2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
77 #define XATTR_SELINUX_SUFFIX "selinux"
78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80 extern unsigned int policydb_loaded_version
;
81 extern int selinux_nlmsg_lookup(u16 sclass
, u16 nlmsg_type
, u32
*perm
);
83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
84 int selinux_enforcing
= 0;
86 static int __init
enforcing_setup(char *str
)
88 selinux_enforcing
= simple_strtol(str
,NULL
,0);
91 __setup("enforcing=", enforcing_setup
);
94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
95 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
97 static int __init
selinux_enabled_setup(char *str
)
99 selinux_enabled
= simple_strtol(str
, NULL
, 0);
102 __setup("selinux=", selinux_enabled_setup
);
105 /* Original (dummy) security module. */
106 static struct security_operations
*original_ops
= NULL
;
108 /* Minimal support for a secondary security module,
109 just to allow the use of the dummy or capability modules.
110 The owlsm module can alternatively be used as a secondary
111 module as long as CONFIG_OWLSM_FD is not enabled. */
112 static struct security_operations
*secondary_ops
= NULL
;
114 /* Lists of inode and superblock security structures initialized
115 before the policy was loaded. */
116 static LIST_HEAD(superblock_security_head
);
117 static DEFINE_SPINLOCK(sb_security_lock
);
119 /* Allocate and free functions for each kind of security blob. */
121 static int task_alloc_security(struct task_struct
*task
)
123 struct task_security_struct
*tsec
;
125 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
129 tsec
->magic
= SELINUX_MAGIC
;
131 tsec
->osid
= tsec
->sid
= tsec
->ptrace_sid
= SECINITSID_UNLABELED
;
132 task
->security
= tsec
;
137 static void task_free_security(struct task_struct
*task
)
139 struct task_security_struct
*tsec
= task
->security
;
141 if (!tsec
|| tsec
->magic
!= SELINUX_MAGIC
)
144 task
->security
= NULL
;
148 static int inode_alloc_security(struct inode
*inode
)
150 struct task_security_struct
*tsec
= current
->security
;
151 struct inode_security_struct
*isec
;
153 isec
= kzalloc(sizeof(struct inode_security_struct
), GFP_KERNEL
);
157 init_MUTEX(&isec
->sem
);
158 INIT_LIST_HEAD(&isec
->list
);
159 isec
->magic
= SELINUX_MAGIC
;
161 isec
->sid
= SECINITSID_UNLABELED
;
162 isec
->sclass
= SECCLASS_FILE
;
163 if (tsec
&& tsec
->magic
== SELINUX_MAGIC
)
164 isec
->task_sid
= tsec
->sid
;
166 isec
->task_sid
= SECINITSID_UNLABELED
;
167 inode
->i_security
= isec
;
172 static void inode_free_security(struct inode
*inode
)
174 struct inode_security_struct
*isec
= inode
->i_security
;
175 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
177 if (!isec
|| isec
->magic
!= SELINUX_MAGIC
)
180 spin_lock(&sbsec
->isec_lock
);
181 if (!list_empty(&isec
->list
))
182 list_del_init(&isec
->list
);
183 spin_unlock(&sbsec
->isec_lock
);
185 inode
->i_security
= NULL
;
189 static int file_alloc_security(struct file
*file
)
191 struct task_security_struct
*tsec
= current
->security
;
192 struct file_security_struct
*fsec
;
194 fsec
= kzalloc(sizeof(struct file_security_struct
), GFP_ATOMIC
);
198 fsec
->magic
= SELINUX_MAGIC
;
200 if (tsec
&& tsec
->magic
== SELINUX_MAGIC
) {
201 fsec
->sid
= tsec
->sid
;
202 fsec
->fown_sid
= tsec
->sid
;
204 fsec
->sid
= SECINITSID_UNLABELED
;
205 fsec
->fown_sid
= SECINITSID_UNLABELED
;
207 file
->f_security
= fsec
;
212 static void file_free_security(struct file
*file
)
214 struct file_security_struct
*fsec
= file
->f_security
;
216 if (!fsec
|| fsec
->magic
!= SELINUX_MAGIC
)
219 file
->f_security
= NULL
;
223 static int superblock_alloc_security(struct super_block
*sb
)
225 struct superblock_security_struct
*sbsec
;
227 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
231 init_MUTEX(&sbsec
->sem
);
232 INIT_LIST_HEAD(&sbsec
->list
);
233 INIT_LIST_HEAD(&sbsec
->isec_head
);
234 spin_lock_init(&sbsec
->isec_lock
);
235 sbsec
->magic
= SELINUX_MAGIC
;
237 sbsec
->sid
= SECINITSID_UNLABELED
;
238 sbsec
->def_sid
= SECINITSID_FILE
;
239 sb
->s_security
= sbsec
;
244 static void superblock_free_security(struct super_block
*sb
)
246 struct superblock_security_struct
*sbsec
= sb
->s_security
;
248 if (!sbsec
|| sbsec
->magic
!= SELINUX_MAGIC
)
251 spin_lock(&sb_security_lock
);
252 if (!list_empty(&sbsec
->list
))
253 list_del_init(&sbsec
->list
);
254 spin_unlock(&sb_security_lock
);
256 sb
->s_security
= NULL
;
260 #ifdef CONFIG_SECURITY_NETWORK
261 static int sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
263 struct sk_security_struct
*ssec
;
265 if (family
!= PF_UNIX
)
268 ssec
= kzalloc(sizeof(*ssec
), priority
);
272 ssec
->magic
= SELINUX_MAGIC
;
274 ssec
->peer_sid
= SECINITSID_UNLABELED
;
275 sk
->sk_security
= ssec
;
280 static void sk_free_security(struct sock
*sk
)
282 struct sk_security_struct
*ssec
= sk
->sk_security
;
284 if (sk
->sk_family
!= PF_UNIX
|| ssec
->magic
!= SELINUX_MAGIC
)
287 sk
->sk_security
= NULL
;
290 #endif /* CONFIG_SECURITY_NETWORK */
292 /* The security server must be initialized before
293 any labeling or access decisions can be provided. */
294 extern int ss_initialized
;
296 /* The file system's label must be initialized prior to use. */
298 static char *labeling_behaviors
[6] = {
300 "uses transition SIDs",
302 "uses genfs_contexts",
303 "not configured for labeling",
304 "uses mountpoint labeling",
307 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
309 static inline int inode_doinit(struct inode
*inode
)
311 return inode_doinit_with_dentry(inode
, NULL
);
320 static match_table_t tokens
= {
321 {Opt_context
, "context=%s"},
322 {Opt_fscontext
, "fscontext=%s"},
323 {Opt_defcontext
, "defcontext=%s"},
326 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
328 static int try_context_mount(struct super_block
*sb
, void *data
)
330 char *context
= NULL
, *defcontext
= NULL
;
333 int alloc
= 0, rc
= 0, seen
= 0;
334 struct task_security_struct
*tsec
= current
->security
;
335 struct superblock_security_struct
*sbsec
= sb
->s_security
;
340 name
= sb
->s_type
->name
;
342 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
344 /* NFS we understand. */
345 if (!strcmp(name
, "nfs")) {
346 struct nfs_mount_data
*d
= data
;
348 if (d
->version
< NFS_MOUNT_VERSION
)
352 context
= d
->context
;
359 /* Standard string-based options. */
360 char *p
, *options
= data
;
362 while ((p
= strsep(&options
, ",")) != NULL
) {
364 substring_t args
[MAX_OPT_ARGS
];
369 token
= match_token(p
, tokens
, args
);
375 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
378 context
= match_strdup(&args
[0]);
389 if (seen
& (Opt_context
|Opt_fscontext
)) {
391 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
394 context
= match_strdup(&args
[0]);
401 seen
|= Opt_fscontext
;
405 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
) {
407 printk(KERN_WARNING
"SELinux: "
408 "defcontext option is invalid "
409 "for this filesystem type\n");
412 if (seen
& (Opt_context
|Opt_defcontext
)) {
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
417 defcontext
= match_strdup(&args
[0]);
424 seen
|= Opt_defcontext
;
429 printk(KERN_WARNING
"SELinux: unknown mount "
441 rc
= security_context_to_sid(context
, strlen(context
), &sid
);
443 printk(KERN_WARNING
"SELinux: security_context_to_sid"
444 "(%s) failed for (dev %s, type %s) errno=%d\n",
445 context
, sb
->s_id
, name
, rc
);
449 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
450 FILESYSTEM__RELABELFROM
, NULL
);
454 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
455 FILESYSTEM__RELABELTO
, NULL
);
461 if (seen
& Opt_context
)
462 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
466 rc
= security_context_to_sid(defcontext
, strlen(defcontext
), &sid
);
468 printk(KERN_WARNING
"SELinux: security_context_to_sid"
469 "(%s) failed for (dev %s, type %s) errno=%d\n",
470 defcontext
, sb
->s_id
, name
, rc
);
474 if (sid
== sbsec
->def_sid
)
477 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
478 FILESYSTEM__RELABELFROM
, NULL
);
482 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
483 FILESYSTEM__ASSOCIATE
, NULL
);
487 sbsec
->def_sid
= sid
;
499 static int superblock_doinit(struct super_block
*sb
, void *data
)
501 struct superblock_security_struct
*sbsec
= sb
->s_security
;
502 struct dentry
*root
= sb
->s_root
;
503 struct inode
*inode
= root
->d_inode
;
507 if (sbsec
->initialized
)
510 if (!ss_initialized
) {
511 /* Defer initialization until selinux_complete_init,
512 after the initial policy is loaded and the security
513 server is ready to handle calls. */
514 spin_lock(&sb_security_lock
);
515 if (list_empty(&sbsec
->list
))
516 list_add(&sbsec
->list
, &superblock_security_head
);
517 spin_unlock(&sb_security_lock
);
521 /* Determine the labeling behavior to use for this filesystem type. */
522 rc
= security_fs_use(sb
->s_type
->name
, &sbsec
->behavior
, &sbsec
->sid
);
524 printk(KERN_WARNING
"%s: security_fs_use(%s) returned %d\n",
525 __FUNCTION__
, sb
->s_type
->name
, rc
);
529 rc
= try_context_mount(sb
, data
);
533 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
534 /* Make sure that the xattr handler exists and that no
535 error other than -ENODATA is returned by getxattr on
536 the root directory. -ENODATA is ok, as this may be
537 the first boot of the SELinux kernel before we have
538 assigned xattr values to the filesystem. */
539 if (!inode
->i_op
->getxattr
) {
540 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
541 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
545 rc
= inode
->i_op
->getxattr(root
, XATTR_NAME_SELINUX
, NULL
, 0);
546 if (rc
< 0 && rc
!= -ENODATA
) {
547 if (rc
== -EOPNOTSUPP
)
548 printk(KERN_WARNING
"SELinux: (dev %s, type "
549 "%s) has no security xattr handler\n",
550 sb
->s_id
, sb
->s_type
->name
);
552 printk(KERN_WARNING
"SELinux: (dev %s, type "
553 "%s) getxattr errno %d\n", sb
->s_id
,
554 sb
->s_type
->name
, -rc
);
559 if (strcmp(sb
->s_type
->name
, "proc") == 0)
562 sbsec
->initialized
= 1;
564 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
)) {
565 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
566 sb
->s_id
, sb
->s_type
->name
);
569 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), %s\n",
570 sb
->s_id
, sb
->s_type
->name
,
571 labeling_behaviors
[sbsec
->behavior
-1]);
574 /* Initialize the root inode. */
575 rc
= inode_doinit_with_dentry(sb
->s_root
->d_inode
, sb
->s_root
);
577 /* Initialize any other inodes associated with the superblock, e.g.
578 inodes created prior to initial policy load or inodes created
579 during get_sb by a pseudo filesystem that directly
581 spin_lock(&sbsec
->isec_lock
);
583 if (!list_empty(&sbsec
->isec_head
)) {
584 struct inode_security_struct
*isec
=
585 list_entry(sbsec
->isec_head
.next
,
586 struct inode_security_struct
, list
);
587 struct inode
*inode
= isec
->inode
;
588 spin_unlock(&sbsec
->isec_lock
);
589 inode
= igrab(inode
);
591 if (!IS_PRIVATE (inode
))
595 spin_lock(&sbsec
->isec_lock
);
596 list_del_init(&isec
->list
);
599 spin_unlock(&sbsec
->isec_lock
);
605 static inline u16
inode_mode_to_security_class(umode_t mode
)
607 switch (mode
& S_IFMT
) {
609 return SECCLASS_SOCK_FILE
;
611 return SECCLASS_LNK_FILE
;
613 return SECCLASS_FILE
;
615 return SECCLASS_BLK_FILE
;
619 return SECCLASS_CHR_FILE
;
621 return SECCLASS_FIFO_FILE
;
625 return SECCLASS_FILE
;
628 static inline int default_protocol_stream(int protocol
)
630 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
633 static inline int default_protocol_dgram(int protocol
)
635 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
638 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
645 return SECCLASS_UNIX_STREAM_SOCKET
;
647 return SECCLASS_UNIX_DGRAM_SOCKET
;
654 if (default_protocol_stream(protocol
))
655 return SECCLASS_TCP_SOCKET
;
657 return SECCLASS_RAWIP_SOCKET
;
659 if (default_protocol_dgram(protocol
))
660 return SECCLASS_UDP_SOCKET
;
662 return SECCLASS_RAWIP_SOCKET
;
664 return SECCLASS_RAWIP_SOCKET
;
670 return SECCLASS_NETLINK_ROUTE_SOCKET
;
671 case NETLINK_FIREWALL
:
672 return SECCLASS_NETLINK_FIREWALL_SOCKET
;
673 case NETLINK_INET_DIAG
:
674 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
676 return SECCLASS_NETLINK_NFLOG_SOCKET
;
678 return SECCLASS_NETLINK_XFRM_SOCKET
;
679 case NETLINK_SELINUX
:
680 return SECCLASS_NETLINK_SELINUX_SOCKET
;
682 return SECCLASS_NETLINK_AUDIT_SOCKET
;
684 return SECCLASS_NETLINK_IP6FW_SOCKET
;
685 case NETLINK_DNRTMSG
:
686 return SECCLASS_NETLINK_DNRT_SOCKET
;
687 case NETLINK_KOBJECT_UEVENT
:
688 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
690 return SECCLASS_NETLINK_SOCKET
;
693 return SECCLASS_PACKET_SOCKET
;
695 return SECCLASS_KEY_SOCKET
;
698 return SECCLASS_SOCKET
;
701 #ifdef CONFIG_PROC_FS
702 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
707 char *buffer
, *path
, *end
;
709 buffer
= (char*)__get_free_page(GFP_KERNEL
);
719 while (de
&& de
!= de
->parent
) {
720 buflen
-= de
->namelen
+ 1;
724 memcpy(end
, de
->name
, de
->namelen
);
729 rc
= security_genfs_sid("proc", path
, tclass
, sid
);
730 free_page((unsigned long)buffer
);
734 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
742 /* The inode's security attributes must be initialized before first use. */
743 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
745 struct superblock_security_struct
*sbsec
= NULL
;
746 struct inode_security_struct
*isec
= inode
->i_security
;
748 struct dentry
*dentry
;
749 #define INITCONTEXTLEN 255
750 char *context
= NULL
;
755 if (isec
->initialized
)
760 if (isec
->initialized
)
763 sbsec
= inode
->i_sb
->s_security
;
764 if (!sbsec
->initialized
) {
765 /* Defer initialization until selinux_complete_init,
766 after the initial policy is loaded and the security
767 server is ready to handle calls. */
768 spin_lock(&sbsec
->isec_lock
);
769 if (list_empty(&isec
->list
))
770 list_add(&isec
->list
, &sbsec
->isec_head
);
771 spin_unlock(&sbsec
->isec_lock
);
775 switch (sbsec
->behavior
) {
776 case SECURITY_FS_USE_XATTR
:
777 if (!inode
->i_op
->getxattr
) {
778 isec
->sid
= sbsec
->def_sid
;
782 /* Need a dentry, since the xattr API requires one.
783 Life would be simpler if we could just pass the inode. */
785 /* Called from d_instantiate or d_splice_alias. */
786 dentry
= dget(opt_dentry
);
788 /* Called from selinux_complete_init, try to find a dentry. */
789 dentry
= d_find_alias(inode
);
792 printk(KERN_WARNING
"%s: no dentry for dev=%s "
793 "ino=%ld\n", __FUNCTION__
, inode
->i_sb
->s_id
,
798 len
= INITCONTEXTLEN
;
799 context
= kmalloc(len
, GFP_KERNEL
);
805 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
808 /* Need a larger buffer. Query for the right size. */
809 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
817 context
= kmalloc(len
, GFP_KERNEL
);
823 rc
= inode
->i_op
->getxattr(dentry
,
829 if (rc
!= -ENODATA
) {
830 printk(KERN_WARNING
"%s: getxattr returned "
831 "%d for dev=%s ino=%ld\n", __FUNCTION__
,
832 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
836 /* Map ENODATA to the default file SID */
837 sid
= sbsec
->def_sid
;
840 rc
= security_context_to_sid_default(context
, rc
, &sid
,
843 printk(KERN_WARNING
"%s: context_to_sid(%s) "
844 "returned %d for dev=%s ino=%ld\n",
845 __FUNCTION__
, context
, -rc
,
846 inode
->i_sb
->s_id
, inode
->i_ino
);
848 /* Leave with the unlabeled SID */
856 case SECURITY_FS_USE_TASK
:
857 isec
->sid
= isec
->task_sid
;
859 case SECURITY_FS_USE_TRANS
:
860 /* Default to the fs SID. */
861 isec
->sid
= sbsec
->sid
;
863 /* Try to obtain a transition SID. */
864 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
865 rc
= security_transition_sid(isec
->task_sid
,
874 /* Default to the fs SID. */
875 isec
->sid
= sbsec
->sid
;
878 struct proc_inode
*proci
= PROC_I(inode
);
880 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
881 rc
= selinux_proc_get_sid(proci
->pde
,
892 isec
->initialized
= 1;
895 if (isec
->sclass
== SECCLASS_FILE
)
896 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
903 /* Convert a Linux signal to an access vector. */
904 static inline u32
signal_to_av(int sig
)
910 /* Commonly granted from child to parent. */
911 perm
= PROCESS__SIGCHLD
;
914 /* Cannot be caught or ignored */
915 perm
= PROCESS__SIGKILL
;
918 /* Cannot be caught or ignored */
919 perm
= PROCESS__SIGSTOP
;
922 /* All other signals. */
923 perm
= PROCESS__SIGNAL
;
930 /* Check permission betweeen a pair of tasks, e.g. signal checks,
931 fork check, ptrace check, etc. */
932 static int task_has_perm(struct task_struct
*tsk1
,
933 struct task_struct
*tsk2
,
936 struct task_security_struct
*tsec1
, *tsec2
;
938 tsec1
= tsk1
->security
;
939 tsec2
= tsk2
->security
;
940 return avc_has_perm(tsec1
->sid
, tsec2
->sid
,
941 SECCLASS_PROCESS
, perms
, NULL
);
944 /* Check whether a task is allowed to use a capability. */
945 static int task_has_capability(struct task_struct
*tsk
,
948 struct task_security_struct
*tsec
;
949 struct avc_audit_data ad
;
951 tsec
= tsk
->security
;
953 AVC_AUDIT_DATA_INIT(&ad
,CAP
);
957 return avc_has_perm(tsec
->sid
, tsec
->sid
,
958 SECCLASS_CAPABILITY
, CAP_TO_MASK(cap
), &ad
);
961 /* Check whether a task is allowed to use a system operation. */
962 static int task_has_system(struct task_struct
*tsk
,
965 struct task_security_struct
*tsec
;
967 tsec
= tsk
->security
;
969 return avc_has_perm(tsec
->sid
, SECINITSID_KERNEL
,
970 SECCLASS_SYSTEM
, perms
, NULL
);
973 /* Check whether a task has a particular permission to an inode.
974 The 'adp' parameter is optional and allows other audit
975 data to be passed (e.g. the dentry). */
976 static int inode_has_perm(struct task_struct
*tsk
,
979 struct avc_audit_data
*adp
)
981 struct task_security_struct
*tsec
;
982 struct inode_security_struct
*isec
;
983 struct avc_audit_data ad
;
985 tsec
= tsk
->security
;
986 isec
= inode
->i_security
;
990 AVC_AUDIT_DATA_INIT(&ad
, FS
);
991 ad
.u
.fs
.inode
= inode
;
994 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
997 /* Same as inode_has_perm, but pass explicit audit data containing
998 the dentry to help the auditing code to more easily generate the
999 pathname if needed. */
1000 static inline int dentry_has_perm(struct task_struct
*tsk
,
1001 struct vfsmount
*mnt
,
1002 struct dentry
*dentry
,
1005 struct inode
*inode
= dentry
->d_inode
;
1006 struct avc_audit_data ad
;
1007 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1009 ad
.u
.fs
.dentry
= dentry
;
1010 return inode_has_perm(tsk
, inode
, av
, &ad
);
1013 /* Check whether a task can use an open file descriptor to
1014 access an inode in a given way. Check access to the
1015 descriptor itself, and then use dentry_has_perm to
1016 check a particular permission to the file.
1017 Access to the descriptor is implicitly granted if it
1018 has the same SID as the process. If av is zero, then
1019 access to the file is not checked, e.g. for cases
1020 where only the descriptor is affected like seek. */
1021 static inline int file_has_perm(struct task_struct
*tsk
,
1025 struct task_security_struct
*tsec
= tsk
->security
;
1026 struct file_security_struct
*fsec
= file
->f_security
;
1027 struct vfsmount
*mnt
= file
->f_vfsmnt
;
1028 struct dentry
*dentry
= file
->f_dentry
;
1029 struct inode
*inode
= dentry
->d_inode
;
1030 struct avc_audit_data ad
;
1033 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1035 ad
.u
.fs
.dentry
= dentry
;
1037 if (tsec
->sid
!= fsec
->sid
) {
1038 rc
= avc_has_perm(tsec
->sid
, fsec
->sid
,
1046 /* av is zero if only checking access to the descriptor. */
1048 return inode_has_perm(tsk
, inode
, av
, &ad
);
1053 /* Check whether a task can create a file. */
1054 static int may_create(struct inode
*dir
,
1055 struct dentry
*dentry
,
1058 struct task_security_struct
*tsec
;
1059 struct inode_security_struct
*dsec
;
1060 struct superblock_security_struct
*sbsec
;
1062 struct avc_audit_data ad
;
1065 tsec
= current
->security
;
1066 dsec
= dir
->i_security
;
1067 sbsec
= dir
->i_sb
->s_security
;
1069 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1070 ad
.u
.fs
.dentry
= dentry
;
1072 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
,
1073 DIR__ADD_NAME
| DIR__SEARCH
,
1078 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1079 newsid
= tsec
->create_sid
;
1081 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1087 rc
= avc_has_perm(tsec
->sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1091 return avc_has_perm(newsid
, sbsec
->sid
,
1092 SECCLASS_FILESYSTEM
,
1093 FILESYSTEM__ASSOCIATE
, &ad
);
1097 #define MAY_UNLINK 1
1100 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1101 static int may_link(struct inode
*dir
,
1102 struct dentry
*dentry
,
1106 struct task_security_struct
*tsec
;
1107 struct inode_security_struct
*dsec
, *isec
;
1108 struct avc_audit_data ad
;
1112 tsec
= current
->security
;
1113 dsec
= dir
->i_security
;
1114 isec
= dentry
->d_inode
->i_security
;
1116 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1117 ad
.u
.fs
.dentry
= dentry
;
1120 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1121 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1136 printk(KERN_WARNING
"may_link: unrecognized kind %d\n", kind
);
1140 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1144 static inline int may_rename(struct inode
*old_dir
,
1145 struct dentry
*old_dentry
,
1146 struct inode
*new_dir
,
1147 struct dentry
*new_dentry
)
1149 struct task_security_struct
*tsec
;
1150 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1151 struct avc_audit_data ad
;
1153 int old_is_dir
, new_is_dir
;
1156 tsec
= current
->security
;
1157 old_dsec
= old_dir
->i_security
;
1158 old_isec
= old_dentry
->d_inode
->i_security
;
1159 old_is_dir
= S_ISDIR(old_dentry
->d_inode
->i_mode
);
1160 new_dsec
= new_dir
->i_security
;
1162 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1164 ad
.u
.fs
.dentry
= old_dentry
;
1165 rc
= avc_has_perm(tsec
->sid
, old_dsec
->sid
, SECCLASS_DIR
,
1166 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1169 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1170 old_isec
->sclass
, FILE__RENAME
, &ad
);
1173 if (old_is_dir
&& new_dir
!= old_dir
) {
1174 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1175 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1180 ad
.u
.fs
.dentry
= new_dentry
;
1181 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1182 if (new_dentry
->d_inode
)
1183 av
|= DIR__REMOVE_NAME
;
1184 rc
= avc_has_perm(tsec
->sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1187 if (new_dentry
->d_inode
) {
1188 new_isec
= new_dentry
->d_inode
->i_security
;
1189 new_is_dir
= S_ISDIR(new_dentry
->d_inode
->i_mode
);
1190 rc
= avc_has_perm(tsec
->sid
, new_isec
->sid
,
1192 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1200 /* Check whether a task can perform a filesystem operation. */
1201 static int superblock_has_perm(struct task_struct
*tsk
,
1202 struct super_block
*sb
,
1204 struct avc_audit_data
*ad
)
1206 struct task_security_struct
*tsec
;
1207 struct superblock_security_struct
*sbsec
;
1209 tsec
= tsk
->security
;
1210 sbsec
= sb
->s_security
;
1211 return avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
1215 /* Convert a Linux mode and permission mask to an access vector. */
1216 static inline u32
file_mask_to_av(int mode
, int mask
)
1220 if ((mode
& S_IFMT
) != S_IFDIR
) {
1221 if (mask
& MAY_EXEC
)
1222 av
|= FILE__EXECUTE
;
1223 if (mask
& MAY_READ
)
1226 if (mask
& MAY_APPEND
)
1228 else if (mask
& MAY_WRITE
)
1232 if (mask
& MAY_EXEC
)
1234 if (mask
& MAY_WRITE
)
1236 if (mask
& MAY_READ
)
1243 /* Convert a Linux file to an access vector. */
1244 static inline u32
file_to_av(struct file
*file
)
1248 if (file
->f_mode
& FMODE_READ
)
1250 if (file
->f_mode
& FMODE_WRITE
) {
1251 if (file
->f_flags
& O_APPEND
)
1260 /* Set an inode's SID to a specified value. */
1261 static int inode_security_set_sid(struct inode
*inode
, u32 sid
)
1263 struct inode_security_struct
*isec
= inode
->i_security
;
1264 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
1266 if (!sbsec
->initialized
) {
1267 /* Defer initialization to selinux_complete_init. */
1272 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1274 isec
->initialized
= 1;
1279 /* Hook functions begin here. */
1281 static int selinux_ptrace(struct task_struct
*parent
, struct task_struct
*child
)
1283 struct task_security_struct
*psec
= parent
->security
;
1284 struct task_security_struct
*csec
= child
->security
;
1287 rc
= secondary_ops
->ptrace(parent
,child
);
1291 rc
= task_has_perm(parent
, child
, PROCESS__PTRACE
);
1292 /* Save the SID of the tracing process for later use in apply_creds. */
1294 csec
->ptrace_sid
= psec
->sid
;
1298 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
1299 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1303 error
= task_has_perm(current
, target
, PROCESS__GETCAP
);
1307 return secondary_ops
->capget(target
, effective
, inheritable
, permitted
);
1310 static int selinux_capset_check(struct task_struct
*target
, kernel_cap_t
*effective
,
1311 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1315 error
= secondary_ops
->capset_check(target
, effective
, inheritable
, permitted
);
1319 return task_has_perm(current
, target
, PROCESS__SETCAP
);
1322 static void selinux_capset_set(struct task_struct
*target
, kernel_cap_t
*effective
,
1323 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1325 secondary_ops
->capset_set(target
, effective
, inheritable
, permitted
);
1328 static int selinux_capable(struct task_struct
*tsk
, int cap
)
1332 rc
= secondary_ops
->capable(tsk
, cap
);
1336 return task_has_capability(tsk
,cap
);
1339 static int selinux_sysctl(ctl_table
*table
, int op
)
1343 struct task_security_struct
*tsec
;
1347 rc
= secondary_ops
->sysctl(table
, op
);
1351 tsec
= current
->security
;
1353 rc
= selinux_proc_get_sid(table
->de
, (op
== 001) ?
1354 SECCLASS_DIR
: SECCLASS_FILE
, &tsid
);
1356 /* Default to the well-defined sysctl SID. */
1357 tsid
= SECINITSID_SYSCTL
;
1360 /* The op values are "defined" in sysctl.c, thereby creating
1361 * a bad coupling between this module and sysctl.c */
1363 error
= avc_has_perm(tsec
->sid
, tsid
,
1364 SECCLASS_DIR
, DIR__SEARCH
, NULL
);
1372 error
= avc_has_perm(tsec
->sid
, tsid
,
1373 SECCLASS_FILE
, av
, NULL
);
1379 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
1392 rc
= superblock_has_perm(current
,
1394 FILESYSTEM__QUOTAMOD
, NULL
);
1399 rc
= superblock_has_perm(current
,
1401 FILESYSTEM__QUOTAGET
, NULL
);
1404 rc
= 0; /* let the kernel handle invalid cmds */
1410 static int selinux_quota_on(struct dentry
*dentry
)
1412 return dentry_has_perm(current
, NULL
, dentry
, FILE__QUOTAON
);
1415 static int selinux_syslog(int type
)
1419 rc
= secondary_ops
->syslog(type
);
1424 case 3: /* Read last kernel messages */
1425 case 10: /* Return size of the log buffer */
1426 rc
= task_has_system(current
, SYSTEM__SYSLOG_READ
);
1428 case 6: /* Disable logging to console */
1429 case 7: /* Enable logging to console */
1430 case 8: /* Set level of messages printed to console */
1431 rc
= task_has_system(current
, SYSTEM__SYSLOG_CONSOLE
);
1433 case 0: /* Close log */
1434 case 1: /* Open log */
1435 case 2: /* Read from log */
1436 case 4: /* Read/clear last kernel messages */
1437 case 5: /* Clear ring buffer */
1439 rc
= task_has_system(current
, SYSTEM__SYSLOG_MOD
);
1446 * Check that a process has enough memory to allocate a new virtual
1447 * mapping. 0 means there is enough memory for the allocation to
1448 * succeed and -ENOMEM implies there is not.
1450 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1451 * if the capability is granted, but __vm_enough_memory requires 1 if
1452 * the capability is granted.
1454 * Do not audit the selinux permission check, as this is applied to all
1455 * processes that allocate mappings.
1457 static int selinux_vm_enough_memory(long pages
)
1459 int rc
, cap_sys_admin
= 0;
1460 struct task_security_struct
*tsec
= current
->security
;
1462 rc
= secondary_ops
->capable(current
, CAP_SYS_ADMIN
);
1464 rc
= avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
1465 SECCLASS_CAPABILITY
,
1466 CAP_TO_MASK(CAP_SYS_ADMIN
),
1472 return __vm_enough_memory(pages
, cap_sys_admin
);
1475 /* binprm security operations */
1477 static int selinux_bprm_alloc_security(struct linux_binprm
*bprm
)
1479 struct bprm_security_struct
*bsec
;
1481 bsec
= kzalloc(sizeof(struct bprm_security_struct
), GFP_KERNEL
);
1485 bsec
->magic
= SELINUX_MAGIC
;
1487 bsec
->sid
= SECINITSID_UNLABELED
;
1490 bprm
->security
= bsec
;
1494 static int selinux_bprm_set_security(struct linux_binprm
*bprm
)
1496 struct task_security_struct
*tsec
;
1497 struct inode
*inode
= bprm
->file
->f_dentry
->d_inode
;
1498 struct inode_security_struct
*isec
;
1499 struct bprm_security_struct
*bsec
;
1501 struct avc_audit_data ad
;
1504 rc
= secondary_ops
->bprm_set_security(bprm
);
1508 bsec
= bprm
->security
;
1513 tsec
= current
->security
;
1514 isec
= inode
->i_security
;
1516 /* Default to the current task SID. */
1517 bsec
->sid
= tsec
->sid
;
1519 /* Reset create SID on execve. */
1520 tsec
->create_sid
= 0;
1522 if (tsec
->exec_sid
) {
1523 newsid
= tsec
->exec_sid
;
1524 /* Reset exec SID on execve. */
1527 /* Check for a default transition on this program. */
1528 rc
= security_transition_sid(tsec
->sid
, isec
->sid
,
1529 SECCLASS_PROCESS
, &newsid
);
1534 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1535 ad
.u
.fs
.mnt
= bprm
->file
->f_vfsmnt
;
1536 ad
.u
.fs
.dentry
= bprm
->file
->f_dentry
;
1538 if (bprm
->file
->f_vfsmnt
->mnt_flags
& MNT_NOSUID
)
1541 if (tsec
->sid
== newsid
) {
1542 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
1543 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
1547 /* Check permissions for the transition. */
1548 rc
= avc_has_perm(tsec
->sid
, newsid
,
1549 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
1553 rc
= avc_has_perm(newsid
, isec
->sid
,
1554 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
1558 /* Clear any possibly unsafe personality bits on exec: */
1559 current
->personality
&= ~PER_CLEAR_ON_SETID
;
1561 /* Set the security field to the new SID. */
1569 static int selinux_bprm_check_security (struct linux_binprm
*bprm
)
1571 return secondary_ops
->bprm_check_security(bprm
);
1575 static int selinux_bprm_secureexec (struct linux_binprm
*bprm
)
1577 struct task_security_struct
*tsec
= current
->security
;
1580 if (tsec
->osid
!= tsec
->sid
) {
1581 /* Enable secure mode for SIDs transitions unless
1582 the noatsecure permission is granted between
1583 the two SIDs, i.e. ahp returns 0. */
1584 atsecure
= avc_has_perm(tsec
->osid
, tsec
->sid
,
1586 PROCESS__NOATSECURE
, NULL
);
1589 return (atsecure
|| secondary_ops
->bprm_secureexec(bprm
));
1592 static void selinux_bprm_free_security(struct linux_binprm
*bprm
)
1594 kfree(bprm
->security
);
1595 bprm
->security
= NULL
;
1598 extern struct vfsmount
*selinuxfs_mount
;
1599 extern struct dentry
*selinux_null
;
1601 /* Derived from fs/exec.c:flush_old_files. */
1602 static inline void flush_unauthorized_files(struct files_struct
* files
)
1604 struct avc_audit_data ad
;
1605 struct file
*file
, *devnull
= NULL
;
1606 struct tty_struct
*tty
= current
->signal
->tty
;
1607 struct fdtable
*fdt
;
1612 file
= list_entry(tty
->tty_files
.next
, typeof(*file
), f_list
);
1614 /* Revalidate access to controlling tty.
1615 Use inode_has_perm on the tty inode directly rather
1616 than using file_has_perm, as this particular open
1617 file may belong to another process and we are only
1618 interested in the inode-based check here. */
1619 struct inode
*inode
= file
->f_dentry
->d_inode
;
1620 if (inode_has_perm(current
, inode
,
1621 FILE__READ
| FILE__WRITE
, NULL
)) {
1622 /* Reset controlling tty. */
1623 current
->signal
->tty
= NULL
;
1624 current
->signal
->tty_old_pgrp
= 0;
1630 /* Revalidate access to inherited open files. */
1632 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1634 spin_lock(&files
->file_lock
);
1636 unsigned long set
, i
;
1641 fdt
= files_fdtable(files
);
1642 if (i
>= fdt
->max_fds
|| i
>= fdt
->max_fdset
)
1644 set
= fdt
->open_fds
->fds_bits
[j
];
1647 spin_unlock(&files
->file_lock
);
1648 for ( ; set
; i
++,set
>>= 1) {
1653 if (file_has_perm(current
,
1655 file_to_av(file
))) {
1657 fd
= get_unused_fd();
1665 rcuref_inc(&devnull
->f_count
);
1667 devnull
= dentry_open(dget(selinux_null
), mntget(selinuxfs_mount
), O_RDWR
);
1674 fd_install(fd
, devnull
);
1679 spin_lock(&files
->file_lock
);
1682 spin_unlock(&files
->file_lock
);
1685 static void selinux_bprm_apply_creds(struct linux_binprm
*bprm
, int unsafe
)
1687 struct task_security_struct
*tsec
;
1688 struct bprm_security_struct
*bsec
;
1692 secondary_ops
->bprm_apply_creds(bprm
, unsafe
);
1694 tsec
= current
->security
;
1696 bsec
= bprm
->security
;
1699 tsec
->osid
= tsec
->sid
;
1701 if (tsec
->sid
!= sid
) {
1702 /* Check for shared state. If not ok, leave SID
1703 unchanged and kill. */
1704 if (unsafe
& LSM_UNSAFE_SHARE
) {
1705 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
1706 PROCESS__SHARE
, NULL
);
1713 /* Check for ptracing, and update the task SID if ok.
1714 Otherwise, leave SID unchanged and kill. */
1715 if (unsafe
& (LSM_UNSAFE_PTRACE
| LSM_UNSAFE_PTRACE_CAP
)) {
1716 rc
= avc_has_perm(tsec
->ptrace_sid
, sid
,
1717 SECCLASS_PROCESS
, PROCESS__PTRACE
,
1729 * called after apply_creds without the task lock held
1731 static void selinux_bprm_post_apply_creds(struct linux_binprm
*bprm
)
1733 struct task_security_struct
*tsec
;
1734 struct rlimit
*rlim
, *initrlim
;
1735 struct itimerval itimer
;
1736 struct bprm_security_struct
*bsec
;
1739 tsec
= current
->security
;
1740 bsec
= bprm
->security
;
1743 force_sig_specific(SIGKILL
, current
);
1746 if (tsec
->osid
== tsec
->sid
)
1749 /* Close files for which the new task SID is not authorized. */
1750 flush_unauthorized_files(current
->files
);
1752 /* Check whether the new SID can inherit signal state
1753 from the old SID. If not, clear itimers to avoid
1754 subsequent signal generation and flush and unblock
1755 signals. This must occur _after_ the task SID has
1756 been updated so that any kill done after the flush
1757 will be checked against the new SID. */
1758 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1759 PROCESS__SIGINH
, NULL
);
1761 memset(&itimer
, 0, sizeof itimer
);
1762 for (i
= 0; i
< 3; i
++)
1763 do_setitimer(i
, &itimer
, NULL
);
1764 flush_signals(current
);
1765 spin_lock_irq(¤t
->sighand
->siglock
);
1766 flush_signal_handlers(current
, 1);
1767 sigemptyset(¤t
->blocked
);
1768 recalc_sigpending();
1769 spin_unlock_irq(¤t
->sighand
->siglock
);
1772 /* Check whether the new SID can inherit resource limits
1773 from the old SID. If not, reset all soft limits to
1774 the lower of the current task's hard limit and the init
1775 task's soft limit. Note that the setting of hard limits
1776 (even to lower them) can be controlled by the setrlimit
1777 check. The inclusion of the init task's soft limit into
1778 the computation is to avoid resetting soft limits higher
1779 than the default soft limit for cases where the default
1780 is lower than the hard limit, e.g. RLIMIT_CORE or
1782 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1783 PROCESS__RLIMITINH
, NULL
);
1785 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
1786 rlim
= current
->signal
->rlim
+ i
;
1787 initrlim
= init_task
.signal
->rlim
+i
;
1788 rlim
->rlim_cur
= min(rlim
->rlim_max
,initrlim
->rlim_cur
);
1790 if (current
->signal
->rlim
[RLIMIT_CPU
].rlim_cur
!= RLIM_INFINITY
) {
1792 * This will cause RLIMIT_CPU calculations
1795 current
->it_prof_expires
= jiffies_to_cputime(1);
1799 /* Wake up the parent if it is waiting so that it can
1800 recheck wait permission to the new task SID. */
1801 wake_up_interruptible(¤t
->parent
->signal
->wait_chldexit
);
1804 /* superblock security operations */
1806 static int selinux_sb_alloc_security(struct super_block
*sb
)
1808 return superblock_alloc_security(sb
);
1811 static void selinux_sb_free_security(struct super_block
*sb
)
1813 superblock_free_security(sb
);
1816 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
1821 return !memcmp(prefix
, option
, plen
);
1824 static inline int selinux_option(char *option
, int len
)
1826 return (match_prefix("context=", sizeof("context=")-1, option
, len
) ||
1827 match_prefix("fscontext=", sizeof("fscontext=")-1, option
, len
) ||
1828 match_prefix("defcontext=", sizeof("defcontext=")-1, option
, len
));
1831 static inline void take_option(char **to
, char *from
, int *first
, int len
)
1839 memcpy(*to
, from
, len
);
1843 static int selinux_sb_copy_data(struct file_system_type
*type
, void *orig
, void *copy
)
1845 int fnosec
, fsec
, rc
= 0;
1846 char *in_save
, *in_curr
, *in_end
;
1847 char *sec_curr
, *nosec_save
, *nosec
;
1852 /* Binary mount data: just copy */
1853 if (type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
1854 copy_page(sec_curr
, in_curr
);
1858 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
1866 in_save
= in_end
= orig
;
1869 if (*in_end
== ',' || *in_end
== '\0') {
1870 int len
= in_end
- in_curr
;
1872 if (selinux_option(in_curr
, len
))
1873 take_option(&sec_curr
, in_curr
, &fsec
, len
);
1875 take_option(&nosec
, in_curr
, &fnosec
, len
);
1877 in_curr
= in_end
+ 1;
1879 } while (*in_end
++);
1881 strcpy(in_save
, nosec_save
);
1882 free_page((unsigned long)nosec_save
);
1887 static int selinux_sb_kern_mount(struct super_block
*sb
, void *data
)
1889 struct avc_audit_data ad
;
1892 rc
= superblock_doinit(sb
, data
);
1896 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1897 ad
.u
.fs
.dentry
= sb
->s_root
;
1898 return superblock_has_perm(current
, sb
, FILESYSTEM__MOUNT
, &ad
);
1901 static int selinux_sb_statfs(struct super_block
*sb
)
1903 struct avc_audit_data ad
;
1905 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1906 ad
.u
.fs
.dentry
= sb
->s_root
;
1907 return superblock_has_perm(current
, sb
, FILESYSTEM__GETATTR
, &ad
);
1910 static int selinux_mount(char * dev_name
,
1911 struct nameidata
*nd
,
1913 unsigned long flags
,
1918 rc
= secondary_ops
->sb_mount(dev_name
, nd
, type
, flags
, data
);
1922 if (flags
& MS_REMOUNT
)
1923 return superblock_has_perm(current
, nd
->mnt
->mnt_sb
,
1924 FILESYSTEM__REMOUNT
, NULL
);
1926 return dentry_has_perm(current
, nd
->mnt
, nd
->dentry
,
1930 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
1934 rc
= secondary_ops
->sb_umount(mnt
, flags
);
1938 return superblock_has_perm(current
,mnt
->mnt_sb
,
1939 FILESYSTEM__UNMOUNT
,NULL
);
1942 /* inode security operations */
1944 static int selinux_inode_alloc_security(struct inode
*inode
)
1946 return inode_alloc_security(inode
);
1949 static void selinux_inode_free_security(struct inode
*inode
)
1951 inode_free_security(inode
);
1954 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
1955 char **name
, void **value
,
1958 struct task_security_struct
*tsec
;
1959 struct inode_security_struct
*dsec
;
1960 struct superblock_security_struct
*sbsec
;
1961 struct inode_security_struct
*isec
;
1964 char *namep
= NULL
, *context
;
1966 tsec
= current
->security
;
1967 dsec
= dir
->i_security
;
1968 sbsec
= dir
->i_sb
->s_security
;
1969 isec
= inode
->i_security
;
1971 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1972 newsid
= tsec
->create_sid
;
1974 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
,
1975 inode_mode_to_security_class(inode
->i_mode
),
1978 printk(KERN_WARNING
"%s: "
1979 "security_transition_sid failed, rc=%d (dev=%s "
1982 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1987 inode_security_set_sid(inode
, newsid
);
1990 namep
= kstrdup(XATTR_SELINUX_SUFFIX
, GFP_KERNEL
);
1997 rc
= security_sid_to_context(newsid
, &context
, &clen
);
2009 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2011 return may_create(dir
, dentry
, SECCLASS_FILE
);
2014 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2018 rc
= secondary_ops
->inode_link(old_dentry
,dir
,new_dentry
);
2021 return may_link(dir
, old_dentry
, MAY_LINK
);
2024 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2028 rc
= secondary_ops
->inode_unlink(dir
, dentry
);
2031 return may_link(dir
, dentry
, MAY_UNLINK
);
2034 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2036 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2039 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2041 return may_create(dir
, dentry
, SECCLASS_DIR
);
2044 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2046 return may_link(dir
, dentry
, MAY_RMDIR
);
2049 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, int mode
, dev_t dev
)
2053 rc
= secondary_ops
->inode_mknod(dir
, dentry
, mode
, dev
);
2057 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2060 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2061 struct inode
*new_inode
, struct dentry
*new_dentry
)
2063 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2066 static int selinux_inode_readlink(struct dentry
*dentry
)
2068 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2071 static int selinux_inode_follow_link(struct dentry
*dentry
, struct nameidata
*nameidata
)
2075 rc
= secondary_ops
->inode_follow_link(dentry
,nameidata
);
2078 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2081 static int selinux_inode_permission(struct inode
*inode
, int mask
,
2082 struct nameidata
*nd
)
2086 rc
= secondary_ops
->inode_permission(inode
, mask
, nd
);
2091 /* No permission to check. Existence test. */
2095 return inode_has_perm(current
, inode
,
2096 file_mask_to_av(inode
->i_mode
, mask
), NULL
);
2099 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
2103 rc
= secondary_ops
->inode_setattr(dentry
, iattr
);
2107 if (iattr
->ia_valid
& ATTR_FORCE
)
2110 if (iattr
->ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
2111 ATTR_ATIME_SET
| ATTR_MTIME_SET
))
2112 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2114 return dentry_has_perm(current
, NULL
, dentry
, FILE__WRITE
);
2117 static int selinux_inode_getattr(struct vfsmount
*mnt
, struct dentry
*dentry
)
2119 return dentry_has_perm(current
, mnt
, dentry
, FILE__GETATTR
);
2122 static int selinux_inode_setxattr(struct dentry
*dentry
, char *name
, void *value
, size_t size
, int flags
)
2124 struct task_security_struct
*tsec
= current
->security
;
2125 struct inode
*inode
= dentry
->d_inode
;
2126 struct inode_security_struct
*isec
= inode
->i_security
;
2127 struct superblock_security_struct
*sbsec
;
2128 struct avc_audit_data ad
;
2132 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2133 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2134 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2135 !capable(CAP_SYS_ADMIN
)) {
2136 /* A different attribute in the security namespace.
2137 Restrict to administrator. */
2141 /* Not an attribute we recognize, so just check the
2142 ordinary setattr permission. */
2143 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2146 sbsec
= inode
->i_sb
->s_security
;
2147 if (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2150 if ((current
->fsuid
!= inode
->i_uid
) && !capable(CAP_FOWNER
))
2153 AVC_AUDIT_DATA_INIT(&ad
,FS
);
2154 ad
.u
.fs
.dentry
= dentry
;
2156 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
,
2157 FILE__RELABELFROM
, &ad
);
2161 rc
= security_context_to_sid(value
, size
, &newsid
);
2165 rc
= avc_has_perm(tsec
->sid
, newsid
, isec
->sclass
,
2166 FILE__RELABELTO
, &ad
);
2170 rc
= security_validate_transition(isec
->sid
, newsid
, tsec
->sid
,
2175 return avc_has_perm(newsid
,
2177 SECCLASS_FILESYSTEM
,
2178 FILESYSTEM__ASSOCIATE
,
2182 static void selinux_inode_post_setxattr(struct dentry
*dentry
, char *name
,
2183 void *value
, size_t size
, int flags
)
2185 struct inode
*inode
= dentry
->d_inode
;
2186 struct inode_security_struct
*isec
= inode
->i_security
;
2190 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2191 /* Not an attribute we recognize, so nothing to do. */
2195 rc
= security_context_to_sid(value
, size
, &newsid
);
2197 printk(KERN_WARNING
"%s: unable to obtain SID for context "
2198 "%s, rc=%d\n", __FUNCTION__
, (char*)value
, -rc
);
2206 static int selinux_inode_getxattr (struct dentry
*dentry
, char *name
)
2208 struct inode
*inode
= dentry
->d_inode
;
2209 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
2211 if (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2214 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2217 static int selinux_inode_listxattr (struct dentry
*dentry
)
2219 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2222 static int selinux_inode_removexattr (struct dentry
*dentry
, char *name
)
2224 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2225 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2226 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2227 !capable(CAP_SYS_ADMIN
)) {
2228 /* A different attribute in the security namespace.
2229 Restrict to administrator. */
2233 /* Not an attribute we recognize, so just check the
2234 ordinary setattr permission. Might want a separate
2235 permission for removexattr. */
2236 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2239 /* No one is allowed to remove a SELinux security label.
2240 You can change the label, but all data must be labeled. */
2244 static int selinux_inode_getsecurity(struct inode
*inode
, const char *name
, void *buffer
, size_t size
)
2246 struct inode_security_struct
*isec
= inode
->i_security
;
2251 /* Permission check handled by selinux_inode_getxattr hook.*/
2253 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2256 rc
= security_sid_to_context(isec
->sid
, &context
, &len
);
2260 if (!buffer
|| !size
) {
2268 memcpy(buffer
, context
, len
);
2273 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
2274 const void *value
, size_t size
, int flags
)
2276 struct inode_security_struct
*isec
= inode
->i_security
;
2280 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2283 if (!value
|| !size
)
2286 rc
= security_context_to_sid((void*)value
, size
, &newsid
);
2294 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
2296 const int len
= sizeof(XATTR_NAME_SELINUX
);
2297 if (buffer
&& len
<= buffer_size
)
2298 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
2302 /* file security operations */
2304 static int selinux_file_permission(struct file
*file
, int mask
)
2306 struct inode
*inode
= file
->f_dentry
->d_inode
;
2309 /* No permission to check. Existence test. */
2313 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2314 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
2317 return file_has_perm(current
, file
,
2318 file_mask_to_av(inode
->i_mode
, mask
));
2321 static int selinux_file_alloc_security(struct file
*file
)
2323 return file_alloc_security(file
);
2326 static void selinux_file_free_security(struct file
*file
)
2328 file_free_security(file
);
2331 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
2343 case EXT2_IOC_GETFLAGS
:
2345 case EXT2_IOC_GETVERSION
:
2346 error
= file_has_perm(current
, file
, FILE__GETATTR
);
2349 case EXT2_IOC_SETFLAGS
:
2351 case EXT2_IOC_SETVERSION
:
2352 error
= file_has_perm(current
, file
, FILE__SETATTR
);
2355 /* sys_ioctl() checks */
2359 error
= file_has_perm(current
, file
, 0);
2364 error
= task_has_capability(current
,CAP_SYS_TTY_CONFIG
);
2367 /* default case assumes that the command will go
2368 * to the file's ioctl() function.
2371 error
= file_has_perm(current
, file
, FILE__IOCTL
);
2377 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
2379 #ifndef CONFIG_PPC32
2380 if ((prot
& PROT_EXEC
) && (!file
|| (!shared
&& (prot
& PROT_WRITE
)))) {
2382 * We are making executable an anonymous mapping or a
2383 * private file mapping that will also be writable.
2384 * This has an additional check.
2386 int rc
= task_has_perm(current
, current
, PROCESS__EXECMEM
);
2393 /* read access is always possible with a mapping */
2394 u32 av
= FILE__READ
;
2396 /* write access only matters if the mapping is shared */
2397 if (shared
&& (prot
& PROT_WRITE
))
2400 if (prot
& PROT_EXEC
)
2401 av
|= FILE__EXECUTE
;
2403 return file_has_perm(current
, file
, av
);
2408 static int selinux_file_mmap(struct file
*file
, unsigned long reqprot
,
2409 unsigned long prot
, unsigned long flags
)
2413 rc
= secondary_ops
->file_mmap(file
, reqprot
, prot
, flags
);
2417 if (selinux_checkreqprot
)
2420 return file_map_prot_check(file
, prot
,
2421 (flags
& MAP_TYPE
) == MAP_SHARED
);
2424 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
2425 unsigned long reqprot
,
2430 rc
= secondary_ops
->file_mprotect(vma
, reqprot
, prot
);
2434 if (selinux_checkreqprot
)
2437 #ifndef CONFIG_PPC32
2438 if ((prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXECUTABLE
) &&
2439 (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
2440 vma
->vm_end
<= vma
->vm_mm
->brk
)) {
2442 * We are making an executable mapping in the brk region.
2443 * This has an additional execheap check.
2445 rc
= task_has_perm(current
, current
, PROCESS__EXECHEAP
);
2449 if (vma
->vm_file
!= NULL
&& vma
->anon_vma
!= NULL
&& (prot
& PROT_EXEC
)) {
2451 * We are making executable a file mapping that has
2452 * had some COW done. Since pages might have been written,
2453 * check ability to execute the possibly modified content.
2454 * This typically should only occur for text relocations.
2456 int rc
= file_has_perm(current
, vma
->vm_file
, FILE__EXECMOD
);
2460 if (!vma
->vm_file
&& (prot
& PROT_EXEC
) &&
2461 vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
2462 vma
->vm_end
>= vma
->vm_mm
->start_stack
) {
2463 /* Attempt to make the process stack executable.
2464 * This has an additional execstack check.
2466 rc
= task_has_perm(current
, current
, PROCESS__EXECSTACK
);
2472 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
2475 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
2477 return file_has_perm(current
, file
, FILE__LOCK
);
2480 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
2487 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2492 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
2493 err
= file_has_perm(current
, file
,FILE__WRITE
);
2502 /* Just check FD__USE permission */
2503 err
= file_has_perm(current
, file
, 0);
2508 #if BITS_PER_LONG == 32
2513 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2517 err
= file_has_perm(current
, file
, FILE__LOCK
);
2524 static int selinux_file_set_fowner(struct file
*file
)
2526 struct task_security_struct
*tsec
;
2527 struct file_security_struct
*fsec
;
2529 tsec
= current
->security
;
2530 fsec
= file
->f_security
;
2531 fsec
->fown_sid
= tsec
->sid
;
2536 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
2537 struct fown_struct
*fown
, int signum
)
2541 struct task_security_struct
*tsec
;
2542 struct file_security_struct
*fsec
;
2544 /* struct fown_struct is never outside the context of a struct file */
2545 file
= (struct file
*)((long)fown
- offsetof(struct file
,f_owner
));
2547 tsec
= tsk
->security
;
2548 fsec
= file
->f_security
;
2551 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
2553 perm
= signal_to_av(signum
);
2555 return avc_has_perm(fsec
->fown_sid
, tsec
->sid
,
2556 SECCLASS_PROCESS
, perm
, NULL
);
2559 static int selinux_file_receive(struct file
*file
)
2561 return file_has_perm(current
, file
, file_to_av(file
));
2564 /* task security operations */
2566 static int selinux_task_create(unsigned long clone_flags
)
2570 rc
= secondary_ops
->task_create(clone_flags
);
2574 return task_has_perm(current
, current
, PROCESS__FORK
);
2577 static int selinux_task_alloc_security(struct task_struct
*tsk
)
2579 struct task_security_struct
*tsec1
, *tsec2
;
2582 tsec1
= current
->security
;
2584 rc
= task_alloc_security(tsk
);
2587 tsec2
= tsk
->security
;
2589 tsec2
->osid
= tsec1
->osid
;
2590 tsec2
->sid
= tsec1
->sid
;
2592 /* Retain the exec and create SIDs across fork */
2593 tsec2
->exec_sid
= tsec1
->exec_sid
;
2594 tsec2
->create_sid
= tsec1
->create_sid
;
2596 /* Retain ptracer SID across fork, if any.
2597 This will be reset by the ptrace hook upon any
2598 subsequent ptrace_attach operations. */
2599 tsec2
->ptrace_sid
= tsec1
->ptrace_sid
;
2604 static void selinux_task_free_security(struct task_struct
*tsk
)
2606 task_free_security(tsk
);
2609 static int selinux_task_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2611 /* Since setuid only affects the current process, and
2612 since the SELinux controls are not based on the Linux
2613 identity attributes, SELinux does not need to control
2614 this operation. However, SELinux does control the use
2615 of the CAP_SETUID and CAP_SETGID capabilities using the
2620 static int selinux_task_post_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2622 return secondary_ops
->task_post_setuid(id0
,id1
,id2
,flags
);
2625 static int selinux_task_setgid(gid_t id0
, gid_t id1
, gid_t id2
, int flags
)
2627 /* See the comment for setuid above. */
2631 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
2633 return task_has_perm(current
, p
, PROCESS__SETPGID
);
2636 static int selinux_task_getpgid(struct task_struct
*p
)
2638 return task_has_perm(current
, p
, PROCESS__GETPGID
);
2641 static int selinux_task_getsid(struct task_struct
*p
)
2643 return task_has_perm(current
, p
, PROCESS__GETSESSION
);
2646 static int selinux_task_setgroups(struct group_info
*group_info
)
2648 /* See the comment for setuid above. */
2652 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
2656 rc
= secondary_ops
->task_setnice(p
, nice
);
2660 return task_has_perm(current
,p
, PROCESS__SETSCHED
);
2663 static int selinux_task_setrlimit(unsigned int resource
, struct rlimit
*new_rlim
)
2665 struct rlimit
*old_rlim
= current
->signal
->rlim
+ resource
;
2668 rc
= secondary_ops
->task_setrlimit(resource
, new_rlim
);
2672 /* Control the ability to change the hard limit (whether
2673 lowering or raising it), so that the hard limit can
2674 later be used as a safe reset point for the soft limit
2675 upon context transitions. See selinux_bprm_apply_creds. */
2676 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
2677 return task_has_perm(current
, current
, PROCESS__SETRLIMIT
);
2682 static int selinux_task_setscheduler(struct task_struct
*p
, int policy
, struct sched_param
*lp
)
2684 return task_has_perm(current
, p
, PROCESS__SETSCHED
);
2687 static int selinux_task_getscheduler(struct task_struct
*p
)
2689 return task_has_perm(current
, p
, PROCESS__GETSCHED
);
2692 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
, int sig
)
2697 rc
= secondary_ops
->task_kill(p
, info
, sig
);
2701 if (info
&& ((unsigned long)info
== 1 ||
2702 (unsigned long)info
== 2 || SI_FROMKERNEL(info
)))
2706 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
2708 perm
= signal_to_av(sig
);
2710 return task_has_perm(current
, p
, perm
);
2713 static int selinux_task_prctl(int option
,
2719 /* The current prctl operations do not appear to require
2720 any SELinux controls since they merely observe or modify
2721 the state of the current process. */
2725 static int selinux_task_wait(struct task_struct
*p
)
2729 perm
= signal_to_av(p
->exit_signal
);
2731 return task_has_perm(p
, current
, perm
);
2734 static void selinux_task_reparent_to_init(struct task_struct
*p
)
2736 struct task_security_struct
*tsec
;
2738 secondary_ops
->task_reparent_to_init(p
);
2741 tsec
->osid
= tsec
->sid
;
2742 tsec
->sid
= SECINITSID_KERNEL
;
2746 static void selinux_task_to_inode(struct task_struct
*p
,
2747 struct inode
*inode
)
2749 struct task_security_struct
*tsec
= p
->security
;
2750 struct inode_security_struct
*isec
= inode
->i_security
;
2752 isec
->sid
= tsec
->sid
;
2753 isec
->initialized
= 1;
2757 #ifdef CONFIG_SECURITY_NETWORK
2759 /* Returns error only if unable to parse addresses */
2760 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2762 int offset
, ihlen
, ret
= -EINVAL
;
2763 struct iphdr _iph
, *ih
;
2765 offset
= skb
->nh
.raw
- skb
->data
;
2766 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
2770 ihlen
= ih
->ihl
* 4;
2771 if (ihlen
< sizeof(_iph
))
2774 ad
->u
.net
.v4info
.saddr
= ih
->saddr
;
2775 ad
->u
.net
.v4info
.daddr
= ih
->daddr
;
2778 switch (ih
->protocol
) {
2780 struct tcphdr _tcph
, *th
;
2782 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2786 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2790 ad
->u
.net
.sport
= th
->source
;
2791 ad
->u
.net
.dport
= th
->dest
;
2796 struct udphdr _udph
, *uh
;
2798 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2802 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2806 ad
->u
.net
.sport
= uh
->source
;
2807 ad
->u
.net
.dport
= uh
->dest
;
2818 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2820 /* Returns error only if unable to parse addresses */
2821 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2824 int ret
= -EINVAL
, offset
;
2825 struct ipv6hdr _ipv6h
, *ip6
;
2827 offset
= skb
->nh
.raw
- skb
->data
;
2828 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
2832 ipv6_addr_copy(&ad
->u
.net
.v6info
.saddr
, &ip6
->saddr
);
2833 ipv6_addr_copy(&ad
->u
.net
.v6info
.daddr
, &ip6
->daddr
);
2836 nexthdr
= ip6
->nexthdr
;
2837 offset
+= sizeof(_ipv6h
);
2838 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
);
2844 struct tcphdr _tcph
, *th
;
2846 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2850 ad
->u
.net
.sport
= th
->source
;
2851 ad
->u
.net
.dport
= th
->dest
;
2856 struct udphdr _udph
, *uh
;
2858 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2862 ad
->u
.net
.sport
= uh
->source
;
2863 ad
->u
.net
.dport
= uh
->dest
;
2867 /* includes fragments */
2877 static int selinux_parse_skb(struct sk_buff
*skb
, struct avc_audit_data
*ad
,
2878 char **addrp
, int *len
, int src
)
2882 switch (ad
->u
.net
.family
) {
2884 ret
= selinux_parse_skb_ipv4(skb
, ad
);
2888 *addrp
= (char *)(src
? &ad
->u
.net
.v4info
.saddr
:
2889 &ad
->u
.net
.v4info
.daddr
);
2892 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2894 ret
= selinux_parse_skb_ipv6(skb
, ad
);
2898 *addrp
= (char *)(src
? &ad
->u
.net
.v6info
.saddr
:
2899 &ad
->u
.net
.v6info
.daddr
);
2909 /* socket security operations */
2910 static int socket_has_perm(struct task_struct
*task
, struct socket
*sock
,
2913 struct inode_security_struct
*isec
;
2914 struct task_security_struct
*tsec
;
2915 struct avc_audit_data ad
;
2918 tsec
= task
->security
;
2919 isec
= SOCK_INODE(sock
)->i_security
;
2921 if (isec
->sid
== SECINITSID_KERNEL
)
2924 AVC_AUDIT_DATA_INIT(&ad
,NET
);
2925 ad
.u
.net
.sk
= sock
->sk
;
2926 err
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
2932 static int selinux_socket_create(int family
, int type
,
2933 int protocol
, int kern
)
2936 struct task_security_struct
*tsec
;
2941 tsec
= current
->security
;
2942 err
= avc_has_perm(tsec
->sid
, tsec
->sid
,
2943 socket_type_to_security_class(family
, type
,
2944 protocol
), SOCKET__CREATE
, NULL
);
2950 static void selinux_socket_post_create(struct socket
*sock
, int family
,
2951 int type
, int protocol
, int kern
)
2953 struct inode_security_struct
*isec
;
2954 struct task_security_struct
*tsec
;
2956 isec
= SOCK_INODE(sock
)->i_security
;
2958 tsec
= current
->security
;
2959 isec
->sclass
= socket_type_to_security_class(family
, type
, protocol
);
2960 isec
->sid
= kern
? SECINITSID_KERNEL
: tsec
->sid
;
2961 isec
->initialized
= 1;
2966 /* Range of port numbers used to automatically bind.
2967 Need to determine whether we should perform a name_bind
2968 permission check between the socket and the port number. */
2969 #define ip_local_port_range_0 sysctl_local_port_range[0]
2970 #define ip_local_port_range_1 sysctl_local_port_range[1]
2972 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
2977 err
= socket_has_perm(current
, sock
, SOCKET__BIND
);
2982 * If PF_INET or PF_INET6, check name_bind permission for the port.
2983 * Multiple address binding for SCTP is not supported yet: we just
2984 * check the first address now.
2986 family
= sock
->sk
->sk_family
;
2987 if (family
== PF_INET
|| family
== PF_INET6
) {
2989 struct inode_security_struct
*isec
;
2990 struct task_security_struct
*tsec
;
2991 struct avc_audit_data ad
;
2992 struct sockaddr_in
*addr4
= NULL
;
2993 struct sockaddr_in6
*addr6
= NULL
;
2994 unsigned short snum
;
2995 struct sock
*sk
= sock
->sk
;
2996 u32 sid
, node_perm
, addrlen
;
2998 tsec
= current
->security
;
2999 isec
= SOCK_INODE(sock
)->i_security
;
3001 if (family
== PF_INET
) {
3002 addr4
= (struct sockaddr_in
*)address
;
3003 snum
= ntohs(addr4
->sin_port
);
3004 addrlen
= sizeof(addr4
->sin_addr
.s_addr
);
3005 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
3007 addr6
= (struct sockaddr_in6
*)address
;
3008 snum
= ntohs(addr6
->sin6_port
);
3009 addrlen
= sizeof(addr6
->sin6_addr
.s6_addr
);
3010 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
3013 if (snum
&&(snum
< max(PROT_SOCK
,ip_local_port_range_0
) ||
3014 snum
> ip_local_port_range_1
)) {
3015 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3016 sk
->sk_protocol
, snum
, &sid
);
3019 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3020 ad
.u
.net
.sport
= htons(snum
);
3021 ad
.u
.net
.family
= family
;
3022 err
= avc_has_perm(isec
->sid
, sid
,
3024 SOCKET__NAME_BIND
, &ad
);
3029 switch(isec
->sclass
) {
3030 case SECCLASS_TCP_SOCKET
:
3031 node_perm
= TCP_SOCKET__NODE_BIND
;
3034 case SECCLASS_UDP_SOCKET
:
3035 node_perm
= UDP_SOCKET__NODE_BIND
;
3039 node_perm
= RAWIP_SOCKET__NODE_BIND
;
3043 err
= security_node_sid(family
, addrp
, addrlen
, &sid
);
3047 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3048 ad
.u
.net
.sport
= htons(snum
);
3049 ad
.u
.net
.family
= family
;
3051 if (family
== PF_INET
)
3052 ad
.u
.net
.v4info
.saddr
= addr4
->sin_addr
.s_addr
;
3054 ipv6_addr_copy(&ad
.u
.net
.v6info
.saddr
, &addr6
->sin6_addr
);
3056 err
= avc_has_perm(isec
->sid
, sid
,
3057 isec
->sclass
, node_perm
, &ad
);
3065 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3067 struct inode_security_struct
*isec
;
3070 err
= socket_has_perm(current
, sock
, SOCKET__CONNECT
);
3075 * If a TCP socket, check name_connect permission for the port.
3077 isec
= SOCK_INODE(sock
)->i_security
;
3078 if (isec
->sclass
== SECCLASS_TCP_SOCKET
) {
3079 struct sock
*sk
= sock
->sk
;
3080 struct avc_audit_data ad
;
3081 struct sockaddr_in
*addr4
= NULL
;
3082 struct sockaddr_in6
*addr6
= NULL
;
3083 unsigned short snum
;
3086 if (sk
->sk_family
== PF_INET
) {
3087 addr4
= (struct sockaddr_in
*)address
;
3088 if (addrlen
< sizeof(struct sockaddr_in
))
3090 snum
= ntohs(addr4
->sin_port
);
3092 addr6
= (struct sockaddr_in6
*)address
;
3093 if (addrlen
< SIN6_LEN_RFC2133
)
3095 snum
= ntohs(addr6
->sin6_port
);
3098 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3099 sk
->sk_protocol
, snum
, &sid
);
3103 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3104 ad
.u
.net
.dport
= htons(snum
);
3105 ad
.u
.net
.family
= sk
->sk_family
;
3106 err
= avc_has_perm(isec
->sid
, sid
, isec
->sclass
,
3107 TCP_SOCKET__NAME_CONNECT
, &ad
);
3116 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
3118 return socket_has_perm(current
, sock
, SOCKET__LISTEN
);
3121 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
3124 struct inode_security_struct
*isec
;
3125 struct inode_security_struct
*newisec
;
3127 err
= socket_has_perm(current
, sock
, SOCKET__ACCEPT
);
3131 newisec
= SOCK_INODE(newsock
)->i_security
;
3133 isec
= SOCK_INODE(sock
)->i_security
;
3134 newisec
->sclass
= isec
->sclass
;
3135 newisec
->sid
= isec
->sid
;
3136 newisec
->initialized
= 1;
3141 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
3144 return socket_has_perm(current
, sock
, SOCKET__WRITE
);
3147 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
3148 int size
, int flags
)
3150 return socket_has_perm(current
, sock
, SOCKET__READ
);
3153 static int selinux_socket_getsockname(struct socket
*sock
)
3155 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3158 static int selinux_socket_getpeername(struct socket
*sock
)
3160 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3163 static int selinux_socket_setsockopt(struct socket
*sock
,int level
,int optname
)
3165 return socket_has_perm(current
, sock
, SOCKET__SETOPT
);
3168 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
3171 return socket_has_perm(current
, sock
, SOCKET__GETOPT
);
3174 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
3176 return socket_has_perm(current
, sock
, SOCKET__SHUTDOWN
);
3179 static int selinux_socket_unix_stream_connect(struct socket
*sock
,
3180 struct socket
*other
,
3183 struct sk_security_struct
*ssec
;
3184 struct inode_security_struct
*isec
;
3185 struct inode_security_struct
*other_isec
;
3186 struct avc_audit_data ad
;
3189 err
= secondary_ops
->unix_stream_connect(sock
, other
, newsk
);
3193 isec
= SOCK_INODE(sock
)->i_security
;
3194 other_isec
= SOCK_INODE(other
)->i_security
;
3196 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3197 ad
.u
.net
.sk
= other
->sk
;
3199 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3201 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
3205 /* connecting socket */
3206 ssec
= sock
->sk
->sk_security
;
3207 ssec
->peer_sid
= other_isec
->sid
;
3209 /* server child socket */
3210 ssec
= newsk
->sk_security
;
3211 ssec
->peer_sid
= isec
->sid
;
3216 static int selinux_socket_unix_may_send(struct socket
*sock
,
3217 struct socket
*other
)
3219 struct inode_security_struct
*isec
;
3220 struct inode_security_struct
*other_isec
;
3221 struct avc_audit_data ad
;
3224 isec
= SOCK_INODE(sock
)->i_security
;
3225 other_isec
= SOCK_INODE(other
)->i_security
;
3227 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3228 ad
.u
.net
.sk
= other
->sk
;
3230 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3231 isec
->sclass
, SOCKET__SENDTO
, &ad
);
3238 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
3243 u32 netif_perm
, node_perm
, node_sid
, if_sid
, recv_perm
= 0;
3246 struct socket
*sock
;
3247 struct net_device
*dev
;
3248 struct avc_audit_data ad
;
3250 family
= sk
->sk_family
;
3251 if (family
!= PF_INET
&& family
!= PF_INET6
)
3254 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3255 if (family
== PF_INET6
&& skb
->protocol
== ntohs(ETH_P_IP
))
3258 read_lock_bh(&sk
->sk_callback_lock
);
3259 sock
= sk
->sk_socket
;
3261 struct inode
*inode
;
3262 inode
= SOCK_INODE(sock
);
3264 struct inode_security_struct
*isec
;
3265 isec
= inode
->i_security
;
3266 sock_sid
= isec
->sid
;
3267 sock_class
= isec
->sclass
;
3270 read_unlock_bh(&sk
->sk_callback_lock
);
3278 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3282 switch (sock_class
) {
3283 case SECCLASS_UDP_SOCKET
:
3284 netif_perm
= NETIF__UDP_RECV
;
3285 node_perm
= NODE__UDP_RECV
;
3286 recv_perm
= UDP_SOCKET__RECV_MSG
;
3289 case SECCLASS_TCP_SOCKET
:
3290 netif_perm
= NETIF__TCP_RECV
;
3291 node_perm
= NODE__TCP_RECV
;
3292 recv_perm
= TCP_SOCKET__RECV_MSG
;
3296 netif_perm
= NETIF__RAWIP_RECV
;
3297 node_perm
= NODE__RAWIP_RECV
;
3301 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3302 ad
.u
.net
.netif
= dev
->name
;
3303 ad
.u
.net
.family
= family
;
3305 err
= selinux_parse_skb(skb
, &ad
, &addrp
, &len
, 1);
3309 err
= avc_has_perm(sock_sid
, if_sid
, SECCLASS_NETIF
, netif_perm
, &ad
);
3313 /* Fixme: this lookup is inefficient */
3314 err
= security_node_sid(family
, addrp
, len
, &node_sid
);
3318 err
= avc_has_perm(sock_sid
, node_sid
, SECCLASS_NODE
, node_perm
, &ad
);
3325 /* Fixme: make this more efficient */
3326 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3327 sk
->sk_protocol
, ntohs(ad
.u
.net
.sport
),
3332 err
= avc_has_perm(sock_sid
, port_sid
,
3333 sock_class
, recv_perm
, &ad
);
3339 static int selinux_socket_getpeersec(struct socket
*sock
, char __user
*optval
,
3340 int __user
*optlen
, unsigned len
)
3345 struct sk_security_struct
*ssec
;
3346 struct inode_security_struct
*isec
;
3348 isec
= SOCK_INODE(sock
)->i_security
;
3349 if (isec
->sclass
!= SECCLASS_UNIX_STREAM_SOCKET
) {
3354 ssec
= sock
->sk
->sk_security
;
3356 err
= security_sid_to_context(ssec
->peer_sid
, &scontext
, &scontext_len
);
3360 if (scontext_len
> len
) {
3365 if (copy_to_user(optval
, scontext
, scontext_len
))
3369 if (put_user(scontext_len
, optlen
))
3377 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
3379 return sk_alloc_security(sk
, family
, priority
);
3382 static void selinux_sk_free_security(struct sock
*sk
)
3384 sk_free_security(sk
);
3387 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
3391 struct nlmsghdr
*nlh
;
3392 struct socket
*sock
= sk
->sk_socket
;
3393 struct inode_security_struct
*isec
= SOCK_INODE(sock
)->i_security
;
3395 if (skb
->len
< NLMSG_SPACE(0)) {
3399 nlh
= (struct nlmsghdr
*)skb
->data
;
3401 err
= selinux_nlmsg_lookup(isec
->sclass
, nlh
->nlmsg_type
, &perm
);
3403 if (err
== -EINVAL
) {
3404 audit_log(current
->audit_context
, GFP_KERNEL
, AUDIT_SELINUX_ERR
,
3405 "SELinux: unrecognized netlink message"
3406 " type=%hu for sclass=%hu\n",
3407 nlh
->nlmsg_type
, isec
->sclass
);
3408 if (!selinux_enforcing
)
3418 err
= socket_has_perm(current
, sock
, perm
);
3423 #ifdef CONFIG_NETFILTER
3425 static unsigned int selinux_ip_postroute_last(unsigned int hooknum
,
3426 struct sk_buff
**pskb
,
3427 const struct net_device
*in
,
3428 const struct net_device
*out
,
3429 int (*okfn
)(struct sk_buff
*),
3433 int len
, err
= NF_ACCEPT
;
3434 u32 netif_perm
, node_perm
, node_sid
, if_sid
, send_perm
= 0;
3436 struct socket
*sock
;
3437 struct inode
*inode
;
3438 struct sk_buff
*skb
= *pskb
;
3439 struct inode_security_struct
*isec
;
3440 struct avc_audit_data ad
;
3441 struct net_device
*dev
= (struct net_device
*)out
;
3447 sock
= sk
->sk_socket
;
3451 inode
= SOCK_INODE(sock
);
3455 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3459 isec
= inode
->i_security
;
3461 switch (isec
->sclass
) {
3462 case SECCLASS_UDP_SOCKET
:
3463 netif_perm
= NETIF__UDP_SEND
;
3464 node_perm
= NODE__UDP_SEND
;
3465 send_perm
= UDP_SOCKET__SEND_MSG
;
3468 case SECCLASS_TCP_SOCKET
:
3469 netif_perm
= NETIF__TCP_SEND
;
3470 node_perm
= NODE__TCP_SEND
;
3471 send_perm
= TCP_SOCKET__SEND_MSG
;
3475 netif_perm
= NETIF__RAWIP_SEND
;
3476 node_perm
= NODE__RAWIP_SEND
;
3481 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3482 ad
.u
.net
.netif
= dev
->name
;
3483 ad
.u
.net
.family
= family
;
3485 err
= selinux_parse_skb(skb
, &ad
, &addrp
,
3486 &len
, 0) ? NF_DROP
: NF_ACCEPT
;
3487 if (err
!= NF_ACCEPT
)
3490 err
= avc_has_perm(isec
->sid
, if_sid
, SECCLASS_NETIF
,
3491 netif_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3492 if (err
!= NF_ACCEPT
)
3495 /* Fixme: this lookup is inefficient */
3496 err
= security_node_sid(family
, addrp
, len
,
3497 &node_sid
) ? NF_DROP
: NF_ACCEPT
;
3498 if (err
!= NF_ACCEPT
)
3501 err
= avc_has_perm(isec
->sid
, node_sid
, SECCLASS_NODE
,
3502 node_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3503 if (err
!= NF_ACCEPT
)
3509 /* Fixme: make this more efficient */
3510 err
= security_port_sid(sk
->sk_family
,
3513 ntohs(ad
.u
.net
.dport
),
3514 &port_sid
) ? NF_DROP
: NF_ACCEPT
;
3515 if (err
!= NF_ACCEPT
)
3518 err
= avc_has_perm(isec
->sid
, port_sid
, isec
->sclass
,
3519 send_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3526 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum
,
3527 struct sk_buff
**pskb
,
3528 const struct net_device
*in
,
3529 const struct net_device
*out
,
3530 int (*okfn
)(struct sk_buff
*))
3532 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET
);
3535 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3537 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum
,
3538 struct sk_buff
**pskb
,
3539 const struct net_device
*in
,
3540 const struct net_device
*out
,
3541 int (*okfn
)(struct sk_buff
*))
3543 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET6
);
3548 #endif /* CONFIG_NETFILTER */
3552 static inline int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
3557 #endif /* CONFIG_SECURITY_NETWORK */
3559 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
3561 struct task_security_struct
*tsec
;
3562 struct av_decision avd
;
3565 err
= secondary_ops
->netlink_send(sk
, skb
);
3569 tsec
= current
->security
;
3572 avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
3573 SECCLASS_CAPABILITY
, ~0, &avd
);
3574 cap_mask(NETLINK_CB(skb
).eff_cap
, avd
.allowed
);
3576 if (policydb_loaded_version
>= POLICYDB_VERSION_NLCLASS
)
3577 err
= selinux_nlmsg_perm(sk
, skb
);
3582 static int selinux_netlink_recv(struct sk_buff
*skb
)
3584 if (!cap_raised(NETLINK_CB(skb
).eff_cap
, CAP_NET_ADMIN
))
3589 static int ipc_alloc_security(struct task_struct
*task
,
3590 struct kern_ipc_perm
*perm
,
3593 struct task_security_struct
*tsec
= task
->security
;
3594 struct ipc_security_struct
*isec
;
3596 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
3600 isec
->magic
= SELINUX_MAGIC
;
3601 isec
->sclass
= sclass
;
3602 isec
->ipc_perm
= perm
;
3604 isec
->sid
= tsec
->sid
;
3606 isec
->sid
= SECINITSID_UNLABELED
;
3608 perm
->security
= isec
;
3613 static void ipc_free_security(struct kern_ipc_perm
*perm
)
3615 struct ipc_security_struct
*isec
= perm
->security
;
3616 if (!isec
|| isec
->magic
!= SELINUX_MAGIC
)
3619 perm
->security
= NULL
;
3623 static int msg_msg_alloc_security(struct msg_msg
*msg
)
3625 struct msg_security_struct
*msec
;
3627 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
3631 msec
->magic
= SELINUX_MAGIC
;
3633 msec
->sid
= SECINITSID_UNLABELED
;
3634 msg
->security
= msec
;
3639 static void msg_msg_free_security(struct msg_msg
*msg
)
3641 struct msg_security_struct
*msec
= msg
->security
;
3642 if (!msec
|| msec
->magic
!= SELINUX_MAGIC
)
3645 msg
->security
= NULL
;
3649 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
3652 struct task_security_struct
*tsec
;
3653 struct ipc_security_struct
*isec
;
3654 struct avc_audit_data ad
;
3656 tsec
= current
->security
;
3657 isec
= ipc_perms
->security
;
3659 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3660 ad
.u
.ipc_id
= ipc_perms
->key
;
3662 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3665 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
3667 return msg_msg_alloc_security(msg
);
3670 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
3672 msg_msg_free_security(msg
);
3675 /* message queue security operations */
3676 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
3678 struct task_security_struct
*tsec
;
3679 struct ipc_security_struct
*isec
;
3680 struct avc_audit_data ad
;
3683 rc
= ipc_alloc_security(current
, &msq
->q_perm
, SECCLASS_MSGQ
);
3687 tsec
= current
->security
;
3688 isec
= msq
->q_perm
.security
;
3690 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3691 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3693 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3696 ipc_free_security(&msq
->q_perm
);
3702 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
3704 ipc_free_security(&msq
->q_perm
);
3707 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
3709 struct task_security_struct
*tsec
;
3710 struct ipc_security_struct
*isec
;
3711 struct avc_audit_data ad
;
3713 tsec
= current
->security
;
3714 isec
= msq
->q_perm
.security
;
3716 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3717 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3719 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3720 MSGQ__ASSOCIATE
, &ad
);
3723 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
3731 /* No specific object, just general system-wide information. */
3732 return task_has_system(current
, SYSTEM__IPC_INFO
);
3735 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
3738 perms
= MSGQ__SETATTR
;
3741 perms
= MSGQ__DESTROY
;
3747 err
= ipc_has_perm(&msq
->q_perm
, perms
);
3751 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
3753 struct task_security_struct
*tsec
;
3754 struct ipc_security_struct
*isec
;
3755 struct msg_security_struct
*msec
;
3756 struct avc_audit_data ad
;
3759 tsec
= current
->security
;
3760 isec
= msq
->q_perm
.security
;
3761 msec
= msg
->security
;
3764 * First time through, need to assign label to the message
3766 if (msec
->sid
== SECINITSID_UNLABELED
) {
3768 * Compute new sid based on current process and
3769 * message queue this message will be stored in
3771 rc
= security_transition_sid(tsec
->sid
,
3779 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3780 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3782 /* Can this process write to the queue? */
3783 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3786 /* Can this process send the message */
3787 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
3788 SECCLASS_MSG
, MSG__SEND
, &ad
);
3790 /* Can the message be put in the queue? */
3791 rc
= avc_has_perm(msec
->sid
, isec
->sid
,
3792 SECCLASS_MSGQ
, MSGQ__ENQUEUE
, &ad
);
3797 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
3798 struct task_struct
*target
,
3799 long type
, int mode
)
3801 struct task_security_struct
*tsec
;
3802 struct ipc_security_struct
*isec
;
3803 struct msg_security_struct
*msec
;
3804 struct avc_audit_data ad
;
3807 tsec
= target
->security
;
3808 isec
= msq
->q_perm
.security
;
3809 msec
= msg
->security
;
3811 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3812 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3814 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
3815 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
3817 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
3818 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
3822 /* Shared Memory security operations */
3823 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
3825 struct task_security_struct
*tsec
;
3826 struct ipc_security_struct
*isec
;
3827 struct avc_audit_data ad
;
3830 rc
= ipc_alloc_security(current
, &shp
->shm_perm
, SECCLASS_SHM
);
3834 tsec
= current
->security
;
3835 isec
= shp
->shm_perm
.security
;
3837 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3838 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
3840 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
3843 ipc_free_security(&shp
->shm_perm
);
3849 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
3851 ipc_free_security(&shp
->shm_perm
);
3854 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
3856 struct task_security_struct
*tsec
;
3857 struct ipc_security_struct
*isec
;
3858 struct avc_audit_data ad
;
3860 tsec
= current
->security
;
3861 isec
= shp
->shm_perm
.security
;
3863 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3864 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
3866 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
3867 SHM__ASSOCIATE
, &ad
);
3870 /* Note, at this point, shp is locked down */
3871 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
3879 /* No specific object, just general system-wide information. */
3880 return task_has_system(current
, SYSTEM__IPC_INFO
);
3883 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
3886 perms
= SHM__SETATTR
;
3893 perms
= SHM__DESTROY
;
3899 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
3903 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
3904 char __user
*shmaddr
, int shmflg
)
3909 rc
= secondary_ops
->shm_shmat(shp
, shmaddr
, shmflg
);
3913 if (shmflg
& SHM_RDONLY
)
3916 perms
= SHM__READ
| SHM__WRITE
;
3918 return ipc_has_perm(&shp
->shm_perm
, perms
);
3921 /* Semaphore security operations */
3922 static int selinux_sem_alloc_security(struct sem_array
*sma
)
3924 struct task_security_struct
*tsec
;
3925 struct ipc_security_struct
*isec
;
3926 struct avc_audit_data ad
;
3929 rc
= ipc_alloc_security(current
, &sma
->sem_perm
, SECCLASS_SEM
);
3933 tsec
= current
->security
;
3934 isec
= sma
->sem_perm
.security
;
3936 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3937 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
3939 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
3942 ipc_free_security(&sma
->sem_perm
);
3948 static void selinux_sem_free_security(struct sem_array
*sma
)
3950 ipc_free_security(&sma
->sem_perm
);
3953 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
3955 struct task_security_struct
*tsec
;
3956 struct ipc_security_struct
*isec
;
3957 struct avc_audit_data ad
;
3959 tsec
= current
->security
;
3960 isec
= sma
->sem_perm
.security
;
3962 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3963 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
3965 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
3966 SEM__ASSOCIATE
, &ad
);
3969 /* Note, at this point, sma is locked down */
3970 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
3978 /* No specific object, just general system-wide information. */
3979 return task_has_system(current
, SYSTEM__IPC_INFO
);
3983 perms
= SEM__GETATTR
;
3994 perms
= SEM__DESTROY
;
3997 perms
= SEM__SETATTR
;
4001 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
4007 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
4011 static int selinux_sem_semop(struct sem_array
*sma
,
4012 struct sembuf
*sops
, unsigned nsops
, int alter
)
4017 perms
= SEM__READ
| SEM__WRITE
;
4021 return ipc_has_perm(&sma
->sem_perm
, perms
);
4024 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
4030 av
|= IPC__UNIX_READ
;
4032 av
|= IPC__UNIX_WRITE
;
4037 return ipc_has_perm(ipcp
, av
);
4040 /* module stacking operations */
4041 static int selinux_register_security (const char *name
, struct security_operations
*ops
)
4043 if (secondary_ops
!= original_ops
) {
4044 printk(KERN_INFO
"%s: There is already a secondary security "
4045 "module registered.\n", __FUNCTION__
);
4049 secondary_ops
= ops
;
4051 printk(KERN_INFO
"%s: Registering secondary module %s\n",
4058 static int selinux_unregister_security (const char *name
, struct security_operations
*ops
)
4060 if (ops
!= secondary_ops
) {
4061 printk (KERN_INFO
"%s: trying to unregister a security module "
4062 "that is not registered.\n", __FUNCTION__
);
4066 secondary_ops
= original_ops
;
4071 static void selinux_d_instantiate (struct dentry
*dentry
, struct inode
*inode
)
4074 inode_doinit_with_dentry(inode
, dentry
);
4077 static int selinux_getprocattr(struct task_struct
*p
,
4078 char *name
, void *value
, size_t size
)
4080 struct task_security_struct
*tsec
;
4086 error
= task_has_perm(current
, p
, PROCESS__GETATTR
);
4096 if (!strcmp(name
, "current"))
4098 else if (!strcmp(name
, "prev"))
4100 else if (!strcmp(name
, "exec"))
4101 sid
= tsec
->exec_sid
;
4102 else if (!strcmp(name
, "fscreate"))
4103 sid
= tsec
->create_sid
;
4110 error
= security_sid_to_context(sid
, &context
, &len
);
4117 memcpy(value
, context
, len
);
4122 static int selinux_setprocattr(struct task_struct
*p
,
4123 char *name
, void *value
, size_t size
)
4125 struct task_security_struct
*tsec
;
4131 /* SELinux only allows a process to change its own
4132 security attributes. */
4137 * Basic control over ability to set these attributes at all.
4138 * current == p, but we'll pass them separately in case the
4139 * above restriction is ever removed.
4141 if (!strcmp(name
, "exec"))
4142 error
= task_has_perm(current
, p
, PROCESS__SETEXEC
);
4143 else if (!strcmp(name
, "fscreate"))
4144 error
= task_has_perm(current
, p
, PROCESS__SETFSCREATE
);
4145 else if (!strcmp(name
, "current"))
4146 error
= task_has_perm(current
, p
, PROCESS__SETCURRENT
);
4152 /* Obtain a SID for the context, if one was specified. */
4153 if (size
&& str
[1] && str
[1] != '\n') {
4154 if (str
[size
-1] == '\n') {
4158 error
= security_context_to_sid(value
, size
, &sid
);
4163 /* Permission checking based on the specified context is
4164 performed during the actual operation (execve,
4165 open/mkdir/...), when we know the full context of the
4166 operation. See selinux_bprm_set_security for the execve
4167 checks and may_create for the file creation checks. The
4168 operation will then fail if the context is not permitted. */
4170 if (!strcmp(name
, "exec"))
4171 tsec
->exec_sid
= sid
;
4172 else if (!strcmp(name
, "fscreate"))
4173 tsec
->create_sid
= sid
;
4174 else if (!strcmp(name
, "current")) {
4175 struct av_decision avd
;
4180 /* Only allow single threaded processes to change context */
4181 if (atomic_read(&p
->mm
->mm_users
) != 1) {
4182 struct task_struct
*g
, *t
;
4183 struct mm_struct
*mm
= p
->mm
;
4184 read_lock(&tasklist_lock
);
4185 do_each_thread(g
, t
)
4186 if (t
->mm
== mm
&& t
!= p
) {
4187 read_unlock(&tasklist_lock
);
4190 while_each_thread(g
, t
);
4191 read_unlock(&tasklist_lock
);
4194 /* Check permissions for the transition. */
4195 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
4196 PROCESS__DYNTRANSITION
, NULL
);
4200 /* Check for ptracing, and update the task SID if ok.
4201 Otherwise, leave SID unchanged and fail. */
4203 if (p
->ptrace
& PT_PTRACED
) {
4204 error
= avc_has_perm_noaudit(tsec
->ptrace_sid
, sid
,
4206 PROCESS__PTRACE
, &avd
);
4210 avc_audit(tsec
->ptrace_sid
, sid
, SECCLASS_PROCESS
,
4211 PROCESS__PTRACE
, &avd
, error
, NULL
);
4225 static struct security_operations selinux_ops
= {
4226 .ptrace
= selinux_ptrace
,
4227 .capget
= selinux_capget
,
4228 .capset_check
= selinux_capset_check
,
4229 .capset_set
= selinux_capset_set
,
4230 .sysctl
= selinux_sysctl
,
4231 .capable
= selinux_capable
,
4232 .quotactl
= selinux_quotactl
,
4233 .quota_on
= selinux_quota_on
,
4234 .syslog
= selinux_syslog
,
4235 .vm_enough_memory
= selinux_vm_enough_memory
,
4237 .netlink_send
= selinux_netlink_send
,
4238 .netlink_recv
= selinux_netlink_recv
,
4240 .bprm_alloc_security
= selinux_bprm_alloc_security
,
4241 .bprm_free_security
= selinux_bprm_free_security
,
4242 .bprm_apply_creds
= selinux_bprm_apply_creds
,
4243 .bprm_post_apply_creds
= selinux_bprm_post_apply_creds
,
4244 .bprm_set_security
= selinux_bprm_set_security
,
4245 .bprm_check_security
= selinux_bprm_check_security
,
4246 .bprm_secureexec
= selinux_bprm_secureexec
,
4248 .sb_alloc_security
= selinux_sb_alloc_security
,
4249 .sb_free_security
= selinux_sb_free_security
,
4250 .sb_copy_data
= selinux_sb_copy_data
,
4251 .sb_kern_mount
= selinux_sb_kern_mount
,
4252 .sb_statfs
= selinux_sb_statfs
,
4253 .sb_mount
= selinux_mount
,
4254 .sb_umount
= selinux_umount
,
4256 .inode_alloc_security
= selinux_inode_alloc_security
,
4257 .inode_free_security
= selinux_inode_free_security
,
4258 .inode_init_security
= selinux_inode_init_security
,
4259 .inode_create
= selinux_inode_create
,
4260 .inode_link
= selinux_inode_link
,
4261 .inode_unlink
= selinux_inode_unlink
,
4262 .inode_symlink
= selinux_inode_symlink
,
4263 .inode_mkdir
= selinux_inode_mkdir
,
4264 .inode_rmdir
= selinux_inode_rmdir
,
4265 .inode_mknod
= selinux_inode_mknod
,
4266 .inode_rename
= selinux_inode_rename
,
4267 .inode_readlink
= selinux_inode_readlink
,
4268 .inode_follow_link
= selinux_inode_follow_link
,
4269 .inode_permission
= selinux_inode_permission
,
4270 .inode_setattr
= selinux_inode_setattr
,
4271 .inode_getattr
= selinux_inode_getattr
,
4272 .inode_setxattr
= selinux_inode_setxattr
,
4273 .inode_post_setxattr
= selinux_inode_post_setxattr
,
4274 .inode_getxattr
= selinux_inode_getxattr
,
4275 .inode_listxattr
= selinux_inode_listxattr
,
4276 .inode_removexattr
= selinux_inode_removexattr
,
4277 .inode_getsecurity
= selinux_inode_getsecurity
,
4278 .inode_setsecurity
= selinux_inode_setsecurity
,
4279 .inode_listsecurity
= selinux_inode_listsecurity
,
4281 .file_permission
= selinux_file_permission
,
4282 .file_alloc_security
= selinux_file_alloc_security
,
4283 .file_free_security
= selinux_file_free_security
,
4284 .file_ioctl
= selinux_file_ioctl
,
4285 .file_mmap
= selinux_file_mmap
,
4286 .file_mprotect
= selinux_file_mprotect
,
4287 .file_lock
= selinux_file_lock
,
4288 .file_fcntl
= selinux_file_fcntl
,
4289 .file_set_fowner
= selinux_file_set_fowner
,
4290 .file_send_sigiotask
= selinux_file_send_sigiotask
,
4291 .file_receive
= selinux_file_receive
,
4293 .task_create
= selinux_task_create
,
4294 .task_alloc_security
= selinux_task_alloc_security
,
4295 .task_free_security
= selinux_task_free_security
,
4296 .task_setuid
= selinux_task_setuid
,
4297 .task_post_setuid
= selinux_task_post_setuid
,
4298 .task_setgid
= selinux_task_setgid
,
4299 .task_setpgid
= selinux_task_setpgid
,
4300 .task_getpgid
= selinux_task_getpgid
,
4301 .task_getsid
= selinux_task_getsid
,
4302 .task_setgroups
= selinux_task_setgroups
,
4303 .task_setnice
= selinux_task_setnice
,
4304 .task_setrlimit
= selinux_task_setrlimit
,
4305 .task_setscheduler
= selinux_task_setscheduler
,
4306 .task_getscheduler
= selinux_task_getscheduler
,
4307 .task_kill
= selinux_task_kill
,
4308 .task_wait
= selinux_task_wait
,
4309 .task_prctl
= selinux_task_prctl
,
4310 .task_reparent_to_init
= selinux_task_reparent_to_init
,
4311 .task_to_inode
= selinux_task_to_inode
,
4313 .ipc_permission
= selinux_ipc_permission
,
4315 .msg_msg_alloc_security
= selinux_msg_msg_alloc_security
,
4316 .msg_msg_free_security
= selinux_msg_msg_free_security
,
4318 .msg_queue_alloc_security
= selinux_msg_queue_alloc_security
,
4319 .msg_queue_free_security
= selinux_msg_queue_free_security
,
4320 .msg_queue_associate
= selinux_msg_queue_associate
,
4321 .msg_queue_msgctl
= selinux_msg_queue_msgctl
,
4322 .msg_queue_msgsnd
= selinux_msg_queue_msgsnd
,
4323 .msg_queue_msgrcv
= selinux_msg_queue_msgrcv
,
4325 .shm_alloc_security
= selinux_shm_alloc_security
,
4326 .shm_free_security
= selinux_shm_free_security
,
4327 .shm_associate
= selinux_shm_associate
,
4328 .shm_shmctl
= selinux_shm_shmctl
,
4329 .shm_shmat
= selinux_shm_shmat
,
4331 .sem_alloc_security
= selinux_sem_alloc_security
,
4332 .sem_free_security
= selinux_sem_free_security
,
4333 .sem_associate
= selinux_sem_associate
,
4334 .sem_semctl
= selinux_sem_semctl
,
4335 .sem_semop
= selinux_sem_semop
,
4337 .register_security
= selinux_register_security
,
4338 .unregister_security
= selinux_unregister_security
,
4340 .d_instantiate
= selinux_d_instantiate
,
4342 .getprocattr
= selinux_getprocattr
,
4343 .setprocattr
= selinux_setprocattr
,
4345 #ifdef CONFIG_SECURITY_NETWORK
4346 .unix_stream_connect
= selinux_socket_unix_stream_connect
,
4347 .unix_may_send
= selinux_socket_unix_may_send
,
4349 .socket_create
= selinux_socket_create
,
4350 .socket_post_create
= selinux_socket_post_create
,
4351 .socket_bind
= selinux_socket_bind
,
4352 .socket_connect
= selinux_socket_connect
,
4353 .socket_listen
= selinux_socket_listen
,
4354 .socket_accept
= selinux_socket_accept
,
4355 .socket_sendmsg
= selinux_socket_sendmsg
,
4356 .socket_recvmsg
= selinux_socket_recvmsg
,
4357 .socket_getsockname
= selinux_socket_getsockname
,
4358 .socket_getpeername
= selinux_socket_getpeername
,
4359 .socket_getsockopt
= selinux_socket_getsockopt
,
4360 .socket_setsockopt
= selinux_socket_setsockopt
,
4361 .socket_shutdown
= selinux_socket_shutdown
,
4362 .socket_sock_rcv_skb
= selinux_socket_sock_rcv_skb
,
4363 .socket_getpeersec
= selinux_socket_getpeersec
,
4364 .sk_alloc_security
= selinux_sk_alloc_security
,
4365 .sk_free_security
= selinux_sk_free_security
,
4369 static __init
int selinux_init(void)
4371 struct task_security_struct
*tsec
;
4373 if (!selinux_enabled
) {
4374 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
4378 printk(KERN_INFO
"SELinux: Initializing.\n");
4380 /* Set the security state for the initial task. */
4381 if (task_alloc_security(current
))
4382 panic("SELinux: Failed to initialize initial task.\n");
4383 tsec
= current
->security
;
4384 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
4388 original_ops
= secondary_ops
= security_ops
;
4390 panic ("SELinux: No initial security operations\n");
4391 if (register_security (&selinux_ops
))
4392 panic("SELinux: Unable to register with kernel.\n");
4394 if (selinux_enforcing
) {
4395 printk(KERN_INFO
"SELinux: Starting in enforcing mode\n");
4397 printk(KERN_INFO
"SELinux: Starting in permissive mode\n");
4402 void selinux_complete_init(void)
4404 printk(KERN_INFO
"SELinux: Completing initialization.\n");
4406 /* Set up any superblocks initialized prior to the policy load. */
4407 printk(KERN_INFO
"SELinux: Setting up existing superblocks.\n");
4408 spin_lock(&sb_security_lock
);
4410 if (!list_empty(&superblock_security_head
)) {
4411 struct superblock_security_struct
*sbsec
=
4412 list_entry(superblock_security_head
.next
,
4413 struct superblock_security_struct
,
4415 struct super_block
*sb
= sbsec
->sb
;
4416 spin_lock(&sb_lock
);
4418 spin_unlock(&sb_lock
);
4419 spin_unlock(&sb_security_lock
);
4420 down_read(&sb
->s_umount
);
4422 superblock_doinit(sb
, NULL
);
4424 spin_lock(&sb_security_lock
);
4425 list_del_init(&sbsec
->list
);
4428 spin_unlock(&sb_security_lock
);
4431 /* SELinux requires early initialization in order to label
4432 all processes and objects when they are created. */
4433 security_initcall(selinux_init
);
4435 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4437 static struct nf_hook_ops selinux_ipv4_op
= {
4438 .hook
= selinux_ipv4_postroute_last
,
4439 .owner
= THIS_MODULE
,
4441 .hooknum
= NF_IP_POST_ROUTING
,
4442 .priority
= NF_IP_PRI_SELINUX_LAST
,
4445 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4447 static struct nf_hook_ops selinux_ipv6_op
= {
4448 .hook
= selinux_ipv6_postroute_last
,
4449 .owner
= THIS_MODULE
,
4451 .hooknum
= NF_IP6_POST_ROUTING
,
4452 .priority
= NF_IP6_PRI_SELINUX_LAST
,
4457 static int __init
selinux_nf_ip_init(void)
4461 if (!selinux_enabled
)
4464 printk(KERN_INFO
"SELinux: Registering netfilter hooks\n");
4466 err
= nf_register_hook(&selinux_ipv4_op
);
4468 panic("SELinux: nf_register_hook for IPv4: error %d\n", err
);
4470 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4472 err
= nf_register_hook(&selinux_ipv6_op
);
4474 panic("SELinux: nf_register_hook for IPv6: error %d\n", err
);
4481 __initcall(selinux_nf_ip_init
);
4483 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4484 static void selinux_nf_ip_exit(void)
4486 printk(KERN_INFO
"SELinux: Unregistering netfilter hooks\n");
4488 nf_unregister_hook(&selinux_ipv4_op
);
4489 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4490 nf_unregister_hook(&selinux_ipv6_op
);
4495 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4497 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4498 #define selinux_nf_ip_exit()
4501 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4503 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4504 int selinux_disable(void)
4506 extern void exit_sel_fs(void);
4507 static int selinux_disabled
= 0;
4509 if (ss_initialized
) {
4510 /* Not permitted after initial policy load. */
4514 if (selinux_disabled
) {
4515 /* Only do this once. */
4519 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
4521 selinux_disabled
= 1;
4523 /* Reset security_ops to the secondary module, dummy or capability. */
4524 security_ops
= secondary_ops
;
4526 /* Unregister netfilter hooks. */
4527 selinux_nf_ip_exit();
4529 /* Unregister selinuxfs. */