) != NULL
) {
1031 substring_t args
[MAX_OPT_ARGS
];
1036 token
= match_token(p
, tokens
, args
);
1040 if (context
|| defcontext
) {
1042 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1045 context
= match_strdup(&args
[0]);
1055 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1058 fscontext
= match_strdup(&args
[0]);
1065 case Opt_rootcontext
:
1068 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1071 rootcontext
= match_strdup(&args
[0]);
1078 case Opt_defcontext
:
1079 if (context
|| defcontext
) {
1081 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
1084 defcontext
= match_strdup(&args
[0]);
1090 case Opt_labelsupport
:
1094 printk(KERN_WARNING
"SELinux: unknown mount option\n");
1101 opts
->mnt_opts
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(char *), GFP_KERNEL
);
1102 if (!opts
->mnt_opts
)
1105 opts
->mnt_opts_flags
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(int),
1107 if (!opts
->mnt_opts_flags
) {
1108 kfree(opts
->mnt_opts
);
1113 opts
->mnt_opts
[num_mnt_opts
] = fscontext
;
1114 opts
->mnt_opts_flags
[num_mnt_opts
++] = FSCONTEXT_MNT
;
1117 opts
->mnt_opts
[num_mnt_opts
] = context
;
1118 opts
->mnt_opts_flags
[num_mnt_opts
++] = CONTEXT_MNT
;
1121 opts
->mnt_opts
[num_mnt_opts
] = rootcontext
;
1122 opts
->mnt_opts_flags
[num_mnt_opts
++] = ROOTCONTEXT_MNT
;
1125 opts
->mnt_opts
[num_mnt_opts
] = defcontext
;
1126 opts
->mnt_opts_flags
[num_mnt_opts
++] = DEFCONTEXT_MNT
;
1129 opts
->num_mnt_opts
= num_mnt_opts
;
1140 * string mount options parsing and call set the sbsec
1142 static int superblock_doinit(struct super_block
*sb
, void *data
)
1145 char *options
= data
;
1146 struct security_mnt_opts opts
;
1148 security_init_mnt_opts(&opts
);
1153 BUG_ON(sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
);
1155 rc
= selinux_parse_opts_str(options
, &opts
);
1160 rc
= selinux_set_mnt_opts(sb
, &opts
, 0, NULL
);
1163 security_free_mnt_opts(&opts
);
1167 static void selinux_write_opts(struct seq_file
*m
,
1168 struct security_mnt_opts
*opts
)
1173 for (i
= 0; i
< opts
->num_mnt_opts
; i
++) {
1176 if (opts
->mnt_opts
[i
])
1177 has_comma
= strchr(opts
->mnt_opts
[i
], ',');
1181 switch (opts
->mnt_opts_flags
[i
]) {
1183 prefix
= CONTEXT_STR
;
1186 prefix
= FSCONTEXT_STR
;
1188 case ROOTCONTEXT_MNT
:
1189 prefix
= ROOTCONTEXT_STR
;
1191 case DEFCONTEXT_MNT
:
1192 prefix
= DEFCONTEXT_STR
;
1196 seq_puts(m
, LABELSUPP_STR
);
1202 /* we need a comma before each option */
1204 seq_puts(m
, prefix
);
1207 seq_escape(m
, opts
->mnt_opts
[i
], "\"\n\\");
1213 static int selinux_sb_show_options(struct seq_file
*m
, struct super_block
*sb
)
1215 struct security_mnt_opts opts
;
1218 rc
= selinux_get_mnt_opts(sb
, &opts
);
1220 /* before policy load we may get EINVAL, don't show anything */
1226 selinux_write_opts(m
, &opts
);
1228 security_free_mnt_opts(&opts
);
1233 static inline u16
inode_mode_to_security_class(umode_t mode
)
1235 switch (mode
& S_IFMT
) {
1237 return SECCLASS_SOCK_FILE
;
1239 return SECCLASS_LNK_FILE
;
1241 return SECCLASS_FILE
;
1243 return SECCLASS_BLK_FILE
;
1245 return SECCLASS_DIR
;
1247 return SECCLASS_CHR_FILE
;
1249 return SECCLASS_FIFO_FILE
;
1253 return SECCLASS_FILE
;
1256 static inline int default_protocol_stream(int protocol
)
1258 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
1261 static inline int default_protocol_dgram(int protocol
)
1263 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
1266 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
1268 int extsockclass
= selinux_policycap_extsockclass
;
1274 case SOCK_SEQPACKET
:
1275 return SECCLASS_UNIX_STREAM_SOCKET
;
1277 return SECCLASS_UNIX_DGRAM_SOCKET
;
1284 case SOCK_SEQPACKET
:
1285 if (default_protocol_stream(protocol
))
1286 return SECCLASS_TCP_SOCKET
;
1287 else if (extsockclass
&& protocol
== IPPROTO_SCTP
)
1288 return SECCLASS_SCTP_SOCKET
;
1290 return SECCLASS_RAWIP_SOCKET
;
1292 if (default_protocol_dgram(protocol
))
1293 return SECCLASS_UDP_SOCKET
;
1294 else if (extsockclass
&& (protocol
== IPPROTO_ICMP
||
1295 protocol
== IPPROTO_ICMPV6
))
1296 return SECCLASS_ICMP_SOCKET
;
1298 return SECCLASS_RAWIP_SOCKET
;
1300 return SECCLASS_DCCP_SOCKET
;
1302 return SECCLASS_RAWIP_SOCKET
;
1308 return SECCLASS_NETLINK_ROUTE_SOCKET
;
1309 case NETLINK_SOCK_DIAG
:
1310 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
1312 return SECCLASS_NETLINK_NFLOG_SOCKET
;
1314 return SECCLASS_NETLINK_XFRM_SOCKET
;
1315 case NETLINK_SELINUX
:
1316 return SECCLASS_NETLINK_SELINUX_SOCKET
;
1318 return SECCLASS_NETLINK_ISCSI_SOCKET
;
1320 return SECCLASS_NETLINK_AUDIT_SOCKET
;
1321 case NETLINK_FIB_LOOKUP
:
1322 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET
;
1323 case NETLINK_CONNECTOR
:
1324 return SECCLASS_NETLINK_CONNECTOR_SOCKET
;
1325 case NETLINK_NETFILTER
:
1326 return SECCLASS_NETLINK_NETFILTER_SOCKET
;
1327 case NETLINK_DNRTMSG
:
1328 return SECCLASS_NETLINK_DNRT_SOCKET
;
1329 case NETLINK_KOBJECT_UEVENT
:
1330 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
1331 case NETLINK_GENERIC
:
1332 return SECCLASS_NETLINK_GENERIC_SOCKET
;
1333 case NETLINK_SCSITRANSPORT
:
1334 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET
;
1336 return SECCLASS_NETLINK_RDMA_SOCKET
;
1337 case NETLINK_CRYPTO
:
1338 return SECCLASS_NETLINK_CRYPTO_SOCKET
;
1340 return SECCLASS_NETLINK_SOCKET
;
1343 return SECCLASS_PACKET_SOCKET
;
1345 return SECCLASS_KEY_SOCKET
;
1347 return SECCLASS_APPLETALK_SOCKET
;
1353 return SECCLASS_AX25_SOCKET
;
1355 return SECCLASS_IPX_SOCKET
;
1357 return SECCLASS_NETROM_SOCKET
;
1359 return SECCLASS_ATMPVC_SOCKET
;
1361 return SECCLASS_X25_SOCKET
;
1363 return SECCLASS_ROSE_SOCKET
;
1365 return SECCLASS_DECNET_SOCKET
;
1367 return SECCLASS_ATMSVC_SOCKET
;
1369 return SECCLASS_RDS_SOCKET
;
1371 return SECCLASS_IRDA_SOCKET
;
1373 return SECCLASS_PPPOX_SOCKET
;
1375 return SECCLASS_LLC_SOCKET
;
1377 return SECCLASS_CAN_SOCKET
;
1379 return SECCLASS_TIPC_SOCKET
;
1381 return SECCLASS_BLUETOOTH_SOCKET
;
1383 return SECCLASS_IUCV_SOCKET
;
1385 return SECCLASS_RXRPC_SOCKET
;
1387 return SECCLASS_ISDN_SOCKET
;
1389 return SECCLASS_PHONET_SOCKET
;
1391 return SECCLASS_IEEE802154_SOCKET
;
1393 return SECCLASS_CAIF_SOCKET
;
1395 return SECCLASS_ALG_SOCKET
;
1397 return SECCLASS_NFC_SOCKET
;
1399 return SECCLASS_VSOCK_SOCKET
;
1401 return SECCLASS_KCM_SOCKET
;
1403 return SECCLASS_QIPCRTR_SOCKET
;
1405 return SECCLASS_SMC_SOCKET
;
1407 #error New address family defined, please update this function.
1412 return SECCLASS_SOCKET
;
1415 static int selinux_genfs_get_sid(struct dentry
*dentry
,
1421 struct super_block
*sb
= dentry
->d_sb
;
1422 char *buffer
, *path
;
1424 buffer
= (char *)__get_free_page(GFP_KERNEL
);
1428 path
= dentry_path_raw(dentry
, buffer
, PAGE_SIZE
);
1432 if (flags
& SE_SBPROC
) {
1433 /* each process gets a /proc/PID/ entry. Strip off the
1434 * PID part to get a valid selinux labeling.
1435 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1436 while (path
[1] >= '0' && path
[1] <= '9') {
1441 rc
= security_genfs_sid(sb
->s_type
->name
, path
, tclass
, sid
);
1443 free_page((unsigned long)buffer
);
1447 /* The inode's security attributes must be initialized before first use. */
1448 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
1450 struct superblock_security_struct
*sbsec
= NULL
;
1451 struct inode_security_struct
*isec
= inode
->i_security
;
1452 u32 task_sid
, sid
= 0;
1454 struct dentry
*dentry
;
1455 #define INITCONTEXTLEN 255
1456 char *context
= NULL
;
1460 if (isec
->initialized
== LABEL_INITIALIZED
)
1463 spin_lock(&isec
->lock
);
1464 if (isec
->initialized
== LABEL_INITIALIZED
)
1467 if (isec
->sclass
== SECCLASS_FILE
)
1468 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1470 sbsec
= inode
->i_sb
->s_security
;
1471 if (!(sbsec
->flags
& SE_SBINITIALIZED
)) {
1472 /* Defer initialization until selinux_complete_init,
1473 after the initial policy is loaded and the security
1474 server is ready to handle calls. */
1475 spin_lock(&sbsec
->isec_lock
);
1476 if (list_empty(&isec
->list
))
1477 list_add(&isec
->list
, &sbsec
->isec_head
);
1478 spin_unlock(&sbsec
->isec_lock
);
1482 sclass
= isec
->sclass
;
1483 task_sid
= isec
->task_sid
;
1485 isec
->initialized
= LABEL_PENDING
;
1486 spin_unlock(&isec
->lock
);
1488 switch (sbsec
->behavior
) {
1489 case SECURITY_FS_USE_NATIVE
:
1491 case SECURITY_FS_USE_XATTR
:
1492 if (!(inode
->i_opflags
& IOP_XATTR
)) {
1493 sid
= sbsec
->def_sid
;
1496 /* Need a dentry, since the xattr API requires one.
1497 Life would be simpler if we could just pass the inode. */
1499 /* Called from d_instantiate or d_splice_alias. */
1500 dentry
= dget(opt_dentry
);
1502 /* Called from selinux_complete_init, try to find a dentry. */
1503 dentry
= d_find_alias(inode
);
1507 * this is can be hit on boot when a file is accessed
1508 * before the policy is loaded. When we load policy we
1509 * may find inodes that have no dentry on the
1510 * sbsec->isec_head list. No reason to complain as these
1511 * will get fixed up the next time we go through
1512 * inode_doinit with a dentry, before these inodes could
1513 * be used again by userspace.
1518 len
= INITCONTEXTLEN
;
1519 context
= kmalloc(len
+1, GFP_NOFS
);
1525 context
[len
] = '\0';
1526 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, context
, len
);
1527 if (rc
== -ERANGE
) {
1530 /* Need a larger buffer. Query for the right size. */
1531 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, NULL
, 0);
1537 context
= kmalloc(len
+1, GFP_NOFS
);
1543 context
[len
] = '\0';
1544 rc
= __vfs_getxattr(dentry
, inode
, XATTR_NAME_SELINUX
, context
, len
);
1548 if (rc
!= -ENODATA
) {
1549 printk(KERN_WARNING
"SELinux: %s: getxattr returned "
1550 "%d for dev=%s ino=%ld\n", __func__
,
1551 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1555 /* Map ENODATA to the default file SID */
1556 sid
= sbsec
->def_sid
;
1559 rc
= security_context_to_sid_default(context
, rc
, &sid
,
1563 char *dev
= inode
->i_sb
->s_id
;
1564 unsigned long ino
= inode
->i_ino
;
1566 if (rc
== -EINVAL
) {
1567 if (printk_ratelimit())
1568 printk(KERN_NOTICE
"SELinux: inode=%lu on dev=%s was found to have an invalid "
1569 "context=%s. This indicates you may need to relabel the inode or the "
1570 "filesystem in question.\n", ino
, dev
, context
);
1572 printk(KERN_WARNING
"SELinux: %s: context_to_sid(%s) "
1573 "returned %d for dev=%s ino=%ld\n",
1574 __func__
, context
, -rc
, dev
, ino
);
1577 /* Leave with the unlabeled SID */
1584 case SECURITY_FS_USE_TASK
:
1587 case SECURITY_FS_USE_TRANS
:
1588 /* Default to the fs SID. */
1591 /* Try to obtain a transition SID. */
1592 rc
= security_transition_sid(task_sid
, sid
, sclass
, NULL
, &sid
);
1596 case SECURITY_FS_USE_MNTPOINT
:
1597 sid
= sbsec
->mntpoint_sid
;
1600 /* Default to the fs superblock SID. */
1603 if ((sbsec
->flags
& SE_SBGENFS
) && !S_ISLNK(inode
->i_mode
)) {
1604 /* We must have a dentry to determine the label on
1607 /* Called from d_instantiate or
1608 * d_splice_alias. */
1609 dentry
= dget(opt_dentry
);
1611 /* Called from selinux_complete_init, try to
1613 dentry
= d_find_alias(inode
);
1615 * This can be hit on boot when a file is accessed
1616 * before the policy is loaded. When we load policy we
1617 * may find inodes that have no dentry on the
1618 * sbsec->isec_head list. No reason to complain as
1619 * these will get fixed up the next time we go through
1620 * inode_doinit() with a dentry, before these inodes
1621 * could be used again by userspace.
1625 rc
= selinux_genfs_get_sid(dentry
, sclass
,
1626 sbsec
->flags
, &sid
);
1635 spin_lock(&isec
->lock
);
1636 if (isec
->initialized
== LABEL_PENDING
) {
1638 isec
->initialized
= LABEL_INVALID
;
1642 isec
->initialized
= LABEL_INITIALIZED
;
1647 spin_unlock(&isec
->lock
);
1651 /* Convert a Linux signal to an access vector. */
1652 static inline u32
signal_to_av(int sig
)
1658 /* Commonly granted from child to parent. */
1659 perm
= PROCESS__SIGCHLD
;
1662 /* Cannot be caught or ignored */
1663 perm
= PROCESS__SIGKILL
;
1666 /* Cannot be caught or ignored */
1667 perm
= PROCESS__SIGSTOP
;
1670 /* All other signals. */
1671 perm
= PROCESS__SIGNAL
;
1678 #if CAP_LAST_CAP > 63
1679 #error Fix SELinux to handle capabilities > 63.
1682 /* Check whether a task is allowed to use a capability. */
1683 static int cred_has_capability(const struct cred
*cred
,
1684 int cap
, int audit
, bool initns
)
1686 struct common_audit_data ad
;
1687 struct av_decision avd
;
1689 u32 sid
= cred_sid(cred
);
1690 u32 av
= CAP_TO_MASK(cap
);
1693 ad
.type
= LSM_AUDIT_DATA_CAP
;
1696 switch (CAP_TO_INDEX(cap
)) {
1698 sclass
= initns
? SECCLASS_CAPABILITY
: SECCLASS_CAP_USERNS
;
1701 sclass
= initns
? SECCLASS_CAPABILITY2
: SECCLASS_CAP2_USERNS
;
1705 "SELinux: out of range capability %d\n", cap
);
1710 rc
= avc_has_perm_noaudit(sid
, sid
, sclass
, av
, 0, &avd
);
1711 if (audit
== SECURITY_CAP_AUDIT
) {
1712 int rc2
= avc_audit(sid
, sid
, sclass
, av
, &avd
, rc
, &ad
, 0);
1719 /* Check whether a task has a particular permission to an inode.
1720 The 'adp' parameter is optional and allows other audit
1721 data to be passed (e.g. the dentry). */
1722 static int inode_has_perm(const struct cred
*cred
,
1723 struct inode
*inode
,
1725 struct common_audit_data
*adp
)
1727 struct inode_security_struct
*isec
;
1730 validate_creds(cred
);
1732 if (unlikely(IS_PRIVATE(inode
)))
1735 sid
= cred_sid(cred
);
1736 isec
= inode
->i_security
;
1738 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742 the dentry to help the auditing code to more easily generate the
1743 pathname if needed. */
1744 static inline int dentry_has_perm(const struct cred
*cred
,
1745 struct dentry
*dentry
,
1748 struct inode
*inode
= d_backing_inode(dentry
);
1749 struct common_audit_data ad
;
1751 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1752 ad
.u
.dentry
= dentry
;
1753 __inode_security_revalidate(inode
, dentry
, true);
1754 return inode_has_perm(cred
, inode
, av
, &ad
);
1757 /* Same as inode_has_perm, but pass explicit audit data containing
1758 the path to help the auditing code to more easily generate the
1759 pathname if needed. */
1760 static inline int path_has_perm(const struct cred
*cred
,
1761 const struct path
*path
,
1764 struct inode
*inode
= d_backing_inode(path
->dentry
);
1765 struct common_audit_data ad
;
1767 ad
.type
= LSM_AUDIT_DATA_PATH
;
1769 __inode_security_revalidate(inode
, path
->dentry
, true);
1770 return inode_has_perm(cred
, inode
, av
, &ad
);
1773 /* Same as path_has_perm, but uses the inode from the file struct. */
1774 static inline int file_path_has_perm(const struct cred
*cred
,
1778 struct common_audit_data ad
;
1780 ad
.type
= LSM_AUDIT_DATA_FILE
;
1782 return inode_has_perm(cred
, file_inode(file
), av
, &ad
);
1785 /* Check whether a task can use an open file descriptor to
1786 access an inode in a given way. Check access to the
1787 descriptor itself, and then use dentry_has_perm to
1788 check a particular permission to the file.
1789 Access to the descriptor is implicitly granted if it
1790 has the same SID as the process. If av is zero, then
1791 access to the file is not checked, e.g. for cases
1792 where only the descriptor is affected like seek. */
1793 static int file_has_perm(const struct cred
*cred
,
1797 struct file_security_struct
*fsec
= file
->f_security
;
1798 struct inode
*inode
= file_inode(file
);
1799 struct common_audit_data ad
;
1800 u32 sid
= cred_sid(cred
);
1803 ad
.type
= LSM_AUDIT_DATA_FILE
;
1806 if (sid
!= fsec
->sid
) {
1807 rc
= avc_has_perm(sid
, fsec
->sid
,
1815 /* av is zero if only checking access to the descriptor. */
1818 rc
= inode_has_perm(cred
, inode
, av
, &ad
);
1825 * Determine the label for an inode that might be unioned.
1828 selinux_determine_inode_label(const struct task_security_struct
*tsec
,
1830 const struct qstr
*name
, u16 tclass
,
1833 const struct superblock_security_struct
*sbsec
= dir
->i_sb
->s_security
;
1835 if ((sbsec
->flags
& SE_SBINITIALIZED
) &&
1836 (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)) {
1837 *_new_isid
= sbsec
->mntpoint_sid
;
1838 } else if ((sbsec
->flags
& SBLABEL_MNT
) &&
1840 *_new_isid
= tsec
->create_sid
;
1842 const struct inode_security_struct
*dsec
= inode_security(dir
);
1843 return security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1850 /* Check whether a task can create a file. */
1851 static int may_create(struct inode
*dir
,
1852 struct dentry
*dentry
,
1855 const struct task_security_struct
*tsec
= current_security();
1856 struct inode_security_struct
*dsec
;
1857 struct superblock_security_struct
*sbsec
;
1859 struct common_audit_data ad
;
1862 dsec
= inode_security(dir
);
1863 sbsec
= dir
->i_sb
->s_security
;
1867 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1868 ad
.u
.dentry
= dentry
;
1870 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
,
1871 DIR__ADD_NAME
| DIR__SEARCH
,
1876 rc
= selinux_determine_inode_label(current_security(), dir
,
1877 &dentry
->d_name
, tclass
, &newsid
);
1881 rc
= avc_has_perm(sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1885 return avc_has_perm(newsid
, sbsec
->sid
,
1886 SECCLASS_FILESYSTEM
,
1887 FILESYSTEM__ASSOCIATE
, &ad
);
1891 #define MAY_UNLINK 1
1894 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1895 static int may_link(struct inode
*dir
,
1896 struct dentry
*dentry
,
1900 struct inode_security_struct
*dsec
, *isec
;
1901 struct common_audit_data ad
;
1902 u32 sid
= current_sid();
1906 dsec
= inode_security(dir
);
1907 isec
= backing_inode_security(dentry
);
1909 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1910 ad
.u
.dentry
= dentry
;
1913 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1914 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1929 printk(KERN_WARNING
"SELinux: %s: unrecognized kind %d\n",
1934 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1938 static inline int may_rename(struct inode
*old_dir
,
1939 struct dentry
*old_dentry
,
1940 struct inode
*new_dir
,
1941 struct dentry
*new_dentry
)
1943 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1944 struct common_audit_data ad
;
1945 u32 sid
= current_sid();
1947 int old_is_dir
, new_is_dir
;
1950 old_dsec
= inode_security(old_dir
);
1951 old_isec
= backing_inode_security(old_dentry
);
1952 old_is_dir
= d_is_dir(old_dentry
);
1953 new_dsec
= inode_security(new_dir
);
1955 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
1957 ad
.u
.dentry
= old_dentry
;
1958 rc
= avc_has_perm(sid
, old_dsec
->sid
, SECCLASS_DIR
,
1959 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1962 rc
= avc_has_perm(sid
, old_isec
->sid
,
1963 old_isec
->sclass
, FILE__RENAME
, &ad
);
1966 if (old_is_dir
&& new_dir
!= old_dir
) {
1967 rc
= avc_has_perm(sid
, old_isec
->sid
,
1968 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1973 ad
.u
.dentry
= new_dentry
;
1974 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1975 if (d_is_positive(new_dentry
))
1976 av
|= DIR__REMOVE_NAME
;
1977 rc
= avc_has_perm(sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1980 if (d_is_positive(new_dentry
)) {
1981 new_isec
= backing_inode_security(new_dentry
);
1982 new_is_dir
= d_is_dir(new_dentry
);
1983 rc
= avc_has_perm(sid
, new_isec
->sid
,
1985 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1993 /* Check whether a task can perform a filesystem operation. */
1994 static int superblock_has_perm(const struct cred
*cred
,
1995 struct super_block
*sb
,
1997 struct common_audit_data
*ad
)
1999 struct superblock_security_struct
*sbsec
;
2000 u32 sid
= cred_sid(cred
);
2002 sbsec
= sb
->s_security
;
2003 return avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
, perms
, ad
);
2006 /* Convert a Linux mode and permission mask to an access vector. */
2007 static inline u32
file_mask_to_av(int mode
, int mask
)
2011 if (!S_ISDIR(mode
)) {
2012 if (mask
& MAY_EXEC
)
2013 av
|= FILE__EXECUTE
;
2014 if (mask
& MAY_READ
)
2017 if (mask
& MAY_APPEND
)
2019 else if (mask
& MAY_WRITE
)
2023 if (mask
& MAY_EXEC
)
2025 if (mask
& MAY_WRITE
)
2027 if (mask
& MAY_READ
)
2034 /* Convert a Linux file to an access vector. */
2035 static inline u32
file_to_av(struct file
*file
)
2039 if (file
->f_mode
& FMODE_READ
)
2041 if (file
->f_mode
& FMODE_WRITE
) {
2042 if (file
->f_flags
& O_APPEND
)
2049 * Special file opened with flags 3 for ioctl-only use.
2058 * Convert a file to an access vector and include the correct open
2061 static inline u32
open_file_to_av(struct file
*file
)
2063 u32 av
= file_to_av(file
);
2065 if (selinux_policycap_openperm
)
2071 /* Hook functions begin here. */
2073 static int selinux_binder_set_context_mgr(struct task_struct
*mgr
)
2075 u32 mysid
= current_sid();
2076 u32 mgrsid
= task_sid(mgr
);
2078 return avc_has_perm(mysid
, mgrsid
, SECCLASS_BINDER
,
2079 BINDER__SET_CONTEXT_MGR
, NULL
);
2082 static int selinux_binder_transaction(struct task_struct
*from
,
2083 struct task_struct
*to
)
2085 u32 mysid
= current_sid();
2086 u32 fromsid
= task_sid(from
);
2087 u32 tosid
= task_sid(to
);
2090 if (mysid
!= fromsid
) {
2091 rc
= avc_has_perm(mysid
, fromsid
, SECCLASS_BINDER
,
2092 BINDER__IMPERSONATE
, NULL
);
2097 return avc_has_perm(fromsid
, tosid
, SECCLASS_BINDER
, BINDER__CALL
,
2101 static int selinux_binder_transfer_binder(struct task_struct
*from
,
2102 struct task_struct
*to
)
2104 u32 fromsid
= task_sid(from
);
2105 u32 tosid
= task_sid(to
);
2107 return avc_has_perm(fromsid
, tosid
, SECCLASS_BINDER
, BINDER__TRANSFER
,
2111 static int selinux_binder_transfer_file(struct task_struct
*from
,
2112 struct task_struct
*to
,
2115 u32 sid
= task_sid(to
);
2116 struct file_security_struct
*fsec
= file
->f_security
;
2117 struct dentry
*dentry
= file
->f_path
.dentry
;
2118 struct inode_security_struct
*isec
;
2119 struct common_audit_data ad
;
2122 ad
.type
= LSM_AUDIT_DATA_PATH
;
2123 ad
.u
.path
= file
->f_path
;
2125 if (sid
!= fsec
->sid
) {
2126 rc
= avc_has_perm(sid
, fsec
->sid
,
2134 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2137 isec
= backing_inode_security(dentry
);
2138 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, file_to_av(file
),
2142 static int selinux_ptrace_access_check(struct task_struct
*child
,
2145 u32 sid
= current_sid();
2146 u32 csid
= task_sid(child
);
2148 if (mode
& PTRACE_MODE_READ
)
2149 return avc_has_perm(sid
, csid
, SECCLASS_FILE
, FILE__READ
, NULL
);
2151 return avc_has_perm(sid
, csid
, SECCLASS_PROCESS
, PROCESS__PTRACE
, NULL
);
2154 static int selinux_ptrace_traceme(struct task_struct
*parent
)
2156 return avc_has_perm(task_sid(parent
), current_sid(), SECCLASS_PROCESS
,
2157 PROCESS__PTRACE
, NULL
);
2160 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
2161 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
2163 return avc_has_perm(current_sid(), task_sid(target
), SECCLASS_PROCESS
,
2164 PROCESS__GETCAP
, NULL
);
2167 static int selinux_capset(struct cred
*new, const struct cred
*old
,
2168 const kernel_cap_t
*effective
,
2169 const kernel_cap_t
*inheritable
,
2170 const kernel_cap_t
*permitted
)
2172 return avc_has_perm(cred_sid(old
), cred_sid(new), SECCLASS_PROCESS
,
2173 PROCESS__SETCAP
, NULL
);
2177 * (This comment used to live with the selinux_task_setuid hook,
2178 * which was removed).
2180 * Since setuid only affects the current process, and since the SELinux
2181 * controls are not based on the Linux identity attributes, SELinux does not
2182 * need to control this operation. However, SELinux does control the use of
2183 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2186 static int selinux_capable(const struct cred
*cred
, struct user_namespace
*ns
,
2189 return cred_has_capability(cred
, cap
, audit
, ns
== &init_user_ns
);
2192 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
2194 const struct cred
*cred
= current_cred();
2206 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAMOD
, NULL
);
2211 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAGET
, NULL
);
2214 rc
= 0; /* let the kernel handle invalid cmds */
2220 static int selinux_quota_on(struct dentry
*dentry
)
2222 const struct cred
*cred
= current_cred();
2224 return dentry_has_perm(cred
, dentry
, FILE__QUOTAON
);
2227 static int selinux_syslog(int type
)
2230 case SYSLOG_ACTION_READ_ALL
: /* Read last kernel messages */
2231 case SYSLOG_ACTION_SIZE_BUFFER
: /* Return size of the log buffer */
2232 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2233 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_READ
, NULL
);
2234 case SYSLOG_ACTION_CONSOLE_OFF
: /* Disable logging to console */
2235 case SYSLOG_ACTION_CONSOLE_ON
: /* Enable logging to console */
2236 /* Set level of messages printed to console */
2237 case SYSLOG_ACTION_CONSOLE_LEVEL
:
2238 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2239 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_CONSOLE
,
2242 /* All other syslog types */
2243 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
2244 SECCLASS_SYSTEM
, SYSTEM__SYSLOG_MOD
, NULL
);
2248 * Check that a process has enough memory to allocate a new virtual
2249 * mapping. 0 means there is enough memory for the allocation to
2250 * succeed and -ENOMEM implies there is not.
2252 * Do not audit the selinux permission check, as this is applied to all
2253 * processes that allocate mappings.
2255 static int selinux_vm_enough_memory(struct mm_struct
*mm
, long pages
)
2257 int rc
, cap_sys_admin
= 0;
2259 rc
= cred_has_capability(current_cred(), CAP_SYS_ADMIN
,
2260 SECURITY_CAP_NOAUDIT
, true);
2264 return cap_sys_admin
;
2267 /* binprm security operations */
2269 static u32
ptrace_parent_sid(void)
2272 struct task_struct
*tracer
;
2275 tracer
= ptrace_parent(current
);
2277 sid
= task_sid(tracer
);
2283 static int check_nnp_nosuid(const struct linux_binprm
*bprm
,
2284 const struct task_security_struct
*old_tsec
,
2285 const struct task_security_struct
*new_tsec
)
2287 int nnp
= (bprm
->unsafe
& LSM_UNSAFE_NO_NEW_PRIVS
);
2288 int nosuid
= !mnt_may_suid(bprm
->file
->f_path
.mnt
);
2291 if (!nnp
&& !nosuid
)
2292 return 0; /* neither NNP nor nosuid */
2294 if (new_tsec
->sid
== old_tsec
->sid
)
2295 return 0; /* No change in credentials */
2298 * The only transitions we permit under NNP or nosuid
2299 * are transitions to bounded SIDs, i.e. SIDs that are
2300 * guaranteed to only be allowed a subset of the permissions
2301 * of the current SID.
2303 rc
= security_bounded_transition(old_tsec
->sid
, new_tsec
->sid
);
2306 * On failure, preserve the errno values for NNP vs nosuid.
2307 * NNP: Operation not permitted for caller.
2308 * nosuid: Permission denied to file.
2318 static int selinux_bprm_set_creds(struct linux_binprm
*bprm
)
2320 const struct task_security_struct
*old_tsec
;
2321 struct task_security_struct
*new_tsec
;
2322 struct inode_security_struct
*isec
;
2323 struct common_audit_data ad
;
2324 struct inode
*inode
= file_inode(bprm
->file
);
2327 /* SELinux context only depends on initial program or script and not
2328 * the script interpreter */
2329 if (bprm
->cred_prepared
)
2332 old_tsec
= current_security();
2333 new_tsec
= bprm
->cred
->security
;
2334 isec
= inode_security(inode
);
2336 /* Default to the current task SID. */
2337 new_tsec
->sid
= old_tsec
->sid
;
2338 new_tsec
->osid
= old_tsec
->sid
;
2340 /* Reset fs, key, and sock SIDs on execve. */
2341 new_tsec
->create_sid
= 0;
2342 new_tsec
->keycreate_sid
= 0;
2343 new_tsec
->sockcreate_sid
= 0;
2345 if (old_tsec
->exec_sid
) {
2346 new_tsec
->sid
= old_tsec
->exec_sid
;
2347 /* Reset exec SID on execve. */
2348 new_tsec
->exec_sid
= 0;
2350 /* Fail on NNP or nosuid if not an allowed transition. */
2351 rc
= check_nnp_nosuid(bprm
, old_tsec
, new_tsec
);
2355 /* Check for a default transition on this program. */
2356 rc
= security_transition_sid(old_tsec
->sid
, isec
->sid
,
2357 SECCLASS_PROCESS
, NULL
,
2363 * Fallback to old SID on NNP or nosuid if not an allowed
2366 rc
= check_nnp_nosuid(bprm
, old_tsec
, new_tsec
);
2368 new_tsec
->sid
= old_tsec
->sid
;
2371 ad
.type
= LSM_AUDIT_DATA_FILE
;
2372 ad
.u
.file
= bprm
->file
;
2374 if (new_tsec
->sid
== old_tsec
->sid
) {
2375 rc
= avc_has_perm(old_tsec
->sid
, isec
->sid
,
2376 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
2380 /* Check permissions for the transition. */
2381 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2382 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
2386 rc
= avc_has_perm(new_tsec
->sid
, isec
->sid
,
2387 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
2391 /* Check for shared state */
2392 if (bprm
->unsafe
& LSM_UNSAFE_SHARE
) {
2393 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2394 SECCLASS_PROCESS
, PROCESS__SHARE
,
2400 /* Make sure that anyone attempting to ptrace over a task that
2401 * changes its SID has the appropriate permit */
2403 (LSM_UNSAFE_PTRACE
| LSM_UNSAFE_PTRACE_CAP
)) {
2404 u32 ptsid
= ptrace_parent_sid();
2406 rc
= avc_has_perm(ptsid
, new_tsec
->sid
,
2408 PROCESS__PTRACE
, NULL
);
2414 /* Clear any possibly unsafe personality bits on exec: */
2415 bprm
->per_clear
|= PER_CLEAR_ON_SETID
;
2421 static int selinux_bprm_secureexec(struct linux_binprm
*bprm
)
2423 const struct task_security_struct
*tsec
= current_security();
2431 /* Enable secure mode for SIDs transitions unless
2432 the noatsecure permission is granted between
2433 the two SIDs, i.e. ahp returns 0. */
2434 atsecure
= avc_has_perm(osid
, sid
,
2436 PROCESS__NOATSECURE
, NULL
);
2442 static int match_file(const void *p
, struct file
*file
, unsigned fd
)
2444 return file_has_perm(p
, file
, file_to_av(file
)) ? fd
+ 1 : 0;
2447 /* Derived from fs/exec.c:flush_old_files. */
2448 static inline void flush_unauthorized_files(const struct cred
*cred
,
2449 struct files_struct
*files
)
2451 struct file
*file
, *devnull
= NULL
;
2452 struct tty_struct
*tty
;
2456 tty
= get_current_tty();
2458 spin_lock(&tty
->files_lock
);
2459 if (!list_empty(&tty
->tty_files
)) {
2460 struct tty_file_private
*file_priv
;
2462 /* Revalidate access to controlling tty.
2463 Use file_path_has_perm on the tty path directly
2464 rather than using file_has_perm, as this particular
2465 open file may belong to another process and we are
2466 only interested in the inode-based check here. */
2467 file_priv
= list_first_entry(&tty
->tty_files
,
2468 struct tty_file_private
, list
);
2469 file
= file_priv
->file
;
2470 if (file_path_has_perm(cred
, file
, FILE__READ
| FILE__WRITE
))
2473 spin_unlock(&tty
->files_lock
);
2476 /* Reset controlling tty. */
2480 /* Revalidate access to inherited open files. */
2481 n
= iterate_fd(files
, 0, match_file
, cred
);
2482 if (!n
) /* none found? */
2485 devnull
= dentry_open(&selinux_null
, O_RDWR
, cred
);
2486 if (IS_ERR(devnull
))
2488 /* replace all the matching ones with this */
2490 replace_fd(n
- 1, devnull
, 0);
2491 } while ((n
= iterate_fd(files
, n
, match_file
, cred
)) != 0);
2497 * Prepare a process for imminent new credential changes due to exec
2499 static void selinux_bprm_committing_creds(struct linux_binprm
*bprm
)
2501 struct task_security_struct
*new_tsec
;
2502 struct rlimit
*rlim
, *initrlim
;
2505 new_tsec
= bprm
->cred
->security
;
2506 if (new_tsec
->sid
== new_tsec
->osid
)
2509 /* Close files for which the new task SID is not authorized. */
2510 flush_unauthorized_files(bprm
->cred
, current
->files
);
2512 /* Always clear parent death signal on SID transitions. */
2513 current
->pdeath_signal
= 0;
2515 /* Check whether the new SID can inherit resource limits from the old
2516 * SID. If not, reset all soft limits to the lower of the current
2517 * task's hard limit and the init task's soft limit.
2519 * Note that the setting of hard limits (even to lower them) can be
2520 * controlled by the setrlimit check. The inclusion of the init task's
2521 * soft limit into the computation is to avoid resetting soft limits
2522 * higher than the default soft limit for cases where the default is
2523 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2525 rc
= avc_has_perm(new_tsec
->osid
, new_tsec
->sid
, SECCLASS_PROCESS
,
2526 PROCESS__RLIMITINH
, NULL
);
2528 /* protect against do_prlimit() */
2530 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
2531 rlim
= current
->signal
->rlim
+ i
;
2532 initrlim
= init_task
.signal
->rlim
+ i
;
2533 rlim
->rlim_cur
= min(rlim
->rlim_max
, initrlim
->rlim_cur
);
2535 task_unlock(current
);
2536 if (IS_ENABLED(CONFIG_POSIX_TIMERS
))
2537 update_rlimit_cpu(current
, rlimit(RLIMIT_CPU
));
2542 * Clean up the process immediately after the installation of new credentials
2545 static void selinux_bprm_committed_creds(struct linux_binprm
*bprm
)
2547 const struct task_security_struct
*tsec
= current_security();
2548 struct itimerval itimer
;
2558 /* Check whether the new SID can inherit signal state from the old SID.
2559 * If not, clear itimers to avoid subsequent signal generation and
2560 * flush and unblock signals.
2562 * This must occur _after_ the task SID has been updated so that any
2563 * kill done after the flush will be checked against the new SID.
2565 rc
= avc_has_perm(osid
, sid
, SECCLASS_PROCESS
, PROCESS__SIGINH
, NULL
);
2567 if (IS_ENABLED(CONFIG_POSIX_TIMERS
)) {
2568 memset(&itimer
, 0, sizeof itimer
);
2569 for (i
= 0; i
< 3; i
++)
2570 do_setitimer(i
, &itimer
, NULL
);
2572 spin_lock_irq(¤t
->sighand
->siglock
);
2573 if (!fatal_signal_pending(current
)) {
2574 flush_sigqueue(¤t
->pending
);
2575 flush_sigqueue(¤t
->signal
->shared_pending
);
2576 flush_signal_handlers(current
, 1);
2577 sigemptyset(¤t
->blocked
);
2578 recalc_sigpending();
2580 spin_unlock_irq(¤t
->sighand
->siglock
);
2583 /* Wake up the parent if it is waiting so that it can recheck
2584 * wait permission to the new task SID. */
2585 read_lock(&tasklist_lock
);
2586 __wake_up_parent(current
, current
->real_parent
);
2587 read_unlock(&tasklist_lock
);
2590 /* superblock security operations */
2592 static int selinux_sb_alloc_security(struct super_block
*sb
)
2594 return superblock_alloc_security(sb
);
2597 static void selinux_sb_free_security(struct super_block
*sb
)
2599 superblock_free_security(sb
);
2602 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
2607 return !memcmp(prefix
, option
, plen
);
2610 static inline int selinux_option(char *option
, int len
)
2612 return (match_prefix(CONTEXT_STR
, sizeof(CONTEXT_STR
)-1, option
, len
) ||
2613 match_prefix(FSCONTEXT_STR
, sizeof(FSCONTEXT_STR
)-1, option
, len
) ||
2614 match_prefix(DEFCONTEXT_STR
, sizeof(DEFCONTEXT_STR
)-1, option
, len
) ||
2615 match_prefix(ROOTCONTEXT_STR
, sizeof(ROOTCONTEXT_STR
)-1, option
, len
) ||
2616 match_prefix(LABELSUPP_STR
, sizeof(LABELSUPP_STR
)-1, option
, len
));
2619 static inline void take_option(char **to
, char *from
, int *first
, int len
)
2626 memcpy(*to
, from
, len
);
2630 static inline void take_selinux_option(char **to
, char *from
, int *first
,
2633 int current_size
= 0;
2641 while (current_size
< len
) {
2651 static int selinux_sb_copy_data(char *orig
, char *copy
)
2653 int fnosec
, fsec
, rc
= 0;
2654 char *in_save
, *in_curr
, *in_end
;
2655 char *sec_curr
, *nosec_save
, *nosec
;
2661 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
2669 in_save
= in_end
= orig
;
2673 open_quote
= !open_quote
;
2674 if ((*in_end
== ',' && open_quote
== 0) ||
2676 int len
= in_end
- in_curr
;
2678 if (selinux_option(in_curr
, len
))
2679 take_selinux_option(&sec_curr
, in_curr
, &fsec
, len
);
2681 take_option(&nosec
, in_curr
, &fnosec
, len
);
2683 in_curr
= in_end
+ 1;
2685 } while (*in_end
++);
2687 strcpy(in_save
, nosec_save
);
2688 free_page((unsigned long)nosec_save
);
2693 static int selinux_sb_remount(struct super_block
*sb
, void *data
)
2696 struct security_mnt_opts opts
;
2697 char *secdata
, **mount_options
;
2698 struct superblock_security_struct
*sbsec
= sb
->s_security
;
2700 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
2706 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
2709 security_init_mnt_opts(&opts
);
2710 secdata
= alloc_secdata();
2713 rc
= selinux_sb_copy_data(data
, secdata
);
2715 goto out_free_secdata
;
2717 rc
= selinux_parse_opts_str(secdata
, &opts
);
2719 goto out_free_secdata
;
2721 mount_options
= opts
.mnt_opts
;
2722 flags
= opts
.mnt_opts_flags
;
2724 for (i
= 0; i
< opts
.num_mnt_opts
; i
++) {
2727 if (flags
[i
] == SBLABEL_MNT
)
2729 rc
= security_context_str_to_sid(mount_options
[i
], &sid
, GFP_KERNEL
);
2731 printk(KERN_WARNING
"SELinux: security_context_str_to_sid"
2732 "(%s) failed for (dev %s, type %s) errno=%d\n",
2733 mount_options
[i
], sb
->s_id
, sb
->s_type
->name
, rc
);
2739 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
, sid
))
2740 goto out_bad_option
;
2743 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
, sid
))
2744 goto out_bad_option
;
2746 case ROOTCONTEXT_MNT
: {
2747 struct inode_security_struct
*root_isec
;
2748 root_isec
= backing_inode_security(sb
->s_root
);
2750 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
, sid
))
2751 goto out_bad_option
;
2754 case DEFCONTEXT_MNT
:
2755 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
, sid
))
2756 goto out_bad_option
;
2765 security_free_mnt_opts(&opts
);
2767 free_secdata(secdata
);
2770 printk(KERN_WARNING
"SELinux: unable to change security options "
2771 "during remount (dev %s, type=%s)\n", sb
->s_id
,
2776 static int selinux_sb_kern_mount(struct super_block
*sb
, int flags
, void *data
)
2778 const struct cred
*cred
= current_cred();
2779 struct common_audit_data ad
;
2782 rc
= superblock_doinit(sb
, data
);
2786 /* Allow all mounts performed by the kernel */
2787 if (flags
& MS_KERNMOUNT
)
2790 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2791 ad
.u
.dentry
= sb
->s_root
;
2792 return superblock_has_perm(cred
, sb
, FILESYSTEM__MOUNT
, &ad
);
2795 static int selinux_sb_statfs(struct dentry
*dentry
)
2797 const struct cred
*cred
= current_cred();
2798 struct common_audit_data ad
;
2800 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2801 ad
.u
.dentry
= dentry
->d_sb
->s_root
;
2802 return superblock_has_perm(cred
, dentry
->d_sb
, FILESYSTEM__GETATTR
, &ad
);
2805 static int selinux_mount(const char *dev_name
,
2806 const struct path
*path
,
2808 unsigned long flags
,
2811 const struct cred
*cred
= current_cred();
2813 if (flags
& MS_REMOUNT
)
2814 return superblock_has_perm(cred
, path
->dentry
->d_sb
,
2815 FILESYSTEM__REMOUNT
, NULL
);
2817 return path_has_perm(cred
, path
, FILE__MOUNTON
);
2820 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
2822 const struct cred
*cred
= current_cred();
2824 return superblock_has_perm(cred
, mnt
->mnt_sb
,
2825 FILESYSTEM__UNMOUNT
, NULL
);
2828 /* inode security operations */
2830 static int selinux_inode_alloc_security(struct inode
*inode
)
2832 return inode_alloc_security(inode
);
2835 static void selinux_inode_free_security(struct inode
*inode
)
2837 inode_free_security(inode
);
2840 static int selinux_dentry_init_security(struct dentry
*dentry
, int mode
,
2841 const struct qstr
*name
, void **ctx
,
2847 rc
= selinux_determine_inode_label(current_security(),
2848 d_inode(dentry
->d_parent
), name
,
2849 inode_mode_to_security_class(mode
),
2854 return security_sid_to_context(newsid
, (char **)ctx
, ctxlen
);
2857 static int selinux_dentry_create_files_as(struct dentry
*dentry
, int mode
,
2859 const struct cred
*old
,
2864 struct task_security_struct
*tsec
;
2866 rc
= selinux_determine_inode_label(old
->security
,
2867 d_inode(dentry
->d_parent
), name
,
2868 inode_mode_to_security_class(mode
),
2873 tsec
= new->security
;
2874 tsec
->create_sid
= newsid
;
2878 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
2879 const struct qstr
*qstr
,
2881 void **value
, size_t *len
)
2883 const struct task_security_struct
*tsec
= current_security();
2884 struct superblock_security_struct
*sbsec
;
2885 u32 sid
, newsid
, clen
;
2889 sbsec
= dir
->i_sb
->s_security
;
2892 newsid
= tsec
->create_sid
;
2894 rc
= selinux_determine_inode_label(current_security(),
2896 inode_mode_to_security_class(inode
->i_mode
),
2901 /* Possibly defer initialization to selinux_complete_init. */
2902 if (sbsec
->flags
& SE_SBINITIALIZED
) {
2903 struct inode_security_struct
*isec
= inode
->i_security
;
2904 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
2906 isec
->initialized
= LABEL_INITIALIZED
;
2909 if (!ss_initialized
|| !(sbsec
->flags
& SBLABEL_MNT
))
2913 *name
= XATTR_SELINUX_SUFFIX
;
2916 rc
= security_sid_to_context_force(newsid
, &context
, &clen
);
2926 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
)
2928 return may_create(dir
, dentry
, SECCLASS_FILE
);
2931 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2933 return may_link(dir
, old_dentry
, MAY_LINK
);
2936 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2938 return may_link(dir
, dentry
, MAY_UNLINK
);
2941 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2943 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2946 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, umode_t mask
)
2948 return may_create(dir
, dentry
, SECCLASS_DIR
);
2951 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2953 return may_link(dir
, dentry
, MAY_RMDIR
);
2956 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
, dev_t dev
)
2958 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2961 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2962 struct inode
*new_inode
, struct dentry
*new_dentry
)
2964 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2967 static int selinux_inode_readlink(struct dentry
*dentry
)
2969 const struct cred
*cred
= current_cred();
2971 return dentry_has_perm(cred
, dentry
, FILE__READ
);
2974 static int selinux_inode_follow_link(struct dentry
*dentry
, struct inode
*inode
,
2977 const struct cred
*cred
= current_cred();
2978 struct common_audit_data ad
;
2979 struct inode_security_struct
*isec
;
2982 validate_creds(cred
);
2984 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
2985 ad
.u
.dentry
= dentry
;
2986 sid
= cred_sid(cred
);
2987 isec
= inode_security_rcu(inode
, rcu
);
2989 return PTR_ERR(isec
);
2991 return avc_has_perm_flags(sid
, isec
->sid
, isec
->sclass
, FILE__READ
, &ad
,
2992 rcu
? MAY_NOT_BLOCK
: 0);
2995 static noinline
int audit_inode_permission(struct inode
*inode
,
2996 u32 perms
, u32 audited
, u32 denied
,
3000 struct common_audit_data ad
;
3001 struct inode_security_struct
*isec
= inode
->i_security
;
3004 ad
.type
= LSM_AUDIT_DATA_INODE
;
3007 rc
= slow_avc_audit(current_sid(), isec
->sid
, isec
->sclass
, perms
,
3008 audited
, denied
, result
, &ad
, flags
);
3014 static int selinux_inode_permission(struct inode
*inode
, int mask
)
3016 const struct cred
*cred
= current_cred();
3019 unsigned flags
= mask
& MAY_NOT_BLOCK
;
3020 struct inode_security_struct
*isec
;
3022 struct av_decision avd
;
3024 u32 audited
, denied
;
3026 from_access
= mask
& MAY_ACCESS
;
3027 mask
&= (MAY_READ
|MAY_WRITE
|MAY_EXEC
|MAY_APPEND
);
3029 /* No permission to check. Existence test. */
3033 validate_creds(cred
);
3035 if (unlikely(IS_PRIVATE(inode
)))
3038 perms
= file_mask_to_av(inode
->i_mode
, mask
);
3040 sid
= cred_sid(cred
);
3041 isec
= inode_security_rcu(inode
, flags
& MAY_NOT_BLOCK
);
3043 return PTR_ERR(isec
);
3045 rc
= avc_has_perm_noaudit(sid
, isec
->sid
, isec
->sclass
, perms
, 0, &avd
);
3046 audited
= avc_audit_required(perms
, &avd
, rc
,
3047 from_access
? FILE__AUDIT_ACCESS
: 0,
3049 if (likely(!audited
))
3052 rc2
= audit_inode_permission(inode
, perms
, audited
, denied
, rc
, flags
);
3058 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
3060 const struct cred
*cred
= current_cred();
3061 unsigned int ia_valid
= iattr
->ia_valid
;
3062 __u32 av
= FILE__WRITE
;
3064 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3065 if (ia_valid
& ATTR_FORCE
) {
3066 ia_valid
&= ~(ATTR_KILL_SUID
| ATTR_KILL_SGID
| ATTR_MODE
|
3072 if (ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
3073 ATTR_ATIME_SET
| ATTR_MTIME_SET
| ATTR_TIMES_SET
))
3074 return dentry_has_perm(cred
, dentry
, FILE__SETATTR
);
3076 if (selinux_policycap_openperm
&& (ia_valid
& ATTR_SIZE
)
3077 && !(ia_valid
& ATTR_FILE
))
3080 return dentry_has_perm(cred
, dentry
, av
);
3083 static int selinux_inode_getattr(const struct path
*path
)
3085 return path_has_perm(current_cred(), path
, FILE__GETATTR
);
3088 static int selinux_inode_setotherxattr(struct dentry
*dentry
, const char *name
)
3090 const struct cred
*cred
= current_cred();
3092 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
3093 sizeof XATTR_SECURITY_PREFIX
- 1)) {
3094 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
3095 if (!capable(CAP_SETFCAP
))
3097 } else if (!capable(CAP_SYS_ADMIN
)) {
3098 /* A different attribute in the security namespace.
3099 Restrict to administrator. */
3104 /* Not an attribute we recognize, so just check the
3105 ordinary setattr permission. */
3106 return dentry_has_perm(cred
, dentry
, FILE__SETATTR
);
3109 static int selinux_inode_setxattr(struct dentry
*dentry
, const char *name
,
3110 const void *value
, size_t size
, int flags
)
3112 struct inode
*inode
= d_backing_inode(dentry
);
3113 struct inode_security_struct
*isec
;
3114 struct superblock_security_struct
*sbsec
;
3115 struct common_audit_data ad
;
3116 u32 newsid
, sid
= current_sid();
3119 if (strcmp(name
, XATTR_NAME_SELINUX
))
3120 return selinux_inode_setotherxattr(dentry
, name
);
3122 sbsec
= inode
->i_sb
->s_security
;
3123 if (!(sbsec
->flags
& SBLABEL_MNT
))
3126 if (!inode_owner_or_capable(inode
))
3129 ad
.type
= LSM_AUDIT_DATA_DENTRY
;
3130 ad
.u
.dentry
= dentry
;
3132 isec
= backing_inode_security(dentry
);
3133 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
,
3134 FILE__RELABELFROM
, &ad
);
3138 rc
= security_context_to_sid(value
, size
, &newsid
, GFP_KERNEL
);
3139 if (rc
== -EINVAL
) {
3140 if (!capable(CAP_MAC_ADMIN
)) {
3141 struct audit_buffer
*ab
;
3145 /* We strip a nul only if it is at the end, otherwise the
3146 * context contains a nul and we should audit that */
3149 if (str
[size
- 1] == '\0')
3150 audit_size
= size
- 1;
3157 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
);
3158 audit_log_format(ab
, "op=setxattr invalid_context=");
3159 audit_log_n_untrustedstring(ab
, value
, audit_size
);
3164 rc
= security_context_to_sid_force(value
, size
, &newsid
);
3169 rc
= avc_has_perm(sid
, newsid
, isec
->sclass
,
3170 FILE__RELABELTO
, &ad
);
3174 rc
= security_validate_transition(isec
->sid
, newsid
, sid
,
3179 return avc_has_perm(newsid
,
3181 SECCLASS_FILESYSTEM
,
3182 FILESYSTEM__ASSOCIATE
,
3186 static void selinux_inode_post_setxattr(struct dentry
*dentry
, const char *name
,
3187 const void *value
, size_t size
,
3190 struct inode
*inode
= d_backing_inode(dentry
);
3191 struct inode_security_struct
*isec
;
3195 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
3196 /* Not an attribute we recognize, so nothing to do. */
3200 rc
= security_context_to_sid_force(value
, size
, &newsid
);
3202 printk(KERN_ERR
"SELinux: unable to map context to SID"
3203 "for (%s, %lu), rc=%d\n",
3204 inode
->i_sb
->s_id
, inode
->i_ino
, -rc
);
3208 isec
= backing_inode_security(dentry
);
3209 spin_lock(&isec
->lock
);
3210 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3212 isec
->initialized
= LABEL_INITIALIZED
;
3213 spin_unlock(&isec
->lock
);
3218 static int selinux_inode_getxattr(struct dentry
*dentry
, const char *name
)
3220 const struct cred
*cred
= current_cred();
3222 return dentry_has_perm(cred
, dentry
, FILE__GETATTR
);
3225 static int selinux_inode_listxattr(struct dentry
*dentry
)
3227 const struct cred
*cred
= current_cred();
3229 return dentry_has_perm(cred
, dentry
, FILE__GETATTR
);
3232 static int selinux_inode_removexattr(struct dentry
*dentry
, const char *name
)
3234 if (strcmp(name
, XATTR_NAME_SELINUX
))
3235 return selinux_inode_setotherxattr(dentry
, name
);
3237 /* No one is allowed to remove a SELinux security label.
3238 You can change the label, but all data must be labeled. */
3243 * Copy the inode security context value to the user.
3245 * Permission check is handled by selinux_inode_getxattr hook.
3247 static int selinux_inode_getsecurity(struct inode
*inode
, const char *name
, void **buffer
, bool alloc
)
3251 char *context
= NULL
;
3252 struct inode_security_struct
*isec
;
3254 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
3258 * If the caller has CAP_MAC_ADMIN, then get the raw context
3259 * value even if it is not defined by current policy; otherwise,
3260 * use the in-core value under current policy.
3261 * Use the non-auditing forms of the permission checks since
3262 * getxattr may be called by unprivileged processes commonly
3263 * and lack of permission just means that we fall back to the
3264 * in-core context value, not a denial.
3266 error
= cap_capable(current_cred(), &init_user_ns
, CAP_MAC_ADMIN
,
3267 SECURITY_CAP_NOAUDIT
);
3269 error
= cred_has_capability(current_cred(), CAP_MAC_ADMIN
,
3270 SECURITY_CAP_NOAUDIT
, true);
3271 isec
= inode_security(inode
);
3273 error
= security_sid_to_context_force(isec
->sid
, &context
,
3276 error
= security_sid_to_context(isec
->sid
, &context
, &size
);
3289 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
3290 const void *value
, size_t size
, int flags
)
3292 struct inode_security_struct
*isec
= inode_security_novalidate(inode
);
3296 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
3299 if (!value
|| !size
)
3302 rc
= security_context_to_sid(value
, size
, &newsid
, GFP_KERNEL
);
3306 spin_lock(&isec
->lock
);
3307 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3309 isec
->initialized
= LABEL_INITIALIZED
;
3310 spin_unlock(&isec
->lock
);
3314 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
3316 const int len
= sizeof(XATTR_NAME_SELINUX
);
3317 if (buffer
&& len
<= buffer_size
)
3318 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
3322 static void selinux_inode_getsecid(struct inode
*inode
, u32
*secid
)
3324 struct inode_security_struct
*isec
= inode_security_novalidate(inode
);
3328 static int selinux_inode_copy_up(struct dentry
*src
, struct cred
**new)
3331 struct task_security_struct
*tsec
;
3332 struct cred
*new_creds
= *new;
3334 if (new_creds
== NULL
) {
3335 new_creds
= prepare_creds();
3340 tsec
= new_creds
->security
;
3341 /* Get label from overlay inode and set it in create_sid */
3342 selinux_inode_getsecid(d_inode(src
), &sid
);
3343 tsec
->create_sid
= sid
;
3348 static int selinux_inode_copy_up_xattr(const char *name
)
3350 /* The copy_up hook above sets the initial context on an inode, but we
3351 * don't then want to overwrite it by blindly copying all the lower
3352 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3354 if (strcmp(name
, XATTR_NAME_SELINUX
) == 0)
3355 return 1; /* Discard */
3357 * Any other attribute apart from SELINUX is not claimed, supported
3363 /* file security operations */
3365 static int selinux_revalidate_file_permission(struct file
*file
, int mask
)
3367 const struct cred
*cred
= current_cred();
3368 struct inode
*inode
= file_inode(file
);
3370 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3371 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
3374 return file_has_perm(cred
, file
,
3375 file_mask_to_av(inode
->i_mode
, mask
));
3378 static int selinux_file_permission(struct file
*file
, int mask
)
3380 struct inode
*inode
= file_inode(file
);
3381 struct file_security_struct
*fsec
= file
->f_security
;
3382 struct inode_security_struct
*isec
;
3383 u32 sid
= current_sid();
3386 /* No permission to check. Existence test. */
3389 isec
= inode_security(inode
);
3390 if (sid
== fsec
->sid
&& fsec
->isid
== isec
->sid
&&
3391 fsec
->pseqno
== avc_policy_seqno())
3392 /* No change since file_open check. */
3395 return selinux_revalidate_file_permission(file
, mask
);
3398 static int selinux_file_alloc_security(struct file
*file
)
3400 return file_alloc_security(file
);
3403 static void selinux_file_free_security(struct file
*file
)
3405 file_free_security(file
);
3409 * Check whether a task has the ioctl permission and cmd
3410 * operation to an inode.
3412 static int ioctl_has_perm(const struct cred
*cred
, struct file
*file
,
3413 u32 requested
, u16 cmd
)
3415 struct common_audit_data ad
;
3416 struct file_security_struct
*fsec
= file
->f_security
;
3417 struct inode
*inode
= file_inode(file
);
3418 struct inode_security_struct
*isec
;
3419 struct lsm_ioctlop_audit ioctl
;
3420 u32 ssid
= cred_sid(cred
);
3422 u8 driver
= cmd
>> 8;
3423 u8 xperm
= cmd
& 0xff;
3425 ad
.type
= LSM_AUDIT_DATA_IOCTL_OP
;
3428 ad
.u
.op
->path
= file
->f_path
;
3430 if (ssid
!= fsec
->sid
) {
3431 rc
= avc_has_perm(ssid
, fsec
->sid
,
3439 if (unlikely(IS_PRIVATE(inode
)))
3442 isec
= inode_security(inode
);
3443 rc
= avc_has_extended_perms(ssid
, isec
->sid
, isec
->sclass
,
3444 requested
, driver
, xperm
, &ad
);
3449 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
3452 const struct cred
*cred
= current_cred();
3462 case FS_IOC_GETFLAGS
:
3464 case FS_IOC_GETVERSION
:
3465 error
= file_has_perm(cred
, file
, FILE__GETATTR
);
3468 case FS_IOC_SETFLAGS
:
3470 case FS_IOC_SETVERSION
:
3471 error
= file_has_perm(cred
, file
, FILE__SETATTR
);
3474 /* sys_ioctl() checks */
3478 error
= file_has_perm(cred
, file
, 0);
3483 error
= cred_has_capability(cred
, CAP_SYS_TTY_CONFIG
,
3484 SECURITY_CAP_AUDIT
, true);
3487 /* default case assumes that the command will go
3488 * to the file's ioctl() function.
3491 error
= ioctl_has_perm(cred
, file
, FILE__IOCTL
, (u16
) cmd
);
3496 static int default_noexec
;
3498 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
3500 const struct cred
*cred
= current_cred();
3501 u32 sid
= cred_sid(cred
);
3504 if (default_noexec
&&
3505 (prot
& PROT_EXEC
) && (!file
|| IS_PRIVATE(file_inode(file
)) ||
3506 (!shared
&& (prot
& PROT_WRITE
)))) {
3508 * We are making executable an anonymous mapping or a
3509 * private file mapping that will also be writable.
3510 * This has an additional check.
3512 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3513 PROCESS__EXECMEM
, NULL
);
3519 /* read access is always possible with a mapping */
3520 u32 av
= FILE__READ
;
3522 /* write access only matters if the mapping is shared */
3523 if (shared
&& (prot
& PROT_WRITE
))
3526 if (prot
& PROT_EXEC
)
3527 av
|= FILE__EXECUTE
;
3529 return file_has_perm(cred
, file
, av
);
3536 static int selinux_mmap_addr(unsigned long addr
)
3540 if (addr
< CONFIG_LSM_MMAP_MIN_ADDR
) {
3541 u32 sid
= current_sid();
3542 rc
= avc_has_perm(sid
, sid
, SECCLASS_MEMPROTECT
,
3543 MEMPROTECT__MMAP_ZERO
, NULL
);
3549 static int selinux_mmap_file(struct file
*file
, unsigned long reqprot
,
3550 unsigned long prot
, unsigned long flags
)
3552 if (selinux_checkreqprot
)
3555 return file_map_prot_check(file
, prot
,
3556 (flags
& MAP_TYPE
) == MAP_SHARED
);
3559 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
3560 unsigned long reqprot
,
3563 const struct cred
*cred
= current_cred();
3564 u32 sid
= cred_sid(cred
);
3566 if (selinux_checkreqprot
)
3569 if (default_noexec
&&
3570 (prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXEC
)) {
3572 if (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
3573 vma
->vm_end
<= vma
->vm_mm
->brk
) {
3574 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3575 PROCESS__EXECHEAP
, NULL
);
3576 } else if (!vma
->vm_file
&&
3577 ((vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
3578 vma
->vm_end
>= vma
->vm_mm
->start_stack
) ||
3579 vma_is_stack_for_current(vma
))) {
3580 rc
= avc_has_perm(sid
, sid
, SECCLASS_PROCESS
,
3581 PROCESS__EXECSTACK
, NULL
);
3582 } else if (vma
->vm_file
&& vma
->anon_vma
) {
3584 * We are making executable a file mapping that has
3585 * had some COW done. Since pages might have been
3586 * written, check ability to execute the possibly
3587 * modified content. This typically should only
3588 * occur for text relocations.
3590 rc
= file_has_perm(cred
, vma
->vm_file
, FILE__EXECMOD
);
3596 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
3599 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
3601 const struct cred
*cred
= current_cred();
3603 return file_has_perm(cred
, file
, FILE__LOCK
);
3606 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
3609 const struct cred
*cred
= current_cred();
3614 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
3615 err
= file_has_perm(cred
, file
, FILE__WRITE
);
3624 case F_GETOWNER_UIDS
:
3625 /* Just check FD__USE permission */
3626 err
= file_has_perm(cred
, file
, 0);
3634 #if BITS_PER_LONG == 32
3639 err
= file_has_perm(cred
, file
, FILE__LOCK
);
3646 static void selinux_file_set_fowner(struct file
*file
)
3648 struct file_security_struct
*fsec
;
3650 fsec
= file
->f_security
;
3651 fsec
->fown_sid
= current_sid();
3654 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
3655 struct fown_struct
*fown
, int signum
)
3658 u32 sid
= task_sid(tsk
);
3660 struct file_security_struct
*fsec
;
3662 /* struct fown_struct is never outside the context of a struct file */
3663 file
= container_of(fown
, struct file
, f_owner
);
3665 fsec
= file
->f_security
;
3668 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
3670 perm
= signal_to_av(signum
);
3672 return avc_has_perm(fsec
->fown_sid
, sid
,
3673 SECCLASS_PROCESS
, perm
, NULL
);
3676 static int selinux_file_receive(struct file
*file
)
3678 const struct cred
*cred
= current_cred();
3680 return file_has_perm(cred
, file
, file_to_av(file
));
3683 static int selinux_file_open(struct file
*file
, const struct cred
*cred
)
3685 struct file_security_struct
*fsec
;
3686 struct inode_security_struct
*isec
;
3688 fsec
= file
->f_security
;
3689 isec
= inode_security(file_inode(file
));
3691 * Save inode label and policy sequence number
3692 * at open-time so that selinux_file_permission
3693 * can determine whether revalidation is necessary.
3694 * Task label is already saved in the file security
3695 * struct as its SID.
3697 fsec
->isid
= isec
->sid
;
3698 fsec
->pseqno
= avc_policy_seqno();
3700 * Since the inode label or policy seqno may have changed
3701 * between the selinux_inode_permission check and the saving
3702 * of state above, recheck that access is still permitted.
3703 * Otherwise, access might never be revalidated against the
3704 * new inode label or new policy.
3705 * This check is not redundant - do not remove.
3707 return file_path_has_perm(cred
, file
, open_file_to_av(file
));
3710 /* task security operations */
3712 static int selinux_task_create(unsigned long clone_flags
)
3714 u32 sid
= current_sid();
3716 return avc_has_perm(sid
, sid
, SECCLASS_PROCESS
, PROCESS__FORK
, NULL
);
3720 * allocate the SELinux part of blank credentials
3722 static int selinux_cred_alloc_blank(struct cred
*cred
, gfp_t gfp
)
3724 struct task_security_struct
*tsec
;
3726 tsec
= kzalloc(sizeof(struct task_security_struct
), gfp
);
3730 cred
->security
= tsec
;
3735 * detach and free the LSM part of a set of credentials
3737 static void selinux_cred_free(struct cred
*cred
)
3739 struct task_security_struct
*tsec
= cred
->security
;
3742 * cred->security == NULL if security_cred_alloc_blank() or
3743 * security_prepare_creds() returned an error.
3745 BUG_ON(cred
->security
&& (unsigned long) cred
->security
< PAGE_SIZE
);
3746 cred
->security
= (void *) 0x7UL
;
3751 * prepare a new set of credentials for modification
3753 static int selinux_cred_prepare(struct cred
*new, const struct cred
*old
,
3756 const struct task_security_struct
*old_tsec
;
3757 struct task_security_struct
*tsec
;
3759 old_tsec
= old
->security
;
3761 tsec
= kmemdup(old_tsec
, sizeof(struct task_security_struct
), gfp
);
3765 new->security
= tsec
;
3770 * transfer the SELinux data to a blank set of creds
3772 static void selinux_cred_transfer(struct cred
*new, const struct cred
*old
)
3774 const struct task_security_struct
*old_tsec
= old
->security
;
3775 struct task_security_struct
*tsec
= new->security
;
3781 * set the security data for a kernel service
3782 * - all the creation contexts are set to unlabelled
3784 static int selinux_kernel_act_as(struct cred
*new, u32 secid
)
3786 struct task_security_struct
*tsec
= new->security
;
3787 u32 sid
= current_sid();
3790 ret
= avc_has_perm(sid
, secid
,
3791 SECCLASS_KERNEL_SERVICE
,
3792 KERNEL_SERVICE__USE_AS_OVERRIDE
,
3796 tsec
->create_sid
= 0;
3797 tsec
->keycreate_sid
= 0;
3798 tsec
->sockcreate_sid
= 0;
3804 * set the file creation context in a security record to the same as the
3805 * objective context of the specified inode
3807 static int selinux_kernel_create_files_as(struct cred
*new, struct inode
*inode
)
3809 struct inode_security_struct
*isec
= inode_security(inode
);
3810 struct task_security_struct
*tsec
= new->security
;
3811 u32 sid
= current_sid();
3814 ret
= avc_has_perm(sid
, isec
->sid
,
3815 SECCLASS_KERNEL_SERVICE
,
3816 KERNEL_SERVICE__CREATE_FILES_AS
,
3820 tsec
->create_sid
= isec
->sid
;
3824 static int selinux_kernel_module_request(char *kmod_name
)
3826 struct common_audit_data ad
;
3828 ad
.type
= LSM_AUDIT_DATA_KMOD
;
3829 ad
.u
.kmod_name
= kmod_name
;
3831 return avc_has_perm(current_sid(), SECINITSID_KERNEL
, SECCLASS_SYSTEM
,
3832 SYSTEM__MODULE_REQUEST
, &ad
);
3835 static int selinux_kernel_module_from_file(struct file
*file
)
3837 struct common_audit_data ad
;
3838 struct inode_security_struct
*isec
;
3839 struct file_security_struct
*fsec
;
3840 u32 sid
= current_sid();
3845 return avc_has_perm(sid
, sid
, SECCLASS_SYSTEM
,
3846 SYSTEM__MODULE_LOAD
, NULL
);
3850 ad
.type
= LSM_AUDIT_DATA_FILE
;
3853 fsec
= file
->f_security
;
3854 if (sid
!= fsec
->sid
) {
3855 rc
= avc_has_perm(sid
, fsec
->sid
, SECCLASS_FD
, FD__USE
, &ad
);
3860 isec
= inode_security(file_inode(file
));
3861 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SYSTEM
,
3862 SYSTEM__MODULE_LOAD
, &ad
);
3865 static int selinux_kernel_read_file(struct file
*file
,
3866 enum kernel_read_file_id id
)
3871 case READING_MODULE
:
3872 rc
= selinux_kernel_module_from_file(file
);
3881 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
3883 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3884 PROCESS__SETPGID
, NULL
);
3887 static int selinux_task_getpgid(struct task_struct
*p
)
3889 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3890 PROCESS__GETPGID
, NULL
);
3893 static int selinux_task_getsid(struct task_struct
*p
)
3895 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3896 PROCESS__GETSESSION
, NULL
);
3899 static void selinux_task_getsecid(struct task_struct
*p
, u32
*secid
)
3901 *secid
= task_sid(p
);
3904 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
3906 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3907 PROCESS__SETSCHED
, NULL
);
3910 static int selinux_task_setioprio(struct task_struct
*p
, int ioprio
)
3912 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3913 PROCESS__SETSCHED
, NULL
);
3916 static int selinux_task_getioprio(struct task_struct
*p
)
3918 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3919 PROCESS__GETSCHED
, NULL
);
3922 static int selinux_task_setrlimit(struct task_struct
*p
, unsigned int resource
,
3923 struct rlimit
*new_rlim
)
3925 struct rlimit
*old_rlim
= p
->signal
->rlim
+ resource
;
3927 /* Control the ability to change the hard limit (whether
3928 lowering or raising it), so that the hard limit can
3929 later be used as a safe reset point for the soft limit
3930 upon context transitions. See selinux_bprm_committing_creds. */
3931 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
3932 return avc_has_perm(current_sid(), task_sid(p
),
3933 SECCLASS_PROCESS
, PROCESS__SETRLIMIT
, NULL
);
3938 static int selinux_task_setscheduler(struct task_struct
*p
)
3940 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3941 PROCESS__SETSCHED
, NULL
);
3944 static int selinux_task_getscheduler(struct task_struct
*p
)
3946 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3947 PROCESS__GETSCHED
, NULL
);
3950 static int selinux_task_movememory(struct task_struct
*p
)
3952 return avc_has_perm(current_sid(), task_sid(p
), SECCLASS_PROCESS
,
3953 PROCESS__SETSCHED
, NULL
);
3956 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
,
3962 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
3964 perm
= signal_to_av(sig
);
3966 secid
= current_sid();
3967 return avc_has_perm(secid
, task_sid(p
), SECCLASS_PROCESS
, perm
, NULL
);
3970 static void selinux_task_to_inode(struct task_struct
*p
,
3971 struct inode
*inode
)
3973 struct inode_security_struct
*isec
= inode
->i_security
;
3974 u32 sid
= task_sid(p
);
3976 spin_lock(&isec
->lock
);
3977 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
3979 isec
->initialized
= LABEL_INITIALIZED
;
3980 spin_unlock(&isec
->lock
);
3983 /* Returns error only if unable to parse addresses */
3984 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
,
3985 struct common_audit_data
*ad
, u8
*proto
)
3987 int offset
, ihlen
, ret
= -EINVAL
;
3988 struct iphdr _iph
, *ih
;
3990 offset
= skb_network_offset(skb
);
3991 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
3995 ihlen
= ih
->ihl
* 4;
3996 if (ihlen
< sizeof(_iph
))
3999 ad
->u
.net
->v4info
.saddr
= ih
->saddr
;
4000 ad
->u
.net
->v4info
.daddr
= ih
->daddr
;
4004 *proto
= ih
->protocol
;
4006 switch (ih
->protocol
) {
4008 struct tcphdr _tcph
, *th
;
4010 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4014 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
4018 ad
->u
.net
->sport
= th
->source
;
4019 ad
->u
.net
->dport
= th
->dest
;
4024 struct udphdr _udph
, *uh
;
4026 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4030 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
4034 ad
->u
.net
->sport
= uh
->source
;
4035 ad
->u
.net
->dport
= uh
->dest
;
4039 case IPPROTO_DCCP
: {
4040 struct dccp_hdr _dccph
, *dh
;
4042 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
4046 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
4050 ad
->u
.net
->sport
= dh
->dccph_sport
;
4051 ad
->u
.net
->dport
= dh
->dccph_dport
;
4062 #if IS_ENABLED(CONFIG_IPV6)
4064 /* Returns error only if unable to parse addresses */
4065 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
,
4066 struct common_audit_data
*ad
, u8
*proto
)
4069 int ret
= -EINVAL
, offset
;
4070 struct ipv6hdr _ipv6h
, *ip6
;
4073 offset
= skb_network_offset(skb
);
4074 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
4078 ad
->u
.net
->v6info
.saddr
= ip6
->saddr
;
4079 ad
->u
.net
->v6info
.daddr
= ip6
->daddr
;
4082 nexthdr
= ip6
->nexthdr
;
4083 offset
+= sizeof(_ipv6h
);
4084 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
, &frag_off
);
4093 struct tcphdr _tcph
, *th
;
4095 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
4099 ad
->u
.net
->sport
= th
->source
;
4100 ad
->u
.net
->dport
= th
->dest
;
4105 struct udphdr _udph
, *uh
;
4107 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
4111 ad
->u
.net
->sport
= uh
->source
;
4112 ad
->u
.net
->dport
= uh
->dest
;
4116 case IPPROTO_DCCP
: {
4117 struct dccp_hdr _dccph
, *dh
;
4119 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
4123 ad
->u
.net
->sport
= dh
->dccph_sport
;
4124 ad
->u
.net
->dport
= dh
->dccph_dport
;
4128 /* includes fragments */
4138 static int selinux_parse_skb(struct sk_buff
*skb
, struct common_audit_data
*ad
,
4139 char **_addrp
, int src
, u8
*proto
)
4144 switch (ad
->u
.net
->family
) {
4146 ret
= selinux_parse_skb_ipv4(skb
, ad
, proto
);
4149 addrp
= (char *)(src
? &ad
->u
.net
->v4info
.saddr
:
4150 &ad
->u
.net
->v4info
.daddr
);
4153 #if IS_ENABLED(CONFIG_IPV6)
4155 ret
= selinux_parse_skb_ipv6(skb
, ad
, proto
);
4158 addrp
= (char *)(src
? &ad
->u
.net
->v6info
.saddr
:
4159 &ad
->u
.net
->v6info
.daddr
);
4169 "SELinux: failure in selinux_parse_skb(),"
4170 " unable to parse packet\n");
4180 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4182 * @family: protocol family
4183 * @sid: the packet's peer label SID
4186 * Check the various different forms of network peer labeling and determine
4187 * the peer label/SID for the packet; most of the magic actually occurs in
4188 * the security server function security_net_peersid_cmp(). The function
4189 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4190 * or -EACCES if @sid is invalid due to inconsistencies with the different
4194 static int selinux_skb_peerlbl_sid(struct sk_buff
*skb
, u16 family
, u32
*sid
)
4201 err
= selinux_xfrm_skb_sid(skb
, &xfrm_sid
);
4204 err
= selinux_netlbl_skbuff_getsid(skb
, family
, &nlbl_type
, &nlbl_sid
);
4208 err
= security_net_peersid_resolve(nlbl_sid
, nlbl_type
, xfrm_sid
, sid
);
4209 if (unlikely(err
)) {
4211 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4212 " unable to determine packet's peer label\n");
4220 * selinux_conn_sid - Determine the child socket label for a connection
4221 * @sk_sid: the parent socket's SID
4222 * @skb_sid: the packet's SID
4223 * @conn_sid: the resulting connection SID
4225 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4226 * combined with the MLS information from @skb_sid in order to create
4227 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4228 * of @sk_sid. Returns zero on success, negative values on failure.
4231 static int selinux_conn_sid(u32 sk_sid
, u32 skb_sid
, u32
*conn_sid
)
4235 if (skb_sid
!= SECSID_NULL
)
4236 err
= security_sid_mls_copy(sk_sid
, skb_sid
, conn_sid
);
4243 /* socket security operations */
4245 static int socket_sockcreate_sid(const struct task_security_struct
*tsec
,
4246 u16 secclass
, u32
*socksid
)
4248 if (tsec
->sockcreate_sid
> SECSID_NULL
) {
4249 *socksid
= tsec
->sockcreate_sid
;
4253 return security_transition_sid(tsec
->sid
, tsec
->sid
, secclass
, NULL
,
4257 static int sock_has_perm(struct sock
*sk
, u32 perms
)
4259 struct sk_security_struct
*sksec
= sk
->sk_security
;
4260 struct common_audit_data ad
;
4261 struct lsm_network_audit net
= {0,};
4263 if (sksec
->sid
== SECINITSID_KERNEL
)
4266 ad
.type
= LSM_AUDIT_DATA_NET
;
4270 return avc_has_perm(current_sid(), sksec
->sid
, sksec
->sclass
, perms
,
4274 static int selinux_socket_create(int family
, int type
,
4275 int protocol
, int kern
)
4277 const struct task_security_struct
*tsec
= current_security();
4285 secclass
= socket_type_to_security_class(family
, type
, protocol
);
4286 rc
= socket_sockcreate_sid(tsec
, secclass
, &newsid
);
4290 return avc_has_perm(tsec
->sid
, newsid
, secclass
, SOCKET__CREATE
, NULL
);
4293 static int selinux_socket_post_create(struct socket
*sock
, int family
,
4294 int type
, int protocol
, int kern
)
4296 const struct task_security_struct
*tsec
= current_security();
4297 struct inode_security_struct
*isec
= inode_security_novalidate(SOCK_INODE(sock
));
4298 struct sk_security_struct
*sksec
;
4299 u16 sclass
= socket_type_to_security_class(family
, type
, protocol
);
4300 u32 sid
= SECINITSID_KERNEL
;
4304 err
= socket_sockcreate_sid(tsec
, sclass
, &sid
);
4309 isec
->sclass
= sclass
;
4311 isec
->initialized
= LABEL_INITIALIZED
;
4314 sksec
= sock
->sk
->sk_security
;
4315 sksec
->sclass
= sclass
;
4317 err
= selinux_netlbl_socket_post_create(sock
->sk
, family
);
4323 /* Range of port numbers used to automatically bind.
4324 Need to determine whether we should perform a name_bind
4325 permission check between the socket and the port number. */
4327 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
4329 struct sock
*sk
= sock
->sk
;
4333 err
= sock_has_perm(sk
, SOCKET__BIND
);
4338 * If PF_INET or PF_INET6, check name_bind permission for the port.
4339 * Multiple address binding for SCTP is not supported yet: we just
4340 * check the first address now.
4342 family
= sk
->sk_family
;
4343 if (family
== PF_INET
|| family
== PF_INET6
) {
4345 struct sk_security_struct
*sksec
= sk
->sk_security
;
4346 struct common_audit_data ad
;
4347 struct lsm_network_audit net
= {0,};
4348 struct sockaddr_in
*addr4
= NULL
;
4349 struct sockaddr_in6
*addr6
= NULL
;
4350 unsigned short snum
;
4353 if (family
== PF_INET
) {
4354 addr4
= (struct sockaddr_in
*)address
;
4355 snum
= ntohs(addr4
->sin_port
);
4356 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
4358 addr6
= (struct sockaddr_in6
*)address
;
4359 snum
= ntohs(addr6
->sin6_port
);
4360 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
4366 inet_get_local_port_range(sock_net(sk
), &low
, &high
);
4368 if (snum
< max(inet_prot_sock(sock_net(sk
)), low
) ||
4370 err
= sel_netport_sid(sk
->sk_protocol
,
4374 ad
.type
= LSM_AUDIT_DATA_NET
;
4376 ad
.u
.net
->sport
= htons(snum
);
4377 ad
.u
.net
->family
= family
;
4378 err
= avc_has_perm(sksec
->sid
, sid
,
4380 SOCKET__NAME_BIND
, &ad
);
4386 switch (sksec
->sclass
) {
4387 case SECCLASS_TCP_SOCKET
:
4388 node_perm
= TCP_SOCKET__NODE_BIND
;
4391 case SECCLASS_UDP_SOCKET
:
4392 node_perm
= UDP_SOCKET__NODE_BIND
;
4395 case SECCLASS_DCCP_SOCKET
:
4396 node_perm
= DCCP_SOCKET__NODE_BIND
;
4400 node_perm
= RAWIP_SOCKET__NODE_BIND
;
4404 err
= sel_netnode_sid(addrp
, family
, &sid
);
4408 ad
.type
= LSM_AUDIT_DATA_NET
;
4410 ad
.u
.net
->sport
= htons(snum
);
4411 ad
.u
.net
->family
= family
;
4413 if (family
== PF_INET
)
4414 ad
.u
.net
->v4info
.saddr
= addr4
->sin_addr
.s_addr
;
4416 ad
.u
.net
->v6info
.saddr
= addr6
->sin6_addr
;
4418 err
= avc_has_perm(sksec
->sid
, sid
,
4419 sksec
->sclass
, node_perm
, &ad
);
4427 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
4429 struct sock
*sk
= sock
->sk
;
4430 struct sk_security_struct
*sksec
= sk
->sk_security
;
4433 err
= sock_has_perm(sk
, SOCKET__CONNECT
);
4438 * If a TCP or DCCP socket, check name_connect permission for the port.
4440 if (sksec
->sclass
== SECCLASS_TCP_SOCKET
||
4441 sksec
->sclass
== SECCLASS_DCCP_SOCKET
) {
4442 struct common_audit_data ad
;
4443 struct lsm_network_audit net
= {0,};
4444 struct sockaddr_in
*addr4
= NULL
;
4445 struct sockaddr_in6
*addr6
= NULL
;
4446 unsigned short snum
;
4449 if (sk
->sk_family
== PF_INET
) {
4450 addr4
= (struct sockaddr_in
*)address
;
4451 if (addrlen
< sizeof(struct sockaddr_in
))
4453 snum
= ntohs(addr4
->sin_port
);
4455 addr6
= (struct sockaddr_in6
*)address
;
4456 if (addrlen
< SIN6_LEN_RFC2133
)
4458 snum
= ntohs(addr6
->sin6_port
);
4461 err
= sel_netport_sid(sk
->sk_protocol
, snum
, &sid
);
4465 perm
= (sksec
->sclass
== SECCLASS_TCP_SOCKET
) ?
4466 TCP_SOCKET__NAME_CONNECT
: DCCP_SOCKET__NAME_CONNECT
;
4468 ad
.type
= LSM_AUDIT_DATA_NET
;
4470 ad
.u
.net
->dport
= htons(snum
);
4471 ad
.u
.net
->family
= sk
->sk_family
;
4472 err
= avc_has_perm(sksec
->sid
, sid
, sksec
->sclass
, perm
, &ad
);
4477 err
= selinux_netlbl_socket_connect(sk
, address
);
4483 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
4485 return sock_has_perm(sock
->sk
, SOCKET__LISTEN
);
4488 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
4491 struct inode_security_struct
*isec
;
4492 struct inode_security_struct
*newisec
;
4496 err
= sock_has_perm(sock
->sk
, SOCKET__ACCEPT
);
4500 isec
= inode_security_novalidate(SOCK_INODE(sock
));
4501 spin_lock(&isec
->lock
);
4502 sclass
= isec
->sclass
;
4504 spin_unlock(&isec
->lock
);
4506 newisec
= inode_security_novalidate(SOCK_INODE(newsock
));
4507 newisec
->sclass
= sclass
;
4509 newisec
->initialized
= LABEL_INITIALIZED
;
4514 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
4517 return sock_has_perm(sock
->sk
, SOCKET__WRITE
);
4520 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
4521 int size
, int flags
)
4523 return sock_has_perm(sock
->sk
, SOCKET__READ
);
4526 static int selinux_socket_getsockname(struct socket
*sock
)
4528 return sock_has_perm(sock
->sk
, SOCKET__GETATTR
);
4531 static int selinux_socket_getpeername(struct socket
*sock
)
4533 return sock_has_perm(sock
->sk
, SOCKET__GETATTR
);
4536 static int selinux_socket_setsockopt(struct socket
*sock
, int level
, int optname
)
4540 err
= sock_has_perm(sock
->sk
, SOCKET__SETOPT
);
4544 return selinux_netlbl_socket_setsockopt(sock
, level
, optname
);
4547 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
4550 return sock_has_perm(sock
->sk
, SOCKET__GETOPT
);
4553 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
4555 return sock_has_perm(sock
->sk
, SOCKET__SHUTDOWN
);
4558 static int selinux_socket_unix_stream_connect(struct sock
*sock
,
4562 struct sk_security_struct
*sksec_sock
= sock
->sk_security
;
4563 struct sk_security_struct
*sksec_other
= other
->sk_security
;
4564 struct sk_security_struct
*sksec_new
= newsk
->sk_security
;
4565 struct common_audit_data ad
;
4566 struct lsm_network_audit net
= {0,};
4569 ad
.type
= LSM_AUDIT_DATA_NET
;
4571 ad
.u
.net
->sk
= other
;
4573 err
= avc_has_perm(sksec_sock
->sid
, sksec_other
->sid
,
4574 sksec_other
->sclass
,
4575 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
4579 /* server child socket */
4580 sksec_new
->peer_sid
= sksec_sock
->sid
;
4581 err
= security_sid_mls_copy(sksec_other
->sid
, sksec_sock
->sid
,
4586 /* connecting socket */
4587 sksec_sock
->peer_sid
= sksec_new
->sid
;
4592 static int selinux_socket_unix_may_send(struct socket
*sock
,
4593 struct socket
*other
)
4595 struct sk_security_struct
*ssec
= sock
->sk
->sk_security
;
4596 struct sk_security_struct
*osec
= other
->sk
->sk_security
;
4597 struct common_audit_data ad
;
4598 struct lsm_network_audit net
= {0,};
4600 ad
.type
= LSM_AUDIT_DATA_NET
;
4602 ad
.u
.net
->sk
= other
->sk
;
4604 return avc_has_perm(ssec
->sid
, osec
->sid
, osec
->sclass
, SOCKET__SENDTO
,
4608 static int selinux_inet_sys_rcv_skb(struct net
*ns
, int ifindex
,
4609 char *addrp
, u16 family
, u32 peer_sid
,
4610 struct common_audit_data
*ad
)
4616 err
= sel_netif_sid(ns
, ifindex
, &if_sid
);
4619 err
= avc_has_perm(peer_sid
, if_sid
,
4620 SECCLASS_NETIF
, NETIF__INGRESS
, ad
);
4624 err
= sel_netnode_sid(addrp
, family
, &node_sid
);
4627 return avc_has_perm(peer_sid
, node_sid
,
4628 SECCLASS_NODE
, NODE__RECVFROM
, ad
);
4631 static int selinux_sock_rcv_skb_compat(struct sock
*sk
, struct sk_buff
*skb
,
4635 struct sk_security_struct
*sksec
= sk
->sk_security
;
4636 u32 sk_sid
= sksec
->sid
;
4637 struct common_audit_data ad
;
4638 struct lsm_network_audit net
= {0,};
4641 ad
.type
= LSM_AUDIT_DATA_NET
;
4643 ad
.u
.net
->netif
= skb
->skb_iif
;
4644 ad
.u
.net
->family
= family
;
4645 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4649 if (selinux_secmark_enabled()) {
4650 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4656 err
= selinux_netlbl_sock_rcv_skb(sksec
, skb
, family
, &ad
);
4659 err
= selinux_xfrm_sock_rcv_skb(sksec
->sid
, skb
, &ad
);
4664 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
4667 struct sk_security_struct
*sksec
= sk
->sk_security
;
4668 u16 family
= sk
->sk_family
;
4669 u32 sk_sid
= sksec
->sid
;
4670 struct common_audit_data ad
;
4671 struct lsm_network_audit net
= {0,};
4676 if (family
!= PF_INET
&& family
!= PF_INET6
)
4679 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4680 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4683 /* If any sort of compatibility mode is enabled then handoff processing
4684 * to the selinux_sock_rcv_skb_compat() function to deal with the
4685 * special handling. We do this in an attempt to keep this function
4686 * as fast and as clean as possible. */
4687 if (!selinux_policycap_netpeer
)
4688 return selinux_sock_rcv_skb_compat(sk
, skb
, family
);
4690 secmark_active
= selinux_secmark_enabled();
4691 peerlbl_active
= selinux_peerlbl_enabled();
4692 if (!secmark_active
&& !peerlbl_active
)
4695 ad
.type
= LSM_AUDIT_DATA_NET
;
4697 ad
.u
.net
->netif
= skb
->skb_iif
;
4698 ad
.u
.net
->family
= family
;
4699 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4703 if (peerlbl_active
) {
4706 err
= selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
);
4709 err
= selinux_inet_sys_rcv_skb(sock_net(sk
), skb
->skb_iif
,
4710 addrp
, family
, peer_sid
, &ad
);
4712 selinux_netlbl_err(skb
, family
, err
, 0);
4715 err
= avc_has_perm(sk_sid
, peer_sid
, SECCLASS_PEER
,
4718 selinux_netlbl_err(skb
, family
, err
, 0);
4723 if (secmark_active
) {
4724 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4733 static int selinux_socket_getpeersec_stream(struct socket
*sock
, char __user
*optval
,
4734 int __user
*optlen
, unsigned len
)
4739 struct sk_security_struct
*sksec
= sock
->sk
->sk_security
;
4740 u32 peer_sid
= SECSID_NULL
;
4742 if (sksec
->sclass
== SECCLASS_UNIX_STREAM_SOCKET
||
4743 sksec
->sclass
== SECCLASS_TCP_SOCKET
)
4744 peer_sid
= sksec
->peer_sid
;
4745 if (peer_sid
== SECSID_NULL
)
4746 return -ENOPROTOOPT
;
4748 err
= security_sid_to_context(peer_sid
, &scontext
, &scontext_len
);
4752 if (scontext_len
> len
) {
4757 if (copy_to_user(optval
, scontext
, scontext_len
))
4761 if (put_user(scontext_len
, optlen
))
4767 static int selinux_socket_getpeersec_dgram(struct socket
*sock
, struct sk_buff
*skb
, u32
*secid
)
4769 u32 peer_secid
= SECSID_NULL
;
4771 struct inode_security_struct
*isec
;
4773 if (skb
&& skb
->protocol
== htons(ETH_P_IP
))
4775 else if (skb
&& skb
->protocol
== htons(ETH_P_IPV6
))
4778 family
= sock
->sk
->sk_family
;
4782 if (sock
&& family
== PF_UNIX
) {
4783 isec
= inode_security_novalidate(SOCK_INODE(sock
));
4784 peer_secid
= isec
->sid
;
4786 selinux_skb_peerlbl_sid(skb
, family
, &peer_secid
);
4789 *secid
= peer_secid
;
4790 if (peer_secid
== SECSID_NULL
)
4795 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
4797 struct sk_security_struct
*sksec
;
4799 sksec
= kzalloc(sizeof(*sksec
), priority
);
4803 sksec
->peer_sid
= SECINITSID_UNLABELED
;
4804 sksec
->sid
= SECINITSID_UNLABELED
;
4805 sksec
->sclass
= SECCLASS_SOCKET
;
4806 selinux_netlbl_sk_security_reset(sksec
);
4807 sk
->sk_security
= sksec
;
4812 static void selinux_sk_free_security(struct sock
*sk
)
4814 struct sk_security_struct
*sksec
= sk
->sk_security
;
4816 sk
->sk_security
= NULL
;
4817 selinux_netlbl_sk_security_free(sksec
);
4821 static void selinux_sk_clone_security(const struct sock
*sk
, struct sock
*newsk
)
4823 struct sk_security_struct
*sksec
= sk
->sk_security
;
4824 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4826 newsksec
->sid
= sksec
->sid
;
4827 newsksec
->peer_sid
= sksec
->peer_sid
;
4828 newsksec
->sclass
= sksec
->sclass
;
4830 selinux_netlbl_sk_security_reset(newsksec
);
4833 static void selinux_sk_getsecid(struct sock
*sk
, u32
*secid
)
4836 *secid
= SECINITSID_ANY_SOCKET
;
4838 struct sk_security_struct
*sksec
= sk
->sk_security
;
4840 *secid
= sksec
->sid
;
4844 static void selinux_sock_graft(struct sock
*sk
, struct socket
*parent
)
4846 struct inode_security_struct
*isec
=
4847 inode_security_novalidate(SOCK_INODE(parent
));
4848 struct sk_security_struct
*sksec
= sk
->sk_security
;
4850 if (sk
->sk_family
== PF_INET
|| sk
->sk_family
== PF_INET6
||
4851 sk
->sk_family
== PF_UNIX
)
4852 isec
->sid
= sksec
->sid
;
4853 sksec
->sclass
= isec
->sclass
;
4856 static int selinux_inet_conn_request(struct sock
*sk
, struct sk_buff
*skb
,
4857 struct request_sock
*req
)
4859 struct sk_security_struct
*sksec
= sk
->sk_security
;
4861 u16 family
= req
->rsk_ops
->family
;
4865 err
= selinux_skb_peerlbl_sid(skb
, family
, &peersid
);
4868 err
= selinux_conn_sid(sksec
->sid
, peersid
, &connsid
);
4871 req
->secid
= connsid
;
4872 req
->peer_secid
= peersid
;
4874 return selinux_netlbl_inet_conn_request(req
, family
);
4877 static void selinux_inet_csk_clone(struct sock
*newsk
,
4878 const struct request_sock
*req
)
4880 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4882 newsksec
->sid
= req
->secid
;
4883 newsksec
->peer_sid
= req
->peer_secid
;
4884 /* NOTE: Ideally, we should also get the isec->sid for the
4885 new socket in sync, but we don't have the isec available yet.
4886 So we will wait until sock_graft to do it, by which
4887 time it will have been created and available. */
4889 /* We don't need to take any sort of lock here as we are the only
4890 * thread with access to newsksec */
4891 selinux_netlbl_inet_csk_clone(newsk
, req
->rsk_ops
->family
);
4894 static void selinux_inet_conn_established(struct sock
*sk
, struct sk_buff
*skb
)
4896 u16 family
= sk
->sk_family
;
4897 struct sk_security_struct
*sksec
= sk
->sk_security
;
4899 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4900 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4903 selinux_skb_peerlbl_sid(skb
, family
, &sksec
->peer_sid
);
4906 static int selinux_secmark_relabel_packet(u32 sid
)
4908 const struct task_security_struct
*__tsec
;
4911 __tsec
= current_security();
4914 return avc_has_perm(tsid
, sid
, SECCLASS_PACKET
, PACKET__RELABELTO
, NULL
);
4917 static void selinux_secmark_refcount_inc(void)
4919 atomic_inc(&selinux_secmark_refcount
);
4922 static void selinux_secmark_refcount_dec(void)
4924 atomic_dec(&selinux_secmark_refcount
);
4927 static void selinux_req_classify_flow(const struct request_sock
*req
,
4930 fl
->flowi_secid
= req
->secid
;
4933 static int selinux_tun_dev_alloc_security(void **security
)
4935 struct tun_security_struct
*tunsec
;
4937 tunsec
= kzalloc(sizeof(*tunsec
), GFP_KERNEL
);
4940 tunsec
->sid
= current_sid();
4946 static void selinux_tun_dev_free_security(void *security
)
4951 static int selinux_tun_dev_create(void)
4953 u32 sid
= current_sid();
4955 /* we aren't taking into account the "sockcreate" SID since the socket
4956 * that is being created here is not a socket in the traditional sense,
4957 * instead it is a private sock, accessible only to the kernel, and
4958 * representing a wide range of network traffic spanning multiple
4959 * connections unlike traditional sockets - check the TUN driver to
4960 * get a better understanding of why this socket is special */
4962 return avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
, TUN_SOCKET__CREATE
,
4966 static int selinux_tun_dev_attach_queue(void *security
)
4968 struct tun_security_struct
*tunsec
= security
;
4970 return avc_has_perm(current_sid(), tunsec
->sid
, SECCLASS_TUN_SOCKET
,
4971 TUN_SOCKET__ATTACH_QUEUE
, NULL
);
4974 static int selinux_tun_dev_attach(struct sock
*sk
, void *security
)
4976 struct tun_security_struct
*tunsec
= security
;
4977 struct sk_security_struct
*sksec
= sk
->sk_security
;
4979 /* we don't currently perform any NetLabel based labeling here and it
4980 * isn't clear that we would want to do so anyway; while we could apply
4981 * labeling without the support of the TUN user the resulting labeled
4982 * traffic from the other end of the connection would almost certainly
4983 * cause confusion to the TUN user that had no idea network labeling
4984 * protocols were being used */
4986 sksec
->sid
= tunsec
->sid
;
4987 sksec
->sclass
= SECCLASS_TUN_SOCKET
;
4992 static int selinux_tun_dev_open(void *security
)
4994 struct tun_security_struct
*tunsec
= security
;
4995 u32 sid
= current_sid();
4998 err
= avc_has_perm(sid
, tunsec
->sid
, SECCLASS_TUN_SOCKET
,
4999 TUN_SOCKET__RELABELFROM
, NULL
);
5002 err
= avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
,
5003 TUN_SOCKET__RELABELTO
, NULL
);
5011 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
5015 struct nlmsghdr
*nlh
;
5016 struct sk_security_struct
*sksec
= sk
->sk_security
;
5018 if (skb
->len
< NLMSG_HDRLEN
) {
5022 nlh
= nlmsg_hdr(skb
);
5024 err
= selinux_nlmsg_lookup(sksec
->sclass
, nlh
->nlmsg_type
, &perm
);
5026 if (err
== -EINVAL
) {
5027 pr_warn_ratelimited("SELinux: unrecognized netlink"
5028 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5029 " pig=%d comm=%s\n",
5030 sk
->sk_protocol
, nlh
->nlmsg_type
,
5031 secclass_map
[sksec
->sclass
- 1].name
,
5032 task_pid_nr(current
), current
->comm
);
5033 if (!selinux_enforcing
|| security_get_allow_unknown())
5043 err
= sock_has_perm(sk
, perm
);
5048 #ifdef CONFIG_NETFILTER
5050 static unsigned int selinux_ip_forward(struct sk_buff
*skb
,
5051 const struct net_device
*indev
,
5057 struct common_audit_data ad
;
5058 struct lsm_network_audit net
= {0,};
5063 if (!selinux_policycap_netpeer
)
5066 secmark_active
= selinux_secmark_enabled();
5067 netlbl_active
= netlbl_enabled();
5068 peerlbl_active
= selinux_peerlbl_enabled();
5069 if (!secmark_active
&& !peerlbl_active
)
5072 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
) != 0)
5075 ad
.type
= LSM_AUDIT_DATA_NET
;
5077 ad
.u
.net
->netif
= indev
->ifindex
;
5078 ad
.u
.net
->family
= family
;
5079 if (selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
) != 0)
5082 if (peerlbl_active
) {
5083 err
= selinux_inet_sys_rcv_skb(dev_net(indev
), indev
->ifindex
,
5084 addrp
, family
, peer_sid
, &ad
);
5086 selinux_netlbl_err(skb
, family
, err
, 1);
5092 if (avc_has_perm(peer_sid
, skb
->secmark
,
5093 SECCLASS_PACKET
, PACKET__FORWARD_IN
, &ad
))
5097 /* we do this in the FORWARD path and not the POST_ROUTING
5098 * path because we want to make sure we apply the necessary
5099 * labeling before IPsec is applied so we can leverage AH
5101 if (selinux_netlbl_skbuff_setsid(skb
, family
, peer_sid
) != 0)
5107 static unsigned int selinux_ipv4_forward(void *priv
,
5108 struct sk_buff
*skb
,
5109 const struct nf_hook_state
*state
)
5111 return selinux_ip_forward(skb
, state
->in
, PF_INET
);
5114 #if IS_ENABLED(CONFIG_IPV6)
5115 static unsigned int selinux_ipv6_forward(void *priv
,
5116 struct sk_buff
*skb
,
5117 const struct nf_hook_state
*state
)
5119 return selinux_ip_forward(skb
, state
->in
, PF_INET6
);
5123 static unsigned int selinux_ip_output(struct sk_buff
*skb
,
5129 if (!netlbl_enabled())
5132 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5133 * because we want to make sure we apply the necessary labeling
5134 * before IPsec is applied so we can leverage AH protection */
5137 struct sk_security_struct
*sksec
;
5139 if (sk_listener(sk
))
5140 /* if the socket is the listening state then this
5141 * packet is a SYN-ACK packet which means it needs to
5142 * be labeled based on the connection/request_sock and
5143 * not the parent socket. unfortunately, we can't
5144 * lookup the request_sock yet as it isn't queued on
5145 * the parent socket until after the SYN-ACK is sent.
5146 * the "solution" is to simply pass the packet as-is
5147 * as any IP option based labeling should be copied
5148 * from the initial connection request (in the IP
5149 * layer). it is far from ideal, but until we get a
5150 * security label in the packet itself this is the
5151 * best we can do. */
5154 /* standard practice, label using the parent socket */
5155 sksec
= sk
->sk_security
;
5158 sid
= SECINITSID_KERNEL
;
5159 if (selinux_netlbl_skbuff_setsid(skb
, family
, sid
) != 0)
5165 static unsigned int selinux_ipv4_output(void *priv
,
5166 struct sk_buff
*skb
,
5167 const struct nf_hook_state
*state
)
5169 return selinux_ip_output(skb
, PF_INET
);
5172 #if IS_ENABLED(CONFIG_IPV6)
5173 static unsigned int selinux_ipv6_output(void *priv
,
5174 struct sk_buff
*skb
,
5175 const struct nf_hook_state
*state
)
5177 return selinux_ip_output(skb
, PF_INET6
);
5181 static unsigned int selinux_ip_postroute_compat(struct sk_buff
*skb
,
5185 struct sock
*sk
= skb_to_full_sk(skb
);
5186 struct sk_security_struct
*sksec
;
5187 struct common_audit_data ad
;
5188 struct lsm_network_audit net
= {0,};
5194 sksec
= sk
->sk_security
;
5196 ad
.type
= LSM_AUDIT_DATA_NET
;
5198 ad
.u
.net
->netif
= ifindex
;
5199 ad
.u
.net
->family
= family
;
5200 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, &proto
))
5203 if (selinux_secmark_enabled())
5204 if (avc_has_perm(sksec
->sid
, skb
->secmark
,
5205 SECCLASS_PACKET
, PACKET__SEND
, &ad
))
5206 return NF_DROP_ERR(-ECONNREFUSED
);
5208 if (selinux_xfrm_postroute_last(sksec
->sid
, skb
, &ad
, proto
))
5209 return NF_DROP_ERR(-ECONNREFUSED
);
5214 static unsigned int selinux_ip_postroute(struct sk_buff
*skb
,
5215 const struct net_device
*outdev
,
5220 int ifindex
= outdev
->ifindex
;
5222 struct common_audit_data ad
;
5223 struct lsm_network_audit net
= {0,};
5228 /* If any sort of compatibility mode is enabled then handoff processing
5229 * to the selinux_ip_postroute_compat() function to deal with the
5230 * special handling. We do this in an attempt to keep this function
5231 * as fast and as clean as possible. */
5232 if (!selinux_policycap_netpeer
)
5233 return selinux_ip_postroute_compat(skb
, ifindex
, family
);
5235 secmark_active
= selinux_secmark_enabled();
5236 peerlbl_active
= selinux_peerlbl_enabled();
5237 if (!secmark_active
&& !peerlbl_active
)
5240 sk
= skb_to_full_sk(skb
);
5243 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5244 * packet transformation so allow the packet to pass without any checks
5245 * since we'll have another chance to perform access control checks
5246 * when the packet is on it's final way out.
5247 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5248 * is NULL, in this case go ahead and apply access control.
5249 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5250 * TCP listening state we cannot wait until the XFRM processing
5251 * is done as we will miss out on the SA label if we do;
5252 * unfortunately, this means more work, but it is only once per
5254 if (skb_dst(skb
) != NULL
&& skb_dst(skb
)->xfrm
!= NULL
&&
5255 !(sk
&& sk_listener(sk
)))
5260 /* Without an associated socket the packet is either coming
5261 * from the kernel or it is being forwarded; check the packet
5262 * to determine which and if the packet is being forwarded
5263 * query the packet directly to determine the security label. */
5265 secmark_perm
= PACKET__FORWARD_OUT
;
5266 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
))
5269 secmark_perm
= PACKET__SEND
;
5270 peer_sid
= SECINITSID_KERNEL
;
5272 } else if (sk_listener(sk
)) {
5273 /* Locally generated packet but the associated socket is in the
5274 * listening state which means this is a SYN-ACK packet. In
5275 * this particular case the correct security label is assigned
5276 * to the connection/request_sock but unfortunately we can't
5277 * query the request_sock as it isn't queued on the parent
5278 * socket until after the SYN-ACK packet is sent; the only
5279 * viable choice is to regenerate the label like we do in
5280 * selinux_inet_conn_request(). See also selinux_ip_output()
5281 * for similar problems. */
5283 struct sk_security_struct
*sksec
;
5285 sksec
= sk
->sk_security
;
5286 if (selinux_skb_peerlbl_sid(skb
, family
, &skb_sid
))
5288 /* At this point, if the returned skb peerlbl is SECSID_NULL
5289 * and the packet has been through at least one XFRM
5290 * transformation then we must be dealing with the "final"
5291 * form of labeled IPsec packet; since we've already applied
5292 * all of our access controls on this packet we can safely
5293 * pass the packet. */
5294 if (skb_sid
== SECSID_NULL
) {
5297 if (IPCB(skb
)->flags
& IPSKB_XFRM_TRANSFORMED
)
5301 if (IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
)
5305 return NF_DROP_ERR(-ECONNREFUSED
);
5308 if (selinux_conn_sid(sksec
->sid
, skb_sid
, &peer_sid
))
5310 secmark_perm
= PACKET__SEND
;
5312 /* Locally generated packet, fetch the security label from the
5313 * associated socket. */
5314 struct sk_security_struct
*sksec
= sk
->sk_security
;
5315 peer_sid
= sksec
->sid
;
5316 secmark_perm
= PACKET__SEND
;
5319 ad
.type
= LSM_AUDIT_DATA_NET
;
5321 ad
.u
.net
->netif
= ifindex
;
5322 ad
.u
.net
->family
= family
;
5323 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, NULL
))
5327 if (avc_has_perm(peer_sid
, skb
->secmark
,
5328 SECCLASS_PACKET
, secmark_perm
, &ad
))
5329 return NF_DROP_ERR(-ECONNREFUSED
);
5331 if (peerlbl_active
) {
5335 if (sel_netif_sid(dev_net(outdev
), ifindex
, &if_sid
))
5337 if (avc_has_perm(peer_sid
, if_sid
,
5338 SECCLASS_NETIF
, NETIF__EGRESS
, &ad
))
5339 return NF_DROP_ERR(-ECONNREFUSED
);
5341 if (sel_netnode_sid(addrp
, family
, &node_sid
))
5343 if (avc_has_perm(peer_sid
, node_sid
,
5344 SECCLASS_NODE
, NODE__SENDTO
, &ad
))
5345 return NF_DROP_ERR(-ECONNREFUSED
);
5351 static unsigned int selinux_ipv4_postroute(void *priv
,
5352 struct sk_buff
*skb
,
5353 const struct nf_hook_state
*state
)
5355 return selinux_ip_postroute(skb
, state
->out
, PF_INET
);
5358 #if IS_ENABLED(CONFIG_IPV6)
5359 static unsigned int selinux_ipv6_postroute(void *priv
,
5360 struct sk_buff
*skb
,
5361 const struct nf_hook_state
*state
)
5363 return selinux_ip_postroute(skb
, state
->out
, PF_INET6
);
5367 #endif /* CONFIG_NETFILTER */
5369 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
5371 return selinux_nlmsg_perm(sk
, skb
);
5374 static int ipc_alloc_security(struct kern_ipc_perm
*perm
,
5377 struct ipc_security_struct
*isec
;
5379 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
5383 isec
->sclass
= sclass
;
5384 isec
->sid
= current_sid();
5385 perm
->security
= isec
;
5390 static void ipc_free_security(struct kern_ipc_perm
*perm
)
5392 struct ipc_security_struct
*isec
= perm
->security
;
5393 perm
->security
= NULL
;
5397 static int msg_msg_alloc_security(struct msg_msg
*msg
)
5399 struct msg_security_struct
*msec
;
5401 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
5405 msec
->sid
= SECINITSID_UNLABELED
;
5406 msg
->security
= msec
;
5411 static void msg_msg_free_security(struct msg_msg
*msg
)
5413 struct msg_security_struct
*msec
= msg
->security
;
5415 msg
->security
= NULL
;
5419 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
5422 struct ipc_security_struct
*isec
;
5423 struct common_audit_data ad
;
5424 u32 sid
= current_sid();
5426 isec
= ipc_perms
->security
;
5428 ad
.type
= LSM_AUDIT_DATA_IPC
;
5429 ad
.u
.ipc_id
= ipc_perms
->key
;
5431 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
5434 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
5436 return msg_msg_alloc_security(msg
);
5439 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
5441 msg_msg_free_security(msg
);
5444 /* message queue security operations */
5445 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
5447 struct ipc_security_struct
*isec
;
5448 struct common_audit_data ad
;
5449 u32 sid
= current_sid();
5452 rc
= ipc_alloc_security(&msq
->q_perm
, SECCLASS_MSGQ
);
5456 isec
= msq
->q_perm
.security
;
5458 ad
.type
= LSM_AUDIT_DATA_IPC
;
5459 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5461 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5464 ipc_free_security(&msq
->q_perm
);
5470 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
5472 ipc_free_security(&msq
->q_perm
);
5475 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
5477 struct ipc_security_struct
*isec
;
5478 struct common_audit_data ad
;
5479 u32 sid
= current_sid();
5481 isec
= msq
->q_perm
.security
;
5483 ad
.type
= LSM_AUDIT_DATA_IPC
;
5484 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5486 return avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5487 MSGQ__ASSOCIATE
, &ad
);
5490 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
5498 /* No specific object, just general system-wide information. */
5499 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5500 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5503 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
5506 perms
= MSGQ__SETATTR
;
5509 perms
= MSGQ__DESTROY
;
5515 err
= ipc_has_perm(&msq
->q_perm
, perms
);
5519 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
5521 struct ipc_security_struct
*isec
;
5522 struct msg_security_struct
*msec
;
5523 struct common_audit_data ad
;
5524 u32 sid
= current_sid();
5527 isec
= msq
->q_perm
.security
;
5528 msec
= msg
->security
;
5531 * First time through, need to assign label to the message
5533 if (msec
->sid
== SECINITSID_UNLABELED
) {
5535 * Compute new sid based on current process and
5536 * message queue this message will be stored in
5538 rc
= security_transition_sid(sid
, isec
->sid
, SECCLASS_MSG
,
5544 ad
.type
= LSM_AUDIT_DATA_IPC
;
5545 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5547 /* Can this process write to the queue? */
5548 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
5551 /* Can this process send the message */
5552 rc
= avc_has_perm(sid
, msec
->sid
, SECCLASS_MSG
,
5555 /* Can the message be put in the queue? */
5556 rc
= avc_has_perm(msec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
5557 MSGQ__ENQUEUE
, &ad
);
5562 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
5563 struct task_struct
*target
,
5564 long type
, int mode
)
5566 struct ipc_security_struct
*isec
;
5567 struct msg_security_struct
*msec
;
5568 struct common_audit_data ad
;
5569 u32 sid
= task_sid(target
);
5572 isec
= msq
->q_perm
.security
;
5573 msec
= msg
->security
;
5575 ad
.type
= LSM_AUDIT_DATA_IPC
;
5576 ad
.u
.ipc_id
= msq
->q_perm
.key
;
5578 rc
= avc_has_perm(sid
, isec
->sid
,
5579 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
5581 rc
= avc_has_perm(sid
, msec
->sid
,
5582 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
5586 /* Shared Memory security operations */
5587 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
5589 struct ipc_security_struct
*isec
;
5590 struct common_audit_data ad
;
5591 u32 sid
= current_sid();
5594 rc
= ipc_alloc_security(&shp
->shm_perm
, SECCLASS_SHM
);
5598 isec
= shp
->shm_perm
.security
;
5600 ad
.type
= LSM_AUDIT_DATA_IPC
;
5601 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
5603 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
5606 ipc_free_security(&shp
->shm_perm
);
5612 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
5614 ipc_free_security(&shp
->shm_perm
);
5617 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
5619 struct ipc_security_struct
*isec
;
5620 struct common_audit_data ad
;
5621 u32 sid
= current_sid();
5623 isec
= shp
->shm_perm
.security
;
5625 ad
.type
= LSM_AUDIT_DATA_IPC
;
5626 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
5628 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
5629 SHM__ASSOCIATE
, &ad
);
5632 /* Note, at this point, shp is locked down */
5633 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
5641 /* No specific object, just general system-wide information. */
5642 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5643 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5646 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
5649 perms
= SHM__SETATTR
;
5656 perms
= SHM__DESTROY
;
5662 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
5666 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
5667 char __user
*shmaddr
, int shmflg
)
5671 if (shmflg
& SHM_RDONLY
)
5674 perms
= SHM__READ
| SHM__WRITE
;
5676 return ipc_has_perm(&shp
->shm_perm
, perms
);
5679 /* Semaphore security operations */
5680 static int selinux_sem_alloc_security(struct sem_array
*sma
)
5682 struct ipc_security_struct
*isec
;
5683 struct common_audit_data ad
;
5684 u32 sid
= current_sid();
5687 rc
= ipc_alloc_security(&sma
->sem_perm
, SECCLASS_SEM
);
5691 isec
= sma
->sem_perm
.security
;
5693 ad
.type
= LSM_AUDIT_DATA_IPC
;
5694 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5696 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5699 ipc_free_security(&sma
->sem_perm
);
5705 static void selinux_sem_free_security(struct sem_array
*sma
)
5707 ipc_free_security(&sma
->sem_perm
);
5710 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
5712 struct ipc_security_struct
*isec
;
5713 struct common_audit_data ad
;
5714 u32 sid
= current_sid();
5716 isec
= sma
->sem_perm
.security
;
5718 ad
.type
= LSM_AUDIT_DATA_IPC
;
5719 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5721 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5722 SEM__ASSOCIATE
, &ad
);
5725 /* Note, at this point, sma is locked down */
5726 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
5734 /* No specific object, just general system-wide information. */
5735 return avc_has_perm(current_sid(), SECINITSID_KERNEL
,
5736 SECCLASS_SYSTEM
, SYSTEM__IPC_INFO
, NULL
);
5740 perms
= SEM__GETATTR
;
5751 perms
= SEM__DESTROY
;
5754 perms
= SEM__SETATTR
;
5758 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
5764 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
5768 static int selinux_sem_semop(struct sem_array
*sma
,
5769 struct sembuf
*sops
, unsigned nsops
, int alter
)
5774 perms
= SEM__READ
| SEM__WRITE
;
5778 return ipc_has_perm(&sma
->sem_perm
, perms
);
5781 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
5787 av
|= IPC__UNIX_READ
;
5789 av
|= IPC__UNIX_WRITE
;
5794 return ipc_has_perm(ipcp
, av
);
5797 static void selinux_ipc_getsecid(struct kern_ipc_perm
*ipcp
, u32
*secid
)
5799 struct ipc_security_struct
*isec
= ipcp
->security
;
5803 static void selinux_d_instantiate(struct dentry
*dentry
, struct inode
*inode
)
5806 inode_doinit_with_dentry(inode
, dentry
);
5809 static int selinux_getprocattr(struct task_struct
*p
,
5810 char *name
, char **value
)
5812 const struct task_security_struct
*__tsec
;
5818 __tsec
= __task_cred(p
)->security
;
5821 error
= avc_has_perm(current_sid(), __tsec
->sid
,
5822 SECCLASS_PROCESS
, PROCESS__GETATTR
, NULL
);
5827 if (!strcmp(name
, "current"))
5829 else if (!strcmp(name
, "prev"))
5831 else if (!strcmp(name
, "exec"))
5832 sid
= __tsec
->exec_sid
;
5833 else if (!strcmp(name
, "fscreate"))
5834 sid
= __tsec
->create_sid
;
5835 else if (!strcmp(name
, "keycreate"))
5836 sid
= __tsec
->keycreate_sid
;
5837 else if (!strcmp(name
, "sockcreate"))
5838 sid
= __tsec
->sockcreate_sid
;
5848 error
= security_sid_to_context(sid
, value
, &len
);
5858 static int selinux_setprocattr(const char *name
, void *value
, size_t size
)
5860 struct task_security_struct
*tsec
;
5862 u32 mysid
= current_sid(), sid
= 0, ptsid
;
5867 * Basic control over ability to set these attributes at all.
5869 if (!strcmp(name
, "exec"))
5870 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5871 PROCESS__SETEXEC
, NULL
);
5872 else if (!strcmp(name
, "fscreate"))
5873 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5874 PROCESS__SETFSCREATE
, NULL
);
5875 else if (!strcmp(name
, "keycreate"))
5876 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5877 PROCESS__SETKEYCREATE
, NULL
);
5878 else if (!strcmp(name
, "sockcreate"))
5879 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5880 PROCESS__SETSOCKCREATE
, NULL
);
5881 else if (!strcmp(name
, "current"))
5882 error
= avc_has_perm(mysid
, mysid
, SECCLASS_PROCESS
,
5883 PROCESS__SETCURRENT
, NULL
);
5889 /* Obtain a SID for the context, if one was specified. */
5890 if (size
&& str
[0] && str
[0] != '\n') {
5891 if (str
[size
-1] == '\n') {
5895 error
= security_context_to_sid(value
, size
, &sid
, GFP_KERNEL
);
5896 if (error
== -EINVAL
&& !strcmp(name
, "fscreate")) {
5897 if (!capable(CAP_MAC_ADMIN
)) {
5898 struct audit_buffer
*ab
;
5901 /* We strip a nul only if it is at the end, otherwise the
5902 * context contains a nul and we should audit that */
5903 if (str
[size
- 1] == '\0')
5904 audit_size
= size
- 1;
5907 ab
= audit_log_start(current
->audit_context
, GFP_ATOMIC
, AUDIT_SELINUX_ERR
);
5908 audit_log_format(ab
, "op=fscreate invalid_context=");
5909 audit_log_n_untrustedstring(ab
, value
, audit_size
);
5914 error
= security_context_to_sid_force(value
, size
,
5921 new = prepare_creds();
5925 /* Permission checking based on the specified context is
5926 performed during the actual operation (execve,
5927 open/mkdir/...), when we know the full context of the
5928 operation. See selinux_bprm_set_creds for the execve
5929 checks and may_create for the file creation checks. The
5930 operation will then fail if the context is not permitted. */
5931 tsec
= new->security
;
5932 if (!strcmp(name
, "exec")) {
5933 tsec
->exec_sid
= sid
;
5934 } else if (!strcmp(name
, "fscreate")) {
5935 tsec
->create_sid
= sid
;
5936 } else if (!strcmp(name
, "keycreate")) {
5937 error
= avc_has_perm(mysid
, sid
, SECCLASS_KEY
, KEY__CREATE
,
5941 tsec
->keycreate_sid
= sid
;
5942 } else if (!strcmp(name
, "sockcreate")) {
5943 tsec
->sockcreate_sid
= sid
;
5944 } else if (!strcmp(name
, "current")) {
5949 /* Only allow single threaded processes to change context */
5951 if (!current_is_single_threaded()) {
5952 error
= security_bounded_transition(tsec
->sid
, sid
);
5957 /* Check permissions for the transition. */
5958 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
5959 PROCESS__DYNTRANSITION
, NULL
);
5963 /* Check for ptracing, and update the task SID if ok.
5964 Otherwise, leave SID unchanged and fail. */
5965 ptsid
= ptrace_parent_sid();
5967 error
= avc_has_perm(ptsid
, sid
, SECCLASS_PROCESS
,
5968 PROCESS__PTRACE
, NULL
);
5987 static int selinux_ismaclabel(const char *name
)
5989 return (strcmp(name
, XATTR_SELINUX_SUFFIX
) == 0);
5992 static int selinux_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
5994 return security_sid_to_context(secid
, secdata
, seclen
);
5997 static int selinux_secctx_to_secid(const char *secdata
, u32 seclen
, u32
*secid
)
5999 return security_context_to_sid(secdata
, seclen
, secid
, GFP_KERNEL
);
6002 static void selinux_release_secctx(char *secdata
, u32 seclen
)
6007 static void selinux_inode_invalidate_secctx(struct inode
*inode
)
6009 struct inode_security_struct
*isec
= inode
->i_security
;
6011 spin_lock(&isec
->lock
);
6012 isec
->initialized
= LABEL_INVALID
;
6013 spin_unlock(&isec
->lock
);
6017 * called with inode->i_mutex locked
6019 static int selinux_inode_notifysecctx(struct inode
*inode
, void *ctx
, u32 ctxlen
)
6021 return selinux_inode_setsecurity(inode
, XATTR_SELINUX_SUFFIX
, ctx
, ctxlen
, 0);
6025 * called with inode->i_mutex locked
6027 static int selinux_inode_setsecctx(struct dentry
*dentry
, void *ctx
, u32 ctxlen
)
6029 return __vfs_setxattr_noperm(dentry
, XATTR_NAME_SELINUX
, ctx
, ctxlen
, 0);
6032 static int selinux_inode_getsecctx(struct inode
*inode
, void **ctx
, u32
*ctxlen
)
6035 len
= selinux_inode_getsecurity(inode
, XATTR_SELINUX_SUFFIX
,
6044 static int selinux_key_alloc(struct key
*k
, const struct cred
*cred
,
6045 unsigned long flags
)
6047 const struct task_security_struct
*tsec
;
6048 struct key_security_struct
*ksec
;
6050 ksec
= kzalloc(sizeof(struct key_security_struct
), GFP_KERNEL
);
6054 tsec
= cred
->security
;
6055 if (tsec
->keycreate_sid
)
6056 ksec
->sid
= tsec
->keycreate_sid
;
6058 ksec
->sid
= tsec
->sid
;
6064 static void selinux_key_free(struct key
*k
)
6066 struct key_security_struct
*ksec
= k
->security
;
6072 static int selinux_key_permission(key_ref_t key_ref
,
6073 const struct cred
*cred
,
6077 struct key_security_struct
*ksec
;
6080 /* if no specific permissions are requested, we skip the
6081 permission check. No serious, additional covert channels
6082 appear to be created. */
6086 sid
= cred_sid(cred
);
6088 key
= key_ref_to_ptr(key_ref
);
6089 ksec
= key
->security
;
6091 return avc_has_perm(sid
, ksec
->sid
, SECCLASS_KEY
, perm
, NULL
);
6094 static int selinux_key_getsecurity(struct key
*key
, char **_buffer
)
6096 struct key_security_struct
*ksec
= key
->security
;
6097 char *context
= NULL
;
6101 rc
= security_sid_to_context(ksec
->sid
, &context
, &len
);
6110 static struct security_hook_list selinux_hooks
[] = {
6111 LSM_HOOK_INIT(binder_set_context_mgr
, selinux_binder_set_context_mgr
),
6112 LSM_HOOK_INIT(binder_transaction
, selinux_binder_transaction
),
6113 LSM_HOOK_INIT(binder_transfer_binder
, selinux_binder_transfer_binder
),
6114 LSM_HOOK_INIT(binder_transfer_file
, selinux_binder_transfer_file
),
6116 LSM_HOOK_INIT(ptrace_access_check
, selinux_ptrace_access_check
),
6117 LSM_HOOK_INIT(ptrace_traceme
, selinux_ptrace_traceme
),
6118 LSM_HOOK_INIT(capget
, selinux_capget
),
6119 LSM_HOOK_INIT(capset
, selinux_capset
),
6120 LSM_HOOK_INIT(capable
, selinux_capable
),
6121 LSM_HOOK_INIT(quotactl
, selinux_quotactl
),
6122 LSM_HOOK_INIT(quota_on
, selinux_quota_on
),
6123 LSM_HOOK_INIT(syslog
, selinux_syslog
),
6124 LSM_HOOK_INIT(vm_enough_memory
, selinux_vm_enough_memory
),
6126 LSM_HOOK_INIT(netlink_send
, selinux_netlink_send
),
6128 LSM_HOOK_INIT(bprm_set_creds
, selinux_bprm_set_creds
),
6129 LSM_HOOK_INIT(bprm_committing_creds
, selinux_bprm_committing_creds
),
6130 LSM_HOOK_INIT(bprm_committed_creds
, selinux_bprm_committed_creds
),
6131 LSM_HOOK_INIT(bprm_secureexec
, selinux_bprm_secureexec
),
6133 LSM_HOOK_INIT(sb_alloc_security
, selinux_sb_alloc_security
),
6134 LSM_HOOK_INIT(sb_free_security
, selinux_sb_free_security
),
6135 LSM_HOOK_INIT(sb_copy_data
, selinux_sb_copy_data
),
6136 LSM_HOOK_INIT(sb_remount
, selinux_sb_remount
),
6137 LSM_HOOK_INIT(sb_kern_mount
, selinux_sb_kern_mount
),
6138 LSM_HOOK_INIT(sb_show_options
, selinux_sb_show_options
),
6139 LSM_HOOK_INIT(sb_statfs
, selinux_sb_statfs
),
6140 LSM_HOOK_INIT(sb_mount
, selinux_mount
),
6141 LSM_HOOK_INIT(sb_umount
, selinux_umount
),
6142 LSM_HOOK_INIT(sb_set_mnt_opts
, selinux_set_mnt_opts
),
6143 LSM_HOOK_INIT(sb_clone_mnt_opts
, selinux_sb_clone_mnt_opts
),
6144 LSM_HOOK_INIT(sb_parse_opts_str
, selinux_parse_opts_str
),
6146 LSM_HOOK_INIT(dentry_init_security
, selinux_dentry_init_security
),
6147 LSM_HOOK_INIT(dentry_create_files_as
, selinux_dentry_create_files_as
),
6149 LSM_HOOK_INIT(inode_alloc_security
, selinux_inode_alloc_security
),
6150 LSM_HOOK_INIT(inode_free_security
, selinux_inode_free_security
),
6151 LSM_HOOK_INIT(inode_init_security
, selinux_inode_init_security
),
6152 LSM_HOOK_INIT(inode_create
, selinux_inode_create
),
6153 LSM_HOOK_INIT(inode_link
, selinux_inode_link
),
6154 LSM_HOOK_INIT(inode_unlink
, selinux_inode_unlink
),
6155 LSM_HOOK_INIT(inode_symlink
, selinux_inode_symlink
),
6156 LSM_HOOK_INIT(inode_mkdir
, selinux_inode_mkdir
),
6157 LSM_HOOK_INIT(inode_rmdir
, selinux_inode_rmdir
),
6158 LSM_HOOK_INIT(inode_mknod
, selinux_inode_mknod
),
6159 LSM_HOOK_INIT(inode_rename
, selinux_inode_rename
),
6160 LSM_HOOK_INIT(inode_readlink
, selinux_inode_readlink
),
6161 LSM_HOOK_INIT(inode_follow_link
, selinux_inode_follow_link
),
6162 LSM_HOOK_INIT(inode_permission
, selinux_inode_permission
),
6163 LSM_HOOK_INIT(inode_setattr
, selinux_inode_setattr
),
6164 LSM_HOOK_INIT(inode_getattr
, selinux_inode_getattr
),
6165 LSM_HOOK_INIT(inode_setxattr
, selinux_inode_setxattr
),
6166 LSM_HOOK_INIT(inode_post_setxattr
, selinux_inode_post_setxattr
),
6167 LSM_HOOK_INIT(inode_getxattr
, selinux_inode_getxattr
),
6168 LSM_HOOK_INIT(inode_listxattr
, selinux_inode_listxattr
),
6169 LSM_HOOK_INIT(inode_removexattr
, selinux_inode_removexattr
),
6170 LSM_HOOK_INIT(inode_getsecurity
, selinux_inode_getsecurity
),
6171 LSM_HOOK_INIT(inode_setsecurity
, selinux_inode_setsecurity
),
6172 LSM_HOOK_INIT(inode_listsecurity
, selinux_inode_listsecurity
),
6173 LSM_HOOK_INIT(inode_getsecid
, selinux_inode_getsecid
),
6174 LSM_HOOK_INIT(inode_copy_up
, selinux_inode_copy_up
),
6175 LSM_HOOK_INIT(inode_copy_up_xattr
, selinux_inode_copy_up_xattr
),
6177 LSM_HOOK_INIT(file_permission
, selinux_file_permission
),
6178 LSM_HOOK_INIT(file_alloc_security
, selinux_file_alloc_security
),
6179 LSM_HOOK_INIT(file_free_security
, selinux_file_free_security
),
6180 LSM_HOOK_INIT(file_ioctl
, selinux_file_ioctl
),
6181 LSM_HOOK_INIT(mmap_file
, selinux_mmap_file
),
6182 LSM_HOOK_INIT(mmap_addr
, selinux_mmap_addr
),
6183 LSM_HOOK_INIT(file_mprotect
, selinux_file_mprotect
),
6184 LSM_HOOK_INIT(file_lock
, selinux_file_lock
),
6185 LSM_HOOK_INIT(file_fcntl
, selinux_file_fcntl
),
6186 LSM_HOOK_INIT(file_set_fowner
, selinux_file_set_fowner
),
6187 LSM_HOOK_INIT(file_send_sigiotask
, selinux_file_send_sigiotask
),
6188 LSM_HOOK_INIT(file_receive
, selinux_file_receive
),
6190 LSM_HOOK_INIT(file_open
, selinux_file_open
),
6192 LSM_HOOK_INIT(task_create
, selinux_task_create
),
6193 LSM_HOOK_INIT(cred_alloc_blank
, selinux_cred_alloc_blank
),
6194 LSM_HOOK_INIT(cred_free
, selinux_cred_free
),
6195 LSM_HOOK_INIT(cred_prepare
, selinux_cred_prepare
),
6196 LSM_HOOK_INIT(cred_transfer
, selinux_cred_transfer
),
6197 LSM_HOOK_INIT(kernel_act_as
, selinux_kernel_act_as
),
6198 LSM_HOOK_INIT(kernel_create_files_as
, selinux_kernel_create_files_as
),
6199 LSM_HOOK_INIT(kernel_module_request
, selinux_kernel_module_request
),
6200 LSM_HOOK_INIT(kernel_read_file
, selinux_kernel_read_file
),
6201 LSM_HOOK_INIT(task_setpgid
, selinux_task_setpgid
),
6202 LSM_HOOK_INIT(task_getpgid
, selinux_task_getpgid
),
6203 LSM_HOOK_INIT(task_getsid
, selinux_task_getsid
),
6204 LSM_HOOK_INIT(task_getsecid
, selinux_task_getsecid
),
6205 LSM_HOOK_INIT(task_setnice
, selinux_task_setnice
),
6206 LSM_HOOK_INIT(task_setioprio
, selinux_task_setioprio
),
6207 LSM_HOOK_INIT(task_getioprio
, selinux_task_getioprio
),
6208 LSM_HOOK_INIT(task_setrlimit
, selinux_task_setrlimit
),
6209 LSM_HOOK_INIT(task_setscheduler
, selinux_task_setscheduler
),
6210 LSM_HOOK_INIT(task_getscheduler
, selinux_task_getscheduler
),
6211 LSM_HOOK_INIT(task_movememory
, selinux_task_movememory
),
6212 LSM_HOOK_INIT(task_kill
, selinux_task_kill
),
6213 LSM_HOOK_INIT(task_to_inode
, selinux_task_to_inode
),
6215 LSM_HOOK_INIT(ipc_permission
, selinux_ipc_permission
),
6216 LSM_HOOK_INIT(ipc_getsecid
, selinux_ipc_getsecid
),
6218 LSM_HOOK_INIT(msg_msg_alloc_security
, selinux_msg_msg_alloc_security
),
6219 LSM_HOOK_INIT(msg_msg_free_security
, selinux_msg_msg_free_security
),
6221 LSM_HOOK_INIT(msg_queue_alloc_security
,
6222 selinux_msg_queue_alloc_security
),
6223 LSM_HOOK_INIT(msg_queue_free_security
, selinux_msg_queue_free_security
),
6224 LSM_HOOK_INIT(msg_queue_associate
, selinux_msg_queue_associate
),
6225 LSM_HOOK_INIT(msg_queue_msgctl
, selinux_msg_queue_msgctl
),
6226 LSM_HOOK_INIT(msg_queue_msgsnd
, selinux_msg_queue_msgsnd
),
6227 LSM_HOOK_INIT(msg_queue_msgrcv
, selinux_msg_queue_msgrcv
),
6229 LSM_HOOK_INIT(shm_alloc_security
, selinux_shm_alloc_security
),
6230 LSM_HOOK_INIT(shm_free_security
, selinux_shm_free_security
),
6231 LSM_HOOK_INIT(shm_associate
, selinux_shm_associate
),
6232 LSM_HOOK_INIT(shm_shmctl
, selinux_shm_shmctl
),
6233 LSM_HOOK_INIT(shm_shmat
, selinux_shm_shmat
),
6235 LSM_HOOK_INIT(sem_alloc_security
, selinux_sem_alloc_security
),
6236 LSM_HOOK_INIT(sem_free_security
, selinux_sem_free_security
),
6237 LSM_HOOK_INIT(sem_associate
, selinux_sem_associate
),
6238 LSM_HOOK_INIT(sem_semctl
, selinux_sem_semctl
),
6239 LSM_HOOK_INIT(sem_semop
, selinux_sem_semop
),
6241 LSM_HOOK_INIT(d_instantiate
, selinux_d_instantiate
),
6243 LSM_HOOK_INIT(getprocattr
, selinux_getprocattr
),
6244 LSM_HOOK_INIT(setprocattr
, selinux_setprocattr
),
6246 LSM_HOOK_INIT(ismaclabel
, selinux_ismaclabel
),
6247 LSM_HOOK_INIT(secid_to_secctx
, selinux_secid_to_secctx
),
6248 LSM_HOOK_INIT(secctx_to_secid
, selinux_secctx_to_secid
),
6249 LSM_HOOK_INIT(release_secctx
, selinux_release_secctx
),
6250 LSM_HOOK_INIT(inode_invalidate_secctx
, selinux_inode_invalidate_secctx
),
6251 LSM_HOOK_INIT(inode_notifysecctx
, selinux_inode_notifysecctx
),
6252 LSM_HOOK_INIT(inode_setsecctx
, selinux_inode_setsecctx
),
6253 LSM_HOOK_INIT(inode_getsecctx
, selinux_inode_getsecctx
),
6255 LSM_HOOK_INIT(unix_stream_connect
, selinux_socket_unix_stream_connect
),
6256 LSM_HOOK_INIT(unix_may_send
, selinux_socket_unix_may_send
),
6258 LSM_HOOK_INIT(socket_create
, selinux_socket_create
),
6259 LSM_HOOK_INIT(socket_post_create
, selinux_socket_post_create
),
6260 LSM_HOOK_INIT(socket_bind
, selinux_socket_bind
),
6261 LSM_HOOK_INIT(socket_connect
, selinux_socket_connect
),
6262 LSM_HOOK_INIT(socket_listen
, selinux_socket_listen
),
6263 LSM_HOOK_INIT(socket_accept
, selinux_socket_accept
),
6264 LSM_HOOK_INIT(socket_sendmsg
, selinux_socket_sendmsg
),
6265 LSM_HOOK_INIT(socket_recvmsg
, selinux_socket_recvmsg
),
6266 LSM_HOOK_INIT(socket_getsockname
, selinux_socket_getsockname
),
6267 LSM_HOOK_INIT(socket_getpeername
, selinux_socket_getpeername
),
6268 LSM_HOOK_INIT(socket_getsockopt
, selinux_socket_getsockopt
),
6269 LSM_HOOK_INIT(socket_setsockopt
, selinux_socket_setsockopt
),
6270 LSM_HOOK_INIT(socket_shutdown
, selinux_socket_shutdown
),
6271 LSM_HOOK_INIT(socket_sock_rcv_skb
, selinux_socket_sock_rcv_skb
),
6272 LSM_HOOK_INIT(socket_getpeersec_stream
,
6273 selinux_socket_getpeersec_stream
),
6274 LSM_HOOK_INIT(socket_getpeersec_dgram
, selinux_socket_getpeersec_dgram
),
6275 LSM_HOOK_INIT(sk_alloc_security
, selinux_sk_alloc_security
),
6276 LSM_HOOK_INIT(sk_free_security
, selinux_sk_free_security
),
6277 LSM_HOOK_INIT(sk_clone_security
, selinux_sk_clone_security
),
6278 LSM_HOOK_INIT(sk_getsecid
, selinux_sk_getsecid
),
6279 LSM_HOOK_INIT(sock_graft
, selinux_sock_graft
),
6280 LSM_HOOK_INIT(inet_conn_request
, selinux_inet_conn_request
),
6281 LSM_HOOK_INIT(inet_csk_clone
, selinux_inet_csk_clone
),
6282 LSM_HOOK_INIT(inet_conn_established
, selinux_inet_conn_established
),
6283 LSM_HOOK_INIT(secmark_relabel_packet
, selinux_secmark_relabel_packet
),
6284 LSM_HOOK_INIT(secmark_refcount_inc
, selinux_secmark_refcount_inc
),
6285 LSM_HOOK_INIT(secmark_refcount_dec
, selinux_secmark_refcount_dec
),
6286 LSM_HOOK_INIT(req_classify_flow
, selinux_req_classify_flow
),
6287 LSM_HOOK_INIT(tun_dev_alloc_security
, selinux_tun_dev_alloc_security
),
6288 LSM_HOOK_INIT(tun_dev_free_security
, selinux_tun_dev_free_security
),
6289 LSM_HOOK_INIT(tun_dev_create
, selinux_tun_dev_create
),
6290 LSM_HOOK_INIT(tun_dev_attach_queue
, selinux_tun_dev_attach_queue
),
6291 LSM_HOOK_INIT(tun_dev_attach
, selinux_tun_dev_attach
),
6292 LSM_HOOK_INIT(tun_dev_open
, selinux_tun_dev_open
),
6294 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6295 LSM_HOOK_INIT(xfrm_policy_alloc_security
, selinux_xfrm_policy_alloc
),
6296 LSM_HOOK_INIT(xfrm_policy_clone_security
, selinux_xfrm_policy_clone
),
6297 LSM_HOOK_INIT(xfrm_policy_free_security
, selinux_xfrm_policy_free
),
6298 LSM_HOOK_INIT(xfrm_policy_delete_security
, selinux_xfrm_policy_delete
),
6299 LSM_HOOK_INIT(xfrm_state_alloc
, selinux_xfrm_state_alloc
),
6300 LSM_HOOK_INIT(xfrm_state_alloc_acquire
,
6301 selinux_xfrm_state_alloc_acquire
),
6302 LSM_HOOK_INIT(xfrm_state_free_security
, selinux_xfrm_state_free
),
6303 LSM_HOOK_INIT(xfrm_state_delete_security
, selinux_xfrm_state_delete
),
6304 LSM_HOOK_INIT(xfrm_policy_lookup
, selinux_xfrm_policy_lookup
),
6305 LSM_HOOK_INIT(xfrm_state_pol_flow_match
,
6306 selinux_xfrm_state_pol_flow_match
),
6307 LSM_HOOK_INIT(xfrm_decode_session
, selinux_xfrm_decode_session
),
6311 LSM_HOOK_INIT(key_alloc
, selinux_key_alloc
),
6312 LSM_HOOK_INIT(key_free
, selinux_key_free
),
6313 LSM_HOOK_INIT(key_permission
, selinux_key_permission
),
6314 LSM_HOOK_INIT(key_getsecurity
, selinux_key_getsecurity
),
6318 LSM_HOOK_INIT(audit_rule_init
, selinux_audit_rule_init
),
6319 LSM_HOOK_INIT(audit_rule_known
, selinux_audit_rule_known
),
6320 LSM_HOOK_INIT(audit_rule_match
, selinux_audit_rule_match
),
6321 LSM_HOOK_INIT(audit_rule_free
, selinux_audit_rule_free
),
6325 static __init
int selinux_init(void)
6327 if (!security_module_enable("selinux")) {
6328 selinux_enabled
= 0;
6332 if (!selinux_enabled
) {
6333 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
6337 printk(KERN_INFO
"SELinux: Initializing.\n");
6339 /* Set the security state for the initial task. */
6340 cred_init_security();
6342 default_noexec
= !(VM_DATA_DEFAULT_FLAGS
& VM_EXEC
);
6344 sel_inode_cache
= kmem_cache_create("selinux_inode_security",
6345 sizeof(struct inode_security_struct
),
6346 0, SLAB_PANIC
, NULL
);
6347 file_security_cache
= kmem_cache_create("selinux_file_security",
6348 sizeof(struct file_security_struct
),
6349 0, SLAB_PANIC
, NULL
);
6352 security_add_hooks(selinux_hooks
, ARRAY_SIZE(selinux_hooks
), "selinux");
6354 if (avc_add_callback(selinux_netcache_avc_callback
, AVC_CALLBACK_RESET
))
6355 panic("SELinux: Unable to register AVC netcache callback\n");
6357 if (selinux_enforcing
)
6358 printk(KERN_DEBUG
"SELinux: Starting in enforcing mode\n");
6360 printk(KERN_DEBUG
"SELinux: Starting in permissive mode\n");
6365 static void delayed_superblock_init(struct super_block
*sb
, void *unused
)
6367 superblock_doinit(sb
, NULL
);
6370 void selinux_complete_init(void)
6372 printk(KERN_DEBUG
"SELinux: Completing initialization.\n");
6374 /* Set up any superblocks initialized prior to the policy load. */
6375 printk(KERN_DEBUG
"SELinux: Setting up existing superblocks.\n");
6376 iterate_supers(delayed_superblock_init
, NULL
);
6379 /* SELinux requires early initialization in order to label
6380 all processes and objects when they are created. */
6381 security_initcall(selinux_init
);
6383 #if defined(CONFIG_NETFILTER)
6385 static struct nf_hook_ops selinux_nf_ops
[] = {
6387 .hook
= selinux_ipv4_postroute
,
6389 .hooknum
= NF_INET_POST_ROUTING
,
6390 .priority
= NF_IP_PRI_SELINUX_LAST
,
6393 .hook
= selinux_ipv4_forward
,
6395 .hooknum
= NF_INET_FORWARD
,
6396 .priority
= NF_IP_PRI_SELINUX_FIRST
,
6399 .hook
= selinux_ipv4_output
,
6401 .hooknum
= NF_INET_LOCAL_OUT
,
6402 .priority
= NF_IP_PRI_SELINUX_FIRST
,
6404 #if IS_ENABLED(CONFIG_IPV6)
6406 .hook
= selinux_ipv6_postroute
,
6408 .hooknum
= NF_INET_POST_ROUTING
,
6409 .priority
= NF_IP6_PRI_SELINUX_LAST
,
6412 .hook
= selinux_ipv6_forward
,
6414 .hooknum
= NF_INET_FORWARD
,
6415 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
6418 .hook
= selinux_ipv6_output
,
6420 .hooknum
= NF_INET_LOCAL_OUT
,
6421 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
6426 static int __init
selinux_nf_ip_init(void)
6430 if (!selinux_enabled
)
6433 printk(KERN_DEBUG
"SELinux: Registering netfilter hooks\n");
6435 err
= nf_register_hooks(selinux_nf_ops
, ARRAY_SIZE(selinux_nf_ops
));
6437 panic("SELinux: nf_register_hooks: error %d\n", err
);
6442 __initcall(selinux_nf_ip_init
);
6444 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6445 static void selinux_nf_ip_exit(void)
6447 printk(KERN_DEBUG
"SELinux: Unregistering netfilter hooks\n");
6449 nf_unregister_hooks(selinux_nf_ops
, ARRAY_SIZE(selinux_nf_ops
));
6453 #else /* CONFIG_NETFILTER */
6455 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6456 #define selinux_nf_ip_exit()
6459 #endif /* CONFIG_NETFILTER */
6461 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6462 static int selinux_disabled
;
6464 int selinux_disable(void)
6466 if (ss_initialized
) {
6467 /* Not permitted after initial policy load. */
6471 if (selinux_disabled
) {
6472 /* Only do this once. */
6476 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
6478 selinux_disabled
= 1;
6479 selinux_enabled
= 0;
6481 security_delete_hooks(selinux_hooks
, ARRAY_SIZE(selinux_hooks
));
6483 /* Try to destroy the avc node cache */
6486 /* Unregister netfilter hooks. */
6487 selinux_nf_ip_exit();
6489 /* Unregister selinuxfs. */