]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'trace-v4.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt...
[mirror_ubuntu-bionic-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
86
87 #include "avc.h"
88 #include "objsec.h"
89 #include "netif.h"
90 #include "netnode.h"
91 #include "netport.h"
92 #include "xfrm.h"
93 #include "netlabel.h"
94 #include "audit.h"
95 #include "avc_ss.h"
96
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102
103 static int __init enforcing_setup(char *str)
104 {
105 unsigned long enforcing;
106 if (!kstrtoul(str, 0, &enforcing))
107 selinux_enforcing = enforcing ? 1 : 0;
108 return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116 static int __init selinux_enabled_setup(char *str)
117 {
118 unsigned long enabled;
119 if (!kstrtoul(str, 0, &enabled))
120 selinux_enabled = enabled ? 1 : 0;
121 return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127
128 static struct kmem_cache *sel_inode_cache;
129 static struct kmem_cache *file_security_cache;
130
131 /**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
140 *
141 */
142 static int selinux_secmark_enabled(void)
143 {
144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
145 }
146
147 /**
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
149 *
150 * Description:
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
155 *
156 */
157 static int selinux_peerlbl_enabled(void)
158 {
159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
160 }
161
162 static int selinux_netcache_avc_callback(u32 event)
163 {
164 if (event == AVC_CALLBACK_RESET) {
165 sel_netif_flush();
166 sel_netnode_flush();
167 sel_netport_flush();
168 synchronize_net();
169 }
170 return 0;
171 }
172
173 /*
174 * initialise the security for the init task
175 */
176 static void cred_init_security(void)
177 {
178 struct cred *cred = (struct cred *) current->real_cred;
179 struct task_security_struct *tsec;
180
181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
182 if (!tsec)
183 panic("SELinux: Failed to initialize initial task.\n");
184
185 tsec->osid = tsec->sid = SECINITSID_KERNEL;
186 cred->security = tsec;
187 }
188
189 /*
190 * get the security ID of a set of credentials
191 */
192 static inline u32 cred_sid(const struct cred *cred)
193 {
194 const struct task_security_struct *tsec;
195
196 tsec = cred->security;
197 return tsec->sid;
198 }
199
200 /*
201 * get the objective security ID of a task
202 */
203 static inline u32 task_sid(const struct task_struct *task)
204 {
205 u32 sid;
206
207 rcu_read_lock();
208 sid = cred_sid(__task_cred(task));
209 rcu_read_unlock();
210 return sid;
211 }
212
213 /* Allocate and free functions for each kind of security blob. */
214
215 static int inode_alloc_security(struct inode *inode)
216 {
217 struct inode_security_struct *isec;
218 u32 sid = current_sid();
219
220 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
221 if (!isec)
222 return -ENOMEM;
223
224 spin_lock_init(&isec->lock);
225 INIT_LIST_HEAD(&isec->list);
226 isec->inode = inode;
227 isec->sid = SECINITSID_UNLABELED;
228 isec->sclass = SECCLASS_FILE;
229 isec->task_sid = sid;
230 isec->initialized = LABEL_INVALID;
231 inode->i_security = isec;
232
233 return 0;
234 }
235
236 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
237
238 /*
239 * Try reloading inode security labels that have been marked as invalid. The
240 * @may_sleep parameter indicates when sleeping and thus reloading labels is
241 * allowed; when set to false, returns -ECHILD when the label is
242 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
243 * when no dentry is available, set it to NULL instead.
244 */
245 static int __inode_security_revalidate(struct inode *inode,
246 struct dentry *opt_dentry,
247 bool may_sleep)
248 {
249 struct inode_security_struct *isec = inode->i_security;
250
251 might_sleep_if(may_sleep);
252
253 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
254 if (!may_sleep)
255 return -ECHILD;
256
257 /*
258 * Try reloading the inode security label. This will fail if
259 * @opt_dentry is NULL and no dentry for this inode can be
260 * found; in that case, continue using the old label.
261 */
262 inode_doinit_with_dentry(inode, opt_dentry);
263 }
264 return 0;
265 }
266
267 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
268 {
269 return inode->i_security;
270 }
271
272 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
273 {
274 int error;
275
276 error = __inode_security_revalidate(inode, NULL, !rcu);
277 if (error)
278 return ERR_PTR(error);
279 return inode->i_security;
280 }
281
282 /*
283 * Get the security label of an inode.
284 */
285 static struct inode_security_struct *inode_security(struct inode *inode)
286 {
287 __inode_security_revalidate(inode, NULL, true);
288 return inode->i_security;
289 }
290
291 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
292 {
293 struct inode *inode = d_backing_inode(dentry);
294
295 return inode->i_security;
296 }
297
298 /*
299 * Get the security label of a dentry's backing inode.
300 */
301 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
302 {
303 struct inode *inode = d_backing_inode(dentry);
304
305 __inode_security_revalidate(inode, dentry, true);
306 return inode->i_security;
307 }
308
309 static void inode_free_rcu(struct rcu_head *head)
310 {
311 struct inode_security_struct *isec;
312
313 isec = container_of(head, struct inode_security_struct, rcu);
314 kmem_cache_free(sel_inode_cache, isec);
315 }
316
317 static void inode_free_security(struct inode *inode)
318 {
319 struct inode_security_struct *isec = inode->i_security;
320 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
321
322 /*
323 * As not all inode security structures are in a list, we check for
324 * empty list outside of the lock to make sure that we won't waste
325 * time taking a lock doing nothing.
326 *
327 * The list_del_init() function can be safely called more than once.
328 * It should not be possible for this function to be called with
329 * concurrent list_add(), but for better safety against future changes
330 * in the code, we use list_empty_careful() here.
331 */
332 if (!list_empty_careful(&isec->list)) {
333 spin_lock(&sbsec->isec_lock);
334 list_del_init(&isec->list);
335 spin_unlock(&sbsec->isec_lock);
336 }
337
338 /*
339 * The inode may still be referenced in a path walk and
340 * a call to selinux_inode_permission() can be made
341 * after inode_free_security() is called. Ideally, the VFS
342 * wouldn't do this, but fixing that is a much harder
343 * job. For now, simply free the i_security via RCU, and
344 * leave the current inode->i_security pointer intact.
345 * The inode will be freed after the RCU grace period too.
346 */
347 call_rcu(&isec->rcu, inode_free_rcu);
348 }
349
350 static int file_alloc_security(struct file *file)
351 {
352 struct file_security_struct *fsec;
353 u32 sid = current_sid();
354
355 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
356 if (!fsec)
357 return -ENOMEM;
358
359 fsec->sid = sid;
360 fsec->fown_sid = sid;
361 file->f_security = fsec;
362
363 return 0;
364 }
365
366 static void file_free_security(struct file *file)
367 {
368 struct file_security_struct *fsec = file->f_security;
369 file->f_security = NULL;
370 kmem_cache_free(file_security_cache, fsec);
371 }
372
373 static int superblock_alloc_security(struct super_block *sb)
374 {
375 struct superblock_security_struct *sbsec;
376
377 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
378 if (!sbsec)
379 return -ENOMEM;
380
381 mutex_init(&sbsec->lock);
382 INIT_LIST_HEAD(&sbsec->isec_head);
383 spin_lock_init(&sbsec->isec_lock);
384 sbsec->sb = sb;
385 sbsec->sid = SECINITSID_UNLABELED;
386 sbsec->def_sid = SECINITSID_FILE;
387 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
388 sb->s_security = sbsec;
389
390 return 0;
391 }
392
393 static void superblock_free_security(struct super_block *sb)
394 {
395 struct superblock_security_struct *sbsec = sb->s_security;
396 sb->s_security = NULL;
397 kfree(sbsec);
398 }
399
400 /* The file system's label must be initialized prior to use. */
401
402 static const char *labeling_behaviors[7] = {
403 "uses xattr",
404 "uses transition SIDs",
405 "uses task SIDs",
406 "uses genfs_contexts",
407 "not configured for labeling",
408 "uses mountpoint labeling",
409 "uses native labeling",
410 };
411
412 static inline int inode_doinit(struct inode *inode)
413 {
414 return inode_doinit_with_dentry(inode, NULL);
415 }
416
417 enum {
418 Opt_error = -1,
419 Opt_context = 1,
420 Opt_fscontext = 2,
421 Opt_defcontext = 3,
422 Opt_rootcontext = 4,
423 Opt_labelsupport = 5,
424 Opt_nextmntopt = 6,
425 };
426
427 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
428
429 static const match_table_t tokens = {
430 {Opt_context, CONTEXT_STR "%s"},
431 {Opt_fscontext, FSCONTEXT_STR "%s"},
432 {Opt_defcontext, DEFCONTEXT_STR "%s"},
433 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
434 {Opt_labelsupport, LABELSUPP_STR},
435 {Opt_error, NULL},
436 };
437
438 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
439
440 static int may_context_mount_sb_relabel(u32 sid,
441 struct superblock_security_struct *sbsec,
442 const struct cred *cred)
443 {
444 const struct task_security_struct *tsec = cred->security;
445 int rc;
446
447 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
448 FILESYSTEM__RELABELFROM, NULL);
449 if (rc)
450 return rc;
451
452 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELTO, NULL);
454 return rc;
455 }
456
457 static int may_context_mount_inode_relabel(u32 sid,
458 struct superblock_security_struct *sbsec,
459 const struct cred *cred)
460 {
461 const struct task_security_struct *tsec = cred->security;
462 int rc;
463 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
464 FILESYSTEM__RELABELFROM, NULL);
465 if (rc)
466 return rc;
467
468 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
469 FILESYSTEM__ASSOCIATE, NULL);
470 return rc;
471 }
472
473 static int selinux_is_sblabel_mnt(struct super_block *sb)
474 {
475 struct superblock_security_struct *sbsec = sb->s_security;
476
477 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
478 sbsec->behavior == SECURITY_FS_USE_TRANS ||
479 sbsec->behavior == SECURITY_FS_USE_TASK ||
480 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
481 /* Special handling. Genfs but also in-core setxattr handler */
482 !strcmp(sb->s_type->name, "sysfs") ||
483 !strcmp(sb->s_type->name, "cgroup") ||
484 !strcmp(sb->s_type->name, "cgroup2") ||
485 !strcmp(sb->s_type->name, "pstore") ||
486 !strcmp(sb->s_type->name, "debugfs") ||
487 !strcmp(sb->s_type->name, "tracefs") ||
488 !strcmp(sb->s_type->name, "rootfs");
489 }
490
491 static int sb_finish_set_opts(struct super_block *sb)
492 {
493 struct superblock_security_struct *sbsec = sb->s_security;
494 struct dentry *root = sb->s_root;
495 struct inode *root_inode = d_backing_inode(root);
496 int rc = 0;
497
498 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
499 /* Make sure that the xattr handler exists and that no
500 error other than -ENODATA is returned by getxattr on
501 the root directory. -ENODATA is ok, as this may be
502 the first boot of the SELinux kernel before we have
503 assigned xattr values to the filesystem. */
504 if (!(root_inode->i_opflags & IOP_XATTR)) {
505 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
506 "xattr support\n", sb->s_id, sb->s_type->name);
507 rc = -EOPNOTSUPP;
508 goto out;
509 }
510
511 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
512 if (rc < 0 && rc != -ENODATA) {
513 if (rc == -EOPNOTSUPP)
514 printk(KERN_WARNING "SELinux: (dev %s, type "
515 "%s) has no security xattr handler\n",
516 sb->s_id, sb->s_type->name);
517 else
518 printk(KERN_WARNING "SELinux: (dev %s, type "
519 "%s) getxattr errno %d\n", sb->s_id,
520 sb->s_type->name, -rc);
521 goto out;
522 }
523 }
524
525 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
526 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
527 sb->s_id, sb->s_type->name);
528
529 sbsec->flags |= SE_SBINITIALIZED;
530 if (selinux_is_sblabel_mnt(sb))
531 sbsec->flags |= SBLABEL_MNT;
532
533 /* Initialize the root inode. */
534 rc = inode_doinit_with_dentry(root_inode, root);
535
536 /* Initialize any other inodes associated with the superblock, e.g.
537 inodes created prior to initial policy load or inodes created
538 during get_sb by a pseudo filesystem that directly
539 populates itself. */
540 spin_lock(&sbsec->isec_lock);
541 next_inode:
542 if (!list_empty(&sbsec->isec_head)) {
543 struct inode_security_struct *isec =
544 list_entry(sbsec->isec_head.next,
545 struct inode_security_struct, list);
546 struct inode *inode = isec->inode;
547 list_del_init(&isec->list);
548 spin_unlock(&sbsec->isec_lock);
549 inode = igrab(inode);
550 if (inode) {
551 if (!IS_PRIVATE(inode))
552 inode_doinit(inode);
553 iput(inode);
554 }
555 spin_lock(&sbsec->isec_lock);
556 goto next_inode;
557 }
558 spin_unlock(&sbsec->isec_lock);
559 out:
560 return rc;
561 }
562
563 /*
564 * This function should allow an FS to ask what it's mount security
565 * options were so it can use those later for submounts, displaying
566 * mount options, or whatever.
567 */
568 static int selinux_get_mnt_opts(const struct super_block *sb,
569 struct security_mnt_opts *opts)
570 {
571 int rc = 0, i;
572 struct superblock_security_struct *sbsec = sb->s_security;
573 char *context = NULL;
574 u32 len;
575 char tmp;
576
577 security_init_mnt_opts(opts);
578
579 if (!(sbsec->flags & SE_SBINITIALIZED))
580 return -EINVAL;
581
582 if (!ss_initialized)
583 return -EINVAL;
584
585 /* make sure we always check enough bits to cover the mask */
586 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
587
588 tmp = sbsec->flags & SE_MNTMASK;
589 /* count the number of mount options for this sb */
590 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
591 if (tmp & 0x01)
592 opts->num_mnt_opts++;
593 tmp >>= 1;
594 }
595 /* Check if the Label support flag is set */
596 if (sbsec->flags & SBLABEL_MNT)
597 opts->num_mnt_opts++;
598
599 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
600 if (!opts->mnt_opts) {
601 rc = -ENOMEM;
602 goto out_free;
603 }
604
605 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
606 if (!opts->mnt_opts_flags) {
607 rc = -ENOMEM;
608 goto out_free;
609 }
610
611 i = 0;
612 if (sbsec->flags & FSCONTEXT_MNT) {
613 rc = security_sid_to_context(sbsec->sid, &context, &len);
614 if (rc)
615 goto out_free;
616 opts->mnt_opts[i] = context;
617 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
618 }
619 if (sbsec->flags & CONTEXT_MNT) {
620 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
621 if (rc)
622 goto out_free;
623 opts->mnt_opts[i] = context;
624 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
625 }
626 if (sbsec->flags & DEFCONTEXT_MNT) {
627 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
628 if (rc)
629 goto out_free;
630 opts->mnt_opts[i] = context;
631 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
632 }
633 if (sbsec->flags & ROOTCONTEXT_MNT) {
634 struct dentry *root = sbsec->sb->s_root;
635 struct inode_security_struct *isec = backing_inode_security(root);
636
637 rc = security_sid_to_context(isec->sid, &context, &len);
638 if (rc)
639 goto out_free;
640 opts->mnt_opts[i] = context;
641 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
642 }
643 if (sbsec->flags & SBLABEL_MNT) {
644 opts->mnt_opts[i] = NULL;
645 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
646 }
647
648 BUG_ON(i != opts->num_mnt_opts);
649
650 return 0;
651
652 out_free:
653 security_free_mnt_opts(opts);
654 return rc;
655 }
656
657 static int bad_option(struct superblock_security_struct *sbsec, char flag,
658 u32 old_sid, u32 new_sid)
659 {
660 char mnt_flags = sbsec->flags & SE_MNTMASK;
661
662 /* check if the old mount command had the same options */
663 if (sbsec->flags & SE_SBINITIALIZED)
664 if (!(sbsec->flags & flag) ||
665 (old_sid != new_sid))
666 return 1;
667
668 /* check if we were passed the same options twice,
669 * aka someone passed context=a,context=b
670 */
671 if (!(sbsec->flags & SE_SBINITIALIZED))
672 if (mnt_flags & flag)
673 return 1;
674 return 0;
675 }
676
677 /*
678 * Allow filesystems with binary mount data to explicitly set mount point
679 * labeling information.
680 */
681 static int selinux_set_mnt_opts(struct super_block *sb,
682 struct security_mnt_opts *opts,
683 unsigned long kern_flags,
684 unsigned long *set_kern_flags)
685 {
686 const struct cred *cred = current_cred();
687 int rc = 0, i;
688 struct superblock_security_struct *sbsec = sb->s_security;
689 const char *name = sb->s_type->name;
690 struct dentry *root = sbsec->sb->s_root;
691 struct inode_security_struct *root_isec;
692 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
693 u32 defcontext_sid = 0;
694 char **mount_options = opts->mnt_opts;
695 int *flags = opts->mnt_opts_flags;
696 int num_opts = opts->num_mnt_opts;
697
698 mutex_lock(&sbsec->lock);
699
700 if (!ss_initialized) {
701 if (!num_opts) {
702 /* Defer initialization until selinux_complete_init,
703 after the initial policy is loaded and the security
704 server is ready to handle calls. */
705 goto out;
706 }
707 rc = -EINVAL;
708 printk(KERN_WARNING "SELinux: Unable to set superblock options "
709 "before the security server is initialized\n");
710 goto out;
711 }
712 if (kern_flags && !set_kern_flags) {
713 /* Specifying internal flags without providing a place to
714 * place the results is not allowed */
715 rc = -EINVAL;
716 goto out;
717 }
718
719 /*
720 * Binary mount data FS will come through this function twice. Once
721 * from an explicit call and once from the generic calls from the vfs.
722 * Since the generic VFS calls will not contain any security mount data
723 * we need to skip the double mount verification.
724 *
725 * This does open a hole in which we will not notice if the first
726 * mount using this sb set explict options and a second mount using
727 * this sb does not set any security options. (The first options
728 * will be used for both mounts)
729 */
730 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
731 && (num_opts == 0))
732 goto out;
733
734 root_isec = backing_inode_security_novalidate(root);
735
736 /*
737 * parse the mount options, check if they are valid sids.
738 * also check if someone is trying to mount the same sb more
739 * than once with different security options.
740 */
741 for (i = 0; i < num_opts; i++) {
742 u32 sid;
743
744 if (flags[i] == SBLABEL_MNT)
745 continue;
746 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
747 if (rc) {
748 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
749 "(%s) failed for (dev %s, type %s) errno=%d\n",
750 mount_options[i], sb->s_id, name, rc);
751 goto out;
752 }
753 switch (flags[i]) {
754 case FSCONTEXT_MNT:
755 fscontext_sid = sid;
756
757 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
758 fscontext_sid))
759 goto out_double_mount;
760
761 sbsec->flags |= FSCONTEXT_MNT;
762 break;
763 case CONTEXT_MNT:
764 context_sid = sid;
765
766 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
767 context_sid))
768 goto out_double_mount;
769
770 sbsec->flags |= CONTEXT_MNT;
771 break;
772 case ROOTCONTEXT_MNT:
773 rootcontext_sid = sid;
774
775 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
776 rootcontext_sid))
777 goto out_double_mount;
778
779 sbsec->flags |= ROOTCONTEXT_MNT;
780
781 break;
782 case DEFCONTEXT_MNT:
783 defcontext_sid = sid;
784
785 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
786 defcontext_sid))
787 goto out_double_mount;
788
789 sbsec->flags |= DEFCONTEXT_MNT;
790
791 break;
792 default:
793 rc = -EINVAL;
794 goto out;
795 }
796 }
797
798 if (sbsec->flags & SE_SBINITIALIZED) {
799 /* previously mounted with options, but not on this attempt? */
800 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
801 goto out_double_mount;
802 rc = 0;
803 goto out;
804 }
805
806 if (strcmp(sb->s_type->name, "proc") == 0)
807 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
808
809 if (!strcmp(sb->s_type->name, "debugfs") ||
810 !strcmp(sb->s_type->name, "sysfs") ||
811 !strcmp(sb->s_type->name, "pstore"))
812 sbsec->flags |= SE_SBGENFS;
813
814 if (!sbsec->behavior) {
815 /*
816 * Determine the labeling behavior to use for this
817 * filesystem type.
818 */
819 rc = security_fs_use(sb);
820 if (rc) {
821 printk(KERN_WARNING
822 "%s: security_fs_use(%s) returned %d\n",
823 __func__, sb->s_type->name, rc);
824 goto out;
825 }
826 }
827
828 /*
829 * If this is a user namespace mount and the filesystem type is not
830 * explicitly whitelisted, then no contexts are allowed on the command
831 * line and security labels must be ignored.
832 */
833 if (sb->s_user_ns != &init_user_ns &&
834 strcmp(sb->s_type->name, "tmpfs") &&
835 strcmp(sb->s_type->name, "ramfs") &&
836 strcmp(sb->s_type->name, "devpts")) {
837 if (context_sid || fscontext_sid || rootcontext_sid ||
838 defcontext_sid) {
839 rc = -EACCES;
840 goto out;
841 }
842 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
843 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
844 rc = security_transition_sid(current_sid(), current_sid(),
845 SECCLASS_FILE, NULL,
846 &sbsec->mntpoint_sid);
847 if (rc)
848 goto out;
849 }
850 goto out_set_opts;
851 }
852
853 /* sets the context of the superblock for the fs being mounted. */
854 if (fscontext_sid) {
855 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
856 if (rc)
857 goto out;
858
859 sbsec->sid = fscontext_sid;
860 }
861
862 /*
863 * Switch to using mount point labeling behavior.
864 * sets the label used on all file below the mountpoint, and will set
865 * the superblock context if not already set.
866 */
867 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
868 sbsec->behavior = SECURITY_FS_USE_NATIVE;
869 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
870 }
871
872 if (context_sid) {
873 if (!fscontext_sid) {
874 rc = may_context_mount_sb_relabel(context_sid, sbsec,
875 cred);
876 if (rc)
877 goto out;
878 sbsec->sid = context_sid;
879 } else {
880 rc = may_context_mount_inode_relabel(context_sid, sbsec,
881 cred);
882 if (rc)
883 goto out;
884 }
885 if (!rootcontext_sid)
886 rootcontext_sid = context_sid;
887
888 sbsec->mntpoint_sid = context_sid;
889 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
890 }
891
892 if (rootcontext_sid) {
893 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
894 cred);
895 if (rc)
896 goto out;
897
898 root_isec->sid = rootcontext_sid;
899 root_isec->initialized = LABEL_INITIALIZED;
900 }
901
902 if (defcontext_sid) {
903 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
904 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
905 rc = -EINVAL;
906 printk(KERN_WARNING "SELinux: defcontext option is "
907 "invalid for this filesystem type\n");
908 goto out;
909 }
910
911 if (defcontext_sid != sbsec->def_sid) {
912 rc = may_context_mount_inode_relabel(defcontext_sid,
913 sbsec, cred);
914 if (rc)
915 goto out;
916 }
917
918 sbsec->def_sid = defcontext_sid;
919 }
920
921 out_set_opts:
922 rc = sb_finish_set_opts(sb);
923 out:
924 mutex_unlock(&sbsec->lock);
925 return rc;
926 out_double_mount:
927 rc = -EINVAL;
928 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
929 "security settings for (dev %s, type %s)\n", sb->s_id, name);
930 goto out;
931 }
932
933 static int selinux_cmp_sb_context(const struct super_block *oldsb,
934 const struct super_block *newsb)
935 {
936 struct superblock_security_struct *old = oldsb->s_security;
937 struct superblock_security_struct *new = newsb->s_security;
938 char oldflags = old->flags & SE_MNTMASK;
939 char newflags = new->flags & SE_MNTMASK;
940
941 if (oldflags != newflags)
942 goto mismatch;
943 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
944 goto mismatch;
945 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
946 goto mismatch;
947 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
948 goto mismatch;
949 if (oldflags & ROOTCONTEXT_MNT) {
950 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
951 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
952 if (oldroot->sid != newroot->sid)
953 goto mismatch;
954 }
955 return 0;
956 mismatch:
957 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
958 "different security settings for (dev %s, "
959 "type %s)\n", newsb->s_id, newsb->s_type->name);
960 return -EBUSY;
961 }
962
963 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
964 struct super_block *newsb)
965 {
966 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
967 struct superblock_security_struct *newsbsec = newsb->s_security;
968
969 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
970 int set_context = (oldsbsec->flags & CONTEXT_MNT);
971 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
972
973 /*
974 * if the parent was able to be mounted it clearly had no special lsm
975 * mount options. thus we can safely deal with this superblock later
976 */
977 if (!ss_initialized)
978 return 0;
979
980 /* how can we clone if the old one wasn't set up?? */
981 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
982
983 /* if fs is reusing a sb, make sure that the contexts match */
984 if (newsbsec->flags & SE_SBINITIALIZED)
985 return selinux_cmp_sb_context(oldsb, newsb);
986
987 mutex_lock(&newsbsec->lock);
988
989 newsbsec->flags = oldsbsec->flags;
990
991 newsbsec->sid = oldsbsec->sid;
992 newsbsec->def_sid = oldsbsec->def_sid;
993 newsbsec->behavior = oldsbsec->behavior;
994
995 if (set_context) {
996 u32 sid = oldsbsec->mntpoint_sid;
997
998 if (!set_fscontext)
999 newsbsec->sid = sid;
1000 if (!set_rootcontext) {
1001 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1002 newisec->sid = sid;
1003 }
1004 newsbsec->mntpoint_sid = sid;
1005 }
1006 if (set_rootcontext) {
1007 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1008 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1009
1010 newisec->sid = oldisec->sid;
1011 }
1012
1013 sb_finish_set_opts(newsb);
1014 mutex_unlock(&newsbsec->lock);
1015 return 0;
1016 }
1017
1018 static int selinux_parse_opts_str(char *options,
1019 struct security_mnt_opts *opts)
1020 {
1021 char *p;
1022 char *context = NULL, *defcontext = NULL;
1023 char *fscontext = NULL, *rootcontext = NULL;
1024 int rc, num_mnt_opts = 0;
1025
1026 opts->num_mnt_opts = 0;
1027
1028 /* Standard string-based options. */
1029 while ((p = strsep(&options, "|")) != NULL) {
1030 int token;
1031 substring_t args[MAX_OPT_ARGS];
1032
1033 if (!*p)
1034 continue;
1035
1036 token = match_token(p, tokens, args);
1037
1038 switch (token) {
1039 case Opt_context:
1040 if (context || defcontext) {
1041 rc = -EINVAL;
1042 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1043 goto out_err;
1044 }
1045 context = match_strdup(&args[0]);
1046 if (!context) {
1047 rc = -ENOMEM;
1048 goto out_err;
1049 }
1050 break;
1051
1052 case Opt_fscontext:
1053 if (fscontext) {
1054 rc = -EINVAL;
1055 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1056 goto out_err;
1057 }
1058 fscontext = match_strdup(&args[0]);
1059 if (!fscontext) {
1060 rc = -ENOMEM;
1061 goto out_err;
1062 }
1063 break;
1064
1065 case Opt_rootcontext:
1066 if (rootcontext) {
1067 rc = -EINVAL;
1068 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1069 goto out_err;
1070 }
1071 rootcontext = match_strdup(&args[0]);
1072 if (!rootcontext) {
1073 rc = -ENOMEM;
1074 goto out_err;
1075 }
1076 break;
1077
1078 case Opt_defcontext:
1079 if (context || defcontext) {
1080 rc = -EINVAL;
1081 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1082 goto out_err;
1083 }
1084 defcontext = match_strdup(&args[0]);
1085 if (!defcontext) {
1086 rc = -ENOMEM;
1087 goto out_err;
1088 }
1089 break;
1090 case Opt_labelsupport:
1091 break;
1092 default:
1093 rc = -EINVAL;
1094 printk(KERN_WARNING "SELinux: unknown mount option\n");
1095 goto out_err;
1096
1097 }
1098 }
1099
1100 rc = -ENOMEM;
1101 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1102 if (!opts->mnt_opts)
1103 goto out_err;
1104
1105 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1106 GFP_KERNEL);
1107 if (!opts->mnt_opts_flags) {
1108 kfree(opts->mnt_opts);
1109 goto out_err;
1110 }
1111
1112 if (fscontext) {
1113 opts->mnt_opts[num_mnt_opts] = fscontext;
1114 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1115 }
1116 if (context) {
1117 opts->mnt_opts[num_mnt_opts] = context;
1118 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1119 }
1120 if (rootcontext) {
1121 opts->mnt_opts[num_mnt_opts] = rootcontext;
1122 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1123 }
1124 if (defcontext) {
1125 opts->mnt_opts[num_mnt_opts] = defcontext;
1126 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1127 }
1128
1129 opts->num_mnt_opts = num_mnt_opts;
1130 return 0;
1131
1132 out_err:
1133 kfree(context);
1134 kfree(defcontext);
1135 kfree(fscontext);
1136 kfree(rootcontext);
1137 return rc;
1138 }
1139 /*
1140 * string mount options parsing and call set the sbsec
1141 */
1142 static int superblock_doinit(struct super_block *sb, void *data)
1143 {
1144 int rc = 0;
1145 char *options = data;
1146 struct security_mnt_opts opts;
1147
1148 security_init_mnt_opts(&opts);
1149
1150 if (!data)
1151 goto out;
1152
1153 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1154
1155 rc = selinux_parse_opts_str(options, &opts);
1156 if (rc)
1157 goto out_err;
1158
1159 out:
1160 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1161
1162 out_err:
1163 security_free_mnt_opts(&opts);
1164 return rc;
1165 }
1166
1167 static void selinux_write_opts(struct seq_file *m,
1168 struct security_mnt_opts *opts)
1169 {
1170 int i;
1171 char *prefix;
1172
1173 for (i = 0; i < opts->num_mnt_opts; i++) {
1174 char *has_comma;
1175
1176 if (opts->mnt_opts[i])
1177 has_comma = strchr(opts->mnt_opts[i], ',');
1178 else
1179 has_comma = NULL;
1180
1181 switch (opts->mnt_opts_flags[i]) {
1182 case CONTEXT_MNT:
1183 prefix = CONTEXT_STR;
1184 break;
1185 case FSCONTEXT_MNT:
1186 prefix = FSCONTEXT_STR;
1187 break;
1188 case ROOTCONTEXT_MNT:
1189 prefix = ROOTCONTEXT_STR;
1190 break;
1191 case DEFCONTEXT_MNT:
1192 prefix = DEFCONTEXT_STR;
1193 break;
1194 case SBLABEL_MNT:
1195 seq_putc(m, ',');
1196 seq_puts(m, LABELSUPP_STR);
1197 continue;
1198 default:
1199 BUG();
1200 return;
1201 };
1202 /* we need a comma before each option */
1203 seq_putc(m, ',');
1204 seq_puts(m, prefix);
1205 if (has_comma)
1206 seq_putc(m, '\"');
1207 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1208 if (has_comma)
1209 seq_putc(m, '\"');
1210 }
1211 }
1212
1213 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1214 {
1215 struct security_mnt_opts opts;
1216 int rc;
1217
1218 rc = selinux_get_mnt_opts(sb, &opts);
1219 if (rc) {
1220 /* before policy load we may get EINVAL, don't show anything */
1221 if (rc == -EINVAL)
1222 rc = 0;
1223 return rc;
1224 }
1225
1226 selinux_write_opts(m, &opts);
1227
1228 security_free_mnt_opts(&opts);
1229
1230 return rc;
1231 }
1232
1233 static inline u16 inode_mode_to_security_class(umode_t mode)
1234 {
1235 switch (mode & S_IFMT) {
1236 case S_IFSOCK:
1237 return SECCLASS_SOCK_FILE;
1238 case S_IFLNK:
1239 return SECCLASS_LNK_FILE;
1240 case S_IFREG:
1241 return SECCLASS_FILE;
1242 case S_IFBLK:
1243 return SECCLASS_BLK_FILE;
1244 case S_IFDIR:
1245 return SECCLASS_DIR;
1246 case S_IFCHR:
1247 return SECCLASS_CHR_FILE;
1248 case S_IFIFO:
1249 return SECCLASS_FIFO_FILE;
1250
1251 }
1252
1253 return SECCLASS_FILE;
1254 }
1255
1256 static inline int default_protocol_stream(int protocol)
1257 {
1258 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1259 }
1260
1261 static inline int default_protocol_dgram(int protocol)
1262 {
1263 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1264 }
1265
1266 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1267 {
1268 int extsockclass = selinux_policycap_extsockclass;
1269
1270 switch (family) {
1271 case PF_UNIX:
1272 switch (type) {
1273 case SOCK_STREAM:
1274 case SOCK_SEQPACKET:
1275 return SECCLASS_UNIX_STREAM_SOCKET;
1276 case SOCK_DGRAM:
1277 return SECCLASS_UNIX_DGRAM_SOCKET;
1278 }
1279 break;
1280 case PF_INET:
1281 case PF_INET6:
1282 switch (type) {
1283 case SOCK_STREAM:
1284 case SOCK_SEQPACKET:
1285 if (default_protocol_stream(protocol))
1286 return SECCLASS_TCP_SOCKET;
1287 else if (extsockclass && protocol == IPPROTO_SCTP)
1288 return SECCLASS_SCTP_SOCKET;
1289 else
1290 return SECCLASS_RAWIP_SOCKET;
1291 case SOCK_DGRAM:
1292 if (default_protocol_dgram(protocol))
1293 return SECCLASS_UDP_SOCKET;
1294 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1295 protocol == IPPROTO_ICMPV6))
1296 return SECCLASS_ICMP_SOCKET;
1297 else
1298 return SECCLASS_RAWIP_SOCKET;
1299 case SOCK_DCCP:
1300 return SECCLASS_DCCP_SOCKET;
1301 default:
1302 return SECCLASS_RAWIP_SOCKET;
1303 }
1304 break;
1305 case PF_NETLINK:
1306 switch (protocol) {
1307 case NETLINK_ROUTE:
1308 return SECCLASS_NETLINK_ROUTE_SOCKET;
1309 case NETLINK_SOCK_DIAG:
1310 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1311 case NETLINK_NFLOG:
1312 return SECCLASS_NETLINK_NFLOG_SOCKET;
1313 case NETLINK_XFRM:
1314 return SECCLASS_NETLINK_XFRM_SOCKET;
1315 case NETLINK_SELINUX:
1316 return SECCLASS_NETLINK_SELINUX_SOCKET;
1317 case NETLINK_ISCSI:
1318 return SECCLASS_NETLINK_ISCSI_SOCKET;
1319 case NETLINK_AUDIT:
1320 return SECCLASS_NETLINK_AUDIT_SOCKET;
1321 case NETLINK_FIB_LOOKUP:
1322 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1323 case NETLINK_CONNECTOR:
1324 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1325 case NETLINK_NETFILTER:
1326 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1327 case NETLINK_DNRTMSG:
1328 return SECCLASS_NETLINK_DNRT_SOCKET;
1329 case NETLINK_KOBJECT_UEVENT:
1330 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1331 case NETLINK_GENERIC:
1332 return SECCLASS_NETLINK_GENERIC_SOCKET;
1333 case NETLINK_SCSITRANSPORT:
1334 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1335 case NETLINK_RDMA:
1336 return SECCLASS_NETLINK_RDMA_SOCKET;
1337 case NETLINK_CRYPTO:
1338 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1339 default:
1340 return SECCLASS_NETLINK_SOCKET;
1341 }
1342 case PF_PACKET:
1343 return SECCLASS_PACKET_SOCKET;
1344 case PF_KEY:
1345 return SECCLASS_KEY_SOCKET;
1346 case PF_APPLETALK:
1347 return SECCLASS_APPLETALK_SOCKET;
1348 }
1349
1350 if (extsockclass) {
1351 switch (family) {
1352 case PF_AX25:
1353 return SECCLASS_AX25_SOCKET;
1354 case PF_IPX:
1355 return SECCLASS_IPX_SOCKET;
1356 case PF_NETROM:
1357 return SECCLASS_NETROM_SOCKET;
1358 case PF_ATMPVC:
1359 return SECCLASS_ATMPVC_SOCKET;
1360 case PF_X25:
1361 return SECCLASS_X25_SOCKET;
1362 case PF_ROSE:
1363 return SECCLASS_ROSE_SOCKET;
1364 case PF_DECnet:
1365 return SECCLASS_DECNET_SOCKET;
1366 case PF_ATMSVC:
1367 return SECCLASS_ATMSVC_SOCKET;
1368 case PF_RDS:
1369 return SECCLASS_RDS_SOCKET;
1370 case PF_IRDA:
1371 return SECCLASS_IRDA_SOCKET;
1372 case PF_PPPOX:
1373 return SECCLASS_PPPOX_SOCKET;
1374 case PF_LLC:
1375 return SECCLASS_LLC_SOCKET;
1376 case PF_CAN:
1377 return SECCLASS_CAN_SOCKET;
1378 case PF_TIPC:
1379 return SECCLASS_TIPC_SOCKET;
1380 case PF_BLUETOOTH:
1381 return SECCLASS_BLUETOOTH_SOCKET;
1382 case PF_IUCV:
1383 return SECCLASS_IUCV_SOCKET;
1384 case PF_RXRPC:
1385 return SECCLASS_RXRPC_SOCKET;
1386 case PF_ISDN:
1387 return SECCLASS_ISDN_SOCKET;
1388 case PF_PHONET:
1389 return SECCLASS_PHONET_SOCKET;
1390 case PF_IEEE802154:
1391 return SECCLASS_IEEE802154_SOCKET;
1392 case PF_CAIF:
1393 return SECCLASS_CAIF_SOCKET;
1394 case PF_ALG:
1395 return SECCLASS_ALG_SOCKET;
1396 case PF_NFC:
1397 return SECCLASS_NFC_SOCKET;
1398 case PF_VSOCK:
1399 return SECCLASS_VSOCK_SOCKET;
1400 case PF_KCM:
1401 return SECCLASS_KCM_SOCKET;
1402 case PF_QIPCRTR:
1403 return SECCLASS_QIPCRTR_SOCKET;
1404 case PF_SMC:
1405 return SECCLASS_SMC_SOCKET;
1406 #if PF_MAX > 44
1407 #error New address family defined, please update this function.
1408 #endif
1409 }
1410 }
1411
1412 return SECCLASS_SOCKET;
1413 }
1414
1415 static int selinux_genfs_get_sid(struct dentry *dentry,
1416 u16 tclass,
1417 u16 flags,
1418 u32 *sid)
1419 {
1420 int rc;
1421 struct super_block *sb = dentry->d_sb;
1422 char *buffer, *path;
1423
1424 buffer = (char *)__get_free_page(GFP_KERNEL);
1425 if (!buffer)
1426 return -ENOMEM;
1427
1428 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1429 if (IS_ERR(path))
1430 rc = PTR_ERR(path);
1431 else {
1432 if (flags & SE_SBPROC) {
1433 /* each process gets a /proc/PID/ entry. Strip off the
1434 * PID part to get a valid selinux labeling.
1435 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1436 while (path[1] >= '0' && path[1] <= '9') {
1437 path[1] = '/';
1438 path++;
1439 }
1440 }
1441 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1442 }
1443 free_page((unsigned long)buffer);
1444 return rc;
1445 }
1446
1447 /* The inode's security attributes must be initialized before first use. */
1448 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1449 {
1450 struct superblock_security_struct *sbsec = NULL;
1451 struct inode_security_struct *isec = inode->i_security;
1452 u32 task_sid, sid = 0;
1453 u16 sclass;
1454 struct dentry *dentry;
1455 #define INITCONTEXTLEN 255
1456 char *context = NULL;
1457 unsigned len = 0;
1458 int rc = 0;
1459
1460 if (isec->initialized == LABEL_INITIALIZED)
1461 return 0;
1462
1463 spin_lock(&isec->lock);
1464 if (isec->initialized == LABEL_INITIALIZED)
1465 goto out_unlock;
1466
1467 if (isec->sclass == SECCLASS_FILE)
1468 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1469
1470 sbsec = inode->i_sb->s_security;
1471 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1472 /* Defer initialization until selinux_complete_init,
1473 after the initial policy is loaded and the security
1474 server is ready to handle calls. */
1475 spin_lock(&sbsec->isec_lock);
1476 if (list_empty(&isec->list))
1477 list_add(&isec->list, &sbsec->isec_head);
1478 spin_unlock(&sbsec->isec_lock);
1479 goto out_unlock;
1480 }
1481
1482 sclass = isec->sclass;
1483 task_sid = isec->task_sid;
1484 sid = isec->sid;
1485 isec->initialized = LABEL_PENDING;
1486 spin_unlock(&isec->lock);
1487
1488 switch (sbsec->behavior) {
1489 case SECURITY_FS_USE_NATIVE:
1490 break;
1491 case SECURITY_FS_USE_XATTR:
1492 if (!(inode->i_opflags & IOP_XATTR)) {
1493 sid = sbsec->def_sid;
1494 break;
1495 }
1496 /* Need a dentry, since the xattr API requires one.
1497 Life would be simpler if we could just pass the inode. */
1498 if (opt_dentry) {
1499 /* Called from d_instantiate or d_splice_alias. */
1500 dentry = dget(opt_dentry);
1501 } else {
1502 /* Called from selinux_complete_init, try to find a dentry. */
1503 dentry = d_find_alias(inode);
1504 }
1505 if (!dentry) {
1506 /*
1507 * this is can be hit on boot when a file is accessed
1508 * before the policy is loaded. When we load policy we
1509 * may find inodes that have no dentry on the
1510 * sbsec->isec_head list. No reason to complain as these
1511 * will get fixed up the next time we go through
1512 * inode_doinit with a dentry, before these inodes could
1513 * be used again by userspace.
1514 */
1515 goto out;
1516 }
1517
1518 len = INITCONTEXTLEN;
1519 context = kmalloc(len+1, GFP_NOFS);
1520 if (!context) {
1521 rc = -ENOMEM;
1522 dput(dentry);
1523 goto out;
1524 }
1525 context[len] = '\0';
1526 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1527 if (rc == -ERANGE) {
1528 kfree(context);
1529
1530 /* Need a larger buffer. Query for the right size. */
1531 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1532 if (rc < 0) {
1533 dput(dentry);
1534 goto out;
1535 }
1536 len = rc;
1537 context = kmalloc(len+1, GFP_NOFS);
1538 if (!context) {
1539 rc = -ENOMEM;
1540 dput(dentry);
1541 goto out;
1542 }
1543 context[len] = '\0';
1544 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1545 }
1546 dput(dentry);
1547 if (rc < 0) {
1548 if (rc != -ENODATA) {
1549 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1550 "%d for dev=%s ino=%ld\n", __func__,
1551 -rc, inode->i_sb->s_id, inode->i_ino);
1552 kfree(context);
1553 goto out;
1554 }
1555 /* Map ENODATA to the default file SID */
1556 sid = sbsec->def_sid;
1557 rc = 0;
1558 } else {
1559 rc = security_context_to_sid_default(context, rc, &sid,
1560 sbsec->def_sid,
1561 GFP_NOFS);
1562 if (rc) {
1563 char *dev = inode->i_sb->s_id;
1564 unsigned long ino = inode->i_ino;
1565
1566 if (rc == -EINVAL) {
1567 if (printk_ratelimit())
1568 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1569 "context=%s. This indicates you may need to relabel the inode or the "
1570 "filesystem in question.\n", ino, dev, context);
1571 } else {
1572 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1573 "returned %d for dev=%s ino=%ld\n",
1574 __func__, context, -rc, dev, ino);
1575 }
1576 kfree(context);
1577 /* Leave with the unlabeled SID */
1578 rc = 0;
1579 break;
1580 }
1581 }
1582 kfree(context);
1583 break;
1584 case SECURITY_FS_USE_TASK:
1585 sid = task_sid;
1586 break;
1587 case SECURITY_FS_USE_TRANS:
1588 /* Default to the fs SID. */
1589 sid = sbsec->sid;
1590
1591 /* Try to obtain a transition SID. */
1592 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1593 if (rc)
1594 goto out;
1595 break;
1596 case SECURITY_FS_USE_MNTPOINT:
1597 sid = sbsec->mntpoint_sid;
1598 break;
1599 default:
1600 /* Default to the fs superblock SID. */
1601 sid = sbsec->sid;
1602
1603 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1604 /* We must have a dentry to determine the label on
1605 * procfs inodes */
1606 if (opt_dentry)
1607 /* Called from d_instantiate or
1608 * d_splice_alias. */
1609 dentry = dget(opt_dentry);
1610 else
1611 /* Called from selinux_complete_init, try to
1612 * find a dentry. */
1613 dentry = d_find_alias(inode);
1614 /*
1615 * This can be hit on boot when a file is accessed
1616 * before the policy is loaded. When we load policy we
1617 * may find inodes that have no dentry on the
1618 * sbsec->isec_head list. No reason to complain as
1619 * these will get fixed up the next time we go through
1620 * inode_doinit() with a dentry, before these inodes
1621 * could be used again by userspace.
1622 */
1623 if (!dentry)
1624 goto out;
1625 rc = selinux_genfs_get_sid(dentry, sclass,
1626 sbsec->flags, &sid);
1627 dput(dentry);
1628 if (rc)
1629 goto out;
1630 }
1631 break;
1632 }
1633
1634 out:
1635 spin_lock(&isec->lock);
1636 if (isec->initialized == LABEL_PENDING) {
1637 if (!sid || rc) {
1638 isec->initialized = LABEL_INVALID;
1639 goto out_unlock;
1640 }
1641
1642 isec->initialized = LABEL_INITIALIZED;
1643 isec->sid = sid;
1644 }
1645
1646 out_unlock:
1647 spin_unlock(&isec->lock);
1648 return rc;
1649 }
1650
1651 /* Convert a Linux signal to an access vector. */
1652 static inline u32 signal_to_av(int sig)
1653 {
1654 u32 perm = 0;
1655
1656 switch (sig) {
1657 case SIGCHLD:
1658 /* Commonly granted from child to parent. */
1659 perm = PROCESS__SIGCHLD;
1660 break;
1661 case SIGKILL:
1662 /* Cannot be caught or ignored */
1663 perm = PROCESS__SIGKILL;
1664 break;
1665 case SIGSTOP:
1666 /* Cannot be caught or ignored */
1667 perm = PROCESS__SIGSTOP;
1668 break;
1669 default:
1670 /* All other signals. */
1671 perm = PROCESS__SIGNAL;
1672 break;
1673 }
1674
1675 return perm;
1676 }
1677
1678 #if CAP_LAST_CAP > 63
1679 #error Fix SELinux to handle capabilities > 63.
1680 #endif
1681
1682 /* Check whether a task is allowed to use a capability. */
1683 static int cred_has_capability(const struct cred *cred,
1684 int cap, int audit, bool initns)
1685 {
1686 struct common_audit_data ad;
1687 struct av_decision avd;
1688 u16 sclass;
1689 u32 sid = cred_sid(cred);
1690 u32 av = CAP_TO_MASK(cap);
1691 int rc;
1692
1693 ad.type = LSM_AUDIT_DATA_CAP;
1694 ad.u.cap = cap;
1695
1696 switch (CAP_TO_INDEX(cap)) {
1697 case 0:
1698 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1699 break;
1700 case 1:
1701 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1702 break;
1703 default:
1704 printk(KERN_ERR
1705 "SELinux: out of range capability %d\n", cap);
1706 BUG();
1707 return -EINVAL;
1708 }
1709
1710 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1711 if (audit == SECURITY_CAP_AUDIT) {
1712 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1713 if (rc2)
1714 return rc2;
1715 }
1716 return rc;
1717 }
1718
1719 /* Check whether a task has a particular permission to an inode.
1720 The 'adp' parameter is optional and allows other audit
1721 data to be passed (e.g. the dentry). */
1722 static int inode_has_perm(const struct cred *cred,
1723 struct inode *inode,
1724 u32 perms,
1725 struct common_audit_data *adp)
1726 {
1727 struct inode_security_struct *isec;
1728 u32 sid;
1729
1730 validate_creds(cred);
1731
1732 if (unlikely(IS_PRIVATE(inode)))
1733 return 0;
1734
1735 sid = cred_sid(cred);
1736 isec = inode->i_security;
1737
1738 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1739 }
1740
1741 /* Same as inode_has_perm, but pass explicit audit data containing
1742 the dentry to help the auditing code to more easily generate the
1743 pathname if needed. */
1744 static inline int dentry_has_perm(const struct cred *cred,
1745 struct dentry *dentry,
1746 u32 av)
1747 {
1748 struct inode *inode = d_backing_inode(dentry);
1749 struct common_audit_data ad;
1750
1751 ad.type = LSM_AUDIT_DATA_DENTRY;
1752 ad.u.dentry = dentry;
1753 __inode_security_revalidate(inode, dentry, true);
1754 return inode_has_perm(cred, inode, av, &ad);
1755 }
1756
1757 /* Same as inode_has_perm, but pass explicit audit data containing
1758 the path to help the auditing code to more easily generate the
1759 pathname if needed. */
1760 static inline int path_has_perm(const struct cred *cred,
1761 const struct path *path,
1762 u32 av)
1763 {
1764 struct inode *inode = d_backing_inode(path->dentry);
1765 struct common_audit_data ad;
1766
1767 ad.type = LSM_AUDIT_DATA_PATH;
1768 ad.u.path = *path;
1769 __inode_security_revalidate(inode, path->dentry, true);
1770 return inode_has_perm(cred, inode, av, &ad);
1771 }
1772
1773 /* Same as path_has_perm, but uses the inode from the file struct. */
1774 static inline int file_path_has_perm(const struct cred *cred,
1775 struct file *file,
1776 u32 av)
1777 {
1778 struct common_audit_data ad;
1779
1780 ad.type = LSM_AUDIT_DATA_FILE;
1781 ad.u.file = file;
1782 return inode_has_perm(cred, file_inode(file), av, &ad);
1783 }
1784
1785 /* Check whether a task can use an open file descriptor to
1786 access an inode in a given way. Check access to the
1787 descriptor itself, and then use dentry_has_perm to
1788 check a particular permission to the file.
1789 Access to the descriptor is implicitly granted if it
1790 has the same SID as the process. If av is zero, then
1791 access to the file is not checked, e.g. for cases
1792 where only the descriptor is affected like seek. */
1793 static int file_has_perm(const struct cred *cred,
1794 struct file *file,
1795 u32 av)
1796 {
1797 struct file_security_struct *fsec = file->f_security;
1798 struct inode *inode = file_inode(file);
1799 struct common_audit_data ad;
1800 u32 sid = cred_sid(cred);
1801 int rc;
1802
1803 ad.type = LSM_AUDIT_DATA_FILE;
1804 ad.u.file = file;
1805
1806 if (sid != fsec->sid) {
1807 rc = avc_has_perm(sid, fsec->sid,
1808 SECCLASS_FD,
1809 FD__USE,
1810 &ad);
1811 if (rc)
1812 goto out;
1813 }
1814
1815 /* av is zero if only checking access to the descriptor. */
1816 rc = 0;
1817 if (av)
1818 rc = inode_has_perm(cred, inode, av, &ad);
1819
1820 out:
1821 return rc;
1822 }
1823
1824 /*
1825 * Determine the label for an inode that might be unioned.
1826 */
1827 static int
1828 selinux_determine_inode_label(const struct task_security_struct *tsec,
1829 struct inode *dir,
1830 const struct qstr *name, u16 tclass,
1831 u32 *_new_isid)
1832 {
1833 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1834
1835 if ((sbsec->flags & SE_SBINITIALIZED) &&
1836 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1837 *_new_isid = sbsec->mntpoint_sid;
1838 } else if ((sbsec->flags & SBLABEL_MNT) &&
1839 tsec->create_sid) {
1840 *_new_isid = tsec->create_sid;
1841 } else {
1842 const struct inode_security_struct *dsec = inode_security(dir);
1843 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1844 name, _new_isid);
1845 }
1846
1847 return 0;
1848 }
1849
1850 /* Check whether a task can create a file. */
1851 static int may_create(struct inode *dir,
1852 struct dentry *dentry,
1853 u16 tclass)
1854 {
1855 const struct task_security_struct *tsec = current_security();
1856 struct inode_security_struct *dsec;
1857 struct superblock_security_struct *sbsec;
1858 u32 sid, newsid;
1859 struct common_audit_data ad;
1860 int rc;
1861
1862 dsec = inode_security(dir);
1863 sbsec = dir->i_sb->s_security;
1864
1865 sid = tsec->sid;
1866
1867 ad.type = LSM_AUDIT_DATA_DENTRY;
1868 ad.u.dentry = dentry;
1869
1870 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1871 DIR__ADD_NAME | DIR__SEARCH,
1872 &ad);
1873 if (rc)
1874 return rc;
1875
1876 rc = selinux_determine_inode_label(current_security(), dir,
1877 &dentry->d_name, tclass, &newsid);
1878 if (rc)
1879 return rc;
1880
1881 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1882 if (rc)
1883 return rc;
1884
1885 return avc_has_perm(newsid, sbsec->sid,
1886 SECCLASS_FILESYSTEM,
1887 FILESYSTEM__ASSOCIATE, &ad);
1888 }
1889
1890 #define MAY_LINK 0
1891 #define MAY_UNLINK 1
1892 #define MAY_RMDIR 2
1893
1894 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1895 static int may_link(struct inode *dir,
1896 struct dentry *dentry,
1897 int kind)
1898
1899 {
1900 struct inode_security_struct *dsec, *isec;
1901 struct common_audit_data ad;
1902 u32 sid = current_sid();
1903 u32 av;
1904 int rc;
1905
1906 dsec = inode_security(dir);
1907 isec = backing_inode_security(dentry);
1908
1909 ad.type = LSM_AUDIT_DATA_DENTRY;
1910 ad.u.dentry = dentry;
1911
1912 av = DIR__SEARCH;
1913 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1914 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1915 if (rc)
1916 return rc;
1917
1918 switch (kind) {
1919 case MAY_LINK:
1920 av = FILE__LINK;
1921 break;
1922 case MAY_UNLINK:
1923 av = FILE__UNLINK;
1924 break;
1925 case MAY_RMDIR:
1926 av = DIR__RMDIR;
1927 break;
1928 default:
1929 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1930 __func__, kind);
1931 return 0;
1932 }
1933
1934 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1935 return rc;
1936 }
1937
1938 static inline int may_rename(struct inode *old_dir,
1939 struct dentry *old_dentry,
1940 struct inode *new_dir,
1941 struct dentry *new_dentry)
1942 {
1943 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1944 struct common_audit_data ad;
1945 u32 sid = current_sid();
1946 u32 av;
1947 int old_is_dir, new_is_dir;
1948 int rc;
1949
1950 old_dsec = inode_security(old_dir);
1951 old_isec = backing_inode_security(old_dentry);
1952 old_is_dir = d_is_dir(old_dentry);
1953 new_dsec = inode_security(new_dir);
1954
1955 ad.type = LSM_AUDIT_DATA_DENTRY;
1956
1957 ad.u.dentry = old_dentry;
1958 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1959 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1960 if (rc)
1961 return rc;
1962 rc = avc_has_perm(sid, old_isec->sid,
1963 old_isec->sclass, FILE__RENAME, &ad);
1964 if (rc)
1965 return rc;
1966 if (old_is_dir && new_dir != old_dir) {
1967 rc = avc_has_perm(sid, old_isec->sid,
1968 old_isec->sclass, DIR__REPARENT, &ad);
1969 if (rc)
1970 return rc;
1971 }
1972
1973 ad.u.dentry = new_dentry;
1974 av = DIR__ADD_NAME | DIR__SEARCH;
1975 if (d_is_positive(new_dentry))
1976 av |= DIR__REMOVE_NAME;
1977 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1978 if (rc)
1979 return rc;
1980 if (d_is_positive(new_dentry)) {
1981 new_isec = backing_inode_security(new_dentry);
1982 new_is_dir = d_is_dir(new_dentry);
1983 rc = avc_has_perm(sid, new_isec->sid,
1984 new_isec->sclass,
1985 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1986 if (rc)
1987 return rc;
1988 }
1989
1990 return 0;
1991 }
1992
1993 /* Check whether a task can perform a filesystem operation. */
1994 static int superblock_has_perm(const struct cred *cred,
1995 struct super_block *sb,
1996 u32 perms,
1997 struct common_audit_data *ad)
1998 {
1999 struct superblock_security_struct *sbsec;
2000 u32 sid = cred_sid(cred);
2001
2002 sbsec = sb->s_security;
2003 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2004 }
2005
2006 /* Convert a Linux mode and permission mask to an access vector. */
2007 static inline u32 file_mask_to_av(int mode, int mask)
2008 {
2009 u32 av = 0;
2010
2011 if (!S_ISDIR(mode)) {
2012 if (mask & MAY_EXEC)
2013 av |= FILE__EXECUTE;
2014 if (mask & MAY_READ)
2015 av |= FILE__READ;
2016
2017 if (mask & MAY_APPEND)
2018 av |= FILE__APPEND;
2019 else if (mask & MAY_WRITE)
2020 av |= FILE__WRITE;
2021
2022 } else {
2023 if (mask & MAY_EXEC)
2024 av |= DIR__SEARCH;
2025 if (mask & MAY_WRITE)
2026 av |= DIR__WRITE;
2027 if (mask & MAY_READ)
2028 av |= DIR__READ;
2029 }
2030
2031 return av;
2032 }
2033
2034 /* Convert a Linux file to an access vector. */
2035 static inline u32 file_to_av(struct file *file)
2036 {
2037 u32 av = 0;
2038
2039 if (file->f_mode & FMODE_READ)
2040 av |= FILE__READ;
2041 if (file->f_mode & FMODE_WRITE) {
2042 if (file->f_flags & O_APPEND)
2043 av |= FILE__APPEND;
2044 else
2045 av |= FILE__WRITE;
2046 }
2047 if (!av) {
2048 /*
2049 * Special file opened with flags 3 for ioctl-only use.
2050 */
2051 av = FILE__IOCTL;
2052 }
2053
2054 return av;
2055 }
2056
2057 /*
2058 * Convert a file to an access vector and include the correct open
2059 * open permission.
2060 */
2061 static inline u32 open_file_to_av(struct file *file)
2062 {
2063 u32 av = file_to_av(file);
2064
2065 if (selinux_policycap_openperm)
2066 av |= FILE__OPEN;
2067
2068 return av;
2069 }
2070
2071 /* Hook functions begin here. */
2072
2073 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2074 {
2075 u32 mysid = current_sid();
2076 u32 mgrsid = task_sid(mgr);
2077
2078 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2079 BINDER__SET_CONTEXT_MGR, NULL);
2080 }
2081
2082 static int selinux_binder_transaction(struct task_struct *from,
2083 struct task_struct *to)
2084 {
2085 u32 mysid = current_sid();
2086 u32 fromsid = task_sid(from);
2087 u32 tosid = task_sid(to);
2088 int rc;
2089
2090 if (mysid != fromsid) {
2091 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2092 BINDER__IMPERSONATE, NULL);
2093 if (rc)
2094 return rc;
2095 }
2096
2097 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2098 NULL);
2099 }
2100
2101 static int selinux_binder_transfer_binder(struct task_struct *from,
2102 struct task_struct *to)
2103 {
2104 u32 fromsid = task_sid(from);
2105 u32 tosid = task_sid(to);
2106
2107 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2108 NULL);
2109 }
2110
2111 static int selinux_binder_transfer_file(struct task_struct *from,
2112 struct task_struct *to,
2113 struct file *file)
2114 {
2115 u32 sid = task_sid(to);
2116 struct file_security_struct *fsec = file->f_security;
2117 struct dentry *dentry = file->f_path.dentry;
2118 struct inode_security_struct *isec;
2119 struct common_audit_data ad;
2120 int rc;
2121
2122 ad.type = LSM_AUDIT_DATA_PATH;
2123 ad.u.path = file->f_path;
2124
2125 if (sid != fsec->sid) {
2126 rc = avc_has_perm(sid, fsec->sid,
2127 SECCLASS_FD,
2128 FD__USE,
2129 &ad);
2130 if (rc)
2131 return rc;
2132 }
2133
2134 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135 return 0;
2136
2137 isec = backing_inode_security(dentry);
2138 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2139 &ad);
2140 }
2141
2142 static int selinux_ptrace_access_check(struct task_struct *child,
2143 unsigned int mode)
2144 {
2145 u32 sid = current_sid();
2146 u32 csid = task_sid(child);
2147
2148 if (mode & PTRACE_MODE_READ)
2149 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2150
2151 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2152 }
2153
2154 static int selinux_ptrace_traceme(struct task_struct *parent)
2155 {
2156 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2157 PROCESS__PTRACE, NULL);
2158 }
2159
2160 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2161 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2162 {
2163 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2164 PROCESS__GETCAP, NULL);
2165 }
2166
2167 static int selinux_capset(struct cred *new, const struct cred *old,
2168 const kernel_cap_t *effective,
2169 const kernel_cap_t *inheritable,
2170 const kernel_cap_t *permitted)
2171 {
2172 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2173 PROCESS__SETCAP, NULL);
2174 }
2175
2176 /*
2177 * (This comment used to live with the selinux_task_setuid hook,
2178 * which was removed).
2179 *
2180 * Since setuid only affects the current process, and since the SELinux
2181 * controls are not based on the Linux identity attributes, SELinux does not
2182 * need to control this operation. However, SELinux does control the use of
2183 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2184 */
2185
2186 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2187 int cap, int audit)
2188 {
2189 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2190 }
2191
2192 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2193 {
2194 const struct cred *cred = current_cred();
2195 int rc = 0;
2196
2197 if (!sb)
2198 return 0;
2199
2200 switch (cmds) {
2201 case Q_SYNC:
2202 case Q_QUOTAON:
2203 case Q_QUOTAOFF:
2204 case Q_SETINFO:
2205 case Q_SETQUOTA:
2206 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2207 break;
2208 case Q_GETFMT:
2209 case Q_GETINFO:
2210 case Q_GETQUOTA:
2211 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2212 break;
2213 default:
2214 rc = 0; /* let the kernel handle invalid cmds */
2215 break;
2216 }
2217 return rc;
2218 }
2219
2220 static int selinux_quota_on(struct dentry *dentry)
2221 {
2222 const struct cred *cred = current_cred();
2223
2224 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2225 }
2226
2227 static int selinux_syslog(int type)
2228 {
2229 switch (type) {
2230 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2231 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2232 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2233 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2234 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2235 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2236 /* Set level of messages printed to console */
2237 case SYSLOG_ACTION_CONSOLE_LEVEL:
2238 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2239 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2240 NULL);
2241 }
2242 /* All other syslog types */
2243 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2244 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2245 }
2246
2247 /*
2248 * Check that a process has enough memory to allocate a new virtual
2249 * mapping. 0 means there is enough memory for the allocation to
2250 * succeed and -ENOMEM implies there is not.
2251 *
2252 * Do not audit the selinux permission check, as this is applied to all
2253 * processes that allocate mappings.
2254 */
2255 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2256 {
2257 int rc, cap_sys_admin = 0;
2258
2259 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2260 SECURITY_CAP_NOAUDIT, true);
2261 if (rc == 0)
2262 cap_sys_admin = 1;
2263
2264 return cap_sys_admin;
2265 }
2266
2267 /* binprm security operations */
2268
2269 static u32 ptrace_parent_sid(void)
2270 {
2271 u32 sid = 0;
2272 struct task_struct *tracer;
2273
2274 rcu_read_lock();
2275 tracer = ptrace_parent(current);
2276 if (tracer)
2277 sid = task_sid(tracer);
2278 rcu_read_unlock();
2279
2280 return sid;
2281 }
2282
2283 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2284 const struct task_security_struct *old_tsec,
2285 const struct task_security_struct *new_tsec)
2286 {
2287 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2288 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2289 int rc;
2290
2291 if (!nnp && !nosuid)
2292 return 0; /* neither NNP nor nosuid */
2293
2294 if (new_tsec->sid == old_tsec->sid)
2295 return 0; /* No change in credentials */
2296
2297 /*
2298 * The only transitions we permit under NNP or nosuid
2299 * are transitions to bounded SIDs, i.e. SIDs that are
2300 * guaranteed to only be allowed a subset of the permissions
2301 * of the current SID.
2302 */
2303 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2304 if (rc) {
2305 /*
2306 * On failure, preserve the errno values for NNP vs nosuid.
2307 * NNP: Operation not permitted for caller.
2308 * nosuid: Permission denied to file.
2309 */
2310 if (nnp)
2311 return -EPERM;
2312 else
2313 return -EACCES;
2314 }
2315 return 0;
2316 }
2317
2318 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2319 {
2320 const struct task_security_struct *old_tsec;
2321 struct task_security_struct *new_tsec;
2322 struct inode_security_struct *isec;
2323 struct common_audit_data ad;
2324 struct inode *inode = file_inode(bprm->file);
2325 int rc;
2326
2327 /* SELinux context only depends on initial program or script and not
2328 * the script interpreter */
2329 if (bprm->cred_prepared)
2330 return 0;
2331
2332 old_tsec = current_security();
2333 new_tsec = bprm->cred->security;
2334 isec = inode_security(inode);
2335
2336 /* Default to the current task SID. */
2337 new_tsec->sid = old_tsec->sid;
2338 new_tsec->osid = old_tsec->sid;
2339
2340 /* Reset fs, key, and sock SIDs on execve. */
2341 new_tsec->create_sid = 0;
2342 new_tsec->keycreate_sid = 0;
2343 new_tsec->sockcreate_sid = 0;
2344
2345 if (old_tsec->exec_sid) {
2346 new_tsec->sid = old_tsec->exec_sid;
2347 /* Reset exec SID on execve. */
2348 new_tsec->exec_sid = 0;
2349
2350 /* Fail on NNP or nosuid if not an allowed transition. */
2351 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2352 if (rc)
2353 return rc;
2354 } else {
2355 /* Check for a default transition on this program. */
2356 rc = security_transition_sid(old_tsec->sid, isec->sid,
2357 SECCLASS_PROCESS, NULL,
2358 &new_tsec->sid);
2359 if (rc)
2360 return rc;
2361
2362 /*
2363 * Fallback to old SID on NNP or nosuid if not an allowed
2364 * transition.
2365 */
2366 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2367 if (rc)
2368 new_tsec->sid = old_tsec->sid;
2369 }
2370
2371 ad.type = LSM_AUDIT_DATA_FILE;
2372 ad.u.file = bprm->file;
2373
2374 if (new_tsec->sid == old_tsec->sid) {
2375 rc = avc_has_perm(old_tsec->sid, isec->sid,
2376 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2377 if (rc)
2378 return rc;
2379 } else {
2380 /* Check permissions for the transition. */
2381 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2382 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2383 if (rc)
2384 return rc;
2385
2386 rc = avc_has_perm(new_tsec->sid, isec->sid,
2387 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2388 if (rc)
2389 return rc;
2390
2391 /* Check for shared state */
2392 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2393 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2394 SECCLASS_PROCESS, PROCESS__SHARE,
2395 NULL);
2396 if (rc)
2397 return -EPERM;
2398 }
2399
2400 /* Make sure that anyone attempting to ptrace over a task that
2401 * changes its SID has the appropriate permit */
2402 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2403 u32 ptsid = ptrace_parent_sid();
2404 if (ptsid != 0) {
2405 rc = avc_has_perm(ptsid, new_tsec->sid,
2406 SECCLASS_PROCESS,
2407 PROCESS__PTRACE, NULL);
2408 if (rc)
2409 return -EPERM;
2410 }
2411 }
2412
2413 /* Clear any possibly unsafe personality bits on exec: */
2414 bprm->per_clear |= PER_CLEAR_ON_SETID;
2415 }
2416
2417 return 0;
2418 }
2419
2420 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2421 {
2422 const struct task_security_struct *tsec = current_security();
2423 u32 sid, osid;
2424 int atsecure = 0;
2425
2426 sid = tsec->sid;
2427 osid = tsec->osid;
2428
2429 if (osid != sid) {
2430 /* Enable secure mode for SIDs transitions unless
2431 the noatsecure permission is granted between
2432 the two SIDs, i.e. ahp returns 0. */
2433 atsecure = avc_has_perm(osid, sid,
2434 SECCLASS_PROCESS,
2435 PROCESS__NOATSECURE, NULL);
2436 }
2437
2438 return !!atsecure;
2439 }
2440
2441 static int match_file(const void *p, struct file *file, unsigned fd)
2442 {
2443 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2444 }
2445
2446 /* Derived from fs/exec.c:flush_old_files. */
2447 static inline void flush_unauthorized_files(const struct cred *cred,
2448 struct files_struct *files)
2449 {
2450 struct file *file, *devnull = NULL;
2451 struct tty_struct *tty;
2452 int drop_tty = 0;
2453 unsigned n;
2454
2455 tty = get_current_tty();
2456 if (tty) {
2457 spin_lock(&tty->files_lock);
2458 if (!list_empty(&tty->tty_files)) {
2459 struct tty_file_private *file_priv;
2460
2461 /* Revalidate access to controlling tty.
2462 Use file_path_has_perm on the tty path directly
2463 rather than using file_has_perm, as this particular
2464 open file may belong to another process and we are
2465 only interested in the inode-based check here. */
2466 file_priv = list_first_entry(&tty->tty_files,
2467 struct tty_file_private, list);
2468 file = file_priv->file;
2469 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2470 drop_tty = 1;
2471 }
2472 spin_unlock(&tty->files_lock);
2473 tty_kref_put(tty);
2474 }
2475 /* Reset controlling tty. */
2476 if (drop_tty)
2477 no_tty();
2478
2479 /* Revalidate access to inherited open files. */
2480 n = iterate_fd(files, 0, match_file, cred);
2481 if (!n) /* none found? */
2482 return;
2483
2484 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2485 if (IS_ERR(devnull))
2486 devnull = NULL;
2487 /* replace all the matching ones with this */
2488 do {
2489 replace_fd(n - 1, devnull, 0);
2490 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2491 if (devnull)
2492 fput(devnull);
2493 }
2494
2495 /*
2496 * Prepare a process for imminent new credential changes due to exec
2497 */
2498 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2499 {
2500 struct task_security_struct *new_tsec;
2501 struct rlimit *rlim, *initrlim;
2502 int rc, i;
2503
2504 new_tsec = bprm->cred->security;
2505 if (new_tsec->sid == new_tsec->osid)
2506 return;
2507
2508 /* Close files for which the new task SID is not authorized. */
2509 flush_unauthorized_files(bprm->cred, current->files);
2510
2511 /* Always clear parent death signal on SID transitions. */
2512 current->pdeath_signal = 0;
2513
2514 /* Check whether the new SID can inherit resource limits from the old
2515 * SID. If not, reset all soft limits to the lower of the current
2516 * task's hard limit and the init task's soft limit.
2517 *
2518 * Note that the setting of hard limits (even to lower them) can be
2519 * controlled by the setrlimit check. The inclusion of the init task's
2520 * soft limit into the computation is to avoid resetting soft limits
2521 * higher than the default soft limit for cases where the default is
2522 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2523 */
2524 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2525 PROCESS__RLIMITINH, NULL);
2526 if (rc) {
2527 /* protect against do_prlimit() */
2528 task_lock(current);
2529 for (i = 0; i < RLIM_NLIMITS; i++) {
2530 rlim = current->signal->rlim + i;
2531 initrlim = init_task.signal->rlim + i;
2532 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2533 }
2534 task_unlock(current);
2535 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2536 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2537 }
2538 }
2539
2540 /*
2541 * Clean up the process immediately after the installation of new credentials
2542 * due to exec
2543 */
2544 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2545 {
2546 const struct task_security_struct *tsec = current_security();
2547 struct itimerval itimer;
2548 u32 osid, sid;
2549 int rc, i;
2550
2551 osid = tsec->osid;
2552 sid = tsec->sid;
2553
2554 if (sid == osid)
2555 return;
2556
2557 /* Check whether the new SID can inherit signal state from the old SID.
2558 * If not, clear itimers to avoid subsequent signal generation and
2559 * flush and unblock signals.
2560 *
2561 * This must occur _after_ the task SID has been updated so that any
2562 * kill done after the flush will be checked against the new SID.
2563 */
2564 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2565 if (rc) {
2566 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2567 memset(&itimer, 0, sizeof itimer);
2568 for (i = 0; i < 3; i++)
2569 do_setitimer(i, &itimer, NULL);
2570 }
2571 spin_lock_irq(&current->sighand->siglock);
2572 if (!fatal_signal_pending(current)) {
2573 flush_sigqueue(&current->pending);
2574 flush_sigqueue(&current->signal->shared_pending);
2575 flush_signal_handlers(current, 1);
2576 sigemptyset(&current->blocked);
2577 recalc_sigpending();
2578 }
2579 spin_unlock_irq(&current->sighand->siglock);
2580 }
2581
2582 /* Wake up the parent if it is waiting so that it can recheck
2583 * wait permission to the new task SID. */
2584 read_lock(&tasklist_lock);
2585 __wake_up_parent(current, current->real_parent);
2586 read_unlock(&tasklist_lock);
2587 }
2588
2589 /* superblock security operations */
2590
2591 static int selinux_sb_alloc_security(struct super_block *sb)
2592 {
2593 return superblock_alloc_security(sb);
2594 }
2595
2596 static void selinux_sb_free_security(struct super_block *sb)
2597 {
2598 superblock_free_security(sb);
2599 }
2600
2601 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2602 {
2603 if (plen > olen)
2604 return 0;
2605
2606 return !memcmp(prefix, option, plen);
2607 }
2608
2609 static inline int selinux_option(char *option, int len)
2610 {
2611 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2612 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2613 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2614 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2615 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2616 }
2617
2618 static inline void take_option(char **to, char *from, int *first, int len)
2619 {
2620 if (!*first) {
2621 **to = ',';
2622 *to += 1;
2623 } else
2624 *first = 0;
2625 memcpy(*to, from, len);
2626 *to += len;
2627 }
2628
2629 static inline void take_selinux_option(char **to, char *from, int *first,
2630 int len)
2631 {
2632 int current_size = 0;
2633
2634 if (!*first) {
2635 **to = '|';
2636 *to += 1;
2637 } else
2638 *first = 0;
2639
2640 while (current_size < len) {
2641 if (*from != '"') {
2642 **to = *from;
2643 *to += 1;
2644 }
2645 from += 1;
2646 current_size += 1;
2647 }
2648 }
2649
2650 static int selinux_sb_copy_data(char *orig, char *copy)
2651 {
2652 int fnosec, fsec, rc = 0;
2653 char *in_save, *in_curr, *in_end;
2654 char *sec_curr, *nosec_save, *nosec;
2655 int open_quote = 0;
2656
2657 in_curr = orig;
2658 sec_curr = copy;
2659
2660 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2661 if (!nosec) {
2662 rc = -ENOMEM;
2663 goto out;
2664 }
2665
2666 nosec_save = nosec;
2667 fnosec = fsec = 1;
2668 in_save = in_end = orig;
2669
2670 do {
2671 if (*in_end == '"')
2672 open_quote = !open_quote;
2673 if ((*in_end == ',' && open_quote == 0) ||
2674 *in_end == '\0') {
2675 int len = in_end - in_curr;
2676
2677 if (selinux_option(in_curr, len))
2678 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2679 else
2680 take_option(&nosec, in_curr, &fnosec, len);
2681
2682 in_curr = in_end + 1;
2683 }
2684 } while (*in_end++);
2685
2686 strcpy(in_save, nosec_save);
2687 free_page((unsigned long)nosec_save);
2688 out:
2689 return rc;
2690 }
2691
2692 static int selinux_sb_remount(struct super_block *sb, void *data)
2693 {
2694 int rc, i, *flags;
2695 struct security_mnt_opts opts;
2696 char *secdata, **mount_options;
2697 struct superblock_security_struct *sbsec = sb->s_security;
2698
2699 if (!(sbsec->flags & SE_SBINITIALIZED))
2700 return 0;
2701
2702 if (!data)
2703 return 0;
2704
2705 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2706 return 0;
2707
2708 security_init_mnt_opts(&opts);
2709 secdata = alloc_secdata();
2710 if (!secdata)
2711 return -ENOMEM;
2712 rc = selinux_sb_copy_data(data, secdata);
2713 if (rc)
2714 goto out_free_secdata;
2715
2716 rc = selinux_parse_opts_str(secdata, &opts);
2717 if (rc)
2718 goto out_free_secdata;
2719
2720 mount_options = opts.mnt_opts;
2721 flags = opts.mnt_opts_flags;
2722
2723 for (i = 0; i < opts.num_mnt_opts; i++) {
2724 u32 sid;
2725
2726 if (flags[i] == SBLABEL_MNT)
2727 continue;
2728 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2729 if (rc) {
2730 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2731 "(%s) failed for (dev %s, type %s) errno=%d\n",
2732 mount_options[i], sb->s_id, sb->s_type->name, rc);
2733 goto out_free_opts;
2734 }
2735 rc = -EINVAL;
2736 switch (flags[i]) {
2737 case FSCONTEXT_MNT:
2738 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2739 goto out_bad_option;
2740 break;
2741 case CONTEXT_MNT:
2742 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2743 goto out_bad_option;
2744 break;
2745 case ROOTCONTEXT_MNT: {
2746 struct inode_security_struct *root_isec;
2747 root_isec = backing_inode_security(sb->s_root);
2748
2749 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2750 goto out_bad_option;
2751 break;
2752 }
2753 case DEFCONTEXT_MNT:
2754 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2755 goto out_bad_option;
2756 break;
2757 default:
2758 goto out_free_opts;
2759 }
2760 }
2761
2762 rc = 0;
2763 out_free_opts:
2764 security_free_mnt_opts(&opts);
2765 out_free_secdata:
2766 free_secdata(secdata);
2767 return rc;
2768 out_bad_option:
2769 printk(KERN_WARNING "SELinux: unable to change security options "
2770 "during remount (dev %s, type=%s)\n", sb->s_id,
2771 sb->s_type->name);
2772 goto out_free_opts;
2773 }
2774
2775 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2776 {
2777 const struct cred *cred = current_cred();
2778 struct common_audit_data ad;
2779 int rc;
2780
2781 rc = superblock_doinit(sb, data);
2782 if (rc)
2783 return rc;
2784
2785 /* Allow all mounts performed by the kernel */
2786 if (flags & MS_KERNMOUNT)
2787 return 0;
2788
2789 ad.type = LSM_AUDIT_DATA_DENTRY;
2790 ad.u.dentry = sb->s_root;
2791 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2792 }
2793
2794 static int selinux_sb_statfs(struct dentry *dentry)
2795 {
2796 const struct cred *cred = current_cred();
2797 struct common_audit_data ad;
2798
2799 ad.type = LSM_AUDIT_DATA_DENTRY;
2800 ad.u.dentry = dentry->d_sb->s_root;
2801 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2802 }
2803
2804 static int selinux_mount(const char *dev_name,
2805 const struct path *path,
2806 const char *type,
2807 unsigned long flags,
2808 void *data)
2809 {
2810 const struct cred *cred = current_cred();
2811
2812 if (flags & MS_REMOUNT)
2813 return superblock_has_perm(cred, path->dentry->d_sb,
2814 FILESYSTEM__REMOUNT, NULL);
2815 else
2816 return path_has_perm(cred, path, FILE__MOUNTON);
2817 }
2818
2819 static int selinux_umount(struct vfsmount *mnt, int flags)
2820 {
2821 const struct cred *cred = current_cred();
2822
2823 return superblock_has_perm(cred, mnt->mnt_sb,
2824 FILESYSTEM__UNMOUNT, NULL);
2825 }
2826
2827 /* inode security operations */
2828
2829 static int selinux_inode_alloc_security(struct inode *inode)
2830 {
2831 return inode_alloc_security(inode);
2832 }
2833
2834 static void selinux_inode_free_security(struct inode *inode)
2835 {
2836 inode_free_security(inode);
2837 }
2838
2839 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2840 const struct qstr *name, void **ctx,
2841 u32 *ctxlen)
2842 {
2843 u32 newsid;
2844 int rc;
2845
2846 rc = selinux_determine_inode_label(current_security(),
2847 d_inode(dentry->d_parent), name,
2848 inode_mode_to_security_class(mode),
2849 &newsid);
2850 if (rc)
2851 return rc;
2852
2853 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2854 }
2855
2856 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2857 struct qstr *name,
2858 const struct cred *old,
2859 struct cred *new)
2860 {
2861 u32 newsid;
2862 int rc;
2863 struct task_security_struct *tsec;
2864
2865 rc = selinux_determine_inode_label(old->security,
2866 d_inode(dentry->d_parent), name,
2867 inode_mode_to_security_class(mode),
2868 &newsid);
2869 if (rc)
2870 return rc;
2871
2872 tsec = new->security;
2873 tsec->create_sid = newsid;
2874 return 0;
2875 }
2876
2877 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2878 const struct qstr *qstr,
2879 const char **name,
2880 void **value, size_t *len)
2881 {
2882 const struct task_security_struct *tsec = current_security();
2883 struct superblock_security_struct *sbsec;
2884 u32 sid, newsid, clen;
2885 int rc;
2886 char *context;
2887
2888 sbsec = dir->i_sb->s_security;
2889
2890 sid = tsec->sid;
2891 newsid = tsec->create_sid;
2892
2893 rc = selinux_determine_inode_label(current_security(),
2894 dir, qstr,
2895 inode_mode_to_security_class(inode->i_mode),
2896 &newsid);
2897 if (rc)
2898 return rc;
2899
2900 /* Possibly defer initialization to selinux_complete_init. */
2901 if (sbsec->flags & SE_SBINITIALIZED) {
2902 struct inode_security_struct *isec = inode->i_security;
2903 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2904 isec->sid = newsid;
2905 isec->initialized = LABEL_INITIALIZED;
2906 }
2907
2908 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2909 return -EOPNOTSUPP;
2910
2911 if (name)
2912 *name = XATTR_SELINUX_SUFFIX;
2913
2914 if (value && len) {
2915 rc = security_sid_to_context_force(newsid, &context, &clen);
2916 if (rc)
2917 return rc;
2918 *value = context;
2919 *len = clen;
2920 }
2921
2922 return 0;
2923 }
2924
2925 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2926 {
2927 return may_create(dir, dentry, SECCLASS_FILE);
2928 }
2929
2930 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2931 {
2932 return may_link(dir, old_dentry, MAY_LINK);
2933 }
2934
2935 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2936 {
2937 return may_link(dir, dentry, MAY_UNLINK);
2938 }
2939
2940 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2941 {
2942 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2943 }
2944
2945 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2946 {
2947 return may_create(dir, dentry, SECCLASS_DIR);
2948 }
2949
2950 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2951 {
2952 return may_link(dir, dentry, MAY_RMDIR);
2953 }
2954
2955 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2956 {
2957 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2958 }
2959
2960 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2961 struct inode *new_inode, struct dentry *new_dentry)
2962 {
2963 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2964 }
2965
2966 static int selinux_inode_readlink(struct dentry *dentry)
2967 {
2968 const struct cred *cred = current_cred();
2969
2970 return dentry_has_perm(cred, dentry, FILE__READ);
2971 }
2972
2973 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2974 bool rcu)
2975 {
2976 const struct cred *cred = current_cred();
2977 struct common_audit_data ad;
2978 struct inode_security_struct *isec;
2979 u32 sid;
2980
2981 validate_creds(cred);
2982
2983 ad.type = LSM_AUDIT_DATA_DENTRY;
2984 ad.u.dentry = dentry;
2985 sid = cred_sid(cred);
2986 isec = inode_security_rcu(inode, rcu);
2987 if (IS_ERR(isec))
2988 return PTR_ERR(isec);
2989
2990 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2991 rcu ? MAY_NOT_BLOCK : 0);
2992 }
2993
2994 static noinline int audit_inode_permission(struct inode *inode,
2995 u32 perms, u32 audited, u32 denied,
2996 int result,
2997 unsigned flags)
2998 {
2999 struct common_audit_data ad;
3000 struct inode_security_struct *isec = inode->i_security;
3001 int rc;
3002
3003 ad.type = LSM_AUDIT_DATA_INODE;
3004 ad.u.inode = inode;
3005
3006 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3007 audited, denied, result, &ad, flags);
3008 if (rc)
3009 return rc;
3010 return 0;
3011 }
3012
3013 static int selinux_inode_permission(struct inode *inode, int mask)
3014 {
3015 const struct cred *cred = current_cred();
3016 u32 perms;
3017 bool from_access;
3018 unsigned flags = mask & MAY_NOT_BLOCK;
3019 struct inode_security_struct *isec;
3020 u32 sid;
3021 struct av_decision avd;
3022 int rc, rc2;
3023 u32 audited, denied;
3024
3025 from_access = mask & MAY_ACCESS;
3026 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3027
3028 /* No permission to check. Existence test. */
3029 if (!mask)
3030 return 0;
3031
3032 validate_creds(cred);
3033
3034 if (unlikely(IS_PRIVATE(inode)))
3035 return 0;
3036
3037 perms = file_mask_to_av(inode->i_mode, mask);
3038
3039 sid = cred_sid(cred);
3040 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3041 if (IS_ERR(isec))
3042 return PTR_ERR(isec);
3043
3044 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3045 audited = avc_audit_required(perms, &avd, rc,
3046 from_access ? FILE__AUDIT_ACCESS : 0,
3047 &denied);
3048 if (likely(!audited))
3049 return rc;
3050
3051 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3052 if (rc2)
3053 return rc2;
3054 return rc;
3055 }
3056
3057 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3058 {
3059 const struct cred *cred = current_cred();
3060 unsigned int ia_valid = iattr->ia_valid;
3061 __u32 av = FILE__WRITE;
3062
3063 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3064 if (ia_valid & ATTR_FORCE) {
3065 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3066 ATTR_FORCE);
3067 if (!ia_valid)
3068 return 0;
3069 }
3070
3071 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3072 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3073 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3074
3075 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3076 && !(ia_valid & ATTR_FILE))
3077 av |= FILE__OPEN;
3078
3079 return dentry_has_perm(cred, dentry, av);
3080 }
3081
3082 static int selinux_inode_getattr(const struct path *path)
3083 {
3084 return path_has_perm(current_cred(), path, FILE__GETATTR);
3085 }
3086
3087 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3088 {
3089 const struct cred *cred = current_cred();
3090
3091 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3092 sizeof XATTR_SECURITY_PREFIX - 1)) {
3093 if (!strcmp(name, XATTR_NAME_CAPS)) {
3094 if (!capable(CAP_SETFCAP))
3095 return -EPERM;
3096 } else if (!capable(CAP_SYS_ADMIN)) {
3097 /* A different attribute in the security namespace.
3098 Restrict to administrator. */
3099 return -EPERM;
3100 }
3101 }
3102
3103 /* Not an attribute we recognize, so just check the
3104 ordinary setattr permission. */
3105 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3106 }
3107
3108 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3109 const void *value, size_t size, int flags)
3110 {
3111 struct inode *inode = d_backing_inode(dentry);
3112 struct inode_security_struct *isec;
3113 struct superblock_security_struct *sbsec;
3114 struct common_audit_data ad;
3115 u32 newsid, sid = current_sid();
3116 int rc = 0;
3117
3118 if (strcmp(name, XATTR_NAME_SELINUX))
3119 return selinux_inode_setotherxattr(dentry, name);
3120
3121 sbsec = inode->i_sb->s_security;
3122 if (!(sbsec->flags & SBLABEL_MNT))
3123 return -EOPNOTSUPP;
3124
3125 if (!inode_owner_or_capable(inode))
3126 return -EPERM;
3127
3128 ad.type = LSM_AUDIT_DATA_DENTRY;
3129 ad.u.dentry = dentry;
3130
3131 isec = backing_inode_security(dentry);
3132 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3133 FILE__RELABELFROM, &ad);
3134 if (rc)
3135 return rc;
3136
3137 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3138 if (rc == -EINVAL) {
3139 if (!capable(CAP_MAC_ADMIN)) {
3140 struct audit_buffer *ab;
3141 size_t audit_size;
3142 const char *str;
3143
3144 /* We strip a nul only if it is at the end, otherwise the
3145 * context contains a nul and we should audit that */
3146 if (value) {
3147 str = value;
3148 if (str[size - 1] == '\0')
3149 audit_size = size - 1;
3150 else
3151 audit_size = size;
3152 } else {
3153 str = "";
3154 audit_size = 0;
3155 }
3156 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3157 audit_log_format(ab, "op=setxattr invalid_context=");
3158 audit_log_n_untrustedstring(ab, value, audit_size);
3159 audit_log_end(ab);
3160
3161 return rc;
3162 }
3163 rc = security_context_to_sid_force(value, size, &newsid);
3164 }
3165 if (rc)
3166 return rc;
3167
3168 rc = avc_has_perm(sid, newsid, isec->sclass,
3169 FILE__RELABELTO, &ad);
3170 if (rc)
3171 return rc;
3172
3173 rc = security_validate_transition(isec->sid, newsid, sid,
3174 isec->sclass);
3175 if (rc)
3176 return rc;
3177
3178 return avc_has_perm(newsid,
3179 sbsec->sid,
3180 SECCLASS_FILESYSTEM,
3181 FILESYSTEM__ASSOCIATE,
3182 &ad);
3183 }
3184
3185 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3186 const void *value, size_t size,
3187 int flags)
3188 {
3189 struct inode *inode = d_backing_inode(dentry);
3190 struct inode_security_struct *isec;
3191 u32 newsid;
3192 int rc;
3193
3194 if (strcmp(name, XATTR_NAME_SELINUX)) {
3195 /* Not an attribute we recognize, so nothing to do. */
3196 return;
3197 }
3198
3199 rc = security_context_to_sid_force(value, size, &newsid);
3200 if (rc) {
3201 printk(KERN_ERR "SELinux: unable to map context to SID"
3202 "for (%s, %lu), rc=%d\n",
3203 inode->i_sb->s_id, inode->i_ino, -rc);
3204 return;
3205 }
3206
3207 isec = backing_inode_security(dentry);
3208 spin_lock(&isec->lock);
3209 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3210 isec->sid = newsid;
3211 isec->initialized = LABEL_INITIALIZED;
3212 spin_unlock(&isec->lock);
3213
3214 return;
3215 }
3216
3217 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3218 {
3219 const struct cred *cred = current_cred();
3220
3221 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3222 }
3223
3224 static int selinux_inode_listxattr(struct dentry *dentry)
3225 {
3226 const struct cred *cred = current_cred();
3227
3228 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3229 }
3230
3231 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3232 {
3233 if (strcmp(name, XATTR_NAME_SELINUX))
3234 return selinux_inode_setotherxattr(dentry, name);
3235
3236 /* No one is allowed to remove a SELinux security label.
3237 You can change the label, but all data must be labeled. */
3238 return -EACCES;
3239 }
3240
3241 /*
3242 * Copy the inode security context value to the user.
3243 *
3244 * Permission check is handled by selinux_inode_getxattr hook.
3245 */
3246 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3247 {
3248 u32 size;
3249 int error;
3250 char *context = NULL;
3251 struct inode_security_struct *isec;
3252
3253 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3254 return -EOPNOTSUPP;
3255
3256 /*
3257 * If the caller has CAP_MAC_ADMIN, then get the raw context
3258 * value even if it is not defined by current policy; otherwise,
3259 * use the in-core value under current policy.
3260 * Use the non-auditing forms of the permission checks since
3261 * getxattr may be called by unprivileged processes commonly
3262 * and lack of permission just means that we fall back to the
3263 * in-core context value, not a denial.
3264 */
3265 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3266 SECURITY_CAP_NOAUDIT);
3267 if (!error)
3268 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3269 SECURITY_CAP_NOAUDIT, true);
3270 isec = inode_security(inode);
3271 if (!error)
3272 error = security_sid_to_context_force(isec->sid, &context,
3273 &size);
3274 else
3275 error = security_sid_to_context(isec->sid, &context, &size);
3276 if (error)
3277 return error;
3278 error = size;
3279 if (alloc) {
3280 *buffer = context;
3281 goto out_nofree;
3282 }
3283 kfree(context);
3284 out_nofree:
3285 return error;
3286 }
3287
3288 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3289 const void *value, size_t size, int flags)
3290 {
3291 struct inode_security_struct *isec = inode_security_novalidate(inode);
3292 u32 newsid;
3293 int rc;
3294
3295 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3296 return -EOPNOTSUPP;
3297
3298 if (!value || !size)
3299 return -EACCES;
3300
3301 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3302 if (rc)
3303 return rc;
3304
3305 spin_lock(&isec->lock);
3306 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3307 isec->sid = newsid;
3308 isec->initialized = LABEL_INITIALIZED;
3309 spin_unlock(&isec->lock);
3310 return 0;
3311 }
3312
3313 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3314 {
3315 const int len = sizeof(XATTR_NAME_SELINUX);
3316 if (buffer && len <= buffer_size)
3317 memcpy(buffer, XATTR_NAME_SELINUX, len);
3318 return len;
3319 }
3320
3321 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3322 {
3323 struct inode_security_struct *isec = inode_security_novalidate(inode);
3324 *secid = isec->sid;
3325 }
3326
3327 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3328 {
3329 u32 sid;
3330 struct task_security_struct *tsec;
3331 struct cred *new_creds = *new;
3332
3333 if (new_creds == NULL) {
3334 new_creds = prepare_creds();
3335 if (!new_creds)
3336 return -ENOMEM;
3337 }
3338
3339 tsec = new_creds->security;
3340 /* Get label from overlay inode and set it in create_sid */
3341 selinux_inode_getsecid(d_inode(src), &sid);
3342 tsec->create_sid = sid;
3343 *new = new_creds;
3344 return 0;
3345 }
3346
3347 static int selinux_inode_copy_up_xattr(const char *name)
3348 {
3349 /* The copy_up hook above sets the initial context on an inode, but we
3350 * don't then want to overwrite it by blindly copying all the lower
3351 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3352 */
3353 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3354 return 1; /* Discard */
3355 /*
3356 * Any other attribute apart from SELINUX is not claimed, supported
3357 * by selinux.
3358 */
3359 return -EOPNOTSUPP;
3360 }
3361
3362 /* file security operations */
3363
3364 static int selinux_revalidate_file_permission(struct file *file, int mask)
3365 {
3366 const struct cred *cred = current_cred();
3367 struct inode *inode = file_inode(file);
3368
3369 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3370 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3371 mask |= MAY_APPEND;
3372
3373 return file_has_perm(cred, file,
3374 file_mask_to_av(inode->i_mode, mask));
3375 }
3376
3377 static int selinux_file_permission(struct file *file, int mask)
3378 {
3379 struct inode *inode = file_inode(file);
3380 struct file_security_struct *fsec = file->f_security;
3381 struct inode_security_struct *isec;
3382 u32 sid = current_sid();
3383
3384 if (!mask)
3385 /* No permission to check. Existence test. */
3386 return 0;
3387
3388 isec = inode_security(inode);
3389 if (sid == fsec->sid && fsec->isid == isec->sid &&
3390 fsec->pseqno == avc_policy_seqno())
3391 /* No change since file_open check. */
3392 return 0;
3393
3394 return selinux_revalidate_file_permission(file, mask);
3395 }
3396
3397 static int selinux_file_alloc_security(struct file *file)
3398 {
3399 return file_alloc_security(file);
3400 }
3401
3402 static void selinux_file_free_security(struct file *file)
3403 {
3404 file_free_security(file);
3405 }
3406
3407 /*
3408 * Check whether a task has the ioctl permission and cmd
3409 * operation to an inode.
3410 */
3411 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3412 u32 requested, u16 cmd)
3413 {
3414 struct common_audit_data ad;
3415 struct file_security_struct *fsec = file->f_security;
3416 struct inode *inode = file_inode(file);
3417 struct inode_security_struct *isec;
3418 struct lsm_ioctlop_audit ioctl;
3419 u32 ssid = cred_sid(cred);
3420 int rc;
3421 u8 driver = cmd >> 8;
3422 u8 xperm = cmd & 0xff;
3423
3424 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3425 ad.u.op = &ioctl;
3426 ad.u.op->cmd = cmd;
3427 ad.u.op->path = file->f_path;
3428
3429 if (ssid != fsec->sid) {
3430 rc = avc_has_perm(ssid, fsec->sid,
3431 SECCLASS_FD,
3432 FD__USE,
3433 &ad);
3434 if (rc)
3435 goto out;
3436 }
3437
3438 if (unlikely(IS_PRIVATE(inode)))
3439 return 0;
3440
3441 isec = inode_security(inode);
3442 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3443 requested, driver, xperm, &ad);
3444 out:
3445 return rc;
3446 }
3447
3448 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3449 unsigned long arg)
3450 {
3451 const struct cred *cred = current_cred();
3452 int error = 0;
3453
3454 switch (cmd) {
3455 case FIONREAD:
3456 /* fall through */
3457 case FIBMAP:
3458 /* fall through */
3459 case FIGETBSZ:
3460 /* fall through */
3461 case FS_IOC_GETFLAGS:
3462 /* fall through */
3463 case FS_IOC_GETVERSION:
3464 error = file_has_perm(cred, file, FILE__GETATTR);
3465 break;
3466
3467 case FS_IOC_SETFLAGS:
3468 /* fall through */
3469 case FS_IOC_SETVERSION:
3470 error = file_has_perm(cred, file, FILE__SETATTR);
3471 break;
3472
3473 /* sys_ioctl() checks */
3474 case FIONBIO:
3475 /* fall through */
3476 case FIOASYNC:
3477 error = file_has_perm(cred, file, 0);
3478 break;
3479
3480 case KDSKBENT:
3481 case KDSKBSENT:
3482 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3483 SECURITY_CAP_AUDIT, true);
3484 break;
3485
3486 /* default case assumes that the command will go
3487 * to the file's ioctl() function.
3488 */
3489 default:
3490 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3491 }
3492 return error;
3493 }
3494
3495 static int default_noexec;
3496
3497 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3498 {
3499 const struct cred *cred = current_cred();
3500 u32 sid = cred_sid(cred);
3501 int rc = 0;
3502
3503 if (default_noexec &&
3504 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3505 (!shared && (prot & PROT_WRITE)))) {
3506 /*
3507 * We are making executable an anonymous mapping or a
3508 * private file mapping that will also be writable.
3509 * This has an additional check.
3510 */
3511 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3512 PROCESS__EXECMEM, NULL);
3513 if (rc)
3514 goto error;
3515 }
3516
3517 if (file) {
3518 /* read access is always possible with a mapping */
3519 u32 av = FILE__READ;
3520
3521 /* write access only matters if the mapping is shared */
3522 if (shared && (prot & PROT_WRITE))
3523 av |= FILE__WRITE;
3524
3525 if (prot & PROT_EXEC)
3526 av |= FILE__EXECUTE;
3527
3528 return file_has_perm(cred, file, av);
3529 }
3530
3531 error:
3532 return rc;
3533 }
3534
3535 static int selinux_mmap_addr(unsigned long addr)
3536 {
3537 int rc = 0;
3538
3539 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3540 u32 sid = current_sid();
3541 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3542 MEMPROTECT__MMAP_ZERO, NULL);
3543 }
3544
3545 return rc;
3546 }
3547
3548 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3549 unsigned long prot, unsigned long flags)
3550 {
3551 if (selinux_checkreqprot)
3552 prot = reqprot;
3553
3554 return file_map_prot_check(file, prot,
3555 (flags & MAP_TYPE) == MAP_SHARED);
3556 }
3557
3558 static int selinux_file_mprotect(struct vm_area_struct *vma,
3559 unsigned long reqprot,
3560 unsigned long prot)
3561 {
3562 const struct cred *cred = current_cred();
3563 u32 sid = cred_sid(cred);
3564
3565 if (selinux_checkreqprot)
3566 prot = reqprot;
3567
3568 if (default_noexec &&
3569 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3570 int rc = 0;
3571 if (vma->vm_start >= vma->vm_mm->start_brk &&
3572 vma->vm_end <= vma->vm_mm->brk) {
3573 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3574 PROCESS__EXECHEAP, NULL);
3575 } else if (!vma->vm_file &&
3576 ((vma->vm_start <= vma->vm_mm->start_stack &&
3577 vma->vm_end >= vma->vm_mm->start_stack) ||
3578 vma_is_stack_for_current(vma))) {
3579 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3580 PROCESS__EXECSTACK, NULL);
3581 } else if (vma->vm_file && vma->anon_vma) {
3582 /*
3583 * We are making executable a file mapping that has
3584 * had some COW done. Since pages might have been
3585 * written, check ability to execute the possibly
3586 * modified content. This typically should only
3587 * occur for text relocations.
3588 */
3589 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3590 }
3591 if (rc)
3592 return rc;
3593 }
3594
3595 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3596 }
3597
3598 static int selinux_file_lock(struct file *file, unsigned int cmd)
3599 {
3600 const struct cred *cred = current_cred();
3601
3602 return file_has_perm(cred, file, FILE__LOCK);
3603 }
3604
3605 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3606 unsigned long arg)
3607 {
3608 const struct cred *cred = current_cred();
3609 int err = 0;
3610
3611 switch (cmd) {
3612 case F_SETFL:
3613 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3614 err = file_has_perm(cred, file, FILE__WRITE);
3615 break;
3616 }
3617 /* fall through */
3618 case F_SETOWN:
3619 case F_SETSIG:
3620 case F_GETFL:
3621 case F_GETOWN:
3622 case F_GETSIG:
3623 case F_GETOWNER_UIDS:
3624 /* Just check FD__USE permission */
3625 err = file_has_perm(cred, file, 0);
3626 break;
3627 case F_GETLK:
3628 case F_SETLK:
3629 case F_SETLKW:
3630 case F_OFD_GETLK:
3631 case F_OFD_SETLK:
3632 case F_OFD_SETLKW:
3633 #if BITS_PER_LONG == 32
3634 case F_GETLK64:
3635 case F_SETLK64:
3636 case F_SETLKW64:
3637 #endif
3638 err = file_has_perm(cred, file, FILE__LOCK);
3639 break;
3640 }
3641
3642 return err;
3643 }
3644
3645 static void selinux_file_set_fowner(struct file *file)
3646 {
3647 struct file_security_struct *fsec;
3648
3649 fsec = file->f_security;
3650 fsec->fown_sid = current_sid();
3651 }
3652
3653 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3654 struct fown_struct *fown, int signum)
3655 {
3656 struct file *file;
3657 u32 sid = task_sid(tsk);
3658 u32 perm;
3659 struct file_security_struct *fsec;
3660
3661 /* struct fown_struct is never outside the context of a struct file */
3662 file = container_of(fown, struct file, f_owner);
3663
3664 fsec = file->f_security;
3665
3666 if (!signum)
3667 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3668 else
3669 perm = signal_to_av(signum);
3670
3671 return avc_has_perm(fsec->fown_sid, sid,
3672 SECCLASS_PROCESS, perm, NULL);
3673 }
3674
3675 static int selinux_file_receive(struct file *file)
3676 {
3677 const struct cred *cred = current_cred();
3678
3679 return file_has_perm(cred, file, file_to_av(file));
3680 }
3681
3682 static int selinux_file_open(struct file *file, const struct cred *cred)
3683 {
3684 struct file_security_struct *fsec;
3685 struct inode_security_struct *isec;
3686
3687 fsec = file->f_security;
3688 isec = inode_security(file_inode(file));
3689 /*
3690 * Save inode label and policy sequence number
3691 * at open-time so that selinux_file_permission
3692 * can determine whether revalidation is necessary.
3693 * Task label is already saved in the file security
3694 * struct as its SID.
3695 */
3696 fsec->isid = isec->sid;
3697 fsec->pseqno = avc_policy_seqno();
3698 /*
3699 * Since the inode label or policy seqno may have changed
3700 * between the selinux_inode_permission check and the saving
3701 * of state above, recheck that access is still permitted.
3702 * Otherwise, access might never be revalidated against the
3703 * new inode label or new policy.
3704 * This check is not redundant - do not remove.
3705 */
3706 return file_path_has_perm(cred, file, open_file_to_av(file));
3707 }
3708
3709 /* task security operations */
3710
3711 static int selinux_task_create(unsigned long clone_flags)
3712 {
3713 u32 sid = current_sid();
3714
3715 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3716 }
3717
3718 /*
3719 * allocate the SELinux part of blank credentials
3720 */
3721 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3722 {
3723 struct task_security_struct *tsec;
3724
3725 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3726 if (!tsec)
3727 return -ENOMEM;
3728
3729 cred->security = tsec;
3730 return 0;
3731 }
3732
3733 /*
3734 * detach and free the LSM part of a set of credentials
3735 */
3736 static void selinux_cred_free(struct cred *cred)
3737 {
3738 struct task_security_struct *tsec = cred->security;
3739
3740 /*
3741 * cred->security == NULL if security_cred_alloc_blank() or
3742 * security_prepare_creds() returned an error.
3743 */
3744 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3745 cred->security = (void *) 0x7UL;
3746 kfree(tsec);
3747 }
3748
3749 /*
3750 * prepare a new set of credentials for modification
3751 */
3752 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3753 gfp_t gfp)
3754 {
3755 const struct task_security_struct *old_tsec;
3756 struct task_security_struct *tsec;
3757
3758 old_tsec = old->security;
3759
3760 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3761 if (!tsec)
3762 return -ENOMEM;
3763
3764 new->security = tsec;
3765 return 0;
3766 }
3767
3768 /*
3769 * transfer the SELinux data to a blank set of creds
3770 */
3771 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3772 {
3773 const struct task_security_struct *old_tsec = old->security;
3774 struct task_security_struct *tsec = new->security;
3775
3776 *tsec = *old_tsec;
3777 }
3778
3779 /*
3780 * set the security data for a kernel service
3781 * - all the creation contexts are set to unlabelled
3782 */
3783 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3784 {
3785 struct task_security_struct *tsec = new->security;
3786 u32 sid = current_sid();
3787 int ret;
3788
3789 ret = avc_has_perm(sid, secid,
3790 SECCLASS_KERNEL_SERVICE,
3791 KERNEL_SERVICE__USE_AS_OVERRIDE,
3792 NULL);
3793 if (ret == 0) {
3794 tsec->sid = secid;
3795 tsec->create_sid = 0;
3796 tsec->keycreate_sid = 0;
3797 tsec->sockcreate_sid = 0;
3798 }
3799 return ret;
3800 }
3801
3802 /*
3803 * set the file creation context in a security record to the same as the
3804 * objective context of the specified inode
3805 */
3806 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3807 {
3808 struct inode_security_struct *isec = inode_security(inode);
3809 struct task_security_struct *tsec = new->security;
3810 u32 sid = current_sid();
3811 int ret;
3812
3813 ret = avc_has_perm(sid, isec->sid,
3814 SECCLASS_KERNEL_SERVICE,
3815 KERNEL_SERVICE__CREATE_FILES_AS,
3816 NULL);
3817
3818 if (ret == 0)
3819 tsec->create_sid = isec->sid;
3820 return ret;
3821 }
3822
3823 static int selinux_kernel_module_request(char *kmod_name)
3824 {
3825 struct common_audit_data ad;
3826
3827 ad.type = LSM_AUDIT_DATA_KMOD;
3828 ad.u.kmod_name = kmod_name;
3829
3830 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3831 SYSTEM__MODULE_REQUEST, &ad);
3832 }
3833
3834 static int selinux_kernel_module_from_file(struct file *file)
3835 {
3836 struct common_audit_data ad;
3837 struct inode_security_struct *isec;
3838 struct file_security_struct *fsec;
3839 u32 sid = current_sid();
3840 int rc;
3841
3842 /* init_module */
3843 if (file == NULL)
3844 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3845 SYSTEM__MODULE_LOAD, NULL);
3846
3847 /* finit_module */
3848
3849 ad.type = LSM_AUDIT_DATA_FILE;
3850 ad.u.file = file;
3851
3852 fsec = file->f_security;
3853 if (sid != fsec->sid) {
3854 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3855 if (rc)
3856 return rc;
3857 }
3858
3859 isec = inode_security(file_inode(file));
3860 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3861 SYSTEM__MODULE_LOAD, &ad);
3862 }
3863
3864 static int selinux_kernel_read_file(struct file *file,
3865 enum kernel_read_file_id id)
3866 {
3867 int rc = 0;
3868
3869 switch (id) {
3870 case READING_MODULE:
3871 rc = selinux_kernel_module_from_file(file);
3872 break;
3873 default:
3874 break;
3875 }
3876
3877 return rc;
3878 }
3879
3880 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3881 {
3882 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3883 PROCESS__SETPGID, NULL);
3884 }
3885
3886 static int selinux_task_getpgid(struct task_struct *p)
3887 {
3888 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3889 PROCESS__GETPGID, NULL);
3890 }
3891
3892 static int selinux_task_getsid(struct task_struct *p)
3893 {
3894 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3895 PROCESS__GETSESSION, NULL);
3896 }
3897
3898 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3899 {
3900 *secid = task_sid(p);
3901 }
3902
3903 static int selinux_task_setnice(struct task_struct *p, int nice)
3904 {
3905 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3906 PROCESS__SETSCHED, NULL);
3907 }
3908
3909 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3910 {
3911 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3912 PROCESS__SETSCHED, NULL);
3913 }
3914
3915 static int selinux_task_getioprio(struct task_struct *p)
3916 {
3917 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3918 PROCESS__GETSCHED, NULL);
3919 }
3920
3921 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3922 struct rlimit *new_rlim)
3923 {
3924 struct rlimit *old_rlim = p->signal->rlim + resource;
3925
3926 /* Control the ability to change the hard limit (whether
3927 lowering or raising it), so that the hard limit can
3928 later be used as a safe reset point for the soft limit
3929 upon context transitions. See selinux_bprm_committing_creds. */
3930 if (old_rlim->rlim_max != new_rlim->rlim_max)
3931 return avc_has_perm(current_sid(), task_sid(p),
3932 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3933
3934 return 0;
3935 }
3936
3937 static int selinux_task_setscheduler(struct task_struct *p)
3938 {
3939 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3940 PROCESS__SETSCHED, NULL);
3941 }
3942
3943 static int selinux_task_getscheduler(struct task_struct *p)
3944 {
3945 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3946 PROCESS__GETSCHED, NULL);
3947 }
3948
3949 static int selinux_task_movememory(struct task_struct *p)
3950 {
3951 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3952 PROCESS__SETSCHED, NULL);
3953 }
3954
3955 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3956 int sig, u32 secid)
3957 {
3958 u32 perm;
3959
3960 if (!sig)
3961 perm = PROCESS__SIGNULL; /* null signal; existence test */
3962 else
3963 perm = signal_to_av(sig);
3964 if (!secid)
3965 secid = current_sid();
3966 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3967 }
3968
3969 static void selinux_task_to_inode(struct task_struct *p,
3970 struct inode *inode)
3971 {
3972 struct inode_security_struct *isec = inode->i_security;
3973 u32 sid = task_sid(p);
3974
3975 spin_lock(&isec->lock);
3976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3977 isec->sid = sid;
3978 isec->initialized = LABEL_INITIALIZED;
3979 spin_unlock(&isec->lock);
3980 }
3981
3982 /* Returns error only if unable to parse addresses */
3983 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3984 struct common_audit_data *ad, u8 *proto)
3985 {
3986 int offset, ihlen, ret = -EINVAL;
3987 struct iphdr _iph, *ih;
3988
3989 offset = skb_network_offset(skb);
3990 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3991 if (ih == NULL)
3992 goto out;
3993
3994 ihlen = ih->ihl * 4;
3995 if (ihlen < sizeof(_iph))
3996 goto out;
3997
3998 ad->u.net->v4info.saddr = ih->saddr;
3999 ad->u.net->v4info.daddr = ih->daddr;
4000 ret = 0;
4001
4002 if (proto)
4003 *proto = ih->protocol;
4004
4005 switch (ih->protocol) {
4006 case IPPROTO_TCP: {
4007 struct tcphdr _tcph, *th;
4008
4009 if (ntohs(ih->frag_off) & IP_OFFSET)
4010 break;
4011
4012 offset += ihlen;
4013 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4014 if (th == NULL)
4015 break;
4016
4017 ad->u.net->sport = th->source;
4018 ad->u.net->dport = th->dest;
4019 break;
4020 }
4021
4022 case IPPROTO_UDP: {
4023 struct udphdr _udph, *uh;
4024
4025 if (ntohs(ih->frag_off) & IP_OFFSET)
4026 break;
4027
4028 offset += ihlen;
4029 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4030 if (uh == NULL)
4031 break;
4032
4033 ad->u.net->sport = uh->source;
4034 ad->u.net->dport = uh->dest;
4035 break;
4036 }
4037
4038 case IPPROTO_DCCP: {
4039 struct dccp_hdr _dccph, *dh;
4040
4041 if (ntohs(ih->frag_off) & IP_OFFSET)
4042 break;
4043
4044 offset += ihlen;
4045 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4046 if (dh == NULL)
4047 break;
4048
4049 ad->u.net->sport = dh->dccph_sport;
4050 ad->u.net->dport = dh->dccph_dport;
4051 break;
4052 }
4053
4054 default:
4055 break;
4056 }
4057 out:
4058 return ret;
4059 }
4060
4061 #if IS_ENABLED(CONFIG_IPV6)
4062
4063 /* Returns error only if unable to parse addresses */
4064 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4065 struct common_audit_data *ad, u8 *proto)
4066 {
4067 u8 nexthdr;
4068 int ret = -EINVAL, offset;
4069 struct ipv6hdr _ipv6h, *ip6;
4070 __be16 frag_off;
4071
4072 offset = skb_network_offset(skb);
4073 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4074 if (ip6 == NULL)
4075 goto out;
4076
4077 ad->u.net->v6info.saddr = ip6->saddr;
4078 ad->u.net->v6info.daddr = ip6->daddr;
4079 ret = 0;
4080
4081 nexthdr = ip6->nexthdr;
4082 offset += sizeof(_ipv6h);
4083 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4084 if (offset < 0)
4085 goto out;
4086
4087 if (proto)
4088 *proto = nexthdr;
4089
4090 switch (nexthdr) {
4091 case IPPROTO_TCP: {
4092 struct tcphdr _tcph, *th;
4093
4094 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4095 if (th == NULL)
4096 break;
4097
4098 ad->u.net->sport = th->source;
4099 ad->u.net->dport = th->dest;
4100 break;
4101 }
4102
4103 case IPPROTO_UDP: {
4104 struct udphdr _udph, *uh;
4105
4106 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4107 if (uh == NULL)
4108 break;
4109
4110 ad->u.net->sport = uh->source;
4111 ad->u.net->dport = uh->dest;
4112 break;
4113 }
4114
4115 case IPPROTO_DCCP: {
4116 struct dccp_hdr _dccph, *dh;
4117
4118 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4119 if (dh == NULL)
4120 break;
4121
4122 ad->u.net->sport = dh->dccph_sport;
4123 ad->u.net->dport = dh->dccph_dport;
4124 break;
4125 }
4126
4127 /* includes fragments */
4128 default:
4129 break;
4130 }
4131 out:
4132 return ret;
4133 }
4134
4135 #endif /* IPV6 */
4136
4137 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4138 char **_addrp, int src, u8 *proto)
4139 {
4140 char *addrp;
4141 int ret;
4142
4143 switch (ad->u.net->family) {
4144 case PF_INET:
4145 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4146 if (ret)
4147 goto parse_error;
4148 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4149 &ad->u.net->v4info.daddr);
4150 goto okay;
4151
4152 #if IS_ENABLED(CONFIG_IPV6)
4153 case PF_INET6:
4154 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4155 if (ret)
4156 goto parse_error;
4157 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4158 &ad->u.net->v6info.daddr);
4159 goto okay;
4160 #endif /* IPV6 */
4161 default:
4162 addrp = NULL;
4163 goto okay;
4164 }
4165
4166 parse_error:
4167 printk(KERN_WARNING
4168 "SELinux: failure in selinux_parse_skb(),"
4169 " unable to parse packet\n");
4170 return ret;
4171
4172 okay:
4173 if (_addrp)
4174 *_addrp = addrp;
4175 return 0;
4176 }
4177
4178 /**
4179 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4180 * @skb: the packet
4181 * @family: protocol family
4182 * @sid: the packet's peer label SID
4183 *
4184 * Description:
4185 * Check the various different forms of network peer labeling and determine
4186 * the peer label/SID for the packet; most of the magic actually occurs in
4187 * the security server function security_net_peersid_cmp(). The function
4188 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4189 * or -EACCES if @sid is invalid due to inconsistencies with the different
4190 * peer labels.
4191 *
4192 */
4193 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4194 {
4195 int err;
4196 u32 xfrm_sid;
4197 u32 nlbl_sid;
4198 u32 nlbl_type;
4199
4200 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4201 if (unlikely(err))
4202 return -EACCES;
4203 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4204 if (unlikely(err))
4205 return -EACCES;
4206
4207 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4208 if (unlikely(err)) {
4209 printk(KERN_WARNING
4210 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4211 " unable to determine packet's peer label\n");
4212 return -EACCES;
4213 }
4214
4215 return 0;
4216 }
4217
4218 /**
4219 * selinux_conn_sid - Determine the child socket label for a connection
4220 * @sk_sid: the parent socket's SID
4221 * @skb_sid: the packet's SID
4222 * @conn_sid: the resulting connection SID
4223 *
4224 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4225 * combined with the MLS information from @skb_sid in order to create
4226 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4227 * of @sk_sid. Returns zero on success, negative values on failure.
4228 *
4229 */
4230 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4231 {
4232 int err = 0;
4233
4234 if (skb_sid != SECSID_NULL)
4235 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4236 else
4237 *conn_sid = sk_sid;
4238
4239 return err;
4240 }
4241
4242 /* socket security operations */
4243
4244 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4245 u16 secclass, u32 *socksid)
4246 {
4247 if (tsec->sockcreate_sid > SECSID_NULL) {
4248 *socksid = tsec->sockcreate_sid;
4249 return 0;
4250 }
4251
4252 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4253 socksid);
4254 }
4255
4256 static int sock_has_perm(struct sock *sk, u32 perms)
4257 {
4258 struct sk_security_struct *sksec = sk->sk_security;
4259 struct common_audit_data ad;
4260 struct lsm_network_audit net = {0,};
4261
4262 if (sksec->sid == SECINITSID_KERNEL)
4263 return 0;
4264
4265 ad.type = LSM_AUDIT_DATA_NET;
4266 ad.u.net = &net;
4267 ad.u.net->sk = sk;
4268
4269 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4270 &ad);
4271 }
4272
4273 static int selinux_socket_create(int family, int type,
4274 int protocol, int kern)
4275 {
4276 const struct task_security_struct *tsec = current_security();
4277 u32 newsid;
4278 u16 secclass;
4279 int rc;
4280
4281 if (kern)
4282 return 0;
4283
4284 secclass = socket_type_to_security_class(family, type, protocol);
4285 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4286 if (rc)
4287 return rc;
4288
4289 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4290 }
4291
4292 static int selinux_socket_post_create(struct socket *sock, int family,
4293 int type, int protocol, int kern)
4294 {
4295 const struct task_security_struct *tsec = current_security();
4296 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4297 struct sk_security_struct *sksec;
4298 u16 sclass = socket_type_to_security_class(family, type, protocol);
4299 u32 sid = SECINITSID_KERNEL;
4300 int err = 0;
4301
4302 if (!kern) {
4303 err = socket_sockcreate_sid(tsec, sclass, &sid);
4304 if (err)
4305 return err;
4306 }
4307
4308 isec->sclass = sclass;
4309 isec->sid = sid;
4310 isec->initialized = LABEL_INITIALIZED;
4311
4312 if (sock->sk) {
4313 sksec = sock->sk->sk_security;
4314 sksec->sclass = sclass;
4315 sksec->sid = sid;
4316 err = selinux_netlbl_socket_post_create(sock->sk, family);
4317 }
4318
4319 return err;
4320 }
4321
4322 /* Range of port numbers used to automatically bind.
4323 Need to determine whether we should perform a name_bind
4324 permission check between the socket and the port number. */
4325
4326 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4327 {
4328 struct sock *sk = sock->sk;
4329 u16 family;
4330 int err;
4331
4332 err = sock_has_perm(sk, SOCKET__BIND);
4333 if (err)
4334 goto out;
4335
4336 /*
4337 * If PF_INET or PF_INET6, check name_bind permission for the port.
4338 * Multiple address binding for SCTP is not supported yet: we just
4339 * check the first address now.
4340 */
4341 family = sk->sk_family;
4342 if (family == PF_INET || family == PF_INET6) {
4343 char *addrp;
4344 struct sk_security_struct *sksec = sk->sk_security;
4345 struct common_audit_data ad;
4346 struct lsm_network_audit net = {0,};
4347 struct sockaddr_in *addr4 = NULL;
4348 struct sockaddr_in6 *addr6 = NULL;
4349 unsigned short snum;
4350 u32 sid, node_perm;
4351
4352 if (family == PF_INET) {
4353 addr4 = (struct sockaddr_in *)address;
4354 snum = ntohs(addr4->sin_port);
4355 addrp = (char *)&addr4->sin_addr.s_addr;
4356 } else {
4357 addr6 = (struct sockaddr_in6 *)address;
4358 snum = ntohs(addr6->sin6_port);
4359 addrp = (char *)&addr6->sin6_addr.s6_addr;
4360 }
4361
4362 if (snum) {
4363 int low, high;
4364
4365 inet_get_local_port_range(sock_net(sk), &low, &high);
4366
4367 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4368 snum > high) {
4369 err = sel_netport_sid(sk->sk_protocol,
4370 snum, &sid);
4371 if (err)
4372 goto out;
4373 ad.type = LSM_AUDIT_DATA_NET;
4374 ad.u.net = &net;
4375 ad.u.net->sport = htons(snum);
4376 ad.u.net->family = family;
4377 err = avc_has_perm(sksec->sid, sid,
4378 sksec->sclass,
4379 SOCKET__NAME_BIND, &ad);
4380 if (err)
4381 goto out;
4382 }
4383 }
4384
4385 switch (sksec->sclass) {
4386 case SECCLASS_TCP_SOCKET:
4387 node_perm = TCP_SOCKET__NODE_BIND;
4388 break;
4389
4390 case SECCLASS_UDP_SOCKET:
4391 node_perm = UDP_SOCKET__NODE_BIND;
4392 break;
4393
4394 case SECCLASS_DCCP_SOCKET:
4395 node_perm = DCCP_SOCKET__NODE_BIND;
4396 break;
4397
4398 default:
4399 node_perm = RAWIP_SOCKET__NODE_BIND;
4400 break;
4401 }
4402
4403 err = sel_netnode_sid(addrp, family, &sid);
4404 if (err)
4405 goto out;
4406
4407 ad.type = LSM_AUDIT_DATA_NET;
4408 ad.u.net = &net;
4409 ad.u.net->sport = htons(snum);
4410 ad.u.net->family = family;
4411
4412 if (family == PF_INET)
4413 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4414 else
4415 ad.u.net->v6info.saddr = addr6->sin6_addr;
4416
4417 err = avc_has_perm(sksec->sid, sid,
4418 sksec->sclass, node_perm, &ad);
4419 if (err)
4420 goto out;
4421 }
4422 out:
4423 return err;
4424 }
4425
4426 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4427 {
4428 struct sock *sk = sock->sk;
4429 struct sk_security_struct *sksec = sk->sk_security;
4430 int err;
4431
4432 err = sock_has_perm(sk, SOCKET__CONNECT);
4433 if (err)
4434 return err;
4435
4436 /*
4437 * If a TCP or DCCP socket, check name_connect permission for the port.
4438 */
4439 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4440 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4441 struct common_audit_data ad;
4442 struct lsm_network_audit net = {0,};
4443 struct sockaddr_in *addr4 = NULL;
4444 struct sockaddr_in6 *addr6 = NULL;
4445 unsigned short snum;
4446 u32 sid, perm;
4447
4448 if (sk->sk_family == PF_INET) {
4449 addr4 = (struct sockaddr_in *)address;
4450 if (addrlen < sizeof(struct sockaddr_in))
4451 return -EINVAL;
4452 snum = ntohs(addr4->sin_port);
4453 } else {
4454 addr6 = (struct sockaddr_in6 *)address;
4455 if (addrlen < SIN6_LEN_RFC2133)
4456 return -EINVAL;
4457 snum = ntohs(addr6->sin6_port);
4458 }
4459
4460 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4461 if (err)
4462 goto out;
4463
4464 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4465 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4466
4467 ad.type = LSM_AUDIT_DATA_NET;
4468 ad.u.net = &net;
4469 ad.u.net->dport = htons(snum);
4470 ad.u.net->family = sk->sk_family;
4471 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4472 if (err)
4473 goto out;
4474 }
4475
4476 err = selinux_netlbl_socket_connect(sk, address);
4477
4478 out:
4479 return err;
4480 }
4481
4482 static int selinux_socket_listen(struct socket *sock, int backlog)
4483 {
4484 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4485 }
4486
4487 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4488 {
4489 int err;
4490 struct inode_security_struct *isec;
4491 struct inode_security_struct *newisec;
4492 u16 sclass;
4493 u32 sid;
4494
4495 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4496 if (err)
4497 return err;
4498
4499 isec = inode_security_novalidate(SOCK_INODE(sock));
4500 spin_lock(&isec->lock);
4501 sclass = isec->sclass;
4502 sid = isec->sid;
4503 spin_unlock(&isec->lock);
4504
4505 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4506 newisec->sclass = sclass;
4507 newisec->sid = sid;
4508 newisec->initialized = LABEL_INITIALIZED;
4509
4510 return 0;
4511 }
4512
4513 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4514 int size)
4515 {
4516 return sock_has_perm(sock->sk, SOCKET__WRITE);
4517 }
4518
4519 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4520 int size, int flags)
4521 {
4522 return sock_has_perm(sock->sk, SOCKET__READ);
4523 }
4524
4525 static int selinux_socket_getsockname(struct socket *sock)
4526 {
4527 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4528 }
4529
4530 static int selinux_socket_getpeername(struct socket *sock)
4531 {
4532 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4533 }
4534
4535 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4536 {
4537 int err;
4538
4539 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4540 if (err)
4541 return err;
4542
4543 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4544 }
4545
4546 static int selinux_socket_getsockopt(struct socket *sock, int level,
4547 int optname)
4548 {
4549 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4550 }
4551
4552 static int selinux_socket_shutdown(struct socket *sock, int how)
4553 {
4554 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4555 }
4556
4557 static int selinux_socket_unix_stream_connect(struct sock *sock,
4558 struct sock *other,
4559 struct sock *newsk)
4560 {
4561 struct sk_security_struct *sksec_sock = sock->sk_security;
4562 struct sk_security_struct *sksec_other = other->sk_security;
4563 struct sk_security_struct *sksec_new = newsk->sk_security;
4564 struct common_audit_data ad;
4565 struct lsm_network_audit net = {0,};
4566 int err;
4567
4568 ad.type = LSM_AUDIT_DATA_NET;
4569 ad.u.net = &net;
4570 ad.u.net->sk = other;
4571
4572 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4573 sksec_other->sclass,
4574 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4575 if (err)
4576 return err;
4577
4578 /* server child socket */
4579 sksec_new->peer_sid = sksec_sock->sid;
4580 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4581 &sksec_new->sid);
4582 if (err)
4583 return err;
4584
4585 /* connecting socket */
4586 sksec_sock->peer_sid = sksec_new->sid;
4587
4588 return 0;
4589 }
4590
4591 static int selinux_socket_unix_may_send(struct socket *sock,
4592 struct socket *other)
4593 {
4594 struct sk_security_struct *ssec = sock->sk->sk_security;
4595 struct sk_security_struct *osec = other->sk->sk_security;
4596 struct common_audit_data ad;
4597 struct lsm_network_audit net = {0,};
4598
4599 ad.type = LSM_AUDIT_DATA_NET;
4600 ad.u.net = &net;
4601 ad.u.net->sk = other->sk;
4602
4603 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4604 &ad);
4605 }
4606
4607 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4608 char *addrp, u16 family, u32 peer_sid,
4609 struct common_audit_data *ad)
4610 {
4611 int err;
4612 u32 if_sid;
4613 u32 node_sid;
4614
4615 err = sel_netif_sid(ns, ifindex, &if_sid);
4616 if (err)
4617 return err;
4618 err = avc_has_perm(peer_sid, if_sid,
4619 SECCLASS_NETIF, NETIF__INGRESS, ad);
4620 if (err)
4621 return err;
4622
4623 err = sel_netnode_sid(addrp, family, &node_sid);
4624 if (err)
4625 return err;
4626 return avc_has_perm(peer_sid, node_sid,
4627 SECCLASS_NODE, NODE__RECVFROM, ad);
4628 }
4629
4630 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4631 u16 family)
4632 {
4633 int err = 0;
4634 struct sk_security_struct *sksec = sk->sk_security;
4635 u32 sk_sid = sksec->sid;
4636 struct common_audit_data ad;
4637 struct lsm_network_audit net = {0,};
4638 char *addrp;
4639
4640 ad.type = LSM_AUDIT_DATA_NET;
4641 ad.u.net = &net;
4642 ad.u.net->netif = skb->skb_iif;
4643 ad.u.net->family = family;
4644 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4645 if (err)
4646 return err;
4647
4648 if (selinux_secmark_enabled()) {
4649 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4650 PACKET__RECV, &ad);
4651 if (err)
4652 return err;
4653 }
4654
4655 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4656 if (err)
4657 return err;
4658 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4659
4660 return err;
4661 }
4662
4663 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4664 {
4665 int err;
4666 struct sk_security_struct *sksec = sk->sk_security;
4667 u16 family = sk->sk_family;
4668 u32 sk_sid = sksec->sid;
4669 struct common_audit_data ad;
4670 struct lsm_network_audit net = {0,};
4671 char *addrp;
4672 u8 secmark_active;
4673 u8 peerlbl_active;
4674
4675 if (family != PF_INET && family != PF_INET6)
4676 return 0;
4677
4678 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4679 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4680 family = PF_INET;
4681
4682 /* If any sort of compatibility mode is enabled then handoff processing
4683 * to the selinux_sock_rcv_skb_compat() function to deal with the
4684 * special handling. We do this in an attempt to keep this function
4685 * as fast and as clean as possible. */
4686 if (!selinux_policycap_netpeer)
4687 return selinux_sock_rcv_skb_compat(sk, skb, family);
4688
4689 secmark_active = selinux_secmark_enabled();
4690 peerlbl_active = selinux_peerlbl_enabled();
4691 if (!secmark_active && !peerlbl_active)
4692 return 0;
4693
4694 ad.type = LSM_AUDIT_DATA_NET;
4695 ad.u.net = &net;
4696 ad.u.net->netif = skb->skb_iif;
4697 ad.u.net->family = family;
4698 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4699 if (err)
4700 return err;
4701
4702 if (peerlbl_active) {
4703 u32 peer_sid;
4704
4705 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4706 if (err)
4707 return err;
4708 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4709 addrp, family, peer_sid, &ad);
4710 if (err) {
4711 selinux_netlbl_err(skb, family, err, 0);
4712 return err;
4713 }
4714 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4715 PEER__RECV, &ad);
4716 if (err) {
4717 selinux_netlbl_err(skb, family, err, 0);
4718 return err;
4719 }
4720 }
4721
4722 if (secmark_active) {
4723 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4724 PACKET__RECV, &ad);
4725 if (err)
4726 return err;
4727 }
4728
4729 return err;
4730 }
4731
4732 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4733 int __user *optlen, unsigned len)
4734 {
4735 int err = 0;
4736 char *scontext;
4737 u32 scontext_len;
4738 struct sk_security_struct *sksec = sock->sk->sk_security;
4739 u32 peer_sid = SECSID_NULL;
4740
4741 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4742 sksec->sclass == SECCLASS_TCP_SOCKET)
4743 peer_sid = sksec->peer_sid;
4744 if (peer_sid == SECSID_NULL)
4745 return -ENOPROTOOPT;
4746
4747 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4748 if (err)
4749 return err;
4750
4751 if (scontext_len > len) {
4752 err = -ERANGE;
4753 goto out_len;
4754 }
4755
4756 if (copy_to_user(optval, scontext, scontext_len))
4757 err = -EFAULT;
4758
4759 out_len:
4760 if (put_user(scontext_len, optlen))
4761 err = -EFAULT;
4762 kfree(scontext);
4763 return err;
4764 }
4765
4766 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4767 {
4768 u32 peer_secid = SECSID_NULL;
4769 u16 family;
4770 struct inode_security_struct *isec;
4771
4772 if (skb && skb->protocol == htons(ETH_P_IP))
4773 family = PF_INET;
4774 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4775 family = PF_INET6;
4776 else if (sock)
4777 family = sock->sk->sk_family;
4778 else
4779 goto out;
4780
4781 if (sock && family == PF_UNIX) {
4782 isec = inode_security_novalidate(SOCK_INODE(sock));
4783 peer_secid = isec->sid;
4784 } else if (skb)
4785 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4786
4787 out:
4788 *secid = peer_secid;
4789 if (peer_secid == SECSID_NULL)
4790 return -EINVAL;
4791 return 0;
4792 }
4793
4794 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4795 {
4796 struct sk_security_struct *sksec;
4797
4798 sksec = kzalloc(sizeof(*sksec), priority);
4799 if (!sksec)
4800 return -ENOMEM;
4801
4802 sksec->peer_sid = SECINITSID_UNLABELED;
4803 sksec->sid = SECINITSID_UNLABELED;
4804 sksec->sclass = SECCLASS_SOCKET;
4805 selinux_netlbl_sk_security_reset(sksec);
4806 sk->sk_security = sksec;
4807
4808 return 0;
4809 }
4810
4811 static void selinux_sk_free_security(struct sock *sk)
4812 {
4813 struct sk_security_struct *sksec = sk->sk_security;
4814
4815 sk->sk_security = NULL;
4816 selinux_netlbl_sk_security_free(sksec);
4817 kfree(sksec);
4818 }
4819
4820 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4821 {
4822 struct sk_security_struct *sksec = sk->sk_security;
4823 struct sk_security_struct *newsksec = newsk->sk_security;
4824
4825 newsksec->sid = sksec->sid;
4826 newsksec->peer_sid = sksec->peer_sid;
4827 newsksec->sclass = sksec->sclass;
4828
4829 selinux_netlbl_sk_security_reset(newsksec);
4830 }
4831
4832 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4833 {
4834 if (!sk)
4835 *secid = SECINITSID_ANY_SOCKET;
4836 else {
4837 struct sk_security_struct *sksec = sk->sk_security;
4838
4839 *secid = sksec->sid;
4840 }
4841 }
4842
4843 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4844 {
4845 struct inode_security_struct *isec =
4846 inode_security_novalidate(SOCK_INODE(parent));
4847 struct sk_security_struct *sksec = sk->sk_security;
4848
4849 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4850 sk->sk_family == PF_UNIX)
4851 isec->sid = sksec->sid;
4852 sksec->sclass = isec->sclass;
4853 }
4854
4855 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4856 struct request_sock *req)
4857 {
4858 struct sk_security_struct *sksec = sk->sk_security;
4859 int err;
4860 u16 family = req->rsk_ops->family;
4861 u32 connsid;
4862 u32 peersid;
4863
4864 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4865 if (err)
4866 return err;
4867 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4868 if (err)
4869 return err;
4870 req->secid = connsid;
4871 req->peer_secid = peersid;
4872
4873 return selinux_netlbl_inet_conn_request(req, family);
4874 }
4875
4876 static void selinux_inet_csk_clone(struct sock *newsk,
4877 const struct request_sock *req)
4878 {
4879 struct sk_security_struct *newsksec = newsk->sk_security;
4880
4881 newsksec->sid = req->secid;
4882 newsksec->peer_sid = req->peer_secid;
4883 /* NOTE: Ideally, we should also get the isec->sid for the
4884 new socket in sync, but we don't have the isec available yet.
4885 So we will wait until sock_graft to do it, by which
4886 time it will have been created and available. */
4887
4888 /* We don't need to take any sort of lock here as we are the only
4889 * thread with access to newsksec */
4890 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4891 }
4892
4893 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4894 {
4895 u16 family = sk->sk_family;
4896 struct sk_security_struct *sksec = sk->sk_security;
4897
4898 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4899 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4900 family = PF_INET;
4901
4902 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4903 }
4904
4905 static int selinux_secmark_relabel_packet(u32 sid)
4906 {
4907 const struct task_security_struct *__tsec;
4908 u32 tsid;
4909
4910 __tsec = current_security();
4911 tsid = __tsec->sid;
4912
4913 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4914 }
4915
4916 static void selinux_secmark_refcount_inc(void)
4917 {
4918 atomic_inc(&selinux_secmark_refcount);
4919 }
4920
4921 static void selinux_secmark_refcount_dec(void)
4922 {
4923 atomic_dec(&selinux_secmark_refcount);
4924 }
4925
4926 static void selinux_req_classify_flow(const struct request_sock *req,
4927 struct flowi *fl)
4928 {
4929 fl->flowi_secid = req->secid;
4930 }
4931
4932 static int selinux_tun_dev_alloc_security(void **security)
4933 {
4934 struct tun_security_struct *tunsec;
4935
4936 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4937 if (!tunsec)
4938 return -ENOMEM;
4939 tunsec->sid = current_sid();
4940
4941 *security = tunsec;
4942 return 0;
4943 }
4944
4945 static void selinux_tun_dev_free_security(void *security)
4946 {
4947 kfree(security);
4948 }
4949
4950 static int selinux_tun_dev_create(void)
4951 {
4952 u32 sid = current_sid();
4953
4954 /* we aren't taking into account the "sockcreate" SID since the socket
4955 * that is being created here is not a socket in the traditional sense,
4956 * instead it is a private sock, accessible only to the kernel, and
4957 * representing a wide range of network traffic spanning multiple
4958 * connections unlike traditional sockets - check the TUN driver to
4959 * get a better understanding of why this socket is special */
4960
4961 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4962 NULL);
4963 }
4964
4965 static int selinux_tun_dev_attach_queue(void *security)
4966 {
4967 struct tun_security_struct *tunsec = security;
4968
4969 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4970 TUN_SOCKET__ATTACH_QUEUE, NULL);
4971 }
4972
4973 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4974 {
4975 struct tun_security_struct *tunsec = security;
4976 struct sk_security_struct *sksec = sk->sk_security;
4977
4978 /* we don't currently perform any NetLabel based labeling here and it
4979 * isn't clear that we would want to do so anyway; while we could apply
4980 * labeling without the support of the TUN user the resulting labeled
4981 * traffic from the other end of the connection would almost certainly
4982 * cause confusion to the TUN user that had no idea network labeling
4983 * protocols were being used */
4984
4985 sksec->sid = tunsec->sid;
4986 sksec->sclass = SECCLASS_TUN_SOCKET;
4987
4988 return 0;
4989 }
4990
4991 static int selinux_tun_dev_open(void *security)
4992 {
4993 struct tun_security_struct *tunsec = security;
4994 u32 sid = current_sid();
4995 int err;
4996
4997 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4998 TUN_SOCKET__RELABELFROM, NULL);
4999 if (err)
5000 return err;
5001 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5002 TUN_SOCKET__RELABELTO, NULL);
5003 if (err)
5004 return err;
5005 tunsec->sid = sid;
5006
5007 return 0;
5008 }
5009
5010 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5011 {
5012 int err = 0;
5013 u32 perm;
5014 struct nlmsghdr *nlh;
5015 struct sk_security_struct *sksec = sk->sk_security;
5016
5017 if (skb->len < NLMSG_HDRLEN) {
5018 err = -EINVAL;
5019 goto out;
5020 }
5021 nlh = nlmsg_hdr(skb);
5022
5023 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5024 if (err) {
5025 if (err == -EINVAL) {
5026 pr_warn_ratelimited("SELinux: unrecognized netlink"
5027 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5028 " pig=%d comm=%s\n",
5029 sk->sk_protocol, nlh->nlmsg_type,
5030 secclass_map[sksec->sclass - 1].name,
5031 task_pid_nr(current), current->comm);
5032 if (!selinux_enforcing || security_get_allow_unknown())
5033 err = 0;
5034 }
5035
5036 /* Ignore */
5037 if (err == -ENOENT)
5038 err = 0;
5039 goto out;
5040 }
5041
5042 err = sock_has_perm(sk, perm);
5043 out:
5044 return err;
5045 }
5046
5047 #ifdef CONFIG_NETFILTER
5048
5049 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5050 const struct net_device *indev,
5051 u16 family)
5052 {
5053 int err;
5054 char *addrp;
5055 u32 peer_sid;
5056 struct common_audit_data ad;
5057 struct lsm_network_audit net = {0,};
5058 u8 secmark_active;
5059 u8 netlbl_active;
5060 u8 peerlbl_active;
5061
5062 if (!selinux_policycap_netpeer)
5063 return NF_ACCEPT;
5064
5065 secmark_active = selinux_secmark_enabled();
5066 netlbl_active = netlbl_enabled();
5067 peerlbl_active = selinux_peerlbl_enabled();
5068 if (!secmark_active && !peerlbl_active)
5069 return NF_ACCEPT;
5070
5071 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5072 return NF_DROP;
5073
5074 ad.type = LSM_AUDIT_DATA_NET;
5075 ad.u.net = &net;
5076 ad.u.net->netif = indev->ifindex;
5077 ad.u.net->family = family;
5078 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5079 return NF_DROP;
5080
5081 if (peerlbl_active) {
5082 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5083 addrp, family, peer_sid, &ad);
5084 if (err) {
5085 selinux_netlbl_err(skb, family, err, 1);
5086 return NF_DROP;
5087 }
5088 }
5089
5090 if (secmark_active)
5091 if (avc_has_perm(peer_sid, skb->secmark,
5092 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5093 return NF_DROP;
5094
5095 if (netlbl_active)
5096 /* we do this in the FORWARD path and not the POST_ROUTING
5097 * path because we want to make sure we apply the necessary
5098 * labeling before IPsec is applied so we can leverage AH
5099 * protection */
5100 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5101 return NF_DROP;
5102
5103 return NF_ACCEPT;
5104 }
5105
5106 static unsigned int selinux_ipv4_forward(void *priv,
5107 struct sk_buff *skb,
5108 const struct nf_hook_state *state)
5109 {
5110 return selinux_ip_forward(skb, state->in, PF_INET);
5111 }
5112
5113 #if IS_ENABLED(CONFIG_IPV6)
5114 static unsigned int selinux_ipv6_forward(void *priv,
5115 struct sk_buff *skb,
5116 const struct nf_hook_state *state)
5117 {
5118 return selinux_ip_forward(skb, state->in, PF_INET6);
5119 }
5120 #endif /* IPV6 */
5121
5122 static unsigned int selinux_ip_output(struct sk_buff *skb,
5123 u16 family)
5124 {
5125 struct sock *sk;
5126 u32 sid;
5127
5128 if (!netlbl_enabled())
5129 return NF_ACCEPT;
5130
5131 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5132 * because we want to make sure we apply the necessary labeling
5133 * before IPsec is applied so we can leverage AH protection */
5134 sk = skb->sk;
5135 if (sk) {
5136 struct sk_security_struct *sksec;
5137
5138 if (sk_listener(sk))
5139 /* if the socket is the listening state then this
5140 * packet is a SYN-ACK packet which means it needs to
5141 * be labeled based on the connection/request_sock and
5142 * not the parent socket. unfortunately, we can't
5143 * lookup the request_sock yet as it isn't queued on
5144 * the parent socket until after the SYN-ACK is sent.
5145 * the "solution" is to simply pass the packet as-is
5146 * as any IP option based labeling should be copied
5147 * from the initial connection request (in the IP
5148 * layer). it is far from ideal, but until we get a
5149 * security label in the packet itself this is the
5150 * best we can do. */
5151 return NF_ACCEPT;
5152
5153 /* standard practice, label using the parent socket */
5154 sksec = sk->sk_security;
5155 sid = sksec->sid;
5156 } else
5157 sid = SECINITSID_KERNEL;
5158 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5159 return NF_DROP;
5160
5161 return NF_ACCEPT;
5162 }
5163
5164 static unsigned int selinux_ipv4_output(void *priv,
5165 struct sk_buff *skb,
5166 const struct nf_hook_state *state)
5167 {
5168 return selinux_ip_output(skb, PF_INET);
5169 }
5170
5171 #if IS_ENABLED(CONFIG_IPV6)
5172 static unsigned int selinux_ipv6_output(void *priv,
5173 struct sk_buff *skb,
5174 const struct nf_hook_state *state)
5175 {
5176 return selinux_ip_output(skb, PF_INET6);
5177 }
5178 #endif /* IPV6 */
5179
5180 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5181 int ifindex,
5182 u16 family)
5183 {
5184 struct sock *sk = skb_to_full_sk(skb);
5185 struct sk_security_struct *sksec;
5186 struct common_audit_data ad;
5187 struct lsm_network_audit net = {0,};
5188 char *addrp;
5189 u8 proto;
5190
5191 if (sk == NULL)
5192 return NF_ACCEPT;
5193 sksec = sk->sk_security;
5194
5195 ad.type = LSM_AUDIT_DATA_NET;
5196 ad.u.net = &net;
5197 ad.u.net->netif = ifindex;
5198 ad.u.net->family = family;
5199 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5200 return NF_DROP;
5201
5202 if (selinux_secmark_enabled())
5203 if (avc_has_perm(sksec->sid, skb->secmark,
5204 SECCLASS_PACKET, PACKET__SEND, &ad))
5205 return NF_DROP_ERR(-ECONNREFUSED);
5206
5207 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5208 return NF_DROP_ERR(-ECONNREFUSED);
5209
5210 return NF_ACCEPT;
5211 }
5212
5213 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5214 const struct net_device *outdev,
5215 u16 family)
5216 {
5217 u32 secmark_perm;
5218 u32 peer_sid;
5219 int ifindex = outdev->ifindex;
5220 struct sock *sk;
5221 struct common_audit_data ad;
5222 struct lsm_network_audit net = {0,};
5223 char *addrp;
5224 u8 secmark_active;
5225 u8 peerlbl_active;
5226
5227 /* If any sort of compatibility mode is enabled then handoff processing
5228 * to the selinux_ip_postroute_compat() function to deal with the
5229 * special handling. We do this in an attempt to keep this function
5230 * as fast and as clean as possible. */
5231 if (!selinux_policycap_netpeer)
5232 return selinux_ip_postroute_compat(skb, ifindex, family);
5233
5234 secmark_active = selinux_secmark_enabled();
5235 peerlbl_active = selinux_peerlbl_enabled();
5236 if (!secmark_active && !peerlbl_active)
5237 return NF_ACCEPT;
5238
5239 sk = skb_to_full_sk(skb);
5240
5241 #ifdef CONFIG_XFRM
5242 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5243 * packet transformation so allow the packet to pass without any checks
5244 * since we'll have another chance to perform access control checks
5245 * when the packet is on it's final way out.
5246 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5247 * is NULL, in this case go ahead and apply access control.
5248 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5249 * TCP listening state we cannot wait until the XFRM processing
5250 * is done as we will miss out on the SA label if we do;
5251 * unfortunately, this means more work, but it is only once per
5252 * connection. */
5253 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5254 !(sk && sk_listener(sk)))
5255 return NF_ACCEPT;
5256 #endif
5257
5258 if (sk == NULL) {
5259 /* Without an associated socket the packet is either coming
5260 * from the kernel or it is being forwarded; check the packet
5261 * to determine which and if the packet is being forwarded
5262 * query the packet directly to determine the security label. */
5263 if (skb->skb_iif) {
5264 secmark_perm = PACKET__FORWARD_OUT;
5265 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5266 return NF_DROP;
5267 } else {
5268 secmark_perm = PACKET__SEND;
5269 peer_sid = SECINITSID_KERNEL;
5270 }
5271 } else if (sk_listener(sk)) {
5272 /* Locally generated packet but the associated socket is in the
5273 * listening state which means this is a SYN-ACK packet. In
5274 * this particular case the correct security label is assigned
5275 * to the connection/request_sock but unfortunately we can't
5276 * query the request_sock as it isn't queued on the parent
5277 * socket until after the SYN-ACK packet is sent; the only
5278 * viable choice is to regenerate the label like we do in
5279 * selinux_inet_conn_request(). See also selinux_ip_output()
5280 * for similar problems. */
5281 u32 skb_sid;
5282 struct sk_security_struct *sksec;
5283
5284 sksec = sk->sk_security;
5285 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5286 return NF_DROP;
5287 /* At this point, if the returned skb peerlbl is SECSID_NULL
5288 * and the packet has been through at least one XFRM
5289 * transformation then we must be dealing with the "final"
5290 * form of labeled IPsec packet; since we've already applied
5291 * all of our access controls on this packet we can safely
5292 * pass the packet. */
5293 if (skb_sid == SECSID_NULL) {
5294 switch (family) {
5295 case PF_INET:
5296 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5297 return NF_ACCEPT;
5298 break;
5299 case PF_INET6:
5300 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5301 return NF_ACCEPT;
5302 break;
5303 default:
5304 return NF_DROP_ERR(-ECONNREFUSED);
5305 }
5306 }
5307 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5308 return NF_DROP;
5309 secmark_perm = PACKET__SEND;
5310 } else {
5311 /* Locally generated packet, fetch the security label from the
5312 * associated socket. */
5313 struct sk_security_struct *sksec = sk->sk_security;
5314 peer_sid = sksec->sid;
5315 secmark_perm = PACKET__SEND;
5316 }
5317
5318 ad.type = LSM_AUDIT_DATA_NET;
5319 ad.u.net = &net;
5320 ad.u.net->netif = ifindex;
5321 ad.u.net->family = family;
5322 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5323 return NF_DROP;
5324
5325 if (secmark_active)
5326 if (avc_has_perm(peer_sid, skb->secmark,
5327 SECCLASS_PACKET, secmark_perm, &ad))
5328 return NF_DROP_ERR(-ECONNREFUSED);
5329
5330 if (peerlbl_active) {
5331 u32 if_sid;
5332 u32 node_sid;
5333
5334 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5335 return NF_DROP;
5336 if (avc_has_perm(peer_sid, if_sid,
5337 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5338 return NF_DROP_ERR(-ECONNREFUSED);
5339
5340 if (sel_netnode_sid(addrp, family, &node_sid))
5341 return NF_DROP;
5342 if (avc_has_perm(peer_sid, node_sid,
5343 SECCLASS_NODE, NODE__SENDTO, &ad))
5344 return NF_DROP_ERR(-ECONNREFUSED);
5345 }
5346
5347 return NF_ACCEPT;
5348 }
5349
5350 static unsigned int selinux_ipv4_postroute(void *priv,
5351 struct sk_buff *skb,
5352 const struct nf_hook_state *state)
5353 {
5354 return selinux_ip_postroute(skb, state->out, PF_INET);
5355 }
5356
5357 #if IS_ENABLED(CONFIG_IPV6)
5358 static unsigned int selinux_ipv6_postroute(void *priv,
5359 struct sk_buff *skb,
5360 const struct nf_hook_state *state)
5361 {
5362 return selinux_ip_postroute(skb, state->out, PF_INET6);
5363 }
5364 #endif /* IPV6 */
5365
5366 #endif /* CONFIG_NETFILTER */
5367
5368 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5369 {
5370 return selinux_nlmsg_perm(sk, skb);
5371 }
5372
5373 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5374 u16 sclass)
5375 {
5376 struct ipc_security_struct *isec;
5377
5378 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5379 if (!isec)
5380 return -ENOMEM;
5381
5382 isec->sclass = sclass;
5383 isec->sid = current_sid();
5384 perm->security = isec;
5385
5386 return 0;
5387 }
5388
5389 static void ipc_free_security(struct kern_ipc_perm *perm)
5390 {
5391 struct ipc_security_struct *isec = perm->security;
5392 perm->security = NULL;
5393 kfree(isec);
5394 }
5395
5396 static int msg_msg_alloc_security(struct msg_msg *msg)
5397 {
5398 struct msg_security_struct *msec;
5399
5400 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5401 if (!msec)
5402 return -ENOMEM;
5403
5404 msec->sid = SECINITSID_UNLABELED;
5405 msg->security = msec;
5406
5407 return 0;
5408 }
5409
5410 static void msg_msg_free_security(struct msg_msg *msg)
5411 {
5412 struct msg_security_struct *msec = msg->security;
5413
5414 msg->security = NULL;
5415 kfree(msec);
5416 }
5417
5418 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5419 u32 perms)
5420 {
5421 struct ipc_security_struct *isec;
5422 struct common_audit_data ad;
5423 u32 sid = current_sid();
5424
5425 isec = ipc_perms->security;
5426
5427 ad.type = LSM_AUDIT_DATA_IPC;
5428 ad.u.ipc_id = ipc_perms->key;
5429
5430 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5431 }
5432
5433 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5434 {
5435 return msg_msg_alloc_security(msg);
5436 }
5437
5438 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5439 {
5440 msg_msg_free_security(msg);
5441 }
5442
5443 /* message queue security operations */
5444 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5445 {
5446 struct ipc_security_struct *isec;
5447 struct common_audit_data ad;
5448 u32 sid = current_sid();
5449 int rc;
5450
5451 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5452 if (rc)
5453 return rc;
5454
5455 isec = msq->q_perm.security;
5456
5457 ad.type = LSM_AUDIT_DATA_IPC;
5458 ad.u.ipc_id = msq->q_perm.key;
5459
5460 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5461 MSGQ__CREATE, &ad);
5462 if (rc) {
5463 ipc_free_security(&msq->q_perm);
5464 return rc;
5465 }
5466 return 0;
5467 }
5468
5469 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5470 {
5471 ipc_free_security(&msq->q_perm);
5472 }
5473
5474 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5475 {
5476 struct ipc_security_struct *isec;
5477 struct common_audit_data ad;
5478 u32 sid = current_sid();
5479
5480 isec = msq->q_perm.security;
5481
5482 ad.type = LSM_AUDIT_DATA_IPC;
5483 ad.u.ipc_id = msq->q_perm.key;
5484
5485 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5486 MSGQ__ASSOCIATE, &ad);
5487 }
5488
5489 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5490 {
5491 int err;
5492 int perms;
5493
5494 switch (cmd) {
5495 case IPC_INFO:
5496 case MSG_INFO:
5497 /* No specific object, just general system-wide information. */
5498 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5499 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5500 case IPC_STAT:
5501 case MSG_STAT:
5502 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5503 break;
5504 case IPC_SET:
5505 perms = MSGQ__SETATTR;
5506 break;
5507 case IPC_RMID:
5508 perms = MSGQ__DESTROY;
5509 break;
5510 default:
5511 return 0;
5512 }
5513
5514 err = ipc_has_perm(&msq->q_perm, perms);
5515 return err;
5516 }
5517
5518 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5519 {
5520 struct ipc_security_struct *isec;
5521 struct msg_security_struct *msec;
5522 struct common_audit_data ad;
5523 u32 sid = current_sid();
5524 int rc;
5525
5526 isec = msq->q_perm.security;
5527 msec = msg->security;
5528
5529 /*
5530 * First time through, need to assign label to the message
5531 */
5532 if (msec->sid == SECINITSID_UNLABELED) {
5533 /*
5534 * Compute new sid based on current process and
5535 * message queue this message will be stored in
5536 */
5537 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5538 NULL, &msec->sid);
5539 if (rc)
5540 return rc;
5541 }
5542
5543 ad.type = LSM_AUDIT_DATA_IPC;
5544 ad.u.ipc_id = msq->q_perm.key;
5545
5546 /* Can this process write to the queue? */
5547 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5548 MSGQ__WRITE, &ad);
5549 if (!rc)
5550 /* Can this process send the message */
5551 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5552 MSG__SEND, &ad);
5553 if (!rc)
5554 /* Can the message be put in the queue? */
5555 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5556 MSGQ__ENQUEUE, &ad);
5557
5558 return rc;
5559 }
5560
5561 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5562 struct task_struct *target,
5563 long type, int mode)
5564 {
5565 struct ipc_security_struct *isec;
5566 struct msg_security_struct *msec;
5567 struct common_audit_data ad;
5568 u32 sid = task_sid(target);
5569 int rc;
5570
5571 isec = msq->q_perm.security;
5572 msec = msg->security;
5573
5574 ad.type = LSM_AUDIT_DATA_IPC;
5575 ad.u.ipc_id = msq->q_perm.key;
5576
5577 rc = avc_has_perm(sid, isec->sid,
5578 SECCLASS_MSGQ, MSGQ__READ, &ad);
5579 if (!rc)
5580 rc = avc_has_perm(sid, msec->sid,
5581 SECCLASS_MSG, MSG__RECEIVE, &ad);
5582 return rc;
5583 }
5584
5585 /* Shared Memory security operations */
5586 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5587 {
5588 struct ipc_security_struct *isec;
5589 struct common_audit_data ad;
5590 u32 sid = current_sid();
5591 int rc;
5592
5593 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5594 if (rc)
5595 return rc;
5596
5597 isec = shp->shm_perm.security;
5598
5599 ad.type = LSM_AUDIT_DATA_IPC;
5600 ad.u.ipc_id = shp->shm_perm.key;
5601
5602 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5603 SHM__CREATE, &ad);
5604 if (rc) {
5605 ipc_free_security(&shp->shm_perm);
5606 return rc;
5607 }
5608 return 0;
5609 }
5610
5611 static void selinux_shm_free_security(struct shmid_kernel *shp)
5612 {
5613 ipc_free_security(&shp->shm_perm);
5614 }
5615
5616 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5617 {
5618 struct ipc_security_struct *isec;
5619 struct common_audit_data ad;
5620 u32 sid = current_sid();
5621
5622 isec = shp->shm_perm.security;
5623
5624 ad.type = LSM_AUDIT_DATA_IPC;
5625 ad.u.ipc_id = shp->shm_perm.key;
5626
5627 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5628 SHM__ASSOCIATE, &ad);
5629 }
5630
5631 /* Note, at this point, shp is locked down */
5632 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5633 {
5634 int perms;
5635 int err;
5636
5637 switch (cmd) {
5638 case IPC_INFO:
5639 case SHM_INFO:
5640 /* No specific object, just general system-wide information. */
5641 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5642 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5643 case IPC_STAT:
5644 case SHM_STAT:
5645 perms = SHM__GETATTR | SHM__ASSOCIATE;
5646 break;
5647 case IPC_SET:
5648 perms = SHM__SETATTR;
5649 break;
5650 case SHM_LOCK:
5651 case SHM_UNLOCK:
5652 perms = SHM__LOCK;
5653 break;
5654 case IPC_RMID:
5655 perms = SHM__DESTROY;
5656 break;
5657 default:
5658 return 0;
5659 }
5660
5661 err = ipc_has_perm(&shp->shm_perm, perms);
5662 return err;
5663 }
5664
5665 static int selinux_shm_shmat(struct shmid_kernel *shp,
5666 char __user *shmaddr, int shmflg)
5667 {
5668 u32 perms;
5669
5670 if (shmflg & SHM_RDONLY)
5671 perms = SHM__READ;
5672 else
5673 perms = SHM__READ | SHM__WRITE;
5674
5675 return ipc_has_perm(&shp->shm_perm, perms);
5676 }
5677
5678 /* Semaphore security operations */
5679 static int selinux_sem_alloc_security(struct sem_array *sma)
5680 {
5681 struct ipc_security_struct *isec;
5682 struct common_audit_data ad;
5683 u32 sid = current_sid();
5684 int rc;
5685
5686 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5687 if (rc)
5688 return rc;
5689
5690 isec = sma->sem_perm.security;
5691
5692 ad.type = LSM_AUDIT_DATA_IPC;
5693 ad.u.ipc_id = sma->sem_perm.key;
5694
5695 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5696 SEM__CREATE, &ad);
5697 if (rc) {
5698 ipc_free_security(&sma->sem_perm);
5699 return rc;
5700 }
5701 return 0;
5702 }
5703
5704 static void selinux_sem_free_security(struct sem_array *sma)
5705 {
5706 ipc_free_security(&sma->sem_perm);
5707 }
5708
5709 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5710 {
5711 struct ipc_security_struct *isec;
5712 struct common_audit_data ad;
5713 u32 sid = current_sid();
5714
5715 isec = sma->sem_perm.security;
5716
5717 ad.type = LSM_AUDIT_DATA_IPC;
5718 ad.u.ipc_id = sma->sem_perm.key;
5719
5720 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5721 SEM__ASSOCIATE, &ad);
5722 }
5723
5724 /* Note, at this point, sma is locked down */
5725 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5726 {
5727 int err;
5728 u32 perms;
5729
5730 switch (cmd) {
5731 case IPC_INFO:
5732 case SEM_INFO:
5733 /* No specific object, just general system-wide information. */
5734 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5735 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5736 case GETPID:
5737 case GETNCNT:
5738 case GETZCNT:
5739 perms = SEM__GETATTR;
5740 break;
5741 case GETVAL:
5742 case GETALL:
5743 perms = SEM__READ;
5744 break;
5745 case SETVAL:
5746 case SETALL:
5747 perms = SEM__WRITE;
5748 break;
5749 case IPC_RMID:
5750 perms = SEM__DESTROY;
5751 break;
5752 case IPC_SET:
5753 perms = SEM__SETATTR;
5754 break;
5755 case IPC_STAT:
5756 case SEM_STAT:
5757 perms = SEM__GETATTR | SEM__ASSOCIATE;
5758 break;
5759 default:
5760 return 0;
5761 }
5762
5763 err = ipc_has_perm(&sma->sem_perm, perms);
5764 return err;
5765 }
5766
5767 static int selinux_sem_semop(struct sem_array *sma,
5768 struct sembuf *sops, unsigned nsops, int alter)
5769 {
5770 u32 perms;
5771
5772 if (alter)
5773 perms = SEM__READ | SEM__WRITE;
5774 else
5775 perms = SEM__READ;
5776
5777 return ipc_has_perm(&sma->sem_perm, perms);
5778 }
5779
5780 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5781 {
5782 u32 av = 0;
5783
5784 av = 0;
5785 if (flag & S_IRUGO)
5786 av |= IPC__UNIX_READ;
5787 if (flag & S_IWUGO)
5788 av |= IPC__UNIX_WRITE;
5789
5790 if (av == 0)
5791 return 0;
5792
5793 return ipc_has_perm(ipcp, av);
5794 }
5795
5796 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5797 {
5798 struct ipc_security_struct *isec = ipcp->security;
5799 *secid = isec->sid;
5800 }
5801
5802 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5803 {
5804 if (inode)
5805 inode_doinit_with_dentry(inode, dentry);
5806 }
5807
5808 static int selinux_getprocattr(struct task_struct *p,
5809 char *name, char **value)
5810 {
5811 const struct task_security_struct *__tsec;
5812 u32 sid;
5813 int error;
5814 unsigned len;
5815
5816 rcu_read_lock();
5817 __tsec = __task_cred(p)->security;
5818
5819 if (current != p) {
5820 error = avc_has_perm(current_sid(), __tsec->sid,
5821 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5822 if (error)
5823 goto bad;
5824 }
5825
5826 if (!strcmp(name, "current"))
5827 sid = __tsec->sid;
5828 else if (!strcmp(name, "prev"))
5829 sid = __tsec->osid;
5830 else if (!strcmp(name, "exec"))
5831 sid = __tsec->exec_sid;
5832 else if (!strcmp(name, "fscreate"))
5833 sid = __tsec->create_sid;
5834 else if (!strcmp(name, "keycreate"))
5835 sid = __tsec->keycreate_sid;
5836 else if (!strcmp(name, "sockcreate"))
5837 sid = __tsec->sockcreate_sid;
5838 else {
5839 error = -EINVAL;
5840 goto bad;
5841 }
5842 rcu_read_unlock();
5843
5844 if (!sid)
5845 return 0;
5846
5847 error = security_sid_to_context(sid, value, &len);
5848 if (error)
5849 return error;
5850 return len;
5851
5852 bad:
5853 rcu_read_unlock();
5854 return error;
5855 }
5856
5857 static int selinux_setprocattr(const char *name, void *value, size_t size)
5858 {
5859 struct task_security_struct *tsec;
5860 struct cred *new;
5861 u32 mysid = current_sid(), sid = 0, ptsid;
5862 int error;
5863 char *str = value;
5864
5865 /*
5866 * Basic control over ability to set these attributes at all.
5867 */
5868 if (!strcmp(name, "exec"))
5869 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5870 PROCESS__SETEXEC, NULL);
5871 else if (!strcmp(name, "fscreate"))
5872 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5873 PROCESS__SETFSCREATE, NULL);
5874 else if (!strcmp(name, "keycreate"))
5875 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5876 PROCESS__SETKEYCREATE, NULL);
5877 else if (!strcmp(name, "sockcreate"))
5878 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5879 PROCESS__SETSOCKCREATE, NULL);
5880 else if (!strcmp(name, "current"))
5881 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5882 PROCESS__SETCURRENT, NULL);
5883 else
5884 error = -EINVAL;
5885 if (error)
5886 return error;
5887
5888 /* Obtain a SID for the context, if one was specified. */
5889 if (size && str[0] && str[0] != '\n') {
5890 if (str[size-1] == '\n') {
5891 str[size-1] = 0;
5892 size--;
5893 }
5894 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5895 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5896 if (!capable(CAP_MAC_ADMIN)) {
5897 struct audit_buffer *ab;
5898 size_t audit_size;
5899
5900 /* We strip a nul only if it is at the end, otherwise the
5901 * context contains a nul and we should audit that */
5902 if (str[size - 1] == '\0')
5903 audit_size = size - 1;
5904 else
5905 audit_size = size;
5906 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5907 audit_log_format(ab, "op=fscreate invalid_context=");
5908 audit_log_n_untrustedstring(ab, value, audit_size);
5909 audit_log_end(ab);
5910
5911 return error;
5912 }
5913 error = security_context_to_sid_force(value, size,
5914 &sid);
5915 }
5916 if (error)
5917 return error;
5918 }
5919
5920 new = prepare_creds();
5921 if (!new)
5922 return -ENOMEM;
5923
5924 /* Permission checking based on the specified context is
5925 performed during the actual operation (execve,
5926 open/mkdir/...), when we know the full context of the
5927 operation. See selinux_bprm_set_creds for the execve
5928 checks and may_create for the file creation checks. The
5929 operation will then fail if the context is not permitted. */
5930 tsec = new->security;
5931 if (!strcmp(name, "exec")) {
5932 tsec->exec_sid = sid;
5933 } else if (!strcmp(name, "fscreate")) {
5934 tsec->create_sid = sid;
5935 } else if (!strcmp(name, "keycreate")) {
5936 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5937 NULL);
5938 if (error)
5939 goto abort_change;
5940 tsec->keycreate_sid = sid;
5941 } else if (!strcmp(name, "sockcreate")) {
5942 tsec->sockcreate_sid = sid;
5943 } else if (!strcmp(name, "current")) {
5944 error = -EINVAL;
5945 if (sid == 0)
5946 goto abort_change;
5947
5948 /* Only allow single threaded processes to change context */
5949 error = -EPERM;
5950 if (!current_is_single_threaded()) {
5951 error = security_bounded_transition(tsec->sid, sid);
5952 if (error)
5953 goto abort_change;
5954 }
5955
5956 /* Check permissions for the transition. */
5957 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5958 PROCESS__DYNTRANSITION, NULL);
5959 if (error)
5960 goto abort_change;
5961
5962 /* Check for ptracing, and update the task SID if ok.
5963 Otherwise, leave SID unchanged and fail. */
5964 ptsid = ptrace_parent_sid();
5965 if (ptsid != 0) {
5966 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5967 PROCESS__PTRACE, NULL);
5968 if (error)
5969 goto abort_change;
5970 }
5971
5972 tsec->sid = sid;
5973 } else {
5974 error = -EINVAL;
5975 goto abort_change;
5976 }
5977
5978 commit_creds(new);
5979 return size;
5980
5981 abort_change:
5982 abort_creds(new);
5983 return error;
5984 }
5985
5986 static int selinux_ismaclabel(const char *name)
5987 {
5988 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5989 }
5990
5991 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5992 {
5993 return security_sid_to_context(secid, secdata, seclen);
5994 }
5995
5996 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5997 {
5998 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5999 }
6000
6001 static void selinux_release_secctx(char *secdata, u32 seclen)
6002 {
6003 kfree(secdata);
6004 }
6005
6006 static void selinux_inode_invalidate_secctx(struct inode *inode)
6007 {
6008 struct inode_security_struct *isec = inode->i_security;
6009
6010 spin_lock(&isec->lock);
6011 isec->initialized = LABEL_INVALID;
6012 spin_unlock(&isec->lock);
6013 }
6014
6015 /*
6016 * called with inode->i_mutex locked
6017 */
6018 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6019 {
6020 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6021 }
6022
6023 /*
6024 * called with inode->i_mutex locked
6025 */
6026 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6027 {
6028 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6029 }
6030
6031 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6032 {
6033 int len = 0;
6034 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6035 ctx, true);
6036 if (len < 0)
6037 return len;
6038 *ctxlen = len;
6039 return 0;
6040 }
6041 #ifdef CONFIG_KEYS
6042
6043 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6044 unsigned long flags)
6045 {
6046 const struct task_security_struct *tsec;
6047 struct key_security_struct *ksec;
6048
6049 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6050 if (!ksec)
6051 return -ENOMEM;
6052
6053 tsec = cred->security;
6054 if (tsec->keycreate_sid)
6055 ksec->sid = tsec->keycreate_sid;
6056 else
6057 ksec->sid = tsec->sid;
6058
6059 k->security = ksec;
6060 return 0;
6061 }
6062
6063 static void selinux_key_free(struct key *k)
6064 {
6065 struct key_security_struct *ksec = k->security;
6066
6067 k->security = NULL;
6068 kfree(ksec);
6069 }
6070
6071 static int selinux_key_permission(key_ref_t key_ref,
6072 const struct cred *cred,
6073 unsigned perm)
6074 {
6075 struct key *key;
6076 struct key_security_struct *ksec;
6077 u32 sid;
6078
6079 /* if no specific permissions are requested, we skip the
6080 permission check. No serious, additional covert channels
6081 appear to be created. */
6082 if (perm == 0)
6083 return 0;
6084
6085 sid = cred_sid(cred);
6086
6087 key = key_ref_to_ptr(key_ref);
6088 ksec = key->security;
6089
6090 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6091 }
6092
6093 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6094 {
6095 struct key_security_struct *ksec = key->security;
6096 char *context = NULL;
6097 unsigned len;
6098 int rc;
6099
6100 rc = security_sid_to_context(ksec->sid, &context, &len);
6101 if (!rc)
6102 rc = len;
6103 *_buffer = context;
6104 return rc;
6105 }
6106
6107 #endif
6108
6109 static struct security_hook_list selinux_hooks[] = {
6110 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6111 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6112 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6113 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6114
6115 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6116 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6117 LSM_HOOK_INIT(capget, selinux_capget),
6118 LSM_HOOK_INIT(capset, selinux_capset),
6119 LSM_HOOK_INIT(capable, selinux_capable),
6120 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6121 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6122 LSM_HOOK_INIT(syslog, selinux_syslog),
6123 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6124
6125 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6126
6127 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6128 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6129 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6130 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6131
6132 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6133 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6134 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6135 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6136 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6137 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6138 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6139 LSM_HOOK_INIT(sb_mount, selinux_mount),
6140 LSM_HOOK_INIT(sb_umount, selinux_umount),
6141 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6142 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6143 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6144
6145 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6146 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6147
6148 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6149 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6150 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6151 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6152 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6153 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6154 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6155 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6156 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6157 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6158 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6159 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6160 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6161 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6162 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6163 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6164 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6165 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6166 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6167 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6168 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6169 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6170 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6171 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6172 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6173 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6174 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6175
6176 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6177 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6178 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6179 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6180 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6181 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6182 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6183 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6184 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6185 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6186 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6187 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6188
6189 LSM_HOOK_INIT(file_open, selinux_file_open),
6190
6191 LSM_HOOK_INIT(task_create, selinux_task_create),
6192 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6193 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6194 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6195 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6196 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6197 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6198 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6199 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6200 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6201 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6202 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6203 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6204 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6205 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6206 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6207 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6208 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6209 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6210 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6211 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6212 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6213
6214 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6215 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6216
6217 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6218 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6219
6220 LSM_HOOK_INIT(msg_queue_alloc_security,
6221 selinux_msg_queue_alloc_security),
6222 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6223 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6224 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6225 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6226 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6227
6228 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6229 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6230 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6231 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6232 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6233
6234 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6235 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6236 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6237 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6238 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6239
6240 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6241
6242 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6243 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6244
6245 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6246 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6247 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6248 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6249 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6250 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6251 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6252 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6253
6254 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6255 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6256
6257 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6258 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6259 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6260 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6261 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6262 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6263 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6264 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6265 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6266 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6267 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6268 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6269 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6270 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6271 LSM_HOOK_INIT(socket_getpeersec_stream,
6272 selinux_socket_getpeersec_stream),
6273 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6274 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6275 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6276 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6277 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6278 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6279 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6280 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6281 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6282 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6283 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6284 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6285 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6286 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6287 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6288 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6289 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6290 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6291 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6292
6293 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6294 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6295 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6296 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6297 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6298 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6299 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6300 selinux_xfrm_state_alloc_acquire),
6301 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6302 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6303 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6304 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6305 selinux_xfrm_state_pol_flow_match),
6306 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6307 #endif
6308
6309 #ifdef CONFIG_KEYS
6310 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6311 LSM_HOOK_INIT(key_free, selinux_key_free),
6312 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6313 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6314 #endif
6315
6316 #ifdef CONFIG_AUDIT
6317 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6318 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6319 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6320 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6321 #endif
6322 };
6323
6324 static __init int selinux_init(void)
6325 {
6326 if (!security_module_enable("selinux")) {
6327 selinux_enabled = 0;
6328 return 0;
6329 }
6330
6331 if (!selinux_enabled) {
6332 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6333 return 0;
6334 }
6335
6336 printk(KERN_INFO "SELinux: Initializing.\n");
6337
6338 /* Set the security state for the initial task. */
6339 cred_init_security();
6340
6341 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6342
6343 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6344 sizeof(struct inode_security_struct),
6345 0, SLAB_PANIC, NULL);
6346 file_security_cache = kmem_cache_create("selinux_file_security",
6347 sizeof(struct file_security_struct),
6348 0, SLAB_PANIC, NULL);
6349 avc_init();
6350
6351 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6352
6353 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6354 panic("SELinux: Unable to register AVC netcache callback\n");
6355
6356 if (selinux_enforcing)
6357 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6358 else
6359 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6360
6361 return 0;
6362 }
6363
6364 static void delayed_superblock_init(struct super_block *sb, void *unused)
6365 {
6366 superblock_doinit(sb, NULL);
6367 }
6368
6369 void selinux_complete_init(void)
6370 {
6371 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6372
6373 /* Set up any superblocks initialized prior to the policy load. */
6374 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6375 iterate_supers(delayed_superblock_init, NULL);
6376 }
6377
6378 /* SELinux requires early initialization in order to label
6379 all processes and objects when they are created. */
6380 security_initcall(selinux_init);
6381
6382 #if defined(CONFIG_NETFILTER)
6383
6384 static struct nf_hook_ops selinux_nf_ops[] = {
6385 {
6386 .hook = selinux_ipv4_postroute,
6387 .pf = NFPROTO_IPV4,
6388 .hooknum = NF_INET_POST_ROUTING,
6389 .priority = NF_IP_PRI_SELINUX_LAST,
6390 },
6391 {
6392 .hook = selinux_ipv4_forward,
6393 .pf = NFPROTO_IPV4,
6394 .hooknum = NF_INET_FORWARD,
6395 .priority = NF_IP_PRI_SELINUX_FIRST,
6396 },
6397 {
6398 .hook = selinux_ipv4_output,
6399 .pf = NFPROTO_IPV4,
6400 .hooknum = NF_INET_LOCAL_OUT,
6401 .priority = NF_IP_PRI_SELINUX_FIRST,
6402 },
6403 #if IS_ENABLED(CONFIG_IPV6)
6404 {
6405 .hook = selinux_ipv6_postroute,
6406 .pf = NFPROTO_IPV6,
6407 .hooknum = NF_INET_POST_ROUTING,
6408 .priority = NF_IP6_PRI_SELINUX_LAST,
6409 },
6410 {
6411 .hook = selinux_ipv6_forward,
6412 .pf = NFPROTO_IPV6,
6413 .hooknum = NF_INET_FORWARD,
6414 .priority = NF_IP6_PRI_SELINUX_FIRST,
6415 },
6416 {
6417 .hook = selinux_ipv6_output,
6418 .pf = NFPROTO_IPV6,
6419 .hooknum = NF_INET_LOCAL_OUT,
6420 .priority = NF_IP6_PRI_SELINUX_FIRST,
6421 },
6422 #endif /* IPV6 */
6423 };
6424
6425 static int __init selinux_nf_ip_init(void)
6426 {
6427 int err;
6428
6429 if (!selinux_enabled)
6430 return 0;
6431
6432 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6433
6434 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6435 if (err)
6436 panic("SELinux: nf_register_hooks: error %d\n", err);
6437
6438 return 0;
6439 }
6440
6441 __initcall(selinux_nf_ip_init);
6442
6443 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6444 static void selinux_nf_ip_exit(void)
6445 {
6446 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6447
6448 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6449 }
6450 #endif
6451
6452 #else /* CONFIG_NETFILTER */
6453
6454 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6455 #define selinux_nf_ip_exit()
6456 #endif
6457
6458 #endif /* CONFIG_NETFILTER */
6459
6460 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6461 static int selinux_disabled;
6462
6463 int selinux_disable(void)
6464 {
6465 if (ss_initialized) {
6466 /* Not permitted after initial policy load. */
6467 return -EINVAL;
6468 }
6469
6470 if (selinux_disabled) {
6471 /* Only do this once. */
6472 return -EINVAL;
6473 }
6474
6475 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6476
6477 selinux_disabled = 1;
6478 selinux_enabled = 0;
6479
6480 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6481
6482 /* Try to destroy the avc node cache */
6483 avc_disable();
6484
6485 /* Unregister netfilter hooks. */
6486 selinux_nf_ip_exit();
6487
6488 /* Unregister selinuxfs. */
6489 exit_sel_fs();
6490
6491 return 0;
6492 }
6493 #endif
ubuntu-bionic-kernel mirror