]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[mirror_ubuntu-bionic-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <linux/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
86
87 #include "avc.h"
88 #include "objsec.h"
89 #include "netif.h"
90 #include "netnode.h"
91 #include "netport.h"
92 #include "xfrm.h"
93 #include "netlabel.h"
94 #include "audit.h"
95 #include "avc_ss.h"
96
97 #define NUM_SEL_MNT_OPTS 5
98
99 extern struct security_operations *security_ops;
100
101 /* SECMARK reference count */
102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
103
104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
105 int selinux_enforcing;
106
107 static int __init enforcing_setup(char *str)
108 {
109 unsigned long enforcing;
110 if (!strict_strtoul(str, 0, &enforcing))
111 selinux_enforcing = enforcing ? 1 : 0;
112 return 1;
113 }
114 __setup("enforcing=", enforcing_setup);
115 #endif
116
117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
119
120 static int __init selinux_enabled_setup(char *str)
121 {
122 unsigned long enabled;
123 if (!strict_strtoul(str, 0, &enabled))
124 selinux_enabled = enabled ? 1 : 0;
125 return 1;
126 }
127 __setup("selinux=", selinux_enabled_setup);
128 #else
129 int selinux_enabled = 1;
130 #endif
131
132 static struct kmem_cache *sel_inode_cache;
133
134 /**
135 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
136 *
137 * Description:
138 * This function checks the SECMARK reference counter to see if any SECMARK
139 * targets are currently configured, if the reference counter is greater than
140 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
141 * enabled, false (0) if SECMARK is disabled.
142 *
143 */
144 static int selinux_secmark_enabled(void)
145 {
146 return (atomic_read(&selinux_secmark_refcount) > 0);
147 }
148
149 /*
150 * initialise the security for the init task
151 */
152 static void cred_init_security(void)
153 {
154 struct cred *cred = (struct cred *) current->real_cred;
155 struct task_security_struct *tsec;
156
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
158 if (!tsec)
159 panic("SELinux: Failed to initialize initial task.\n");
160
161 tsec->osid = tsec->sid = SECINITSID_KERNEL;
162 cred->security = tsec;
163 }
164
165 /*
166 * get the security ID of a set of credentials
167 */
168 static inline u32 cred_sid(const struct cred *cred)
169 {
170 const struct task_security_struct *tsec;
171
172 tsec = cred->security;
173 return tsec->sid;
174 }
175
176 /*
177 * get the objective security ID of a task
178 */
179 static inline u32 task_sid(const struct task_struct *task)
180 {
181 u32 sid;
182
183 rcu_read_lock();
184 sid = cred_sid(__task_cred(task));
185 rcu_read_unlock();
186 return sid;
187 }
188
189 /*
190 * get the subjective security ID of the current task
191 */
192 static inline u32 current_sid(void)
193 {
194 const struct task_security_struct *tsec = current_security();
195
196 return tsec->sid;
197 }
198
199 /* Allocate and free functions for each kind of security blob. */
200
201 static int inode_alloc_security(struct inode *inode)
202 {
203 struct inode_security_struct *isec;
204 u32 sid = current_sid();
205
206 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
207 if (!isec)
208 return -ENOMEM;
209
210 mutex_init(&isec->lock);
211 INIT_LIST_HEAD(&isec->list);
212 isec->inode = inode;
213 isec->sid = SECINITSID_UNLABELED;
214 isec->sclass = SECCLASS_FILE;
215 isec->task_sid = sid;
216 inode->i_security = isec;
217
218 return 0;
219 }
220
221 static void inode_free_security(struct inode *inode)
222 {
223 struct inode_security_struct *isec = inode->i_security;
224 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
225
226 spin_lock(&sbsec->isec_lock);
227 if (!list_empty(&isec->list))
228 list_del_init(&isec->list);
229 spin_unlock(&sbsec->isec_lock);
230
231 inode->i_security = NULL;
232 kmem_cache_free(sel_inode_cache, isec);
233 }
234
235 static int file_alloc_security(struct file *file)
236 {
237 struct file_security_struct *fsec;
238 u32 sid = current_sid();
239
240 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
241 if (!fsec)
242 return -ENOMEM;
243
244 fsec->sid = sid;
245 fsec->fown_sid = sid;
246 file->f_security = fsec;
247
248 return 0;
249 }
250
251 static void file_free_security(struct file *file)
252 {
253 struct file_security_struct *fsec = file->f_security;
254 file->f_security = NULL;
255 kfree(fsec);
256 }
257
258 static int superblock_alloc_security(struct super_block *sb)
259 {
260 struct superblock_security_struct *sbsec;
261
262 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
263 if (!sbsec)
264 return -ENOMEM;
265
266 mutex_init(&sbsec->lock);
267 INIT_LIST_HEAD(&sbsec->isec_head);
268 spin_lock_init(&sbsec->isec_lock);
269 sbsec->sb = sb;
270 sbsec->sid = SECINITSID_UNLABELED;
271 sbsec->def_sid = SECINITSID_FILE;
272 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
273 sb->s_security = sbsec;
274
275 return 0;
276 }
277
278 static void superblock_free_security(struct super_block *sb)
279 {
280 struct superblock_security_struct *sbsec = sb->s_security;
281 sb->s_security = NULL;
282 kfree(sbsec);
283 }
284
285 /* The file system's label must be initialized prior to use. */
286
287 static const char *labeling_behaviors[6] = {
288 "uses xattr",
289 "uses transition SIDs",
290 "uses task SIDs",
291 "uses genfs_contexts",
292 "not configured for labeling",
293 "uses mountpoint labeling",
294 };
295
296 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
297
298 static inline int inode_doinit(struct inode *inode)
299 {
300 return inode_doinit_with_dentry(inode, NULL);
301 }
302
303 enum {
304 Opt_error = -1,
305 Opt_context = 1,
306 Opt_fscontext = 2,
307 Opt_defcontext = 3,
308 Opt_rootcontext = 4,
309 Opt_labelsupport = 5,
310 };
311
312 static const match_table_t tokens = {
313 {Opt_context, CONTEXT_STR "%s"},
314 {Opt_fscontext, FSCONTEXT_STR "%s"},
315 {Opt_defcontext, DEFCONTEXT_STR "%s"},
316 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
317 {Opt_labelsupport, LABELSUPP_STR},
318 {Opt_error, NULL},
319 };
320
321 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
322
323 static int may_context_mount_sb_relabel(u32 sid,
324 struct superblock_security_struct *sbsec,
325 const struct cred *cred)
326 {
327 const struct task_security_struct *tsec = cred->security;
328 int rc;
329
330 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
331 FILESYSTEM__RELABELFROM, NULL);
332 if (rc)
333 return rc;
334
335 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
336 FILESYSTEM__RELABELTO, NULL);
337 return rc;
338 }
339
340 static int may_context_mount_inode_relabel(u32 sid,
341 struct superblock_security_struct *sbsec,
342 const struct cred *cred)
343 {
344 const struct task_security_struct *tsec = cred->security;
345 int rc;
346 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELFROM, NULL);
348 if (rc)
349 return rc;
350
351 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
352 FILESYSTEM__ASSOCIATE, NULL);
353 return rc;
354 }
355
356 static int sb_finish_set_opts(struct super_block *sb)
357 {
358 struct superblock_security_struct *sbsec = sb->s_security;
359 struct dentry *root = sb->s_root;
360 struct inode *root_inode = root->d_inode;
361 int rc = 0;
362
363 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
364 /* Make sure that the xattr handler exists and that no
365 error other than -ENODATA is returned by getxattr on
366 the root directory. -ENODATA is ok, as this may be
367 the first boot of the SELinux kernel before we have
368 assigned xattr values to the filesystem. */
369 if (!root_inode->i_op->getxattr) {
370 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
371 "xattr support\n", sb->s_id, sb->s_type->name);
372 rc = -EOPNOTSUPP;
373 goto out;
374 }
375 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
376 if (rc < 0 && rc != -ENODATA) {
377 if (rc == -EOPNOTSUPP)
378 printk(KERN_WARNING "SELinux: (dev %s, type "
379 "%s) has no security xattr handler\n",
380 sb->s_id, sb->s_type->name);
381 else
382 printk(KERN_WARNING "SELinux: (dev %s, type "
383 "%s) getxattr errno %d\n", sb->s_id,
384 sb->s_type->name, -rc);
385 goto out;
386 }
387 }
388
389 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
390
391 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
392 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
393 sb->s_id, sb->s_type->name);
394 else
395 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
396 sb->s_id, sb->s_type->name,
397 labeling_behaviors[sbsec->behavior-1]);
398
399 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
400 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
401 sbsec->behavior == SECURITY_FS_USE_NONE ||
402 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
403 sbsec->flags &= ~SE_SBLABELSUPP;
404
405 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
406 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
407 sbsec->flags |= SE_SBLABELSUPP;
408
409 /* Initialize the root inode. */
410 rc = inode_doinit_with_dentry(root_inode, root);
411
412 /* Initialize any other inodes associated with the superblock, e.g.
413 inodes created prior to initial policy load or inodes created
414 during get_sb by a pseudo filesystem that directly
415 populates itself. */
416 spin_lock(&sbsec->isec_lock);
417 next_inode:
418 if (!list_empty(&sbsec->isec_head)) {
419 struct inode_security_struct *isec =
420 list_entry(sbsec->isec_head.next,
421 struct inode_security_struct, list);
422 struct inode *inode = isec->inode;
423 spin_unlock(&sbsec->isec_lock);
424 inode = igrab(inode);
425 if (inode) {
426 if (!IS_PRIVATE(inode))
427 inode_doinit(inode);
428 iput(inode);
429 }
430 spin_lock(&sbsec->isec_lock);
431 list_del_init(&isec->list);
432 goto next_inode;
433 }
434 spin_unlock(&sbsec->isec_lock);
435 out:
436 return rc;
437 }
438
439 /*
440 * This function should allow an FS to ask what it's mount security
441 * options were so it can use those later for submounts, displaying
442 * mount options, or whatever.
443 */
444 static int selinux_get_mnt_opts(const struct super_block *sb,
445 struct security_mnt_opts *opts)
446 {
447 int rc = 0, i;
448 struct superblock_security_struct *sbsec = sb->s_security;
449 char *context = NULL;
450 u32 len;
451 char tmp;
452
453 security_init_mnt_opts(opts);
454
455 if (!(sbsec->flags & SE_SBINITIALIZED))
456 return -EINVAL;
457
458 if (!ss_initialized)
459 return -EINVAL;
460
461 tmp = sbsec->flags & SE_MNTMASK;
462 /* count the number of mount options for this sb */
463 for (i = 0; i < 8; i++) {
464 if (tmp & 0x01)
465 opts->num_mnt_opts++;
466 tmp >>= 1;
467 }
468 /* Check if the Label support flag is set */
469 if (sbsec->flags & SE_SBLABELSUPP)
470 opts->num_mnt_opts++;
471
472 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
473 if (!opts->mnt_opts) {
474 rc = -ENOMEM;
475 goto out_free;
476 }
477
478 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
479 if (!opts->mnt_opts_flags) {
480 rc = -ENOMEM;
481 goto out_free;
482 }
483
484 i = 0;
485 if (sbsec->flags & FSCONTEXT_MNT) {
486 rc = security_sid_to_context(sbsec->sid, &context, &len);
487 if (rc)
488 goto out_free;
489 opts->mnt_opts[i] = context;
490 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
491 }
492 if (sbsec->flags & CONTEXT_MNT) {
493 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
494 if (rc)
495 goto out_free;
496 opts->mnt_opts[i] = context;
497 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
498 }
499 if (sbsec->flags & DEFCONTEXT_MNT) {
500 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
501 if (rc)
502 goto out_free;
503 opts->mnt_opts[i] = context;
504 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
505 }
506 if (sbsec->flags & ROOTCONTEXT_MNT) {
507 struct inode *root = sbsec->sb->s_root->d_inode;
508 struct inode_security_struct *isec = root->i_security;
509
510 rc = security_sid_to_context(isec->sid, &context, &len);
511 if (rc)
512 goto out_free;
513 opts->mnt_opts[i] = context;
514 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
515 }
516 if (sbsec->flags & SE_SBLABELSUPP) {
517 opts->mnt_opts[i] = NULL;
518 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
519 }
520
521 BUG_ON(i != opts->num_mnt_opts);
522
523 return 0;
524
525 out_free:
526 security_free_mnt_opts(opts);
527 return rc;
528 }
529
530 static int bad_option(struct superblock_security_struct *sbsec, char flag,
531 u32 old_sid, u32 new_sid)
532 {
533 char mnt_flags = sbsec->flags & SE_MNTMASK;
534
535 /* check if the old mount command had the same options */
536 if (sbsec->flags & SE_SBINITIALIZED)
537 if (!(sbsec->flags & flag) ||
538 (old_sid != new_sid))
539 return 1;
540
541 /* check if we were passed the same options twice,
542 * aka someone passed context=a,context=b
543 */
544 if (!(sbsec->flags & SE_SBINITIALIZED))
545 if (mnt_flags & flag)
546 return 1;
547 return 0;
548 }
549
550 /*
551 * Allow filesystems with binary mount data to explicitly set mount point
552 * labeling information.
553 */
554 static int selinux_set_mnt_opts(struct super_block *sb,
555 struct security_mnt_opts *opts)
556 {
557 const struct cred *cred = current_cred();
558 int rc = 0, i;
559 struct superblock_security_struct *sbsec = sb->s_security;
560 const char *name = sb->s_type->name;
561 struct inode *inode = sbsec->sb->s_root->d_inode;
562 struct inode_security_struct *root_isec = inode->i_security;
563 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
564 u32 defcontext_sid = 0;
565 char **mount_options = opts->mnt_opts;
566 int *flags = opts->mnt_opts_flags;
567 int num_opts = opts->num_mnt_opts;
568
569 mutex_lock(&sbsec->lock);
570
571 if (!ss_initialized) {
572 if (!num_opts) {
573 /* Defer initialization until selinux_complete_init,
574 after the initial policy is loaded and the security
575 server is ready to handle calls. */
576 goto out;
577 }
578 rc = -EINVAL;
579 printk(KERN_WARNING "SELinux: Unable to set superblock options "
580 "before the security server is initialized\n");
581 goto out;
582 }
583
584 /*
585 * Binary mount data FS will come through this function twice. Once
586 * from an explicit call and once from the generic calls from the vfs.
587 * Since the generic VFS calls will not contain any security mount data
588 * we need to skip the double mount verification.
589 *
590 * This does open a hole in which we will not notice if the first
591 * mount using this sb set explict options and a second mount using
592 * this sb does not set any security options. (The first options
593 * will be used for both mounts)
594 */
595 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
596 && (num_opts == 0))
597 goto out;
598
599 /*
600 * parse the mount options, check if they are valid sids.
601 * also check if someone is trying to mount the same sb more
602 * than once with different security options.
603 */
604 for (i = 0; i < num_opts; i++) {
605 u32 sid;
606
607 if (flags[i] == SE_SBLABELSUPP)
608 continue;
609 rc = security_context_to_sid(mount_options[i],
610 strlen(mount_options[i]), &sid);
611 if (rc) {
612 printk(KERN_WARNING "SELinux: security_context_to_sid"
613 "(%s) failed for (dev %s, type %s) errno=%d\n",
614 mount_options[i], sb->s_id, name, rc);
615 goto out;
616 }
617 switch (flags[i]) {
618 case FSCONTEXT_MNT:
619 fscontext_sid = sid;
620
621 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
622 fscontext_sid))
623 goto out_double_mount;
624
625 sbsec->flags |= FSCONTEXT_MNT;
626 break;
627 case CONTEXT_MNT:
628 context_sid = sid;
629
630 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
631 context_sid))
632 goto out_double_mount;
633
634 sbsec->flags |= CONTEXT_MNT;
635 break;
636 case ROOTCONTEXT_MNT:
637 rootcontext_sid = sid;
638
639 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
640 rootcontext_sid))
641 goto out_double_mount;
642
643 sbsec->flags |= ROOTCONTEXT_MNT;
644
645 break;
646 case DEFCONTEXT_MNT:
647 defcontext_sid = sid;
648
649 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
650 defcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= DEFCONTEXT_MNT;
654
655 break;
656 default:
657 rc = -EINVAL;
658 goto out;
659 }
660 }
661
662 if (sbsec->flags & SE_SBINITIALIZED) {
663 /* previously mounted with options, but not on this attempt? */
664 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
665 goto out_double_mount;
666 rc = 0;
667 goto out;
668 }
669
670 if (strcmp(sb->s_type->name, "proc") == 0)
671 sbsec->flags |= SE_SBPROC;
672
673 /* Determine the labeling behavior to use for this filesystem type. */
674 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
675 if (rc) {
676 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
677 __func__, sb->s_type->name, rc);
678 goto out;
679 }
680
681 /* sets the context of the superblock for the fs being mounted. */
682 if (fscontext_sid) {
683 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
684 if (rc)
685 goto out;
686
687 sbsec->sid = fscontext_sid;
688 }
689
690 /*
691 * Switch to using mount point labeling behavior.
692 * sets the label used on all file below the mountpoint, and will set
693 * the superblock context if not already set.
694 */
695 if (context_sid) {
696 if (!fscontext_sid) {
697 rc = may_context_mount_sb_relabel(context_sid, sbsec,
698 cred);
699 if (rc)
700 goto out;
701 sbsec->sid = context_sid;
702 } else {
703 rc = may_context_mount_inode_relabel(context_sid, sbsec,
704 cred);
705 if (rc)
706 goto out;
707 }
708 if (!rootcontext_sid)
709 rootcontext_sid = context_sid;
710
711 sbsec->mntpoint_sid = context_sid;
712 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
713 }
714
715 if (rootcontext_sid) {
716 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
717 cred);
718 if (rc)
719 goto out;
720
721 root_isec->sid = rootcontext_sid;
722 root_isec->initialized = 1;
723 }
724
725 if (defcontext_sid) {
726 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
727 rc = -EINVAL;
728 printk(KERN_WARNING "SELinux: defcontext option is "
729 "invalid for this filesystem type\n");
730 goto out;
731 }
732
733 if (defcontext_sid != sbsec->def_sid) {
734 rc = may_context_mount_inode_relabel(defcontext_sid,
735 sbsec, cred);
736 if (rc)
737 goto out;
738 }
739
740 sbsec->def_sid = defcontext_sid;
741 }
742
743 rc = sb_finish_set_opts(sb);
744 out:
745 mutex_unlock(&sbsec->lock);
746 return rc;
747 out_double_mount:
748 rc = -EINVAL;
749 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
750 "security settings for (dev %s, type %s)\n", sb->s_id, name);
751 goto out;
752 }
753
754 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
755 struct super_block *newsb)
756 {
757 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
758 struct superblock_security_struct *newsbsec = newsb->s_security;
759
760 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
761 int set_context = (oldsbsec->flags & CONTEXT_MNT);
762 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
763
764 /*
765 * if the parent was able to be mounted it clearly had no special lsm
766 * mount options. thus we can safely deal with this superblock later
767 */
768 if (!ss_initialized)
769 return;
770
771 /* how can we clone if the old one wasn't set up?? */
772 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
773
774 /* if fs is reusing a sb, just let its options stand... */
775 if (newsbsec->flags & SE_SBINITIALIZED)
776 return;
777
778 mutex_lock(&newsbsec->lock);
779
780 newsbsec->flags = oldsbsec->flags;
781
782 newsbsec->sid = oldsbsec->sid;
783 newsbsec->def_sid = oldsbsec->def_sid;
784 newsbsec->behavior = oldsbsec->behavior;
785
786 if (set_context) {
787 u32 sid = oldsbsec->mntpoint_sid;
788
789 if (!set_fscontext)
790 newsbsec->sid = sid;
791 if (!set_rootcontext) {
792 struct inode *newinode = newsb->s_root->d_inode;
793 struct inode_security_struct *newisec = newinode->i_security;
794 newisec->sid = sid;
795 }
796 newsbsec->mntpoint_sid = sid;
797 }
798 if (set_rootcontext) {
799 const struct inode *oldinode = oldsb->s_root->d_inode;
800 const struct inode_security_struct *oldisec = oldinode->i_security;
801 struct inode *newinode = newsb->s_root->d_inode;
802 struct inode_security_struct *newisec = newinode->i_security;
803
804 newisec->sid = oldisec->sid;
805 }
806
807 sb_finish_set_opts(newsb);
808 mutex_unlock(&newsbsec->lock);
809 }
810
811 static int selinux_parse_opts_str(char *options,
812 struct security_mnt_opts *opts)
813 {
814 char *p;
815 char *context = NULL, *defcontext = NULL;
816 char *fscontext = NULL, *rootcontext = NULL;
817 int rc, num_mnt_opts = 0;
818
819 opts->num_mnt_opts = 0;
820
821 /* Standard string-based options. */
822 while ((p = strsep(&options, "|")) != NULL) {
823 int token;
824 substring_t args[MAX_OPT_ARGS];
825
826 if (!*p)
827 continue;
828
829 token = match_token(p, tokens, args);
830
831 switch (token) {
832 case Opt_context:
833 if (context || defcontext) {
834 rc = -EINVAL;
835 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
836 goto out_err;
837 }
838 context = match_strdup(&args[0]);
839 if (!context) {
840 rc = -ENOMEM;
841 goto out_err;
842 }
843 break;
844
845 case Opt_fscontext:
846 if (fscontext) {
847 rc = -EINVAL;
848 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
849 goto out_err;
850 }
851 fscontext = match_strdup(&args[0]);
852 if (!fscontext) {
853 rc = -ENOMEM;
854 goto out_err;
855 }
856 break;
857
858 case Opt_rootcontext:
859 if (rootcontext) {
860 rc = -EINVAL;
861 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
862 goto out_err;
863 }
864 rootcontext = match_strdup(&args[0]);
865 if (!rootcontext) {
866 rc = -ENOMEM;
867 goto out_err;
868 }
869 break;
870
871 case Opt_defcontext:
872 if (context || defcontext) {
873 rc = -EINVAL;
874 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
875 goto out_err;
876 }
877 defcontext = match_strdup(&args[0]);
878 if (!defcontext) {
879 rc = -ENOMEM;
880 goto out_err;
881 }
882 break;
883 case Opt_labelsupport:
884 break;
885 default:
886 rc = -EINVAL;
887 printk(KERN_WARNING "SELinux: unknown mount option\n");
888 goto out_err;
889
890 }
891 }
892
893 rc = -ENOMEM;
894 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
895 if (!opts->mnt_opts)
896 goto out_err;
897
898 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
899 if (!opts->mnt_opts_flags) {
900 kfree(opts->mnt_opts);
901 goto out_err;
902 }
903
904 if (fscontext) {
905 opts->mnt_opts[num_mnt_opts] = fscontext;
906 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
907 }
908 if (context) {
909 opts->mnt_opts[num_mnt_opts] = context;
910 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
911 }
912 if (rootcontext) {
913 opts->mnt_opts[num_mnt_opts] = rootcontext;
914 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
915 }
916 if (defcontext) {
917 opts->mnt_opts[num_mnt_opts] = defcontext;
918 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
919 }
920
921 opts->num_mnt_opts = num_mnt_opts;
922 return 0;
923
924 out_err:
925 kfree(context);
926 kfree(defcontext);
927 kfree(fscontext);
928 kfree(rootcontext);
929 return rc;
930 }
931 /*
932 * string mount options parsing and call set the sbsec
933 */
934 static int superblock_doinit(struct super_block *sb, void *data)
935 {
936 int rc = 0;
937 char *options = data;
938 struct security_mnt_opts opts;
939
940 security_init_mnt_opts(&opts);
941
942 if (!data)
943 goto out;
944
945 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
946
947 rc = selinux_parse_opts_str(options, &opts);
948 if (rc)
949 goto out_err;
950
951 out:
952 rc = selinux_set_mnt_opts(sb, &opts);
953
954 out_err:
955 security_free_mnt_opts(&opts);
956 return rc;
957 }
958
959 static void selinux_write_opts(struct seq_file *m,
960 struct security_mnt_opts *opts)
961 {
962 int i;
963 char *prefix;
964
965 for (i = 0; i < opts->num_mnt_opts; i++) {
966 char *has_comma;
967
968 if (opts->mnt_opts[i])
969 has_comma = strchr(opts->mnt_opts[i], ',');
970 else
971 has_comma = NULL;
972
973 switch (opts->mnt_opts_flags[i]) {
974 case CONTEXT_MNT:
975 prefix = CONTEXT_STR;
976 break;
977 case FSCONTEXT_MNT:
978 prefix = FSCONTEXT_STR;
979 break;
980 case ROOTCONTEXT_MNT:
981 prefix = ROOTCONTEXT_STR;
982 break;
983 case DEFCONTEXT_MNT:
984 prefix = DEFCONTEXT_STR;
985 break;
986 case SE_SBLABELSUPP:
987 seq_putc(m, ',');
988 seq_puts(m, LABELSUPP_STR);
989 continue;
990 default:
991 BUG();
992 return;
993 };
994 /* we need a comma before each option */
995 seq_putc(m, ',');
996 seq_puts(m, prefix);
997 if (has_comma)
998 seq_putc(m, '\"');
999 seq_puts(m, opts->mnt_opts[i]);
1000 if (has_comma)
1001 seq_putc(m, '\"');
1002 }
1003 }
1004
1005 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1006 {
1007 struct security_mnt_opts opts;
1008 int rc;
1009
1010 rc = selinux_get_mnt_opts(sb, &opts);
1011 if (rc) {
1012 /* before policy load we may get EINVAL, don't show anything */
1013 if (rc == -EINVAL)
1014 rc = 0;
1015 return rc;
1016 }
1017
1018 selinux_write_opts(m, &opts);
1019
1020 security_free_mnt_opts(&opts);
1021
1022 return rc;
1023 }
1024
1025 static inline u16 inode_mode_to_security_class(umode_t mode)
1026 {
1027 switch (mode & S_IFMT) {
1028 case S_IFSOCK:
1029 return SECCLASS_SOCK_FILE;
1030 case S_IFLNK:
1031 return SECCLASS_LNK_FILE;
1032 case S_IFREG:
1033 return SECCLASS_FILE;
1034 case S_IFBLK:
1035 return SECCLASS_BLK_FILE;
1036 case S_IFDIR:
1037 return SECCLASS_DIR;
1038 case S_IFCHR:
1039 return SECCLASS_CHR_FILE;
1040 case S_IFIFO:
1041 return SECCLASS_FIFO_FILE;
1042
1043 }
1044
1045 return SECCLASS_FILE;
1046 }
1047
1048 static inline int default_protocol_stream(int protocol)
1049 {
1050 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1051 }
1052
1053 static inline int default_protocol_dgram(int protocol)
1054 {
1055 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1056 }
1057
1058 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1059 {
1060 switch (family) {
1061 case PF_UNIX:
1062 switch (type) {
1063 case SOCK_STREAM:
1064 case SOCK_SEQPACKET:
1065 return SECCLASS_UNIX_STREAM_SOCKET;
1066 case SOCK_DGRAM:
1067 return SECCLASS_UNIX_DGRAM_SOCKET;
1068 }
1069 break;
1070 case PF_INET:
1071 case PF_INET6:
1072 switch (type) {
1073 case SOCK_STREAM:
1074 if (default_protocol_stream(protocol))
1075 return SECCLASS_TCP_SOCKET;
1076 else
1077 return SECCLASS_RAWIP_SOCKET;
1078 case SOCK_DGRAM:
1079 if (default_protocol_dgram(protocol))
1080 return SECCLASS_UDP_SOCKET;
1081 else
1082 return SECCLASS_RAWIP_SOCKET;
1083 case SOCK_DCCP:
1084 return SECCLASS_DCCP_SOCKET;
1085 default:
1086 return SECCLASS_RAWIP_SOCKET;
1087 }
1088 break;
1089 case PF_NETLINK:
1090 switch (protocol) {
1091 case NETLINK_ROUTE:
1092 return SECCLASS_NETLINK_ROUTE_SOCKET;
1093 case NETLINK_FIREWALL:
1094 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1095 case NETLINK_SOCK_DIAG:
1096 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1097 case NETLINK_NFLOG:
1098 return SECCLASS_NETLINK_NFLOG_SOCKET;
1099 case NETLINK_XFRM:
1100 return SECCLASS_NETLINK_XFRM_SOCKET;
1101 case NETLINK_SELINUX:
1102 return SECCLASS_NETLINK_SELINUX_SOCKET;
1103 case NETLINK_AUDIT:
1104 return SECCLASS_NETLINK_AUDIT_SOCKET;
1105 case NETLINK_IP6_FW:
1106 return SECCLASS_NETLINK_IP6FW_SOCKET;
1107 case NETLINK_DNRTMSG:
1108 return SECCLASS_NETLINK_DNRT_SOCKET;
1109 case NETLINK_KOBJECT_UEVENT:
1110 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1111 default:
1112 return SECCLASS_NETLINK_SOCKET;
1113 }
1114 case PF_PACKET:
1115 return SECCLASS_PACKET_SOCKET;
1116 case PF_KEY:
1117 return SECCLASS_KEY_SOCKET;
1118 case PF_APPLETALK:
1119 return SECCLASS_APPLETALK_SOCKET;
1120 }
1121
1122 return SECCLASS_SOCKET;
1123 }
1124
1125 #ifdef CONFIG_PROC_FS
1126 static int selinux_proc_get_sid(struct dentry *dentry,
1127 u16 tclass,
1128 u32 *sid)
1129 {
1130 int rc;
1131 char *buffer, *path;
1132
1133 buffer = (char *)__get_free_page(GFP_KERNEL);
1134 if (!buffer)
1135 return -ENOMEM;
1136
1137 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1138 if (IS_ERR(path))
1139 rc = PTR_ERR(path);
1140 else {
1141 /* each process gets a /proc/PID/ entry. Strip off the
1142 * PID part to get a valid selinux labeling.
1143 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1144 while (path[1] >= '0' && path[1] <= '9') {
1145 path[1] = '/';
1146 path++;
1147 }
1148 rc = security_genfs_sid("proc", path, tclass, sid);
1149 }
1150 free_page((unsigned long)buffer);
1151 return rc;
1152 }
1153 #else
1154 static int selinux_proc_get_sid(struct dentry *dentry,
1155 u16 tclass,
1156 u32 *sid)
1157 {
1158 return -EINVAL;
1159 }
1160 #endif
1161
1162 /* The inode's security attributes must be initialized before first use. */
1163 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1164 {
1165 struct superblock_security_struct *sbsec = NULL;
1166 struct inode_security_struct *isec = inode->i_security;
1167 u32 sid;
1168 struct dentry *dentry;
1169 #define INITCONTEXTLEN 255
1170 char *context = NULL;
1171 unsigned len = 0;
1172 int rc = 0;
1173
1174 if (isec->initialized)
1175 goto out;
1176
1177 mutex_lock(&isec->lock);
1178 if (isec->initialized)
1179 goto out_unlock;
1180
1181 sbsec = inode->i_sb->s_security;
1182 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1183 /* Defer initialization until selinux_complete_init,
1184 after the initial policy is loaded and the security
1185 server is ready to handle calls. */
1186 spin_lock(&sbsec->isec_lock);
1187 if (list_empty(&isec->list))
1188 list_add(&isec->list, &sbsec->isec_head);
1189 spin_unlock(&sbsec->isec_lock);
1190 goto out_unlock;
1191 }
1192
1193 switch (sbsec->behavior) {
1194 case SECURITY_FS_USE_XATTR:
1195 if (!inode->i_op->getxattr) {
1196 isec->sid = sbsec->def_sid;
1197 break;
1198 }
1199
1200 /* Need a dentry, since the xattr API requires one.
1201 Life would be simpler if we could just pass the inode. */
1202 if (opt_dentry) {
1203 /* Called from d_instantiate or d_splice_alias. */
1204 dentry = dget(opt_dentry);
1205 } else {
1206 /* Called from selinux_complete_init, try to find a dentry. */
1207 dentry = d_find_alias(inode);
1208 }
1209 if (!dentry) {
1210 /*
1211 * this is can be hit on boot when a file is accessed
1212 * before the policy is loaded. When we load policy we
1213 * may find inodes that have no dentry on the
1214 * sbsec->isec_head list. No reason to complain as these
1215 * will get fixed up the next time we go through
1216 * inode_doinit with a dentry, before these inodes could
1217 * be used again by userspace.
1218 */
1219 goto out_unlock;
1220 }
1221
1222 len = INITCONTEXTLEN;
1223 context = kmalloc(len+1, GFP_NOFS);
1224 if (!context) {
1225 rc = -ENOMEM;
1226 dput(dentry);
1227 goto out_unlock;
1228 }
1229 context[len] = '\0';
1230 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1231 context, len);
1232 if (rc == -ERANGE) {
1233 kfree(context);
1234
1235 /* Need a larger buffer. Query for the right size. */
1236 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1237 NULL, 0);
1238 if (rc < 0) {
1239 dput(dentry);
1240 goto out_unlock;
1241 }
1242 len = rc;
1243 context = kmalloc(len+1, GFP_NOFS);
1244 if (!context) {
1245 rc = -ENOMEM;
1246 dput(dentry);
1247 goto out_unlock;
1248 }
1249 context[len] = '\0';
1250 rc = inode->i_op->getxattr(dentry,
1251 XATTR_NAME_SELINUX,
1252 context, len);
1253 }
1254 dput(dentry);
1255 if (rc < 0) {
1256 if (rc != -ENODATA) {
1257 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1258 "%d for dev=%s ino=%ld\n", __func__,
1259 -rc, inode->i_sb->s_id, inode->i_ino);
1260 kfree(context);
1261 goto out_unlock;
1262 }
1263 /* Map ENODATA to the default file SID */
1264 sid = sbsec->def_sid;
1265 rc = 0;
1266 } else {
1267 rc = security_context_to_sid_default(context, rc, &sid,
1268 sbsec->def_sid,
1269 GFP_NOFS);
1270 if (rc) {
1271 char *dev = inode->i_sb->s_id;
1272 unsigned long ino = inode->i_ino;
1273
1274 if (rc == -EINVAL) {
1275 if (printk_ratelimit())
1276 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1277 "context=%s. This indicates you may need to relabel the inode or the "
1278 "filesystem in question.\n", ino, dev, context);
1279 } else {
1280 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1281 "returned %d for dev=%s ino=%ld\n",
1282 __func__, context, -rc, dev, ino);
1283 }
1284 kfree(context);
1285 /* Leave with the unlabeled SID */
1286 rc = 0;
1287 break;
1288 }
1289 }
1290 kfree(context);
1291 isec->sid = sid;
1292 break;
1293 case SECURITY_FS_USE_TASK:
1294 isec->sid = isec->task_sid;
1295 break;
1296 case SECURITY_FS_USE_TRANS:
1297 /* Default to the fs SID. */
1298 isec->sid = sbsec->sid;
1299
1300 /* Try to obtain a transition SID. */
1301 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1302 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1303 isec->sclass, NULL, &sid);
1304 if (rc)
1305 goto out_unlock;
1306 isec->sid = sid;
1307 break;
1308 case SECURITY_FS_USE_MNTPOINT:
1309 isec->sid = sbsec->mntpoint_sid;
1310 break;
1311 default:
1312 /* Default to the fs superblock SID. */
1313 isec->sid = sbsec->sid;
1314
1315 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1316 if (opt_dentry) {
1317 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1318 rc = selinux_proc_get_sid(opt_dentry,
1319 isec->sclass,
1320 &sid);
1321 if (rc)
1322 goto out_unlock;
1323 isec->sid = sid;
1324 }
1325 }
1326 break;
1327 }
1328
1329 isec->initialized = 1;
1330
1331 out_unlock:
1332 mutex_unlock(&isec->lock);
1333 out:
1334 if (isec->sclass == SECCLASS_FILE)
1335 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1336 return rc;
1337 }
1338
1339 /* Convert a Linux signal to an access vector. */
1340 static inline u32 signal_to_av(int sig)
1341 {
1342 u32 perm = 0;
1343
1344 switch (sig) {
1345 case SIGCHLD:
1346 /* Commonly granted from child to parent. */
1347 perm = PROCESS__SIGCHLD;
1348 break;
1349 case SIGKILL:
1350 /* Cannot be caught or ignored */
1351 perm = PROCESS__SIGKILL;
1352 break;
1353 case SIGSTOP:
1354 /* Cannot be caught or ignored */
1355 perm = PROCESS__SIGSTOP;
1356 break;
1357 default:
1358 /* All other signals. */
1359 perm = PROCESS__SIGNAL;
1360 break;
1361 }
1362
1363 return perm;
1364 }
1365
1366 /*
1367 * Check permission between a pair of credentials
1368 * fork check, ptrace check, etc.
1369 */
1370 static int cred_has_perm(const struct cred *actor,
1371 const struct cred *target,
1372 u32 perms)
1373 {
1374 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1375
1376 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1377 }
1378
1379 /*
1380 * Check permission between a pair of tasks, e.g. signal checks,
1381 * fork check, ptrace check, etc.
1382 * tsk1 is the actor and tsk2 is the target
1383 * - this uses the default subjective creds of tsk1
1384 */
1385 static int task_has_perm(const struct task_struct *tsk1,
1386 const struct task_struct *tsk2,
1387 u32 perms)
1388 {
1389 const struct task_security_struct *__tsec1, *__tsec2;
1390 u32 sid1, sid2;
1391
1392 rcu_read_lock();
1393 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1394 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1395 rcu_read_unlock();
1396 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1397 }
1398
1399 /*
1400 * Check permission between current and another task, e.g. signal checks,
1401 * fork check, ptrace check, etc.
1402 * current is the actor and tsk2 is the target
1403 * - this uses current's subjective creds
1404 */
1405 static int current_has_perm(const struct task_struct *tsk,
1406 u32 perms)
1407 {
1408 u32 sid, tsid;
1409
1410 sid = current_sid();
1411 tsid = task_sid(tsk);
1412 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1413 }
1414
1415 #if CAP_LAST_CAP > 63
1416 #error Fix SELinux to handle capabilities > 63.
1417 #endif
1418
1419 /* Check whether a task is allowed to use a capability. */
1420 static int cred_has_capability(const struct cred *cred,
1421 int cap, int audit)
1422 {
1423 struct common_audit_data ad;
1424 struct av_decision avd;
1425 u16 sclass;
1426 u32 sid = cred_sid(cred);
1427 u32 av = CAP_TO_MASK(cap);
1428 int rc;
1429
1430 ad.type = LSM_AUDIT_DATA_CAP;
1431 ad.u.cap = cap;
1432
1433 switch (CAP_TO_INDEX(cap)) {
1434 case 0:
1435 sclass = SECCLASS_CAPABILITY;
1436 break;
1437 case 1:
1438 sclass = SECCLASS_CAPABILITY2;
1439 break;
1440 default:
1441 printk(KERN_ERR
1442 "SELinux: out of range capability %d\n", cap);
1443 BUG();
1444 return -EINVAL;
1445 }
1446
1447 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1448 if (audit == SECURITY_CAP_AUDIT) {
1449 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1450 if (rc2)
1451 return rc2;
1452 }
1453 return rc;
1454 }
1455
1456 /* Check whether a task is allowed to use a system operation. */
1457 static int task_has_system(struct task_struct *tsk,
1458 u32 perms)
1459 {
1460 u32 sid = task_sid(tsk);
1461
1462 return avc_has_perm(sid, SECINITSID_KERNEL,
1463 SECCLASS_SYSTEM, perms, NULL);
1464 }
1465
1466 /* Check whether a task has a particular permission to an inode.
1467 The 'adp' parameter is optional and allows other audit
1468 data to be passed (e.g. the dentry). */
1469 static int inode_has_perm(const struct cred *cred,
1470 struct inode *inode,
1471 u32 perms,
1472 struct common_audit_data *adp,
1473 unsigned flags)
1474 {
1475 struct inode_security_struct *isec;
1476 u32 sid;
1477
1478 validate_creds(cred);
1479
1480 if (unlikely(IS_PRIVATE(inode)))
1481 return 0;
1482
1483 sid = cred_sid(cred);
1484 isec = inode->i_security;
1485
1486 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1487 }
1488
1489 /* Same as inode_has_perm, but pass explicit audit data containing
1490 the dentry to help the auditing code to more easily generate the
1491 pathname if needed. */
1492 static inline int dentry_has_perm(const struct cred *cred,
1493 struct dentry *dentry,
1494 u32 av)
1495 {
1496 struct inode *inode = dentry->d_inode;
1497 struct common_audit_data ad;
1498
1499 ad.type = LSM_AUDIT_DATA_DENTRY;
1500 ad.u.dentry = dentry;
1501 return inode_has_perm(cred, inode, av, &ad, 0);
1502 }
1503
1504 /* Same as inode_has_perm, but pass explicit audit data containing
1505 the path to help the auditing code to more easily generate the
1506 pathname if needed. */
1507 static inline int path_has_perm(const struct cred *cred,
1508 struct path *path,
1509 u32 av)
1510 {
1511 struct inode *inode = path->dentry->d_inode;
1512 struct common_audit_data ad;
1513
1514 ad.type = LSM_AUDIT_DATA_PATH;
1515 ad.u.path = *path;
1516 return inode_has_perm(cred, inode, av, &ad, 0);
1517 }
1518
1519 /* Check whether a task can use an open file descriptor to
1520 access an inode in a given way. Check access to the
1521 descriptor itself, and then use dentry_has_perm to
1522 check a particular permission to the file.
1523 Access to the descriptor is implicitly granted if it
1524 has the same SID as the process. If av is zero, then
1525 access to the file is not checked, e.g. for cases
1526 where only the descriptor is affected like seek. */
1527 static int file_has_perm(const struct cred *cred,
1528 struct file *file,
1529 u32 av)
1530 {
1531 struct file_security_struct *fsec = file->f_security;
1532 struct inode *inode = file_inode(file);
1533 struct common_audit_data ad;
1534 u32 sid = cred_sid(cred);
1535 int rc;
1536
1537 ad.type = LSM_AUDIT_DATA_PATH;
1538 ad.u.path = file->f_path;
1539
1540 if (sid != fsec->sid) {
1541 rc = avc_has_perm(sid, fsec->sid,
1542 SECCLASS_FD,
1543 FD__USE,
1544 &ad);
1545 if (rc)
1546 goto out;
1547 }
1548
1549 /* av is zero if only checking access to the descriptor. */
1550 rc = 0;
1551 if (av)
1552 rc = inode_has_perm(cred, inode, av, &ad, 0);
1553
1554 out:
1555 return rc;
1556 }
1557
1558 /* Check whether a task can create a file. */
1559 static int may_create(struct inode *dir,
1560 struct dentry *dentry,
1561 u16 tclass)
1562 {
1563 const struct task_security_struct *tsec = current_security();
1564 struct inode_security_struct *dsec;
1565 struct superblock_security_struct *sbsec;
1566 u32 sid, newsid;
1567 struct common_audit_data ad;
1568 int rc;
1569
1570 dsec = dir->i_security;
1571 sbsec = dir->i_sb->s_security;
1572
1573 sid = tsec->sid;
1574 newsid = tsec->create_sid;
1575
1576 ad.type = LSM_AUDIT_DATA_DENTRY;
1577 ad.u.dentry = dentry;
1578
1579 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1580 DIR__ADD_NAME | DIR__SEARCH,
1581 &ad);
1582 if (rc)
1583 return rc;
1584
1585 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1586 rc = security_transition_sid(sid, dsec->sid, tclass,
1587 &dentry->d_name, &newsid);
1588 if (rc)
1589 return rc;
1590 }
1591
1592 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1593 if (rc)
1594 return rc;
1595
1596 return avc_has_perm(newsid, sbsec->sid,
1597 SECCLASS_FILESYSTEM,
1598 FILESYSTEM__ASSOCIATE, &ad);
1599 }
1600
1601 /* Check whether a task can create a key. */
1602 static int may_create_key(u32 ksid,
1603 struct task_struct *ctx)
1604 {
1605 u32 sid = task_sid(ctx);
1606
1607 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1608 }
1609
1610 #define MAY_LINK 0
1611 #define MAY_UNLINK 1
1612 #define MAY_RMDIR 2
1613
1614 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1615 static int may_link(struct inode *dir,
1616 struct dentry *dentry,
1617 int kind)
1618
1619 {
1620 struct inode_security_struct *dsec, *isec;
1621 struct common_audit_data ad;
1622 u32 sid = current_sid();
1623 u32 av;
1624 int rc;
1625
1626 dsec = dir->i_security;
1627 isec = dentry->d_inode->i_security;
1628
1629 ad.type = LSM_AUDIT_DATA_DENTRY;
1630 ad.u.dentry = dentry;
1631
1632 av = DIR__SEARCH;
1633 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1634 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1635 if (rc)
1636 return rc;
1637
1638 switch (kind) {
1639 case MAY_LINK:
1640 av = FILE__LINK;
1641 break;
1642 case MAY_UNLINK:
1643 av = FILE__UNLINK;
1644 break;
1645 case MAY_RMDIR:
1646 av = DIR__RMDIR;
1647 break;
1648 default:
1649 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1650 __func__, kind);
1651 return 0;
1652 }
1653
1654 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1655 return rc;
1656 }
1657
1658 static inline int may_rename(struct inode *old_dir,
1659 struct dentry *old_dentry,
1660 struct inode *new_dir,
1661 struct dentry *new_dentry)
1662 {
1663 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1664 struct common_audit_data ad;
1665 u32 sid = current_sid();
1666 u32 av;
1667 int old_is_dir, new_is_dir;
1668 int rc;
1669
1670 old_dsec = old_dir->i_security;
1671 old_isec = old_dentry->d_inode->i_security;
1672 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1673 new_dsec = new_dir->i_security;
1674
1675 ad.type = LSM_AUDIT_DATA_DENTRY;
1676
1677 ad.u.dentry = old_dentry;
1678 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1679 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1680 if (rc)
1681 return rc;
1682 rc = avc_has_perm(sid, old_isec->sid,
1683 old_isec->sclass, FILE__RENAME, &ad);
1684 if (rc)
1685 return rc;
1686 if (old_is_dir && new_dir != old_dir) {
1687 rc = avc_has_perm(sid, old_isec->sid,
1688 old_isec->sclass, DIR__REPARENT, &ad);
1689 if (rc)
1690 return rc;
1691 }
1692
1693 ad.u.dentry = new_dentry;
1694 av = DIR__ADD_NAME | DIR__SEARCH;
1695 if (new_dentry->d_inode)
1696 av |= DIR__REMOVE_NAME;
1697 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1698 if (rc)
1699 return rc;
1700 if (new_dentry->d_inode) {
1701 new_isec = new_dentry->d_inode->i_security;
1702 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1703 rc = avc_has_perm(sid, new_isec->sid,
1704 new_isec->sclass,
1705 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1706 if (rc)
1707 return rc;
1708 }
1709
1710 return 0;
1711 }
1712
1713 /* Check whether a task can perform a filesystem operation. */
1714 static int superblock_has_perm(const struct cred *cred,
1715 struct super_block *sb,
1716 u32 perms,
1717 struct common_audit_data *ad)
1718 {
1719 struct superblock_security_struct *sbsec;
1720 u32 sid = cred_sid(cred);
1721
1722 sbsec = sb->s_security;
1723 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1724 }
1725
1726 /* Convert a Linux mode and permission mask to an access vector. */
1727 static inline u32 file_mask_to_av(int mode, int mask)
1728 {
1729 u32 av = 0;
1730
1731 if (!S_ISDIR(mode)) {
1732 if (mask & MAY_EXEC)
1733 av |= FILE__EXECUTE;
1734 if (mask & MAY_READ)
1735 av |= FILE__READ;
1736
1737 if (mask & MAY_APPEND)
1738 av |= FILE__APPEND;
1739 else if (mask & MAY_WRITE)
1740 av |= FILE__WRITE;
1741
1742 } else {
1743 if (mask & MAY_EXEC)
1744 av |= DIR__SEARCH;
1745 if (mask & MAY_WRITE)
1746 av |= DIR__WRITE;
1747 if (mask & MAY_READ)
1748 av |= DIR__READ;
1749 }
1750
1751 return av;
1752 }
1753
1754 /* Convert a Linux file to an access vector. */
1755 static inline u32 file_to_av(struct file *file)
1756 {
1757 u32 av = 0;
1758
1759 if (file->f_mode & FMODE_READ)
1760 av |= FILE__READ;
1761 if (file->f_mode & FMODE_WRITE) {
1762 if (file->f_flags & O_APPEND)
1763 av |= FILE__APPEND;
1764 else
1765 av |= FILE__WRITE;
1766 }
1767 if (!av) {
1768 /*
1769 * Special file opened with flags 3 for ioctl-only use.
1770 */
1771 av = FILE__IOCTL;
1772 }
1773
1774 return av;
1775 }
1776
1777 /*
1778 * Convert a file to an access vector and include the correct open
1779 * open permission.
1780 */
1781 static inline u32 open_file_to_av(struct file *file)
1782 {
1783 u32 av = file_to_av(file);
1784
1785 if (selinux_policycap_openperm)
1786 av |= FILE__OPEN;
1787
1788 return av;
1789 }
1790
1791 /* Hook functions begin here. */
1792
1793 static int selinux_ptrace_access_check(struct task_struct *child,
1794 unsigned int mode)
1795 {
1796 int rc;
1797
1798 rc = cap_ptrace_access_check(child, mode);
1799 if (rc)
1800 return rc;
1801
1802 if (mode & PTRACE_MODE_READ) {
1803 u32 sid = current_sid();
1804 u32 csid = task_sid(child);
1805 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1806 }
1807
1808 return current_has_perm(child, PROCESS__PTRACE);
1809 }
1810
1811 static int selinux_ptrace_traceme(struct task_struct *parent)
1812 {
1813 int rc;
1814
1815 rc = cap_ptrace_traceme(parent);
1816 if (rc)
1817 return rc;
1818
1819 return task_has_perm(parent, current, PROCESS__PTRACE);
1820 }
1821
1822 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1823 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1824 {
1825 int error;
1826
1827 error = current_has_perm(target, PROCESS__GETCAP);
1828 if (error)
1829 return error;
1830
1831 return cap_capget(target, effective, inheritable, permitted);
1832 }
1833
1834 static int selinux_capset(struct cred *new, const struct cred *old,
1835 const kernel_cap_t *effective,
1836 const kernel_cap_t *inheritable,
1837 const kernel_cap_t *permitted)
1838 {
1839 int error;
1840
1841 error = cap_capset(new, old,
1842 effective, inheritable, permitted);
1843 if (error)
1844 return error;
1845
1846 return cred_has_perm(old, new, PROCESS__SETCAP);
1847 }
1848
1849 /*
1850 * (This comment used to live with the selinux_task_setuid hook,
1851 * which was removed).
1852 *
1853 * Since setuid only affects the current process, and since the SELinux
1854 * controls are not based on the Linux identity attributes, SELinux does not
1855 * need to control this operation. However, SELinux does control the use of
1856 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1857 */
1858
1859 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1860 int cap, int audit)
1861 {
1862 int rc;
1863
1864 rc = cap_capable(cred, ns, cap, audit);
1865 if (rc)
1866 return rc;
1867
1868 return cred_has_capability(cred, cap, audit);
1869 }
1870
1871 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1872 {
1873 const struct cred *cred = current_cred();
1874 int rc = 0;
1875
1876 if (!sb)
1877 return 0;
1878
1879 switch (cmds) {
1880 case Q_SYNC:
1881 case Q_QUOTAON:
1882 case Q_QUOTAOFF:
1883 case Q_SETINFO:
1884 case Q_SETQUOTA:
1885 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1886 break;
1887 case Q_GETFMT:
1888 case Q_GETINFO:
1889 case Q_GETQUOTA:
1890 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1891 break;
1892 default:
1893 rc = 0; /* let the kernel handle invalid cmds */
1894 break;
1895 }
1896 return rc;
1897 }
1898
1899 static int selinux_quota_on(struct dentry *dentry)
1900 {
1901 const struct cred *cred = current_cred();
1902
1903 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1904 }
1905
1906 static int selinux_syslog(int type)
1907 {
1908 int rc;
1909
1910 switch (type) {
1911 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1912 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1913 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1914 break;
1915 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1916 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1917 /* Set level of messages printed to console */
1918 case SYSLOG_ACTION_CONSOLE_LEVEL:
1919 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1920 break;
1921 case SYSLOG_ACTION_CLOSE: /* Close log */
1922 case SYSLOG_ACTION_OPEN: /* Open log */
1923 case SYSLOG_ACTION_READ: /* Read from log */
1924 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1925 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1926 default:
1927 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1928 break;
1929 }
1930 return rc;
1931 }
1932
1933 /*
1934 * Check that a process has enough memory to allocate a new virtual
1935 * mapping. 0 means there is enough memory for the allocation to
1936 * succeed and -ENOMEM implies there is not.
1937 *
1938 * Do not audit the selinux permission check, as this is applied to all
1939 * processes that allocate mappings.
1940 */
1941 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1942 {
1943 int rc, cap_sys_admin = 0;
1944
1945 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1946 SECURITY_CAP_NOAUDIT);
1947 if (rc == 0)
1948 cap_sys_admin = 1;
1949
1950 return __vm_enough_memory(mm, pages, cap_sys_admin);
1951 }
1952
1953 /* binprm security operations */
1954
1955 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1956 {
1957 const struct task_security_struct *old_tsec;
1958 struct task_security_struct *new_tsec;
1959 struct inode_security_struct *isec;
1960 struct common_audit_data ad;
1961 struct inode *inode = file_inode(bprm->file);
1962 int rc;
1963
1964 rc = cap_bprm_set_creds(bprm);
1965 if (rc)
1966 return rc;
1967
1968 /* SELinux context only depends on initial program or script and not
1969 * the script interpreter */
1970 if (bprm->cred_prepared)
1971 return 0;
1972
1973 old_tsec = current_security();
1974 new_tsec = bprm->cred->security;
1975 isec = inode->i_security;
1976
1977 /* Default to the current task SID. */
1978 new_tsec->sid = old_tsec->sid;
1979 new_tsec->osid = old_tsec->sid;
1980
1981 /* Reset fs, key, and sock SIDs on execve. */
1982 new_tsec->create_sid = 0;
1983 new_tsec->keycreate_sid = 0;
1984 new_tsec->sockcreate_sid = 0;
1985
1986 if (old_tsec->exec_sid) {
1987 new_tsec->sid = old_tsec->exec_sid;
1988 /* Reset exec SID on execve. */
1989 new_tsec->exec_sid = 0;
1990
1991 /*
1992 * Minimize confusion: if no_new_privs and a transition is
1993 * explicitly requested, then fail the exec.
1994 */
1995 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
1996 return -EPERM;
1997 } else {
1998 /* Check for a default transition on this program. */
1999 rc = security_transition_sid(old_tsec->sid, isec->sid,
2000 SECCLASS_PROCESS, NULL,
2001 &new_tsec->sid);
2002 if (rc)
2003 return rc;
2004 }
2005
2006 ad.type = LSM_AUDIT_DATA_PATH;
2007 ad.u.path = bprm->file->f_path;
2008
2009 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2010 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2011 new_tsec->sid = old_tsec->sid;
2012
2013 if (new_tsec->sid == old_tsec->sid) {
2014 rc = avc_has_perm(old_tsec->sid, isec->sid,
2015 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2016 if (rc)
2017 return rc;
2018 } else {
2019 /* Check permissions for the transition. */
2020 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2021 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2022 if (rc)
2023 return rc;
2024
2025 rc = avc_has_perm(new_tsec->sid, isec->sid,
2026 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2027 if (rc)
2028 return rc;
2029
2030 /* Check for shared state */
2031 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2032 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2033 SECCLASS_PROCESS, PROCESS__SHARE,
2034 NULL);
2035 if (rc)
2036 return -EPERM;
2037 }
2038
2039 /* Make sure that anyone attempting to ptrace over a task that
2040 * changes its SID has the appropriate permit */
2041 if (bprm->unsafe &
2042 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2043 struct task_struct *tracer;
2044 struct task_security_struct *sec;
2045 u32 ptsid = 0;
2046
2047 rcu_read_lock();
2048 tracer = ptrace_parent(current);
2049 if (likely(tracer != NULL)) {
2050 sec = __task_cred(tracer)->security;
2051 ptsid = sec->sid;
2052 }
2053 rcu_read_unlock();
2054
2055 if (ptsid != 0) {
2056 rc = avc_has_perm(ptsid, new_tsec->sid,
2057 SECCLASS_PROCESS,
2058 PROCESS__PTRACE, NULL);
2059 if (rc)
2060 return -EPERM;
2061 }
2062 }
2063
2064 /* Clear any possibly unsafe personality bits on exec: */
2065 bprm->per_clear |= PER_CLEAR_ON_SETID;
2066 }
2067
2068 return 0;
2069 }
2070
2071 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2072 {
2073 const struct task_security_struct *tsec = current_security();
2074 u32 sid, osid;
2075 int atsecure = 0;
2076
2077 sid = tsec->sid;
2078 osid = tsec->osid;
2079
2080 if (osid != sid) {
2081 /* Enable secure mode for SIDs transitions unless
2082 the noatsecure permission is granted between
2083 the two SIDs, i.e. ahp returns 0. */
2084 atsecure = avc_has_perm(osid, sid,
2085 SECCLASS_PROCESS,
2086 PROCESS__NOATSECURE, NULL);
2087 }
2088
2089 return (atsecure || cap_bprm_secureexec(bprm));
2090 }
2091
2092 static int match_file(const void *p, struct file *file, unsigned fd)
2093 {
2094 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2095 }
2096
2097 /* Derived from fs/exec.c:flush_old_files. */
2098 static inline void flush_unauthorized_files(const struct cred *cred,
2099 struct files_struct *files)
2100 {
2101 struct file *file, *devnull = NULL;
2102 struct tty_struct *tty;
2103 int drop_tty = 0;
2104 unsigned n;
2105
2106 tty = get_current_tty();
2107 if (tty) {
2108 spin_lock(&tty_files_lock);
2109 if (!list_empty(&tty->tty_files)) {
2110 struct tty_file_private *file_priv;
2111
2112 /* Revalidate access to controlling tty.
2113 Use path_has_perm on the tty path directly rather
2114 than using file_has_perm, as this particular open
2115 file may belong to another process and we are only
2116 interested in the inode-based check here. */
2117 file_priv = list_first_entry(&tty->tty_files,
2118 struct tty_file_private, list);
2119 file = file_priv->file;
2120 if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2121 drop_tty = 1;
2122 }
2123 spin_unlock(&tty_files_lock);
2124 tty_kref_put(tty);
2125 }
2126 /* Reset controlling tty. */
2127 if (drop_tty)
2128 no_tty();
2129
2130 /* Revalidate access to inherited open files. */
2131 n = iterate_fd(files, 0, match_file, cred);
2132 if (!n) /* none found? */
2133 return;
2134
2135 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2136 if (IS_ERR(devnull))
2137 devnull = NULL;
2138 /* replace all the matching ones with this */
2139 do {
2140 replace_fd(n - 1, devnull, 0);
2141 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2142 if (devnull)
2143 fput(devnull);
2144 }
2145
2146 /*
2147 * Prepare a process for imminent new credential changes due to exec
2148 */
2149 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2150 {
2151 struct task_security_struct *new_tsec;
2152 struct rlimit *rlim, *initrlim;
2153 int rc, i;
2154
2155 new_tsec = bprm->cred->security;
2156 if (new_tsec->sid == new_tsec->osid)
2157 return;
2158
2159 /* Close files for which the new task SID is not authorized. */
2160 flush_unauthorized_files(bprm->cred, current->files);
2161
2162 /* Always clear parent death signal on SID transitions. */
2163 current->pdeath_signal = 0;
2164
2165 /* Check whether the new SID can inherit resource limits from the old
2166 * SID. If not, reset all soft limits to the lower of the current
2167 * task's hard limit and the init task's soft limit.
2168 *
2169 * Note that the setting of hard limits (even to lower them) can be
2170 * controlled by the setrlimit check. The inclusion of the init task's
2171 * soft limit into the computation is to avoid resetting soft limits
2172 * higher than the default soft limit for cases where the default is
2173 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2174 */
2175 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2176 PROCESS__RLIMITINH, NULL);
2177 if (rc) {
2178 /* protect against do_prlimit() */
2179 task_lock(current);
2180 for (i = 0; i < RLIM_NLIMITS; i++) {
2181 rlim = current->signal->rlim + i;
2182 initrlim = init_task.signal->rlim + i;
2183 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2184 }
2185 task_unlock(current);
2186 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2187 }
2188 }
2189
2190 /*
2191 * Clean up the process immediately after the installation of new credentials
2192 * due to exec
2193 */
2194 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2195 {
2196 const struct task_security_struct *tsec = current_security();
2197 struct itimerval itimer;
2198 u32 osid, sid;
2199 int rc, i;
2200
2201 osid = tsec->osid;
2202 sid = tsec->sid;
2203
2204 if (sid == osid)
2205 return;
2206
2207 /* Check whether the new SID can inherit signal state from the old SID.
2208 * If not, clear itimers to avoid subsequent signal generation and
2209 * flush and unblock signals.
2210 *
2211 * This must occur _after_ the task SID has been updated so that any
2212 * kill done after the flush will be checked against the new SID.
2213 */
2214 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2215 if (rc) {
2216 memset(&itimer, 0, sizeof itimer);
2217 for (i = 0; i < 3; i++)
2218 do_setitimer(i, &itimer, NULL);
2219 spin_lock_irq(&current->sighand->siglock);
2220 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2221 __flush_signals(current);
2222 flush_signal_handlers(current, 1);
2223 sigemptyset(&current->blocked);
2224 }
2225 spin_unlock_irq(&current->sighand->siglock);
2226 }
2227
2228 /* Wake up the parent if it is waiting so that it can recheck
2229 * wait permission to the new task SID. */
2230 read_lock(&tasklist_lock);
2231 __wake_up_parent(current, current->real_parent);
2232 read_unlock(&tasklist_lock);
2233 }
2234
2235 /* superblock security operations */
2236
2237 static int selinux_sb_alloc_security(struct super_block *sb)
2238 {
2239 return superblock_alloc_security(sb);
2240 }
2241
2242 static void selinux_sb_free_security(struct super_block *sb)
2243 {
2244 superblock_free_security(sb);
2245 }
2246
2247 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2248 {
2249 if (plen > olen)
2250 return 0;
2251
2252 return !memcmp(prefix, option, plen);
2253 }
2254
2255 static inline int selinux_option(char *option, int len)
2256 {
2257 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2258 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2259 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2260 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2261 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2262 }
2263
2264 static inline void take_option(char **to, char *from, int *first, int len)
2265 {
2266 if (!*first) {
2267 **to = ',';
2268 *to += 1;
2269 } else
2270 *first = 0;
2271 memcpy(*to, from, len);
2272 *to += len;
2273 }
2274
2275 static inline void take_selinux_option(char **to, char *from, int *first,
2276 int len)
2277 {
2278 int current_size = 0;
2279
2280 if (!*first) {
2281 **to = '|';
2282 *to += 1;
2283 } else
2284 *first = 0;
2285
2286 while (current_size < len) {
2287 if (*from != '"') {
2288 **to = *from;
2289 *to += 1;
2290 }
2291 from += 1;
2292 current_size += 1;
2293 }
2294 }
2295
2296 static int selinux_sb_copy_data(char *orig, char *copy)
2297 {
2298 int fnosec, fsec, rc = 0;
2299 char *in_save, *in_curr, *in_end;
2300 char *sec_curr, *nosec_save, *nosec;
2301 int open_quote = 0;
2302
2303 in_curr = orig;
2304 sec_curr = copy;
2305
2306 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2307 if (!nosec) {
2308 rc = -ENOMEM;
2309 goto out;
2310 }
2311
2312 nosec_save = nosec;
2313 fnosec = fsec = 1;
2314 in_save = in_end = orig;
2315
2316 do {
2317 if (*in_end == '"')
2318 open_quote = !open_quote;
2319 if ((*in_end == ',' && open_quote == 0) ||
2320 *in_end == '\0') {
2321 int len = in_end - in_curr;
2322
2323 if (selinux_option(in_curr, len))
2324 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2325 else
2326 take_option(&nosec, in_curr, &fnosec, len);
2327
2328 in_curr = in_end + 1;
2329 }
2330 } while (*in_end++);
2331
2332 strcpy(in_save, nosec_save);
2333 free_page((unsigned long)nosec_save);
2334 out:
2335 return rc;
2336 }
2337
2338 static int selinux_sb_remount(struct super_block *sb, void *data)
2339 {
2340 int rc, i, *flags;
2341 struct security_mnt_opts opts;
2342 char *secdata, **mount_options;
2343 struct superblock_security_struct *sbsec = sb->s_security;
2344
2345 if (!(sbsec->flags & SE_SBINITIALIZED))
2346 return 0;
2347
2348 if (!data)
2349 return 0;
2350
2351 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2352 return 0;
2353
2354 security_init_mnt_opts(&opts);
2355 secdata = alloc_secdata();
2356 if (!secdata)
2357 return -ENOMEM;
2358 rc = selinux_sb_copy_data(data, secdata);
2359 if (rc)
2360 goto out_free_secdata;
2361
2362 rc = selinux_parse_opts_str(secdata, &opts);
2363 if (rc)
2364 goto out_free_secdata;
2365
2366 mount_options = opts.mnt_opts;
2367 flags = opts.mnt_opts_flags;
2368
2369 for (i = 0; i < opts.num_mnt_opts; i++) {
2370 u32 sid;
2371 size_t len;
2372
2373 if (flags[i] == SE_SBLABELSUPP)
2374 continue;
2375 len = strlen(mount_options[i]);
2376 rc = security_context_to_sid(mount_options[i], len, &sid);
2377 if (rc) {
2378 printk(KERN_WARNING "SELinux: security_context_to_sid"
2379 "(%s) failed for (dev %s, type %s) errno=%d\n",
2380 mount_options[i], sb->s_id, sb->s_type->name, rc);
2381 goto out_free_opts;
2382 }
2383 rc = -EINVAL;
2384 switch (flags[i]) {
2385 case FSCONTEXT_MNT:
2386 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2387 goto out_bad_option;
2388 break;
2389 case CONTEXT_MNT:
2390 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2391 goto out_bad_option;
2392 break;
2393 case ROOTCONTEXT_MNT: {
2394 struct inode_security_struct *root_isec;
2395 root_isec = sb->s_root->d_inode->i_security;
2396
2397 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2398 goto out_bad_option;
2399 break;
2400 }
2401 case DEFCONTEXT_MNT:
2402 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2403 goto out_bad_option;
2404 break;
2405 default:
2406 goto out_free_opts;
2407 }
2408 }
2409
2410 rc = 0;
2411 out_free_opts:
2412 security_free_mnt_opts(&opts);
2413 out_free_secdata:
2414 free_secdata(secdata);
2415 return rc;
2416 out_bad_option:
2417 printk(KERN_WARNING "SELinux: unable to change security options "
2418 "during remount (dev %s, type=%s)\n", sb->s_id,
2419 sb->s_type->name);
2420 goto out_free_opts;
2421 }
2422
2423 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2424 {
2425 const struct cred *cred = current_cred();
2426 struct common_audit_data ad;
2427 int rc;
2428
2429 rc = superblock_doinit(sb, data);
2430 if (rc)
2431 return rc;
2432
2433 /* Allow all mounts performed by the kernel */
2434 if (flags & MS_KERNMOUNT)
2435 return 0;
2436
2437 ad.type = LSM_AUDIT_DATA_DENTRY;
2438 ad.u.dentry = sb->s_root;
2439 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2440 }
2441
2442 static int selinux_sb_statfs(struct dentry *dentry)
2443 {
2444 const struct cred *cred = current_cred();
2445 struct common_audit_data ad;
2446
2447 ad.type = LSM_AUDIT_DATA_DENTRY;
2448 ad.u.dentry = dentry->d_sb->s_root;
2449 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2450 }
2451
2452 static int selinux_mount(const char *dev_name,
2453 struct path *path,
2454 const char *type,
2455 unsigned long flags,
2456 void *data)
2457 {
2458 const struct cred *cred = current_cred();
2459
2460 if (flags & MS_REMOUNT)
2461 return superblock_has_perm(cred, path->dentry->d_sb,
2462 FILESYSTEM__REMOUNT, NULL);
2463 else
2464 return path_has_perm(cred, path, FILE__MOUNTON);
2465 }
2466
2467 static int selinux_umount(struct vfsmount *mnt, int flags)
2468 {
2469 const struct cred *cred = current_cred();
2470
2471 return superblock_has_perm(cred, mnt->mnt_sb,
2472 FILESYSTEM__UNMOUNT, NULL);
2473 }
2474
2475 /* inode security operations */
2476
2477 static int selinux_inode_alloc_security(struct inode *inode)
2478 {
2479 return inode_alloc_security(inode);
2480 }
2481
2482 static void selinux_inode_free_security(struct inode *inode)
2483 {
2484 inode_free_security(inode);
2485 }
2486
2487 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2488 const struct qstr *qstr, char **name,
2489 void **value, size_t *len)
2490 {
2491 const struct task_security_struct *tsec = current_security();
2492 struct inode_security_struct *dsec;
2493 struct superblock_security_struct *sbsec;
2494 u32 sid, newsid, clen;
2495 int rc;
2496 char *namep = NULL, *context;
2497
2498 dsec = dir->i_security;
2499 sbsec = dir->i_sb->s_security;
2500
2501 sid = tsec->sid;
2502 newsid = tsec->create_sid;
2503
2504 if ((sbsec->flags & SE_SBINITIALIZED) &&
2505 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2506 newsid = sbsec->mntpoint_sid;
2507 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2508 rc = security_transition_sid(sid, dsec->sid,
2509 inode_mode_to_security_class(inode->i_mode),
2510 qstr, &newsid);
2511 if (rc) {
2512 printk(KERN_WARNING "%s: "
2513 "security_transition_sid failed, rc=%d (dev=%s "
2514 "ino=%ld)\n",
2515 __func__,
2516 -rc, inode->i_sb->s_id, inode->i_ino);
2517 return rc;
2518 }
2519 }
2520
2521 /* Possibly defer initialization to selinux_complete_init. */
2522 if (sbsec->flags & SE_SBINITIALIZED) {
2523 struct inode_security_struct *isec = inode->i_security;
2524 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2525 isec->sid = newsid;
2526 isec->initialized = 1;
2527 }
2528
2529 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2530 return -EOPNOTSUPP;
2531
2532 if (name) {
2533 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2534 if (!namep)
2535 return -ENOMEM;
2536 *name = namep;
2537 }
2538
2539 if (value && len) {
2540 rc = security_sid_to_context_force(newsid, &context, &clen);
2541 if (rc) {
2542 kfree(namep);
2543 return rc;
2544 }
2545 *value = context;
2546 *len = clen;
2547 }
2548
2549 return 0;
2550 }
2551
2552 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2553 {
2554 return may_create(dir, dentry, SECCLASS_FILE);
2555 }
2556
2557 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2558 {
2559 return may_link(dir, old_dentry, MAY_LINK);
2560 }
2561
2562 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2563 {
2564 return may_link(dir, dentry, MAY_UNLINK);
2565 }
2566
2567 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2568 {
2569 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2570 }
2571
2572 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2573 {
2574 return may_create(dir, dentry, SECCLASS_DIR);
2575 }
2576
2577 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2578 {
2579 return may_link(dir, dentry, MAY_RMDIR);
2580 }
2581
2582 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2583 {
2584 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2585 }
2586
2587 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2588 struct inode *new_inode, struct dentry *new_dentry)
2589 {
2590 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2591 }
2592
2593 static int selinux_inode_readlink(struct dentry *dentry)
2594 {
2595 const struct cred *cred = current_cred();
2596
2597 return dentry_has_perm(cred, dentry, FILE__READ);
2598 }
2599
2600 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2601 {
2602 const struct cred *cred = current_cred();
2603
2604 return dentry_has_perm(cred, dentry, FILE__READ);
2605 }
2606
2607 static noinline int audit_inode_permission(struct inode *inode,
2608 u32 perms, u32 audited, u32 denied,
2609 unsigned flags)
2610 {
2611 struct common_audit_data ad;
2612 struct inode_security_struct *isec = inode->i_security;
2613 int rc;
2614
2615 ad.type = LSM_AUDIT_DATA_INODE;
2616 ad.u.inode = inode;
2617
2618 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2619 audited, denied, &ad, flags);
2620 if (rc)
2621 return rc;
2622 return 0;
2623 }
2624
2625 static int selinux_inode_permission(struct inode *inode, int mask)
2626 {
2627 const struct cred *cred = current_cred();
2628 u32 perms;
2629 bool from_access;
2630 unsigned flags = mask & MAY_NOT_BLOCK;
2631 struct inode_security_struct *isec;
2632 u32 sid;
2633 struct av_decision avd;
2634 int rc, rc2;
2635 u32 audited, denied;
2636
2637 from_access = mask & MAY_ACCESS;
2638 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2639
2640 /* No permission to check. Existence test. */
2641 if (!mask)
2642 return 0;
2643
2644 validate_creds(cred);
2645
2646 if (unlikely(IS_PRIVATE(inode)))
2647 return 0;
2648
2649 perms = file_mask_to_av(inode->i_mode, mask);
2650
2651 sid = cred_sid(cred);
2652 isec = inode->i_security;
2653
2654 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2655 audited = avc_audit_required(perms, &avd, rc,
2656 from_access ? FILE__AUDIT_ACCESS : 0,
2657 &denied);
2658 if (likely(!audited))
2659 return rc;
2660
2661 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2662 if (rc2)
2663 return rc2;
2664 return rc;
2665 }
2666
2667 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2668 {
2669 const struct cred *cred = current_cred();
2670 unsigned int ia_valid = iattr->ia_valid;
2671 __u32 av = FILE__WRITE;
2672
2673 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2674 if (ia_valid & ATTR_FORCE) {
2675 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2676 ATTR_FORCE);
2677 if (!ia_valid)
2678 return 0;
2679 }
2680
2681 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2682 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2683 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2684
2685 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2686 av |= FILE__OPEN;
2687
2688 return dentry_has_perm(cred, dentry, av);
2689 }
2690
2691 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2692 {
2693 const struct cred *cred = current_cred();
2694 struct path path;
2695
2696 path.dentry = dentry;
2697 path.mnt = mnt;
2698
2699 return path_has_perm(cred, &path, FILE__GETATTR);
2700 }
2701
2702 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2703 {
2704 const struct cred *cred = current_cred();
2705
2706 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2707 sizeof XATTR_SECURITY_PREFIX - 1)) {
2708 if (!strcmp(name, XATTR_NAME_CAPS)) {
2709 if (!capable(CAP_SETFCAP))
2710 return -EPERM;
2711 } else if (!capable(CAP_SYS_ADMIN)) {
2712 /* A different attribute in the security namespace.
2713 Restrict to administrator. */
2714 return -EPERM;
2715 }
2716 }
2717
2718 /* Not an attribute we recognize, so just check the
2719 ordinary setattr permission. */
2720 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2721 }
2722
2723 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2724 const void *value, size_t size, int flags)
2725 {
2726 struct inode *inode = dentry->d_inode;
2727 struct inode_security_struct *isec = inode->i_security;
2728 struct superblock_security_struct *sbsec;
2729 struct common_audit_data ad;
2730 u32 newsid, sid = current_sid();
2731 int rc = 0;
2732
2733 if (strcmp(name, XATTR_NAME_SELINUX))
2734 return selinux_inode_setotherxattr(dentry, name);
2735
2736 sbsec = inode->i_sb->s_security;
2737 if (!(sbsec->flags & SE_SBLABELSUPP))
2738 return -EOPNOTSUPP;
2739
2740 if (!inode_owner_or_capable(inode))
2741 return -EPERM;
2742
2743 ad.type = LSM_AUDIT_DATA_DENTRY;
2744 ad.u.dentry = dentry;
2745
2746 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2747 FILE__RELABELFROM, &ad);
2748 if (rc)
2749 return rc;
2750
2751 rc = security_context_to_sid(value, size, &newsid);
2752 if (rc == -EINVAL) {
2753 if (!capable(CAP_MAC_ADMIN)) {
2754 struct audit_buffer *ab;
2755 size_t audit_size;
2756 const char *str;
2757
2758 /* We strip a nul only if it is at the end, otherwise the
2759 * context contains a nul and we should audit that */
2760 if (value) {
2761 str = value;
2762 if (str[size - 1] == '\0')
2763 audit_size = size - 1;
2764 else
2765 audit_size = size;
2766 } else {
2767 str = "";
2768 audit_size = 0;
2769 }
2770 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2771 audit_log_format(ab, "op=setxattr invalid_context=");
2772 audit_log_n_untrustedstring(ab, value, audit_size);
2773 audit_log_end(ab);
2774
2775 return rc;
2776 }
2777 rc = security_context_to_sid_force(value, size, &newsid);
2778 }
2779 if (rc)
2780 return rc;
2781
2782 rc = avc_has_perm(sid, newsid, isec->sclass,
2783 FILE__RELABELTO, &ad);
2784 if (rc)
2785 return rc;
2786
2787 rc = security_validate_transition(isec->sid, newsid, sid,
2788 isec->sclass);
2789 if (rc)
2790 return rc;
2791
2792 return avc_has_perm(newsid,
2793 sbsec->sid,
2794 SECCLASS_FILESYSTEM,
2795 FILESYSTEM__ASSOCIATE,
2796 &ad);
2797 }
2798
2799 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2800 const void *value, size_t size,
2801 int flags)
2802 {
2803 struct inode *inode = dentry->d_inode;
2804 struct inode_security_struct *isec = inode->i_security;
2805 u32 newsid;
2806 int rc;
2807
2808 if (strcmp(name, XATTR_NAME_SELINUX)) {
2809 /* Not an attribute we recognize, so nothing to do. */
2810 return;
2811 }
2812
2813 rc = security_context_to_sid_force(value, size, &newsid);
2814 if (rc) {
2815 printk(KERN_ERR "SELinux: unable to map context to SID"
2816 "for (%s, %lu), rc=%d\n",
2817 inode->i_sb->s_id, inode->i_ino, -rc);
2818 return;
2819 }
2820
2821 isec->sid = newsid;
2822 return;
2823 }
2824
2825 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2826 {
2827 const struct cred *cred = current_cred();
2828
2829 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2830 }
2831
2832 static int selinux_inode_listxattr(struct dentry *dentry)
2833 {
2834 const struct cred *cred = current_cred();
2835
2836 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2837 }
2838
2839 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2840 {
2841 if (strcmp(name, XATTR_NAME_SELINUX))
2842 return selinux_inode_setotherxattr(dentry, name);
2843
2844 /* No one is allowed to remove a SELinux security label.
2845 You can change the label, but all data must be labeled. */
2846 return -EACCES;
2847 }
2848
2849 /*
2850 * Copy the inode security context value to the user.
2851 *
2852 * Permission check is handled by selinux_inode_getxattr hook.
2853 */
2854 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2855 {
2856 u32 size;
2857 int error;
2858 char *context = NULL;
2859 struct inode_security_struct *isec = inode->i_security;
2860
2861 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2862 return -EOPNOTSUPP;
2863
2864 /*
2865 * If the caller has CAP_MAC_ADMIN, then get the raw context
2866 * value even if it is not defined by current policy; otherwise,
2867 * use the in-core value under current policy.
2868 * Use the non-auditing forms of the permission checks since
2869 * getxattr may be called by unprivileged processes commonly
2870 * and lack of permission just means that we fall back to the
2871 * in-core context value, not a denial.
2872 */
2873 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2874 SECURITY_CAP_NOAUDIT);
2875 if (!error)
2876 error = security_sid_to_context_force(isec->sid, &context,
2877 &size);
2878 else
2879 error = security_sid_to_context(isec->sid, &context, &size);
2880 if (error)
2881 return error;
2882 error = size;
2883 if (alloc) {
2884 *buffer = context;
2885 goto out_nofree;
2886 }
2887 kfree(context);
2888 out_nofree:
2889 return error;
2890 }
2891
2892 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2893 const void *value, size_t size, int flags)
2894 {
2895 struct inode_security_struct *isec = inode->i_security;
2896 u32 newsid;
2897 int rc;
2898
2899 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2900 return -EOPNOTSUPP;
2901
2902 if (!value || !size)
2903 return -EACCES;
2904
2905 rc = security_context_to_sid((void *)value, size, &newsid);
2906 if (rc)
2907 return rc;
2908
2909 isec->sid = newsid;
2910 isec->initialized = 1;
2911 return 0;
2912 }
2913
2914 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2915 {
2916 const int len = sizeof(XATTR_NAME_SELINUX);
2917 if (buffer && len <= buffer_size)
2918 memcpy(buffer, XATTR_NAME_SELINUX, len);
2919 return len;
2920 }
2921
2922 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2923 {
2924 struct inode_security_struct *isec = inode->i_security;
2925 *secid = isec->sid;
2926 }
2927
2928 /* file security operations */
2929
2930 static int selinux_revalidate_file_permission(struct file *file, int mask)
2931 {
2932 const struct cred *cred = current_cred();
2933 struct inode *inode = file_inode(file);
2934
2935 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2936 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2937 mask |= MAY_APPEND;
2938
2939 return file_has_perm(cred, file,
2940 file_mask_to_av(inode->i_mode, mask));
2941 }
2942
2943 static int selinux_file_permission(struct file *file, int mask)
2944 {
2945 struct inode *inode = file_inode(file);
2946 struct file_security_struct *fsec = file->f_security;
2947 struct inode_security_struct *isec = inode->i_security;
2948 u32 sid = current_sid();
2949
2950 if (!mask)
2951 /* No permission to check. Existence test. */
2952 return 0;
2953
2954 if (sid == fsec->sid && fsec->isid == isec->sid &&
2955 fsec->pseqno == avc_policy_seqno())
2956 /* No change since file_open check. */
2957 return 0;
2958
2959 return selinux_revalidate_file_permission(file, mask);
2960 }
2961
2962 static int selinux_file_alloc_security(struct file *file)
2963 {
2964 return file_alloc_security(file);
2965 }
2966
2967 static void selinux_file_free_security(struct file *file)
2968 {
2969 file_free_security(file);
2970 }
2971
2972 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2973 unsigned long arg)
2974 {
2975 const struct cred *cred = current_cred();
2976 int error = 0;
2977
2978 switch (cmd) {
2979 case FIONREAD:
2980 /* fall through */
2981 case FIBMAP:
2982 /* fall through */
2983 case FIGETBSZ:
2984 /* fall through */
2985 case FS_IOC_GETFLAGS:
2986 /* fall through */
2987 case FS_IOC_GETVERSION:
2988 error = file_has_perm(cred, file, FILE__GETATTR);
2989 break;
2990
2991 case FS_IOC_SETFLAGS:
2992 /* fall through */
2993 case FS_IOC_SETVERSION:
2994 error = file_has_perm(cred, file, FILE__SETATTR);
2995 break;
2996
2997 /* sys_ioctl() checks */
2998 case FIONBIO:
2999 /* fall through */
3000 case FIOASYNC:
3001 error = file_has_perm(cred, file, 0);
3002 break;
3003
3004 case KDSKBENT:
3005 case KDSKBSENT:
3006 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3007 SECURITY_CAP_AUDIT);
3008 break;
3009
3010 /* default case assumes that the command will go
3011 * to the file's ioctl() function.
3012 */
3013 default:
3014 error = file_has_perm(cred, file, FILE__IOCTL);
3015 }
3016 return error;
3017 }
3018
3019 static int default_noexec;
3020
3021 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3022 {
3023 const struct cred *cred = current_cred();
3024 int rc = 0;
3025
3026 if (default_noexec &&
3027 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3028 /*
3029 * We are making executable an anonymous mapping or a
3030 * private file mapping that will also be writable.
3031 * This has an additional check.
3032 */
3033 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3034 if (rc)
3035 goto error;
3036 }
3037
3038 if (file) {
3039 /* read access is always possible with a mapping */
3040 u32 av = FILE__READ;
3041
3042 /* write access only matters if the mapping is shared */
3043 if (shared && (prot & PROT_WRITE))
3044 av |= FILE__WRITE;
3045
3046 if (prot & PROT_EXEC)
3047 av |= FILE__EXECUTE;
3048
3049 return file_has_perm(cred, file, av);
3050 }
3051
3052 error:
3053 return rc;
3054 }
3055
3056 static int selinux_mmap_addr(unsigned long addr)
3057 {
3058 int rc = 0;
3059 u32 sid = current_sid();
3060
3061 /*
3062 * notice that we are intentionally putting the SELinux check before
3063 * the secondary cap_file_mmap check. This is such a likely attempt
3064 * at bad behaviour/exploit that we always want to get the AVC, even
3065 * if DAC would have also denied the operation.
3066 */
3067 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3068 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3069 MEMPROTECT__MMAP_ZERO, NULL);
3070 if (rc)
3071 return rc;
3072 }
3073
3074 /* do DAC check on address space usage */
3075 return cap_mmap_addr(addr);
3076 }
3077
3078 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3079 unsigned long prot, unsigned long flags)
3080 {
3081 if (selinux_checkreqprot)
3082 prot = reqprot;
3083
3084 return file_map_prot_check(file, prot,
3085 (flags & MAP_TYPE) == MAP_SHARED);
3086 }
3087
3088 static int selinux_file_mprotect(struct vm_area_struct *vma,
3089 unsigned long reqprot,
3090 unsigned long prot)
3091 {
3092 const struct cred *cred = current_cred();
3093
3094 if (selinux_checkreqprot)
3095 prot = reqprot;
3096
3097 if (default_noexec &&
3098 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3099 int rc = 0;
3100 if (vma->vm_start >= vma->vm_mm->start_brk &&
3101 vma->vm_end <= vma->vm_mm->brk) {
3102 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3103 } else if (!vma->vm_file &&
3104 vma->vm_start <= vma->vm_mm->start_stack &&
3105 vma->vm_end >= vma->vm_mm->start_stack) {
3106 rc = current_has_perm(current, PROCESS__EXECSTACK);
3107 } else if (vma->vm_file && vma->anon_vma) {
3108 /*
3109 * We are making executable a file mapping that has
3110 * had some COW done. Since pages might have been
3111 * written, check ability to execute the possibly
3112 * modified content. This typically should only
3113 * occur for text relocations.
3114 */
3115 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3116 }
3117 if (rc)
3118 return rc;
3119 }
3120
3121 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3122 }
3123
3124 static int selinux_file_lock(struct file *file, unsigned int cmd)
3125 {
3126 const struct cred *cred = current_cred();
3127
3128 return file_has_perm(cred, file, FILE__LOCK);
3129 }
3130
3131 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3132 unsigned long arg)
3133 {
3134 const struct cred *cred = current_cred();
3135 int err = 0;
3136
3137 switch (cmd) {
3138 case F_SETFL:
3139 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3140 err = file_has_perm(cred, file, FILE__WRITE);
3141 break;
3142 }
3143 /* fall through */
3144 case F_SETOWN:
3145 case F_SETSIG:
3146 case F_GETFL:
3147 case F_GETOWN:
3148 case F_GETSIG:
3149 case F_GETOWNER_UIDS:
3150 /* Just check FD__USE permission */
3151 err = file_has_perm(cred, file, 0);
3152 break;
3153 case F_GETLK:
3154 case F_SETLK:
3155 case F_SETLKW:
3156 #if BITS_PER_LONG == 32
3157 case F_GETLK64:
3158 case F_SETLK64:
3159 case F_SETLKW64:
3160 #endif
3161 err = file_has_perm(cred, file, FILE__LOCK);
3162 break;
3163 }
3164
3165 return err;
3166 }
3167
3168 static int selinux_file_set_fowner(struct file *file)
3169 {
3170 struct file_security_struct *fsec;
3171
3172 fsec = file->f_security;
3173 fsec->fown_sid = current_sid();
3174
3175 return 0;
3176 }
3177
3178 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3179 struct fown_struct *fown, int signum)
3180 {
3181 struct file *file;
3182 u32 sid = task_sid(tsk);
3183 u32 perm;
3184 struct file_security_struct *fsec;
3185
3186 /* struct fown_struct is never outside the context of a struct file */
3187 file = container_of(fown, struct file, f_owner);
3188
3189 fsec = file->f_security;
3190
3191 if (!signum)
3192 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3193 else
3194 perm = signal_to_av(signum);
3195
3196 return avc_has_perm(fsec->fown_sid, sid,
3197 SECCLASS_PROCESS, perm, NULL);
3198 }
3199
3200 static int selinux_file_receive(struct file *file)
3201 {
3202 const struct cred *cred = current_cred();
3203
3204 return file_has_perm(cred, file, file_to_av(file));
3205 }
3206
3207 static int selinux_file_open(struct file *file, const struct cred *cred)
3208 {
3209 struct file_security_struct *fsec;
3210 struct inode_security_struct *isec;
3211
3212 fsec = file->f_security;
3213 isec = file_inode(file)->i_security;
3214 /*
3215 * Save inode label and policy sequence number
3216 * at open-time so that selinux_file_permission
3217 * can determine whether revalidation is necessary.
3218 * Task label is already saved in the file security
3219 * struct as its SID.
3220 */
3221 fsec->isid = isec->sid;
3222 fsec->pseqno = avc_policy_seqno();
3223 /*
3224 * Since the inode label or policy seqno may have changed
3225 * between the selinux_inode_permission check and the saving
3226 * of state above, recheck that access is still permitted.
3227 * Otherwise, access might never be revalidated against the
3228 * new inode label or new policy.
3229 * This check is not redundant - do not remove.
3230 */
3231 return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3232 }
3233
3234 /* task security operations */
3235
3236 static int selinux_task_create(unsigned long clone_flags)
3237 {
3238 return current_has_perm(current, PROCESS__FORK);
3239 }
3240
3241 /*
3242 * allocate the SELinux part of blank credentials
3243 */
3244 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3245 {
3246 struct task_security_struct *tsec;
3247
3248 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3249 if (!tsec)
3250 return -ENOMEM;
3251
3252 cred->security = tsec;
3253 return 0;
3254 }
3255
3256 /*
3257 * detach and free the LSM part of a set of credentials
3258 */
3259 static void selinux_cred_free(struct cred *cred)
3260 {
3261 struct task_security_struct *tsec = cred->security;
3262
3263 /*
3264 * cred->security == NULL if security_cred_alloc_blank() or
3265 * security_prepare_creds() returned an error.
3266 */
3267 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3268 cred->security = (void *) 0x7UL;
3269 kfree(tsec);
3270 }
3271
3272 /*
3273 * prepare a new set of credentials for modification
3274 */
3275 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3276 gfp_t gfp)
3277 {
3278 const struct task_security_struct *old_tsec;
3279 struct task_security_struct *tsec;
3280
3281 old_tsec = old->security;
3282
3283 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3284 if (!tsec)
3285 return -ENOMEM;
3286
3287 new->security = tsec;
3288 return 0;
3289 }
3290
3291 /*
3292 * transfer the SELinux data to a blank set of creds
3293 */
3294 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3295 {
3296 const struct task_security_struct *old_tsec = old->security;
3297 struct task_security_struct *tsec = new->security;
3298
3299 *tsec = *old_tsec;
3300 }
3301
3302 /*
3303 * set the security data for a kernel service
3304 * - all the creation contexts are set to unlabelled
3305 */
3306 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3307 {
3308 struct task_security_struct *tsec = new->security;
3309 u32 sid = current_sid();
3310 int ret;
3311
3312 ret = avc_has_perm(sid, secid,
3313 SECCLASS_KERNEL_SERVICE,
3314 KERNEL_SERVICE__USE_AS_OVERRIDE,
3315 NULL);
3316 if (ret == 0) {
3317 tsec->sid = secid;
3318 tsec->create_sid = 0;
3319 tsec->keycreate_sid = 0;
3320 tsec->sockcreate_sid = 0;
3321 }
3322 return ret;
3323 }
3324
3325 /*
3326 * set the file creation context in a security record to the same as the
3327 * objective context of the specified inode
3328 */
3329 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3330 {
3331 struct inode_security_struct *isec = inode->i_security;
3332 struct task_security_struct *tsec = new->security;
3333 u32 sid = current_sid();
3334 int ret;
3335
3336 ret = avc_has_perm(sid, isec->sid,
3337 SECCLASS_KERNEL_SERVICE,
3338 KERNEL_SERVICE__CREATE_FILES_AS,
3339 NULL);
3340
3341 if (ret == 0)
3342 tsec->create_sid = isec->sid;
3343 return ret;
3344 }
3345
3346 static int selinux_kernel_module_request(char *kmod_name)
3347 {
3348 u32 sid;
3349 struct common_audit_data ad;
3350
3351 sid = task_sid(current);
3352
3353 ad.type = LSM_AUDIT_DATA_KMOD;
3354 ad.u.kmod_name = kmod_name;
3355
3356 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3357 SYSTEM__MODULE_REQUEST, &ad);
3358 }
3359
3360 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3361 {
3362 return current_has_perm(p, PROCESS__SETPGID);
3363 }
3364
3365 static int selinux_task_getpgid(struct task_struct *p)
3366 {
3367 return current_has_perm(p, PROCESS__GETPGID);
3368 }
3369
3370 static int selinux_task_getsid(struct task_struct *p)
3371 {
3372 return current_has_perm(p, PROCESS__GETSESSION);
3373 }
3374
3375 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3376 {
3377 *secid = task_sid(p);
3378 }
3379
3380 static int selinux_task_setnice(struct task_struct *p, int nice)
3381 {
3382 int rc;
3383
3384 rc = cap_task_setnice(p, nice);
3385 if (rc)
3386 return rc;
3387
3388 return current_has_perm(p, PROCESS__SETSCHED);
3389 }
3390
3391 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3392 {
3393 int rc;
3394
3395 rc = cap_task_setioprio(p, ioprio);
3396 if (rc)
3397 return rc;
3398
3399 return current_has_perm(p, PROCESS__SETSCHED);
3400 }
3401
3402 static int selinux_task_getioprio(struct task_struct *p)
3403 {
3404 return current_has_perm(p, PROCESS__GETSCHED);
3405 }
3406
3407 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3408 struct rlimit *new_rlim)
3409 {
3410 struct rlimit *old_rlim = p->signal->rlim + resource;
3411
3412 /* Control the ability to change the hard limit (whether
3413 lowering or raising it), so that the hard limit can
3414 later be used as a safe reset point for the soft limit
3415 upon context transitions. See selinux_bprm_committing_creds. */
3416 if (old_rlim->rlim_max != new_rlim->rlim_max)
3417 return current_has_perm(p, PROCESS__SETRLIMIT);
3418
3419 return 0;
3420 }
3421
3422 static int selinux_task_setscheduler(struct task_struct *p)
3423 {
3424 int rc;
3425
3426 rc = cap_task_setscheduler(p);
3427 if (rc)
3428 return rc;
3429
3430 return current_has_perm(p, PROCESS__SETSCHED);
3431 }
3432
3433 static int selinux_task_getscheduler(struct task_struct *p)
3434 {
3435 return current_has_perm(p, PROCESS__GETSCHED);
3436 }
3437
3438 static int selinux_task_movememory(struct task_struct *p)
3439 {
3440 return current_has_perm(p, PROCESS__SETSCHED);
3441 }
3442
3443 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3444 int sig, u32 secid)
3445 {
3446 u32 perm;
3447 int rc;
3448
3449 if (!sig)
3450 perm = PROCESS__SIGNULL; /* null signal; existence test */
3451 else
3452 perm = signal_to_av(sig);
3453 if (secid)
3454 rc = avc_has_perm(secid, task_sid(p),
3455 SECCLASS_PROCESS, perm, NULL);
3456 else
3457 rc = current_has_perm(p, perm);
3458 return rc;
3459 }
3460
3461 static int selinux_task_wait(struct task_struct *p)
3462 {
3463 return task_has_perm(p, current, PROCESS__SIGCHLD);
3464 }
3465
3466 static void selinux_task_to_inode(struct task_struct *p,
3467 struct inode *inode)
3468 {
3469 struct inode_security_struct *isec = inode->i_security;
3470 u32 sid = task_sid(p);
3471
3472 isec->sid = sid;
3473 isec->initialized = 1;
3474 }
3475
3476 /* Returns error only if unable to parse addresses */
3477 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3478 struct common_audit_data *ad, u8 *proto)
3479 {
3480 int offset, ihlen, ret = -EINVAL;
3481 struct iphdr _iph, *ih;
3482
3483 offset = skb_network_offset(skb);
3484 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3485 if (ih == NULL)
3486 goto out;
3487
3488 ihlen = ih->ihl * 4;
3489 if (ihlen < sizeof(_iph))
3490 goto out;
3491
3492 ad->u.net->v4info.saddr = ih->saddr;
3493 ad->u.net->v4info.daddr = ih->daddr;
3494 ret = 0;
3495
3496 if (proto)
3497 *proto = ih->protocol;
3498
3499 switch (ih->protocol) {
3500 case IPPROTO_TCP: {
3501 struct tcphdr _tcph, *th;
3502
3503 if (ntohs(ih->frag_off) & IP_OFFSET)
3504 break;
3505
3506 offset += ihlen;
3507 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3508 if (th == NULL)
3509 break;
3510
3511 ad->u.net->sport = th->source;
3512 ad->u.net->dport = th->dest;
3513 break;
3514 }
3515
3516 case IPPROTO_UDP: {
3517 struct udphdr _udph, *uh;
3518
3519 if (ntohs(ih->frag_off) & IP_OFFSET)
3520 break;
3521
3522 offset += ihlen;
3523 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3524 if (uh == NULL)
3525 break;
3526
3527 ad->u.net->sport = uh->source;
3528 ad->u.net->dport = uh->dest;
3529 break;
3530 }
3531
3532 case IPPROTO_DCCP: {
3533 struct dccp_hdr _dccph, *dh;
3534
3535 if (ntohs(ih->frag_off) & IP_OFFSET)
3536 break;
3537
3538 offset += ihlen;
3539 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3540 if (dh == NULL)
3541 break;
3542
3543 ad->u.net->sport = dh->dccph_sport;
3544 ad->u.net->dport = dh->dccph_dport;
3545 break;
3546 }
3547
3548 default:
3549 break;
3550 }
3551 out:
3552 return ret;
3553 }
3554
3555 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3556
3557 /* Returns error only if unable to parse addresses */
3558 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3559 struct common_audit_data *ad, u8 *proto)
3560 {
3561 u8 nexthdr;
3562 int ret = -EINVAL, offset;
3563 struct ipv6hdr _ipv6h, *ip6;
3564 __be16 frag_off;
3565
3566 offset = skb_network_offset(skb);
3567 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3568 if (ip6 == NULL)
3569 goto out;
3570
3571 ad->u.net->v6info.saddr = ip6->saddr;
3572 ad->u.net->v6info.daddr = ip6->daddr;
3573 ret = 0;
3574
3575 nexthdr = ip6->nexthdr;
3576 offset += sizeof(_ipv6h);
3577 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3578 if (offset < 0)
3579 goto out;
3580
3581 if (proto)
3582 *proto = nexthdr;
3583
3584 switch (nexthdr) {
3585 case IPPROTO_TCP: {
3586 struct tcphdr _tcph, *th;
3587
3588 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3589 if (th == NULL)
3590 break;
3591
3592 ad->u.net->sport = th->source;
3593 ad->u.net->dport = th->dest;
3594 break;
3595 }
3596
3597 case IPPROTO_UDP: {
3598 struct udphdr _udph, *uh;
3599
3600 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3601 if (uh == NULL)
3602 break;
3603
3604 ad->u.net->sport = uh->source;
3605 ad->u.net->dport = uh->dest;
3606 break;
3607 }
3608
3609 case IPPROTO_DCCP: {
3610 struct dccp_hdr _dccph, *dh;
3611
3612 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3613 if (dh == NULL)
3614 break;
3615
3616 ad->u.net->sport = dh->dccph_sport;
3617 ad->u.net->dport = dh->dccph_dport;
3618 break;
3619 }
3620
3621 /* includes fragments */
3622 default:
3623 break;
3624 }
3625 out:
3626 return ret;
3627 }
3628
3629 #endif /* IPV6 */
3630
3631 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3632 char **_addrp, int src, u8 *proto)
3633 {
3634 char *addrp;
3635 int ret;
3636
3637 switch (ad->u.net->family) {
3638 case PF_INET:
3639 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3640 if (ret)
3641 goto parse_error;
3642 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3643 &ad->u.net->v4info.daddr);
3644 goto okay;
3645
3646 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3647 case PF_INET6:
3648 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3649 if (ret)
3650 goto parse_error;
3651 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3652 &ad->u.net->v6info.daddr);
3653 goto okay;
3654 #endif /* IPV6 */
3655 default:
3656 addrp = NULL;
3657 goto okay;
3658 }
3659
3660 parse_error:
3661 printk(KERN_WARNING
3662 "SELinux: failure in selinux_parse_skb(),"
3663 " unable to parse packet\n");
3664 return ret;
3665
3666 okay:
3667 if (_addrp)
3668 *_addrp = addrp;
3669 return 0;
3670 }
3671
3672 /**
3673 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3674 * @skb: the packet
3675 * @family: protocol family
3676 * @sid: the packet's peer label SID
3677 *
3678 * Description:
3679 * Check the various different forms of network peer labeling and determine
3680 * the peer label/SID for the packet; most of the magic actually occurs in
3681 * the security server function security_net_peersid_cmp(). The function
3682 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3683 * or -EACCES if @sid is invalid due to inconsistencies with the different
3684 * peer labels.
3685 *
3686 */
3687 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3688 {
3689 int err;
3690 u32 xfrm_sid;
3691 u32 nlbl_sid;
3692 u32 nlbl_type;
3693
3694 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3695 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3696
3697 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3698 if (unlikely(err)) {
3699 printk(KERN_WARNING
3700 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3701 " unable to determine packet's peer label\n");
3702 return -EACCES;
3703 }
3704
3705 return 0;
3706 }
3707
3708 /* socket security operations */
3709
3710 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3711 u16 secclass, u32 *socksid)
3712 {
3713 if (tsec->sockcreate_sid > SECSID_NULL) {
3714 *socksid = tsec->sockcreate_sid;
3715 return 0;
3716 }
3717
3718 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3719 socksid);
3720 }
3721
3722 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3723 {
3724 struct sk_security_struct *sksec = sk->sk_security;
3725 struct common_audit_data ad;
3726 struct lsm_network_audit net = {0,};
3727 u32 tsid = task_sid(task);
3728
3729 if (sksec->sid == SECINITSID_KERNEL)
3730 return 0;
3731
3732 ad.type = LSM_AUDIT_DATA_NET;
3733 ad.u.net = &net;
3734 ad.u.net->sk = sk;
3735
3736 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3737 }
3738
3739 static int selinux_socket_create(int family, int type,
3740 int protocol, int kern)
3741 {
3742 const struct task_security_struct *tsec = current_security();
3743 u32 newsid;
3744 u16 secclass;
3745 int rc;
3746
3747 if (kern)
3748 return 0;
3749
3750 secclass = socket_type_to_security_class(family, type, protocol);
3751 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3752 if (rc)
3753 return rc;
3754
3755 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3756 }
3757
3758 static int selinux_socket_post_create(struct socket *sock, int family,
3759 int type, int protocol, int kern)
3760 {
3761 const struct task_security_struct *tsec = current_security();
3762 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3763 struct sk_security_struct *sksec;
3764 int err = 0;
3765
3766 isec->sclass = socket_type_to_security_class(family, type, protocol);
3767
3768 if (kern)
3769 isec->sid = SECINITSID_KERNEL;
3770 else {
3771 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3772 if (err)
3773 return err;
3774 }
3775
3776 isec->initialized = 1;
3777
3778 if (sock->sk) {
3779 sksec = sock->sk->sk_security;
3780 sksec->sid = isec->sid;
3781 sksec->sclass = isec->sclass;
3782 err = selinux_netlbl_socket_post_create(sock->sk, family);
3783 }
3784
3785 return err;
3786 }
3787
3788 /* Range of port numbers used to automatically bind.
3789 Need to determine whether we should perform a name_bind
3790 permission check between the socket and the port number. */
3791
3792 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3793 {
3794 struct sock *sk = sock->sk;
3795 u16 family;
3796 int err;
3797
3798 err = sock_has_perm(current, sk, SOCKET__BIND);
3799 if (err)
3800 goto out;
3801
3802 /*
3803 * If PF_INET or PF_INET6, check name_bind permission for the port.
3804 * Multiple address binding for SCTP is not supported yet: we just
3805 * check the first address now.
3806 */
3807 family = sk->sk_family;
3808 if (family == PF_INET || family == PF_INET6) {
3809 char *addrp;
3810 struct sk_security_struct *sksec = sk->sk_security;
3811 struct common_audit_data ad;
3812 struct lsm_network_audit net = {0,};
3813 struct sockaddr_in *addr4 = NULL;
3814 struct sockaddr_in6 *addr6 = NULL;
3815 unsigned short snum;
3816 u32 sid, node_perm;
3817
3818 if (family == PF_INET) {
3819 addr4 = (struct sockaddr_in *)address;
3820 snum = ntohs(addr4->sin_port);
3821 addrp = (char *)&addr4->sin_addr.s_addr;
3822 } else {
3823 addr6 = (struct sockaddr_in6 *)address;
3824 snum = ntohs(addr6->sin6_port);
3825 addrp = (char *)&addr6->sin6_addr.s6_addr;
3826 }
3827
3828 if (snum) {
3829 int low, high;
3830
3831 inet_get_local_port_range(&low, &high);
3832
3833 if (snum < max(PROT_SOCK, low) || snum > high) {
3834 err = sel_netport_sid(sk->sk_protocol,
3835 snum, &sid);
3836 if (err)
3837 goto out;
3838 ad.type = LSM_AUDIT_DATA_NET;
3839 ad.u.net = &net;
3840 ad.u.net->sport = htons(snum);
3841 ad.u.net->family = family;
3842 err = avc_has_perm(sksec->sid, sid,
3843 sksec->sclass,
3844 SOCKET__NAME_BIND, &ad);
3845 if (err)
3846 goto out;
3847 }
3848 }
3849
3850 switch (sksec->sclass) {
3851 case SECCLASS_TCP_SOCKET:
3852 node_perm = TCP_SOCKET__NODE_BIND;
3853 break;
3854
3855 case SECCLASS_UDP_SOCKET:
3856 node_perm = UDP_SOCKET__NODE_BIND;
3857 break;
3858
3859 case SECCLASS_DCCP_SOCKET:
3860 node_perm = DCCP_SOCKET__NODE_BIND;
3861 break;
3862
3863 default:
3864 node_perm = RAWIP_SOCKET__NODE_BIND;
3865 break;
3866 }
3867
3868 err = sel_netnode_sid(addrp, family, &sid);
3869 if (err)
3870 goto out;
3871
3872 ad.type = LSM_AUDIT_DATA_NET;
3873 ad.u.net = &net;
3874 ad.u.net->sport = htons(snum);
3875 ad.u.net->family = family;
3876
3877 if (family == PF_INET)
3878 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3879 else
3880 ad.u.net->v6info.saddr = addr6->sin6_addr;
3881
3882 err = avc_has_perm(sksec->sid, sid,
3883 sksec->sclass, node_perm, &ad);
3884 if (err)
3885 goto out;
3886 }
3887 out:
3888 return err;
3889 }
3890
3891 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3892 {
3893 struct sock *sk = sock->sk;
3894 struct sk_security_struct *sksec = sk->sk_security;
3895 int err;
3896
3897 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3898 if (err)
3899 return err;
3900
3901 /*
3902 * If a TCP or DCCP socket, check name_connect permission for the port.
3903 */
3904 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3905 sksec->sclass == SECCLASS_DCCP_SOCKET) {
3906 struct common_audit_data ad;
3907 struct lsm_network_audit net = {0,};
3908 struct sockaddr_in *addr4 = NULL;
3909 struct sockaddr_in6 *addr6 = NULL;
3910 unsigned short snum;
3911 u32 sid, perm;
3912
3913 if (sk->sk_family == PF_INET) {
3914 addr4 = (struct sockaddr_in *)address;
3915 if (addrlen < sizeof(struct sockaddr_in))
3916 return -EINVAL;
3917 snum = ntohs(addr4->sin_port);
3918 } else {
3919 addr6 = (struct sockaddr_in6 *)address;
3920 if (addrlen < SIN6_LEN_RFC2133)
3921 return -EINVAL;
3922 snum = ntohs(addr6->sin6_port);
3923 }
3924
3925 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3926 if (err)
3927 goto out;
3928
3929 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3930 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3931
3932 ad.type = LSM_AUDIT_DATA_NET;
3933 ad.u.net = &net;
3934 ad.u.net->dport = htons(snum);
3935 ad.u.net->family = sk->sk_family;
3936 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3937 if (err)
3938 goto out;
3939 }
3940
3941 err = selinux_netlbl_socket_connect(sk, address);
3942
3943 out:
3944 return err;
3945 }
3946
3947 static int selinux_socket_listen(struct socket *sock, int backlog)
3948 {
3949 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3950 }
3951
3952 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3953 {
3954 int err;
3955 struct inode_security_struct *isec;
3956 struct inode_security_struct *newisec;
3957
3958 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3959 if (err)
3960 return err;
3961
3962 newisec = SOCK_INODE(newsock)->i_security;
3963
3964 isec = SOCK_INODE(sock)->i_security;
3965 newisec->sclass = isec->sclass;
3966 newisec->sid = isec->sid;
3967 newisec->initialized = 1;
3968
3969 return 0;
3970 }
3971
3972 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3973 int size)
3974 {
3975 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
3976 }
3977
3978 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3979 int size, int flags)
3980 {
3981 return sock_has_perm(current, sock->sk, SOCKET__READ);
3982 }
3983
3984 static int selinux_socket_getsockname(struct socket *sock)
3985 {
3986 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3987 }
3988
3989 static int selinux_socket_getpeername(struct socket *sock)
3990 {
3991 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3992 }
3993
3994 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3995 {
3996 int err;
3997
3998 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
3999 if (err)
4000 return err;
4001
4002 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4003 }
4004
4005 static int selinux_socket_getsockopt(struct socket *sock, int level,
4006 int optname)
4007 {
4008 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4009 }
4010
4011 static int selinux_socket_shutdown(struct socket *sock, int how)
4012 {
4013 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4014 }
4015
4016 static int selinux_socket_unix_stream_connect(struct sock *sock,
4017 struct sock *other,
4018 struct sock *newsk)
4019 {
4020 struct sk_security_struct *sksec_sock = sock->sk_security;
4021 struct sk_security_struct *sksec_other = other->sk_security;
4022 struct sk_security_struct *sksec_new = newsk->sk_security;
4023 struct common_audit_data ad;
4024 struct lsm_network_audit net = {0,};
4025 int err;
4026
4027 ad.type = LSM_AUDIT_DATA_NET;
4028 ad.u.net = &net;
4029 ad.u.net->sk = other;
4030
4031 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4032 sksec_other->sclass,
4033 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4034 if (err)
4035 return err;
4036
4037 /* server child socket */
4038 sksec_new->peer_sid = sksec_sock->sid;
4039 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4040 &sksec_new->sid);
4041 if (err)
4042 return err;
4043
4044 /* connecting socket */
4045 sksec_sock->peer_sid = sksec_new->sid;
4046
4047 return 0;
4048 }
4049
4050 static int selinux_socket_unix_may_send(struct socket *sock,
4051 struct socket *other)
4052 {
4053 struct sk_security_struct *ssec = sock->sk->sk_security;
4054 struct sk_security_struct *osec = other->sk->sk_security;
4055 struct common_audit_data ad;
4056 struct lsm_network_audit net = {0,};
4057
4058 ad.type = LSM_AUDIT_DATA_NET;
4059 ad.u.net = &net;
4060 ad.u.net->sk = other->sk;
4061
4062 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4063 &ad);
4064 }
4065
4066 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4067 u32 peer_sid,
4068 struct common_audit_data *ad)
4069 {
4070 int err;
4071 u32 if_sid;
4072 u32 node_sid;
4073
4074 err = sel_netif_sid(ifindex, &if_sid);
4075 if (err)
4076 return err;
4077 err = avc_has_perm(peer_sid, if_sid,
4078 SECCLASS_NETIF, NETIF__INGRESS, ad);
4079 if (err)
4080 return err;
4081
4082 err = sel_netnode_sid(addrp, family, &node_sid);
4083 if (err)
4084 return err;
4085 return avc_has_perm(peer_sid, node_sid,
4086 SECCLASS_NODE, NODE__RECVFROM, ad);
4087 }
4088
4089 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4090 u16 family)
4091 {
4092 int err = 0;
4093 struct sk_security_struct *sksec = sk->sk_security;
4094 u32 sk_sid = sksec->sid;
4095 struct common_audit_data ad;
4096 struct lsm_network_audit net = {0,};
4097 char *addrp;
4098
4099 ad.type = LSM_AUDIT_DATA_NET;
4100 ad.u.net = &net;
4101 ad.u.net->netif = skb->skb_iif;
4102 ad.u.net->family = family;
4103 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4104 if (err)
4105 return err;
4106
4107 if (selinux_secmark_enabled()) {
4108 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4109 PACKET__RECV, &ad);
4110 if (err)
4111 return err;
4112 }
4113
4114 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4115 if (err)
4116 return err;
4117 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4118
4119 return err;
4120 }
4121
4122 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4123 {
4124 int err;
4125 struct sk_security_struct *sksec = sk->sk_security;
4126 u16 family = sk->sk_family;
4127 u32 sk_sid = sksec->sid;
4128 struct common_audit_data ad;
4129 struct lsm_network_audit net = {0,};
4130 char *addrp;
4131 u8 secmark_active;
4132 u8 peerlbl_active;
4133
4134 if (family != PF_INET && family != PF_INET6)
4135 return 0;
4136
4137 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4138 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4139 family = PF_INET;
4140
4141 /* If any sort of compatibility mode is enabled then handoff processing
4142 * to the selinux_sock_rcv_skb_compat() function to deal with the
4143 * special handling. We do this in an attempt to keep this function
4144 * as fast and as clean as possible. */
4145 if (!selinux_policycap_netpeer)
4146 return selinux_sock_rcv_skb_compat(sk, skb, family);
4147
4148 secmark_active = selinux_secmark_enabled();
4149 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4150 if (!secmark_active && !peerlbl_active)
4151 return 0;
4152
4153 ad.type = LSM_AUDIT_DATA_NET;
4154 ad.u.net = &net;
4155 ad.u.net->netif = skb->skb_iif;
4156 ad.u.net->family = family;
4157 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4158 if (err)
4159 return err;
4160
4161 if (peerlbl_active) {
4162 u32 peer_sid;
4163
4164 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4165 if (err)
4166 return err;
4167 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4168 peer_sid, &ad);
4169 if (err) {
4170 selinux_netlbl_err(skb, err, 0);
4171 return err;
4172 }
4173 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4174 PEER__RECV, &ad);
4175 if (err)
4176 selinux_netlbl_err(skb, err, 0);
4177 }
4178
4179 if (secmark_active) {
4180 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4181 PACKET__RECV, &ad);
4182 if (err)
4183 return err;
4184 }
4185
4186 return err;
4187 }
4188
4189 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4190 int __user *optlen, unsigned len)
4191 {
4192 int err = 0;
4193 char *scontext;
4194 u32 scontext_len;
4195 struct sk_security_struct *sksec = sock->sk->sk_security;
4196 u32 peer_sid = SECSID_NULL;
4197
4198 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4199 sksec->sclass == SECCLASS_TCP_SOCKET)
4200 peer_sid = sksec->peer_sid;
4201 if (peer_sid == SECSID_NULL)
4202 return -ENOPROTOOPT;
4203
4204 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4205 if (err)
4206 return err;
4207
4208 if (scontext_len > len) {
4209 err = -ERANGE;
4210 goto out_len;
4211 }
4212
4213 if (copy_to_user(optval, scontext, scontext_len))
4214 err = -EFAULT;
4215
4216 out_len:
4217 if (put_user(scontext_len, optlen))
4218 err = -EFAULT;
4219 kfree(scontext);
4220 return err;
4221 }
4222
4223 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4224 {
4225 u32 peer_secid = SECSID_NULL;
4226 u16 family;
4227
4228 if (skb && skb->protocol == htons(ETH_P_IP))
4229 family = PF_INET;
4230 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4231 family = PF_INET6;
4232 else if (sock)
4233 family = sock->sk->sk_family;
4234 else
4235 goto out;
4236
4237 if (sock && family == PF_UNIX)
4238 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4239 else if (skb)
4240 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4241
4242 out:
4243 *secid = peer_secid;
4244 if (peer_secid == SECSID_NULL)
4245 return -EINVAL;
4246 return 0;
4247 }
4248
4249 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4250 {
4251 struct sk_security_struct *sksec;
4252
4253 sksec = kzalloc(sizeof(*sksec), priority);
4254 if (!sksec)
4255 return -ENOMEM;
4256
4257 sksec->peer_sid = SECINITSID_UNLABELED;
4258 sksec->sid = SECINITSID_UNLABELED;
4259 selinux_netlbl_sk_security_reset(sksec);
4260 sk->sk_security = sksec;
4261
4262 return 0;
4263 }
4264
4265 static void selinux_sk_free_security(struct sock *sk)
4266 {
4267 struct sk_security_struct *sksec = sk->sk_security;
4268
4269 sk->sk_security = NULL;
4270 selinux_netlbl_sk_security_free(sksec);
4271 kfree(sksec);
4272 }
4273
4274 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4275 {
4276 struct sk_security_struct *sksec = sk->sk_security;
4277 struct sk_security_struct *newsksec = newsk->sk_security;
4278
4279 newsksec->sid = sksec->sid;
4280 newsksec->peer_sid = sksec->peer_sid;
4281 newsksec->sclass = sksec->sclass;
4282
4283 selinux_netlbl_sk_security_reset(newsksec);
4284 }
4285
4286 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4287 {
4288 if (!sk)
4289 *secid = SECINITSID_ANY_SOCKET;
4290 else {
4291 struct sk_security_struct *sksec = sk->sk_security;
4292
4293 *secid = sksec->sid;
4294 }
4295 }
4296
4297 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4298 {
4299 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4300 struct sk_security_struct *sksec = sk->sk_security;
4301
4302 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4303 sk->sk_family == PF_UNIX)
4304 isec->sid = sksec->sid;
4305 sksec->sclass = isec->sclass;
4306 }
4307
4308 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4309 struct request_sock *req)
4310 {
4311 struct sk_security_struct *sksec = sk->sk_security;
4312 int err;
4313 u16 family = sk->sk_family;
4314 u32 newsid;
4315 u32 peersid;
4316
4317 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4318 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4319 family = PF_INET;
4320
4321 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4322 if (err)
4323 return err;
4324 if (peersid == SECSID_NULL) {
4325 req->secid = sksec->sid;
4326 req->peer_secid = SECSID_NULL;
4327 } else {
4328 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4329 if (err)
4330 return err;
4331 req->secid = newsid;
4332 req->peer_secid = peersid;
4333 }
4334
4335 return selinux_netlbl_inet_conn_request(req, family);
4336 }
4337
4338 static void selinux_inet_csk_clone(struct sock *newsk,
4339 const struct request_sock *req)
4340 {
4341 struct sk_security_struct *newsksec = newsk->sk_security;
4342
4343 newsksec->sid = req->secid;
4344 newsksec->peer_sid = req->peer_secid;
4345 /* NOTE: Ideally, we should also get the isec->sid for the
4346 new socket in sync, but we don't have the isec available yet.
4347 So we will wait until sock_graft to do it, by which
4348 time it will have been created and available. */
4349
4350 /* We don't need to take any sort of lock here as we are the only
4351 * thread with access to newsksec */
4352 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4353 }
4354
4355 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4356 {
4357 u16 family = sk->sk_family;
4358 struct sk_security_struct *sksec = sk->sk_security;
4359
4360 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4361 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4362 family = PF_INET;
4363
4364 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4365 }
4366
4367 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4368 {
4369 skb_set_owner_w(skb, sk);
4370 }
4371
4372 static int selinux_secmark_relabel_packet(u32 sid)
4373 {
4374 const struct task_security_struct *__tsec;
4375 u32 tsid;
4376
4377 __tsec = current_security();
4378 tsid = __tsec->sid;
4379
4380 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4381 }
4382
4383 static void selinux_secmark_refcount_inc(void)
4384 {
4385 atomic_inc(&selinux_secmark_refcount);
4386 }
4387
4388 static void selinux_secmark_refcount_dec(void)
4389 {
4390 atomic_dec(&selinux_secmark_refcount);
4391 }
4392
4393 static void selinux_req_classify_flow(const struct request_sock *req,
4394 struct flowi *fl)
4395 {
4396 fl->flowi_secid = req->secid;
4397 }
4398
4399 static int selinux_tun_dev_alloc_security(void **security)
4400 {
4401 struct tun_security_struct *tunsec;
4402
4403 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4404 if (!tunsec)
4405 return -ENOMEM;
4406 tunsec->sid = current_sid();
4407
4408 *security = tunsec;
4409 return 0;
4410 }
4411
4412 static void selinux_tun_dev_free_security(void *security)
4413 {
4414 kfree(security);
4415 }
4416
4417 static int selinux_tun_dev_create(void)
4418 {
4419 u32 sid = current_sid();
4420
4421 /* we aren't taking into account the "sockcreate" SID since the socket
4422 * that is being created here is not a socket in the traditional sense,
4423 * instead it is a private sock, accessible only to the kernel, and
4424 * representing a wide range of network traffic spanning multiple
4425 * connections unlike traditional sockets - check the TUN driver to
4426 * get a better understanding of why this socket is special */
4427
4428 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4429 NULL);
4430 }
4431
4432 static int selinux_tun_dev_attach_queue(void *security)
4433 {
4434 struct tun_security_struct *tunsec = security;
4435
4436 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4437 TUN_SOCKET__ATTACH_QUEUE, NULL);
4438 }
4439
4440 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4441 {
4442 struct tun_security_struct *tunsec = security;
4443 struct sk_security_struct *sksec = sk->sk_security;
4444
4445 /* we don't currently perform any NetLabel based labeling here and it
4446 * isn't clear that we would want to do so anyway; while we could apply
4447 * labeling without the support of the TUN user the resulting labeled
4448 * traffic from the other end of the connection would almost certainly
4449 * cause confusion to the TUN user that had no idea network labeling
4450 * protocols were being used */
4451
4452 sksec->sid = tunsec->sid;
4453 sksec->sclass = SECCLASS_TUN_SOCKET;
4454
4455 return 0;
4456 }
4457
4458 static int selinux_tun_dev_open(void *security)
4459 {
4460 struct tun_security_struct *tunsec = security;
4461 u32 sid = current_sid();
4462 int err;
4463
4464 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4465 TUN_SOCKET__RELABELFROM, NULL);
4466 if (err)
4467 return err;
4468 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4469 TUN_SOCKET__RELABELTO, NULL);
4470 if (err)
4471 return err;
4472 tunsec->sid = sid;
4473
4474 return 0;
4475 }
4476
4477 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4478 {
4479 int err = 0;
4480 u32 perm;
4481 struct nlmsghdr *nlh;
4482 struct sk_security_struct *sksec = sk->sk_security;
4483
4484 if (skb->len < NLMSG_SPACE(0)) {
4485 err = -EINVAL;
4486 goto out;
4487 }
4488 nlh = nlmsg_hdr(skb);
4489
4490 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4491 if (err) {
4492 if (err == -EINVAL) {
4493 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4494 "SELinux: unrecognized netlink message"
4495 " type=%hu for sclass=%hu\n",
4496 nlh->nlmsg_type, sksec->sclass);
4497 if (!selinux_enforcing || security_get_allow_unknown())
4498 err = 0;
4499 }
4500
4501 /* Ignore */
4502 if (err == -ENOENT)
4503 err = 0;
4504 goto out;
4505 }
4506
4507 err = sock_has_perm(current, sk, perm);
4508 out:
4509 return err;
4510 }
4511
4512 #ifdef CONFIG_NETFILTER
4513
4514 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4515 u16 family)
4516 {
4517 int err;
4518 char *addrp;
4519 u32 peer_sid;
4520 struct common_audit_data ad;
4521 struct lsm_network_audit net = {0,};
4522 u8 secmark_active;
4523 u8 netlbl_active;
4524 u8 peerlbl_active;
4525
4526 if (!selinux_policycap_netpeer)
4527 return NF_ACCEPT;
4528
4529 secmark_active = selinux_secmark_enabled();
4530 netlbl_active = netlbl_enabled();
4531 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4532 if (!secmark_active && !peerlbl_active)
4533 return NF_ACCEPT;
4534
4535 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4536 return NF_DROP;
4537
4538 ad.type = LSM_AUDIT_DATA_NET;
4539 ad.u.net = &net;
4540 ad.u.net->netif = ifindex;
4541 ad.u.net->family = family;
4542 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4543 return NF_DROP;
4544
4545 if (peerlbl_active) {
4546 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4547 peer_sid, &ad);
4548 if (err) {
4549 selinux_netlbl_err(skb, err, 1);
4550 return NF_DROP;
4551 }
4552 }
4553
4554 if (secmark_active)
4555 if (avc_has_perm(peer_sid, skb->secmark,
4556 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4557 return NF_DROP;
4558
4559 if (netlbl_active)
4560 /* we do this in the FORWARD path and not the POST_ROUTING
4561 * path because we want to make sure we apply the necessary
4562 * labeling before IPsec is applied so we can leverage AH
4563 * protection */
4564 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4565 return NF_DROP;
4566
4567 return NF_ACCEPT;
4568 }
4569
4570 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4571 struct sk_buff *skb,
4572 const struct net_device *in,
4573 const struct net_device *out,
4574 int (*okfn)(struct sk_buff *))
4575 {
4576 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4577 }
4578
4579 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4580 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4581 struct sk_buff *skb,
4582 const struct net_device *in,
4583 const struct net_device *out,
4584 int (*okfn)(struct sk_buff *))
4585 {
4586 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4587 }
4588 #endif /* IPV6 */
4589
4590 static unsigned int selinux_ip_output(struct sk_buff *skb,
4591 u16 family)
4592 {
4593 u32 sid;
4594
4595 if (!netlbl_enabled())
4596 return NF_ACCEPT;
4597
4598 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4599 * because we want to make sure we apply the necessary labeling
4600 * before IPsec is applied so we can leverage AH protection */
4601 if (skb->sk) {
4602 struct sk_security_struct *sksec = skb->sk->sk_security;
4603 sid = sksec->sid;
4604 } else
4605 sid = SECINITSID_KERNEL;
4606 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4607 return NF_DROP;
4608
4609 return NF_ACCEPT;
4610 }
4611
4612 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4613 struct sk_buff *skb,
4614 const struct net_device *in,
4615 const struct net_device *out,
4616 int (*okfn)(struct sk_buff *))
4617 {
4618 return selinux_ip_output(skb, PF_INET);
4619 }
4620
4621 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4622 int ifindex,
4623 u16 family)
4624 {
4625 struct sock *sk = skb->sk;
4626 struct sk_security_struct *sksec;
4627 struct common_audit_data ad;
4628 struct lsm_network_audit net = {0,};
4629 char *addrp;
4630 u8 proto;
4631
4632 if (sk == NULL)
4633 return NF_ACCEPT;
4634 sksec = sk->sk_security;
4635
4636 ad.type = LSM_AUDIT_DATA_NET;
4637 ad.u.net = &net;
4638 ad.u.net->netif = ifindex;
4639 ad.u.net->family = family;
4640 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4641 return NF_DROP;
4642
4643 if (selinux_secmark_enabled())
4644 if (avc_has_perm(sksec->sid, skb->secmark,
4645 SECCLASS_PACKET, PACKET__SEND, &ad))
4646 return NF_DROP_ERR(-ECONNREFUSED);
4647
4648 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4649 return NF_DROP_ERR(-ECONNREFUSED);
4650
4651 return NF_ACCEPT;
4652 }
4653
4654 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4655 u16 family)
4656 {
4657 u32 secmark_perm;
4658 u32 peer_sid;
4659 struct sock *sk;
4660 struct common_audit_data ad;
4661 struct lsm_network_audit net = {0,};
4662 char *addrp;
4663 u8 secmark_active;
4664 u8 peerlbl_active;
4665
4666 /* If any sort of compatibility mode is enabled then handoff processing
4667 * to the selinux_ip_postroute_compat() function to deal with the
4668 * special handling. We do this in an attempt to keep this function
4669 * as fast and as clean as possible. */
4670 if (!selinux_policycap_netpeer)
4671 return selinux_ip_postroute_compat(skb, ifindex, family);
4672 #ifdef CONFIG_XFRM
4673 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4674 * packet transformation so allow the packet to pass without any checks
4675 * since we'll have another chance to perform access control checks
4676 * when the packet is on it's final way out.
4677 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4678 * is NULL, in this case go ahead and apply access control. */
4679 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4680 return NF_ACCEPT;
4681 #endif
4682 secmark_active = selinux_secmark_enabled();
4683 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4684 if (!secmark_active && !peerlbl_active)
4685 return NF_ACCEPT;
4686
4687 /* if the packet is being forwarded then get the peer label from the
4688 * packet itself; otherwise check to see if it is from a local
4689 * application or the kernel, if from an application get the peer label
4690 * from the sending socket, otherwise use the kernel's sid */
4691 sk = skb->sk;
4692 if (sk == NULL) {
4693 if (skb->skb_iif) {
4694 secmark_perm = PACKET__FORWARD_OUT;
4695 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4696 return NF_DROP;
4697 } else {
4698 secmark_perm = PACKET__SEND;
4699 peer_sid = SECINITSID_KERNEL;
4700 }
4701 } else {
4702 struct sk_security_struct *sksec = sk->sk_security;
4703 peer_sid = sksec->sid;
4704 secmark_perm = PACKET__SEND;
4705 }
4706
4707 ad.type = LSM_AUDIT_DATA_NET;
4708 ad.u.net = &net;
4709 ad.u.net->netif = ifindex;
4710 ad.u.net->family = family;
4711 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4712 return NF_DROP;
4713
4714 if (secmark_active)
4715 if (avc_has_perm(peer_sid, skb->secmark,
4716 SECCLASS_PACKET, secmark_perm, &ad))
4717 return NF_DROP_ERR(-ECONNREFUSED);
4718
4719 if (peerlbl_active) {
4720 u32 if_sid;
4721 u32 node_sid;
4722
4723 if (sel_netif_sid(ifindex, &if_sid))
4724 return NF_DROP;
4725 if (avc_has_perm(peer_sid, if_sid,
4726 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4727 return NF_DROP_ERR(-ECONNREFUSED);
4728
4729 if (sel_netnode_sid(addrp, family, &node_sid))
4730 return NF_DROP;
4731 if (avc_has_perm(peer_sid, node_sid,
4732 SECCLASS_NODE, NODE__SENDTO, &ad))
4733 return NF_DROP_ERR(-ECONNREFUSED);
4734 }
4735
4736 return NF_ACCEPT;
4737 }
4738
4739 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4740 struct sk_buff *skb,
4741 const struct net_device *in,
4742 const struct net_device *out,
4743 int (*okfn)(struct sk_buff *))
4744 {
4745 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4746 }
4747
4748 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4749 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4750 struct sk_buff *skb,
4751 const struct net_device *in,
4752 const struct net_device *out,
4753 int (*okfn)(struct sk_buff *))
4754 {
4755 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4756 }
4757 #endif /* IPV6 */
4758
4759 #endif /* CONFIG_NETFILTER */
4760
4761 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4762 {
4763 int err;
4764
4765 err = cap_netlink_send(sk, skb);
4766 if (err)
4767 return err;
4768
4769 return selinux_nlmsg_perm(sk, skb);
4770 }
4771
4772 static int ipc_alloc_security(struct task_struct *task,
4773 struct kern_ipc_perm *perm,
4774 u16 sclass)
4775 {
4776 struct ipc_security_struct *isec;
4777 u32 sid;
4778
4779 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4780 if (!isec)
4781 return -ENOMEM;
4782
4783 sid = task_sid(task);
4784 isec->sclass = sclass;
4785 isec->sid = sid;
4786 perm->security = isec;
4787
4788 return 0;
4789 }
4790
4791 static void ipc_free_security(struct kern_ipc_perm *perm)
4792 {
4793 struct ipc_security_struct *isec = perm->security;
4794 perm->security = NULL;
4795 kfree(isec);
4796 }
4797
4798 static int msg_msg_alloc_security(struct msg_msg *msg)
4799 {
4800 struct msg_security_struct *msec;
4801
4802 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4803 if (!msec)
4804 return -ENOMEM;
4805
4806 msec->sid = SECINITSID_UNLABELED;
4807 msg->security = msec;
4808
4809 return 0;
4810 }
4811
4812 static void msg_msg_free_security(struct msg_msg *msg)
4813 {
4814 struct msg_security_struct *msec = msg->security;
4815
4816 msg->security = NULL;
4817 kfree(msec);
4818 }
4819
4820 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4821 u32 perms)
4822 {
4823 struct ipc_security_struct *isec;
4824 struct common_audit_data ad;
4825 u32 sid = current_sid();
4826
4827 isec = ipc_perms->security;
4828
4829 ad.type = LSM_AUDIT_DATA_IPC;
4830 ad.u.ipc_id = ipc_perms->key;
4831
4832 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4833 }
4834
4835 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4836 {
4837 return msg_msg_alloc_security(msg);
4838 }
4839
4840 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4841 {
4842 msg_msg_free_security(msg);
4843 }
4844
4845 /* message queue security operations */
4846 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4847 {
4848 struct ipc_security_struct *isec;
4849 struct common_audit_data ad;
4850 u32 sid = current_sid();
4851 int rc;
4852
4853 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4854 if (rc)
4855 return rc;
4856
4857 isec = msq->q_perm.security;
4858
4859 ad.type = LSM_AUDIT_DATA_IPC;
4860 ad.u.ipc_id = msq->q_perm.key;
4861
4862 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4863 MSGQ__CREATE, &ad);
4864 if (rc) {
4865 ipc_free_security(&msq->q_perm);
4866 return rc;
4867 }
4868 return 0;
4869 }
4870
4871 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4872 {
4873 ipc_free_security(&msq->q_perm);
4874 }
4875
4876 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4877 {
4878 struct ipc_security_struct *isec;
4879 struct common_audit_data ad;
4880 u32 sid = current_sid();
4881
4882 isec = msq->q_perm.security;
4883
4884 ad.type = LSM_AUDIT_DATA_IPC;
4885 ad.u.ipc_id = msq->q_perm.key;
4886
4887 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4888 MSGQ__ASSOCIATE, &ad);
4889 }
4890
4891 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4892 {
4893 int err;
4894 int perms;
4895
4896 switch (cmd) {
4897 case IPC_INFO:
4898 case MSG_INFO:
4899 /* No specific object, just general system-wide information. */
4900 return task_has_system(current, SYSTEM__IPC_INFO);
4901 case IPC_STAT:
4902 case MSG_STAT:
4903 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4904 break;
4905 case IPC_SET:
4906 perms = MSGQ__SETATTR;
4907 break;
4908 case IPC_RMID:
4909 perms = MSGQ__DESTROY;
4910 break;
4911 default:
4912 return 0;
4913 }
4914
4915 err = ipc_has_perm(&msq->q_perm, perms);
4916 return err;
4917 }
4918
4919 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4920 {
4921 struct ipc_security_struct *isec;
4922 struct msg_security_struct *msec;
4923 struct common_audit_data ad;
4924 u32 sid = current_sid();
4925 int rc;
4926
4927 isec = msq->q_perm.security;
4928 msec = msg->security;
4929
4930 /*
4931 * First time through, need to assign label to the message
4932 */
4933 if (msec->sid == SECINITSID_UNLABELED) {
4934 /*
4935 * Compute new sid based on current process and
4936 * message queue this message will be stored in
4937 */
4938 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4939 NULL, &msec->sid);
4940 if (rc)
4941 return rc;
4942 }
4943
4944 ad.type = LSM_AUDIT_DATA_IPC;
4945 ad.u.ipc_id = msq->q_perm.key;
4946
4947 /* Can this process write to the queue? */
4948 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4949 MSGQ__WRITE, &ad);
4950 if (!rc)
4951 /* Can this process send the message */
4952 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4953 MSG__SEND, &ad);
4954 if (!rc)
4955 /* Can the message be put in the queue? */
4956 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4957 MSGQ__ENQUEUE, &ad);
4958
4959 return rc;
4960 }
4961
4962 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4963 struct task_struct *target,
4964 long type, int mode)
4965 {
4966 struct ipc_security_struct *isec;
4967 struct msg_security_struct *msec;
4968 struct common_audit_data ad;
4969 u32 sid = task_sid(target);
4970 int rc;
4971
4972 isec = msq->q_perm.security;
4973 msec = msg->security;
4974
4975 ad.type = LSM_AUDIT_DATA_IPC;
4976 ad.u.ipc_id = msq->q_perm.key;
4977
4978 rc = avc_has_perm(sid, isec->sid,
4979 SECCLASS_MSGQ, MSGQ__READ, &ad);
4980 if (!rc)
4981 rc = avc_has_perm(sid, msec->sid,
4982 SECCLASS_MSG, MSG__RECEIVE, &ad);
4983 return rc;
4984 }
4985
4986 /* Shared Memory security operations */
4987 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4988 {
4989 struct ipc_security_struct *isec;
4990 struct common_audit_data ad;
4991 u32 sid = current_sid();
4992 int rc;
4993
4994 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4995 if (rc)
4996 return rc;
4997
4998 isec = shp->shm_perm.security;
4999
5000 ad.type = LSM_AUDIT_DATA_IPC;
5001 ad.u.ipc_id = shp->shm_perm.key;
5002
5003 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5004 SHM__CREATE, &ad);
5005 if (rc) {
5006 ipc_free_security(&shp->shm_perm);
5007 return rc;
5008 }
5009 return 0;
5010 }
5011
5012 static void selinux_shm_free_security(struct shmid_kernel *shp)
5013 {
5014 ipc_free_security(&shp->shm_perm);
5015 }
5016
5017 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5018 {
5019 struct ipc_security_struct *isec;
5020 struct common_audit_data ad;
5021 u32 sid = current_sid();
5022
5023 isec = shp->shm_perm.security;
5024
5025 ad.type = LSM_AUDIT_DATA_IPC;
5026 ad.u.ipc_id = shp->shm_perm.key;
5027
5028 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5029 SHM__ASSOCIATE, &ad);
5030 }
5031
5032 /* Note, at this point, shp is locked down */
5033 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5034 {
5035 int perms;
5036 int err;
5037
5038 switch (cmd) {
5039 case IPC_INFO:
5040 case SHM_INFO:
5041 /* No specific object, just general system-wide information. */
5042 return task_has_system(current, SYSTEM__IPC_INFO);
5043 case IPC_STAT:
5044 case SHM_STAT:
5045 perms = SHM__GETATTR | SHM__ASSOCIATE;
5046 break;
5047 case IPC_SET:
5048 perms = SHM__SETATTR;
5049 break;
5050 case SHM_LOCK:
5051 case SHM_UNLOCK:
5052 perms = SHM__LOCK;
5053 break;
5054 case IPC_RMID:
5055 perms = SHM__DESTROY;
5056 break;
5057 default:
5058 return 0;
5059 }
5060
5061 err = ipc_has_perm(&shp->shm_perm, perms);
5062 return err;
5063 }
5064
5065 static int selinux_shm_shmat(struct shmid_kernel *shp,
5066 char __user *shmaddr, int shmflg)
5067 {
5068 u32 perms;
5069
5070 if (shmflg & SHM_RDONLY)
5071 perms = SHM__READ;
5072 else
5073 perms = SHM__READ | SHM__WRITE;
5074
5075 return ipc_has_perm(&shp->shm_perm, perms);
5076 }
5077
5078 /* Semaphore security operations */
5079 static int selinux_sem_alloc_security(struct sem_array *sma)
5080 {
5081 struct ipc_security_struct *isec;
5082 struct common_audit_data ad;
5083 u32 sid = current_sid();
5084 int rc;
5085
5086 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5087 if (rc)
5088 return rc;
5089
5090 isec = sma->sem_perm.security;
5091
5092 ad.type = LSM_AUDIT_DATA_IPC;
5093 ad.u.ipc_id = sma->sem_perm.key;
5094
5095 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5096 SEM__CREATE, &ad);
5097 if (rc) {
5098 ipc_free_security(&sma->sem_perm);
5099 return rc;
5100 }
5101 return 0;
5102 }
5103
5104 static void selinux_sem_free_security(struct sem_array *sma)
5105 {
5106 ipc_free_security(&sma->sem_perm);
5107 }
5108
5109 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5110 {
5111 struct ipc_security_struct *isec;
5112 struct common_audit_data ad;
5113 u32 sid = current_sid();
5114
5115 isec = sma->sem_perm.security;
5116
5117 ad.type = LSM_AUDIT_DATA_IPC;
5118 ad.u.ipc_id = sma->sem_perm.key;
5119
5120 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5121 SEM__ASSOCIATE, &ad);
5122 }
5123
5124 /* Note, at this point, sma is locked down */
5125 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5126 {
5127 int err;
5128 u32 perms;
5129
5130 switch (cmd) {
5131 case IPC_INFO:
5132 case SEM_INFO:
5133 /* No specific object, just general system-wide information. */
5134 return task_has_system(current, SYSTEM__IPC_INFO);
5135 case GETPID:
5136 case GETNCNT:
5137 case GETZCNT:
5138 perms = SEM__GETATTR;
5139 break;
5140 case GETVAL:
5141 case GETALL:
5142 perms = SEM__READ;
5143 break;
5144 case SETVAL:
5145 case SETALL:
5146 perms = SEM__WRITE;
5147 break;
5148 case IPC_RMID:
5149 perms = SEM__DESTROY;
5150 break;
5151 case IPC_SET:
5152 perms = SEM__SETATTR;
5153 break;
5154 case IPC_STAT:
5155 case SEM_STAT:
5156 perms = SEM__GETATTR | SEM__ASSOCIATE;
5157 break;
5158 default:
5159 return 0;
5160 }
5161
5162 err = ipc_has_perm(&sma->sem_perm, perms);
5163 return err;
5164 }
5165
5166 static int selinux_sem_semop(struct sem_array *sma,
5167 struct sembuf *sops, unsigned nsops, int alter)
5168 {
5169 u32 perms;
5170
5171 if (alter)
5172 perms = SEM__READ | SEM__WRITE;
5173 else
5174 perms = SEM__READ;
5175
5176 return ipc_has_perm(&sma->sem_perm, perms);
5177 }
5178
5179 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5180 {
5181 u32 av = 0;
5182
5183 av = 0;
5184 if (flag & S_IRUGO)
5185 av |= IPC__UNIX_READ;
5186 if (flag & S_IWUGO)
5187 av |= IPC__UNIX_WRITE;
5188
5189 if (av == 0)
5190 return 0;
5191
5192 return ipc_has_perm(ipcp, av);
5193 }
5194
5195 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5196 {
5197 struct ipc_security_struct *isec = ipcp->security;
5198 *secid = isec->sid;
5199 }
5200
5201 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5202 {
5203 if (inode)
5204 inode_doinit_with_dentry(inode, dentry);
5205 }
5206
5207 static int selinux_getprocattr(struct task_struct *p,
5208 char *name, char **value)
5209 {
5210 const struct task_security_struct *__tsec;
5211 u32 sid;
5212 int error;
5213 unsigned len;
5214
5215 if (current != p) {
5216 error = current_has_perm(p, PROCESS__GETATTR);
5217 if (error)
5218 return error;
5219 }
5220
5221 rcu_read_lock();
5222 __tsec = __task_cred(p)->security;
5223
5224 if (!strcmp(name, "current"))
5225 sid = __tsec->sid;
5226 else if (!strcmp(name, "prev"))
5227 sid = __tsec->osid;
5228 else if (!strcmp(name, "exec"))
5229 sid = __tsec->exec_sid;
5230 else if (!strcmp(name, "fscreate"))
5231 sid = __tsec->create_sid;
5232 else if (!strcmp(name, "keycreate"))
5233 sid = __tsec->keycreate_sid;
5234 else if (!strcmp(name, "sockcreate"))
5235 sid = __tsec->sockcreate_sid;
5236 else
5237 goto invalid;
5238 rcu_read_unlock();
5239
5240 if (!sid)
5241 return 0;
5242
5243 error = security_sid_to_context(sid, value, &len);
5244 if (error)
5245 return error;
5246 return len;
5247
5248 invalid:
5249 rcu_read_unlock();
5250 return -EINVAL;
5251 }
5252
5253 static int selinux_setprocattr(struct task_struct *p,
5254 char *name, void *value, size_t size)
5255 {
5256 struct task_security_struct *tsec;
5257 struct task_struct *tracer;
5258 struct cred *new;
5259 u32 sid = 0, ptsid;
5260 int error;
5261 char *str = value;
5262
5263 if (current != p) {
5264 /* SELinux only allows a process to change its own
5265 security attributes. */
5266 return -EACCES;
5267 }
5268
5269 /*
5270 * Basic control over ability to set these attributes at all.
5271 * current == p, but we'll pass them separately in case the
5272 * above restriction is ever removed.
5273 */
5274 if (!strcmp(name, "exec"))
5275 error = current_has_perm(p, PROCESS__SETEXEC);
5276 else if (!strcmp(name, "fscreate"))
5277 error = current_has_perm(p, PROCESS__SETFSCREATE);
5278 else if (!strcmp(name, "keycreate"))
5279 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5280 else if (!strcmp(name, "sockcreate"))
5281 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5282 else if (!strcmp(name, "current"))
5283 error = current_has_perm(p, PROCESS__SETCURRENT);
5284 else
5285 error = -EINVAL;
5286 if (error)
5287 return error;
5288
5289 /* Obtain a SID for the context, if one was specified. */
5290 if (size && str[1] && str[1] != '\n') {
5291 if (str[size-1] == '\n') {
5292 str[size-1] = 0;
5293 size--;
5294 }
5295 error = security_context_to_sid(value, size, &sid);
5296 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5297 if (!capable(CAP_MAC_ADMIN)) {
5298 struct audit_buffer *ab;
5299 size_t audit_size;
5300
5301 /* We strip a nul only if it is at the end, otherwise the
5302 * context contains a nul and we should audit that */
5303 if (str[size - 1] == '\0')
5304 audit_size = size - 1;
5305 else
5306 audit_size = size;
5307 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5308 audit_log_format(ab, "op=fscreate invalid_context=");
5309 audit_log_n_untrustedstring(ab, value, audit_size);
5310 audit_log_end(ab);
5311
5312 return error;
5313 }
5314 error = security_context_to_sid_force(value, size,
5315 &sid);
5316 }
5317 if (error)
5318 return error;
5319 }
5320
5321 new = prepare_creds();
5322 if (!new)
5323 return -ENOMEM;
5324
5325 /* Permission checking based on the specified context is
5326 performed during the actual operation (execve,
5327 open/mkdir/...), when we know the full context of the
5328 operation. See selinux_bprm_set_creds for the execve
5329 checks and may_create for the file creation checks. The
5330 operation will then fail if the context is not permitted. */
5331 tsec = new->security;
5332 if (!strcmp(name, "exec")) {
5333 tsec->exec_sid = sid;
5334 } else if (!strcmp(name, "fscreate")) {
5335 tsec->create_sid = sid;
5336 } else if (!strcmp(name, "keycreate")) {
5337 error = may_create_key(sid, p);
5338 if (error)
5339 goto abort_change;
5340 tsec->keycreate_sid = sid;
5341 } else if (!strcmp(name, "sockcreate")) {
5342 tsec->sockcreate_sid = sid;
5343 } else if (!strcmp(name, "current")) {
5344 error = -EINVAL;
5345 if (sid == 0)
5346 goto abort_change;
5347
5348 /* Only allow single threaded processes to change context */
5349 error = -EPERM;
5350 if (!current_is_single_threaded()) {
5351 error = security_bounded_transition(tsec->sid, sid);
5352 if (error)
5353 goto abort_change;
5354 }
5355
5356 /* Check permissions for the transition. */
5357 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5358 PROCESS__DYNTRANSITION, NULL);
5359 if (error)
5360 goto abort_change;
5361
5362 /* Check for ptracing, and update the task SID if ok.
5363 Otherwise, leave SID unchanged and fail. */
5364 ptsid = 0;
5365 task_lock(p);
5366 tracer = ptrace_parent(p);
5367 if (tracer)
5368 ptsid = task_sid(tracer);
5369 task_unlock(p);
5370
5371 if (tracer) {
5372 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5373 PROCESS__PTRACE, NULL);
5374 if (error)
5375 goto abort_change;
5376 }
5377
5378 tsec->sid = sid;
5379 } else {
5380 error = -EINVAL;
5381 goto abort_change;
5382 }
5383
5384 commit_creds(new);
5385 return size;
5386
5387 abort_change:
5388 abort_creds(new);
5389 return error;
5390 }
5391
5392 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5393 {
5394 return security_sid_to_context(secid, secdata, seclen);
5395 }
5396
5397 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5398 {
5399 return security_context_to_sid(secdata, seclen, secid);
5400 }
5401
5402 static void selinux_release_secctx(char *secdata, u32 seclen)
5403 {
5404 kfree(secdata);
5405 }
5406
5407 /*
5408 * called with inode->i_mutex locked
5409 */
5410 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5411 {
5412 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5413 }
5414
5415 /*
5416 * called with inode->i_mutex locked
5417 */
5418 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5419 {
5420 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5421 }
5422
5423 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5424 {
5425 int len = 0;
5426 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5427 ctx, true);
5428 if (len < 0)
5429 return len;
5430 *ctxlen = len;
5431 return 0;
5432 }
5433 #ifdef CONFIG_KEYS
5434
5435 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5436 unsigned long flags)
5437 {
5438 const struct task_security_struct *tsec;
5439 struct key_security_struct *ksec;
5440
5441 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5442 if (!ksec)
5443 return -ENOMEM;
5444
5445 tsec = cred->security;
5446 if (tsec->keycreate_sid)
5447 ksec->sid = tsec->keycreate_sid;
5448 else
5449 ksec->sid = tsec->sid;
5450
5451 k->security = ksec;
5452 return 0;
5453 }
5454
5455 static void selinux_key_free(struct key *k)
5456 {
5457 struct key_security_struct *ksec = k->security;
5458
5459 k->security = NULL;
5460 kfree(ksec);
5461 }
5462
5463 static int selinux_key_permission(key_ref_t key_ref,
5464 const struct cred *cred,
5465 key_perm_t perm)
5466 {
5467 struct key *key;
5468 struct key_security_struct *ksec;
5469 u32 sid;
5470
5471 /* if no specific permissions are requested, we skip the
5472 permission check. No serious, additional covert channels
5473 appear to be created. */
5474 if (perm == 0)
5475 return 0;
5476
5477 sid = cred_sid(cred);
5478
5479 key = key_ref_to_ptr(key_ref);
5480 ksec = key->security;
5481
5482 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5483 }
5484
5485 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5486 {
5487 struct key_security_struct *ksec = key->security;
5488 char *context = NULL;
5489 unsigned len;
5490 int rc;
5491
5492 rc = security_sid_to_context(ksec->sid, &context, &len);
5493 if (!rc)
5494 rc = len;
5495 *_buffer = context;
5496 return rc;
5497 }
5498
5499 #endif
5500
5501 static struct security_operations selinux_ops = {
5502 .name = "selinux",
5503
5504 .ptrace_access_check = selinux_ptrace_access_check,
5505 .ptrace_traceme = selinux_ptrace_traceme,
5506 .capget = selinux_capget,
5507 .capset = selinux_capset,
5508 .capable = selinux_capable,
5509 .quotactl = selinux_quotactl,
5510 .quota_on = selinux_quota_on,
5511 .syslog = selinux_syslog,
5512 .vm_enough_memory = selinux_vm_enough_memory,
5513
5514 .netlink_send = selinux_netlink_send,
5515
5516 .bprm_set_creds = selinux_bprm_set_creds,
5517 .bprm_committing_creds = selinux_bprm_committing_creds,
5518 .bprm_committed_creds = selinux_bprm_committed_creds,
5519 .bprm_secureexec = selinux_bprm_secureexec,
5520
5521 .sb_alloc_security = selinux_sb_alloc_security,
5522 .sb_free_security = selinux_sb_free_security,
5523 .sb_copy_data = selinux_sb_copy_data,
5524 .sb_remount = selinux_sb_remount,
5525 .sb_kern_mount = selinux_sb_kern_mount,
5526 .sb_show_options = selinux_sb_show_options,
5527 .sb_statfs = selinux_sb_statfs,
5528 .sb_mount = selinux_mount,
5529 .sb_umount = selinux_umount,
5530 .sb_set_mnt_opts = selinux_set_mnt_opts,
5531 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5532 .sb_parse_opts_str = selinux_parse_opts_str,
5533
5534
5535 .inode_alloc_security = selinux_inode_alloc_security,
5536 .inode_free_security = selinux_inode_free_security,
5537 .inode_init_security = selinux_inode_init_security,
5538 .inode_create = selinux_inode_create,
5539 .inode_link = selinux_inode_link,
5540 .inode_unlink = selinux_inode_unlink,
5541 .inode_symlink = selinux_inode_symlink,
5542 .inode_mkdir = selinux_inode_mkdir,
5543 .inode_rmdir = selinux_inode_rmdir,
5544 .inode_mknod = selinux_inode_mknod,
5545 .inode_rename = selinux_inode_rename,
5546 .inode_readlink = selinux_inode_readlink,
5547 .inode_follow_link = selinux_inode_follow_link,
5548 .inode_permission = selinux_inode_permission,
5549 .inode_setattr = selinux_inode_setattr,
5550 .inode_getattr = selinux_inode_getattr,
5551 .inode_setxattr = selinux_inode_setxattr,
5552 .inode_post_setxattr = selinux_inode_post_setxattr,
5553 .inode_getxattr = selinux_inode_getxattr,
5554 .inode_listxattr = selinux_inode_listxattr,
5555 .inode_removexattr = selinux_inode_removexattr,
5556 .inode_getsecurity = selinux_inode_getsecurity,
5557 .inode_setsecurity = selinux_inode_setsecurity,
5558 .inode_listsecurity = selinux_inode_listsecurity,
5559 .inode_getsecid = selinux_inode_getsecid,
5560
5561 .file_permission = selinux_file_permission,
5562 .file_alloc_security = selinux_file_alloc_security,
5563 .file_free_security = selinux_file_free_security,
5564 .file_ioctl = selinux_file_ioctl,
5565 .mmap_file = selinux_mmap_file,
5566 .mmap_addr = selinux_mmap_addr,
5567 .file_mprotect = selinux_file_mprotect,
5568 .file_lock = selinux_file_lock,
5569 .file_fcntl = selinux_file_fcntl,
5570 .file_set_fowner = selinux_file_set_fowner,
5571 .file_send_sigiotask = selinux_file_send_sigiotask,
5572 .file_receive = selinux_file_receive,
5573
5574 .file_open = selinux_file_open,
5575
5576 .task_create = selinux_task_create,
5577 .cred_alloc_blank = selinux_cred_alloc_blank,
5578 .cred_free = selinux_cred_free,
5579 .cred_prepare = selinux_cred_prepare,
5580 .cred_transfer = selinux_cred_transfer,
5581 .kernel_act_as = selinux_kernel_act_as,
5582 .kernel_create_files_as = selinux_kernel_create_files_as,
5583 .kernel_module_request = selinux_kernel_module_request,
5584 .task_setpgid = selinux_task_setpgid,
5585 .task_getpgid = selinux_task_getpgid,
5586 .task_getsid = selinux_task_getsid,
5587 .task_getsecid = selinux_task_getsecid,
5588 .task_setnice = selinux_task_setnice,
5589 .task_setioprio = selinux_task_setioprio,
5590 .task_getioprio = selinux_task_getioprio,
5591 .task_setrlimit = selinux_task_setrlimit,
5592 .task_setscheduler = selinux_task_setscheduler,
5593 .task_getscheduler = selinux_task_getscheduler,
5594 .task_movememory = selinux_task_movememory,
5595 .task_kill = selinux_task_kill,
5596 .task_wait = selinux_task_wait,
5597 .task_to_inode = selinux_task_to_inode,
5598
5599 .ipc_permission = selinux_ipc_permission,
5600 .ipc_getsecid = selinux_ipc_getsecid,
5601
5602 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5603 .msg_msg_free_security = selinux_msg_msg_free_security,
5604
5605 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5606 .msg_queue_free_security = selinux_msg_queue_free_security,
5607 .msg_queue_associate = selinux_msg_queue_associate,
5608 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5609 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5610 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5611
5612 .shm_alloc_security = selinux_shm_alloc_security,
5613 .shm_free_security = selinux_shm_free_security,
5614 .shm_associate = selinux_shm_associate,
5615 .shm_shmctl = selinux_shm_shmctl,
5616 .shm_shmat = selinux_shm_shmat,
5617
5618 .sem_alloc_security = selinux_sem_alloc_security,
5619 .sem_free_security = selinux_sem_free_security,
5620 .sem_associate = selinux_sem_associate,
5621 .sem_semctl = selinux_sem_semctl,
5622 .sem_semop = selinux_sem_semop,
5623
5624 .d_instantiate = selinux_d_instantiate,
5625
5626 .getprocattr = selinux_getprocattr,
5627 .setprocattr = selinux_setprocattr,
5628
5629 .secid_to_secctx = selinux_secid_to_secctx,
5630 .secctx_to_secid = selinux_secctx_to_secid,
5631 .release_secctx = selinux_release_secctx,
5632 .inode_notifysecctx = selinux_inode_notifysecctx,
5633 .inode_setsecctx = selinux_inode_setsecctx,
5634 .inode_getsecctx = selinux_inode_getsecctx,
5635
5636 .unix_stream_connect = selinux_socket_unix_stream_connect,
5637 .unix_may_send = selinux_socket_unix_may_send,
5638
5639 .socket_create = selinux_socket_create,
5640 .socket_post_create = selinux_socket_post_create,
5641 .socket_bind = selinux_socket_bind,
5642 .socket_connect = selinux_socket_connect,
5643 .socket_listen = selinux_socket_listen,
5644 .socket_accept = selinux_socket_accept,
5645 .socket_sendmsg = selinux_socket_sendmsg,
5646 .socket_recvmsg = selinux_socket_recvmsg,
5647 .socket_getsockname = selinux_socket_getsockname,
5648 .socket_getpeername = selinux_socket_getpeername,
5649 .socket_getsockopt = selinux_socket_getsockopt,
5650 .socket_setsockopt = selinux_socket_setsockopt,
5651 .socket_shutdown = selinux_socket_shutdown,
5652 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5653 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5654 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5655 .sk_alloc_security = selinux_sk_alloc_security,
5656 .sk_free_security = selinux_sk_free_security,
5657 .sk_clone_security = selinux_sk_clone_security,
5658 .sk_getsecid = selinux_sk_getsecid,
5659 .sock_graft = selinux_sock_graft,
5660 .inet_conn_request = selinux_inet_conn_request,
5661 .inet_csk_clone = selinux_inet_csk_clone,
5662 .inet_conn_established = selinux_inet_conn_established,
5663 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5664 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5665 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5666 .req_classify_flow = selinux_req_classify_flow,
5667 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5668 .tun_dev_free_security = selinux_tun_dev_free_security,
5669 .tun_dev_create = selinux_tun_dev_create,
5670 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5671 .tun_dev_attach = selinux_tun_dev_attach,
5672 .tun_dev_open = selinux_tun_dev_open,
5673 .skb_owned_by = selinux_skb_owned_by,
5674
5675 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5676 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5677 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5678 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5679 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5680 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5681 .xfrm_state_free_security = selinux_xfrm_state_free,
5682 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5683 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5684 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5685 .xfrm_decode_session = selinux_xfrm_decode_session,
5686 #endif
5687
5688 #ifdef CONFIG_KEYS
5689 .key_alloc = selinux_key_alloc,
5690 .key_free = selinux_key_free,
5691 .key_permission = selinux_key_permission,
5692 .key_getsecurity = selinux_key_getsecurity,
5693 #endif
5694
5695 #ifdef CONFIG_AUDIT
5696 .audit_rule_init = selinux_audit_rule_init,
5697 .audit_rule_known = selinux_audit_rule_known,
5698 .audit_rule_match = selinux_audit_rule_match,
5699 .audit_rule_free = selinux_audit_rule_free,
5700 #endif
5701 };
5702
5703 static __init int selinux_init(void)
5704 {
5705 if (!security_module_enable(&selinux_ops)) {
5706 selinux_enabled = 0;
5707 return 0;
5708 }
5709
5710 if (!selinux_enabled) {
5711 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5712 return 0;
5713 }
5714
5715 printk(KERN_INFO "SELinux: Initializing.\n");
5716
5717 /* Set the security state for the initial task. */
5718 cred_init_security();
5719
5720 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5721
5722 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5723 sizeof(struct inode_security_struct),
5724 0, SLAB_PANIC, NULL);
5725 avc_init();
5726
5727 if (register_security(&selinux_ops))
5728 panic("SELinux: Unable to register with kernel.\n");
5729
5730 if (selinux_enforcing)
5731 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5732 else
5733 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5734
5735 return 0;
5736 }
5737
5738 static void delayed_superblock_init(struct super_block *sb, void *unused)
5739 {
5740 superblock_doinit(sb, NULL);
5741 }
5742
5743 void selinux_complete_init(void)
5744 {
5745 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5746
5747 /* Set up any superblocks initialized prior to the policy load. */
5748 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5749 iterate_supers(delayed_superblock_init, NULL);
5750 }
5751
5752 /* SELinux requires early initialization in order to label
5753 all processes and objects when they are created. */
5754 security_initcall(selinux_init);
5755
5756 #if defined(CONFIG_NETFILTER)
5757
5758 static struct nf_hook_ops selinux_ipv4_ops[] = {
5759 {
5760 .hook = selinux_ipv4_postroute,
5761 .owner = THIS_MODULE,
5762 .pf = NFPROTO_IPV4,
5763 .hooknum = NF_INET_POST_ROUTING,
5764 .priority = NF_IP_PRI_SELINUX_LAST,
5765 },
5766 {
5767 .hook = selinux_ipv4_forward,
5768 .owner = THIS_MODULE,
5769 .pf = NFPROTO_IPV4,
5770 .hooknum = NF_INET_FORWARD,
5771 .priority = NF_IP_PRI_SELINUX_FIRST,
5772 },
5773 {
5774 .hook = selinux_ipv4_output,
5775 .owner = THIS_MODULE,
5776 .pf = NFPROTO_IPV4,
5777 .hooknum = NF_INET_LOCAL_OUT,
5778 .priority = NF_IP_PRI_SELINUX_FIRST,
5779 }
5780 };
5781
5782 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5783
5784 static struct nf_hook_ops selinux_ipv6_ops[] = {
5785 {
5786 .hook = selinux_ipv6_postroute,
5787 .owner = THIS_MODULE,
5788 .pf = NFPROTO_IPV6,
5789 .hooknum = NF_INET_POST_ROUTING,
5790 .priority = NF_IP6_PRI_SELINUX_LAST,
5791 },
5792 {
5793 .hook = selinux_ipv6_forward,
5794 .owner = THIS_MODULE,
5795 .pf = NFPROTO_IPV6,
5796 .hooknum = NF_INET_FORWARD,
5797 .priority = NF_IP6_PRI_SELINUX_FIRST,
5798 }
5799 };
5800
5801 #endif /* IPV6 */
5802
5803 static int __init selinux_nf_ip_init(void)
5804 {
5805 int err = 0;
5806
5807 if (!selinux_enabled)
5808 goto out;
5809
5810 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5811
5812 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5813 if (err)
5814 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5815
5816 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5817 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5818 if (err)
5819 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5820 #endif /* IPV6 */
5821
5822 out:
5823 return err;
5824 }
5825
5826 __initcall(selinux_nf_ip_init);
5827
5828 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5829 static void selinux_nf_ip_exit(void)
5830 {
5831 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5832
5833 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5834 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5835 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5836 #endif /* IPV6 */
5837 }
5838 #endif
5839
5840 #else /* CONFIG_NETFILTER */
5841
5842 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5843 #define selinux_nf_ip_exit()
5844 #endif
5845
5846 #endif /* CONFIG_NETFILTER */
5847
5848 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5849 static int selinux_disabled;
5850
5851 int selinux_disable(void)
5852 {
5853 if (ss_initialized) {
5854 /* Not permitted after initial policy load. */
5855 return -EINVAL;
5856 }
5857
5858 if (selinux_disabled) {
5859 /* Only do this once. */
5860 return -EINVAL;
5861 }
5862
5863 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5864
5865 selinux_disabled = 1;
5866 selinux_enabled = 0;
5867
5868 reset_security_ops();
5869
5870 /* Try to destroy the avc node cache */
5871 avc_disable();
5872
5873 /* Unregister netfilter hooks. */
5874 selinux_nf_ip_exit();
5875
5876 /* Unregister selinuxfs. */
5877 exit_sel_fs();
5878
5879 return 0;
5880 }
5881 #endif
ubuntu-bionic-kernel mirror