]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-hirsute-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
[mirror_ubuntu-hirsute-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 * Copyright (C) 2016 Mellanox Technologies
21 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
24 * as published by the Free Software Foundation.
25 */
26
27 #include <linux/init.h>
28 #include <linux/kd.h>
29 #include <linux/kernel.h>
30 #include <linux/tracehook.h>
31 #include <linux/errno.h>
32 #include <linux/sched/signal.h>
33 #include <linux/sched/task.h>
34 #include <linux/lsm_hooks.h>
35 #include <linux/xattr.h>
36 #include <linux/capability.h>
37 #include <linux/unistd.h>
38 #include <linux/mm.h>
39 #include <linux/mman.h>
40 #include <linux/slab.h>
41 #include <linux/pagemap.h>
42 #include <linux/proc_fs.h>
43 #include <linux/swap.h>
44 #include <linux/spinlock.h>
45 #include <linux/syscalls.h>
46 #include <linux/dcache.h>
47 #include <linux/file.h>
48 #include <linux/fdtable.h>
49 #include <linux/namei.h>
50 #include <linux/mount.h>
51 #include <linux/fs_context.h>
52 #include <linux/fs_parser.h>
53 #include <linux/netfilter_ipv4.h>
54 #include <linux/netfilter_ipv6.h>
55 #include <linux/tty.h>
56 #include <net/icmp.h>
57 #include <net/ip.h> /* for local_port_range[] */
58 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
59 #include <net/inet_connection_sock.h>
60 #include <net/net_namespace.h>
61 #include <net/netlabel.h>
62 #include <linux/uaccess.h>
63 #include <asm/ioctls.h>
64 #include <linux/atomic.h>
65 #include <linux/bitops.h>
66 #include <linux/interrupt.h>
67 #include <linux/netdevice.h> /* for network interface checks */
68 #include <net/netlink.h>
69 #include <linux/tcp.h>
70 #include <linux/udp.h>
71 #include <linux/dccp.h>
72 #include <linux/sctp.h>
73 #include <net/sctp/structs.h>
74 #include <linux/quota.h>
75 #include <linux/un.h> /* for Unix socket types */
76 #include <net/af_unix.h> /* for Unix socket types */
77 #include <linux/parser.h>
78 #include <linux/nfs_mount.h>
79 #include <net/ipv6.h>
80 #include <linux/hugetlb.h>
81 #include <linux/personality.h>
82 #include <linux/audit.h>
83 #include <linux/string.h>
84 #include <linux/mutex.h>
85 #include <linux/posix-timers.h>
86 #include <linux/syslog.h>
87 #include <linux/user_namespace.h>
88 #include <linux/export.h>
89 #include <linux/msg.h>
90 #include <linux/shm.h>
91 #include <linux/bpf.h>
92 #include <linux/kernfs.h>
93 #include <linux/stringhash.h> /* for hashlen_string() */
94 #include <uapi/linux/mount.h>
95
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106
107 struct selinux_state selinux_state;
108
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot;
114
115 static int __init enforcing_setup(char *str)
116 {
117 unsigned long enforcing;
118 if (!kstrtoul(str, 0, &enforcing))
119 selinux_enforcing_boot = enforcing ? 1 : 0;
120 return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126
127 int selinux_enabled __lsm_ro_after_init = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
130 {
131 unsigned long enabled;
132 if (!kstrtoul(str, 0, &enabled))
133 selinux_enabled = enabled ? 1 : 0;
134 return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138
139 static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142 static int __init checkreqprot_setup(char *str)
143 {
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot))
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 return 1;
149 }
150 __setup("checkreqprot=", checkreqprot_setup);
151
152 /**
153 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
154 *
155 * Description:
156 * This function checks the SECMARK reference counter to see if any SECMARK
157 * targets are currently configured, if the reference counter is greater than
158 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
159 * enabled, false (0) if SECMARK is disabled. If the always_check_network
160 * policy capability is enabled, SECMARK is always considered enabled.
161 *
162 */
163 static int selinux_secmark_enabled(void)
164 {
165 return (selinux_policycap_alwaysnetwork() ||
166 atomic_read(&selinux_secmark_refcount));
167 }
168
169 /**
170 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
171 *
172 * Description:
173 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
174 * (1) if any are enabled or false (0) if neither are enabled. If the
175 * always_check_network policy capability is enabled, peer labeling
176 * is always considered enabled.
177 *
178 */
179 static int selinux_peerlbl_enabled(void)
180 {
181 return (selinux_policycap_alwaysnetwork() ||
182 netlbl_enabled() || selinux_xfrm_enabled());
183 }
184
185 static int selinux_netcache_avc_callback(u32 event)
186 {
187 if (event == AVC_CALLBACK_RESET) {
188 sel_netif_flush();
189 sel_netnode_flush();
190 sel_netport_flush();
191 synchronize_net();
192 }
193 return 0;
194 }
195
196 static int selinux_lsm_notifier_avc_callback(u32 event)
197 {
198 if (event == AVC_CALLBACK_RESET) {
199 sel_ib_pkey_flush();
200 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
201 }
202
203 return 0;
204 }
205
206 /*
207 * initialise the security for the init task
208 */
209 static void cred_init_security(void)
210 {
211 struct cred *cred = (struct cred *) current->real_cred;
212 struct task_security_struct *tsec;
213
214 tsec = selinux_cred(cred);
215 tsec->osid = tsec->sid = SECINITSID_KERNEL;
216 }
217
218 /*
219 * get the security ID of a set of credentials
220 */
221 static inline u32 cred_sid(const struct cred *cred)
222 {
223 const struct task_security_struct *tsec;
224
225 tsec = selinux_cred(cred);
226 return tsec->sid;
227 }
228
229 /*
230 * get the objective security ID of a task
231 */
232 static inline u32 task_sid(const struct task_struct *task)
233 {
234 u32 sid;
235
236 rcu_read_lock();
237 sid = cred_sid(__task_cred(task));
238 rcu_read_unlock();
239 return sid;
240 }
241
242 /* Allocate and free functions for each kind of security blob. */
243
244 static int inode_alloc_security(struct inode *inode)
245 {
246 struct inode_security_struct *isec = selinux_inode(inode);
247 u32 sid = current_sid();
248
249 spin_lock_init(&isec->lock);
250 INIT_LIST_HEAD(&isec->list);
251 isec->inode = inode;
252 isec->sid = SECINITSID_UNLABELED;
253 isec->sclass = SECCLASS_FILE;
254 isec->task_sid = sid;
255 isec->initialized = LABEL_INVALID;
256
257 return 0;
258 }
259
260 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
261
262 /*
263 * Try reloading inode security labels that have been marked as invalid. The
264 * @may_sleep parameter indicates when sleeping and thus reloading labels is
265 * allowed; when set to false, returns -ECHILD when the label is
266 * invalid. The @dentry parameter should be set to a dentry of the inode.
267 */
268 static int __inode_security_revalidate(struct inode *inode,
269 struct dentry *dentry,
270 bool may_sleep)
271 {
272 struct inode_security_struct *isec = selinux_inode(inode);
273
274 might_sleep_if(may_sleep);
275
276 if (selinux_state.initialized &&
277 isec->initialized != LABEL_INITIALIZED) {
278 if (!may_sleep)
279 return -ECHILD;
280
281 /*
282 * Try reloading the inode security label. This will fail if
283 * @opt_dentry is NULL and no dentry for this inode can be
284 * found; in that case, continue using the old label.
285 */
286 inode_doinit_with_dentry(inode, dentry);
287 }
288 return 0;
289 }
290
291 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
292 {
293 return selinux_inode(inode);
294 }
295
296 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
297 {
298 int error;
299
300 error = __inode_security_revalidate(inode, NULL, !rcu);
301 if (error)
302 return ERR_PTR(error);
303 return selinux_inode(inode);
304 }
305
306 /*
307 * Get the security label of an inode.
308 */
309 static struct inode_security_struct *inode_security(struct inode *inode)
310 {
311 __inode_security_revalidate(inode, NULL, true);
312 return selinux_inode(inode);
313 }
314
315 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
316 {
317 struct inode *inode = d_backing_inode(dentry);
318
319 return selinux_inode(inode);
320 }
321
322 /*
323 * Get the security label of a dentry's backing inode.
324 */
325 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
326 {
327 struct inode *inode = d_backing_inode(dentry);
328
329 __inode_security_revalidate(inode, dentry, true);
330 return selinux_inode(inode);
331 }
332
333 static void inode_free_security(struct inode *inode)
334 {
335 struct inode_security_struct *isec = selinux_inode(inode);
336 struct superblock_security_struct *sbsec;
337
338 if (!isec)
339 return;
340 sbsec = inode->i_sb->s_security;
341 /*
342 * As not all inode security structures are in a list, we check for
343 * empty list outside of the lock to make sure that we won't waste
344 * time taking a lock doing nothing.
345 *
346 * The list_del_init() function can be safely called more than once.
347 * It should not be possible for this function to be called with
348 * concurrent list_add(), but for better safety against future changes
349 * in the code, we use list_empty_careful() here.
350 */
351 if (!list_empty_careful(&isec->list)) {
352 spin_lock(&sbsec->isec_lock);
353 list_del_init(&isec->list);
354 spin_unlock(&sbsec->isec_lock);
355 }
356 }
357
358 static int file_alloc_security(struct file *file)
359 {
360 struct file_security_struct *fsec = selinux_file(file);
361 u32 sid = current_sid();
362
363 fsec->sid = sid;
364 fsec->fown_sid = sid;
365
366 return 0;
367 }
368
369 static int superblock_alloc_security(struct super_block *sb)
370 {
371 struct superblock_security_struct *sbsec;
372
373 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
374 if (!sbsec)
375 return -ENOMEM;
376
377 mutex_init(&sbsec->lock);
378 INIT_LIST_HEAD(&sbsec->isec_head);
379 spin_lock_init(&sbsec->isec_lock);
380 sbsec->sb = sb;
381 sbsec->sid = SECINITSID_UNLABELED;
382 sbsec->def_sid = SECINITSID_FILE;
383 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
384 sb->s_security = sbsec;
385
386 return 0;
387 }
388
389 static void superblock_free_security(struct super_block *sb)
390 {
391 struct superblock_security_struct *sbsec = sb->s_security;
392 sb->s_security = NULL;
393 kfree(sbsec);
394 }
395
396 struct selinux_mnt_opts {
397 const char *fscontext, *context, *rootcontext, *defcontext;
398 };
399
400 static void selinux_free_mnt_opts(void *mnt_opts)
401 {
402 struct selinux_mnt_opts *opts = mnt_opts;
403 kfree(opts->fscontext);
404 kfree(opts->context);
405 kfree(opts->rootcontext);
406 kfree(opts->defcontext);
407 kfree(opts);
408 }
409
410 static inline int inode_doinit(struct inode *inode)
411 {
412 return inode_doinit_with_dentry(inode, NULL);
413 }
414
415 enum {
416 Opt_error = -1,
417 Opt_context = 0,
418 Opt_defcontext = 1,
419 Opt_fscontext = 2,
420 Opt_rootcontext = 3,
421 Opt_seclabel = 4,
422 };
423
424 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
425 static struct {
426 const char *name;
427 int len;
428 int opt;
429 bool has_arg;
430 } tokens[] = {
431 A(context, true),
432 A(fscontext, true),
433 A(defcontext, true),
434 A(rootcontext, true),
435 A(seclabel, false),
436 };
437 #undef A
438
439 static int match_opt_prefix(char *s, int l, char **arg)
440 {
441 int i;
442
443 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
444 size_t len = tokens[i].len;
445 if (len > l || memcmp(s, tokens[i].name, len))
446 continue;
447 if (tokens[i].has_arg) {
448 if (len == l || s[len] != '=')
449 continue;
450 *arg = s + len + 1;
451 } else if (len != l)
452 continue;
453 return tokens[i].opt;
454 }
455 return Opt_error;
456 }
457
458 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
459
460 static int may_context_mount_sb_relabel(u32 sid,
461 struct superblock_security_struct *sbsec,
462 const struct cred *cred)
463 {
464 const struct task_security_struct *tsec = selinux_cred(cred);
465 int rc;
466
467 rc = avc_has_perm(&selinux_state,
468 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
469 FILESYSTEM__RELABELFROM, NULL);
470 if (rc)
471 return rc;
472
473 rc = avc_has_perm(&selinux_state,
474 tsec->sid, sid, SECCLASS_FILESYSTEM,
475 FILESYSTEM__RELABELTO, NULL);
476 return rc;
477 }
478
479 static int may_context_mount_inode_relabel(u32 sid,
480 struct superblock_security_struct *sbsec,
481 const struct cred *cred)
482 {
483 const struct task_security_struct *tsec = selinux_cred(cred);
484 int rc;
485 rc = avc_has_perm(&selinux_state,
486 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__RELABELFROM, NULL);
488 if (rc)
489 return rc;
490
491 rc = avc_has_perm(&selinux_state,
492 sid, sbsec->sid, SECCLASS_FILESYSTEM,
493 FILESYSTEM__ASSOCIATE, NULL);
494 return rc;
495 }
496
497 static int selinux_is_genfs_special_handling(struct super_block *sb)
498 {
499 /* Special handling. Genfs but also in-core setxattr handler */
500 return !strcmp(sb->s_type->name, "sysfs") ||
501 !strcmp(sb->s_type->name, "pstore") ||
502 !strcmp(sb->s_type->name, "debugfs") ||
503 !strcmp(sb->s_type->name, "tracefs") ||
504 !strcmp(sb->s_type->name, "rootfs") ||
505 (selinux_policycap_cgroupseclabel() &&
506 (!strcmp(sb->s_type->name, "cgroup") ||
507 !strcmp(sb->s_type->name, "cgroup2")));
508 }
509
510 static int selinux_is_sblabel_mnt(struct super_block *sb)
511 {
512 struct superblock_security_struct *sbsec = sb->s_security;
513
514 /*
515 * IMPORTANT: Double-check logic in this function when adding a new
516 * SECURITY_FS_USE_* definition!
517 */
518 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
519
520 switch (sbsec->behavior) {
521 case SECURITY_FS_USE_XATTR:
522 case SECURITY_FS_USE_TRANS:
523 case SECURITY_FS_USE_TASK:
524 case SECURITY_FS_USE_NATIVE:
525 return 1;
526
527 case SECURITY_FS_USE_GENFS:
528 return selinux_is_genfs_special_handling(sb);
529
530 /* Never allow relabeling on context mounts */
531 case SECURITY_FS_USE_MNTPOINT:
532 case SECURITY_FS_USE_NONE:
533 default:
534 return 0;
535 }
536 }
537
538 static int sb_finish_set_opts(struct super_block *sb)
539 {
540 struct superblock_security_struct *sbsec = sb->s_security;
541 struct dentry *root = sb->s_root;
542 struct inode *root_inode = d_backing_inode(root);
543 int rc = 0;
544
545 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
546 /* Make sure that the xattr handler exists and that no
547 error other than -ENODATA is returned by getxattr on
548 the root directory. -ENODATA is ok, as this may be
549 the first boot of the SELinux kernel before we have
550 assigned xattr values to the filesystem. */
551 if (!(root_inode->i_opflags & IOP_XATTR)) {
552 pr_warn("SELinux: (dev %s, type %s) has no "
553 "xattr support\n", sb->s_id, sb->s_type->name);
554 rc = -EOPNOTSUPP;
555 goto out;
556 }
557
558 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
559 if (rc < 0 && rc != -ENODATA) {
560 if (rc == -EOPNOTSUPP)
561 pr_warn("SELinux: (dev %s, type "
562 "%s) has no security xattr handler\n",
563 sb->s_id, sb->s_type->name);
564 else
565 pr_warn("SELinux: (dev %s, type "
566 "%s) getxattr errno %d\n", sb->s_id,
567 sb->s_type->name, -rc);
568 goto out;
569 }
570 }
571
572 sbsec->flags |= SE_SBINITIALIZED;
573
574 /*
575 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
576 * leave the flag untouched because sb_clone_mnt_opts might be handing
577 * us a superblock that needs the flag to be cleared.
578 */
579 if (selinux_is_sblabel_mnt(sb))
580 sbsec->flags |= SBLABEL_MNT;
581 else
582 sbsec->flags &= ~SBLABEL_MNT;
583
584 /* Initialize the root inode. */
585 rc = inode_doinit_with_dentry(root_inode, root);
586
587 /* Initialize any other inodes associated with the superblock, e.g.
588 inodes created prior to initial policy load or inodes created
589 during get_sb by a pseudo filesystem that directly
590 populates itself. */
591 spin_lock(&sbsec->isec_lock);
592 while (!list_empty(&sbsec->isec_head)) {
593 struct inode_security_struct *isec =
594 list_first_entry(&sbsec->isec_head,
595 struct inode_security_struct, list);
596 struct inode *inode = isec->inode;
597 list_del_init(&isec->list);
598 spin_unlock(&sbsec->isec_lock);
599 inode = igrab(inode);
600 if (inode) {
601 if (!IS_PRIVATE(inode))
602 inode_doinit(inode);
603 iput(inode);
604 }
605 spin_lock(&sbsec->isec_lock);
606 }
607 spin_unlock(&sbsec->isec_lock);
608 out:
609 return rc;
610 }
611
612 static int bad_option(struct superblock_security_struct *sbsec, char flag,
613 u32 old_sid, u32 new_sid)
614 {
615 char mnt_flags = sbsec->flags & SE_MNTMASK;
616
617 /* check if the old mount command had the same options */
618 if (sbsec->flags & SE_SBINITIALIZED)
619 if (!(sbsec->flags & flag) ||
620 (old_sid != new_sid))
621 return 1;
622
623 /* check if we were passed the same options twice,
624 * aka someone passed context=a,context=b
625 */
626 if (!(sbsec->flags & SE_SBINITIALIZED))
627 if (mnt_flags & flag)
628 return 1;
629 return 0;
630 }
631
632 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
633 {
634 int rc = security_context_str_to_sid(&selinux_state, s,
635 sid, GFP_KERNEL);
636 if (rc)
637 pr_warn("SELinux: security_context_str_to_sid"
638 "(%s) failed for (dev %s, type %s) errno=%d\n",
639 s, sb->s_id, sb->s_type->name, rc);
640 return rc;
641 }
642
643 /*
644 * Allow filesystems with binary mount data to explicitly set mount point
645 * labeling information.
646 */
647 static int selinux_set_mnt_opts(struct super_block *sb,
648 void *mnt_opts,
649 unsigned long kern_flags,
650 unsigned long *set_kern_flags)
651 {
652 const struct cred *cred = current_cred();
653 struct superblock_security_struct *sbsec = sb->s_security;
654 struct dentry *root = sbsec->sb->s_root;
655 struct selinux_mnt_opts *opts = mnt_opts;
656 struct inode_security_struct *root_isec;
657 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
658 u32 defcontext_sid = 0;
659 int rc = 0;
660
661 mutex_lock(&sbsec->lock);
662
663 if (!selinux_state.initialized) {
664 if (!opts) {
665 /* Defer initialization until selinux_complete_init,
666 after the initial policy is loaded and the security
667 server is ready to handle calls. */
668 goto out;
669 }
670 rc = -EINVAL;
671 pr_warn("SELinux: Unable to set superblock options "
672 "before the security server is initialized\n");
673 goto out;
674 }
675 if (kern_flags && !set_kern_flags) {
676 /* Specifying internal flags without providing a place to
677 * place the results is not allowed */
678 rc = -EINVAL;
679 goto out;
680 }
681
682 /*
683 * Binary mount data FS will come through this function twice. Once
684 * from an explicit call and once from the generic calls from the vfs.
685 * Since the generic VFS calls will not contain any security mount data
686 * we need to skip the double mount verification.
687 *
688 * This does open a hole in which we will not notice if the first
689 * mount using this sb set explict options and a second mount using
690 * this sb does not set any security options. (The first options
691 * will be used for both mounts)
692 */
693 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
694 && !opts)
695 goto out;
696
697 root_isec = backing_inode_security_novalidate(root);
698
699 /*
700 * parse the mount options, check if they are valid sids.
701 * also check if someone is trying to mount the same sb more
702 * than once with different security options.
703 */
704 if (opts) {
705 if (opts->fscontext) {
706 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
707 if (rc)
708 goto out;
709 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
710 fscontext_sid))
711 goto out_double_mount;
712 sbsec->flags |= FSCONTEXT_MNT;
713 }
714 if (opts->context) {
715 rc = parse_sid(sb, opts->context, &context_sid);
716 if (rc)
717 goto out;
718 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
719 context_sid))
720 goto out_double_mount;
721 sbsec->flags |= CONTEXT_MNT;
722 }
723 if (opts->rootcontext) {
724 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
725 if (rc)
726 goto out;
727 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
728 rootcontext_sid))
729 goto out_double_mount;
730 sbsec->flags |= ROOTCONTEXT_MNT;
731 }
732 if (opts->defcontext) {
733 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
734 if (rc)
735 goto out;
736 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
737 defcontext_sid))
738 goto out_double_mount;
739 sbsec->flags |= DEFCONTEXT_MNT;
740 }
741 }
742
743 if (sbsec->flags & SE_SBINITIALIZED) {
744 /* previously mounted with options, but not on this attempt? */
745 if ((sbsec->flags & SE_MNTMASK) && !opts)
746 goto out_double_mount;
747 rc = 0;
748 goto out;
749 }
750
751 if (strcmp(sb->s_type->name, "proc") == 0)
752 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
753
754 if (!strcmp(sb->s_type->name, "debugfs") ||
755 !strcmp(sb->s_type->name, "tracefs") ||
756 !strcmp(sb->s_type->name, "pstore"))
757 sbsec->flags |= SE_SBGENFS;
758
759 if (!strcmp(sb->s_type->name, "sysfs") ||
760 !strcmp(sb->s_type->name, "cgroup") ||
761 !strcmp(sb->s_type->name, "cgroup2"))
762 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
763
764 if (!sbsec->behavior) {
765 /*
766 * Determine the labeling behavior to use for this
767 * filesystem type.
768 */
769 rc = security_fs_use(&selinux_state, sb);
770 if (rc) {
771 pr_warn("%s: security_fs_use(%s) returned %d\n",
772 __func__, sb->s_type->name, rc);
773 goto out;
774 }
775 }
776
777 /*
778 * If this is a user namespace mount and the filesystem type is not
779 * explicitly whitelisted, then no contexts are allowed on the command
780 * line and security labels must be ignored.
781 */
782 if (sb->s_user_ns != &init_user_ns &&
783 strcmp(sb->s_type->name, "tmpfs") &&
784 strcmp(sb->s_type->name, "ramfs") &&
785 strcmp(sb->s_type->name, "devpts")) {
786 if (context_sid || fscontext_sid || rootcontext_sid ||
787 defcontext_sid) {
788 rc = -EACCES;
789 goto out;
790 }
791 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
792 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
793 rc = security_transition_sid(&selinux_state,
794 current_sid(),
795 current_sid(),
796 SECCLASS_FILE, NULL,
797 &sbsec->mntpoint_sid);
798 if (rc)
799 goto out;
800 }
801 goto out_set_opts;
802 }
803
804 /* sets the context of the superblock for the fs being mounted. */
805 if (fscontext_sid) {
806 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
807 if (rc)
808 goto out;
809
810 sbsec->sid = fscontext_sid;
811 }
812
813 /*
814 * Switch to using mount point labeling behavior.
815 * sets the label used on all file below the mountpoint, and will set
816 * the superblock context if not already set.
817 */
818 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
819 sbsec->behavior = SECURITY_FS_USE_NATIVE;
820 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
821 }
822
823 if (context_sid) {
824 if (!fscontext_sid) {
825 rc = may_context_mount_sb_relabel(context_sid, sbsec,
826 cred);
827 if (rc)
828 goto out;
829 sbsec->sid = context_sid;
830 } else {
831 rc = may_context_mount_inode_relabel(context_sid, sbsec,
832 cred);
833 if (rc)
834 goto out;
835 }
836 if (!rootcontext_sid)
837 rootcontext_sid = context_sid;
838
839 sbsec->mntpoint_sid = context_sid;
840 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
841 }
842
843 if (rootcontext_sid) {
844 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
845 cred);
846 if (rc)
847 goto out;
848
849 root_isec->sid = rootcontext_sid;
850 root_isec->initialized = LABEL_INITIALIZED;
851 }
852
853 if (defcontext_sid) {
854 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
855 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
856 rc = -EINVAL;
857 pr_warn("SELinux: defcontext option is "
858 "invalid for this filesystem type\n");
859 goto out;
860 }
861
862 if (defcontext_sid != sbsec->def_sid) {
863 rc = may_context_mount_inode_relabel(defcontext_sid,
864 sbsec, cred);
865 if (rc)
866 goto out;
867 }
868
869 sbsec->def_sid = defcontext_sid;
870 }
871
872 out_set_opts:
873 rc = sb_finish_set_opts(sb);
874 out:
875 mutex_unlock(&sbsec->lock);
876 return rc;
877 out_double_mount:
878 rc = -EINVAL;
879 pr_warn("SELinux: mount invalid. Same superblock, different "
880 "security settings for (dev %s, type %s)\n", sb->s_id,
881 sb->s_type->name);
882 goto out;
883 }
884
885 static int selinux_cmp_sb_context(const struct super_block *oldsb,
886 const struct super_block *newsb)
887 {
888 struct superblock_security_struct *old = oldsb->s_security;
889 struct superblock_security_struct *new = newsb->s_security;
890 char oldflags = old->flags & SE_MNTMASK;
891 char newflags = new->flags & SE_MNTMASK;
892
893 if (oldflags != newflags)
894 goto mismatch;
895 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
896 goto mismatch;
897 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
898 goto mismatch;
899 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
900 goto mismatch;
901 if (oldflags & ROOTCONTEXT_MNT) {
902 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
903 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
904 if (oldroot->sid != newroot->sid)
905 goto mismatch;
906 }
907 return 0;
908 mismatch:
909 pr_warn("SELinux: mount invalid. Same superblock, "
910 "different security settings for (dev %s, "
911 "type %s)\n", newsb->s_id, newsb->s_type->name);
912 return -EBUSY;
913 }
914
915 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
916 struct super_block *newsb,
917 unsigned long kern_flags,
918 unsigned long *set_kern_flags)
919 {
920 int rc = 0;
921 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
922 struct superblock_security_struct *newsbsec = newsb->s_security;
923
924 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
925 int set_context = (oldsbsec->flags & CONTEXT_MNT);
926 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
927
928 /*
929 * if the parent was able to be mounted it clearly had no special lsm
930 * mount options. thus we can safely deal with this superblock later
931 */
932 if (!selinux_state.initialized)
933 return 0;
934
935 /*
936 * Specifying internal flags without providing a place to
937 * place the results is not allowed.
938 */
939 if (kern_flags && !set_kern_flags)
940 return -EINVAL;
941
942 /* how can we clone if the old one wasn't set up?? */
943 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
944
945 /* if fs is reusing a sb, make sure that the contexts match */
946 if (newsbsec->flags & SE_SBINITIALIZED) {
947 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
948 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
949 return selinux_cmp_sb_context(oldsb, newsb);
950 }
951
952 mutex_lock(&newsbsec->lock);
953
954 newsbsec->flags = oldsbsec->flags;
955
956 newsbsec->sid = oldsbsec->sid;
957 newsbsec->def_sid = oldsbsec->def_sid;
958 newsbsec->behavior = oldsbsec->behavior;
959
960 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
961 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
962 rc = security_fs_use(&selinux_state, newsb);
963 if (rc)
964 goto out;
965 }
966
967 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
968 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
969 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
970 }
971
972 if (set_context) {
973 u32 sid = oldsbsec->mntpoint_sid;
974
975 if (!set_fscontext)
976 newsbsec->sid = sid;
977 if (!set_rootcontext) {
978 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
979 newisec->sid = sid;
980 }
981 newsbsec->mntpoint_sid = sid;
982 }
983 if (set_rootcontext) {
984 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
985 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
986
987 newisec->sid = oldisec->sid;
988 }
989
990 sb_finish_set_opts(newsb);
991 out:
992 mutex_unlock(&newsbsec->lock);
993 return rc;
994 }
995
996 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
997 {
998 struct selinux_mnt_opts *opts = *mnt_opts;
999
1000 if (token == Opt_seclabel) /* eaten and completely ignored */
1001 return 0;
1002
1003 if (!opts) {
1004 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1005 if (!opts)
1006 return -ENOMEM;
1007 *mnt_opts = opts;
1008 }
1009 if (!s)
1010 return -ENOMEM;
1011 switch (token) {
1012 case Opt_context:
1013 if (opts->context || opts->defcontext)
1014 goto Einval;
1015 opts->context = s;
1016 break;
1017 case Opt_fscontext:
1018 if (opts->fscontext)
1019 goto Einval;
1020 opts->fscontext = s;
1021 break;
1022 case Opt_rootcontext:
1023 if (opts->rootcontext)
1024 goto Einval;
1025 opts->rootcontext = s;
1026 break;
1027 case Opt_defcontext:
1028 if (opts->context || opts->defcontext)
1029 goto Einval;
1030 opts->defcontext = s;
1031 break;
1032 }
1033 return 0;
1034 Einval:
1035 pr_warn(SEL_MOUNT_FAIL_MSG);
1036 return -EINVAL;
1037 }
1038
1039 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1040 void **mnt_opts)
1041 {
1042 int token = Opt_error;
1043 int rc, i;
1044
1045 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1046 if (strcmp(option, tokens[i].name) == 0) {
1047 token = tokens[i].opt;
1048 break;
1049 }
1050 }
1051
1052 if (token == Opt_error)
1053 return -EINVAL;
1054
1055 if (token != Opt_seclabel)
1056 val = kmemdup_nul(val, len, GFP_KERNEL);
1057 rc = selinux_add_opt(token, val, mnt_opts);
1058 if (unlikely(rc)) {
1059 kfree(val);
1060 if (*mnt_opts) {
1061 selinux_free_mnt_opts(*mnt_opts);
1062 *mnt_opts = NULL;
1063 }
1064 }
1065 return rc;
1066 }
1067
1068 static int show_sid(struct seq_file *m, u32 sid)
1069 {
1070 char *context = NULL;
1071 u32 len;
1072 int rc;
1073
1074 rc = security_sid_to_context(&selinux_state, sid,
1075 &context, &len);
1076 if (!rc) {
1077 bool has_comma = context && strchr(context, ',');
1078
1079 seq_putc(m, '=');
1080 if (has_comma)
1081 seq_putc(m, '\"');
1082 seq_escape(m, context, "\"\n\\");
1083 if (has_comma)
1084 seq_putc(m, '\"');
1085 }
1086 kfree(context);
1087 return rc;
1088 }
1089
1090 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1091 {
1092 struct superblock_security_struct *sbsec = sb->s_security;
1093 int rc;
1094
1095 if (!(sbsec->flags & SE_SBINITIALIZED))
1096 return 0;
1097
1098 if (!selinux_state.initialized)
1099 return 0;
1100
1101 if (sbsec->flags & FSCONTEXT_MNT) {
1102 seq_putc(m, ',');
1103 seq_puts(m, FSCONTEXT_STR);
1104 rc = show_sid(m, sbsec->sid);
1105 if (rc)
1106 return rc;
1107 }
1108 if (sbsec->flags & CONTEXT_MNT) {
1109 seq_putc(m, ',');
1110 seq_puts(m, CONTEXT_STR);
1111 rc = show_sid(m, sbsec->mntpoint_sid);
1112 if (rc)
1113 return rc;
1114 }
1115 if (sbsec->flags & DEFCONTEXT_MNT) {
1116 seq_putc(m, ',');
1117 seq_puts(m, DEFCONTEXT_STR);
1118 rc = show_sid(m, sbsec->def_sid);
1119 if (rc)
1120 return rc;
1121 }
1122 if (sbsec->flags & ROOTCONTEXT_MNT) {
1123 struct dentry *root = sbsec->sb->s_root;
1124 struct inode_security_struct *isec = backing_inode_security(root);
1125 seq_putc(m, ',');
1126 seq_puts(m, ROOTCONTEXT_STR);
1127 rc = show_sid(m, isec->sid);
1128 if (rc)
1129 return rc;
1130 }
1131 if (sbsec->flags & SBLABEL_MNT) {
1132 seq_putc(m, ',');
1133 seq_puts(m, SECLABEL_STR);
1134 }
1135 return 0;
1136 }
1137
1138 static inline u16 inode_mode_to_security_class(umode_t mode)
1139 {
1140 switch (mode & S_IFMT) {
1141 case S_IFSOCK:
1142 return SECCLASS_SOCK_FILE;
1143 case S_IFLNK:
1144 return SECCLASS_LNK_FILE;
1145 case S_IFREG:
1146 return SECCLASS_FILE;
1147 case S_IFBLK:
1148 return SECCLASS_BLK_FILE;
1149 case S_IFDIR:
1150 return SECCLASS_DIR;
1151 case S_IFCHR:
1152 return SECCLASS_CHR_FILE;
1153 case S_IFIFO:
1154 return SECCLASS_FIFO_FILE;
1155
1156 }
1157
1158 return SECCLASS_FILE;
1159 }
1160
1161 static inline int default_protocol_stream(int protocol)
1162 {
1163 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1164 }
1165
1166 static inline int default_protocol_dgram(int protocol)
1167 {
1168 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1169 }
1170
1171 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1172 {
1173 int extsockclass = selinux_policycap_extsockclass();
1174
1175 switch (family) {
1176 case PF_UNIX:
1177 switch (type) {
1178 case SOCK_STREAM:
1179 case SOCK_SEQPACKET:
1180 return SECCLASS_UNIX_STREAM_SOCKET;
1181 case SOCK_DGRAM:
1182 case SOCK_RAW:
1183 return SECCLASS_UNIX_DGRAM_SOCKET;
1184 }
1185 break;
1186 case PF_INET:
1187 case PF_INET6:
1188 switch (type) {
1189 case SOCK_STREAM:
1190 case SOCK_SEQPACKET:
1191 if (default_protocol_stream(protocol))
1192 return SECCLASS_TCP_SOCKET;
1193 else if (extsockclass && protocol == IPPROTO_SCTP)
1194 return SECCLASS_SCTP_SOCKET;
1195 else
1196 return SECCLASS_RAWIP_SOCKET;
1197 case SOCK_DGRAM:
1198 if (default_protocol_dgram(protocol))
1199 return SECCLASS_UDP_SOCKET;
1200 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1201 protocol == IPPROTO_ICMPV6))
1202 return SECCLASS_ICMP_SOCKET;
1203 else
1204 return SECCLASS_RAWIP_SOCKET;
1205 case SOCK_DCCP:
1206 return SECCLASS_DCCP_SOCKET;
1207 default:
1208 return SECCLASS_RAWIP_SOCKET;
1209 }
1210 break;
1211 case PF_NETLINK:
1212 switch (protocol) {
1213 case NETLINK_ROUTE:
1214 return SECCLASS_NETLINK_ROUTE_SOCKET;
1215 case NETLINK_SOCK_DIAG:
1216 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1217 case NETLINK_NFLOG:
1218 return SECCLASS_NETLINK_NFLOG_SOCKET;
1219 case NETLINK_XFRM:
1220 return SECCLASS_NETLINK_XFRM_SOCKET;
1221 case NETLINK_SELINUX:
1222 return SECCLASS_NETLINK_SELINUX_SOCKET;
1223 case NETLINK_ISCSI:
1224 return SECCLASS_NETLINK_ISCSI_SOCKET;
1225 case NETLINK_AUDIT:
1226 return SECCLASS_NETLINK_AUDIT_SOCKET;
1227 case NETLINK_FIB_LOOKUP:
1228 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1229 case NETLINK_CONNECTOR:
1230 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1231 case NETLINK_NETFILTER:
1232 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1233 case NETLINK_DNRTMSG:
1234 return SECCLASS_NETLINK_DNRT_SOCKET;
1235 case NETLINK_KOBJECT_UEVENT:
1236 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1237 case NETLINK_GENERIC:
1238 return SECCLASS_NETLINK_GENERIC_SOCKET;
1239 case NETLINK_SCSITRANSPORT:
1240 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1241 case NETLINK_RDMA:
1242 return SECCLASS_NETLINK_RDMA_SOCKET;
1243 case NETLINK_CRYPTO:
1244 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1245 default:
1246 return SECCLASS_NETLINK_SOCKET;
1247 }
1248 case PF_PACKET:
1249 return SECCLASS_PACKET_SOCKET;
1250 case PF_KEY:
1251 return SECCLASS_KEY_SOCKET;
1252 case PF_APPLETALK:
1253 return SECCLASS_APPLETALK_SOCKET;
1254 }
1255
1256 if (extsockclass) {
1257 switch (family) {
1258 case PF_AX25:
1259 return SECCLASS_AX25_SOCKET;
1260 case PF_IPX:
1261 return SECCLASS_IPX_SOCKET;
1262 case PF_NETROM:
1263 return SECCLASS_NETROM_SOCKET;
1264 case PF_ATMPVC:
1265 return SECCLASS_ATMPVC_SOCKET;
1266 case PF_X25:
1267 return SECCLASS_X25_SOCKET;
1268 case PF_ROSE:
1269 return SECCLASS_ROSE_SOCKET;
1270 case PF_DECnet:
1271 return SECCLASS_DECNET_SOCKET;
1272 case PF_ATMSVC:
1273 return SECCLASS_ATMSVC_SOCKET;
1274 case PF_RDS:
1275 return SECCLASS_RDS_SOCKET;
1276 case PF_IRDA:
1277 return SECCLASS_IRDA_SOCKET;
1278 case PF_PPPOX:
1279 return SECCLASS_PPPOX_SOCKET;
1280 case PF_LLC:
1281 return SECCLASS_LLC_SOCKET;
1282 case PF_CAN:
1283 return SECCLASS_CAN_SOCKET;
1284 case PF_TIPC:
1285 return SECCLASS_TIPC_SOCKET;
1286 case PF_BLUETOOTH:
1287 return SECCLASS_BLUETOOTH_SOCKET;
1288 case PF_IUCV:
1289 return SECCLASS_IUCV_SOCKET;
1290 case PF_RXRPC:
1291 return SECCLASS_RXRPC_SOCKET;
1292 case PF_ISDN:
1293 return SECCLASS_ISDN_SOCKET;
1294 case PF_PHONET:
1295 return SECCLASS_PHONET_SOCKET;
1296 case PF_IEEE802154:
1297 return SECCLASS_IEEE802154_SOCKET;
1298 case PF_CAIF:
1299 return SECCLASS_CAIF_SOCKET;
1300 case PF_ALG:
1301 return SECCLASS_ALG_SOCKET;
1302 case PF_NFC:
1303 return SECCLASS_NFC_SOCKET;
1304 case PF_VSOCK:
1305 return SECCLASS_VSOCK_SOCKET;
1306 case PF_KCM:
1307 return SECCLASS_KCM_SOCKET;
1308 case PF_QIPCRTR:
1309 return SECCLASS_QIPCRTR_SOCKET;
1310 case PF_SMC:
1311 return SECCLASS_SMC_SOCKET;
1312 case PF_XDP:
1313 return SECCLASS_XDP_SOCKET;
1314 #if PF_MAX > 45
1315 #error New address family defined, please update this function.
1316 #endif
1317 }
1318 }
1319
1320 return SECCLASS_SOCKET;
1321 }
1322
1323 static int selinux_genfs_get_sid(struct dentry *dentry,
1324 u16 tclass,
1325 u16 flags,
1326 u32 *sid)
1327 {
1328 int rc;
1329 struct super_block *sb = dentry->d_sb;
1330 char *buffer, *path;
1331
1332 buffer = (char *)__get_free_page(GFP_KERNEL);
1333 if (!buffer)
1334 return -ENOMEM;
1335
1336 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1337 if (IS_ERR(path))
1338 rc = PTR_ERR(path);
1339 else {
1340 if (flags & SE_SBPROC) {
1341 /* each process gets a /proc/PID/ entry. Strip off the
1342 * PID part to get a valid selinux labeling.
1343 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1344 while (path[1] >= '0' && path[1] <= '9') {
1345 path[1] = '/';
1346 path++;
1347 }
1348 }
1349 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1350 path, tclass, sid);
1351 if (rc == -ENOENT) {
1352 /* No match in policy, mark as unlabeled. */
1353 *sid = SECINITSID_UNLABELED;
1354 rc = 0;
1355 }
1356 }
1357 free_page((unsigned long)buffer);
1358 return rc;
1359 }
1360
1361 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1362 u32 def_sid, u32 *sid)
1363 {
1364 #define INITCONTEXTLEN 255
1365 char *context;
1366 unsigned int len;
1367 int rc;
1368
1369 len = INITCONTEXTLEN;
1370 context = kmalloc(len + 1, GFP_NOFS);
1371 if (!context)
1372 return -ENOMEM;
1373
1374 context[len] = '\0';
1375 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1376 if (rc == -ERANGE) {
1377 kfree(context);
1378
1379 /* Need a larger buffer. Query for the right size. */
1380 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1381 if (rc < 0)
1382 return rc;
1383
1384 len = rc;
1385 context = kmalloc(len + 1, GFP_NOFS);
1386 if (!context)
1387 return -ENOMEM;
1388
1389 context[len] = '\0';
1390 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1391 context, len);
1392 }
1393 if (rc < 0) {
1394 kfree(context);
1395 if (rc != -ENODATA) {
1396 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1397 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1398 return rc;
1399 }
1400 *sid = def_sid;
1401 return 0;
1402 }
1403
1404 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1405 def_sid, GFP_NOFS);
1406 if (rc) {
1407 char *dev = inode->i_sb->s_id;
1408 unsigned long ino = inode->i_ino;
1409
1410 if (rc == -EINVAL) {
1411 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1412 ino, dev, context);
1413 } else {
1414 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1415 __func__, context, -rc, dev, ino);
1416 }
1417 }
1418 kfree(context);
1419 return 0;
1420 }
1421
1422 /* The inode's security attributes must be initialized before first use. */
1423 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1424 {
1425 struct superblock_security_struct *sbsec = NULL;
1426 struct inode_security_struct *isec = selinux_inode(inode);
1427 u32 task_sid, sid = 0;
1428 u16 sclass;
1429 struct dentry *dentry;
1430 int rc = 0;
1431
1432 if (isec->initialized == LABEL_INITIALIZED)
1433 return 0;
1434
1435 spin_lock(&isec->lock);
1436 if (isec->initialized == LABEL_INITIALIZED)
1437 goto out_unlock;
1438
1439 if (isec->sclass == SECCLASS_FILE)
1440 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441
1442 sbsec = inode->i_sb->s_security;
1443 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1444 /* Defer initialization until selinux_complete_init,
1445 after the initial policy is loaded and the security
1446 server is ready to handle calls. */
1447 spin_lock(&sbsec->isec_lock);
1448 if (list_empty(&isec->list))
1449 list_add(&isec->list, &sbsec->isec_head);
1450 spin_unlock(&sbsec->isec_lock);
1451 goto out_unlock;
1452 }
1453
1454 sclass = isec->sclass;
1455 task_sid = isec->task_sid;
1456 sid = isec->sid;
1457 isec->initialized = LABEL_PENDING;
1458 spin_unlock(&isec->lock);
1459
1460 switch (sbsec->behavior) {
1461 case SECURITY_FS_USE_NATIVE:
1462 break;
1463 case SECURITY_FS_USE_XATTR:
1464 if (!(inode->i_opflags & IOP_XATTR)) {
1465 sid = sbsec->def_sid;
1466 break;
1467 }
1468 /* Need a dentry, since the xattr API requires one.
1469 Life would be simpler if we could just pass the inode. */
1470 if (opt_dentry) {
1471 /* Called from d_instantiate or d_splice_alias. */
1472 dentry = dget(opt_dentry);
1473 } else {
1474 /*
1475 * Called from selinux_complete_init, try to find a dentry.
1476 * Some filesystems really want a connected one, so try
1477 * that first. We could split SECURITY_FS_USE_XATTR in
1478 * two, depending upon that...
1479 */
1480 dentry = d_find_alias(inode);
1481 if (!dentry)
1482 dentry = d_find_any_alias(inode);
1483 }
1484 if (!dentry) {
1485 /*
1486 * this is can be hit on boot when a file is accessed
1487 * before the policy is loaded. When we load policy we
1488 * may find inodes that have no dentry on the
1489 * sbsec->isec_head list. No reason to complain as these
1490 * will get fixed up the next time we go through
1491 * inode_doinit with a dentry, before these inodes could
1492 * be used again by userspace.
1493 */
1494 goto out;
1495 }
1496
1497 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1498 &sid);
1499 dput(dentry);
1500 if (rc)
1501 goto out;
1502 break;
1503 case SECURITY_FS_USE_TASK:
1504 sid = task_sid;
1505 break;
1506 case SECURITY_FS_USE_TRANS:
1507 /* Default to the fs SID. */
1508 sid = sbsec->sid;
1509
1510 /* Try to obtain a transition SID. */
1511 rc = security_transition_sid(&selinux_state, task_sid, sid,
1512 sclass, NULL, &sid);
1513 if (rc)
1514 goto out;
1515 break;
1516 case SECURITY_FS_USE_MNTPOINT:
1517 sid = sbsec->mntpoint_sid;
1518 break;
1519 default:
1520 /* Default to the fs superblock SID. */
1521 sid = sbsec->sid;
1522
1523 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1524 /* We must have a dentry to determine the label on
1525 * procfs inodes */
1526 if (opt_dentry) {
1527 /* Called from d_instantiate or
1528 * d_splice_alias. */
1529 dentry = dget(opt_dentry);
1530 } else {
1531 /* Called from selinux_complete_init, try to
1532 * find a dentry. Some filesystems really want
1533 * a connected one, so try that first.
1534 */
1535 dentry = d_find_alias(inode);
1536 if (!dentry)
1537 dentry = d_find_any_alias(inode);
1538 }
1539 /*
1540 * This can be hit on boot when a file is accessed
1541 * before the policy is loaded. When we load policy we
1542 * may find inodes that have no dentry on the
1543 * sbsec->isec_head list. No reason to complain as
1544 * these will get fixed up the next time we go through
1545 * inode_doinit() with a dentry, before these inodes
1546 * could be used again by userspace.
1547 */
1548 if (!dentry)
1549 goto out;
1550 rc = selinux_genfs_get_sid(dentry, sclass,
1551 sbsec->flags, &sid);
1552 if (rc) {
1553 dput(dentry);
1554 goto out;
1555 }
1556
1557 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1558 (inode->i_opflags & IOP_XATTR)) {
1559 rc = inode_doinit_use_xattr(inode, dentry,
1560 sid, &sid);
1561 if (rc) {
1562 dput(dentry);
1563 goto out;
1564 }
1565 }
1566 dput(dentry);
1567 }
1568 break;
1569 }
1570
1571 out:
1572 spin_lock(&isec->lock);
1573 if (isec->initialized == LABEL_PENDING) {
1574 if (!sid || rc) {
1575 isec->initialized = LABEL_INVALID;
1576 goto out_unlock;
1577 }
1578
1579 isec->initialized = LABEL_INITIALIZED;
1580 isec->sid = sid;
1581 }
1582
1583 out_unlock:
1584 spin_unlock(&isec->lock);
1585 return rc;
1586 }
1587
1588 /* Convert a Linux signal to an access vector. */
1589 static inline u32 signal_to_av(int sig)
1590 {
1591 u32 perm = 0;
1592
1593 switch (sig) {
1594 case SIGCHLD:
1595 /* Commonly granted from child to parent. */
1596 perm = PROCESS__SIGCHLD;
1597 break;
1598 case SIGKILL:
1599 /* Cannot be caught or ignored */
1600 perm = PROCESS__SIGKILL;
1601 break;
1602 case SIGSTOP:
1603 /* Cannot be caught or ignored */
1604 perm = PROCESS__SIGSTOP;
1605 break;
1606 default:
1607 /* All other signals. */
1608 perm = PROCESS__SIGNAL;
1609 break;
1610 }
1611
1612 return perm;
1613 }
1614
1615 #if CAP_LAST_CAP > 63
1616 #error Fix SELinux to handle capabilities > 63.
1617 #endif
1618
1619 /* Check whether a task is allowed to use a capability. */
1620 static int cred_has_capability(const struct cred *cred,
1621 int cap, unsigned int opts, bool initns)
1622 {
1623 struct common_audit_data ad;
1624 struct av_decision avd;
1625 u16 sclass;
1626 u32 sid = cred_sid(cred);
1627 u32 av = CAP_TO_MASK(cap);
1628 int rc;
1629
1630 ad.type = LSM_AUDIT_DATA_CAP;
1631 ad.u.cap = cap;
1632
1633 switch (CAP_TO_INDEX(cap)) {
1634 case 0:
1635 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1636 break;
1637 case 1:
1638 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1639 break;
1640 default:
1641 pr_err("SELinux: out of range capability %d\n", cap);
1642 BUG();
1643 return -EINVAL;
1644 }
1645
1646 rc = avc_has_perm_noaudit(&selinux_state,
1647 sid, sid, sclass, av, 0, &avd);
1648 if (!(opts & CAP_OPT_NOAUDIT)) {
1649 int rc2 = avc_audit(&selinux_state,
1650 sid, sid, sclass, av, &avd, rc, &ad, 0);
1651 if (rc2)
1652 return rc2;
1653 }
1654 return rc;
1655 }
1656
1657 /* Check whether a task has a particular permission to an inode.
1658 The 'adp' parameter is optional and allows other audit
1659 data to be passed (e.g. the dentry). */
1660 static int inode_has_perm(const struct cred *cred,
1661 struct inode *inode,
1662 u32 perms,
1663 struct common_audit_data *adp)
1664 {
1665 struct inode_security_struct *isec;
1666 u32 sid;
1667
1668 validate_creds(cred);
1669
1670 if (unlikely(IS_PRIVATE(inode)))
1671 return 0;
1672
1673 sid = cred_sid(cred);
1674 isec = selinux_inode(inode);
1675
1676 return avc_has_perm(&selinux_state,
1677 sid, isec->sid, isec->sclass, perms, adp);
1678 }
1679
1680 /* Same as inode_has_perm, but pass explicit audit data containing
1681 the dentry to help the auditing code to more easily generate the
1682 pathname if needed. */
1683 static inline int dentry_has_perm(const struct cred *cred,
1684 struct dentry *dentry,
1685 u32 av)
1686 {
1687 struct inode *inode = d_backing_inode(dentry);
1688 struct common_audit_data ad;
1689
1690 ad.type = LSM_AUDIT_DATA_DENTRY;
1691 ad.u.dentry = dentry;
1692 __inode_security_revalidate(inode, dentry, true);
1693 return inode_has_perm(cred, inode, av, &ad);
1694 }
1695
1696 /* Same as inode_has_perm, but pass explicit audit data containing
1697 the path to help the auditing code to more easily generate the
1698 pathname if needed. */
1699 static inline int path_has_perm(const struct cred *cred,
1700 const struct path *path,
1701 u32 av)
1702 {
1703 struct inode *inode = d_backing_inode(path->dentry);
1704 struct common_audit_data ad;
1705
1706 ad.type = LSM_AUDIT_DATA_PATH;
1707 ad.u.path = *path;
1708 __inode_security_revalidate(inode, path->dentry, true);
1709 return inode_has_perm(cred, inode, av, &ad);
1710 }
1711
1712 /* Same as path_has_perm, but uses the inode from the file struct. */
1713 static inline int file_path_has_perm(const struct cred *cred,
1714 struct file *file,
1715 u32 av)
1716 {
1717 struct common_audit_data ad;
1718
1719 ad.type = LSM_AUDIT_DATA_FILE;
1720 ad.u.file = file;
1721 return inode_has_perm(cred, file_inode(file), av, &ad);
1722 }
1723
1724 #ifdef CONFIG_BPF_SYSCALL
1725 static int bpf_fd_pass(struct file *file, u32 sid);
1726 #endif
1727
1728 /* Check whether a task can use an open file descriptor to
1729 access an inode in a given way. Check access to the
1730 descriptor itself, and then use dentry_has_perm to
1731 check a particular permission to the file.
1732 Access to the descriptor is implicitly granted if it
1733 has the same SID as the process. If av is zero, then
1734 access to the file is not checked, e.g. for cases
1735 where only the descriptor is affected like seek. */
1736 static int file_has_perm(const struct cred *cred,
1737 struct file *file,
1738 u32 av)
1739 {
1740 struct file_security_struct *fsec = selinux_file(file);
1741 struct inode *inode = file_inode(file);
1742 struct common_audit_data ad;
1743 u32 sid = cred_sid(cred);
1744 int rc;
1745
1746 ad.type = LSM_AUDIT_DATA_FILE;
1747 ad.u.file = file;
1748
1749 if (sid != fsec->sid) {
1750 rc = avc_has_perm(&selinux_state,
1751 sid, fsec->sid,
1752 SECCLASS_FD,
1753 FD__USE,
1754 &ad);
1755 if (rc)
1756 goto out;
1757 }
1758
1759 #ifdef CONFIG_BPF_SYSCALL
1760 rc = bpf_fd_pass(file, cred_sid(cred));
1761 if (rc)
1762 return rc;
1763 #endif
1764
1765 /* av is zero if only checking access to the descriptor. */
1766 rc = 0;
1767 if (av)
1768 rc = inode_has_perm(cred, inode, av, &ad);
1769
1770 out:
1771 return rc;
1772 }
1773
1774 /*
1775 * Determine the label for an inode that might be unioned.
1776 */
1777 static int
1778 selinux_determine_inode_label(const struct task_security_struct *tsec,
1779 struct inode *dir,
1780 const struct qstr *name, u16 tclass,
1781 u32 *_new_isid)
1782 {
1783 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1784
1785 if ((sbsec->flags & SE_SBINITIALIZED) &&
1786 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1787 *_new_isid = sbsec->mntpoint_sid;
1788 } else if ((sbsec->flags & SBLABEL_MNT) &&
1789 tsec->create_sid) {
1790 *_new_isid = tsec->create_sid;
1791 } else {
1792 const struct inode_security_struct *dsec = inode_security(dir);
1793 return security_transition_sid(&selinux_state, tsec->sid,
1794 dsec->sid, tclass,
1795 name, _new_isid);
1796 }
1797
1798 return 0;
1799 }
1800
1801 /* Check whether a task can create a file. */
1802 static int may_create(struct inode *dir,
1803 struct dentry *dentry,
1804 u16 tclass)
1805 {
1806 const struct task_security_struct *tsec = selinux_cred(current_cred());
1807 struct inode_security_struct *dsec;
1808 struct superblock_security_struct *sbsec;
1809 u32 sid, newsid;
1810 struct common_audit_data ad;
1811 int rc;
1812
1813 dsec = inode_security(dir);
1814 sbsec = dir->i_sb->s_security;
1815
1816 sid = tsec->sid;
1817
1818 ad.type = LSM_AUDIT_DATA_DENTRY;
1819 ad.u.dentry = dentry;
1820
1821 rc = avc_has_perm(&selinux_state,
1822 sid, dsec->sid, SECCLASS_DIR,
1823 DIR__ADD_NAME | DIR__SEARCH,
1824 &ad);
1825 if (rc)
1826 return rc;
1827
1828 rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1829 &dentry->d_name, tclass, &newsid);
1830 if (rc)
1831 return rc;
1832
1833 rc = avc_has_perm(&selinux_state,
1834 sid, newsid, tclass, FILE__CREATE, &ad);
1835 if (rc)
1836 return rc;
1837
1838 return avc_has_perm(&selinux_state,
1839 newsid, sbsec->sid,
1840 SECCLASS_FILESYSTEM,
1841 FILESYSTEM__ASSOCIATE, &ad);
1842 }
1843
1844 #define MAY_LINK 0
1845 #define MAY_UNLINK 1
1846 #define MAY_RMDIR 2
1847
1848 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1849 static int may_link(struct inode *dir,
1850 struct dentry *dentry,
1851 int kind)
1852
1853 {
1854 struct inode_security_struct *dsec, *isec;
1855 struct common_audit_data ad;
1856 u32 sid = current_sid();
1857 u32 av;
1858 int rc;
1859
1860 dsec = inode_security(dir);
1861 isec = backing_inode_security(dentry);
1862
1863 ad.type = LSM_AUDIT_DATA_DENTRY;
1864 ad.u.dentry = dentry;
1865
1866 av = DIR__SEARCH;
1867 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1868 rc = avc_has_perm(&selinux_state,
1869 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1870 if (rc)
1871 return rc;
1872
1873 switch (kind) {
1874 case MAY_LINK:
1875 av = FILE__LINK;
1876 break;
1877 case MAY_UNLINK:
1878 av = FILE__UNLINK;
1879 break;
1880 case MAY_RMDIR:
1881 av = DIR__RMDIR;
1882 break;
1883 default:
1884 pr_warn("SELinux: %s: unrecognized kind %d\n",
1885 __func__, kind);
1886 return 0;
1887 }
1888
1889 rc = avc_has_perm(&selinux_state,
1890 sid, isec->sid, isec->sclass, av, &ad);
1891 return rc;
1892 }
1893
1894 static inline int may_rename(struct inode *old_dir,
1895 struct dentry *old_dentry,
1896 struct inode *new_dir,
1897 struct dentry *new_dentry)
1898 {
1899 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1900 struct common_audit_data ad;
1901 u32 sid = current_sid();
1902 u32 av;
1903 int old_is_dir, new_is_dir;
1904 int rc;
1905
1906 old_dsec = inode_security(old_dir);
1907 old_isec = backing_inode_security(old_dentry);
1908 old_is_dir = d_is_dir(old_dentry);
1909 new_dsec = inode_security(new_dir);
1910
1911 ad.type = LSM_AUDIT_DATA_DENTRY;
1912
1913 ad.u.dentry = old_dentry;
1914 rc = avc_has_perm(&selinux_state,
1915 sid, old_dsec->sid, SECCLASS_DIR,
1916 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1917 if (rc)
1918 return rc;
1919 rc = avc_has_perm(&selinux_state,
1920 sid, old_isec->sid,
1921 old_isec->sclass, FILE__RENAME, &ad);
1922 if (rc)
1923 return rc;
1924 if (old_is_dir && new_dir != old_dir) {
1925 rc = avc_has_perm(&selinux_state,
1926 sid, old_isec->sid,
1927 old_isec->sclass, DIR__REPARENT, &ad);
1928 if (rc)
1929 return rc;
1930 }
1931
1932 ad.u.dentry = new_dentry;
1933 av = DIR__ADD_NAME | DIR__SEARCH;
1934 if (d_is_positive(new_dentry))
1935 av |= DIR__REMOVE_NAME;
1936 rc = avc_has_perm(&selinux_state,
1937 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1938 if (rc)
1939 return rc;
1940 if (d_is_positive(new_dentry)) {
1941 new_isec = backing_inode_security(new_dentry);
1942 new_is_dir = d_is_dir(new_dentry);
1943 rc = avc_has_perm(&selinux_state,
1944 sid, new_isec->sid,
1945 new_isec->sclass,
1946 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1947 if (rc)
1948 return rc;
1949 }
1950
1951 return 0;
1952 }
1953
1954 /* Check whether a task can perform a filesystem operation. */
1955 static int superblock_has_perm(const struct cred *cred,
1956 struct super_block *sb,
1957 u32 perms,
1958 struct common_audit_data *ad)
1959 {
1960 struct superblock_security_struct *sbsec;
1961 u32 sid = cred_sid(cred);
1962
1963 sbsec = sb->s_security;
1964 return avc_has_perm(&selinux_state,
1965 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1966 }
1967
1968 /* Convert a Linux mode and permission mask to an access vector. */
1969 static inline u32 file_mask_to_av(int mode, int mask)
1970 {
1971 u32 av = 0;
1972
1973 if (!S_ISDIR(mode)) {
1974 if (mask & MAY_EXEC)
1975 av |= FILE__EXECUTE;
1976 if (mask & MAY_READ)
1977 av |= FILE__READ;
1978
1979 if (mask & MAY_APPEND)
1980 av |= FILE__APPEND;
1981 else if (mask & MAY_WRITE)
1982 av |= FILE__WRITE;
1983
1984 } else {
1985 if (mask & MAY_EXEC)
1986 av |= DIR__SEARCH;
1987 if (mask & MAY_WRITE)
1988 av |= DIR__WRITE;
1989 if (mask & MAY_READ)
1990 av |= DIR__READ;
1991 }
1992
1993 return av;
1994 }
1995
1996 /* Convert a Linux file to an access vector. */
1997 static inline u32 file_to_av(struct file *file)
1998 {
1999 u32 av = 0;
2000
2001 if (file->f_mode & FMODE_READ)
2002 av |= FILE__READ;
2003 if (file->f_mode & FMODE_WRITE) {
2004 if (file->f_flags & O_APPEND)
2005 av |= FILE__APPEND;
2006 else
2007 av |= FILE__WRITE;
2008 }
2009 if (!av) {
2010 /*
2011 * Special file opened with flags 3 for ioctl-only use.
2012 */
2013 av = FILE__IOCTL;
2014 }
2015
2016 return av;
2017 }
2018
2019 /*
2020 * Convert a file to an access vector and include the correct open
2021 * open permission.
2022 */
2023 static inline u32 open_file_to_av(struct file *file)
2024 {
2025 u32 av = file_to_av(file);
2026 struct inode *inode = file_inode(file);
2027
2028 if (selinux_policycap_openperm() &&
2029 inode->i_sb->s_magic != SOCKFS_MAGIC)
2030 av |= FILE__OPEN;
2031
2032 return av;
2033 }
2034
2035 /* Hook functions begin here. */
2036
2037 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2038 {
2039 u32 mysid = current_sid();
2040 u32 mgrsid = task_sid(mgr);
2041
2042 return avc_has_perm(&selinux_state,
2043 mysid, mgrsid, SECCLASS_BINDER,
2044 BINDER__SET_CONTEXT_MGR, NULL);
2045 }
2046
2047 static int selinux_binder_transaction(struct task_struct *from,
2048 struct task_struct *to)
2049 {
2050 u32 mysid = current_sid();
2051 u32 fromsid = task_sid(from);
2052 u32 tosid = task_sid(to);
2053 int rc;
2054
2055 if (mysid != fromsid) {
2056 rc = avc_has_perm(&selinux_state,
2057 mysid, fromsid, SECCLASS_BINDER,
2058 BINDER__IMPERSONATE, NULL);
2059 if (rc)
2060 return rc;
2061 }
2062
2063 return avc_has_perm(&selinux_state,
2064 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2065 NULL);
2066 }
2067
2068 static int selinux_binder_transfer_binder(struct task_struct *from,
2069 struct task_struct *to)
2070 {
2071 u32 fromsid = task_sid(from);
2072 u32 tosid = task_sid(to);
2073
2074 return avc_has_perm(&selinux_state,
2075 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2076 NULL);
2077 }
2078
2079 static int selinux_binder_transfer_file(struct task_struct *from,
2080 struct task_struct *to,
2081 struct file *file)
2082 {
2083 u32 sid = task_sid(to);
2084 struct file_security_struct *fsec = selinux_file(file);
2085 struct dentry *dentry = file->f_path.dentry;
2086 struct inode_security_struct *isec;
2087 struct common_audit_data ad;
2088 int rc;
2089
2090 ad.type = LSM_AUDIT_DATA_PATH;
2091 ad.u.path = file->f_path;
2092
2093 if (sid != fsec->sid) {
2094 rc = avc_has_perm(&selinux_state,
2095 sid, fsec->sid,
2096 SECCLASS_FD,
2097 FD__USE,
2098 &ad);
2099 if (rc)
2100 return rc;
2101 }
2102
2103 #ifdef CONFIG_BPF_SYSCALL
2104 rc = bpf_fd_pass(file, sid);
2105 if (rc)
2106 return rc;
2107 #endif
2108
2109 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2110 return 0;
2111
2112 isec = backing_inode_security(dentry);
2113 return avc_has_perm(&selinux_state,
2114 sid, isec->sid, isec->sclass, file_to_av(file),
2115 &ad);
2116 }
2117
2118 static int selinux_ptrace_access_check(struct task_struct *child,
2119 unsigned int mode)
2120 {
2121 u32 sid = current_sid();
2122 u32 csid = task_sid(child);
2123
2124 if (mode & PTRACE_MODE_READ)
2125 return avc_has_perm(&selinux_state,
2126 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2127
2128 return avc_has_perm(&selinux_state,
2129 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2130 }
2131
2132 static int selinux_ptrace_traceme(struct task_struct *parent)
2133 {
2134 return avc_has_perm(&selinux_state,
2135 task_sid(parent), current_sid(), SECCLASS_PROCESS,
2136 PROCESS__PTRACE, NULL);
2137 }
2138
2139 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2140 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2141 {
2142 return avc_has_perm(&selinux_state,
2143 current_sid(), task_sid(target), SECCLASS_PROCESS,
2144 PROCESS__GETCAP, NULL);
2145 }
2146
2147 static int selinux_capset(struct cred *new, const struct cred *old,
2148 const kernel_cap_t *effective,
2149 const kernel_cap_t *inheritable,
2150 const kernel_cap_t *permitted)
2151 {
2152 return avc_has_perm(&selinux_state,
2153 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2154 PROCESS__SETCAP, NULL);
2155 }
2156
2157 /*
2158 * (This comment used to live with the selinux_task_setuid hook,
2159 * which was removed).
2160 *
2161 * Since setuid only affects the current process, and since the SELinux
2162 * controls are not based on the Linux identity attributes, SELinux does not
2163 * need to control this operation. However, SELinux does control the use of
2164 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2165 */
2166
2167 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2168 int cap, unsigned int opts)
2169 {
2170 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2171 }
2172
2173 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2174 {
2175 const struct cred *cred = current_cred();
2176 int rc = 0;
2177
2178 if (!sb)
2179 return 0;
2180
2181 switch (cmds) {
2182 case Q_SYNC:
2183 case Q_QUOTAON:
2184 case Q_QUOTAOFF:
2185 case Q_SETINFO:
2186 case Q_SETQUOTA:
2187 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2188 break;
2189 case Q_GETFMT:
2190 case Q_GETINFO:
2191 case Q_GETQUOTA:
2192 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2193 break;
2194 default:
2195 rc = 0; /* let the kernel handle invalid cmds */
2196 break;
2197 }
2198 return rc;
2199 }
2200
2201 static int selinux_quota_on(struct dentry *dentry)
2202 {
2203 const struct cred *cred = current_cred();
2204
2205 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2206 }
2207
2208 static int selinux_syslog(int type)
2209 {
2210 switch (type) {
2211 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2212 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2213 return avc_has_perm(&selinux_state,
2214 current_sid(), SECINITSID_KERNEL,
2215 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2216 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2217 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2218 /* Set level of messages printed to console */
2219 case SYSLOG_ACTION_CONSOLE_LEVEL:
2220 return avc_has_perm(&selinux_state,
2221 current_sid(), SECINITSID_KERNEL,
2222 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2223 NULL);
2224 }
2225 /* All other syslog types */
2226 return avc_has_perm(&selinux_state,
2227 current_sid(), SECINITSID_KERNEL,
2228 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2229 }
2230
2231 /*
2232 * Check that a process has enough memory to allocate a new virtual
2233 * mapping. 0 means there is enough memory for the allocation to
2234 * succeed and -ENOMEM implies there is not.
2235 *
2236 * Do not audit the selinux permission check, as this is applied to all
2237 * processes that allocate mappings.
2238 */
2239 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2240 {
2241 int rc, cap_sys_admin = 0;
2242
2243 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2244 CAP_OPT_NOAUDIT, true);
2245 if (rc == 0)
2246 cap_sys_admin = 1;
2247
2248 return cap_sys_admin;
2249 }
2250
2251 /* binprm security operations */
2252
2253 static u32 ptrace_parent_sid(void)
2254 {
2255 u32 sid = 0;
2256 struct task_struct *tracer;
2257
2258 rcu_read_lock();
2259 tracer = ptrace_parent(current);
2260 if (tracer)
2261 sid = task_sid(tracer);
2262 rcu_read_unlock();
2263
2264 return sid;
2265 }
2266
2267 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2268 const struct task_security_struct *old_tsec,
2269 const struct task_security_struct *new_tsec)
2270 {
2271 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2272 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2273 int rc;
2274 u32 av;
2275
2276 if (!nnp && !nosuid)
2277 return 0; /* neither NNP nor nosuid */
2278
2279 if (new_tsec->sid == old_tsec->sid)
2280 return 0; /* No change in credentials */
2281
2282 /*
2283 * If the policy enables the nnp_nosuid_transition policy capability,
2284 * then we permit transitions under NNP or nosuid if the
2285 * policy allows the corresponding permission between
2286 * the old and new contexts.
2287 */
2288 if (selinux_policycap_nnp_nosuid_transition()) {
2289 av = 0;
2290 if (nnp)
2291 av |= PROCESS2__NNP_TRANSITION;
2292 if (nosuid)
2293 av |= PROCESS2__NOSUID_TRANSITION;
2294 rc = avc_has_perm(&selinux_state,
2295 old_tsec->sid, new_tsec->sid,
2296 SECCLASS_PROCESS2, av, NULL);
2297 if (!rc)
2298 return 0;
2299 }
2300
2301 /*
2302 * We also permit NNP or nosuid transitions to bounded SIDs,
2303 * i.e. SIDs that are guaranteed to only be allowed a subset
2304 * of the permissions of the current SID.
2305 */
2306 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2307 new_tsec->sid);
2308 if (!rc)
2309 return 0;
2310
2311 /*
2312 * On failure, preserve the errno values for NNP vs nosuid.
2313 * NNP: Operation not permitted for caller.
2314 * nosuid: Permission denied to file.
2315 */
2316 if (nnp)
2317 return -EPERM;
2318 return -EACCES;
2319 }
2320
2321 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2322 {
2323 const struct task_security_struct *old_tsec;
2324 struct task_security_struct *new_tsec;
2325 struct inode_security_struct *isec;
2326 struct common_audit_data ad;
2327 struct inode *inode = file_inode(bprm->file);
2328 int rc;
2329
2330 /* SELinux context only depends on initial program or script and not
2331 * the script interpreter */
2332 if (bprm->called_set_creds)
2333 return 0;
2334
2335 old_tsec = selinux_cred(current_cred());
2336 new_tsec = selinux_cred(bprm->cred);
2337 isec = inode_security(inode);
2338
2339 /* Default to the current task SID. */
2340 new_tsec->sid = old_tsec->sid;
2341 new_tsec->osid = old_tsec->sid;
2342
2343 /* Reset fs, key, and sock SIDs on execve. */
2344 new_tsec->create_sid = 0;
2345 new_tsec->keycreate_sid = 0;
2346 new_tsec->sockcreate_sid = 0;
2347
2348 if (old_tsec->exec_sid) {
2349 new_tsec->sid = old_tsec->exec_sid;
2350 /* Reset exec SID on execve. */
2351 new_tsec->exec_sid = 0;
2352
2353 /* Fail on NNP or nosuid if not an allowed transition. */
2354 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2355 if (rc)
2356 return rc;
2357 } else {
2358 /* Check for a default transition on this program. */
2359 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2360 isec->sid, SECCLASS_PROCESS, NULL,
2361 &new_tsec->sid);
2362 if (rc)
2363 return rc;
2364
2365 /*
2366 * Fallback to old SID on NNP or nosuid if not an allowed
2367 * transition.
2368 */
2369 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2370 if (rc)
2371 new_tsec->sid = old_tsec->sid;
2372 }
2373
2374 ad.type = LSM_AUDIT_DATA_FILE;
2375 ad.u.file = bprm->file;
2376
2377 if (new_tsec->sid == old_tsec->sid) {
2378 rc = avc_has_perm(&selinux_state,
2379 old_tsec->sid, isec->sid,
2380 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2381 if (rc)
2382 return rc;
2383 } else {
2384 /* Check permissions for the transition. */
2385 rc = avc_has_perm(&selinux_state,
2386 old_tsec->sid, new_tsec->sid,
2387 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2388 if (rc)
2389 return rc;
2390
2391 rc = avc_has_perm(&selinux_state,
2392 new_tsec->sid, isec->sid,
2393 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2394 if (rc)
2395 return rc;
2396
2397 /* Check for shared state */
2398 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2399 rc = avc_has_perm(&selinux_state,
2400 old_tsec->sid, new_tsec->sid,
2401 SECCLASS_PROCESS, PROCESS__SHARE,
2402 NULL);
2403 if (rc)
2404 return -EPERM;
2405 }
2406
2407 /* Make sure that anyone attempting to ptrace over a task that
2408 * changes its SID has the appropriate permit */
2409 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2410 u32 ptsid = ptrace_parent_sid();
2411 if (ptsid != 0) {
2412 rc = avc_has_perm(&selinux_state,
2413 ptsid, new_tsec->sid,
2414 SECCLASS_PROCESS,
2415 PROCESS__PTRACE, NULL);
2416 if (rc)
2417 return -EPERM;
2418 }
2419 }
2420
2421 /* Clear any possibly unsafe personality bits on exec: */
2422 bprm->per_clear |= PER_CLEAR_ON_SETID;
2423
2424 /* Enable secure mode for SIDs transitions unless
2425 the noatsecure permission is granted between
2426 the two SIDs, i.e. ahp returns 0. */
2427 rc = avc_has_perm(&selinux_state,
2428 old_tsec->sid, new_tsec->sid,
2429 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2430 NULL);
2431 bprm->secureexec |= !!rc;
2432 }
2433
2434 return 0;
2435 }
2436
2437 static int match_file(const void *p, struct file *file, unsigned fd)
2438 {
2439 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2440 }
2441
2442 /* Derived from fs/exec.c:flush_old_files. */
2443 static inline void flush_unauthorized_files(const struct cred *cred,
2444 struct files_struct *files)
2445 {
2446 struct file *file, *devnull = NULL;
2447 struct tty_struct *tty;
2448 int drop_tty = 0;
2449 unsigned n;
2450
2451 tty = get_current_tty();
2452 if (tty) {
2453 spin_lock(&tty->files_lock);
2454 if (!list_empty(&tty->tty_files)) {
2455 struct tty_file_private *file_priv;
2456
2457 /* Revalidate access to controlling tty.
2458 Use file_path_has_perm on the tty path directly
2459 rather than using file_has_perm, as this particular
2460 open file may belong to another process and we are
2461 only interested in the inode-based check here. */
2462 file_priv = list_first_entry(&tty->tty_files,
2463 struct tty_file_private, list);
2464 file = file_priv->file;
2465 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2466 drop_tty = 1;
2467 }
2468 spin_unlock(&tty->files_lock);
2469 tty_kref_put(tty);
2470 }
2471 /* Reset controlling tty. */
2472 if (drop_tty)
2473 no_tty();
2474
2475 /* Revalidate access to inherited open files. */
2476 n = iterate_fd(files, 0, match_file, cred);
2477 if (!n) /* none found? */
2478 return;
2479
2480 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2481 if (IS_ERR(devnull))
2482 devnull = NULL;
2483 /* replace all the matching ones with this */
2484 do {
2485 replace_fd(n - 1, devnull, 0);
2486 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2487 if (devnull)
2488 fput(devnull);
2489 }
2490
2491 /*
2492 * Prepare a process for imminent new credential changes due to exec
2493 */
2494 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2495 {
2496 struct task_security_struct *new_tsec;
2497 struct rlimit *rlim, *initrlim;
2498 int rc, i;
2499
2500 new_tsec = selinux_cred(bprm->cred);
2501 if (new_tsec->sid == new_tsec->osid)
2502 return;
2503
2504 /* Close files for which the new task SID is not authorized. */
2505 flush_unauthorized_files(bprm->cred, current->files);
2506
2507 /* Always clear parent death signal on SID transitions. */
2508 current->pdeath_signal = 0;
2509
2510 /* Check whether the new SID can inherit resource limits from the old
2511 * SID. If not, reset all soft limits to the lower of the current
2512 * task's hard limit and the init task's soft limit.
2513 *
2514 * Note that the setting of hard limits (even to lower them) can be
2515 * controlled by the setrlimit check. The inclusion of the init task's
2516 * soft limit into the computation is to avoid resetting soft limits
2517 * higher than the default soft limit for cases where the default is
2518 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2519 */
2520 rc = avc_has_perm(&selinux_state,
2521 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2522 PROCESS__RLIMITINH, NULL);
2523 if (rc) {
2524 /* protect against do_prlimit() */
2525 task_lock(current);
2526 for (i = 0; i < RLIM_NLIMITS; i++) {
2527 rlim = current->signal->rlim + i;
2528 initrlim = init_task.signal->rlim + i;
2529 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2530 }
2531 task_unlock(current);
2532 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2533 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2534 }
2535 }
2536
2537 /*
2538 * Clean up the process immediately after the installation of new credentials
2539 * due to exec
2540 */
2541 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542 {
2543 const struct task_security_struct *tsec = selinux_cred(current_cred());
2544 struct itimerval itimer;
2545 u32 osid, sid;
2546 int rc, i;
2547
2548 osid = tsec->osid;
2549 sid = tsec->sid;
2550
2551 if (sid == osid)
2552 return;
2553
2554 /* Check whether the new SID can inherit signal state from the old SID.
2555 * If not, clear itimers to avoid subsequent signal generation and
2556 * flush and unblock signals.
2557 *
2558 * This must occur _after_ the task SID has been updated so that any
2559 * kill done after the flush will be checked against the new SID.
2560 */
2561 rc = avc_has_perm(&selinux_state,
2562 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2563 if (rc) {
2564 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2565 memset(&itimer, 0, sizeof itimer);
2566 for (i = 0; i < 3; i++)
2567 do_setitimer(i, &itimer, NULL);
2568 }
2569 spin_lock_irq(&current->sighand->siglock);
2570 if (!fatal_signal_pending(current)) {
2571 flush_sigqueue(&current->pending);
2572 flush_sigqueue(&current->signal->shared_pending);
2573 flush_signal_handlers(current, 1);
2574 sigemptyset(&current->blocked);
2575 recalc_sigpending();
2576 }
2577 spin_unlock_irq(&current->sighand->siglock);
2578 }
2579
2580 /* Wake up the parent if it is waiting so that it can recheck
2581 * wait permission to the new task SID. */
2582 read_lock(&tasklist_lock);
2583 __wake_up_parent(current, current->real_parent);
2584 read_unlock(&tasklist_lock);
2585 }
2586
2587 /* superblock security operations */
2588
2589 static int selinux_sb_alloc_security(struct super_block *sb)
2590 {
2591 return superblock_alloc_security(sb);
2592 }
2593
2594 static void selinux_sb_free_security(struct super_block *sb)
2595 {
2596 superblock_free_security(sb);
2597 }
2598
2599 static inline int opt_len(const char *s)
2600 {
2601 bool open_quote = false;
2602 int len;
2603 char c;
2604
2605 for (len = 0; (c = s[len]) != '\0'; len++) {
2606 if (c == '"')
2607 open_quote = !open_quote;
2608 if (c == ',' && !open_quote)
2609 break;
2610 }
2611 return len;
2612 }
2613
2614 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2615 {
2616 char *from = options;
2617 char *to = options;
2618 bool first = true;
2619
2620 while (1) {
2621 int len = opt_len(from);
2622 int token, rc;
2623 char *arg = NULL;
2624
2625 token = match_opt_prefix(from, len, &arg);
2626
2627 if (token != Opt_error) {
2628 char *p, *q;
2629
2630 /* strip quotes */
2631 if (arg) {
2632 for (p = q = arg; p < from + len; p++) {
2633 char c = *p;
2634 if (c != '"')
2635 *q++ = c;
2636 }
2637 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2638 }
2639 rc = selinux_add_opt(token, arg, mnt_opts);
2640 if (unlikely(rc)) {
2641 kfree(arg);
2642 if (*mnt_opts) {
2643 selinux_free_mnt_opts(*mnt_opts);
2644 *mnt_opts = NULL;
2645 }
2646 return rc;
2647 }
2648 } else {
2649 if (!first) { // copy with preceding comma
2650 from--;
2651 len++;
2652 }
2653 if (to != from)
2654 memmove(to, from, len);
2655 to += len;
2656 first = false;
2657 }
2658 if (!from[len])
2659 break;
2660 from += len + 1;
2661 }
2662 *to = '\0';
2663 return 0;
2664 }
2665
2666 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2667 {
2668 struct selinux_mnt_opts *opts = mnt_opts;
2669 struct superblock_security_struct *sbsec = sb->s_security;
2670 u32 sid;
2671 int rc;
2672
2673 if (!(sbsec->flags & SE_SBINITIALIZED))
2674 return 0;
2675
2676 if (!opts)
2677 return 0;
2678
2679 if (opts->fscontext) {
2680 rc = parse_sid(sb, opts->fscontext, &sid);
2681 if (rc)
2682 return rc;
2683 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2684 goto out_bad_option;
2685 }
2686 if (opts->context) {
2687 rc = parse_sid(sb, opts->context, &sid);
2688 if (rc)
2689 return rc;
2690 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2691 goto out_bad_option;
2692 }
2693 if (opts->rootcontext) {
2694 struct inode_security_struct *root_isec;
2695 root_isec = backing_inode_security(sb->s_root);
2696 rc = parse_sid(sb, opts->rootcontext, &sid);
2697 if (rc)
2698 return rc;
2699 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2700 goto out_bad_option;
2701 }
2702 if (opts->defcontext) {
2703 rc = parse_sid(sb, opts->defcontext, &sid);
2704 if (rc)
2705 return rc;
2706 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2707 goto out_bad_option;
2708 }
2709 return 0;
2710
2711 out_bad_option:
2712 pr_warn("SELinux: unable to change security options "
2713 "during remount (dev %s, type=%s)\n", sb->s_id,
2714 sb->s_type->name);
2715 return -EINVAL;
2716 }
2717
2718 static int selinux_sb_kern_mount(struct super_block *sb)
2719 {
2720 const struct cred *cred = current_cred();
2721 struct common_audit_data ad;
2722
2723 ad.type = LSM_AUDIT_DATA_DENTRY;
2724 ad.u.dentry = sb->s_root;
2725 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2726 }
2727
2728 static int selinux_sb_statfs(struct dentry *dentry)
2729 {
2730 const struct cred *cred = current_cred();
2731 struct common_audit_data ad;
2732
2733 ad.type = LSM_AUDIT_DATA_DENTRY;
2734 ad.u.dentry = dentry->d_sb->s_root;
2735 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2736 }
2737
2738 static int selinux_mount(const char *dev_name,
2739 const struct path *path,
2740 const char *type,
2741 unsigned long flags,
2742 void *data)
2743 {
2744 const struct cred *cred = current_cred();
2745
2746 if (flags & MS_REMOUNT)
2747 return superblock_has_perm(cred, path->dentry->d_sb,
2748 FILESYSTEM__REMOUNT, NULL);
2749 else
2750 return path_has_perm(cred, path, FILE__MOUNTON);
2751 }
2752
2753 static int selinux_umount(struct vfsmount *mnt, int flags)
2754 {
2755 const struct cred *cred = current_cred();
2756
2757 return superblock_has_perm(cred, mnt->mnt_sb,
2758 FILESYSTEM__UNMOUNT, NULL);
2759 }
2760
2761 static int selinux_fs_context_dup(struct fs_context *fc,
2762 struct fs_context *src_fc)
2763 {
2764 const struct selinux_mnt_opts *src = src_fc->security;
2765 struct selinux_mnt_opts *opts;
2766
2767 if (!src)
2768 return 0;
2769
2770 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2771 if (!fc->security)
2772 return -ENOMEM;
2773
2774 opts = fc->security;
2775
2776 if (src->fscontext) {
2777 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2778 if (!opts->fscontext)
2779 return -ENOMEM;
2780 }
2781 if (src->context) {
2782 opts->context = kstrdup(src->context, GFP_KERNEL);
2783 if (!opts->context)
2784 return -ENOMEM;
2785 }
2786 if (src->rootcontext) {
2787 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2788 if (!opts->rootcontext)
2789 return -ENOMEM;
2790 }
2791 if (src->defcontext) {
2792 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2793 if (!opts->defcontext)
2794 return -ENOMEM;
2795 }
2796 return 0;
2797 }
2798
2799 static const struct fs_parameter_spec selinux_param_specs[] = {
2800 fsparam_string(CONTEXT_STR, Opt_context),
2801 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2802 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2803 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2804 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2805 {}
2806 };
2807
2808 static const struct fs_parameter_description selinux_fs_parameters = {
2809 .name = "SELinux",
2810 .specs = selinux_param_specs,
2811 };
2812
2813 static int selinux_fs_context_parse_param(struct fs_context *fc,
2814 struct fs_parameter *param)
2815 {
2816 struct fs_parse_result result;
2817 int opt, rc;
2818
2819 opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2820 if (opt < 0)
2821 return opt;
2822
2823 rc = selinux_add_opt(opt, param->string, &fc->security);
2824 if (!rc) {
2825 param->string = NULL;
2826 rc = 1;
2827 }
2828 return rc;
2829 }
2830
2831 /* inode security operations */
2832
2833 static int selinux_inode_alloc_security(struct inode *inode)
2834 {
2835 return inode_alloc_security(inode);
2836 }
2837
2838 static void selinux_inode_free_security(struct inode *inode)
2839 {
2840 inode_free_security(inode);
2841 }
2842
2843 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2844 const struct qstr *name, void **ctx,
2845 u32 *ctxlen)
2846 {
2847 u32 newsid;
2848 int rc;
2849
2850 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2851 d_inode(dentry->d_parent), name,
2852 inode_mode_to_security_class(mode),
2853 &newsid);
2854 if (rc)
2855 return rc;
2856
2857 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2858 ctxlen);
2859 }
2860
2861 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2862 struct qstr *name,
2863 const struct cred *old,
2864 struct cred *new)
2865 {
2866 u32 newsid;
2867 int rc;
2868 struct task_security_struct *tsec;
2869
2870 rc = selinux_determine_inode_label(selinux_cred(old),
2871 d_inode(dentry->d_parent), name,
2872 inode_mode_to_security_class(mode),
2873 &newsid);
2874 if (rc)
2875 return rc;
2876
2877 tsec = selinux_cred(new);
2878 tsec->create_sid = newsid;
2879 return 0;
2880 }
2881
2882 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2883 const struct qstr *qstr,
2884 const char **name,
2885 void **value, size_t *len)
2886 {
2887 const struct task_security_struct *tsec = selinux_cred(current_cred());
2888 struct superblock_security_struct *sbsec;
2889 u32 newsid, clen;
2890 int rc;
2891 char *context;
2892
2893 sbsec = dir->i_sb->s_security;
2894
2895 newsid = tsec->create_sid;
2896
2897 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2898 dir, qstr,
2899 inode_mode_to_security_class(inode->i_mode),
2900 &newsid);
2901 if (rc)
2902 return rc;
2903
2904 /* Possibly defer initialization to selinux_complete_init. */
2905 if (sbsec->flags & SE_SBINITIALIZED) {
2906 struct inode_security_struct *isec = selinux_inode(inode);
2907 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2908 isec->sid = newsid;
2909 isec->initialized = LABEL_INITIALIZED;
2910 }
2911
2912 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2913 return -EOPNOTSUPP;
2914
2915 if (name)
2916 *name = XATTR_SELINUX_SUFFIX;
2917
2918 if (value && len) {
2919 rc = security_sid_to_context_force(&selinux_state, newsid,
2920 &context, &clen);
2921 if (rc)
2922 return rc;
2923 *value = context;
2924 *len = clen;
2925 }
2926
2927 return 0;
2928 }
2929
2930 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2931 {
2932 return may_create(dir, dentry, SECCLASS_FILE);
2933 }
2934
2935 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2936 {
2937 return may_link(dir, old_dentry, MAY_LINK);
2938 }
2939
2940 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2941 {
2942 return may_link(dir, dentry, MAY_UNLINK);
2943 }
2944
2945 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2946 {
2947 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2948 }
2949
2950 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2951 {
2952 return may_create(dir, dentry, SECCLASS_DIR);
2953 }
2954
2955 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2956 {
2957 return may_link(dir, dentry, MAY_RMDIR);
2958 }
2959
2960 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2961 {
2962 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2963 }
2964
2965 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2966 struct inode *new_inode, struct dentry *new_dentry)
2967 {
2968 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2969 }
2970
2971 static int selinux_inode_readlink(struct dentry *dentry)
2972 {
2973 const struct cred *cred = current_cred();
2974
2975 return dentry_has_perm(cred, dentry, FILE__READ);
2976 }
2977
2978 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2979 bool rcu)
2980 {
2981 const struct cred *cred = current_cred();
2982 struct common_audit_data ad;
2983 struct inode_security_struct *isec;
2984 u32 sid;
2985
2986 validate_creds(cred);
2987
2988 ad.type = LSM_AUDIT_DATA_DENTRY;
2989 ad.u.dentry = dentry;
2990 sid = cred_sid(cred);
2991 isec = inode_security_rcu(inode, rcu);
2992 if (IS_ERR(isec))
2993 return PTR_ERR(isec);
2994
2995 return avc_has_perm(&selinux_state,
2996 sid, isec->sid, isec->sclass, FILE__READ, &ad);
2997 }
2998
2999 static noinline int audit_inode_permission(struct inode *inode,
3000 u32 perms, u32 audited, u32 denied,
3001 int result,
3002 unsigned flags)
3003 {
3004 struct common_audit_data ad;
3005 struct inode_security_struct *isec = selinux_inode(inode);
3006 int rc;
3007
3008 ad.type = LSM_AUDIT_DATA_INODE;
3009 ad.u.inode = inode;
3010
3011 rc = slow_avc_audit(&selinux_state,
3012 current_sid(), isec->sid, isec->sclass, perms,
3013 audited, denied, result, &ad, flags);
3014 if (rc)
3015 return rc;
3016 return 0;
3017 }
3018
3019 static int selinux_inode_permission(struct inode *inode, int mask)
3020 {
3021 const struct cred *cred = current_cred();
3022 u32 perms;
3023 bool from_access;
3024 unsigned flags = mask & MAY_NOT_BLOCK;
3025 struct inode_security_struct *isec;
3026 u32 sid;
3027 struct av_decision avd;
3028 int rc, rc2;
3029 u32 audited, denied;
3030
3031 from_access = mask & MAY_ACCESS;
3032 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3033
3034 /* No permission to check. Existence test. */
3035 if (!mask)
3036 return 0;
3037
3038 validate_creds(cred);
3039
3040 if (unlikely(IS_PRIVATE(inode)))
3041 return 0;
3042
3043 perms = file_mask_to_av(inode->i_mode, mask);
3044
3045 sid = cred_sid(cred);
3046 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3047 if (IS_ERR(isec))
3048 return PTR_ERR(isec);
3049
3050 rc = avc_has_perm_noaudit(&selinux_state,
3051 sid, isec->sid, isec->sclass, perms,
3052 (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3053 &avd);
3054 audited = avc_audit_required(perms, &avd, rc,
3055 from_access ? FILE__AUDIT_ACCESS : 0,
3056 &denied);
3057 if (likely(!audited))
3058 return rc;
3059
3060 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3061 if (rc2)
3062 return rc2;
3063 return rc;
3064 }
3065
3066 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3067 {
3068 const struct cred *cred = current_cred();
3069 struct inode *inode = d_backing_inode(dentry);
3070 unsigned int ia_valid = iattr->ia_valid;
3071 __u32 av = FILE__WRITE;
3072
3073 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3074 if (ia_valid & ATTR_FORCE) {
3075 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3076 ATTR_FORCE);
3077 if (!ia_valid)
3078 return 0;
3079 }
3080
3081 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3082 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3083 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3084
3085 if (selinux_policycap_openperm() &&
3086 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3087 (ia_valid & ATTR_SIZE) &&
3088 !(ia_valid & ATTR_FILE))
3089 av |= FILE__OPEN;
3090
3091 return dentry_has_perm(cred, dentry, av);
3092 }
3093
3094 static int selinux_inode_getattr(const struct path *path)
3095 {
3096 return path_has_perm(current_cred(), path, FILE__GETATTR);
3097 }
3098
3099 static bool has_cap_mac_admin(bool audit)
3100 {
3101 const struct cred *cred = current_cred();
3102 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3103
3104 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3105 return false;
3106 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3107 return false;
3108 return true;
3109 }
3110
3111 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3112 const void *value, size_t size, int flags)
3113 {
3114 struct inode *inode = d_backing_inode(dentry);
3115 struct inode_security_struct *isec;
3116 struct superblock_security_struct *sbsec;
3117 struct common_audit_data ad;
3118 u32 newsid, sid = current_sid();
3119 int rc = 0;
3120
3121 if (strcmp(name, XATTR_NAME_SELINUX)) {
3122 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3123 if (rc)
3124 return rc;
3125
3126 /* Not an attribute we recognize, so just check the
3127 ordinary setattr permission. */
3128 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3129 }
3130
3131 sbsec = inode->i_sb->s_security;
3132 if (!(sbsec->flags & SBLABEL_MNT))
3133 return -EOPNOTSUPP;
3134
3135 if (!inode_owner_or_capable(inode))
3136 return -EPERM;
3137
3138 ad.type = LSM_AUDIT_DATA_DENTRY;
3139 ad.u.dentry = dentry;
3140
3141 isec = backing_inode_security(dentry);
3142 rc = avc_has_perm(&selinux_state,
3143 sid, isec->sid, isec->sclass,
3144 FILE__RELABELFROM, &ad);
3145 if (rc)
3146 return rc;
3147
3148 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3149 GFP_KERNEL);
3150 if (rc == -EINVAL) {
3151 if (!has_cap_mac_admin(true)) {
3152 struct audit_buffer *ab;
3153 size_t audit_size;
3154
3155 /* We strip a nul only if it is at the end, otherwise the
3156 * context contains a nul and we should audit that */
3157 if (value) {
3158 const char *str = value;
3159
3160 if (str[size - 1] == '\0')
3161 audit_size = size - 1;
3162 else
3163 audit_size = size;
3164 } else {
3165 audit_size = 0;
3166 }
3167 ab = audit_log_start(audit_context(),
3168 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3169 audit_log_format(ab, "op=setxattr invalid_context=");
3170 audit_log_n_untrustedstring(ab, value, audit_size);
3171 audit_log_end(ab);
3172
3173 return rc;
3174 }
3175 rc = security_context_to_sid_force(&selinux_state, value,
3176 size, &newsid);
3177 }
3178 if (rc)
3179 return rc;
3180
3181 rc = avc_has_perm(&selinux_state,
3182 sid, newsid, isec->sclass,
3183 FILE__RELABELTO, &ad);
3184 if (rc)
3185 return rc;
3186
3187 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3188 sid, isec->sclass);
3189 if (rc)
3190 return rc;
3191
3192 return avc_has_perm(&selinux_state,
3193 newsid,
3194 sbsec->sid,
3195 SECCLASS_FILESYSTEM,
3196 FILESYSTEM__ASSOCIATE,
3197 &ad);
3198 }
3199
3200 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3201 const void *value, size_t size,
3202 int flags)
3203 {
3204 struct inode *inode = d_backing_inode(dentry);
3205 struct inode_security_struct *isec;
3206 u32 newsid;
3207 int rc;
3208
3209 if (strcmp(name, XATTR_NAME_SELINUX)) {
3210 /* Not an attribute we recognize, so nothing to do. */
3211 return;
3212 }
3213
3214 rc = security_context_to_sid_force(&selinux_state, value, size,
3215 &newsid);
3216 if (rc) {
3217 pr_err("SELinux: unable to map context to SID"
3218 "for (%s, %lu), rc=%d\n",
3219 inode->i_sb->s_id, inode->i_ino, -rc);
3220 return;
3221 }
3222
3223 isec = backing_inode_security(dentry);
3224 spin_lock(&isec->lock);
3225 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3226 isec->sid = newsid;
3227 isec->initialized = LABEL_INITIALIZED;
3228 spin_unlock(&isec->lock);
3229
3230 return;
3231 }
3232
3233 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3234 {
3235 const struct cred *cred = current_cred();
3236
3237 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3238 }
3239
3240 static int selinux_inode_listxattr(struct dentry *dentry)
3241 {
3242 const struct cred *cred = current_cred();
3243
3244 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3245 }
3246
3247 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3248 {
3249 if (strcmp(name, XATTR_NAME_SELINUX)) {
3250 int rc = cap_inode_removexattr(dentry, name);
3251 if (rc)
3252 return rc;
3253
3254 /* Not an attribute we recognize, so just check the
3255 ordinary setattr permission. */
3256 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3257 }
3258
3259 /* No one is allowed to remove a SELinux security label.
3260 You can change the label, but all data must be labeled. */
3261 return -EACCES;
3262 }
3263
3264 /*
3265 * Copy the inode security context value to the user.
3266 *
3267 * Permission check is handled by selinux_inode_getxattr hook.
3268 */
3269 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3270 {
3271 u32 size;
3272 int error;
3273 char *context = NULL;
3274 struct inode_security_struct *isec;
3275
3276 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3277 return -EOPNOTSUPP;
3278
3279 /*
3280 * If the caller has CAP_MAC_ADMIN, then get the raw context
3281 * value even if it is not defined by current policy; otherwise,
3282 * use the in-core value under current policy.
3283 * Use the non-auditing forms of the permission checks since
3284 * getxattr may be called by unprivileged processes commonly
3285 * and lack of permission just means that we fall back to the
3286 * in-core context value, not a denial.
3287 */
3288 isec = inode_security(inode);
3289 if (has_cap_mac_admin(false))
3290 error = security_sid_to_context_force(&selinux_state,
3291 isec->sid, &context,
3292 &size);
3293 else
3294 error = security_sid_to_context(&selinux_state, isec->sid,
3295 &context, &size);
3296 if (error)
3297 return error;
3298 error = size;
3299 if (alloc) {
3300 *buffer = context;
3301 goto out_nofree;
3302 }
3303 kfree(context);
3304 out_nofree:
3305 return error;
3306 }
3307
3308 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3309 const void *value, size_t size, int flags)
3310 {
3311 struct inode_security_struct *isec = inode_security_novalidate(inode);
3312 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3313 u32 newsid;
3314 int rc;
3315
3316 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3317 return -EOPNOTSUPP;
3318
3319 if (!(sbsec->flags & SBLABEL_MNT))
3320 return -EOPNOTSUPP;
3321
3322 if (!value || !size)
3323 return -EACCES;
3324
3325 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3326 GFP_KERNEL);
3327 if (rc)
3328 return rc;
3329
3330 spin_lock(&isec->lock);
3331 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3332 isec->sid = newsid;
3333 isec->initialized = LABEL_INITIALIZED;
3334 spin_unlock(&isec->lock);
3335 return 0;
3336 }
3337
3338 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3339 {
3340 const int len = sizeof(XATTR_NAME_SELINUX);
3341 if (buffer && len <= buffer_size)
3342 memcpy(buffer, XATTR_NAME_SELINUX, len);
3343 return len;
3344 }
3345
3346 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3347 {
3348 struct inode_security_struct *isec = inode_security_novalidate(inode);
3349 *secid = isec->sid;
3350 }
3351
3352 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3353 {
3354 u32 sid;
3355 struct task_security_struct *tsec;
3356 struct cred *new_creds = *new;
3357
3358 if (new_creds == NULL) {
3359 new_creds = prepare_creds();
3360 if (!new_creds)
3361 return -ENOMEM;
3362 }
3363
3364 tsec = selinux_cred(new_creds);
3365 /* Get label from overlay inode and set it in create_sid */
3366 selinux_inode_getsecid(d_inode(src), &sid);
3367 tsec->create_sid = sid;
3368 *new = new_creds;
3369 return 0;
3370 }
3371
3372 static int selinux_inode_copy_up_xattr(const char *name)
3373 {
3374 /* The copy_up hook above sets the initial context on an inode, but we
3375 * don't then want to overwrite it by blindly copying all the lower
3376 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3377 */
3378 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3379 return 1; /* Discard */
3380 /*
3381 * Any other attribute apart from SELINUX is not claimed, supported
3382 * by selinux.
3383 */
3384 return -EOPNOTSUPP;
3385 }
3386
3387 /* kernfs node operations */
3388
3389 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3390 struct kernfs_node *kn)
3391 {
3392 const struct task_security_struct *tsec = current_security();
3393 u32 parent_sid, newsid, clen;
3394 int rc;
3395 char *context;
3396
3397 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3398 if (rc == -ENODATA)
3399 return 0;
3400 else if (rc < 0)
3401 return rc;
3402
3403 clen = (u32)rc;
3404 context = kmalloc(clen, GFP_KERNEL);
3405 if (!context)
3406 return -ENOMEM;
3407
3408 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3409 if (rc < 0) {
3410 kfree(context);
3411 return rc;
3412 }
3413
3414 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3415 GFP_KERNEL);
3416 kfree(context);
3417 if (rc)
3418 return rc;
3419
3420 if (tsec->create_sid) {
3421 newsid = tsec->create_sid;
3422 } else {
3423 u16 secclass = inode_mode_to_security_class(kn->mode);
3424 struct qstr q;
3425
3426 q.name = kn->name;
3427 q.hash_len = hashlen_string(kn_dir, kn->name);
3428
3429 rc = security_transition_sid(&selinux_state, tsec->sid,
3430 parent_sid, secclass, &q,
3431 &newsid);
3432 if (rc)
3433 return rc;
3434 }
3435
3436 rc = security_sid_to_context_force(&selinux_state, newsid,
3437 &context, &clen);
3438 if (rc)
3439 return rc;
3440
3441 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3442 XATTR_CREATE);
3443 kfree(context);
3444 return rc;
3445 }
3446
3447
3448 /* file security operations */
3449
3450 static int selinux_revalidate_file_permission(struct file *file, int mask)
3451 {
3452 const struct cred *cred = current_cred();
3453 struct inode *inode = file_inode(file);
3454
3455 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3456 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3457 mask |= MAY_APPEND;
3458
3459 return file_has_perm(cred, file,
3460 file_mask_to_av(inode->i_mode, mask));
3461 }
3462
3463 static int selinux_file_permission(struct file *file, int mask)
3464 {
3465 struct inode *inode = file_inode(file);
3466 struct file_security_struct *fsec = selinux_file(file);
3467 struct inode_security_struct *isec;
3468 u32 sid = current_sid();
3469
3470 if (!mask)
3471 /* No permission to check. Existence test. */
3472 return 0;
3473
3474 isec = inode_security(inode);
3475 if (sid == fsec->sid && fsec->isid == isec->sid &&
3476 fsec->pseqno == avc_policy_seqno(&selinux_state))
3477 /* No change since file_open check. */
3478 return 0;
3479
3480 return selinux_revalidate_file_permission(file, mask);
3481 }
3482
3483 static int selinux_file_alloc_security(struct file *file)
3484 {
3485 return file_alloc_security(file);
3486 }
3487
3488 /*
3489 * Check whether a task has the ioctl permission and cmd
3490 * operation to an inode.
3491 */
3492 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3493 u32 requested, u16 cmd)
3494 {
3495 struct common_audit_data ad;
3496 struct file_security_struct *fsec = selinux_file(file);
3497 struct inode *inode = file_inode(file);
3498 struct inode_security_struct *isec;
3499 struct lsm_ioctlop_audit ioctl;
3500 u32 ssid = cred_sid(cred);
3501 int rc;
3502 u8 driver = cmd >> 8;
3503 u8 xperm = cmd & 0xff;
3504
3505 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3506 ad.u.op = &ioctl;
3507 ad.u.op->cmd = cmd;
3508 ad.u.op->path = file->f_path;
3509
3510 if (ssid != fsec->sid) {
3511 rc = avc_has_perm(&selinux_state,
3512 ssid, fsec->sid,
3513 SECCLASS_FD,
3514 FD__USE,
3515 &ad);
3516 if (rc)
3517 goto out;
3518 }
3519
3520 if (unlikely(IS_PRIVATE(inode)))
3521 return 0;
3522
3523 isec = inode_security(inode);
3524 rc = avc_has_extended_perms(&selinux_state,
3525 ssid, isec->sid, isec->sclass,
3526 requested, driver, xperm, &ad);
3527 out:
3528 return rc;
3529 }
3530
3531 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3532 unsigned long arg)
3533 {
3534 const struct cred *cred = current_cred();
3535 int error = 0;
3536
3537 switch (cmd) {
3538 case FIONREAD:
3539 /* fall through */
3540 case FIBMAP:
3541 /* fall through */
3542 case FIGETBSZ:
3543 /* fall through */
3544 case FS_IOC_GETFLAGS:
3545 /* fall through */
3546 case FS_IOC_GETVERSION:
3547 error = file_has_perm(cred, file, FILE__GETATTR);
3548 break;
3549
3550 case FS_IOC_SETFLAGS:
3551 /* fall through */
3552 case FS_IOC_SETVERSION:
3553 error = file_has_perm(cred, file, FILE__SETATTR);
3554 break;
3555
3556 /* sys_ioctl() checks */
3557 case FIONBIO:
3558 /* fall through */
3559 case FIOASYNC:
3560 error = file_has_perm(cred, file, 0);
3561 break;
3562
3563 case KDSKBENT:
3564 case KDSKBSENT:
3565 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3566 CAP_OPT_NONE, true);
3567 break;
3568
3569 /* default case assumes that the command will go
3570 * to the file's ioctl() function.
3571 */
3572 default:
3573 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3574 }
3575 return error;
3576 }
3577
3578 static int default_noexec;
3579
3580 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3581 {
3582 const struct cred *cred = current_cred();
3583 u32 sid = cred_sid(cred);
3584 int rc = 0;
3585
3586 if (default_noexec &&
3587 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3588 (!shared && (prot & PROT_WRITE)))) {
3589 /*
3590 * We are making executable an anonymous mapping or a
3591 * private file mapping that will also be writable.
3592 * This has an additional check.
3593 */
3594 rc = avc_has_perm(&selinux_state,
3595 sid, sid, SECCLASS_PROCESS,
3596 PROCESS__EXECMEM, NULL);
3597 if (rc)
3598 goto error;
3599 }
3600
3601 if (file) {
3602 /* read access is always possible with a mapping */
3603 u32 av = FILE__READ;
3604
3605 /* write access only matters if the mapping is shared */
3606 if (shared && (prot & PROT_WRITE))
3607 av |= FILE__WRITE;
3608
3609 if (prot & PROT_EXEC)
3610 av |= FILE__EXECUTE;
3611
3612 return file_has_perm(cred, file, av);
3613 }
3614
3615 error:
3616 return rc;
3617 }
3618
3619 static int selinux_mmap_addr(unsigned long addr)
3620 {
3621 int rc = 0;
3622
3623 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3624 u32 sid = current_sid();
3625 rc = avc_has_perm(&selinux_state,
3626 sid, sid, SECCLASS_MEMPROTECT,
3627 MEMPROTECT__MMAP_ZERO, NULL);
3628 }
3629
3630 return rc;
3631 }
3632
3633 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3634 unsigned long prot, unsigned long flags)
3635 {
3636 struct common_audit_data ad;
3637 int rc;
3638
3639 if (file) {
3640 ad.type = LSM_AUDIT_DATA_FILE;
3641 ad.u.file = file;
3642 rc = inode_has_perm(current_cred(), file_inode(file),
3643 FILE__MAP, &ad);
3644 if (rc)
3645 return rc;
3646 }
3647
3648 if (selinux_state.checkreqprot)
3649 prot = reqprot;
3650
3651 return file_map_prot_check(file, prot,
3652 (flags & MAP_TYPE) == MAP_SHARED);
3653 }
3654
3655 static int selinux_file_mprotect(struct vm_area_struct *vma,
3656 unsigned long reqprot,
3657 unsigned long prot)
3658 {
3659 const struct cred *cred = current_cred();
3660 u32 sid = cred_sid(cred);
3661
3662 if (selinux_state.checkreqprot)
3663 prot = reqprot;
3664
3665 if (default_noexec &&
3666 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3667 int rc = 0;
3668 if (vma->vm_start >= vma->vm_mm->start_brk &&
3669 vma->vm_end <= vma->vm_mm->brk) {
3670 rc = avc_has_perm(&selinux_state,
3671 sid, sid, SECCLASS_PROCESS,
3672 PROCESS__EXECHEAP, NULL);
3673 } else if (!vma->vm_file &&
3674 ((vma->vm_start <= vma->vm_mm->start_stack &&
3675 vma->vm_end >= vma->vm_mm->start_stack) ||
3676 vma_is_stack_for_current(vma))) {
3677 rc = avc_has_perm(&selinux_state,
3678 sid, sid, SECCLASS_PROCESS,
3679 PROCESS__EXECSTACK, NULL);
3680 } else if (vma->vm_file && vma->anon_vma) {
3681 /*
3682 * We are making executable a file mapping that has
3683 * had some COW done. Since pages might have been
3684 * written, check ability to execute the possibly
3685 * modified content. This typically should only
3686 * occur for text relocations.
3687 */
3688 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3689 }
3690 if (rc)
3691 return rc;
3692 }
3693
3694 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3695 }
3696
3697 static int selinux_file_lock(struct file *file, unsigned int cmd)
3698 {
3699 const struct cred *cred = current_cred();
3700
3701 return file_has_perm(cred, file, FILE__LOCK);
3702 }
3703
3704 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3705 unsigned long arg)
3706 {
3707 const struct cred *cred = current_cred();
3708 int err = 0;
3709
3710 switch (cmd) {
3711 case F_SETFL:
3712 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3713 err = file_has_perm(cred, file, FILE__WRITE);
3714 break;
3715 }
3716 /* fall through */
3717 case F_SETOWN:
3718 case F_SETSIG:
3719 case F_GETFL:
3720 case F_GETOWN:
3721 case F_GETSIG:
3722 case F_GETOWNER_UIDS:
3723 /* Just check FD__USE permission */
3724 err = file_has_perm(cred, file, 0);
3725 break;
3726 case F_GETLK:
3727 case F_SETLK:
3728 case F_SETLKW:
3729 case F_OFD_GETLK:
3730 case F_OFD_SETLK:
3731 case F_OFD_SETLKW:
3732 #if BITS_PER_LONG == 32
3733 case F_GETLK64:
3734 case F_SETLK64:
3735 case F_SETLKW64:
3736 #endif
3737 err = file_has_perm(cred, file, FILE__LOCK);
3738 break;
3739 }
3740
3741 return err;
3742 }
3743
3744 static void selinux_file_set_fowner(struct file *file)
3745 {
3746 struct file_security_struct *fsec;
3747
3748 fsec = selinux_file(file);
3749 fsec->fown_sid = current_sid();
3750 }
3751
3752 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3753 struct fown_struct *fown, int signum)
3754 {
3755 struct file *file;
3756 u32 sid = task_sid(tsk);
3757 u32 perm;
3758 struct file_security_struct *fsec;
3759
3760 /* struct fown_struct is never outside the context of a struct file */
3761 file = container_of(fown, struct file, f_owner);
3762
3763 fsec = selinux_file(file);
3764
3765 if (!signum)
3766 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3767 else
3768 perm = signal_to_av(signum);
3769
3770 return avc_has_perm(&selinux_state,
3771 fsec->fown_sid, sid,
3772 SECCLASS_PROCESS, perm, NULL);
3773 }
3774
3775 static int selinux_file_receive(struct file *file)
3776 {
3777 const struct cred *cred = current_cred();
3778
3779 return file_has_perm(cred, file, file_to_av(file));
3780 }
3781
3782 static int selinux_file_open(struct file *file)
3783 {
3784 struct file_security_struct *fsec;
3785 struct inode_security_struct *isec;
3786
3787 fsec = selinux_file(file);
3788 isec = inode_security(file_inode(file));
3789 /*
3790 * Save inode label and policy sequence number
3791 * at open-time so that selinux_file_permission
3792 * can determine whether revalidation is necessary.
3793 * Task label is already saved in the file security
3794 * struct as its SID.
3795 */
3796 fsec->isid = isec->sid;
3797 fsec->pseqno = avc_policy_seqno(&selinux_state);
3798 /*
3799 * Since the inode label or policy seqno may have changed
3800 * between the selinux_inode_permission check and the saving
3801 * of state above, recheck that access is still permitted.
3802 * Otherwise, access might never be revalidated against the
3803 * new inode label or new policy.
3804 * This check is not redundant - do not remove.
3805 */
3806 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3807 }
3808
3809 /* task security operations */
3810
3811 static int selinux_task_alloc(struct task_struct *task,
3812 unsigned long clone_flags)
3813 {
3814 u32 sid = current_sid();
3815
3816 return avc_has_perm(&selinux_state,
3817 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3818 }
3819
3820 /*
3821 * prepare a new set of credentials for modification
3822 */
3823 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3824 gfp_t gfp)
3825 {
3826 const struct task_security_struct *old_tsec = selinux_cred(old);
3827 struct task_security_struct *tsec = selinux_cred(new);
3828
3829 *tsec = *old_tsec;
3830 return 0;
3831 }
3832
3833 /*
3834 * transfer the SELinux data to a blank set of creds
3835 */
3836 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3837 {
3838 const struct task_security_struct *old_tsec = selinux_cred(old);
3839 struct task_security_struct *tsec = selinux_cred(new);
3840
3841 *tsec = *old_tsec;
3842 }
3843
3844 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3845 {
3846 *secid = cred_sid(c);
3847 }
3848
3849 /*
3850 * set the security data for a kernel service
3851 * - all the creation contexts are set to unlabelled
3852 */
3853 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3854 {
3855 struct task_security_struct *tsec = selinux_cred(new);
3856 u32 sid = current_sid();
3857 int ret;
3858
3859 ret = avc_has_perm(&selinux_state,
3860 sid, secid,
3861 SECCLASS_KERNEL_SERVICE,
3862 KERNEL_SERVICE__USE_AS_OVERRIDE,
3863 NULL);
3864 if (ret == 0) {
3865 tsec->sid = secid;
3866 tsec->create_sid = 0;
3867 tsec->keycreate_sid = 0;
3868 tsec->sockcreate_sid = 0;
3869 }
3870 return ret;
3871 }
3872
3873 /*
3874 * set the file creation context in a security record to the same as the
3875 * objective context of the specified inode
3876 */
3877 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3878 {
3879 struct inode_security_struct *isec = inode_security(inode);
3880 struct task_security_struct *tsec = selinux_cred(new);
3881 u32 sid = current_sid();
3882 int ret;
3883
3884 ret = avc_has_perm(&selinux_state,
3885 sid, isec->sid,
3886 SECCLASS_KERNEL_SERVICE,
3887 KERNEL_SERVICE__CREATE_FILES_AS,
3888 NULL);
3889
3890 if (ret == 0)
3891 tsec->create_sid = isec->sid;
3892 return ret;
3893 }
3894
3895 static int selinux_kernel_module_request(char *kmod_name)
3896 {
3897 struct common_audit_data ad;
3898
3899 ad.type = LSM_AUDIT_DATA_KMOD;
3900 ad.u.kmod_name = kmod_name;
3901
3902 return avc_has_perm(&selinux_state,
3903 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3904 SYSTEM__MODULE_REQUEST, &ad);
3905 }
3906
3907 static int selinux_kernel_module_from_file(struct file *file)
3908 {
3909 struct common_audit_data ad;
3910 struct inode_security_struct *isec;
3911 struct file_security_struct *fsec;
3912 u32 sid = current_sid();
3913 int rc;
3914
3915 /* init_module */
3916 if (file == NULL)
3917 return avc_has_perm(&selinux_state,
3918 sid, sid, SECCLASS_SYSTEM,
3919 SYSTEM__MODULE_LOAD, NULL);
3920
3921 /* finit_module */
3922
3923 ad.type = LSM_AUDIT_DATA_FILE;
3924 ad.u.file = file;
3925
3926 fsec = selinux_file(file);
3927 if (sid != fsec->sid) {
3928 rc = avc_has_perm(&selinux_state,
3929 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3930 if (rc)
3931 return rc;
3932 }
3933
3934 isec = inode_security(file_inode(file));
3935 return avc_has_perm(&selinux_state,
3936 sid, isec->sid, SECCLASS_SYSTEM,
3937 SYSTEM__MODULE_LOAD, &ad);
3938 }
3939
3940 static int selinux_kernel_read_file(struct file *file,
3941 enum kernel_read_file_id id)
3942 {
3943 int rc = 0;
3944
3945 switch (id) {
3946 case READING_MODULE:
3947 rc = selinux_kernel_module_from_file(file);
3948 break;
3949 default:
3950 break;
3951 }
3952
3953 return rc;
3954 }
3955
3956 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3957 {
3958 int rc = 0;
3959
3960 switch (id) {
3961 case LOADING_MODULE:
3962 rc = selinux_kernel_module_from_file(NULL);
3963 default:
3964 break;
3965 }
3966
3967 return rc;
3968 }
3969
3970 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3971 {
3972 return avc_has_perm(&selinux_state,
3973 current_sid(), task_sid(p), SECCLASS_PROCESS,
3974 PROCESS__SETPGID, NULL);
3975 }
3976
3977 static int selinux_task_getpgid(struct task_struct *p)
3978 {
3979 return avc_has_perm(&selinux_state,
3980 current_sid(), task_sid(p), SECCLASS_PROCESS,
3981 PROCESS__GETPGID, NULL);
3982 }
3983
3984 static int selinux_task_getsid(struct task_struct *p)
3985 {
3986 return avc_has_perm(&selinux_state,
3987 current_sid(), task_sid(p), SECCLASS_PROCESS,
3988 PROCESS__GETSESSION, NULL);
3989 }
3990
3991 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3992 {
3993 *secid = task_sid(p);
3994 }
3995
3996 static int selinux_task_setnice(struct task_struct *p, int nice)
3997 {
3998 return avc_has_perm(&selinux_state,
3999 current_sid(), task_sid(p), SECCLASS_PROCESS,
4000 PROCESS__SETSCHED, NULL);
4001 }
4002
4003 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4004 {
4005 return avc_has_perm(&selinux_state,
4006 current_sid(), task_sid(p), SECCLASS_PROCESS,
4007 PROCESS__SETSCHED, NULL);
4008 }
4009
4010 static int selinux_task_getioprio(struct task_struct *p)
4011 {
4012 return avc_has_perm(&selinux_state,
4013 current_sid(), task_sid(p), SECCLASS_PROCESS,
4014 PROCESS__GETSCHED, NULL);
4015 }
4016
4017 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4018 unsigned int flags)
4019 {
4020 u32 av = 0;
4021
4022 if (!flags)
4023 return 0;
4024 if (flags & LSM_PRLIMIT_WRITE)
4025 av |= PROCESS__SETRLIMIT;
4026 if (flags & LSM_PRLIMIT_READ)
4027 av |= PROCESS__GETRLIMIT;
4028 return avc_has_perm(&selinux_state,
4029 cred_sid(cred), cred_sid(tcred),
4030 SECCLASS_PROCESS, av, NULL);
4031 }
4032
4033 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4034 struct rlimit *new_rlim)
4035 {
4036 struct rlimit *old_rlim = p->signal->rlim + resource;
4037
4038 /* Control the ability to change the hard limit (whether
4039 lowering or raising it), so that the hard limit can
4040 later be used as a safe reset point for the soft limit
4041 upon context transitions. See selinux_bprm_committing_creds. */
4042 if (old_rlim->rlim_max != new_rlim->rlim_max)
4043 return avc_has_perm(&selinux_state,
4044 current_sid(), task_sid(p),
4045 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4046
4047 return 0;
4048 }
4049
4050 static int selinux_task_setscheduler(struct task_struct *p)
4051 {
4052 return avc_has_perm(&selinux_state,
4053 current_sid(), task_sid(p), SECCLASS_PROCESS,
4054 PROCESS__SETSCHED, NULL);
4055 }
4056
4057 static int selinux_task_getscheduler(struct task_struct *p)
4058 {
4059 return avc_has_perm(&selinux_state,
4060 current_sid(), task_sid(p), SECCLASS_PROCESS,
4061 PROCESS__GETSCHED, NULL);
4062 }
4063
4064 static int selinux_task_movememory(struct task_struct *p)
4065 {
4066 return avc_has_perm(&selinux_state,
4067 current_sid(), task_sid(p), SECCLASS_PROCESS,
4068 PROCESS__SETSCHED, NULL);
4069 }
4070
4071 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4072 int sig, const struct cred *cred)
4073 {
4074 u32 secid;
4075 u32 perm;
4076
4077 if (!sig)
4078 perm = PROCESS__SIGNULL; /* null signal; existence test */
4079 else
4080 perm = signal_to_av(sig);
4081 if (!cred)
4082 secid = current_sid();
4083 else
4084 secid = cred_sid(cred);
4085 return avc_has_perm(&selinux_state,
4086 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4087 }
4088
4089 static void selinux_task_to_inode(struct task_struct *p,
4090 struct inode *inode)
4091 {
4092 struct inode_security_struct *isec = selinux_inode(inode);
4093 u32 sid = task_sid(p);
4094
4095 spin_lock(&isec->lock);
4096 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4097 isec->sid = sid;
4098 isec->initialized = LABEL_INITIALIZED;
4099 spin_unlock(&isec->lock);
4100 }
4101
4102 /* Returns error only if unable to parse addresses */
4103 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4104 struct common_audit_data *ad, u8 *proto)
4105 {
4106 int offset, ihlen, ret = -EINVAL;
4107 struct iphdr _iph, *ih;
4108
4109 offset = skb_network_offset(skb);
4110 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4111 if (ih == NULL)
4112 goto out;
4113
4114 ihlen = ih->ihl * 4;
4115 if (ihlen < sizeof(_iph))
4116 goto out;
4117
4118 ad->u.net->v4info.saddr = ih->saddr;
4119 ad->u.net->v4info.daddr = ih->daddr;
4120 ret = 0;
4121
4122 if (proto)
4123 *proto = ih->protocol;
4124
4125 switch (ih->protocol) {
4126 case IPPROTO_TCP: {
4127 struct tcphdr _tcph, *th;
4128
4129 if (ntohs(ih->frag_off) & IP_OFFSET)
4130 break;
4131
4132 offset += ihlen;
4133 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4134 if (th == NULL)
4135 break;
4136
4137 ad->u.net->sport = th->source;
4138 ad->u.net->dport = th->dest;
4139 break;
4140 }
4141
4142 case IPPROTO_UDP: {
4143 struct udphdr _udph, *uh;
4144
4145 if (ntohs(ih->frag_off) & IP_OFFSET)
4146 break;
4147
4148 offset += ihlen;
4149 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4150 if (uh == NULL)
4151 break;
4152
4153 ad->u.net->sport = uh->source;
4154 ad->u.net->dport = uh->dest;
4155 break;
4156 }
4157
4158 case IPPROTO_DCCP: {
4159 struct dccp_hdr _dccph, *dh;
4160
4161 if (ntohs(ih->frag_off) & IP_OFFSET)
4162 break;
4163
4164 offset += ihlen;
4165 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4166 if (dh == NULL)
4167 break;
4168
4169 ad->u.net->sport = dh->dccph_sport;
4170 ad->u.net->dport = dh->dccph_dport;
4171 break;
4172 }
4173
4174 #if IS_ENABLED(CONFIG_IP_SCTP)
4175 case IPPROTO_SCTP: {
4176 struct sctphdr _sctph, *sh;
4177
4178 if (ntohs(ih->frag_off) & IP_OFFSET)
4179 break;
4180
4181 offset += ihlen;
4182 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4183 if (sh == NULL)
4184 break;
4185
4186 ad->u.net->sport = sh->source;
4187 ad->u.net->dport = sh->dest;
4188 break;
4189 }
4190 #endif
4191 default:
4192 break;
4193 }
4194 out:
4195 return ret;
4196 }
4197
4198 #if IS_ENABLED(CONFIG_IPV6)
4199
4200 /* Returns error only if unable to parse addresses */
4201 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4202 struct common_audit_data *ad, u8 *proto)
4203 {
4204 u8 nexthdr;
4205 int ret = -EINVAL, offset;
4206 struct ipv6hdr _ipv6h, *ip6;
4207 __be16 frag_off;
4208
4209 offset = skb_network_offset(skb);
4210 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4211 if (ip6 == NULL)
4212 goto out;
4213
4214 ad->u.net->v6info.saddr = ip6->saddr;
4215 ad->u.net->v6info.daddr = ip6->daddr;
4216 ret = 0;
4217
4218 nexthdr = ip6->nexthdr;
4219 offset += sizeof(_ipv6h);
4220 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4221 if (offset < 0)
4222 goto out;
4223
4224 if (proto)
4225 *proto = nexthdr;
4226
4227 switch (nexthdr) {
4228 case IPPROTO_TCP: {
4229 struct tcphdr _tcph, *th;
4230
4231 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4232 if (th == NULL)
4233 break;
4234
4235 ad->u.net->sport = th->source;
4236 ad->u.net->dport = th->dest;
4237 break;
4238 }
4239
4240 case IPPROTO_UDP: {
4241 struct udphdr _udph, *uh;
4242
4243 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4244 if (uh == NULL)
4245 break;
4246
4247 ad->u.net->sport = uh->source;
4248 ad->u.net->dport = uh->dest;
4249 break;
4250 }
4251
4252 case IPPROTO_DCCP: {
4253 struct dccp_hdr _dccph, *dh;
4254
4255 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4256 if (dh == NULL)
4257 break;
4258
4259 ad->u.net->sport = dh->dccph_sport;
4260 ad->u.net->dport = dh->dccph_dport;
4261 break;
4262 }
4263
4264 #if IS_ENABLED(CONFIG_IP_SCTP)
4265 case IPPROTO_SCTP: {
4266 struct sctphdr _sctph, *sh;
4267
4268 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4269 if (sh == NULL)
4270 break;
4271
4272 ad->u.net->sport = sh->source;
4273 ad->u.net->dport = sh->dest;
4274 break;
4275 }
4276 #endif
4277 /* includes fragments */
4278 default:
4279 break;
4280 }
4281 out:
4282 return ret;
4283 }
4284
4285 #endif /* IPV6 */
4286
4287 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4288 char **_addrp, int src, u8 *proto)
4289 {
4290 char *addrp;
4291 int ret;
4292
4293 switch (ad->u.net->family) {
4294 case PF_INET:
4295 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4296 if (ret)
4297 goto parse_error;
4298 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4299 &ad->u.net->v4info.daddr);
4300 goto okay;
4301
4302 #if IS_ENABLED(CONFIG_IPV6)
4303 case PF_INET6:
4304 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4305 if (ret)
4306 goto parse_error;
4307 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4308 &ad->u.net->v6info.daddr);
4309 goto okay;
4310 #endif /* IPV6 */
4311 default:
4312 addrp = NULL;
4313 goto okay;
4314 }
4315
4316 parse_error:
4317 pr_warn(
4318 "SELinux: failure in selinux_parse_skb(),"
4319 " unable to parse packet\n");
4320 return ret;
4321
4322 okay:
4323 if (_addrp)
4324 *_addrp = addrp;
4325 return 0;
4326 }
4327
4328 /**
4329 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4330 * @skb: the packet
4331 * @family: protocol family
4332 * @sid: the packet's peer label SID
4333 *
4334 * Description:
4335 * Check the various different forms of network peer labeling and determine
4336 * the peer label/SID for the packet; most of the magic actually occurs in
4337 * the security server function security_net_peersid_cmp(). The function
4338 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4339 * or -EACCES if @sid is invalid due to inconsistencies with the different
4340 * peer labels.
4341 *
4342 */
4343 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4344 {
4345 int err;
4346 u32 xfrm_sid;
4347 u32 nlbl_sid;
4348 u32 nlbl_type;
4349
4350 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4351 if (unlikely(err))
4352 return -EACCES;
4353 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4354 if (unlikely(err))
4355 return -EACCES;
4356
4357 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4358 nlbl_type, xfrm_sid, sid);
4359 if (unlikely(err)) {
4360 pr_warn(
4361 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4362 " unable to determine packet's peer label\n");
4363 return -EACCES;
4364 }
4365
4366 return 0;
4367 }
4368
4369 /**
4370 * selinux_conn_sid - Determine the child socket label for a connection
4371 * @sk_sid: the parent socket's SID
4372 * @skb_sid: the packet's SID
4373 * @conn_sid: the resulting connection SID
4374 *
4375 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4376 * combined with the MLS information from @skb_sid in order to create
4377 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4378 * of @sk_sid. Returns zero on success, negative values on failure.
4379 *
4380 */
4381 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4382 {
4383 int err = 0;
4384
4385 if (skb_sid != SECSID_NULL)
4386 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4387 conn_sid);
4388 else
4389 *conn_sid = sk_sid;
4390
4391 return err;
4392 }
4393
4394 /* socket security operations */
4395
4396 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4397 u16 secclass, u32 *socksid)
4398 {
4399 if (tsec->sockcreate_sid > SECSID_NULL) {
4400 *socksid = tsec->sockcreate_sid;
4401 return 0;
4402 }
4403
4404 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4405 secclass, NULL, socksid);
4406 }
4407
4408 static int sock_has_perm(struct sock *sk, u32 perms)
4409 {
4410 struct sk_security_struct *sksec = sk->sk_security;
4411 struct common_audit_data ad;
4412 struct lsm_network_audit net = {0,};
4413
4414 if (sksec->sid == SECINITSID_KERNEL)
4415 return 0;
4416
4417 ad.type = LSM_AUDIT_DATA_NET;
4418 ad.u.net = &net;
4419 ad.u.net->sk = sk;
4420
4421 return avc_has_perm(&selinux_state,
4422 current_sid(), sksec->sid, sksec->sclass, perms,
4423 &ad);
4424 }
4425
4426 static int selinux_socket_create(int family, int type,
4427 int protocol, int kern)
4428 {
4429 const struct task_security_struct *tsec = selinux_cred(current_cred());
4430 u32 newsid;
4431 u16 secclass;
4432 int rc;
4433
4434 if (kern)
4435 return 0;
4436
4437 secclass = socket_type_to_security_class(family, type, protocol);
4438 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4439 if (rc)
4440 return rc;
4441
4442 return avc_has_perm(&selinux_state,
4443 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4444 }
4445
4446 static int selinux_socket_post_create(struct socket *sock, int family,
4447 int type, int protocol, int kern)
4448 {
4449 const struct task_security_struct *tsec = selinux_cred(current_cred());
4450 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4451 struct sk_security_struct *sksec;
4452 u16 sclass = socket_type_to_security_class(family, type, protocol);
4453 u32 sid = SECINITSID_KERNEL;
4454 int err = 0;
4455
4456 if (!kern) {
4457 err = socket_sockcreate_sid(tsec, sclass, &sid);
4458 if (err)
4459 return err;
4460 }
4461
4462 isec->sclass = sclass;
4463 isec->sid = sid;
4464 isec->initialized = LABEL_INITIALIZED;
4465
4466 if (sock->sk) {
4467 sksec = sock->sk->sk_security;
4468 sksec->sclass = sclass;
4469 sksec->sid = sid;
4470 /* Allows detection of the first association on this socket */
4471 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4472 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4473
4474 err = selinux_netlbl_socket_post_create(sock->sk, family);
4475 }
4476
4477 return err;
4478 }
4479
4480 static int selinux_socket_socketpair(struct socket *socka,
4481 struct socket *sockb)
4482 {
4483 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4484 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4485
4486 sksec_a->peer_sid = sksec_b->sid;
4487 sksec_b->peer_sid = sksec_a->sid;
4488
4489 return 0;
4490 }
4491
4492 /* Range of port numbers used to automatically bind.
4493 Need to determine whether we should perform a name_bind
4494 permission check between the socket and the port number. */
4495
4496 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4497 {
4498 struct sock *sk = sock->sk;
4499 struct sk_security_struct *sksec = sk->sk_security;
4500 u16 family;
4501 int err;
4502
4503 err = sock_has_perm(sk, SOCKET__BIND);
4504 if (err)
4505 goto out;
4506
4507 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4508 family = sk->sk_family;
4509 if (family == PF_INET || family == PF_INET6) {
4510 char *addrp;
4511 struct common_audit_data ad;
4512 struct lsm_network_audit net = {0,};
4513 struct sockaddr_in *addr4 = NULL;
4514 struct sockaddr_in6 *addr6 = NULL;
4515 u16 family_sa;
4516 unsigned short snum;
4517 u32 sid, node_perm;
4518
4519 /*
4520 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4521 * that validates multiple binding addresses. Because of this
4522 * need to check address->sa_family as it is possible to have
4523 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4524 */
4525 if (addrlen < offsetofend(struct sockaddr, sa_family))
4526 return -EINVAL;
4527 family_sa = address->sa_family;
4528 switch (family_sa) {
4529 case AF_UNSPEC:
4530 case AF_INET:
4531 if (addrlen < sizeof(struct sockaddr_in))
4532 return -EINVAL;
4533 addr4 = (struct sockaddr_in *)address;
4534 if (family_sa == AF_UNSPEC) {
4535 /* see __inet_bind(), we only want to allow
4536 * AF_UNSPEC if the address is INADDR_ANY
4537 */
4538 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4539 goto err_af;
4540 family_sa = AF_INET;
4541 }
4542 snum = ntohs(addr4->sin_port);
4543 addrp = (char *)&addr4->sin_addr.s_addr;
4544 break;
4545 case AF_INET6:
4546 if (addrlen < SIN6_LEN_RFC2133)
4547 return -EINVAL;
4548 addr6 = (struct sockaddr_in6 *)address;
4549 snum = ntohs(addr6->sin6_port);
4550 addrp = (char *)&addr6->sin6_addr.s6_addr;
4551 break;
4552 default:
4553 goto err_af;
4554 }
4555
4556 ad.type = LSM_AUDIT_DATA_NET;
4557 ad.u.net = &net;
4558 ad.u.net->sport = htons(snum);
4559 ad.u.net->family = family_sa;
4560
4561 if (snum) {
4562 int low, high;
4563
4564 inet_get_local_port_range(sock_net(sk), &low, &high);
4565
4566 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4567 snum > high) {
4568 err = sel_netport_sid(sk->sk_protocol,
4569 snum, &sid);
4570 if (err)
4571 goto out;
4572 err = avc_has_perm(&selinux_state,
4573 sksec->sid, sid,
4574 sksec->sclass,
4575 SOCKET__NAME_BIND, &ad);
4576 if (err)
4577 goto out;
4578 }
4579 }
4580
4581 switch (sksec->sclass) {
4582 case SECCLASS_TCP_SOCKET:
4583 node_perm = TCP_SOCKET__NODE_BIND;
4584 break;
4585
4586 case SECCLASS_UDP_SOCKET:
4587 node_perm = UDP_SOCKET__NODE_BIND;
4588 break;
4589
4590 case SECCLASS_DCCP_SOCKET:
4591 node_perm = DCCP_SOCKET__NODE_BIND;
4592 break;
4593
4594 case SECCLASS_SCTP_SOCKET:
4595 node_perm = SCTP_SOCKET__NODE_BIND;
4596 break;
4597
4598 default:
4599 node_perm = RAWIP_SOCKET__NODE_BIND;
4600 break;
4601 }
4602
4603 err = sel_netnode_sid(addrp, family_sa, &sid);
4604 if (err)
4605 goto out;
4606
4607 if (family_sa == AF_INET)
4608 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4609 else
4610 ad.u.net->v6info.saddr = addr6->sin6_addr;
4611
4612 err = avc_has_perm(&selinux_state,
4613 sksec->sid, sid,
4614 sksec->sclass, node_perm, &ad);
4615 if (err)
4616 goto out;
4617 }
4618 out:
4619 return err;
4620 err_af:
4621 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4622 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4623 return -EINVAL;
4624 return -EAFNOSUPPORT;
4625 }
4626
4627 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4628 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4629 */
4630 static int selinux_socket_connect_helper(struct socket *sock,
4631 struct sockaddr *address, int addrlen)
4632 {
4633 struct sock *sk = sock->sk;
4634 struct sk_security_struct *sksec = sk->sk_security;
4635 int err;
4636
4637 err = sock_has_perm(sk, SOCKET__CONNECT);
4638 if (err)
4639 return err;
4640 if (addrlen < offsetofend(struct sockaddr, sa_family))
4641 return -EINVAL;
4642
4643 /* connect(AF_UNSPEC) has special handling, as it is a documented
4644 * way to disconnect the socket
4645 */
4646 if (address->sa_family == AF_UNSPEC)
4647 return 0;
4648
4649 /*
4650 * If a TCP, DCCP or SCTP socket, check name_connect permission
4651 * for the port.
4652 */
4653 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4654 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4655 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4656 struct common_audit_data ad;
4657 struct lsm_network_audit net = {0,};
4658 struct sockaddr_in *addr4 = NULL;
4659 struct sockaddr_in6 *addr6 = NULL;
4660 unsigned short snum;
4661 u32 sid, perm;
4662
4663 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4664 * that validates multiple connect addresses. Because of this
4665 * need to check address->sa_family as it is possible to have
4666 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4667 */
4668 switch (address->sa_family) {
4669 case AF_INET:
4670 addr4 = (struct sockaddr_in *)address;
4671 if (addrlen < sizeof(struct sockaddr_in))
4672 return -EINVAL;
4673 snum = ntohs(addr4->sin_port);
4674 break;
4675 case AF_INET6:
4676 addr6 = (struct sockaddr_in6 *)address;
4677 if (addrlen < SIN6_LEN_RFC2133)
4678 return -EINVAL;
4679 snum = ntohs(addr6->sin6_port);
4680 break;
4681 default:
4682 /* Note that SCTP services expect -EINVAL, whereas
4683 * others expect -EAFNOSUPPORT.
4684 */
4685 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4686 return -EINVAL;
4687 else
4688 return -EAFNOSUPPORT;
4689 }
4690
4691 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4692 if (err)
4693 return err;
4694
4695 switch (sksec->sclass) {
4696 case SECCLASS_TCP_SOCKET:
4697 perm = TCP_SOCKET__NAME_CONNECT;
4698 break;
4699 case SECCLASS_DCCP_SOCKET:
4700 perm = DCCP_SOCKET__NAME_CONNECT;
4701 break;
4702 case SECCLASS_SCTP_SOCKET:
4703 perm = SCTP_SOCKET__NAME_CONNECT;
4704 break;
4705 }
4706
4707 ad.type = LSM_AUDIT_DATA_NET;
4708 ad.u.net = &net;
4709 ad.u.net->dport = htons(snum);
4710 ad.u.net->family = address->sa_family;
4711 err = avc_has_perm(&selinux_state,
4712 sksec->sid, sid, sksec->sclass, perm, &ad);
4713 if (err)
4714 return err;
4715 }
4716
4717 return 0;
4718 }
4719
4720 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4721 static int selinux_socket_connect(struct socket *sock,
4722 struct sockaddr *address, int addrlen)
4723 {
4724 int err;
4725 struct sock *sk = sock->sk;
4726
4727 err = selinux_socket_connect_helper(sock, address, addrlen);
4728 if (err)
4729 return err;
4730
4731 return selinux_netlbl_socket_connect(sk, address);
4732 }
4733
4734 static int selinux_socket_listen(struct socket *sock, int backlog)
4735 {
4736 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4737 }
4738
4739 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4740 {
4741 int err;
4742 struct inode_security_struct *isec;
4743 struct inode_security_struct *newisec;
4744 u16 sclass;
4745 u32 sid;
4746
4747 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4748 if (err)
4749 return err;
4750
4751 isec = inode_security_novalidate(SOCK_INODE(sock));
4752 spin_lock(&isec->lock);
4753 sclass = isec->sclass;
4754 sid = isec->sid;
4755 spin_unlock(&isec->lock);
4756
4757 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4758 newisec->sclass = sclass;
4759 newisec->sid = sid;
4760 newisec->initialized = LABEL_INITIALIZED;
4761
4762 return 0;
4763 }
4764
4765 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4766 int size)
4767 {
4768 return sock_has_perm(sock->sk, SOCKET__WRITE);
4769 }
4770
4771 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4772 int size, int flags)
4773 {
4774 return sock_has_perm(sock->sk, SOCKET__READ);
4775 }
4776
4777 static int selinux_socket_getsockname(struct socket *sock)
4778 {
4779 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4780 }
4781
4782 static int selinux_socket_getpeername(struct socket *sock)
4783 {
4784 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4785 }
4786
4787 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4788 {
4789 int err;
4790
4791 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4792 if (err)
4793 return err;
4794
4795 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4796 }
4797
4798 static int selinux_socket_getsockopt(struct socket *sock, int level,
4799 int optname)
4800 {
4801 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4802 }
4803
4804 static int selinux_socket_shutdown(struct socket *sock, int how)
4805 {
4806 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4807 }
4808
4809 static int selinux_socket_unix_stream_connect(struct sock *sock,
4810 struct sock *other,
4811 struct sock *newsk)
4812 {
4813 struct sk_security_struct *sksec_sock = sock->sk_security;
4814 struct sk_security_struct *sksec_other = other->sk_security;
4815 struct sk_security_struct *sksec_new = newsk->sk_security;
4816 struct common_audit_data ad;
4817 struct lsm_network_audit net = {0,};
4818 int err;
4819
4820 ad.type = LSM_AUDIT_DATA_NET;
4821 ad.u.net = &net;
4822 ad.u.net->sk = other;
4823
4824 err = avc_has_perm(&selinux_state,
4825 sksec_sock->sid, sksec_other->sid,
4826 sksec_other->sclass,
4827 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4828 if (err)
4829 return err;
4830
4831 /* server child socket */
4832 sksec_new->peer_sid = sksec_sock->sid;
4833 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4834 sksec_sock->sid, &sksec_new->sid);
4835 if (err)
4836 return err;
4837
4838 /* connecting socket */
4839 sksec_sock->peer_sid = sksec_new->sid;
4840
4841 return 0;
4842 }
4843
4844 static int selinux_socket_unix_may_send(struct socket *sock,
4845 struct socket *other)
4846 {
4847 struct sk_security_struct *ssec = sock->sk->sk_security;
4848 struct sk_security_struct *osec = other->sk->sk_security;
4849 struct common_audit_data ad;
4850 struct lsm_network_audit net = {0,};
4851
4852 ad.type = LSM_AUDIT_DATA_NET;
4853 ad.u.net = &net;
4854 ad.u.net->sk = other->sk;
4855
4856 return avc_has_perm(&selinux_state,
4857 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4858 &ad);
4859 }
4860
4861 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4862 char *addrp, u16 family, u32 peer_sid,
4863 struct common_audit_data *ad)
4864 {
4865 int err;
4866 u32 if_sid;
4867 u32 node_sid;
4868
4869 err = sel_netif_sid(ns, ifindex, &if_sid);
4870 if (err)
4871 return err;
4872 err = avc_has_perm(&selinux_state,
4873 peer_sid, if_sid,
4874 SECCLASS_NETIF, NETIF__INGRESS, ad);
4875 if (err)
4876 return err;
4877
4878 err = sel_netnode_sid(addrp, family, &node_sid);
4879 if (err)
4880 return err;
4881 return avc_has_perm(&selinux_state,
4882 peer_sid, node_sid,
4883 SECCLASS_NODE, NODE__RECVFROM, ad);
4884 }
4885
4886 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4887 u16 family)
4888 {
4889 int err = 0;
4890 struct sk_security_struct *sksec = sk->sk_security;
4891 u32 sk_sid = sksec->sid;
4892 struct common_audit_data ad;
4893 struct lsm_network_audit net = {0,};
4894 char *addrp;
4895
4896 ad.type = LSM_AUDIT_DATA_NET;
4897 ad.u.net = &net;
4898 ad.u.net->netif = skb->skb_iif;
4899 ad.u.net->family = family;
4900 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4901 if (err)
4902 return err;
4903
4904 if (selinux_secmark_enabled()) {
4905 err = avc_has_perm(&selinux_state,
4906 sk_sid, skb->secmark, SECCLASS_PACKET,
4907 PACKET__RECV, &ad);
4908 if (err)
4909 return err;
4910 }
4911
4912 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4913 if (err)
4914 return err;
4915 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4916
4917 return err;
4918 }
4919
4920 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4921 {
4922 int err;
4923 struct sk_security_struct *sksec = sk->sk_security;
4924 u16 family = sk->sk_family;
4925 u32 sk_sid = sksec->sid;
4926 struct common_audit_data ad;
4927 struct lsm_network_audit net = {0,};
4928 char *addrp;
4929 u8 secmark_active;
4930 u8 peerlbl_active;
4931
4932 if (family != PF_INET && family != PF_INET6)
4933 return 0;
4934
4935 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4936 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4937 family = PF_INET;
4938
4939 /* If any sort of compatibility mode is enabled then handoff processing
4940 * to the selinux_sock_rcv_skb_compat() function to deal with the
4941 * special handling. We do this in an attempt to keep this function
4942 * as fast and as clean as possible. */
4943 if (!selinux_policycap_netpeer())
4944 return selinux_sock_rcv_skb_compat(sk, skb, family);
4945
4946 secmark_active = selinux_secmark_enabled();
4947 peerlbl_active = selinux_peerlbl_enabled();
4948 if (!secmark_active && !peerlbl_active)
4949 return 0;
4950
4951 ad.type = LSM_AUDIT_DATA_NET;
4952 ad.u.net = &net;
4953 ad.u.net->netif = skb->skb_iif;
4954 ad.u.net->family = family;
4955 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4956 if (err)
4957 return err;
4958
4959 if (peerlbl_active) {
4960 u32 peer_sid;
4961
4962 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4963 if (err)
4964 return err;
4965 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4966 addrp, family, peer_sid, &ad);
4967 if (err) {
4968 selinux_netlbl_err(skb, family, err, 0);
4969 return err;
4970 }
4971 err = avc_has_perm(&selinux_state,
4972 sk_sid, peer_sid, SECCLASS_PEER,
4973 PEER__RECV, &ad);
4974 if (err) {
4975 selinux_netlbl_err(skb, family, err, 0);
4976 return err;
4977 }
4978 }
4979
4980 if (secmark_active) {
4981 err = avc_has_perm(&selinux_state,
4982 sk_sid, skb->secmark, SECCLASS_PACKET,
4983 PACKET__RECV, &ad);
4984 if (err)
4985 return err;
4986 }
4987
4988 return err;
4989 }
4990
4991 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4992 int __user *optlen, unsigned len)
4993 {
4994 int err = 0;
4995 char *scontext;
4996 u32 scontext_len;
4997 struct sk_security_struct *sksec = sock->sk->sk_security;
4998 u32 peer_sid = SECSID_NULL;
4999
5000 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5001 sksec->sclass == SECCLASS_TCP_SOCKET ||
5002 sksec->sclass == SECCLASS_SCTP_SOCKET)
5003 peer_sid = sksec->peer_sid;
5004 if (peer_sid == SECSID_NULL)
5005 return -ENOPROTOOPT;
5006
5007 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5008 &scontext_len);
5009 if (err)
5010 return err;
5011
5012 if (scontext_len > len) {
5013 err = -ERANGE;
5014 goto out_len;
5015 }
5016
5017 if (copy_to_user(optval, scontext, scontext_len))
5018 err = -EFAULT;
5019
5020 out_len:
5021 if (put_user(scontext_len, optlen))
5022 err = -EFAULT;
5023 kfree(scontext);
5024 return err;
5025 }
5026
5027 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5028 {
5029 u32 peer_secid = SECSID_NULL;
5030 u16 family;
5031 struct inode_security_struct *isec;
5032
5033 if (skb && skb->protocol == htons(ETH_P_IP))
5034 family = PF_INET;
5035 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5036 family = PF_INET6;
5037 else if (sock)
5038 family = sock->sk->sk_family;
5039 else
5040 goto out;
5041
5042 if (sock && family == PF_UNIX) {
5043 isec = inode_security_novalidate(SOCK_INODE(sock));
5044 peer_secid = isec->sid;
5045 } else if (skb)
5046 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5047
5048 out:
5049 *secid = peer_secid;
5050 if (peer_secid == SECSID_NULL)
5051 return -EINVAL;
5052 return 0;
5053 }
5054
5055 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5056 {
5057 struct sk_security_struct *sksec;
5058
5059 sksec = kzalloc(sizeof(*sksec), priority);
5060 if (!sksec)
5061 return -ENOMEM;
5062
5063 sksec->peer_sid = SECINITSID_UNLABELED;
5064 sksec->sid = SECINITSID_UNLABELED;
5065 sksec->sclass = SECCLASS_SOCKET;
5066 selinux_netlbl_sk_security_reset(sksec);
5067 sk->sk_security = sksec;
5068
5069 return 0;
5070 }
5071
5072 static void selinux_sk_free_security(struct sock *sk)
5073 {
5074 struct sk_security_struct *sksec = sk->sk_security;
5075
5076 sk->sk_security = NULL;
5077 selinux_netlbl_sk_security_free(sksec);
5078 kfree(sksec);
5079 }
5080
5081 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5082 {
5083 struct sk_security_struct *sksec = sk->sk_security;
5084 struct sk_security_struct *newsksec = newsk->sk_security;
5085
5086 newsksec->sid = sksec->sid;
5087 newsksec->peer_sid = sksec->peer_sid;
5088 newsksec->sclass = sksec->sclass;
5089
5090 selinux_netlbl_sk_security_reset(newsksec);
5091 }
5092
5093 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5094 {
5095 if (!sk)
5096 *secid = SECINITSID_ANY_SOCKET;
5097 else {
5098 struct sk_security_struct *sksec = sk->sk_security;
5099
5100 *secid = sksec->sid;
5101 }
5102 }
5103
5104 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5105 {
5106 struct inode_security_struct *isec =
5107 inode_security_novalidate(SOCK_INODE(parent));
5108 struct sk_security_struct *sksec = sk->sk_security;
5109
5110 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5111 sk->sk_family == PF_UNIX)
5112 isec->sid = sksec->sid;
5113 sksec->sclass = isec->sclass;
5114 }
5115
5116 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5117 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5118 * already present).
5119 */
5120 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5121 struct sk_buff *skb)
5122 {
5123 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5124 struct common_audit_data ad;
5125 struct lsm_network_audit net = {0,};
5126 u8 peerlbl_active;
5127 u32 peer_sid = SECINITSID_UNLABELED;
5128 u32 conn_sid;
5129 int err = 0;
5130
5131 if (!selinux_policycap_extsockclass())
5132 return 0;
5133
5134 peerlbl_active = selinux_peerlbl_enabled();
5135
5136 if (peerlbl_active) {
5137 /* This will return peer_sid = SECSID_NULL if there are
5138 * no peer labels, see security_net_peersid_resolve().
5139 */
5140 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5141 &peer_sid);
5142 if (err)
5143 return err;
5144
5145 if (peer_sid == SECSID_NULL)
5146 peer_sid = SECINITSID_UNLABELED;
5147 }
5148
5149 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5150 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5151
5152 /* Here as first association on socket. As the peer SID
5153 * was allowed by peer recv (and the netif/node checks),
5154 * then it is approved by policy and used as the primary
5155 * peer SID for getpeercon(3).
5156 */
5157 sksec->peer_sid = peer_sid;
5158 } else if (sksec->peer_sid != peer_sid) {
5159 /* Other association peer SIDs are checked to enforce
5160 * consistency among the peer SIDs.
5161 */
5162 ad.type = LSM_AUDIT_DATA_NET;
5163 ad.u.net = &net;
5164 ad.u.net->sk = ep->base.sk;
5165 err = avc_has_perm(&selinux_state,
5166 sksec->peer_sid, peer_sid, sksec->sclass,
5167 SCTP_SOCKET__ASSOCIATION, &ad);
5168 if (err)
5169 return err;
5170 }
5171
5172 /* Compute the MLS component for the connection and store
5173 * the information in ep. This will be used by SCTP TCP type
5174 * sockets and peeled off connections as they cause a new
5175 * socket to be generated. selinux_sctp_sk_clone() will then
5176 * plug this into the new socket.
5177 */
5178 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5179 if (err)
5180 return err;
5181
5182 ep->secid = conn_sid;
5183 ep->peer_secid = peer_sid;
5184
5185 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5186 return selinux_netlbl_sctp_assoc_request(ep, skb);
5187 }
5188
5189 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5190 * based on their @optname.
5191 */
5192 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5193 struct sockaddr *address,
5194 int addrlen)
5195 {
5196 int len, err = 0, walk_size = 0;
5197 void *addr_buf;
5198 struct sockaddr *addr;
5199 struct socket *sock;
5200
5201 if (!selinux_policycap_extsockclass())
5202 return 0;
5203
5204 /* Process one or more addresses that may be IPv4 or IPv6 */
5205 sock = sk->sk_socket;
5206 addr_buf = address;
5207
5208 while (walk_size < addrlen) {
5209 if (walk_size + sizeof(sa_family_t) > addrlen)
5210 return -EINVAL;
5211
5212 addr = addr_buf;
5213 switch (addr->sa_family) {
5214 case AF_UNSPEC:
5215 case AF_INET:
5216 len = sizeof(struct sockaddr_in);
5217 break;
5218 case AF_INET6:
5219 len = sizeof(struct sockaddr_in6);
5220 break;
5221 default:
5222 return -EINVAL;
5223 }
5224
5225 if (walk_size + len > addrlen)
5226 return -EINVAL;
5227
5228 err = -EINVAL;
5229 switch (optname) {
5230 /* Bind checks */
5231 case SCTP_PRIMARY_ADDR:
5232 case SCTP_SET_PEER_PRIMARY_ADDR:
5233 case SCTP_SOCKOPT_BINDX_ADD:
5234 err = selinux_socket_bind(sock, addr, len);
5235 break;
5236 /* Connect checks */
5237 case SCTP_SOCKOPT_CONNECTX:
5238 case SCTP_PARAM_SET_PRIMARY:
5239 case SCTP_PARAM_ADD_IP:
5240 case SCTP_SENDMSG_CONNECT:
5241 err = selinux_socket_connect_helper(sock, addr, len);
5242 if (err)
5243 return err;
5244
5245 /* As selinux_sctp_bind_connect() is called by the
5246 * SCTP protocol layer, the socket is already locked,
5247 * therefore selinux_netlbl_socket_connect_locked() is
5248 * is called here. The situations handled are:
5249 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5250 * whenever a new IP address is added or when a new
5251 * primary address is selected.
5252 * Note that an SCTP connect(2) call happens before
5253 * the SCTP protocol layer and is handled via
5254 * selinux_socket_connect().
5255 */
5256 err = selinux_netlbl_socket_connect_locked(sk, addr);
5257 break;
5258 }
5259
5260 if (err)
5261 return err;
5262
5263 addr_buf += len;
5264 walk_size += len;
5265 }
5266
5267 return 0;
5268 }
5269
5270 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5271 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5272 struct sock *newsk)
5273 {
5274 struct sk_security_struct *sksec = sk->sk_security;
5275 struct sk_security_struct *newsksec = newsk->sk_security;
5276
5277 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5278 * the non-sctp clone version.
5279 */
5280 if (!selinux_policycap_extsockclass())
5281 return selinux_sk_clone_security(sk, newsk);
5282
5283 newsksec->sid = ep->secid;
5284 newsksec->peer_sid = ep->peer_secid;
5285 newsksec->sclass = sksec->sclass;
5286 selinux_netlbl_sctp_sk_clone(sk, newsk);
5287 }
5288
5289 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5290 struct request_sock *req)
5291 {
5292 struct sk_security_struct *sksec = sk->sk_security;
5293 int err;
5294 u16 family = req->rsk_ops->family;
5295 u32 connsid;
5296 u32 peersid;
5297
5298 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5299 if (err)
5300 return err;
5301 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5302 if (err)
5303 return err;
5304 req->secid = connsid;
5305 req->peer_secid = peersid;
5306
5307 return selinux_netlbl_inet_conn_request(req, family);
5308 }
5309
5310 static void selinux_inet_csk_clone(struct sock *newsk,
5311 const struct request_sock *req)
5312 {
5313 struct sk_security_struct *newsksec = newsk->sk_security;
5314
5315 newsksec->sid = req->secid;
5316 newsksec->peer_sid = req->peer_secid;
5317 /* NOTE: Ideally, we should also get the isec->sid for the
5318 new socket in sync, but we don't have the isec available yet.
5319 So we will wait until sock_graft to do it, by which
5320 time it will have been created and available. */
5321
5322 /* We don't need to take any sort of lock here as we are the only
5323 * thread with access to newsksec */
5324 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5325 }
5326
5327 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5328 {
5329 u16 family = sk->sk_family;
5330 struct sk_security_struct *sksec = sk->sk_security;
5331
5332 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5333 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5334 family = PF_INET;
5335
5336 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5337 }
5338
5339 static int selinux_secmark_relabel_packet(u32 sid)
5340 {
5341 const struct task_security_struct *__tsec;
5342 u32 tsid;
5343
5344 __tsec = selinux_cred(current_cred());
5345 tsid = __tsec->sid;
5346
5347 return avc_has_perm(&selinux_state,
5348 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5349 NULL);
5350 }
5351
5352 static void selinux_secmark_refcount_inc(void)
5353 {
5354 atomic_inc(&selinux_secmark_refcount);
5355 }
5356
5357 static void selinux_secmark_refcount_dec(void)
5358 {
5359 atomic_dec(&selinux_secmark_refcount);
5360 }
5361
5362 static void selinux_req_classify_flow(const struct request_sock *req,
5363 struct flowi *fl)
5364 {
5365 fl->flowi_secid = req->secid;
5366 }
5367
5368 static int selinux_tun_dev_alloc_security(void **security)
5369 {
5370 struct tun_security_struct *tunsec;
5371
5372 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5373 if (!tunsec)
5374 return -ENOMEM;
5375 tunsec->sid = current_sid();
5376
5377 *security = tunsec;
5378 return 0;
5379 }
5380
5381 static void selinux_tun_dev_free_security(void *security)
5382 {
5383 kfree(security);
5384 }
5385
5386 static int selinux_tun_dev_create(void)
5387 {
5388 u32 sid = current_sid();
5389
5390 /* we aren't taking into account the "sockcreate" SID since the socket
5391 * that is being created here is not a socket in the traditional sense,
5392 * instead it is a private sock, accessible only to the kernel, and
5393 * representing a wide range of network traffic spanning multiple
5394 * connections unlike traditional sockets - check the TUN driver to
5395 * get a better understanding of why this socket is special */
5396
5397 return avc_has_perm(&selinux_state,
5398 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5399 NULL);
5400 }
5401
5402 static int selinux_tun_dev_attach_queue(void *security)
5403 {
5404 struct tun_security_struct *tunsec = security;
5405
5406 return avc_has_perm(&selinux_state,
5407 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5408 TUN_SOCKET__ATTACH_QUEUE, NULL);
5409 }
5410
5411 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5412 {
5413 struct tun_security_struct *tunsec = security;
5414 struct sk_security_struct *sksec = sk->sk_security;
5415
5416 /* we don't currently perform any NetLabel based labeling here and it
5417 * isn't clear that we would want to do so anyway; while we could apply
5418 * labeling without the support of the TUN user the resulting labeled
5419 * traffic from the other end of the connection would almost certainly
5420 * cause confusion to the TUN user that had no idea network labeling
5421 * protocols were being used */
5422
5423 sksec->sid = tunsec->sid;
5424 sksec->sclass = SECCLASS_TUN_SOCKET;
5425
5426 return 0;
5427 }
5428
5429 static int selinux_tun_dev_open(void *security)
5430 {
5431 struct tun_security_struct *tunsec = security;
5432 u32 sid = current_sid();
5433 int err;
5434
5435 err = avc_has_perm(&selinux_state,
5436 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5437 TUN_SOCKET__RELABELFROM, NULL);
5438 if (err)
5439 return err;
5440 err = avc_has_perm(&selinux_state,
5441 sid, sid, SECCLASS_TUN_SOCKET,
5442 TUN_SOCKET__RELABELTO, NULL);
5443 if (err)
5444 return err;
5445 tunsec->sid = sid;
5446
5447 return 0;
5448 }
5449
5450 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5451 {
5452 int err = 0;
5453 u32 perm;
5454 struct nlmsghdr *nlh;
5455 struct sk_security_struct *sksec = sk->sk_security;
5456
5457 if (skb->len < NLMSG_HDRLEN) {
5458 err = -EINVAL;
5459 goto out;
5460 }
5461 nlh = nlmsg_hdr(skb);
5462
5463 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5464 if (err) {
5465 if (err == -EINVAL) {
5466 pr_warn_ratelimited("SELinux: unrecognized netlink"
5467 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5468 " pig=%d comm=%s\n",
5469 sk->sk_protocol, nlh->nlmsg_type,
5470 secclass_map[sksec->sclass - 1].name,
5471 task_pid_nr(current), current->comm);
5472 if (!enforcing_enabled(&selinux_state) ||
5473 security_get_allow_unknown(&selinux_state))
5474 err = 0;
5475 }
5476
5477 /* Ignore */
5478 if (err == -ENOENT)
5479 err = 0;
5480 goto out;
5481 }
5482
5483 err = sock_has_perm(sk, perm);
5484 out:
5485 return err;
5486 }
5487
5488 #ifdef CONFIG_NETFILTER
5489
5490 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5491 const struct net_device *indev,
5492 u16 family)
5493 {
5494 int err;
5495 char *addrp;
5496 u32 peer_sid;
5497 struct common_audit_data ad;
5498 struct lsm_network_audit net = {0,};
5499 u8 secmark_active;
5500 u8 netlbl_active;
5501 u8 peerlbl_active;
5502
5503 if (!selinux_policycap_netpeer())
5504 return NF_ACCEPT;
5505
5506 secmark_active = selinux_secmark_enabled();
5507 netlbl_active = netlbl_enabled();
5508 peerlbl_active = selinux_peerlbl_enabled();
5509 if (!secmark_active && !peerlbl_active)
5510 return NF_ACCEPT;
5511
5512 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5513 return NF_DROP;
5514
5515 ad.type = LSM_AUDIT_DATA_NET;
5516 ad.u.net = &net;
5517 ad.u.net->netif = indev->ifindex;
5518 ad.u.net->family = family;
5519 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5520 return NF_DROP;
5521
5522 if (peerlbl_active) {
5523 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5524 addrp, family, peer_sid, &ad);
5525 if (err) {
5526 selinux_netlbl_err(skb, family, err, 1);
5527 return NF_DROP;
5528 }
5529 }
5530
5531 if (secmark_active)
5532 if (avc_has_perm(&selinux_state,
5533 peer_sid, skb->secmark,
5534 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5535 return NF_DROP;
5536
5537 if (netlbl_active)
5538 /* we do this in the FORWARD path and not the POST_ROUTING
5539 * path because we want to make sure we apply the necessary
5540 * labeling before IPsec is applied so we can leverage AH
5541 * protection */
5542 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5543 return NF_DROP;
5544
5545 return NF_ACCEPT;
5546 }
5547
5548 static unsigned int selinux_ipv4_forward(void *priv,
5549 struct sk_buff *skb,
5550 const struct nf_hook_state *state)
5551 {
5552 return selinux_ip_forward(skb, state->in, PF_INET);
5553 }
5554
5555 #if IS_ENABLED(CONFIG_IPV6)
5556 static unsigned int selinux_ipv6_forward(void *priv,
5557 struct sk_buff *skb,
5558 const struct nf_hook_state *state)
5559 {
5560 return selinux_ip_forward(skb, state->in, PF_INET6);
5561 }
5562 #endif /* IPV6 */
5563
5564 static unsigned int selinux_ip_output(struct sk_buff *skb,
5565 u16 family)
5566 {
5567 struct sock *sk;
5568 u32 sid;
5569
5570 if (!netlbl_enabled())
5571 return NF_ACCEPT;
5572
5573 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5574 * because we want to make sure we apply the necessary labeling
5575 * before IPsec is applied so we can leverage AH protection */
5576 sk = skb->sk;
5577 if (sk) {
5578 struct sk_security_struct *sksec;
5579
5580 if (sk_listener(sk))
5581 /* if the socket is the listening state then this
5582 * packet is a SYN-ACK packet which means it needs to
5583 * be labeled based on the connection/request_sock and
5584 * not the parent socket. unfortunately, we can't
5585 * lookup the request_sock yet as it isn't queued on
5586 * the parent socket until after the SYN-ACK is sent.
5587 * the "solution" is to simply pass the packet as-is
5588 * as any IP option based labeling should be copied
5589 * from the initial connection request (in the IP
5590 * layer). it is far from ideal, but until we get a
5591 * security label in the packet itself this is the
5592 * best we can do. */
5593 return NF_ACCEPT;
5594
5595 /* standard practice, label using the parent socket */
5596 sksec = sk->sk_security;
5597 sid = sksec->sid;
5598 } else
5599 sid = SECINITSID_KERNEL;
5600 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5601 return NF_DROP;
5602
5603 return NF_ACCEPT;
5604 }
5605
5606 static unsigned int selinux_ipv4_output(void *priv,
5607 struct sk_buff *skb,
5608 const struct nf_hook_state *state)
5609 {
5610 return selinux_ip_output(skb, PF_INET);
5611 }
5612
5613 #if IS_ENABLED(CONFIG_IPV6)
5614 static unsigned int selinux_ipv6_output(void *priv,
5615 struct sk_buff *skb,
5616 const struct nf_hook_state *state)
5617 {
5618 return selinux_ip_output(skb, PF_INET6);
5619 }
5620 #endif /* IPV6 */
5621
5622 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5623 int ifindex,
5624 u16 family)
5625 {
5626 struct sock *sk = skb_to_full_sk(skb);
5627 struct sk_security_struct *sksec;
5628 struct common_audit_data ad;
5629 struct lsm_network_audit net = {0,};
5630 char *addrp;
5631 u8 proto;
5632
5633 if (sk == NULL)
5634 return NF_ACCEPT;
5635 sksec = sk->sk_security;
5636
5637 ad.type = LSM_AUDIT_DATA_NET;
5638 ad.u.net = &net;
5639 ad.u.net->netif = ifindex;
5640 ad.u.net->family = family;
5641 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5642 return NF_DROP;
5643
5644 if (selinux_secmark_enabled())
5645 if (avc_has_perm(&selinux_state,
5646 sksec->sid, skb->secmark,
5647 SECCLASS_PACKET, PACKET__SEND, &ad))
5648 return NF_DROP_ERR(-ECONNREFUSED);
5649
5650 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5651 return NF_DROP_ERR(-ECONNREFUSED);
5652
5653 return NF_ACCEPT;
5654 }
5655
5656 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5657 const struct net_device *outdev,
5658 u16 family)
5659 {
5660 u32 secmark_perm;
5661 u32 peer_sid;
5662 int ifindex = outdev->ifindex;
5663 struct sock *sk;
5664 struct common_audit_data ad;
5665 struct lsm_network_audit net = {0,};
5666 char *addrp;
5667 u8 secmark_active;
5668 u8 peerlbl_active;
5669
5670 /* If any sort of compatibility mode is enabled then handoff processing
5671 * to the selinux_ip_postroute_compat() function to deal with the
5672 * special handling. We do this in an attempt to keep this function
5673 * as fast and as clean as possible. */
5674 if (!selinux_policycap_netpeer())
5675 return selinux_ip_postroute_compat(skb, ifindex, family);
5676
5677 secmark_active = selinux_secmark_enabled();
5678 peerlbl_active = selinux_peerlbl_enabled();
5679 if (!secmark_active && !peerlbl_active)
5680 return NF_ACCEPT;
5681
5682 sk = skb_to_full_sk(skb);
5683
5684 #ifdef CONFIG_XFRM
5685 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5686 * packet transformation so allow the packet to pass without any checks
5687 * since we'll have another chance to perform access control checks
5688 * when the packet is on it's final way out.
5689 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5690 * is NULL, in this case go ahead and apply access control.
5691 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5692 * TCP listening state we cannot wait until the XFRM processing
5693 * is done as we will miss out on the SA label if we do;
5694 * unfortunately, this means more work, but it is only once per
5695 * connection. */
5696 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5697 !(sk && sk_listener(sk)))
5698 return NF_ACCEPT;
5699 #endif
5700
5701 if (sk == NULL) {
5702 /* Without an associated socket the packet is either coming
5703 * from the kernel or it is being forwarded; check the packet
5704 * to determine which and if the packet is being forwarded
5705 * query the packet directly to determine the security label. */
5706 if (skb->skb_iif) {
5707 secmark_perm = PACKET__FORWARD_OUT;
5708 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5709 return NF_DROP;
5710 } else {
5711 secmark_perm = PACKET__SEND;
5712 peer_sid = SECINITSID_KERNEL;
5713 }
5714 } else if (sk_listener(sk)) {
5715 /* Locally generated packet but the associated socket is in the
5716 * listening state which means this is a SYN-ACK packet. In
5717 * this particular case the correct security label is assigned
5718 * to the connection/request_sock but unfortunately we can't
5719 * query the request_sock as it isn't queued on the parent
5720 * socket until after the SYN-ACK packet is sent; the only
5721 * viable choice is to regenerate the label like we do in
5722 * selinux_inet_conn_request(). See also selinux_ip_output()
5723 * for similar problems. */
5724 u32 skb_sid;
5725 struct sk_security_struct *sksec;
5726
5727 sksec = sk->sk_security;
5728 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5729 return NF_DROP;
5730 /* At this point, if the returned skb peerlbl is SECSID_NULL
5731 * and the packet has been through at least one XFRM
5732 * transformation then we must be dealing with the "final"
5733 * form of labeled IPsec packet; since we've already applied
5734 * all of our access controls on this packet we can safely
5735 * pass the packet. */
5736 if (skb_sid == SECSID_NULL) {
5737 switch (family) {
5738 case PF_INET:
5739 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5740 return NF_ACCEPT;
5741 break;
5742 case PF_INET6:
5743 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5744 return NF_ACCEPT;
5745 break;
5746 default:
5747 return NF_DROP_ERR(-ECONNREFUSED);
5748 }
5749 }
5750 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5751 return NF_DROP;
5752 secmark_perm = PACKET__SEND;
5753 } else {
5754 /* Locally generated packet, fetch the security label from the
5755 * associated socket. */
5756 struct sk_security_struct *sksec = sk->sk_security;
5757 peer_sid = sksec->sid;
5758 secmark_perm = PACKET__SEND;
5759 }
5760
5761 ad.type = LSM_AUDIT_DATA_NET;
5762 ad.u.net = &net;
5763 ad.u.net->netif = ifindex;
5764 ad.u.net->family = family;
5765 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5766 return NF_DROP;
5767
5768 if (secmark_active)
5769 if (avc_has_perm(&selinux_state,
5770 peer_sid, skb->secmark,
5771 SECCLASS_PACKET, secmark_perm, &ad))
5772 return NF_DROP_ERR(-ECONNREFUSED);
5773
5774 if (peerlbl_active) {
5775 u32 if_sid;
5776 u32 node_sid;
5777
5778 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5779 return NF_DROP;
5780 if (avc_has_perm(&selinux_state,
5781 peer_sid, if_sid,
5782 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5783 return NF_DROP_ERR(-ECONNREFUSED);
5784
5785 if (sel_netnode_sid(addrp, family, &node_sid))
5786 return NF_DROP;
5787 if (avc_has_perm(&selinux_state,
5788 peer_sid, node_sid,
5789 SECCLASS_NODE, NODE__SENDTO, &ad))
5790 return NF_DROP_ERR(-ECONNREFUSED);
5791 }
5792
5793 return NF_ACCEPT;
5794 }
5795
5796 static unsigned int selinux_ipv4_postroute(void *priv,
5797 struct sk_buff *skb,
5798 const struct nf_hook_state *state)
5799 {
5800 return selinux_ip_postroute(skb, state->out, PF_INET);
5801 }
5802
5803 #if IS_ENABLED(CONFIG_IPV6)
5804 static unsigned int selinux_ipv6_postroute(void *priv,
5805 struct sk_buff *skb,
5806 const struct nf_hook_state *state)
5807 {
5808 return selinux_ip_postroute(skb, state->out, PF_INET6);
5809 }
5810 #endif /* IPV6 */
5811
5812 #endif /* CONFIG_NETFILTER */
5813
5814 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5815 {
5816 return selinux_nlmsg_perm(sk, skb);
5817 }
5818
5819 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5820 {
5821 isec->sclass = sclass;
5822 isec->sid = current_sid();
5823 }
5824
5825 static int msg_msg_alloc_security(struct msg_msg *msg)
5826 {
5827 struct msg_security_struct *msec;
5828
5829 msec = selinux_msg_msg(msg);
5830 msec->sid = SECINITSID_UNLABELED;
5831
5832 return 0;
5833 }
5834
5835 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5836 u32 perms)
5837 {
5838 struct ipc_security_struct *isec;
5839 struct common_audit_data ad;
5840 u32 sid = current_sid();
5841
5842 isec = selinux_ipc(ipc_perms);
5843
5844 ad.type = LSM_AUDIT_DATA_IPC;
5845 ad.u.ipc_id = ipc_perms->key;
5846
5847 return avc_has_perm(&selinux_state,
5848 sid, isec->sid, isec->sclass, perms, &ad);
5849 }
5850
5851 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5852 {
5853 return msg_msg_alloc_security(msg);
5854 }
5855
5856 /* message queue security operations */
5857 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5858 {
5859 struct ipc_security_struct *isec;
5860 struct common_audit_data ad;
5861 u32 sid = current_sid();
5862 int rc;
5863
5864 isec = selinux_ipc(msq);
5865 ipc_init_security(isec, SECCLASS_MSGQ);
5866
5867 ad.type = LSM_AUDIT_DATA_IPC;
5868 ad.u.ipc_id = msq->key;
5869
5870 rc = avc_has_perm(&selinux_state,
5871 sid, isec->sid, SECCLASS_MSGQ,
5872 MSGQ__CREATE, &ad);
5873 return rc;
5874 }
5875
5876 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5877 {
5878 struct ipc_security_struct *isec;
5879 struct common_audit_data ad;
5880 u32 sid = current_sid();
5881
5882 isec = selinux_ipc(msq);
5883
5884 ad.type = LSM_AUDIT_DATA_IPC;
5885 ad.u.ipc_id = msq->key;
5886
5887 return avc_has_perm(&selinux_state,
5888 sid, isec->sid, SECCLASS_MSGQ,
5889 MSGQ__ASSOCIATE, &ad);
5890 }
5891
5892 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5893 {
5894 int err;
5895 int perms;
5896
5897 switch (cmd) {
5898 case IPC_INFO:
5899 case MSG_INFO:
5900 /* No specific object, just general system-wide information. */
5901 return avc_has_perm(&selinux_state,
5902 current_sid(), SECINITSID_KERNEL,
5903 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5904 case IPC_STAT:
5905 case MSG_STAT:
5906 case MSG_STAT_ANY:
5907 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5908 break;
5909 case IPC_SET:
5910 perms = MSGQ__SETATTR;
5911 break;
5912 case IPC_RMID:
5913 perms = MSGQ__DESTROY;
5914 break;
5915 default:
5916 return 0;
5917 }
5918
5919 err = ipc_has_perm(msq, perms);
5920 return err;
5921 }
5922
5923 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5924 {
5925 struct ipc_security_struct *isec;
5926 struct msg_security_struct *msec;
5927 struct common_audit_data ad;
5928 u32 sid = current_sid();
5929 int rc;
5930
5931 isec = selinux_ipc(msq);
5932 msec = selinux_msg_msg(msg);
5933
5934 /*
5935 * First time through, need to assign label to the message
5936 */
5937 if (msec->sid == SECINITSID_UNLABELED) {
5938 /*
5939 * Compute new sid based on current process and
5940 * message queue this message will be stored in
5941 */
5942 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5943 SECCLASS_MSG, NULL, &msec->sid);
5944 if (rc)
5945 return rc;
5946 }
5947
5948 ad.type = LSM_AUDIT_DATA_IPC;
5949 ad.u.ipc_id = msq->key;
5950
5951 /* Can this process write to the queue? */
5952 rc = avc_has_perm(&selinux_state,
5953 sid, isec->sid, SECCLASS_MSGQ,
5954 MSGQ__WRITE, &ad);
5955 if (!rc)
5956 /* Can this process send the message */
5957 rc = avc_has_perm(&selinux_state,
5958 sid, msec->sid, SECCLASS_MSG,
5959 MSG__SEND, &ad);
5960 if (!rc)
5961 /* Can the message be put in the queue? */
5962 rc = avc_has_perm(&selinux_state,
5963 msec->sid, isec->sid, SECCLASS_MSGQ,
5964 MSGQ__ENQUEUE, &ad);
5965
5966 return rc;
5967 }
5968
5969 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5970 struct task_struct *target,
5971 long type, int mode)
5972 {
5973 struct ipc_security_struct *isec;
5974 struct msg_security_struct *msec;
5975 struct common_audit_data ad;
5976 u32 sid = task_sid(target);
5977 int rc;
5978
5979 isec = selinux_ipc(msq);
5980 msec = selinux_msg_msg(msg);
5981
5982 ad.type = LSM_AUDIT_DATA_IPC;
5983 ad.u.ipc_id = msq->key;
5984
5985 rc = avc_has_perm(&selinux_state,
5986 sid, isec->sid,
5987 SECCLASS_MSGQ, MSGQ__READ, &ad);
5988 if (!rc)
5989 rc = avc_has_perm(&selinux_state,
5990 sid, msec->sid,
5991 SECCLASS_MSG, MSG__RECEIVE, &ad);
5992 return rc;
5993 }
5994
5995 /* Shared Memory security operations */
5996 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
5997 {
5998 struct ipc_security_struct *isec;
5999 struct common_audit_data ad;
6000 u32 sid = current_sid();
6001 int rc;
6002
6003 isec = selinux_ipc(shp);
6004 ipc_init_security(isec, SECCLASS_SHM);
6005
6006 ad.type = LSM_AUDIT_DATA_IPC;
6007 ad.u.ipc_id = shp->key;
6008
6009 rc = avc_has_perm(&selinux_state,
6010 sid, isec->sid, SECCLASS_SHM,
6011 SHM__CREATE, &ad);
6012 return rc;
6013 }
6014
6015 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6016 {
6017 struct ipc_security_struct *isec;
6018 struct common_audit_data ad;
6019 u32 sid = current_sid();
6020
6021 isec = selinux_ipc(shp);
6022
6023 ad.type = LSM_AUDIT_DATA_IPC;
6024 ad.u.ipc_id = shp->key;
6025
6026 return avc_has_perm(&selinux_state,
6027 sid, isec->sid, SECCLASS_SHM,
6028 SHM__ASSOCIATE, &ad);
6029 }
6030
6031 /* Note, at this point, shp is locked down */
6032 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6033 {
6034 int perms;
6035 int err;
6036
6037 switch (cmd) {
6038 case IPC_INFO:
6039 case SHM_INFO:
6040 /* No specific object, just general system-wide information. */
6041 return avc_has_perm(&selinux_state,
6042 current_sid(), SECINITSID_KERNEL,
6043 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6044 case IPC_STAT:
6045 case SHM_STAT:
6046 case SHM_STAT_ANY:
6047 perms = SHM__GETATTR | SHM__ASSOCIATE;
6048 break;
6049 case IPC_SET:
6050 perms = SHM__SETATTR;
6051 break;
6052 case SHM_LOCK:
6053 case SHM_UNLOCK:
6054 perms = SHM__LOCK;
6055 break;
6056 case IPC_RMID:
6057 perms = SHM__DESTROY;
6058 break;
6059 default:
6060 return 0;
6061 }
6062
6063 err = ipc_has_perm(shp, perms);
6064 return err;
6065 }
6066
6067 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6068 char __user *shmaddr, int shmflg)
6069 {
6070 u32 perms;
6071
6072 if (shmflg & SHM_RDONLY)
6073 perms = SHM__READ;
6074 else
6075 perms = SHM__READ | SHM__WRITE;
6076
6077 return ipc_has_perm(shp, perms);
6078 }
6079
6080 /* Semaphore security operations */
6081 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6082 {
6083 struct ipc_security_struct *isec;
6084 struct common_audit_data ad;
6085 u32 sid = current_sid();
6086 int rc;
6087
6088 isec = selinux_ipc(sma);
6089 ipc_init_security(isec, SECCLASS_SEM);
6090
6091 ad.type = LSM_AUDIT_DATA_IPC;
6092 ad.u.ipc_id = sma->key;
6093
6094 rc = avc_has_perm(&selinux_state,
6095 sid, isec->sid, SECCLASS_SEM,
6096 SEM__CREATE, &ad);
6097 return rc;
6098 }
6099
6100 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6101 {
6102 struct ipc_security_struct *isec;
6103 struct common_audit_data ad;
6104 u32 sid = current_sid();
6105
6106 isec = selinux_ipc(sma);
6107
6108 ad.type = LSM_AUDIT_DATA_IPC;
6109 ad.u.ipc_id = sma->key;
6110
6111 return avc_has_perm(&selinux_state,
6112 sid, isec->sid, SECCLASS_SEM,
6113 SEM__ASSOCIATE, &ad);
6114 }
6115
6116 /* Note, at this point, sma is locked down */
6117 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6118 {
6119 int err;
6120 u32 perms;
6121
6122 switch (cmd) {
6123 case IPC_INFO:
6124 case SEM_INFO:
6125 /* No specific object, just general system-wide information. */
6126 return avc_has_perm(&selinux_state,
6127 current_sid(), SECINITSID_KERNEL,
6128 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6129 case GETPID:
6130 case GETNCNT:
6131 case GETZCNT:
6132 perms = SEM__GETATTR;
6133 break;
6134 case GETVAL:
6135 case GETALL:
6136 perms = SEM__READ;
6137 break;
6138 case SETVAL:
6139 case SETALL:
6140 perms = SEM__WRITE;
6141 break;
6142 case IPC_RMID:
6143 perms = SEM__DESTROY;
6144 break;
6145 case IPC_SET:
6146 perms = SEM__SETATTR;
6147 break;
6148 case IPC_STAT:
6149 case SEM_STAT:
6150 case SEM_STAT_ANY:
6151 perms = SEM__GETATTR | SEM__ASSOCIATE;
6152 break;
6153 default:
6154 return 0;
6155 }
6156
6157 err = ipc_has_perm(sma, perms);
6158 return err;
6159 }
6160
6161 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6162 struct sembuf *sops, unsigned nsops, int alter)
6163 {
6164 u32 perms;
6165
6166 if (alter)
6167 perms = SEM__READ | SEM__WRITE;
6168 else
6169 perms = SEM__READ;
6170
6171 return ipc_has_perm(sma, perms);
6172 }
6173
6174 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6175 {
6176 u32 av = 0;
6177
6178 av = 0;
6179 if (flag & S_IRUGO)
6180 av |= IPC__UNIX_READ;
6181 if (flag & S_IWUGO)
6182 av |= IPC__UNIX_WRITE;
6183
6184 if (av == 0)
6185 return 0;
6186
6187 return ipc_has_perm(ipcp, av);
6188 }
6189
6190 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6191 {
6192 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6193 *secid = isec->sid;
6194 }
6195
6196 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6197 {
6198 if (inode)
6199 inode_doinit_with_dentry(inode, dentry);
6200 }
6201
6202 static int selinux_getprocattr(struct task_struct *p,
6203 char *name, char **value)
6204 {
6205 const struct task_security_struct *__tsec;
6206 u32 sid;
6207 int error;
6208 unsigned len;
6209
6210 rcu_read_lock();
6211 __tsec = selinux_cred(__task_cred(p));
6212
6213 if (current != p) {
6214 error = avc_has_perm(&selinux_state,
6215 current_sid(), __tsec->sid,
6216 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6217 if (error)
6218 goto bad;
6219 }
6220
6221 if (!strcmp(name, "current"))
6222 sid = __tsec->sid;
6223 else if (!strcmp(name, "prev"))
6224 sid = __tsec->osid;
6225 else if (!strcmp(name, "exec"))
6226 sid = __tsec->exec_sid;
6227 else if (!strcmp(name, "fscreate"))
6228 sid = __tsec->create_sid;
6229 else if (!strcmp(name, "keycreate"))
6230 sid = __tsec->keycreate_sid;
6231 else if (!strcmp(name, "sockcreate"))
6232 sid = __tsec->sockcreate_sid;
6233 else {
6234 error = -EINVAL;
6235 goto bad;
6236 }
6237 rcu_read_unlock();
6238
6239 if (!sid)
6240 return 0;
6241
6242 error = security_sid_to_context(&selinux_state, sid, value, &len);
6243 if (error)
6244 return error;
6245 return len;
6246
6247 bad:
6248 rcu_read_unlock();
6249 return error;
6250 }
6251
6252 static int selinux_setprocattr(const char *name, void *value, size_t size)
6253 {
6254 struct task_security_struct *tsec;
6255 struct cred *new;
6256 u32 mysid = current_sid(), sid = 0, ptsid;
6257 int error;
6258 char *str = value;
6259
6260 /*
6261 * Basic control over ability to set these attributes at all.
6262 */
6263 if (!strcmp(name, "exec"))
6264 error = avc_has_perm(&selinux_state,
6265 mysid, mysid, SECCLASS_PROCESS,
6266 PROCESS__SETEXEC, NULL);
6267 else if (!strcmp(name, "fscreate"))
6268 error = avc_has_perm(&selinux_state,
6269 mysid, mysid, SECCLASS_PROCESS,
6270 PROCESS__SETFSCREATE, NULL);
6271 else if (!strcmp(name, "keycreate"))
6272 error = avc_has_perm(&selinux_state,
6273 mysid, mysid, SECCLASS_PROCESS,
6274 PROCESS__SETKEYCREATE, NULL);
6275 else if (!strcmp(name, "sockcreate"))
6276 error = avc_has_perm(&selinux_state,
6277 mysid, mysid, SECCLASS_PROCESS,
6278 PROCESS__SETSOCKCREATE, NULL);
6279 else if (!strcmp(name, "current"))
6280 error = avc_has_perm(&selinux_state,
6281 mysid, mysid, SECCLASS_PROCESS,
6282 PROCESS__SETCURRENT, NULL);
6283 else
6284 error = -EINVAL;
6285 if (error)
6286 return error;
6287
6288 /* Obtain a SID for the context, if one was specified. */
6289 if (size && str[0] && str[0] != '\n') {
6290 if (str[size-1] == '\n') {
6291 str[size-1] = 0;
6292 size--;
6293 }
6294 error = security_context_to_sid(&selinux_state, value, size,
6295 &sid, GFP_KERNEL);
6296 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6297 if (!has_cap_mac_admin(true)) {
6298 struct audit_buffer *ab;
6299 size_t audit_size;
6300
6301 /* We strip a nul only if it is at the end, otherwise the
6302 * context contains a nul and we should audit that */
6303 if (str[size - 1] == '\0')
6304 audit_size = size - 1;
6305 else
6306 audit_size = size;
6307 ab = audit_log_start(audit_context(),
6308 GFP_ATOMIC,
6309 AUDIT_SELINUX_ERR);
6310 audit_log_format(ab, "op=fscreate invalid_context=");
6311 audit_log_n_untrustedstring(ab, value, audit_size);
6312 audit_log_end(ab);
6313
6314 return error;
6315 }
6316 error = security_context_to_sid_force(
6317 &selinux_state,
6318 value, size, &sid);
6319 }
6320 if (error)
6321 return error;
6322 }
6323
6324 new = prepare_creds();
6325 if (!new)
6326 return -ENOMEM;
6327
6328 /* Permission checking based on the specified context is
6329 performed during the actual operation (execve,
6330 open/mkdir/...), when we know the full context of the
6331 operation. See selinux_bprm_set_creds for the execve
6332 checks and may_create for the file creation checks. The
6333 operation will then fail if the context is not permitted. */
6334 tsec = selinux_cred(new);
6335 if (!strcmp(name, "exec")) {
6336 tsec->exec_sid = sid;
6337 } else if (!strcmp(name, "fscreate")) {
6338 tsec->create_sid = sid;
6339 } else if (!strcmp(name, "keycreate")) {
6340 error = avc_has_perm(&selinux_state,
6341 mysid, sid, SECCLASS_KEY, KEY__CREATE,
6342 NULL);
6343 if (error)
6344 goto abort_change;
6345 tsec->keycreate_sid = sid;
6346 } else if (!strcmp(name, "sockcreate")) {
6347 tsec->sockcreate_sid = sid;
6348 } else if (!strcmp(name, "current")) {
6349 error = -EINVAL;
6350 if (sid == 0)
6351 goto abort_change;
6352
6353 /* Only allow single threaded processes to change context */
6354 error = -EPERM;
6355 if (!current_is_single_threaded()) {
6356 error = security_bounded_transition(&selinux_state,
6357 tsec->sid, sid);
6358 if (error)
6359 goto abort_change;
6360 }
6361
6362 /* Check permissions for the transition. */
6363 error = avc_has_perm(&selinux_state,
6364 tsec->sid, sid, SECCLASS_PROCESS,
6365 PROCESS__DYNTRANSITION, NULL);
6366 if (error)
6367 goto abort_change;
6368
6369 /* Check for ptracing, and update the task SID if ok.
6370 Otherwise, leave SID unchanged and fail. */
6371 ptsid = ptrace_parent_sid();
6372 if (ptsid != 0) {
6373 error = avc_has_perm(&selinux_state,
6374 ptsid, sid, SECCLASS_PROCESS,
6375 PROCESS__PTRACE, NULL);
6376 if (error)
6377 goto abort_change;
6378 }
6379
6380 tsec->sid = sid;
6381 } else {
6382 error = -EINVAL;
6383 goto abort_change;
6384 }
6385
6386 commit_creds(new);
6387 return size;
6388
6389 abort_change:
6390 abort_creds(new);
6391 return error;
6392 }
6393
6394 static int selinux_ismaclabel(const char *name)
6395 {
6396 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6397 }
6398
6399 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6400 {
6401 return security_sid_to_context(&selinux_state, secid,
6402 secdata, seclen);
6403 }
6404
6405 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6406 {
6407 return security_context_to_sid(&selinux_state, secdata, seclen,
6408 secid, GFP_KERNEL);
6409 }
6410
6411 static void selinux_release_secctx(char *secdata, u32 seclen)
6412 {
6413 kfree(secdata);
6414 }
6415
6416 static void selinux_inode_invalidate_secctx(struct inode *inode)
6417 {
6418 struct inode_security_struct *isec = selinux_inode(inode);
6419
6420 spin_lock(&isec->lock);
6421 isec->initialized = LABEL_INVALID;
6422 spin_unlock(&isec->lock);
6423 }
6424
6425 /*
6426 * called with inode->i_mutex locked
6427 */
6428 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6429 {
6430 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6431 ctx, ctxlen, 0);
6432 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6433 return rc == -EOPNOTSUPP ? 0 : rc;
6434 }
6435
6436 /*
6437 * called with inode->i_mutex locked
6438 */
6439 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6440 {
6441 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6442 }
6443
6444 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6445 {
6446 int len = 0;
6447 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6448 ctx, true);
6449 if (len < 0)
6450 return len;
6451 *ctxlen = len;
6452 return 0;
6453 }
6454 #ifdef CONFIG_KEYS
6455
6456 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6457 unsigned long flags)
6458 {
6459 const struct task_security_struct *tsec;
6460 struct key_security_struct *ksec;
6461
6462 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6463 if (!ksec)
6464 return -ENOMEM;
6465
6466 tsec = selinux_cred(cred);
6467 if (tsec->keycreate_sid)
6468 ksec->sid = tsec->keycreate_sid;
6469 else
6470 ksec->sid = tsec->sid;
6471
6472 k->security = ksec;
6473 return 0;
6474 }
6475
6476 static void selinux_key_free(struct key *k)
6477 {
6478 struct key_security_struct *ksec = k->security;
6479
6480 k->security = NULL;
6481 kfree(ksec);
6482 }
6483
6484 static int selinux_key_permission(key_ref_t key_ref,
6485 const struct cred *cred,
6486 unsigned perm)
6487 {
6488 struct key *key;
6489 struct key_security_struct *ksec;
6490 u32 sid;
6491
6492 /* if no specific permissions are requested, we skip the
6493 permission check. No serious, additional covert channels
6494 appear to be created. */
6495 if (perm == 0)
6496 return 0;
6497
6498 sid = cred_sid(cred);
6499
6500 key = key_ref_to_ptr(key_ref);
6501 ksec = key->security;
6502
6503 return avc_has_perm(&selinux_state,
6504 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6505 }
6506
6507 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6508 {
6509 struct key_security_struct *ksec = key->security;
6510 char *context = NULL;
6511 unsigned len;
6512 int rc;
6513
6514 rc = security_sid_to_context(&selinux_state, ksec->sid,
6515 &context, &len);
6516 if (!rc)
6517 rc = len;
6518 *_buffer = context;
6519 return rc;
6520 }
6521 #endif
6522
6523 #ifdef CONFIG_SECURITY_INFINIBAND
6524 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6525 {
6526 struct common_audit_data ad;
6527 int err;
6528 u32 sid = 0;
6529 struct ib_security_struct *sec = ib_sec;
6530 struct lsm_ibpkey_audit ibpkey;
6531
6532 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6533 if (err)
6534 return err;
6535
6536 ad.type = LSM_AUDIT_DATA_IBPKEY;
6537 ibpkey.subnet_prefix = subnet_prefix;
6538 ibpkey.pkey = pkey_val;
6539 ad.u.ibpkey = &ibpkey;
6540 return avc_has_perm(&selinux_state,
6541 sec->sid, sid,
6542 SECCLASS_INFINIBAND_PKEY,
6543 INFINIBAND_PKEY__ACCESS, &ad);
6544 }
6545
6546 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6547 u8 port_num)
6548 {
6549 struct common_audit_data ad;
6550 int err;
6551 u32 sid = 0;
6552 struct ib_security_struct *sec = ib_sec;
6553 struct lsm_ibendport_audit ibendport;
6554
6555 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6556 &sid);
6557
6558 if (err)
6559 return err;
6560
6561 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6562 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6563 ibendport.port = port_num;
6564 ad.u.ibendport = &ibendport;
6565 return avc_has_perm(&selinux_state,
6566 sec->sid, sid,
6567 SECCLASS_INFINIBAND_ENDPORT,
6568 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6569 }
6570
6571 static int selinux_ib_alloc_security(void **ib_sec)
6572 {
6573 struct ib_security_struct *sec;
6574
6575 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6576 if (!sec)
6577 return -ENOMEM;
6578 sec->sid = current_sid();
6579
6580 *ib_sec = sec;
6581 return 0;
6582 }
6583
6584 static void selinux_ib_free_security(void *ib_sec)
6585 {
6586 kfree(ib_sec);
6587 }
6588 #endif
6589
6590 #ifdef CONFIG_BPF_SYSCALL
6591 static int selinux_bpf(int cmd, union bpf_attr *attr,
6592 unsigned int size)
6593 {
6594 u32 sid = current_sid();
6595 int ret;
6596
6597 switch (cmd) {
6598 case BPF_MAP_CREATE:
6599 ret = avc_has_perm(&selinux_state,
6600 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6601 NULL);
6602 break;
6603 case BPF_PROG_LOAD:
6604 ret = avc_has_perm(&selinux_state,
6605 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6606 NULL);
6607 break;
6608 default:
6609 ret = 0;
6610 break;
6611 }
6612
6613 return ret;
6614 }
6615
6616 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6617 {
6618 u32 av = 0;
6619
6620 if (fmode & FMODE_READ)
6621 av |= BPF__MAP_READ;
6622 if (fmode & FMODE_WRITE)
6623 av |= BPF__MAP_WRITE;
6624 return av;
6625 }
6626
6627 /* This function will check the file pass through unix socket or binder to see
6628 * if it is a bpf related object. And apply correspinding checks on the bpf
6629 * object based on the type. The bpf maps and programs, not like other files and
6630 * socket, are using a shared anonymous inode inside the kernel as their inode.
6631 * So checking that inode cannot identify if the process have privilege to
6632 * access the bpf object and that's why we have to add this additional check in
6633 * selinux_file_receive and selinux_binder_transfer_files.
6634 */
6635 static int bpf_fd_pass(struct file *file, u32 sid)
6636 {
6637 struct bpf_security_struct *bpfsec;
6638 struct bpf_prog *prog;
6639 struct bpf_map *map;
6640 int ret;
6641
6642 if (file->f_op == &bpf_map_fops) {
6643 map = file->private_data;
6644 bpfsec = map->security;
6645 ret = avc_has_perm(&selinux_state,
6646 sid, bpfsec->sid, SECCLASS_BPF,
6647 bpf_map_fmode_to_av(file->f_mode), NULL);
6648 if (ret)
6649 return ret;
6650 } else if (file->f_op == &bpf_prog_fops) {
6651 prog = file->private_data;
6652 bpfsec = prog->aux->security;
6653 ret = avc_has_perm(&selinux_state,
6654 sid, bpfsec->sid, SECCLASS_BPF,
6655 BPF__PROG_RUN, NULL);
6656 if (ret)
6657 return ret;
6658 }
6659 return 0;
6660 }
6661
6662 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6663 {
6664 u32 sid = current_sid();
6665 struct bpf_security_struct *bpfsec;
6666
6667 bpfsec = map->security;
6668 return avc_has_perm(&selinux_state,
6669 sid, bpfsec->sid, SECCLASS_BPF,
6670 bpf_map_fmode_to_av(fmode), NULL);
6671 }
6672
6673 static int selinux_bpf_prog(struct bpf_prog *prog)
6674 {
6675 u32 sid = current_sid();
6676 struct bpf_security_struct *bpfsec;
6677
6678 bpfsec = prog->aux->security;
6679 return avc_has_perm(&selinux_state,
6680 sid, bpfsec->sid, SECCLASS_BPF,
6681 BPF__PROG_RUN, NULL);
6682 }
6683
6684 static int selinux_bpf_map_alloc(struct bpf_map *map)
6685 {
6686 struct bpf_security_struct *bpfsec;
6687
6688 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6689 if (!bpfsec)
6690 return -ENOMEM;
6691
6692 bpfsec->sid = current_sid();
6693 map->security = bpfsec;
6694
6695 return 0;
6696 }
6697
6698 static void selinux_bpf_map_free(struct bpf_map *map)
6699 {
6700 struct bpf_security_struct *bpfsec = map->security;
6701
6702 map->security = NULL;
6703 kfree(bpfsec);
6704 }
6705
6706 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6707 {
6708 struct bpf_security_struct *bpfsec;
6709
6710 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6711 if (!bpfsec)
6712 return -ENOMEM;
6713
6714 bpfsec->sid = current_sid();
6715 aux->security = bpfsec;
6716
6717 return 0;
6718 }
6719
6720 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6721 {
6722 struct bpf_security_struct *bpfsec = aux->security;
6723
6724 aux->security = NULL;
6725 kfree(bpfsec);
6726 }
6727 #endif
6728
6729 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6730 .lbs_cred = sizeof(struct task_security_struct),
6731 .lbs_file = sizeof(struct file_security_struct),
6732 .lbs_inode = sizeof(struct inode_security_struct),
6733 .lbs_ipc = sizeof(struct ipc_security_struct),
6734 .lbs_msg_msg = sizeof(struct msg_security_struct),
6735 };
6736
6737 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6738 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6739 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6740 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6741 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6742
6743 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6744 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6745 LSM_HOOK_INIT(capget, selinux_capget),
6746 LSM_HOOK_INIT(capset, selinux_capset),
6747 LSM_HOOK_INIT(capable, selinux_capable),
6748 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6749 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6750 LSM_HOOK_INIT(syslog, selinux_syslog),
6751 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6752
6753 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6754
6755 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6756 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6757 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6758
6759 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6760 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6761
6762 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6763 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6764 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6765 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6766 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6767 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6768 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6769 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6770 LSM_HOOK_INIT(sb_mount, selinux_mount),
6771 LSM_HOOK_INIT(sb_umount, selinux_umount),
6772 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6773 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6774 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6775
6776 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6777 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6778
6779 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6780 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6781 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6782 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6783 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6784 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6785 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6786 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6787 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6788 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6789 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6790 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6791 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6792 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6793 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6794 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6795 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6796 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6797 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6798 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6799 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6800 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6801 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6802 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6803 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6804 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6805 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6806
6807 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6808
6809 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6810 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6811 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6812 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6813 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6814 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6815 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6816 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6817 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6818 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6819 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6820
6821 LSM_HOOK_INIT(file_open, selinux_file_open),
6822
6823 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6824 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6825 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6826 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6827 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6828 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6829 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6830 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6831 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6832 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6833 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6834 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6835 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6836 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6837 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6838 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6839 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6840 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6841 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6842 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6843 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6844 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6845 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6846
6847 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6848 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6849
6850 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6851
6852 LSM_HOOK_INIT(msg_queue_alloc_security,
6853 selinux_msg_queue_alloc_security),
6854 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6855 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6856 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6857 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6858
6859 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6860 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6861 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6862 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6863
6864 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6865 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6866 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6867 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6868
6869 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6870
6871 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6872 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6873
6874 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6875 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6876 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6877 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6878 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6879 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6880 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6881 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6882
6883 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6884 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6885
6886 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6887 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6888 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6889 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6890 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6891 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6892 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6893 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6894 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6895 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6896 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6897 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6898 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6899 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6900 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6901 LSM_HOOK_INIT(socket_getpeersec_stream,
6902 selinux_socket_getpeersec_stream),
6903 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6904 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6905 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6906 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6907 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6908 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6909 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6910 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6911 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6912 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6913 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6914 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6915 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6916 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6917 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6918 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6919 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6920 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6921 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6922 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6923 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6924 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6925 #ifdef CONFIG_SECURITY_INFINIBAND
6926 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6927 LSM_HOOK_INIT(ib_endport_manage_subnet,
6928 selinux_ib_endport_manage_subnet),
6929 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6930 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6931 #endif
6932 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6933 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6934 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6935 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6936 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6937 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6938 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6939 selinux_xfrm_state_alloc_acquire),
6940 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6941 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6942 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6943 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6944 selinux_xfrm_state_pol_flow_match),
6945 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6946 #endif
6947
6948 #ifdef CONFIG_KEYS
6949 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6950 LSM_HOOK_INIT(key_free, selinux_key_free),
6951 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6952 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6953 #endif
6954
6955 #ifdef CONFIG_AUDIT
6956 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6957 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6958 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6959 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6960 #endif
6961
6962 #ifdef CONFIG_BPF_SYSCALL
6963 LSM_HOOK_INIT(bpf, selinux_bpf),
6964 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6965 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6966 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6967 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6968 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6969 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6970 #endif
6971 };
6972
6973 static __init int selinux_init(void)
6974 {
6975 pr_info("SELinux: Initializing.\n");
6976
6977 memset(&selinux_state, 0, sizeof(selinux_state));
6978 enforcing_set(&selinux_state, selinux_enforcing_boot);
6979 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6980 selinux_ss_init(&selinux_state.ss);
6981 selinux_avc_init(&selinux_state.avc);
6982
6983 /* Set the security state for the initial task. */
6984 cred_init_security();
6985
6986 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6987
6988 avc_init();
6989
6990 avtab_cache_init();
6991
6992 ebitmap_cache_init();
6993
6994 hashtab_cache_init();
6995
6996 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6997
6998 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6999 panic("SELinux: Unable to register AVC netcache callback\n");
7000
7001 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7002 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7003
7004 if (selinux_enforcing_boot)
7005 pr_debug("SELinux: Starting in enforcing mode\n");
7006 else
7007 pr_debug("SELinux: Starting in permissive mode\n");
7008
7009 fs_validate_description(&selinux_fs_parameters);
7010
7011 return 0;
7012 }
7013
7014 static void delayed_superblock_init(struct super_block *sb, void *unused)
7015 {
7016 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7017 }
7018
7019 void selinux_complete_init(void)
7020 {
7021 pr_debug("SELinux: Completing initialization.\n");
7022
7023 /* Set up any superblocks initialized prior to the policy load. */
7024 pr_debug("SELinux: Setting up existing superblocks.\n");
7025 iterate_supers(delayed_superblock_init, NULL);
7026 }
7027
7028 /* SELinux requires early initialization in order to label
7029 all processes and objects when they are created. */
7030 DEFINE_LSM(selinux) = {
7031 .name = "selinux",
7032 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7033 .enabled = &selinux_enabled,
7034 .blobs = &selinux_blob_sizes,
7035 .init = selinux_init,
7036 };
7037
7038 #if defined(CONFIG_NETFILTER)
7039
7040 static const struct nf_hook_ops selinux_nf_ops[] = {
7041 {
7042 .hook = selinux_ipv4_postroute,
7043 .pf = NFPROTO_IPV4,
7044 .hooknum = NF_INET_POST_ROUTING,
7045 .priority = NF_IP_PRI_SELINUX_LAST,
7046 },
7047 {
7048 .hook = selinux_ipv4_forward,
7049 .pf = NFPROTO_IPV4,
7050 .hooknum = NF_INET_FORWARD,
7051 .priority = NF_IP_PRI_SELINUX_FIRST,
7052 },
7053 {
7054 .hook = selinux_ipv4_output,
7055 .pf = NFPROTO_IPV4,
7056 .hooknum = NF_INET_LOCAL_OUT,
7057 .priority = NF_IP_PRI_SELINUX_FIRST,
7058 },
7059 #if IS_ENABLED(CONFIG_IPV6)
7060 {
7061 .hook = selinux_ipv6_postroute,
7062 .pf = NFPROTO_IPV6,
7063 .hooknum = NF_INET_POST_ROUTING,
7064 .priority = NF_IP6_PRI_SELINUX_LAST,
7065 },
7066 {
7067 .hook = selinux_ipv6_forward,
7068 .pf = NFPROTO_IPV6,
7069 .hooknum = NF_INET_FORWARD,
7070 .priority = NF_IP6_PRI_SELINUX_FIRST,
7071 },
7072 {
7073 .hook = selinux_ipv6_output,
7074 .pf = NFPROTO_IPV6,
7075 .hooknum = NF_INET_LOCAL_OUT,
7076 .priority = NF_IP6_PRI_SELINUX_FIRST,
7077 },
7078 #endif /* IPV6 */
7079 };
7080
7081 static int __net_init selinux_nf_register(struct net *net)
7082 {
7083 return nf_register_net_hooks(net, selinux_nf_ops,
7084 ARRAY_SIZE(selinux_nf_ops));
7085 }
7086
7087 static void __net_exit selinux_nf_unregister(struct net *net)
7088 {
7089 nf_unregister_net_hooks(net, selinux_nf_ops,
7090 ARRAY_SIZE(selinux_nf_ops));
7091 }
7092
7093 static struct pernet_operations selinux_net_ops = {
7094 .init = selinux_nf_register,
7095 .exit = selinux_nf_unregister,
7096 };
7097
7098 static int __init selinux_nf_ip_init(void)
7099 {
7100 int err;
7101
7102 if (!selinux_enabled)
7103 return 0;
7104
7105 pr_debug("SELinux: Registering netfilter hooks\n");
7106
7107 err = register_pernet_subsys(&selinux_net_ops);
7108 if (err)
7109 panic("SELinux: register_pernet_subsys: error %d\n", err);
7110
7111 return 0;
7112 }
7113 __initcall(selinux_nf_ip_init);
7114
7115 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7116 static void selinux_nf_ip_exit(void)
7117 {
7118 pr_debug("SELinux: Unregistering netfilter hooks\n");
7119
7120 unregister_pernet_subsys(&selinux_net_ops);
7121 }
7122 #endif
7123
7124 #else /* CONFIG_NETFILTER */
7125
7126 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7127 #define selinux_nf_ip_exit()
7128 #endif
7129
7130 #endif /* CONFIG_NETFILTER */
7131
7132 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7133 int selinux_disable(struct selinux_state *state)
7134 {
7135 if (state->initialized) {
7136 /* Not permitted after initial policy load. */
7137 return -EINVAL;
7138 }
7139
7140 if (state->disabled) {
7141 /* Only do this once. */
7142 return -EINVAL;
7143 }
7144
7145 state->disabled = 1;
7146
7147 pr_info("SELinux: Disabled at runtime.\n");
7148
7149 selinux_enabled = 0;
7150
7151 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7152
7153 /* Try to destroy the avc node cache */
7154 avc_disable();
7155
7156 /* Unregister netfilter hooks. */
7157 selinux_nf_ip_exit();
7158
7159 /* Unregister selinuxfs. */
7160 exit_sel_fs();
7161
7162 return 0;
7163 }
7164 #endif
Ubuntu Hirsute Linux kernel mirror