]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...
[mirror_ubuntu-bionic-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
33 #include <linux/mm.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for sysctl_local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/dccp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h> /* for Unix socket types */
64 #include <net/af_unix.h> /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
67 #include <net/ipv6.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
74 #include <linux/mutex.h>
75
76 #include "avc.h"
77 #include "objsec.h"
78 #include "netif.h"
79 #include "xfrm.h"
80 #include "netlabel.h"
81
82 #define XATTR_SELINUX_SUFFIX "selinux"
83 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84
85 extern unsigned int policydb_loaded_version;
86 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
87 extern int selinux_compat_net;
88
89 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
90 int selinux_enforcing = 0;
91
92 static int __init enforcing_setup(char *str)
93 {
94 selinux_enforcing = simple_strtol(str,NULL,0);
95 return 1;
96 }
97 __setup("enforcing=", enforcing_setup);
98 #endif
99
100 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
101 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102
103 static int __init selinux_enabled_setup(char *str)
104 {
105 selinux_enabled = simple_strtol(str, NULL, 0);
106 return 1;
107 }
108 __setup("selinux=", selinux_enabled_setup);
109 #else
110 int selinux_enabled = 1;
111 #endif
112
113 /* Original (dummy) security module. */
114 static struct security_operations *original_ops = NULL;
115
116 /* Minimal support for a secondary security module,
117 just to allow the use of the dummy or capability modules.
118 The owlsm module can alternatively be used as a secondary
119 module as long as CONFIG_OWLSM_FD is not enabled. */
120 static struct security_operations *secondary_ops = NULL;
121
122 /* Lists of inode and superblock security structures initialized
123 before the policy was loaded. */
124 static LIST_HEAD(superblock_security_head);
125 static DEFINE_SPINLOCK(sb_security_lock);
126
127 static struct kmem_cache *sel_inode_cache;
128
129 /* Return security context for a given sid or just the context
130 length if the buffer is null or length is 0 */
131 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132 {
133 char *context;
134 unsigned len;
135 int rc;
136
137 rc = security_sid_to_context(sid, &context, &len);
138 if (rc)
139 return rc;
140
141 if (!buffer || !size)
142 goto getsecurity_exit;
143
144 if (size < len) {
145 len = -ERANGE;
146 goto getsecurity_exit;
147 }
148 memcpy(buffer, context, len);
149
150 getsecurity_exit:
151 kfree(context);
152 return len;
153 }
154
155 /* Allocate and free functions for each kind of security blob. */
156
157 static int task_alloc_security(struct task_struct *task)
158 {
159 struct task_security_struct *tsec;
160
161 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 if (!tsec)
163 return -ENOMEM;
164
165 tsec->task = task;
166 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
167 task->security = tsec;
168
169 return 0;
170 }
171
172 static void task_free_security(struct task_struct *task)
173 {
174 struct task_security_struct *tsec = task->security;
175 task->security = NULL;
176 kfree(tsec);
177 }
178
179 static int inode_alloc_security(struct inode *inode)
180 {
181 struct task_security_struct *tsec = current->security;
182 struct inode_security_struct *isec;
183
184 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
185 if (!isec)
186 return -ENOMEM;
187
188 mutex_init(&isec->lock);
189 INIT_LIST_HEAD(&isec->list);
190 isec->inode = inode;
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
195
196 return 0;
197 }
198
199 static void inode_free_security(struct inode *inode)
200 {
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
208
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
211 }
212
213 static int file_alloc_security(struct file *file)
214 {
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
217
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 if (!fsec)
220 return -ENOMEM;
221
222 fsec->file = file;
223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
225 file->f_security = fsec;
226
227 return 0;
228 }
229
230 static void file_free_security(struct file *file)
231 {
232 struct file_security_struct *fsec = file->f_security;
233 file->f_security = NULL;
234 kfree(fsec);
235 }
236
237 static int superblock_alloc_security(struct super_block *sb)
238 {
239 struct superblock_security_struct *sbsec;
240
241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 if (!sbsec)
243 return -ENOMEM;
244
245 mutex_init(&sbsec->lock);
246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
249 sbsec->sb = sb;
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
253 sb->s_security = sbsec;
254
255 return 0;
256 }
257
258 static void superblock_free_security(struct super_block *sb)
259 {
260 struct superblock_security_struct *sbsec = sb->s_security;
261
262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
266
267 sb->s_security = NULL;
268 kfree(sbsec);
269 }
270
271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
272 {
273 struct sk_security_struct *ssec;
274
275 ssec = kzalloc(sizeof(*ssec), priority);
276 if (!ssec)
277 return -ENOMEM;
278
279 ssec->sk = sk;
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
283
284 selinux_netlbl_sk_security_init(ssec, family);
285
286 return 0;
287 }
288
289 static void sk_free_security(struct sock *sk)
290 {
291 struct sk_security_struct *ssec = sk->sk_security;
292
293 sk->sk_security = NULL;
294 kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
323 Opt_rootcontext = 8,
324 };
325
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
331 };
332
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
334
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
338 {
339 int rc;
340
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
343 if (rc)
344 return rc;
345
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
348 return rc;
349 }
350
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
354 {
355 int rc;
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
358 if (rc)
359 return rc;
360
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
363 return rc;
364 }
365
366 static int try_context_mount(struct super_block *sb, void *data)
367 {
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
370 const char *name;
371 u32 sid;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
375
376 if (!data)
377 goto out;
378
379 name = sb->s_type->name;
380
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
382
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
386
387 if (d->version < NFS_MOUNT_VERSION)
388 goto out;
389
390 if (d->context[0]) {
391 context = d->context;
392 seen |= Opt_context;
393 }
394 } else
395 goto out;
396
397 } else {
398 /* Standard string-based options. */
399 char *p, *options = data;
400
401 while ((p = strsep(&options, "|")) != NULL) {
402 int token;
403 substring_t args[MAX_OPT_ARGS];
404
405 if (!*p)
406 continue;
407
408 token = match_token(p, tokens, args);
409
410 switch (token) {
411 case Opt_context:
412 if (seen & (Opt_context|Opt_defcontext)) {
413 rc = -EINVAL;
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
415 goto out_free;
416 }
417 context = match_strdup(&args[0]);
418 if (!context) {
419 rc = -ENOMEM;
420 goto out_free;
421 }
422 if (!alloc)
423 alloc = 1;
424 seen |= Opt_context;
425 break;
426
427 case Opt_fscontext:
428 if (seen & Opt_fscontext) {
429 rc = -EINVAL;
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
431 goto out_free;
432 }
433 fscontext = match_strdup(&args[0]);
434 if (!fscontext) {
435 rc = -ENOMEM;
436 goto out_free;
437 }
438 if (!alloc)
439 alloc = 1;
440 seen |= Opt_fscontext;
441 break;
442
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
445 rc = -EINVAL;
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
447 goto out_free;
448 }
449 rootcontext = match_strdup(&args[0]);
450 if (!rootcontext) {
451 rc = -ENOMEM;
452 goto out_free;
453 }
454 if (!alloc)
455 alloc = 1;
456 seen |= Opt_rootcontext;
457 break;
458
459 case Opt_defcontext:
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
461 rc = -EINVAL;
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
465 goto out_free;
466 }
467 if (seen & (Opt_context|Opt_defcontext)) {
468 rc = -EINVAL;
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
470 goto out_free;
471 }
472 defcontext = match_strdup(&args[0]);
473 if (!defcontext) {
474 rc = -ENOMEM;
475 goto out_free;
476 }
477 if (!alloc)
478 alloc = 1;
479 seen |= Opt_defcontext;
480 break;
481
482 default:
483 rc = -EINVAL;
484 printk(KERN_WARNING "SELinux: unknown mount "
485 "option\n");
486 goto out_free;
487
488 }
489 }
490 }
491
492 if (!seen)
493 goto out;
494
495 /* sets the context of the superblock for the fs being mounted. */
496 if (fscontext) {
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
498 if (rc) {
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
502 goto out_free;
503 }
504
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
506 if (rc)
507 goto out_free;
508
509 sbsec->sid = sid;
510 }
511
512 /*
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
516 */
517 if (context) {
518 rc = security_context_to_sid(context, strlen(context), &sid);
519 if (rc) {
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
523 goto out_free;
524 }
525
526 if (!fscontext) {
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
528 if (rc)
529 goto out_free;
530 sbsec->sid = sid;
531 } else {
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
533 if (rc)
534 goto out_free;
535 }
536 sbsec->mntpoint_sid = sid;
537
538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
539 }
540
541 if (rootcontext) {
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
545 if (rc) {
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
549 goto out_free;
550 }
551
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
553 if (rc)
554 goto out_free;
555
556 isec->sid = sid;
557 isec->initialized = 1;
558 }
559
560 if (defcontext) {
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
562 if (rc) {
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
566 goto out_free;
567 }
568
569 if (sid == sbsec->def_sid)
570 goto out_free;
571
572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
573 if (rc)
574 goto out_free;
575
576 sbsec->def_sid = sid;
577 }
578
579 out_free:
580 if (alloc) {
581 kfree(context);
582 kfree(defcontext);
583 kfree(fscontext);
584 kfree(rootcontext);
585 }
586 out:
587 return rc;
588 }
589
590 static int superblock_doinit(struct super_block *sb, void *data)
591 {
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
595 int rc = 0;
596
597 mutex_lock(&sbsec->lock);
598 if (sbsec->initialized)
599 goto out;
600
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
609 goto out;
610 }
611
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
614 if (rc) {
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
617 goto out;
618 }
619
620 rc = try_context_mount(sb, data);
621 if (rc)
622 goto out;
623
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
633 rc = -EOPNOTSUPP;
634 goto out;
635 }
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
642 else
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
646 goto out;
647 }
648 }
649
650 if (strcmp(sb->s_type->name, "proc") == 0)
651 sbsec->proc = 1;
652
653 sbsec->initialized = 1;
654
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
658 }
659 else {
660 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
663 }
664
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
667
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
671 populates itself. */
672 spin_lock(&sbsec->isec_lock);
673 next_inode:
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
681 if (inode) {
682 if (!IS_PRIVATE (inode))
683 inode_doinit(inode);
684 iput(inode);
685 }
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
688 goto next_inode;
689 }
690 spin_unlock(&sbsec->isec_lock);
691 out:
692 mutex_unlock(&sbsec->lock);
693 return rc;
694 }
695
696 static inline u16 inode_mode_to_security_class(umode_t mode)
697 {
698 switch (mode & S_IFMT) {
699 case S_IFSOCK:
700 return SECCLASS_SOCK_FILE;
701 case S_IFLNK:
702 return SECCLASS_LNK_FILE;
703 case S_IFREG:
704 return SECCLASS_FILE;
705 case S_IFBLK:
706 return SECCLASS_BLK_FILE;
707 case S_IFDIR:
708 return SECCLASS_DIR;
709 case S_IFCHR:
710 return SECCLASS_CHR_FILE;
711 case S_IFIFO:
712 return SECCLASS_FIFO_FILE;
713
714 }
715
716 return SECCLASS_FILE;
717 }
718
719 static inline int default_protocol_stream(int protocol)
720 {
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
722 }
723
724 static inline int default_protocol_dgram(int protocol)
725 {
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
727 }
728
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
730 {
731 switch (family) {
732 case PF_UNIX:
733 switch (type) {
734 case SOCK_STREAM:
735 case SOCK_SEQPACKET:
736 return SECCLASS_UNIX_STREAM_SOCKET;
737 case SOCK_DGRAM:
738 return SECCLASS_UNIX_DGRAM_SOCKET;
739 }
740 break;
741 case PF_INET:
742 case PF_INET6:
743 switch (type) {
744 case SOCK_STREAM:
745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
747 else
748 return SECCLASS_RAWIP_SOCKET;
749 case SOCK_DGRAM:
750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
752 else
753 return SECCLASS_RAWIP_SOCKET;
754 case SOCK_DCCP:
755 return SECCLASS_DCCP_SOCKET;
756 default:
757 return SECCLASS_RAWIP_SOCKET;
758 }
759 break;
760 case PF_NETLINK:
761 switch (protocol) {
762 case NETLINK_ROUTE:
763 return SECCLASS_NETLINK_ROUTE_SOCKET;
764 case NETLINK_FIREWALL:
765 return SECCLASS_NETLINK_FIREWALL_SOCKET;
766 case NETLINK_INET_DIAG:
767 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
768 case NETLINK_NFLOG:
769 return SECCLASS_NETLINK_NFLOG_SOCKET;
770 case NETLINK_XFRM:
771 return SECCLASS_NETLINK_XFRM_SOCKET;
772 case NETLINK_SELINUX:
773 return SECCLASS_NETLINK_SELINUX_SOCKET;
774 case NETLINK_AUDIT:
775 return SECCLASS_NETLINK_AUDIT_SOCKET;
776 case NETLINK_IP6_FW:
777 return SECCLASS_NETLINK_IP6FW_SOCKET;
778 case NETLINK_DNRTMSG:
779 return SECCLASS_NETLINK_DNRT_SOCKET;
780 case NETLINK_KOBJECT_UEVENT:
781 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
782 default:
783 return SECCLASS_NETLINK_SOCKET;
784 }
785 case PF_PACKET:
786 return SECCLASS_PACKET_SOCKET;
787 case PF_KEY:
788 return SECCLASS_KEY_SOCKET;
789 case PF_APPLETALK:
790 return SECCLASS_APPLETALK_SOCKET;
791 }
792
793 return SECCLASS_SOCKET;
794 }
795
796 #ifdef CONFIG_PROC_FS
797 static int selinux_proc_get_sid(struct proc_dir_entry *de,
798 u16 tclass,
799 u32 *sid)
800 {
801 int buflen, rc;
802 char *buffer, *path, *end;
803
804 buffer = (char*)__get_free_page(GFP_KERNEL);
805 if (!buffer)
806 return -ENOMEM;
807
808 buflen = PAGE_SIZE;
809 end = buffer+buflen;
810 *--end = '\0';
811 buflen--;
812 path = end-1;
813 *path = '/';
814 while (de && de != de->parent) {
815 buflen -= de->namelen + 1;
816 if (buflen < 0)
817 break;
818 end -= de->namelen;
819 memcpy(end, de->name, de->namelen);
820 *--end = '/';
821 path = end;
822 de = de->parent;
823 }
824 rc = security_genfs_sid("proc", path, tclass, sid);
825 free_page((unsigned long)buffer);
826 return rc;
827 }
828 #else
829 static int selinux_proc_get_sid(struct proc_dir_entry *de,
830 u16 tclass,
831 u32 *sid)
832 {
833 return -EINVAL;
834 }
835 #endif
836
837 /* The inode's security attributes must be initialized before first use. */
838 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
839 {
840 struct superblock_security_struct *sbsec = NULL;
841 struct inode_security_struct *isec = inode->i_security;
842 u32 sid;
843 struct dentry *dentry;
844 #define INITCONTEXTLEN 255
845 char *context = NULL;
846 unsigned len = 0;
847 int rc = 0;
848
849 if (isec->initialized)
850 goto out;
851
852 mutex_lock(&isec->lock);
853 if (isec->initialized)
854 goto out_unlock;
855
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
865 goto out_unlock;
866 }
867
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
872 break;
873 }
874
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
877 if (opt_dentry) {
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
880 } else {
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
883 }
884 if (!dentry) {
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
887 inode->i_ino);
888 goto out_unlock;
889 }
890
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
893 if (!context) {
894 rc = -ENOMEM;
895 dput(dentry);
896 goto out_unlock;
897 }
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
899 context, len);
900 if (rc == -ERANGE) {
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
903 NULL, 0);
904 if (rc < 0) {
905 dput(dentry);
906 goto out_unlock;
907 }
908 kfree(context);
909 len = rc;
910 context = kmalloc(len, GFP_KERNEL);
911 if (!context) {
912 rc = -ENOMEM;
913 dput(dentry);
914 goto out_unlock;
915 }
916 rc = inode->i_op->getxattr(dentry,
917 XATTR_NAME_SELINUX,
918 context, len);
919 }
920 dput(dentry);
921 if (rc < 0) {
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
926 kfree(context);
927 goto out_unlock;
928 }
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
931 rc = 0;
932 } else {
933 rc = security_context_to_sid_default(context, rc, &sid,
934 sbsec->def_sid);
935 if (rc) {
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
940 kfree(context);
941 /* Leave with the unlabeled SID */
942 rc = 0;
943 break;
944 }
945 }
946 kfree(context);
947 isec->sid = sid;
948 break;
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
951 break;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
955
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
959 sbsec->sid,
960 isec->sclass,
961 &sid);
962 if (rc)
963 goto out_unlock;
964 isec->sid = sid;
965 break;
966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
968 break;
969 default:
970 /* Default to the fs superblock SID. */
971 isec->sid = sbsec->sid;
972
973 if (sbsec->proc) {
974 struct proc_inode *proci = PROC_I(inode);
975 if (proci->pde) {
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
978 isec->sclass,
979 &sid);
980 if (rc)
981 goto out_unlock;
982 isec->sid = sid;
983 }
984 }
985 break;
986 }
987
988 isec->initialized = 1;
989
990 out_unlock:
991 mutex_unlock(&isec->lock);
992 out:
993 if (isec->sclass == SECCLASS_FILE)
994 isec->sclass = inode_mode_to_security_class(inode->i_mode);
995 return rc;
996 }
997
998 /* Convert a Linux signal to an access vector. */
999 static inline u32 signal_to_av(int sig)
1000 {
1001 u32 perm = 0;
1002
1003 switch (sig) {
1004 case SIGCHLD:
1005 /* Commonly granted from child to parent. */
1006 perm = PROCESS__SIGCHLD;
1007 break;
1008 case SIGKILL:
1009 /* Cannot be caught or ignored */
1010 perm = PROCESS__SIGKILL;
1011 break;
1012 case SIGSTOP:
1013 /* Cannot be caught or ignored */
1014 perm = PROCESS__SIGSTOP;
1015 break;
1016 default:
1017 /* All other signals. */
1018 perm = PROCESS__SIGNAL;
1019 break;
1020 }
1021
1022 return perm;
1023 }
1024
1025 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1026 fork check, ptrace check, etc. */
1027 static int task_has_perm(struct task_struct *tsk1,
1028 struct task_struct *tsk2,
1029 u32 perms)
1030 {
1031 struct task_security_struct *tsec1, *tsec2;
1032
1033 tsec1 = tsk1->security;
1034 tsec2 = tsk2->security;
1035 return avc_has_perm(tsec1->sid, tsec2->sid,
1036 SECCLASS_PROCESS, perms, NULL);
1037 }
1038
1039 /* Check whether a task is allowed to use a capability. */
1040 static int task_has_capability(struct task_struct *tsk,
1041 int cap)
1042 {
1043 struct task_security_struct *tsec;
1044 struct avc_audit_data ad;
1045
1046 tsec = tsk->security;
1047
1048 AVC_AUDIT_DATA_INIT(&ad,CAP);
1049 ad.tsk = tsk;
1050 ad.u.cap = cap;
1051
1052 return avc_has_perm(tsec->sid, tsec->sid,
1053 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1054 }
1055
1056 /* Check whether a task is allowed to use a system operation. */
1057 static int task_has_system(struct task_struct *tsk,
1058 u32 perms)
1059 {
1060 struct task_security_struct *tsec;
1061
1062 tsec = tsk->security;
1063
1064 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1065 SECCLASS_SYSTEM, perms, NULL);
1066 }
1067
1068 /* Check whether a task has a particular permission to an inode.
1069 The 'adp' parameter is optional and allows other audit
1070 data to be passed (e.g. the dentry). */
1071 static int inode_has_perm(struct task_struct *tsk,
1072 struct inode *inode,
1073 u32 perms,
1074 struct avc_audit_data *adp)
1075 {
1076 struct task_security_struct *tsec;
1077 struct inode_security_struct *isec;
1078 struct avc_audit_data ad;
1079
1080 if (unlikely (IS_PRIVATE (inode)))
1081 return 0;
1082
1083 tsec = tsk->security;
1084 isec = inode->i_security;
1085
1086 if (!adp) {
1087 adp = &ad;
1088 AVC_AUDIT_DATA_INIT(&ad, FS);
1089 ad.u.fs.inode = inode;
1090 }
1091
1092 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 }
1094
1095 /* Same as inode_has_perm, but pass explicit audit data containing
1096 the dentry to help the auditing code to more easily generate the
1097 pathname if needed. */
1098 static inline int dentry_has_perm(struct task_struct *tsk,
1099 struct vfsmount *mnt,
1100 struct dentry *dentry,
1101 u32 av)
1102 {
1103 struct inode *inode = dentry->d_inode;
1104 struct avc_audit_data ad;
1105 AVC_AUDIT_DATA_INIT(&ad,FS);
1106 ad.u.fs.mnt = mnt;
1107 ad.u.fs.dentry = dentry;
1108 return inode_has_perm(tsk, inode, av, &ad);
1109 }
1110
1111 /* Check whether a task can use an open file descriptor to
1112 access an inode in a given way. Check access to the
1113 descriptor itself, and then use dentry_has_perm to
1114 check a particular permission to the file.
1115 Access to the descriptor is implicitly granted if it
1116 has the same SID as the process. If av is zero, then
1117 access to the file is not checked, e.g. for cases
1118 where only the descriptor is affected like seek. */
1119 static int file_has_perm(struct task_struct *tsk,
1120 struct file *file,
1121 u32 av)
1122 {
1123 struct task_security_struct *tsec = tsk->security;
1124 struct file_security_struct *fsec = file->f_security;
1125 struct vfsmount *mnt = file->f_path.mnt;
1126 struct dentry *dentry = file->f_path.dentry;
1127 struct inode *inode = dentry->d_inode;
1128 struct avc_audit_data ad;
1129 int rc;
1130
1131 AVC_AUDIT_DATA_INIT(&ad, FS);
1132 ad.u.fs.mnt = mnt;
1133 ad.u.fs.dentry = dentry;
1134
1135 if (tsec->sid != fsec->sid) {
1136 rc = avc_has_perm(tsec->sid, fsec->sid,
1137 SECCLASS_FD,
1138 FD__USE,
1139 &ad);
1140 if (rc)
1141 return rc;
1142 }
1143
1144 /* av is zero if only checking access to the descriptor. */
1145 if (av)
1146 return inode_has_perm(tsk, inode, av, &ad);
1147
1148 return 0;
1149 }
1150
1151 /* Check whether a task can create a file. */
1152 static int may_create(struct inode *dir,
1153 struct dentry *dentry,
1154 u16 tclass)
1155 {
1156 struct task_security_struct *tsec;
1157 struct inode_security_struct *dsec;
1158 struct superblock_security_struct *sbsec;
1159 u32 newsid;
1160 struct avc_audit_data ad;
1161 int rc;
1162
1163 tsec = current->security;
1164 dsec = dir->i_security;
1165 sbsec = dir->i_sb->s_security;
1166
1167 AVC_AUDIT_DATA_INIT(&ad, FS);
1168 ad.u.fs.dentry = dentry;
1169
1170 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1171 DIR__ADD_NAME | DIR__SEARCH,
1172 &ad);
1173 if (rc)
1174 return rc;
1175
1176 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1177 newsid = tsec->create_sid;
1178 } else {
1179 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1180 &newsid);
1181 if (rc)
1182 return rc;
1183 }
1184
1185 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1186 if (rc)
1187 return rc;
1188
1189 return avc_has_perm(newsid, sbsec->sid,
1190 SECCLASS_FILESYSTEM,
1191 FILESYSTEM__ASSOCIATE, &ad);
1192 }
1193
1194 /* Check whether a task can create a key. */
1195 static int may_create_key(u32 ksid,
1196 struct task_struct *ctx)
1197 {
1198 struct task_security_struct *tsec;
1199
1200 tsec = ctx->security;
1201
1202 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1203 }
1204
1205 #define MAY_LINK 0
1206 #define MAY_UNLINK 1
1207 #define MAY_RMDIR 2
1208
1209 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1210 static int may_link(struct inode *dir,
1211 struct dentry *dentry,
1212 int kind)
1213
1214 {
1215 struct task_security_struct *tsec;
1216 struct inode_security_struct *dsec, *isec;
1217 struct avc_audit_data ad;
1218 u32 av;
1219 int rc;
1220
1221 tsec = current->security;
1222 dsec = dir->i_security;
1223 isec = dentry->d_inode->i_security;
1224
1225 AVC_AUDIT_DATA_INIT(&ad, FS);
1226 ad.u.fs.dentry = dentry;
1227
1228 av = DIR__SEARCH;
1229 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1230 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1231 if (rc)
1232 return rc;
1233
1234 switch (kind) {
1235 case MAY_LINK:
1236 av = FILE__LINK;
1237 break;
1238 case MAY_UNLINK:
1239 av = FILE__UNLINK;
1240 break;
1241 case MAY_RMDIR:
1242 av = DIR__RMDIR;
1243 break;
1244 default:
1245 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1246 return 0;
1247 }
1248
1249 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1250 return rc;
1251 }
1252
1253 static inline int may_rename(struct inode *old_dir,
1254 struct dentry *old_dentry,
1255 struct inode *new_dir,
1256 struct dentry *new_dentry)
1257 {
1258 struct task_security_struct *tsec;
1259 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1260 struct avc_audit_data ad;
1261 u32 av;
1262 int old_is_dir, new_is_dir;
1263 int rc;
1264
1265 tsec = current->security;
1266 old_dsec = old_dir->i_security;
1267 old_isec = old_dentry->d_inode->i_security;
1268 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1269 new_dsec = new_dir->i_security;
1270
1271 AVC_AUDIT_DATA_INIT(&ad, FS);
1272
1273 ad.u.fs.dentry = old_dentry;
1274 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1275 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276 if (rc)
1277 return rc;
1278 rc = avc_has_perm(tsec->sid, old_isec->sid,
1279 old_isec->sclass, FILE__RENAME, &ad);
1280 if (rc)
1281 return rc;
1282 if (old_is_dir && new_dir != old_dir) {
1283 rc = avc_has_perm(tsec->sid, old_isec->sid,
1284 old_isec->sclass, DIR__REPARENT, &ad);
1285 if (rc)
1286 return rc;
1287 }
1288
1289 ad.u.fs.dentry = new_dentry;
1290 av = DIR__ADD_NAME | DIR__SEARCH;
1291 if (new_dentry->d_inode)
1292 av |= DIR__REMOVE_NAME;
1293 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294 if (rc)
1295 return rc;
1296 if (new_dentry->d_inode) {
1297 new_isec = new_dentry->d_inode->i_security;
1298 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1299 rc = avc_has_perm(tsec->sid, new_isec->sid,
1300 new_isec->sclass,
1301 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1302 if (rc)
1303 return rc;
1304 }
1305
1306 return 0;
1307 }
1308
1309 /* Check whether a task can perform a filesystem operation. */
1310 static int superblock_has_perm(struct task_struct *tsk,
1311 struct super_block *sb,
1312 u32 perms,
1313 struct avc_audit_data *ad)
1314 {
1315 struct task_security_struct *tsec;
1316 struct superblock_security_struct *sbsec;
1317
1318 tsec = tsk->security;
1319 sbsec = sb->s_security;
1320 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1321 perms, ad);
1322 }
1323
1324 /* Convert a Linux mode and permission mask to an access vector. */
1325 static inline u32 file_mask_to_av(int mode, int mask)
1326 {
1327 u32 av = 0;
1328
1329 if ((mode & S_IFMT) != S_IFDIR) {
1330 if (mask & MAY_EXEC)
1331 av |= FILE__EXECUTE;
1332 if (mask & MAY_READ)
1333 av |= FILE__READ;
1334
1335 if (mask & MAY_APPEND)
1336 av |= FILE__APPEND;
1337 else if (mask & MAY_WRITE)
1338 av |= FILE__WRITE;
1339
1340 } else {
1341 if (mask & MAY_EXEC)
1342 av |= DIR__SEARCH;
1343 if (mask & MAY_WRITE)
1344 av |= DIR__WRITE;
1345 if (mask & MAY_READ)
1346 av |= DIR__READ;
1347 }
1348
1349 return av;
1350 }
1351
1352 /* Convert a Linux file to an access vector. */
1353 static inline u32 file_to_av(struct file *file)
1354 {
1355 u32 av = 0;
1356
1357 if (file->f_mode & FMODE_READ)
1358 av |= FILE__READ;
1359 if (file->f_mode & FMODE_WRITE) {
1360 if (file->f_flags & O_APPEND)
1361 av |= FILE__APPEND;
1362 else
1363 av |= FILE__WRITE;
1364 }
1365
1366 return av;
1367 }
1368
1369 /* Hook functions begin here. */
1370
1371 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1372 {
1373 struct task_security_struct *psec = parent->security;
1374 struct task_security_struct *csec = child->security;
1375 int rc;
1376
1377 rc = secondary_ops->ptrace(parent,child);
1378 if (rc)
1379 return rc;
1380
1381 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1382 /* Save the SID of the tracing process for later use in apply_creds. */
1383 if (!(child->ptrace & PT_PTRACED) && !rc)
1384 csec->ptrace_sid = psec->sid;
1385 return rc;
1386 }
1387
1388 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1389 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391 int error;
1392
1393 error = task_has_perm(current, target, PROCESS__GETCAP);
1394 if (error)
1395 return error;
1396
1397 return secondary_ops->capget(target, effective, inheritable, permitted);
1398 }
1399
1400 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1401 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1402 {
1403 int error;
1404
1405 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1406 if (error)
1407 return error;
1408
1409 return task_has_perm(current, target, PROCESS__SETCAP);
1410 }
1411
1412 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1413 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1414 {
1415 secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 }
1417
1418 static int selinux_capable(struct task_struct *tsk, int cap)
1419 {
1420 int rc;
1421
1422 rc = secondary_ops->capable(tsk, cap);
1423 if (rc)
1424 return rc;
1425
1426 return task_has_capability(tsk,cap);
1427 }
1428
1429 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1430 {
1431 int buflen, rc;
1432 char *buffer, *path, *end;
1433
1434 rc = -ENOMEM;
1435 buffer = (char*)__get_free_page(GFP_KERNEL);
1436 if (!buffer)
1437 goto out;
1438
1439 buflen = PAGE_SIZE;
1440 end = buffer+buflen;
1441 *--end = '\0';
1442 buflen--;
1443 path = end-1;
1444 *path = '/';
1445 while (table) {
1446 const char *name = table->procname;
1447 size_t namelen = strlen(name);
1448 buflen -= namelen + 1;
1449 if (buflen < 0)
1450 goto out_free;
1451 end -= namelen;
1452 memcpy(end, name, namelen);
1453 *--end = '/';
1454 path = end;
1455 table = table->parent;
1456 }
1457 buflen -= 4;
1458 if (buflen < 0)
1459 goto out_free;
1460 end -= 4;
1461 memcpy(end, "/sys", 4);
1462 path = end;
1463 rc = security_genfs_sid("proc", path, tclass, sid);
1464 out_free:
1465 free_page((unsigned long)buffer);
1466 out:
1467 return rc;
1468 }
1469
1470 static int selinux_sysctl(ctl_table *table, int op)
1471 {
1472 int error = 0;
1473 u32 av;
1474 struct task_security_struct *tsec;
1475 u32 tsid;
1476 int rc;
1477
1478 rc = secondary_ops->sysctl(table, op);
1479 if (rc)
1480 return rc;
1481
1482 tsec = current->security;
1483
1484 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1485 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1486 if (rc) {
1487 /* Default to the well-defined sysctl SID. */
1488 tsid = SECINITSID_SYSCTL;
1489 }
1490
1491 /* The op values are "defined" in sysctl.c, thereby creating
1492 * a bad coupling between this module and sysctl.c */
1493 if(op == 001) {
1494 error = avc_has_perm(tsec->sid, tsid,
1495 SECCLASS_DIR, DIR__SEARCH, NULL);
1496 } else {
1497 av = 0;
1498 if (op & 004)
1499 av |= FILE__READ;
1500 if (op & 002)
1501 av |= FILE__WRITE;
1502 if (av)
1503 error = avc_has_perm(tsec->sid, tsid,
1504 SECCLASS_FILE, av, NULL);
1505 }
1506
1507 return error;
1508 }
1509
1510 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1511 {
1512 int rc = 0;
1513
1514 if (!sb)
1515 return 0;
1516
1517 switch (cmds) {
1518 case Q_SYNC:
1519 case Q_QUOTAON:
1520 case Q_QUOTAOFF:
1521 case Q_SETINFO:
1522 case Q_SETQUOTA:
1523 rc = superblock_has_perm(current,
1524 sb,
1525 FILESYSTEM__QUOTAMOD, NULL);
1526 break;
1527 case Q_GETFMT:
1528 case Q_GETINFO:
1529 case Q_GETQUOTA:
1530 rc = superblock_has_perm(current,
1531 sb,
1532 FILESYSTEM__QUOTAGET, NULL);
1533 break;
1534 default:
1535 rc = 0; /* let the kernel handle invalid cmds */
1536 break;
1537 }
1538 return rc;
1539 }
1540
1541 static int selinux_quota_on(struct dentry *dentry)
1542 {
1543 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1544 }
1545
1546 static int selinux_syslog(int type)
1547 {
1548 int rc;
1549
1550 rc = secondary_ops->syslog(type);
1551 if (rc)
1552 return rc;
1553
1554 switch (type) {
1555 case 3: /* Read last kernel messages */
1556 case 10: /* Return size of the log buffer */
1557 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1558 break;
1559 case 6: /* Disable logging to console */
1560 case 7: /* Enable logging to console */
1561 case 8: /* Set level of messages printed to console */
1562 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1563 break;
1564 case 0: /* Close log */
1565 case 1: /* Open log */
1566 case 2: /* Read from log */
1567 case 4: /* Read/clear last kernel messages */
1568 case 5: /* Clear ring buffer */
1569 default:
1570 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1571 break;
1572 }
1573 return rc;
1574 }
1575
1576 /*
1577 * Check that a process has enough memory to allocate a new virtual
1578 * mapping. 0 means there is enough memory for the allocation to
1579 * succeed and -ENOMEM implies there is not.
1580 *
1581 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1582 * if the capability is granted, but __vm_enough_memory requires 1 if
1583 * the capability is granted.
1584 *
1585 * Do not audit the selinux permission check, as this is applied to all
1586 * processes that allocate mappings.
1587 */
1588 static int selinux_vm_enough_memory(long pages)
1589 {
1590 int rc, cap_sys_admin = 0;
1591 struct task_security_struct *tsec = current->security;
1592
1593 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1594 if (rc == 0)
1595 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1596 SECCLASS_CAPABILITY,
1597 CAP_TO_MASK(CAP_SYS_ADMIN),
1598 NULL);
1599
1600 if (rc == 0)
1601 cap_sys_admin = 1;
1602
1603 return __vm_enough_memory(pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610 struct bprm_security_struct *bsec;
1611
1612 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613 if (!bsec)
1614 return -ENOMEM;
1615
1616 bsec->bprm = bprm;
1617 bsec->sid = SECINITSID_UNLABELED;
1618 bsec->set = 0;
1619
1620 bprm->security = bsec;
1621 return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626 struct task_security_struct *tsec;
1627 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628 struct inode_security_struct *isec;
1629 struct bprm_security_struct *bsec;
1630 u32 newsid;
1631 struct avc_audit_data ad;
1632 int rc;
1633
1634 rc = secondary_ops->bprm_set_security(bprm);
1635 if (rc)
1636 return rc;
1637
1638 bsec = bprm->security;
1639
1640 if (bsec->set)
1641 return 0;
1642
1643 tsec = current->security;
1644 isec = inode->i_security;
1645
1646 /* Default to the current task SID. */
1647 bsec->sid = tsec->sid;
1648
1649 /* Reset fs, key, and sock SIDs on execve. */
1650 tsec->create_sid = 0;
1651 tsec->keycreate_sid = 0;
1652 tsec->sockcreate_sid = 0;
1653
1654 if (tsec->exec_sid) {
1655 newsid = tsec->exec_sid;
1656 /* Reset exec SID on execve. */
1657 tsec->exec_sid = 0;
1658 } else {
1659 /* Check for a default transition on this program. */
1660 rc = security_transition_sid(tsec->sid, isec->sid,
1661 SECCLASS_PROCESS, &newsid);
1662 if (rc)
1663 return rc;
1664 }
1665
1666 AVC_AUDIT_DATA_INIT(&ad, FS);
1667 ad.u.fs.mnt = bprm->file->f_path.mnt;
1668 ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671 newsid = tsec->sid;
1672
1673 if (tsec->sid == newsid) {
1674 rc = avc_has_perm(tsec->sid, isec->sid,
1675 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676 if (rc)
1677 return rc;
1678 } else {
1679 /* Check permissions for the transition. */
1680 rc = avc_has_perm(tsec->sid, newsid,
1681 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682 if (rc)
1683 return rc;
1684
1685 rc = avc_has_perm(newsid, isec->sid,
1686 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687 if (rc)
1688 return rc;
1689
1690 /* Clear any possibly unsafe personality bits on exec: */
1691 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693 /* Set the security field to the new SID. */
1694 bsec->sid = newsid;
1695 }
1696
1697 bsec->set = 1;
1698 return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703 return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709 struct task_security_struct *tsec = current->security;
1710 int atsecure = 0;
1711
1712 if (tsec->osid != tsec->sid) {
1713 /* Enable secure mode for SIDs transitions unless
1714 the noatsecure permission is granted between
1715 the two SIDs, i.e. ahp returns 0. */
1716 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717 SECCLASS_PROCESS,
1718 PROCESS__NOATSECURE, NULL);
1719 }
1720
1721 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726 kfree(bprm->security);
1727 bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736 struct avc_audit_data ad;
1737 struct file *file, *devnull = NULL;
1738 struct tty_struct *tty;
1739 struct fdtable *fdt;
1740 long j = -1;
1741 int drop_tty = 0;
1742
1743 mutex_lock(&tty_mutex);
1744 tty = get_current_tty();
1745 if (tty) {
1746 file_list_lock();
1747 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748 if (file) {
1749 /* Revalidate access to controlling tty.
1750 Use inode_has_perm on the tty inode directly rather
1751 than using file_has_perm, as this particular open
1752 file may belong to another process and we are only
1753 interested in the inode-based check here. */
1754 struct inode *inode = file->f_path.dentry->d_inode;
1755 if (inode_has_perm(current, inode,
1756 FILE__READ | FILE__WRITE, NULL)) {
1757 drop_tty = 1;
1758 }
1759 }
1760 file_list_unlock();
1761
1762 /* Reset controlling tty. */
1763 if (drop_tty)
1764 proc_set_tty(current, NULL);
1765 }
1766 mutex_unlock(&tty_mutex);
1767
1768 /* Revalidate access to inherited open files. */
1769
1770 AVC_AUDIT_DATA_INIT(&ad,FS);
1771
1772 spin_lock(&files->file_lock);
1773 for (;;) {
1774 unsigned long set, i;
1775 int fd;
1776
1777 j++;
1778 i = j * __NFDBITS;
1779 fdt = files_fdtable(files);
1780 if (i >= fdt->max_fds)
1781 break;
1782 set = fdt->open_fds->fds_bits[j];
1783 if (!set)
1784 continue;
1785 spin_unlock(&files->file_lock);
1786 for ( ; set ; i++,set >>= 1) {
1787 if (set & 1) {
1788 file = fget(i);
1789 if (!file)
1790 continue;
1791 if (file_has_perm(current,
1792 file,
1793 file_to_av(file))) {
1794 sys_close(i);
1795 fd = get_unused_fd();
1796 if (fd != i) {
1797 if (fd >= 0)
1798 put_unused_fd(fd);
1799 fput(file);
1800 continue;
1801 }
1802 if (devnull) {
1803 get_file(devnull);
1804 } else {
1805 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1806 if (IS_ERR(devnull)) {
1807 devnull = NULL;
1808 put_unused_fd(fd);
1809 fput(file);
1810 continue;
1811 }
1812 }
1813 fd_install(fd, devnull);
1814 }
1815 fput(file);
1816 }
1817 }
1818 spin_lock(&files->file_lock);
1819
1820 }
1821 spin_unlock(&files->file_lock);
1822 }
1823
1824 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1825 {
1826 struct task_security_struct *tsec;
1827 struct bprm_security_struct *bsec;
1828 u32 sid;
1829 int rc;
1830
1831 secondary_ops->bprm_apply_creds(bprm, unsafe);
1832
1833 tsec = current->security;
1834
1835 bsec = bprm->security;
1836 sid = bsec->sid;
1837
1838 tsec->osid = tsec->sid;
1839 bsec->unsafe = 0;
1840 if (tsec->sid != sid) {
1841 /* Check for shared state. If not ok, leave SID
1842 unchanged and kill. */
1843 if (unsafe & LSM_UNSAFE_SHARE) {
1844 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1845 PROCESS__SHARE, NULL);
1846 if (rc) {
1847 bsec->unsafe = 1;
1848 return;
1849 }
1850 }
1851
1852 /* Check for ptracing, and update the task SID if ok.
1853 Otherwise, leave SID unchanged and kill. */
1854 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1855 rc = avc_has_perm(tsec->ptrace_sid, sid,
1856 SECCLASS_PROCESS, PROCESS__PTRACE,
1857 NULL);
1858 if (rc) {
1859 bsec->unsafe = 1;
1860 return;
1861 }
1862 }
1863 tsec->sid = sid;
1864 }
1865 }
1866
1867 /*
1868 * called after apply_creds without the task lock held
1869 */
1870 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1871 {
1872 struct task_security_struct *tsec;
1873 struct rlimit *rlim, *initrlim;
1874 struct itimerval itimer;
1875 struct bprm_security_struct *bsec;
1876 int rc, i;
1877
1878 tsec = current->security;
1879 bsec = bprm->security;
1880
1881 if (bsec->unsafe) {
1882 force_sig_specific(SIGKILL, current);
1883 return;
1884 }
1885 if (tsec->osid == tsec->sid)
1886 return;
1887
1888 /* Close files for which the new task SID is not authorized. */
1889 flush_unauthorized_files(current->files);
1890
1891 /* Check whether the new SID can inherit signal state
1892 from the old SID. If not, clear itimers to avoid
1893 subsequent signal generation and flush and unblock
1894 signals. This must occur _after_ the task SID has
1895 been updated so that any kill done after the flush
1896 will be checked against the new SID. */
1897 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1898 PROCESS__SIGINH, NULL);
1899 if (rc) {
1900 memset(&itimer, 0, sizeof itimer);
1901 for (i = 0; i < 3; i++)
1902 do_setitimer(i, &itimer, NULL);
1903 flush_signals(current);
1904 spin_lock_irq(&current->sighand->siglock);
1905 flush_signal_handlers(current, 1);
1906 sigemptyset(&current->blocked);
1907 recalc_sigpending();
1908 spin_unlock_irq(&current->sighand->siglock);
1909 }
1910
1911 /* Check whether the new SID can inherit resource limits
1912 from the old SID. If not, reset all soft limits to
1913 the lower of the current task's hard limit and the init
1914 task's soft limit. Note that the setting of hard limits
1915 (even to lower them) can be controlled by the setrlimit
1916 check. The inclusion of the init task's soft limit into
1917 the computation is to avoid resetting soft limits higher
1918 than the default soft limit for cases where the default
1919 is lower than the hard limit, e.g. RLIMIT_CORE or
1920 RLIMIT_STACK.*/
1921 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1922 PROCESS__RLIMITINH, NULL);
1923 if (rc) {
1924 for (i = 0; i < RLIM_NLIMITS; i++) {
1925 rlim = current->signal->rlim + i;
1926 initrlim = init_task.signal->rlim+i;
1927 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1928 }
1929 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1930 /*
1931 * This will cause RLIMIT_CPU calculations
1932 * to be refigured.
1933 */
1934 current->it_prof_expires = jiffies_to_cputime(1);
1935 }
1936 }
1937
1938 /* Wake up the parent if it is waiting so that it can
1939 recheck wait permission to the new task SID. */
1940 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1941 }
1942
1943 /* superblock security operations */
1944
1945 static int selinux_sb_alloc_security(struct super_block *sb)
1946 {
1947 return superblock_alloc_security(sb);
1948 }
1949
1950 static void selinux_sb_free_security(struct super_block *sb)
1951 {
1952 superblock_free_security(sb);
1953 }
1954
1955 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1956 {
1957 if (plen > olen)
1958 return 0;
1959
1960 return !memcmp(prefix, option, plen);
1961 }
1962
1963 static inline int selinux_option(char *option, int len)
1964 {
1965 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1966 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1967 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1968 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1969 }
1970
1971 static inline void take_option(char **to, char *from, int *first, int len)
1972 {
1973 if (!*first) {
1974 **to = ',';
1975 *to += 1;
1976 } else
1977 *first = 0;
1978 memcpy(*to, from, len);
1979 *to += len;
1980 }
1981
1982 static inline void take_selinux_option(char **to, char *from, int *first,
1983 int len)
1984 {
1985 int current_size = 0;
1986
1987 if (!*first) {
1988 **to = '|';
1989 *to += 1;
1990 }
1991 else
1992 *first = 0;
1993
1994 while (current_size < len) {
1995 if (*from != '"') {
1996 **to = *from;
1997 *to += 1;
1998 }
1999 from += 1;
2000 current_size += 1;
2001 }
2002 }
2003
2004 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2005 {
2006 int fnosec, fsec, rc = 0;
2007 char *in_save, *in_curr, *in_end;
2008 char *sec_curr, *nosec_save, *nosec;
2009 int open_quote = 0;
2010
2011 in_curr = orig;
2012 sec_curr = copy;
2013
2014 /* Binary mount data: just copy */
2015 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2016 copy_page(sec_curr, in_curr);
2017 goto out;
2018 }
2019
2020 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2021 if (!nosec) {
2022 rc = -ENOMEM;
2023 goto out;
2024 }
2025
2026 nosec_save = nosec;
2027 fnosec = fsec = 1;
2028 in_save = in_end = orig;
2029
2030 do {
2031 if (*in_end == '"')
2032 open_quote = !open_quote;
2033 if ((*in_end == ',' && open_quote == 0) ||
2034 *in_end == '\0') {
2035 int len = in_end - in_curr;
2036
2037 if (selinux_option(in_curr, len))
2038 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2039 else
2040 take_option(&nosec, in_curr, &fnosec, len);
2041
2042 in_curr = in_end + 1;
2043 }
2044 } while (*in_end++);
2045
2046 strcpy(in_save, nosec_save);
2047 free_page((unsigned long)nosec_save);
2048 out:
2049 return rc;
2050 }
2051
2052 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2053 {
2054 struct avc_audit_data ad;
2055 int rc;
2056
2057 rc = superblock_doinit(sb, data);
2058 if (rc)
2059 return rc;
2060
2061 AVC_AUDIT_DATA_INIT(&ad,FS);
2062 ad.u.fs.dentry = sb->s_root;
2063 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2064 }
2065
2066 static int selinux_sb_statfs(struct dentry *dentry)
2067 {
2068 struct avc_audit_data ad;
2069
2070 AVC_AUDIT_DATA_INIT(&ad,FS);
2071 ad.u.fs.dentry = dentry->d_sb->s_root;
2072 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2073 }
2074
2075 static int selinux_mount(char * dev_name,
2076 struct nameidata *nd,
2077 char * type,
2078 unsigned long flags,
2079 void * data)
2080 {
2081 int rc;
2082
2083 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2084 if (rc)
2085 return rc;
2086
2087 if (flags & MS_REMOUNT)
2088 return superblock_has_perm(current, nd->mnt->mnt_sb,
2089 FILESYSTEM__REMOUNT, NULL);
2090 else
2091 return dentry_has_perm(current, nd->mnt, nd->dentry,
2092 FILE__MOUNTON);
2093 }
2094
2095 static int selinux_umount(struct vfsmount *mnt, int flags)
2096 {
2097 int rc;
2098
2099 rc = secondary_ops->sb_umount(mnt, flags);
2100 if (rc)
2101 return rc;
2102
2103 return superblock_has_perm(current,mnt->mnt_sb,
2104 FILESYSTEM__UNMOUNT,NULL);
2105 }
2106
2107 /* inode security operations */
2108
2109 static int selinux_inode_alloc_security(struct inode *inode)
2110 {
2111 return inode_alloc_security(inode);
2112 }
2113
2114 static void selinux_inode_free_security(struct inode *inode)
2115 {
2116 inode_free_security(inode);
2117 }
2118
2119 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2120 char **name, void **value,
2121 size_t *len)
2122 {
2123 struct task_security_struct *tsec;
2124 struct inode_security_struct *dsec;
2125 struct superblock_security_struct *sbsec;
2126 u32 newsid, clen;
2127 int rc;
2128 char *namep = NULL, *context;
2129
2130 tsec = current->security;
2131 dsec = dir->i_security;
2132 sbsec = dir->i_sb->s_security;
2133
2134 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2135 newsid = tsec->create_sid;
2136 } else {
2137 rc = security_transition_sid(tsec->sid, dsec->sid,
2138 inode_mode_to_security_class(inode->i_mode),
2139 &newsid);
2140 if (rc) {
2141 printk(KERN_WARNING "%s: "
2142 "security_transition_sid failed, rc=%d (dev=%s "
2143 "ino=%ld)\n",
2144 __FUNCTION__,
2145 -rc, inode->i_sb->s_id, inode->i_ino);
2146 return rc;
2147 }
2148 }
2149
2150 /* Possibly defer initialization to selinux_complete_init. */
2151 if (sbsec->initialized) {
2152 struct inode_security_struct *isec = inode->i_security;
2153 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2154 isec->sid = newsid;
2155 isec->initialized = 1;
2156 }
2157
2158 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2159 return -EOPNOTSUPP;
2160
2161 if (name) {
2162 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2163 if (!namep)
2164 return -ENOMEM;
2165 *name = namep;
2166 }
2167
2168 if (value && len) {
2169 rc = security_sid_to_context(newsid, &context, &clen);
2170 if (rc) {
2171 kfree(namep);
2172 return rc;
2173 }
2174 *value = context;
2175 *len = clen;
2176 }
2177
2178 return 0;
2179 }
2180
2181 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2182 {
2183 return may_create(dir, dentry, SECCLASS_FILE);
2184 }
2185
2186 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2187 {
2188 int rc;
2189
2190 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2191 if (rc)
2192 return rc;
2193 return may_link(dir, old_dentry, MAY_LINK);
2194 }
2195
2196 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2197 {
2198 int rc;
2199
2200 rc = secondary_ops->inode_unlink(dir, dentry);
2201 if (rc)
2202 return rc;
2203 return may_link(dir, dentry, MAY_UNLINK);
2204 }
2205
2206 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2207 {
2208 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2209 }
2210
2211 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2212 {
2213 return may_create(dir, dentry, SECCLASS_DIR);
2214 }
2215
2216 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2217 {
2218 return may_link(dir, dentry, MAY_RMDIR);
2219 }
2220
2221 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2222 {
2223 int rc;
2224
2225 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2226 if (rc)
2227 return rc;
2228
2229 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2230 }
2231
2232 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2233 struct inode *new_inode, struct dentry *new_dentry)
2234 {
2235 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2236 }
2237
2238 static int selinux_inode_readlink(struct dentry *dentry)
2239 {
2240 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2241 }
2242
2243 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2244 {
2245 int rc;
2246
2247 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2248 if (rc)
2249 return rc;
2250 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2251 }
2252
2253 static int selinux_inode_permission(struct inode *inode, int mask,
2254 struct nameidata *nd)
2255 {
2256 int rc;
2257
2258 rc = secondary_ops->inode_permission(inode, mask, nd);
2259 if (rc)
2260 return rc;
2261
2262 if (!mask) {
2263 /* No permission to check. Existence test. */
2264 return 0;
2265 }
2266
2267 return inode_has_perm(current, inode,
2268 file_mask_to_av(inode->i_mode, mask), NULL);
2269 }
2270
2271 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2272 {
2273 int rc;
2274
2275 rc = secondary_ops->inode_setattr(dentry, iattr);
2276 if (rc)
2277 return rc;
2278
2279 if (iattr->ia_valid & ATTR_FORCE)
2280 return 0;
2281
2282 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2283 ATTR_ATIME_SET | ATTR_MTIME_SET))
2284 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2285
2286 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2287 }
2288
2289 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2290 {
2291 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2292 }
2293
2294 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2295 {
2296 struct task_security_struct *tsec = current->security;
2297 struct inode *inode = dentry->d_inode;
2298 struct inode_security_struct *isec = inode->i_security;
2299 struct superblock_security_struct *sbsec;
2300 struct avc_audit_data ad;
2301 u32 newsid;
2302 int rc = 0;
2303
2304 if (strcmp(name, XATTR_NAME_SELINUX)) {
2305 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2306 sizeof XATTR_SECURITY_PREFIX - 1) &&
2307 !capable(CAP_SYS_ADMIN)) {
2308 /* A different attribute in the security namespace.
2309 Restrict to administrator. */
2310 return -EPERM;
2311 }
2312
2313 /* Not an attribute we recognize, so just check the
2314 ordinary setattr permission. */
2315 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2316 }
2317
2318 sbsec = inode->i_sb->s_security;
2319 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2320 return -EOPNOTSUPP;
2321
2322 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2323 return -EPERM;
2324
2325 AVC_AUDIT_DATA_INIT(&ad,FS);
2326 ad.u.fs.dentry = dentry;
2327
2328 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2329 FILE__RELABELFROM, &ad);
2330 if (rc)
2331 return rc;
2332
2333 rc = security_context_to_sid(value, size, &newsid);
2334 if (rc)
2335 return rc;
2336
2337 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2338 FILE__RELABELTO, &ad);
2339 if (rc)
2340 return rc;
2341
2342 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2343 isec->sclass);
2344 if (rc)
2345 return rc;
2346
2347 return avc_has_perm(newsid,
2348 sbsec->sid,
2349 SECCLASS_FILESYSTEM,
2350 FILESYSTEM__ASSOCIATE,
2351 &ad);
2352 }
2353
2354 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2355 void *value, size_t size, int flags)
2356 {
2357 struct inode *inode = dentry->d_inode;
2358 struct inode_security_struct *isec = inode->i_security;
2359 u32 newsid;
2360 int rc;
2361
2362 if (strcmp(name, XATTR_NAME_SELINUX)) {
2363 /* Not an attribute we recognize, so nothing to do. */
2364 return;
2365 }
2366
2367 rc = security_context_to_sid(value, size, &newsid);
2368 if (rc) {
2369 printk(KERN_WARNING "%s: unable to obtain SID for context "
2370 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2371 return;
2372 }
2373
2374 isec->sid = newsid;
2375 return;
2376 }
2377
2378 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2379 {
2380 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2381 }
2382
2383 static int selinux_inode_listxattr (struct dentry *dentry)
2384 {
2385 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2386 }
2387
2388 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2389 {
2390 if (strcmp(name, XATTR_NAME_SELINUX)) {
2391 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2392 sizeof XATTR_SECURITY_PREFIX - 1) &&
2393 !capable(CAP_SYS_ADMIN)) {
2394 /* A different attribute in the security namespace.
2395 Restrict to administrator. */
2396 return -EPERM;
2397 }
2398
2399 /* Not an attribute we recognize, so just check the
2400 ordinary setattr permission. Might want a separate
2401 permission for removexattr. */
2402 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2403 }
2404
2405 /* No one is allowed to remove a SELinux security label.
2406 You can change the label, but all data must be labeled. */
2407 return -EACCES;
2408 }
2409
2410 static const char *selinux_inode_xattr_getsuffix(void)
2411 {
2412 return XATTR_SELINUX_SUFFIX;
2413 }
2414
2415 /*
2416 * Copy the in-core inode security context value to the user. If the
2417 * getxattr() prior to this succeeded, check to see if we need to
2418 * canonicalize the value to be finally returned to the user.
2419 *
2420 * Permission check is handled by selinux_inode_getxattr hook.
2421 */
2422 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2423 {
2424 struct inode_security_struct *isec = inode->i_security;
2425
2426 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2427 return -EOPNOTSUPP;
2428
2429 return selinux_getsecurity(isec->sid, buffer, size);
2430 }
2431
2432 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2433 const void *value, size_t size, int flags)
2434 {
2435 struct inode_security_struct *isec = inode->i_security;
2436 u32 newsid;
2437 int rc;
2438
2439 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2440 return -EOPNOTSUPP;
2441
2442 if (!value || !size)
2443 return -EACCES;
2444
2445 rc = security_context_to_sid((void*)value, size, &newsid);
2446 if (rc)
2447 return rc;
2448
2449 isec->sid = newsid;
2450 return 0;
2451 }
2452
2453 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2454 {
2455 const int len = sizeof(XATTR_NAME_SELINUX);
2456 if (buffer && len <= buffer_size)
2457 memcpy(buffer, XATTR_NAME_SELINUX, len);
2458 return len;
2459 }
2460
2461 /* file security operations */
2462
2463 static int selinux_file_permission(struct file *file, int mask)
2464 {
2465 int rc;
2466 struct inode *inode = file->f_path.dentry->d_inode;
2467
2468 if (!mask) {
2469 /* No permission to check. Existence test. */
2470 return 0;
2471 }
2472
2473 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2474 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2475 mask |= MAY_APPEND;
2476
2477 rc = file_has_perm(current, file,
2478 file_mask_to_av(inode->i_mode, mask));
2479 if (rc)
2480 return rc;
2481
2482 return selinux_netlbl_inode_permission(inode, mask);
2483 }
2484
2485 static int selinux_file_alloc_security(struct file *file)
2486 {
2487 return file_alloc_security(file);
2488 }
2489
2490 static void selinux_file_free_security(struct file *file)
2491 {
2492 file_free_security(file);
2493 }
2494
2495 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2496 unsigned long arg)
2497 {
2498 int error = 0;
2499
2500 switch (cmd) {
2501 case FIONREAD:
2502 /* fall through */
2503 case FIBMAP:
2504 /* fall through */
2505 case FIGETBSZ:
2506 /* fall through */
2507 case EXT2_IOC_GETFLAGS:
2508 /* fall through */
2509 case EXT2_IOC_GETVERSION:
2510 error = file_has_perm(current, file, FILE__GETATTR);
2511 break;
2512
2513 case EXT2_IOC_SETFLAGS:
2514 /* fall through */
2515 case EXT2_IOC_SETVERSION:
2516 error = file_has_perm(current, file, FILE__SETATTR);
2517 break;
2518
2519 /* sys_ioctl() checks */
2520 case FIONBIO:
2521 /* fall through */
2522 case FIOASYNC:
2523 error = file_has_perm(current, file, 0);
2524 break;
2525
2526 case KDSKBENT:
2527 case KDSKBSENT:
2528 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2529 break;
2530
2531 /* default case assumes that the command will go
2532 * to the file's ioctl() function.
2533 */
2534 default:
2535 error = file_has_perm(current, file, FILE__IOCTL);
2536
2537 }
2538 return error;
2539 }
2540
2541 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2542 {
2543 #ifndef CONFIG_PPC32
2544 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2545 /*
2546 * We are making executable an anonymous mapping or a
2547 * private file mapping that will also be writable.
2548 * This has an additional check.
2549 */
2550 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2551 if (rc)
2552 return rc;
2553 }
2554 #endif
2555
2556 if (file) {
2557 /* read access is always possible with a mapping */
2558 u32 av = FILE__READ;
2559
2560 /* write access only matters if the mapping is shared */
2561 if (shared && (prot & PROT_WRITE))
2562 av |= FILE__WRITE;
2563
2564 if (prot & PROT_EXEC)
2565 av |= FILE__EXECUTE;
2566
2567 return file_has_perm(current, file, av);
2568 }
2569 return 0;
2570 }
2571
2572 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2573 unsigned long prot, unsigned long flags)
2574 {
2575 int rc;
2576
2577 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2578 if (rc)
2579 return rc;
2580
2581 if (selinux_checkreqprot)
2582 prot = reqprot;
2583
2584 return file_map_prot_check(file, prot,
2585 (flags & MAP_TYPE) == MAP_SHARED);
2586 }
2587
2588 static int selinux_file_mprotect(struct vm_area_struct *vma,
2589 unsigned long reqprot,
2590 unsigned long prot)
2591 {
2592 int rc;
2593
2594 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2595 if (rc)
2596 return rc;
2597
2598 if (selinux_checkreqprot)
2599 prot = reqprot;
2600
2601 #ifndef CONFIG_PPC32
2602 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2603 rc = 0;
2604 if (vma->vm_start >= vma->vm_mm->start_brk &&
2605 vma->vm_end <= vma->vm_mm->brk) {
2606 rc = task_has_perm(current, current,
2607 PROCESS__EXECHEAP);
2608 } else if (!vma->vm_file &&
2609 vma->vm_start <= vma->vm_mm->start_stack &&
2610 vma->vm_end >= vma->vm_mm->start_stack) {
2611 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2612 } else if (vma->vm_file && vma->anon_vma) {
2613 /*
2614 * We are making executable a file mapping that has
2615 * had some COW done. Since pages might have been
2616 * written, check ability to execute the possibly
2617 * modified content. This typically should only
2618 * occur for text relocations.
2619 */
2620 rc = file_has_perm(current, vma->vm_file,
2621 FILE__EXECMOD);
2622 }
2623 if (rc)
2624 return rc;
2625 }
2626 #endif
2627
2628 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2629 }
2630
2631 static int selinux_file_lock(struct file *file, unsigned int cmd)
2632 {
2633 return file_has_perm(current, file, FILE__LOCK);
2634 }
2635
2636 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2637 unsigned long arg)
2638 {
2639 int err = 0;
2640
2641 switch (cmd) {
2642 case F_SETFL:
2643 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2644 err = -EINVAL;
2645 break;
2646 }
2647
2648 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2649 err = file_has_perm(current, file,FILE__WRITE);
2650 break;
2651 }
2652 /* fall through */
2653 case F_SETOWN:
2654 case F_SETSIG:
2655 case F_GETFL:
2656 case F_GETOWN:
2657 case F_GETSIG:
2658 /* Just check FD__USE permission */
2659 err = file_has_perm(current, file, 0);
2660 break;
2661 case F_GETLK:
2662 case F_SETLK:
2663 case F_SETLKW:
2664 #if BITS_PER_LONG == 32
2665 case F_GETLK64:
2666 case F_SETLK64:
2667 case F_SETLKW64:
2668 #endif
2669 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2670 err = -EINVAL;
2671 break;
2672 }
2673 err = file_has_perm(current, file, FILE__LOCK);
2674 break;
2675 }
2676
2677 return err;
2678 }
2679
2680 static int selinux_file_set_fowner(struct file *file)
2681 {
2682 struct task_security_struct *tsec;
2683 struct file_security_struct *fsec;
2684
2685 tsec = current->security;
2686 fsec = file->f_security;
2687 fsec->fown_sid = tsec->sid;
2688
2689 return 0;
2690 }
2691
2692 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2693 struct fown_struct *fown, int signum)
2694 {
2695 struct file *file;
2696 u32 perm;
2697 struct task_security_struct *tsec;
2698 struct file_security_struct *fsec;
2699
2700 /* struct fown_struct is never outside the context of a struct file */
2701 file = container_of(fown, struct file, f_owner);
2702
2703 tsec = tsk->security;
2704 fsec = file->f_security;
2705
2706 if (!signum)
2707 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2708 else
2709 perm = signal_to_av(signum);
2710
2711 return avc_has_perm(fsec->fown_sid, tsec->sid,
2712 SECCLASS_PROCESS, perm, NULL);
2713 }
2714
2715 static int selinux_file_receive(struct file *file)
2716 {
2717 return file_has_perm(current, file, file_to_av(file));
2718 }
2719
2720 /* task security operations */
2721
2722 static int selinux_task_create(unsigned long clone_flags)
2723 {
2724 int rc;
2725
2726 rc = secondary_ops->task_create(clone_flags);
2727 if (rc)
2728 return rc;
2729
2730 return task_has_perm(current, current, PROCESS__FORK);
2731 }
2732
2733 static int selinux_task_alloc_security(struct task_struct *tsk)
2734 {
2735 struct task_security_struct *tsec1, *tsec2;
2736 int rc;
2737
2738 tsec1 = current->security;
2739
2740 rc = task_alloc_security(tsk);
2741 if (rc)
2742 return rc;
2743 tsec2 = tsk->security;
2744
2745 tsec2->osid = tsec1->osid;
2746 tsec2->sid = tsec1->sid;
2747
2748 /* Retain the exec, fs, key, and sock SIDs across fork */
2749 tsec2->exec_sid = tsec1->exec_sid;
2750 tsec2->create_sid = tsec1->create_sid;
2751 tsec2->keycreate_sid = tsec1->keycreate_sid;
2752 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2753
2754 /* Retain ptracer SID across fork, if any.
2755 This will be reset by the ptrace hook upon any
2756 subsequent ptrace_attach operations. */
2757 tsec2->ptrace_sid = tsec1->ptrace_sid;
2758
2759 return 0;
2760 }
2761
2762 static void selinux_task_free_security(struct task_struct *tsk)
2763 {
2764 task_free_security(tsk);
2765 }
2766
2767 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2768 {
2769 /* Since setuid only affects the current process, and
2770 since the SELinux controls are not based on the Linux
2771 identity attributes, SELinux does not need to control
2772 this operation. However, SELinux does control the use
2773 of the CAP_SETUID and CAP_SETGID capabilities using the
2774 capable hook. */
2775 return 0;
2776 }
2777
2778 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2779 {
2780 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2781 }
2782
2783 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2784 {
2785 /* See the comment for setuid above. */
2786 return 0;
2787 }
2788
2789 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2790 {
2791 return task_has_perm(current, p, PROCESS__SETPGID);
2792 }
2793
2794 static int selinux_task_getpgid(struct task_struct *p)
2795 {
2796 return task_has_perm(current, p, PROCESS__GETPGID);
2797 }
2798
2799 static int selinux_task_getsid(struct task_struct *p)
2800 {
2801 return task_has_perm(current, p, PROCESS__GETSESSION);
2802 }
2803
2804 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2805 {
2806 selinux_get_task_sid(p, secid);
2807 }
2808
2809 static int selinux_task_setgroups(struct group_info *group_info)
2810 {
2811 /* See the comment for setuid above. */
2812 return 0;
2813 }
2814
2815 static int selinux_task_setnice(struct task_struct *p, int nice)
2816 {
2817 int rc;
2818
2819 rc = secondary_ops->task_setnice(p, nice);
2820 if (rc)
2821 return rc;
2822
2823 return task_has_perm(current,p, PROCESS__SETSCHED);
2824 }
2825
2826 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2827 {
2828 return task_has_perm(current, p, PROCESS__SETSCHED);
2829 }
2830
2831 static int selinux_task_getioprio(struct task_struct *p)
2832 {
2833 return task_has_perm(current, p, PROCESS__GETSCHED);
2834 }
2835
2836 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2837 {
2838 struct rlimit *old_rlim = current->signal->rlim + resource;
2839 int rc;
2840
2841 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2842 if (rc)
2843 return rc;
2844
2845 /* Control the ability to change the hard limit (whether
2846 lowering or raising it), so that the hard limit can
2847 later be used as a safe reset point for the soft limit
2848 upon context transitions. See selinux_bprm_apply_creds. */
2849 if (old_rlim->rlim_max != new_rlim->rlim_max)
2850 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2851
2852 return 0;
2853 }
2854
2855 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2856 {
2857 return task_has_perm(current, p, PROCESS__SETSCHED);
2858 }
2859
2860 static int selinux_task_getscheduler(struct task_struct *p)
2861 {
2862 return task_has_perm(current, p, PROCESS__GETSCHED);
2863 }
2864
2865 static int selinux_task_movememory(struct task_struct *p)
2866 {
2867 return task_has_perm(current, p, PROCESS__SETSCHED);
2868 }
2869
2870 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2871 int sig, u32 secid)
2872 {
2873 u32 perm;
2874 int rc;
2875 struct task_security_struct *tsec;
2876
2877 rc = secondary_ops->task_kill(p, info, sig, secid);
2878 if (rc)
2879 return rc;
2880
2881 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2882 return 0;
2883
2884 if (!sig)
2885 perm = PROCESS__SIGNULL; /* null signal; existence test */
2886 else
2887 perm = signal_to_av(sig);
2888 tsec = p->security;
2889 if (secid)
2890 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2891 else
2892 rc = task_has_perm(current, p, perm);
2893 return rc;
2894 }
2895
2896 static int selinux_task_prctl(int option,
2897 unsigned long arg2,
2898 unsigned long arg3,
2899 unsigned long arg4,
2900 unsigned long arg5)
2901 {
2902 /* The current prctl operations do not appear to require
2903 any SELinux controls since they merely observe or modify
2904 the state of the current process. */
2905 return 0;
2906 }
2907
2908 static int selinux_task_wait(struct task_struct *p)
2909 {
2910 u32 perm;
2911
2912 perm = signal_to_av(p->exit_signal);
2913
2914 return task_has_perm(p, current, perm);
2915 }
2916
2917 static void selinux_task_reparent_to_init(struct task_struct *p)
2918 {
2919 struct task_security_struct *tsec;
2920
2921 secondary_ops->task_reparent_to_init(p);
2922
2923 tsec = p->security;
2924 tsec->osid = tsec->sid;
2925 tsec->sid = SECINITSID_KERNEL;
2926 return;
2927 }
2928
2929 static void selinux_task_to_inode(struct task_struct *p,
2930 struct inode *inode)
2931 {
2932 struct task_security_struct *tsec = p->security;
2933 struct inode_security_struct *isec = inode->i_security;
2934
2935 isec->sid = tsec->sid;
2936 isec->initialized = 1;
2937 return;
2938 }
2939
2940 /* Returns error only if unable to parse addresses */
2941 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2942 struct avc_audit_data *ad, u8 *proto)
2943 {
2944 int offset, ihlen, ret = -EINVAL;
2945 struct iphdr _iph, *ih;
2946
2947 offset = skb_network_offset(skb);
2948 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2949 if (ih == NULL)
2950 goto out;
2951
2952 ihlen = ih->ihl * 4;
2953 if (ihlen < sizeof(_iph))
2954 goto out;
2955
2956 ad->u.net.v4info.saddr = ih->saddr;
2957 ad->u.net.v4info.daddr = ih->daddr;
2958 ret = 0;
2959
2960 if (proto)
2961 *proto = ih->protocol;
2962
2963 switch (ih->protocol) {
2964 case IPPROTO_TCP: {
2965 struct tcphdr _tcph, *th;
2966
2967 if (ntohs(ih->frag_off) & IP_OFFSET)
2968 break;
2969
2970 offset += ihlen;
2971 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2972 if (th == NULL)
2973 break;
2974
2975 ad->u.net.sport = th->source;
2976 ad->u.net.dport = th->dest;
2977 break;
2978 }
2979
2980 case IPPROTO_UDP: {
2981 struct udphdr _udph, *uh;
2982
2983 if (ntohs(ih->frag_off) & IP_OFFSET)
2984 break;
2985
2986 offset += ihlen;
2987 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2988 if (uh == NULL)
2989 break;
2990
2991 ad->u.net.sport = uh->source;
2992 ad->u.net.dport = uh->dest;
2993 break;
2994 }
2995
2996 case IPPROTO_DCCP: {
2997 struct dccp_hdr _dccph, *dh;
2998
2999 if (ntohs(ih->frag_off) & IP_OFFSET)
3000 break;
3001
3002 offset += ihlen;
3003 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3004 if (dh == NULL)
3005 break;
3006
3007 ad->u.net.sport = dh->dccph_sport;
3008 ad->u.net.dport = dh->dccph_dport;
3009 break;
3010 }
3011
3012 default:
3013 break;
3014 }
3015 out:
3016 return ret;
3017 }
3018
3019 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3020
3021 /* Returns error only if unable to parse addresses */
3022 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3023 struct avc_audit_data *ad, u8 *proto)
3024 {
3025 u8 nexthdr;
3026 int ret = -EINVAL, offset;
3027 struct ipv6hdr _ipv6h, *ip6;
3028
3029 offset = skb_network_offset(skb);
3030 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3031 if (ip6 == NULL)
3032 goto out;
3033
3034 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3035 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3036 ret = 0;
3037
3038 nexthdr = ip6->nexthdr;
3039 offset += sizeof(_ipv6h);
3040 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3041 if (offset < 0)
3042 goto out;
3043
3044 if (proto)
3045 *proto = nexthdr;
3046
3047 switch (nexthdr) {
3048 case IPPROTO_TCP: {
3049 struct tcphdr _tcph, *th;
3050
3051 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3052 if (th == NULL)
3053 break;
3054
3055 ad->u.net.sport = th->source;
3056 ad->u.net.dport = th->dest;
3057 break;
3058 }
3059
3060 case IPPROTO_UDP: {
3061 struct udphdr _udph, *uh;
3062
3063 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3064 if (uh == NULL)
3065 break;
3066
3067 ad->u.net.sport = uh->source;
3068 ad->u.net.dport = uh->dest;
3069 break;
3070 }
3071
3072 case IPPROTO_DCCP: {
3073 struct dccp_hdr _dccph, *dh;
3074
3075 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3076 if (dh == NULL)
3077 break;
3078
3079 ad->u.net.sport = dh->dccph_sport;
3080 ad->u.net.dport = dh->dccph_dport;
3081 break;
3082 }
3083
3084 /* includes fragments */
3085 default:
3086 break;
3087 }
3088 out:
3089 return ret;
3090 }
3091
3092 #endif /* IPV6 */
3093
3094 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3095 char **addrp, int *len, int src, u8 *proto)
3096 {
3097 int ret = 0;
3098
3099 switch (ad->u.net.family) {
3100 case PF_INET:
3101 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3102 if (ret || !addrp)
3103 break;
3104 *len = 4;
3105 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3106 &ad->u.net.v4info.daddr);
3107 break;
3108
3109 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3110 case PF_INET6:
3111 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3112 if (ret || !addrp)
3113 break;
3114 *len = 16;
3115 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3116 &ad->u.net.v6info.daddr);
3117 break;
3118 #endif /* IPV6 */
3119 default:
3120 break;
3121 }
3122
3123 return ret;
3124 }
3125
3126 /**
3127 * selinux_skb_extlbl_sid - Determine the external label of a packet
3128 * @skb: the packet
3129 * @base_sid: the SELinux SID to use as a context for MLS only external labels
3130 * @sid: the packet's SID
3131 *
3132 * Description:
3133 * Check the various different forms of external packet labeling and determine
3134 * the external SID for the packet.
3135 *
3136 */
3137 static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3138 u32 base_sid,
3139 u32 *sid)
3140 {
3141 u32 xfrm_sid;
3142 u32 nlbl_sid;
3143
3144 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3145 if (selinux_netlbl_skbuff_getsid(skb,
3146 (xfrm_sid == SECSID_NULL ?
3147 base_sid : xfrm_sid),
3148 &nlbl_sid) != 0)
3149 nlbl_sid = SECSID_NULL;
3150
3151 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3152 }
3153
3154 /* socket security operations */
3155 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3156 u32 perms)
3157 {
3158 struct inode_security_struct *isec;
3159 struct task_security_struct *tsec;
3160 struct avc_audit_data ad;
3161 int err = 0;
3162
3163 tsec = task->security;
3164 isec = SOCK_INODE(sock)->i_security;
3165
3166 if (isec->sid == SECINITSID_KERNEL)
3167 goto out;
3168
3169 AVC_AUDIT_DATA_INIT(&ad,NET);
3170 ad.u.net.sk = sock->sk;
3171 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3172
3173 out:
3174 return err;
3175 }
3176
3177 static int selinux_socket_create(int family, int type,
3178 int protocol, int kern)
3179 {
3180 int err = 0;
3181 struct task_security_struct *tsec;
3182 u32 newsid;
3183
3184 if (kern)
3185 goto out;
3186
3187 tsec = current->security;
3188 newsid = tsec->sockcreate_sid ? : tsec->sid;
3189 err = avc_has_perm(tsec->sid, newsid,
3190 socket_type_to_security_class(family, type,
3191 protocol), SOCKET__CREATE, NULL);
3192
3193 out:
3194 return err;
3195 }
3196
3197 static int selinux_socket_post_create(struct socket *sock, int family,
3198 int type, int protocol, int kern)
3199 {
3200 int err = 0;
3201 struct inode_security_struct *isec;
3202 struct task_security_struct *tsec;
3203 struct sk_security_struct *sksec;
3204 u32 newsid;
3205
3206 isec = SOCK_INODE(sock)->i_security;
3207
3208 tsec = current->security;
3209 newsid = tsec->sockcreate_sid ? : tsec->sid;
3210 isec->sclass = socket_type_to_security_class(family, type, protocol);
3211 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3212 isec->initialized = 1;
3213
3214 if (sock->sk) {
3215 sksec = sock->sk->sk_security;
3216 sksec->sid = isec->sid;
3217 err = selinux_netlbl_socket_post_create(sock);
3218 }
3219
3220 return err;
3221 }
3222
3223 /* Range of port numbers used to automatically bind.
3224 Need to determine whether we should perform a name_bind
3225 permission check between the socket and the port number. */
3226 #define ip_local_port_range_0 sysctl_local_port_range[0]
3227 #define ip_local_port_range_1 sysctl_local_port_range[1]
3228
3229 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3230 {
3231 u16 family;
3232 int err;
3233
3234 err = socket_has_perm(current, sock, SOCKET__BIND);
3235 if (err)
3236 goto out;
3237
3238 /*
3239 * If PF_INET or PF_INET6, check name_bind permission for the port.
3240 * Multiple address binding for SCTP is not supported yet: we just
3241 * check the first address now.
3242 */
3243 family = sock->sk->sk_family;
3244 if (family == PF_INET || family == PF_INET6) {
3245 char *addrp;
3246 struct inode_security_struct *isec;
3247 struct task_security_struct *tsec;
3248 struct avc_audit_data ad;
3249 struct sockaddr_in *addr4 = NULL;
3250 struct sockaddr_in6 *addr6 = NULL;
3251 unsigned short snum;
3252 struct sock *sk = sock->sk;
3253 u32 sid, node_perm, addrlen;
3254
3255 tsec = current->security;
3256 isec = SOCK_INODE(sock)->i_security;
3257
3258 if (family == PF_INET) {
3259 addr4 = (struct sockaddr_in *)address;
3260 snum = ntohs(addr4->sin_port);
3261 addrlen = sizeof(addr4->sin_addr.s_addr);
3262 addrp = (char *)&addr4->sin_addr.s_addr;
3263 } else {
3264 addr6 = (struct sockaddr_in6 *)address;
3265 snum = ntohs(addr6->sin6_port);
3266 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3267 addrp = (char *)&addr6->sin6_addr.s6_addr;
3268 }
3269
3270 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3271 snum > ip_local_port_range_1)) {
3272 err = security_port_sid(sk->sk_family, sk->sk_type,
3273 sk->sk_protocol, snum, &sid);
3274 if (err)
3275 goto out;
3276 AVC_AUDIT_DATA_INIT(&ad,NET);
3277 ad.u.net.sport = htons(snum);
3278 ad.u.net.family = family;
3279 err = avc_has_perm(isec->sid, sid,
3280 isec->sclass,
3281 SOCKET__NAME_BIND, &ad);
3282 if (err)
3283 goto out;
3284 }
3285
3286 switch(isec->sclass) {
3287 case SECCLASS_TCP_SOCKET:
3288 node_perm = TCP_SOCKET__NODE_BIND;
3289 break;
3290
3291 case SECCLASS_UDP_SOCKET:
3292 node_perm = UDP_SOCKET__NODE_BIND;
3293 break;
3294
3295 case SECCLASS_DCCP_SOCKET:
3296 node_perm = DCCP_SOCKET__NODE_BIND;
3297 break;
3298
3299 default:
3300 node_perm = RAWIP_SOCKET__NODE_BIND;
3301 break;
3302 }
3303
3304 err = security_node_sid(family, addrp, addrlen, &sid);
3305 if (err)
3306 goto out;
3307
3308 AVC_AUDIT_DATA_INIT(&ad,NET);
3309 ad.u.net.sport = htons(snum);
3310 ad.u.net.family = family;
3311
3312 if (family == PF_INET)
3313 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3314 else
3315 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3316
3317 err = avc_has_perm(isec->sid, sid,
3318 isec->sclass, node_perm, &ad);
3319 if (err)
3320 goto out;
3321 }
3322 out:
3323 return err;
3324 }
3325
3326 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3327 {
3328 struct inode_security_struct *isec;
3329 int err;
3330
3331 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3332 if (err)
3333 return err;
3334
3335 /*
3336 * If a TCP or DCCP socket, check name_connect permission for the port.
3337 */
3338 isec = SOCK_INODE(sock)->i_security;
3339 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3340 isec->sclass == SECCLASS_DCCP_SOCKET) {
3341 struct sock *sk = sock->sk;
3342 struct avc_audit_data ad;
3343 struct sockaddr_in *addr4 = NULL;
3344 struct sockaddr_in6 *addr6 = NULL;
3345 unsigned short snum;
3346 u32 sid, perm;
3347
3348 if (sk->sk_family == PF_INET) {
3349 addr4 = (struct sockaddr_in *)address;
3350 if (addrlen < sizeof(struct sockaddr_in))
3351 return -EINVAL;
3352 snum = ntohs(addr4->sin_port);
3353 } else {
3354 addr6 = (struct sockaddr_in6 *)address;
3355 if (addrlen < SIN6_LEN_RFC2133)
3356 return -EINVAL;
3357 snum = ntohs(addr6->sin6_port);
3358 }
3359
3360 err = security_port_sid(sk->sk_family, sk->sk_type,
3361 sk->sk_protocol, snum, &sid);
3362 if (err)
3363 goto out;
3364
3365 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3366 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3367
3368 AVC_AUDIT_DATA_INIT(&ad,NET);
3369 ad.u.net.dport = htons(snum);
3370 ad.u.net.family = sk->sk_family;
3371 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3372 if (err)
3373 goto out;
3374 }
3375
3376 out:
3377 return err;
3378 }
3379
3380 static int selinux_socket_listen(struct socket *sock, int backlog)
3381 {
3382 return socket_has_perm(current, sock, SOCKET__LISTEN);
3383 }
3384
3385 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3386 {
3387 int err;
3388 struct inode_security_struct *isec;
3389 struct inode_security_struct *newisec;
3390
3391 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3392 if (err)
3393 return err;
3394
3395 newisec = SOCK_INODE(newsock)->i_security;
3396
3397 isec = SOCK_INODE(sock)->i_security;
3398 newisec->sclass = isec->sclass;
3399 newisec->sid = isec->sid;
3400 newisec->initialized = 1;
3401
3402 return 0;
3403 }
3404
3405 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3406 int size)
3407 {
3408 int rc;
3409
3410 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3411 if (rc)
3412 return rc;
3413
3414 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3415 }
3416
3417 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3418 int size, int flags)
3419 {
3420 return socket_has_perm(current, sock, SOCKET__READ);
3421 }
3422
3423 static int selinux_socket_getsockname(struct socket *sock)
3424 {
3425 return socket_has_perm(current, sock, SOCKET__GETATTR);
3426 }
3427
3428 static int selinux_socket_getpeername(struct socket *sock)
3429 {
3430 return socket_has_perm(current, sock, SOCKET__GETATTR);
3431 }
3432
3433 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3434 {
3435 int err;
3436
3437 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3438 if (err)
3439 return err;
3440
3441 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3442 }
3443
3444 static int selinux_socket_getsockopt(struct socket *sock, int level,
3445 int optname)
3446 {
3447 return socket_has_perm(current, sock, SOCKET__GETOPT);
3448 }
3449
3450 static int selinux_socket_shutdown(struct socket *sock, int how)
3451 {
3452 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3453 }
3454
3455 static int selinux_socket_unix_stream_connect(struct socket *sock,
3456 struct socket *other,
3457 struct sock *newsk)
3458 {
3459 struct sk_security_struct *ssec;
3460 struct inode_security_struct *isec;
3461 struct inode_security_struct *other_isec;
3462 struct avc_audit_data ad;
3463 int err;
3464
3465 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3466 if (err)
3467 return err;
3468
3469 isec = SOCK_INODE(sock)->i_security;
3470 other_isec = SOCK_INODE(other)->i_security;
3471
3472 AVC_AUDIT_DATA_INIT(&ad,NET);
3473 ad.u.net.sk = other->sk;
3474
3475 err = avc_has_perm(isec->sid, other_isec->sid,
3476 isec->sclass,
3477 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3478 if (err)
3479 return err;
3480
3481 /* connecting socket */
3482 ssec = sock->sk->sk_security;
3483 ssec->peer_sid = other_isec->sid;
3484
3485 /* server child socket */
3486 ssec = newsk->sk_security;
3487 ssec->peer_sid = isec->sid;
3488 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3489
3490 return err;
3491 }
3492
3493 static int selinux_socket_unix_may_send(struct socket *sock,
3494 struct socket *other)
3495 {
3496 struct inode_security_struct *isec;
3497 struct inode_security_struct *other_isec;
3498 struct avc_audit_data ad;
3499 int err;
3500
3501 isec = SOCK_INODE(sock)->i_security;
3502 other_isec = SOCK_INODE(other)->i_security;
3503
3504 AVC_AUDIT_DATA_INIT(&ad,NET);
3505 ad.u.net.sk = other->sk;
3506
3507 err = avc_has_perm(isec->sid, other_isec->sid,
3508 isec->sclass, SOCKET__SENDTO, &ad);
3509 if (err)
3510 return err;
3511
3512 return 0;
3513 }
3514
3515 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3516 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3517 {
3518 int err = 0;
3519 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3520 struct socket *sock;
3521 u16 sock_class = 0;
3522 u32 sock_sid = 0;
3523
3524 read_lock_bh(&sk->sk_callback_lock);
3525 sock = sk->sk_socket;
3526 if (sock) {
3527 struct inode *inode;
3528 inode = SOCK_INODE(sock);
3529 if (inode) {
3530 struct inode_security_struct *isec;
3531 isec = inode->i_security;
3532 sock_sid = isec->sid;
3533 sock_class = isec->sclass;
3534 }
3535 }
3536 read_unlock_bh(&sk->sk_callback_lock);
3537 if (!sock_sid)
3538 goto out;
3539
3540 if (!skb->dev)
3541 goto out;
3542
3543 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3544 if (err)
3545 goto out;
3546
3547 switch (sock_class) {
3548 case SECCLASS_UDP_SOCKET:
3549 netif_perm = NETIF__UDP_RECV;
3550 node_perm = NODE__UDP_RECV;
3551 recv_perm = UDP_SOCKET__RECV_MSG;
3552 break;
3553
3554 case SECCLASS_TCP_SOCKET:
3555 netif_perm = NETIF__TCP_RECV;
3556 node_perm = NODE__TCP_RECV;
3557 recv_perm = TCP_SOCKET__RECV_MSG;
3558 break;
3559
3560 case SECCLASS_DCCP_SOCKET:
3561 netif_perm = NETIF__DCCP_RECV;
3562 node_perm = NODE__DCCP_RECV;
3563 recv_perm = DCCP_SOCKET__RECV_MSG;
3564 break;
3565
3566 default:
3567 netif_perm = NETIF__RAWIP_RECV;
3568 node_perm = NODE__RAWIP_RECV;
3569 break;
3570 }
3571
3572 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3573 if (err)
3574 goto out;
3575
3576 err = security_node_sid(family, addrp, len, &node_sid);
3577 if (err)
3578 goto out;
3579
3580 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3581 if (err)
3582 goto out;
3583
3584 if (recv_perm) {
3585 u32 port_sid;
3586
3587 err = security_port_sid(sk->sk_family, sk->sk_type,
3588 sk->sk_protocol, ntohs(ad->u.net.sport),
3589 &port_sid);
3590 if (err)
3591 goto out;
3592
3593 err = avc_has_perm(sock_sid, port_sid,
3594 sock_class, recv_perm, ad);
3595 }
3596
3597 out:
3598 return err;
3599 }
3600
3601 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3602 {
3603 u16 family;
3604 char *addrp;
3605 int len, err = 0;
3606 struct avc_audit_data ad;
3607 struct sk_security_struct *sksec = sk->sk_security;
3608
3609 family = sk->sk_family;
3610 if (family != PF_INET && family != PF_INET6)
3611 goto out;
3612
3613 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3614 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3615 family = PF_INET;
3616
3617 AVC_AUDIT_DATA_INIT(&ad, NET);
3618 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3619 ad.u.net.family = family;
3620
3621 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3622 if (err)
3623 goto out;
3624
3625 if (selinux_compat_net)
3626 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3627 addrp, len);
3628 else
3629 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3630 PACKET__RECV, &ad);
3631 if (err)
3632 goto out;
3633
3634 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3635 if (err)
3636 goto out;
3637
3638 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3639 out:
3640 return err;
3641 }
3642
3643 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3644 int __user *optlen, unsigned len)
3645 {
3646 int err = 0;
3647 char *scontext;
3648 u32 scontext_len;
3649 struct sk_security_struct *ssec;
3650 struct inode_security_struct *isec;
3651 u32 peer_sid = SECSID_NULL;
3652
3653 isec = SOCK_INODE(sock)->i_security;
3654
3655 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3656 isec->sclass == SECCLASS_TCP_SOCKET) {
3657 ssec = sock->sk->sk_security;
3658 peer_sid = ssec->peer_sid;
3659 }
3660 if (peer_sid == SECSID_NULL) {
3661 err = -ENOPROTOOPT;
3662 goto out;
3663 }
3664
3665 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3666
3667 if (err)
3668 goto out;
3669
3670 if (scontext_len > len) {
3671 err = -ERANGE;
3672 goto out_len;
3673 }
3674
3675 if (copy_to_user(optval, scontext, scontext_len))
3676 err = -EFAULT;
3677
3678 out_len:
3679 if (put_user(scontext_len, optlen))
3680 err = -EFAULT;
3681
3682 kfree(scontext);
3683 out:
3684 return err;
3685 }
3686
3687 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3688 {
3689 u32 peer_secid = SECSID_NULL;
3690 int err = 0;
3691
3692 if (sock && sock->sk->sk_family == PF_UNIX)
3693 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3694 else if (skb)
3695 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
3696
3697 if (peer_secid == SECSID_NULL)
3698 err = -EINVAL;
3699 *secid = peer_secid;
3700
3701 return err;
3702 }
3703
3704 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3705 {
3706 return sk_alloc_security(sk, family, priority);
3707 }
3708
3709 static void selinux_sk_free_security(struct sock *sk)
3710 {
3711 sk_free_security(sk);
3712 }
3713
3714 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3715 {
3716 struct sk_security_struct *ssec = sk->sk_security;
3717 struct sk_security_struct *newssec = newsk->sk_security;
3718
3719 newssec->sid = ssec->sid;
3720 newssec->peer_sid = ssec->peer_sid;
3721
3722 selinux_netlbl_sk_security_clone(ssec, newssec);
3723 }
3724
3725 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3726 {
3727 if (!sk)
3728 *secid = SECINITSID_ANY_SOCKET;
3729 else {
3730 struct sk_security_struct *sksec = sk->sk_security;
3731
3732 *secid = sksec->sid;
3733 }
3734 }
3735
3736 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3737 {
3738 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3739 struct sk_security_struct *sksec = sk->sk_security;
3740
3741 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3742 sk->sk_family == PF_UNIX)
3743 isec->sid = sksec->sid;
3744
3745 selinux_netlbl_sock_graft(sk, parent);
3746 }
3747
3748 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3749 struct request_sock *req)
3750 {
3751 struct sk_security_struct *sksec = sk->sk_security;
3752 int err;
3753 u32 newsid;
3754 u32 peersid;
3755
3756 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3757 if (peersid == SECSID_NULL) {
3758 req->secid = sksec->sid;
3759 req->peer_secid = SECSID_NULL;
3760 return 0;
3761 }
3762
3763 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3764 if (err)
3765 return err;
3766
3767 req->secid = newsid;
3768 req->peer_secid = peersid;
3769 return 0;
3770 }
3771
3772 static void selinux_inet_csk_clone(struct sock *newsk,
3773 const struct request_sock *req)
3774 {
3775 struct sk_security_struct *newsksec = newsk->sk_security;
3776
3777 newsksec->sid = req->secid;
3778 newsksec->peer_sid = req->peer_secid;
3779 /* NOTE: Ideally, we should also get the isec->sid for the
3780 new socket in sync, but we don't have the isec available yet.
3781 So we will wait until sock_graft to do it, by which
3782 time it will have been created and available. */
3783
3784 /* We don't need to take any sort of lock here as we are the only
3785 * thread with access to newsksec */
3786 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3787 }
3788
3789 static void selinux_inet_conn_established(struct sock *sk,
3790 struct sk_buff *skb)
3791 {
3792 struct sk_security_struct *sksec = sk->sk_security;
3793
3794 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3795 }
3796
3797 static void selinux_req_classify_flow(const struct request_sock *req,
3798 struct flowi *fl)
3799 {
3800 fl->secid = req->secid;
3801 }
3802
3803 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3804 {
3805 int err = 0;
3806 u32 perm;
3807 struct nlmsghdr *nlh;
3808 struct socket *sock = sk->sk_socket;
3809 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3810
3811 if (skb->len < NLMSG_SPACE(0)) {
3812 err = -EINVAL;
3813 goto out;
3814 }
3815 nlh = nlmsg_hdr(skb);
3816
3817 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3818 if (err) {
3819 if (err == -EINVAL) {
3820 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3821 "SELinux: unrecognized netlink message"
3822 " type=%hu for sclass=%hu\n",
3823 nlh->nlmsg_type, isec->sclass);
3824 if (!selinux_enforcing)
3825 err = 0;
3826 }
3827
3828 /* Ignore */
3829 if (err == -ENOENT)
3830 err = 0;
3831 goto out;
3832 }
3833
3834 err = socket_has_perm(current, sock, perm);
3835 out:
3836 return err;
3837 }
3838
3839 #ifdef CONFIG_NETFILTER
3840
3841 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3842 struct avc_audit_data *ad,
3843 u16 family, char *addrp, int len)
3844 {
3845 int err = 0;
3846 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3847 struct socket *sock;
3848 struct inode *inode;
3849 struct inode_security_struct *isec;
3850
3851 sock = sk->sk_socket;
3852 if (!sock)
3853 goto out;
3854
3855 inode = SOCK_INODE(sock);
3856 if (!inode)
3857 goto out;
3858
3859 isec = inode->i_security;
3860
3861 err = sel_netif_sids(dev, &if_sid, NULL);
3862 if (err)
3863 goto out;
3864
3865 switch (isec->sclass) {
3866 case SECCLASS_UDP_SOCKET:
3867 netif_perm = NETIF__UDP_SEND;
3868 node_perm = NODE__UDP_SEND;
3869 send_perm = UDP_SOCKET__SEND_MSG;
3870 break;
3871
3872 case SECCLASS_TCP_SOCKET:
3873 netif_perm = NETIF__TCP_SEND;
3874 node_perm = NODE__TCP_SEND;
3875 send_perm = TCP_SOCKET__SEND_MSG;
3876 break;
3877
3878 case SECCLASS_DCCP_SOCKET:
3879 netif_perm = NETIF__DCCP_SEND;
3880 node_perm = NODE__DCCP_SEND;
3881 send_perm = DCCP_SOCKET__SEND_MSG;
3882 break;
3883
3884 default:
3885 netif_perm = NETIF__RAWIP_SEND;
3886 node_perm = NODE__RAWIP_SEND;
3887 break;
3888 }
3889
3890 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3891 if (err)
3892 goto out;
3893
3894 err = security_node_sid(family, addrp, len, &node_sid);
3895 if (err)
3896 goto out;
3897
3898 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3899 if (err)
3900 goto out;
3901
3902 if (send_perm) {
3903 u32 port_sid;
3904
3905 err = security_port_sid(sk->sk_family,
3906 sk->sk_type,
3907 sk->sk_protocol,
3908 ntohs(ad->u.net.dport),
3909 &port_sid);
3910 if (err)
3911 goto out;
3912
3913 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3914 send_perm, ad);
3915 }
3916 out:
3917 return err;
3918 }
3919
3920 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3921 struct sk_buff **pskb,
3922 const struct net_device *in,
3923 const struct net_device *out,
3924 int (*okfn)(struct sk_buff *),
3925 u16 family)
3926 {
3927 char *addrp;
3928 int len, err = 0;
3929 struct sock *sk;
3930 struct sk_buff *skb = *pskb;
3931 struct avc_audit_data ad;
3932 struct net_device *dev = (struct net_device *)out;
3933 struct sk_security_struct *sksec;
3934 u8 proto;
3935
3936 sk = skb->sk;
3937 if (!sk)
3938 goto out;
3939
3940 sksec = sk->sk_security;
3941
3942 AVC_AUDIT_DATA_INIT(&ad, NET);
3943 ad.u.net.netif = dev->name;
3944 ad.u.net.family = family;
3945
3946 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3947 if (err)
3948 goto out;
3949
3950 if (selinux_compat_net)
3951 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3952 family, addrp, len);
3953 else
3954 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3955 PACKET__SEND, &ad);
3956
3957 if (err)
3958 goto out;
3959
3960 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3961 out:
3962 return err ? NF_DROP : NF_ACCEPT;
3963 }
3964
3965 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3966 struct sk_buff **pskb,
3967 const struct net_device *in,
3968 const struct net_device *out,
3969 int (*okfn)(struct sk_buff *))
3970 {
3971 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3972 }
3973
3974 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3975
3976 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3977 struct sk_buff **pskb,
3978 const struct net_device *in,
3979 const struct net_device *out,
3980 int (*okfn)(struct sk_buff *))
3981 {
3982 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3983 }
3984
3985 #endif /* IPV6 */
3986
3987 #endif /* CONFIG_NETFILTER */
3988
3989 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3990 {
3991 int err;
3992
3993 err = secondary_ops->netlink_send(sk, skb);
3994 if (err)
3995 return err;
3996
3997 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3998 err = selinux_nlmsg_perm(sk, skb);
3999
4000 return err;
4001 }
4002
4003 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4004 {
4005 int err;
4006 struct avc_audit_data ad;
4007
4008 err = secondary_ops->netlink_recv(skb, capability);
4009 if (err)
4010 return err;
4011
4012 AVC_AUDIT_DATA_INIT(&ad, CAP);
4013 ad.u.cap = capability;
4014
4015 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4016 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4017 }
4018
4019 static int ipc_alloc_security(struct task_struct *task,
4020 struct kern_ipc_perm *perm,
4021 u16 sclass)
4022 {
4023 struct task_security_struct *tsec = task->security;
4024 struct ipc_security_struct *isec;
4025
4026 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4027 if (!isec)
4028 return -ENOMEM;
4029
4030 isec->sclass = sclass;
4031 isec->ipc_perm = perm;
4032 isec->sid = tsec->sid;
4033 perm->security = isec;
4034
4035 return 0;
4036 }
4037
4038 static void ipc_free_security(struct kern_ipc_perm *perm)
4039 {
4040 struct ipc_security_struct *isec = perm->security;
4041 perm->security = NULL;
4042 kfree(isec);
4043 }
4044
4045 static int msg_msg_alloc_security(struct msg_msg *msg)
4046 {
4047 struct msg_security_struct *msec;
4048
4049 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4050 if (!msec)
4051 return -ENOMEM;
4052
4053 msec->msg = msg;
4054 msec->sid = SECINITSID_UNLABELED;
4055 msg->security = msec;
4056
4057 return 0;
4058 }
4059
4060 static void msg_msg_free_security(struct msg_msg *msg)
4061 {
4062 struct msg_security_struct *msec = msg->security;
4063
4064 msg->security = NULL;
4065 kfree(msec);
4066 }
4067
4068 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4069 u32 perms)
4070 {
4071 struct task_security_struct *tsec;
4072 struct ipc_security_struct *isec;
4073 struct avc_audit_data ad;
4074
4075 tsec = current->security;
4076 isec = ipc_perms->security;
4077
4078 AVC_AUDIT_DATA_INIT(&ad, IPC);
4079 ad.u.ipc_id = ipc_perms->key;
4080
4081 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4082 }
4083
4084 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4085 {
4086 return msg_msg_alloc_security(msg);
4087 }
4088
4089 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4090 {
4091 msg_msg_free_security(msg);
4092 }
4093
4094 /* message queue security operations */
4095 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4096 {
4097 struct task_security_struct *tsec;
4098 struct ipc_security_struct *isec;
4099 struct avc_audit_data ad;
4100 int rc;
4101
4102 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4103 if (rc)
4104 return rc;
4105
4106 tsec = current->security;
4107 isec = msq->q_perm.security;
4108
4109 AVC_AUDIT_DATA_INIT(&ad, IPC);
4110 ad.u.ipc_id = msq->q_perm.key;
4111
4112 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4113 MSGQ__CREATE, &ad);
4114 if (rc) {
4115 ipc_free_security(&msq->q_perm);
4116 return rc;
4117 }
4118 return 0;
4119 }
4120
4121 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4122 {
4123 ipc_free_security(&msq->q_perm);
4124 }
4125
4126 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4127 {
4128 struct task_security_struct *tsec;
4129 struct ipc_security_struct *isec;
4130 struct avc_audit_data ad;
4131
4132 tsec = current->security;
4133 isec = msq->q_perm.security;
4134
4135 AVC_AUDIT_DATA_INIT(&ad, IPC);
4136 ad.u.ipc_id = msq->q_perm.key;
4137
4138 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4139 MSGQ__ASSOCIATE, &ad);
4140 }
4141
4142 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4143 {
4144 int err;
4145 int perms;
4146
4147 switch(cmd) {
4148 case IPC_INFO:
4149 case MSG_INFO:
4150 /* No specific object, just general system-wide information. */
4151 return task_has_system(current, SYSTEM__IPC_INFO);
4152 case IPC_STAT:
4153 case MSG_STAT:
4154 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4155 break;
4156 case IPC_SET:
4157 perms = MSGQ__SETATTR;
4158 break;
4159 case IPC_RMID:
4160 perms = MSGQ__DESTROY;
4161 break;
4162 default:
4163 return 0;
4164 }
4165
4166 err = ipc_has_perm(&msq->q_perm, perms);
4167 return err;
4168 }
4169
4170 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4171 {
4172 struct task_security_struct *tsec;
4173 struct ipc_security_struct *isec;
4174 struct msg_security_struct *msec;
4175 struct avc_audit_data ad;
4176 int rc;
4177
4178 tsec = current->security;
4179 isec = msq->q_perm.security;
4180 msec = msg->security;
4181
4182 /*
4183 * First time through, need to assign label to the message
4184 */
4185 if (msec->sid == SECINITSID_UNLABELED) {
4186 /*
4187 * Compute new sid based on current process and
4188 * message queue this message will be stored in
4189 */
4190 rc = security_transition_sid(tsec->sid,
4191 isec->sid,
4192 SECCLASS_MSG,
4193 &msec->sid);
4194 if (rc)
4195 return rc;
4196 }
4197
4198 AVC_AUDIT_DATA_INIT(&ad, IPC);
4199 ad.u.ipc_id = msq->q_perm.key;
4200
4201 /* Can this process write to the queue? */
4202 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4203 MSGQ__WRITE, &ad);
4204 if (!rc)
4205 /* Can this process send the message */
4206 rc = avc_has_perm(tsec->sid, msec->sid,
4207 SECCLASS_MSG, MSG__SEND, &ad);
4208 if (!rc)
4209 /* Can the message be put in the queue? */
4210 rc = avc_has_perm(msec->sid, isec->sid,
4211 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4212
4213 return rc;
4214 }
4215
4216 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4217 struct task_struct *target,
4218 long type, int mode)
4219 {
4220 struct task_security_struct *tsec;
4221 struct ipc_security_struct *isec;
4222 struct msg_security_struct *msec;
4223 struct avc_audit_data ad;
4224 int rc;
4225
4226 tsec = target->security;
4227 isec = msq->q_perm.security;
4228 msec = msg->security;
4229
4230 AVC_AUDIT_DATA_INIT(&ad, IPC);
4231 ad.u.ipc_id = msq->q_perm.key;
4232
4233 rc = avc_has_perm(tsec->sid, isec->sid,
4234 SECCLASS_MSGQ, MSGQ__READ, &ad);
4235 if (!rc)
4236 rc = avc_has_perm(tsec->sid, msec->sid,
4237 SECCLASS_MSG, MSG__RECEIVE, &ad);
4238 return rc;
4239 }
4240
4241 /* Shared Memory security operations */
4242 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4243 {
4244 struct task_security_struct *tsec;
4245 struct ipc_security_struct *isec;
4246 struct avc_audit_data ad;
4247 int rc;
4248
4249 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4250 if (rc)
4251 return rc;
4252
4253 tsec = current->security;
4254 isec = shp->shm_perm.security;
4255
4256 AVC_AUDIT_DATA_INIT(&ad, IPC);
4257 ad.u.ipc_id = shp->shm_perm.key;
4258
4259 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4260 SHM__CREATE, &ad);
4261 if (rc) {
4262 ipc_free_security(&shp->shm_perm);
4263 return rc;
4264 }
4265 return 0;
4266 }
4267
4268 static void selinux_shm_free_security(struct shmid_kernel *shp)
4269 {
4270 ipc_free_security(&shp->shm_perm);
4271 }
4272
4273 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4274 {
4275 struct task_security_struct *tsec;
4276 struct ipc_security_struct *isec;
4277 struct avc_audit_data ad;
4278
4279 tsec = current->security;
4280 isec = shp->shm_perm.security;
4281
4282 AVC_AUDIT_DATA_INIT(&ad, IPC);
4283 ad.u.ipc_id = shp->shm_perm.key;
4284
4285 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4286 SHM__ASSOCIATE, &ad);
4287 }
4288
4289 /* Note, at this point, shp is locked down */
4290 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4291 {
4292 int perms;
4293 int err;
4294
4295 switch(cmd) {
4296 case IPC_INFO:
4297 case SHM_INFO:
4298 /* No specific object, just general system-wide information. */
4299 return task_has_system(current, SYSTEM__IPC_INFO);
4300 case IPC_STAT:
4301 case SHM_STAT:
4302 perms = SHM__GETATTR | SHM__ASSOCIATE;
4303 break;
4304 case IPC_SET:
4305 perms = SHM__SETATTR;
4306 break;
4307 case SHM_LOCK:
4308 case SHM_UNLOCK:
4309 perms = SHM__LOCK;
4310 break;
4311 case IPC_RMID:
4312 perms = SHM__DESTROY;
4313 break;
4314 default:
4315 return 0;
4316 }
4317
4318 err = ipc_has_perm(&shp->shm_perm, perms);
4319 return err;
4320 }
4321
4322 static int selinux_shm_shmat(struct shmid_kernel *shp,
4323 char __user *shmaddr, int shmflg)
4324 {
4325 u32 perms;
4326 int rc;
4327
4328 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4329 if (rc)
4330 return rc;
4331
4332 if (shmflg & SHM_RDONLY)
4333 perms = SHM__READ;
4334 else
4335 perms = SHM__READ | SHM__WRITE;
4336
4337 return ipc_has_perm(&shp->shm_perm, perms);
4338 }
4339
4340 /* Semaphore security operations */
4341 static int selinux_sem_alloc_security(struct sem_array *sma)
4342 {
4343 struct task_security_struct *tsec;
4344 struct ipc_security_struct *isec;
4345 struct avc_audit_data ad;
4346 int rc;
4347
4348 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4349 if (rc)
4350 return rc;
4351
4352 tsec = current->security;
4353 isec = sma->sem_perm.security;
4354
4355 AVC_AUDIT_DATA_INIT(&ad, IPC);
4356 ad.u.ipc_id = sma->sem_perm.key;
4357
4358 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4359 SEM__CREATE, &ad);
4360 if (rc) {
4361 ipc_free_security(&sma->sem_perm);
4362 return rc;
4363 }
4364 return 0;
4365 }
4366
4367 static void selinux_sem_free_security(struct sem_array *sma)
4368 {
4369 ipc_free_security(&sma->sem_perm);
4370 }
4371
4372 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4373 {
4374 struct task_security_struct *tsec;
4375 struct ipc_security_struct *isec;
4376 struct avc_audit_data ad;
4377
4378 tsec = current->security;
4379 isec = sma->sem_perm.security;
4380
4381 AVC_AUDIT_DATA_INIT(&ad, IPC);
4382 ad.u.ipc_id = sma->sem_perm.key;
4383
4384 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4385 SEM__ASSOCIATE, &ad);
4386 }
4387
4388 /* Note, at this point, sma is locked down */
4389 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4390 {
4391 int err;
4392 u32 perms;
4393
4394 switch(cmd) {
4395 case IPC_INFO:
4396 case SEM_INFO:
4397 /* No specific object, just general system-wide information. */
4398 return task_has_system(current, SYSTEM__IPC_INFO);
4399 case GETPID:
4400 case GETNCNT:
4401 case GETZCNT:
4402 perms = SEM__GETATTR;
4403 break;
4404 case GETVAL:
4405 case GETALL:
4406 perms = SEM__READ;
4407 break;
4408 case SETVAL:
4409 case SETALL:
4410 perms = SEM__WRITE;
4411 break;
4412 case IPC_RMID:
4413 perms = SEM__DESTROY;
4414 break;
4415 case IPC_SET:
4416 perms = SEM__SETATTR;
4417 break;
4418 case IPC_STAT:
4419 case SEM_STAT:
4420 perms = SEM__GETATTR | SEM__ASSOCIATE;
4421 break;
4422 default:
4423 return 0;
4424 }
4425
4426 err = ipc_has_perm(&sma->sem_perm, perms);
4427 return err;
4428 }
4429
4430 static int selinux_sem_semop(struct sem_array *sma,
4431 struct sembuf *sops, unsigned nsops, int alter)
4432 {
4433 u32 perms;
4434
4435 if (alter)
4436 perms = SEM__READ | SEM__WRITE;
4437 else
4438 perms = SEM__READ;
4439
4440 return ipc_has_perm(&sma->sem_perm, perms);
4441 }
4442
4443 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4444 {
4445 u32 av = 0;
4446
4447 av = 0;
4448 if (flag & S_IRUGO)
4449 av |= IPC__UNIX_READ;
4450 if (flag & S_IWUGO)
4451 av |= IPC__UNIX_WRITE;
4452
4453 if (av == 0)
4454 return 0;
4455
4456 return ipc_has_perm(ipcp, av);
4457 }
4458
4459 /* module stacking operations */
4460 static int selinux_register_security (const char *name, struct security_operations *ops)
4461 {
4462 if (secondary_ops != original_ops) {
4463 printk(KERN_ERR "%s: There is already a secondary security "
4464 "module registered.\n", __FUNCTION__);
4465 return -EINVAL;
4466 }
4467
4468 secondary_ops = ops;
4469
4470 printk(KERN_INFO "%s: Registering secondary module %s\n",
4471 __FUNCTION__,
4472 name);
4473
4474 return 0;
4475 }
4476
4477 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4478 {
4479 if (ops != secondary_ops) {
4480 printk(KERN_ERR "%s: trying to unregister a security module "
4481 "that is not registered.\n", __FUNCTION__);
4482 return -EINVAL;
4483 }
4484
4485 secondary_ops = original_ops;
4486
4487 return 0;
4488 }
4489
4490 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4491 {
4492 if (inode)
4493 inode_doinit_with_dentry(inode, dentry);
4494 }
4495
4496 static int selinux_getprocattr(struct task_struct *p,
4497 char *name, char **value)
4498 {
4499 struct task_security_struct *tsec;
4500 u32 sid;
4501 int error;
4502 unsigned len;
4503
4504 if (current != p) {
4505 error = task_has_perm(current, p, PROCESS__GETATTR);
4506 if (error)
4507 return error;
4508 }
4509
4510 tsec = p->security;
4511
4512 if (!strcmp(name, "current"))
4513 sid = tsec->sid;
4514 else if (!strcmp(name, "prev"))
4515 sid = tsec->osid;
4516 else if (!strcmp(name, "exec"))
4517 sid = tsec->exec_sid;
4518 else if (!strcmp(name, "fscreate"))
4519 sid = tsec->create_sid;
4520 else if (!strcmp(name, "keycreate"))
4521 sid = tsec->keycreate_sid;
4522 else if (!strcmp(name, "sockcreate"))
4523 sid = tsec->sockcreate_sid;
4524 else
4525 return -EINVAL;
4526
4527 if (!sid)
4528 return 0;
4529
4530 error = security_sid_to_context(sid, value, &len);
4531 if (error)
4532 return error;
4533 return len;
4534 }
4535
4536 static int selinux_setprocattr(struct task_struct *p,
4537 char *name, void *value, size_t size)
4538 {
4539 struct task_security_struct *tsec;
4540 u32 sid = 0;
4541 int error;
4542 char *str = value;
4543
4544 if (current != p) {
4545 /* SELinux only allows a process to change its own
4546 security attributes. */
4547 return -EACCES;
4548 }
4549
4550 /*
4551 * Basic control over ability to set these attributes at all.
4552 * current == p, but we'll pass them separately in case the
4553 * above restriction is ever removed.
4554 */
4555 if (!strcmp(name, "exec"))
4556 error = task_has_perm(current, p, PROCESS__SETEXEC);
4557 else if (!strcmp(name, "fscreate"))
4558 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4559 else if (!strcmp(name, "keycreate"))
4560 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4561 else if (!strcmp(name, "sockcreate"))
4562 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4563 else if (!strcmp(name, "current"))
4564 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4565 else
4566 error = -EINVAL;
4567 if (error)
4568 return error;
4569
4570 /* Obtain a SID for the context, if one was specified. */
4571 if (size && str[1] && str[1] != '\n') {
4572 if (str[size-1] == '\n') {
4573 str[size-1] = 0;
4574 size--;
4575 }
4576 error = security_context_to_sid(value, size, &sid);
4577 if (error)
4578 return error;
4579 }
4580
4581 /* Permission checking based on the specified context is
4582 performed during the actual operation (execve,
4583 open/mkdir/...), when we know the full context of the
4584 operation. See selinux_bprm_set_security for the execve
4585 checks and may_create for the file creation checks. The
4586 operation will then fail if the context is not permitted. */
4587 tsec = p->security;
4588 if (!strcmp(name, "exec"))
4589 tsec->exec_sid = sid;
4590 else if (!strcmp(name, "fscreate"))
4591 tsec->create_sid = sid;
4592 else if (!strcmp(name, "keycreate")) {
4593 error = may_create_key(sid, p);
4594 if (error)
4595 return error;
4596 tsec->keycreate_sid = sid;
4597 } else if (!strcmp(name, "sockcreate"))
4598 tsec->sockcreate_sid = sid;
4599 else if (!strcmp(name, "current")) {
4600 struct av_decision avd;
4601
4602 if (sid == 0)
4603 return -EINVAL;
4604
4605 /* Only allow single threaded processes to change context */
4606 if (atomic_read(&p->mm->mm_users) != 1) {
4607 struct task_struct *g, *t;
4608 struct mm_struct *mm = p->mm;
4609 read_lock(&tasklist_lock);
4610 do_each_thread(g, t)
4611 if (t->mm == mm && t != p) {
4612 read_unlock(&tasklist_lock);
4613 return -EPERM;
4614 }
4615 while_each_thread(g, t);
4616 read_unlock(&tasklist_lock);
4617 }
4618
4619 /* Check permissions for the transition. */
4620 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4621 PROCESS__DYNTRANSITION, NULL);
4622 if (error)
4623 return error;
4624
4625 /* Check for ptracing, and update the task SID if ok.
4626 Otherwise, leave SID unchanged and fail. */
4627 task_lock(p);
4628 if (p->ptrace & PT_PTRACED) {
4629 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4630 SECCLASS_PROCESS,
4631 PROCESS__PTRACE, &avd);
4632 if (!error)
4633 tsec->sid = sid;
4634 task_unlock(p);
4635 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4636 PROCESS__PTRACE, &avd, error, NULL);
4637 if (error)
4638 return error;
4639 } else {
4640 tsec->sid = sid;
4641 task_unlock(p);
4642 }
4643 }
4644 else
4645 return -EINVAL;
4646
4647 return size;
4648 }
4649
4650 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4651 {
4652 return security_sid_to_context(secid, secdata, seclen);
4653 }
4654
4655 static void selinux_release_secctx(char *secdata, u32 seclen)
4656 {
4657 if (secdata)
4658 kfree(secdata);
4659 }
4660
4661 #ifdef CONFIG_KEYS
4662
4663 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4664 unsigned long flags)
4665 {
4666 struct task_security_struct *tsec = tsk->security;
4667 struct key_security_struct *ksec;
4668
4669 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4670 if (!ksec)
4671 return -ENOMEM;
4672
4673 ksec->obj = k;
4674 if (tsec->keycreate_sid)
4675 ksec->sid = tsec->keycreate_sid;
4676 else
4677 ksec->sid = tsec->sid;
4678 k->security = ksec;
4679
4680 return 0;
4681 }
4682
4683 static void selinux_key_free(struct key *k)
4684 {
4685 struct key_security_struct *ksec = k->security;
4686
4687 k->security = NULL;
4688 kfree(ksec);
4689 }
4690
4691 static int selinux_key_permission(key_ref_t key_ref,
4692 struct task_struct *ctx,
4693 key_perm_t perm)
4694 {
4695 struct key *key;
4696 struct task_security_struct *tsec;
4697 struct key_security_struct *ksec;
4698
4699 key = key_ref_to_ptr(key_ref);
4700
4701 tsec = ctx->security;
4702 ksec = key->security;
4703
4704 /* if no specific permissions are requested, we skip the
4705 permission check. No serious, additional covert channels
4706 appear to be created. */
4707 if (perm == 0)
4708 return 0;
4709
4710 return avc_has_perm(tsec->sid, ksec->sid,
4711 SECCLASS_KEY, perm, NULL);
4712 }
4713
4714 #endif
4715
4716 static struct security_operations selinux_ops = {
4717 .ptrace = selinux_ptrace,
4718 .capget = selinux_capget,
4719 .capset_check = selinux_capset_check,
4720 .capset_set = selinux_capset_set,
4721 .sysctl = selinux_sysctl,
4722 .capable = selinux_capable,
4723 .quotactl = selinux_quotactl,
4724 .quota_on = selinux_quota_on,
4725 .syslog = selinux_syslog,
4726 .vm_enough_memory = selinux_vm_enough_memory,
4727
4728 .netlink_send = selinux_netlink_send,
4729 .netlink_recv = selinux_netlink_recv,
4730
4731 .bprm_alloc_security = selinux_bprm_alloc_security,
4732 .bprm_free_security = selinux_bprm_free_security,
4733 .bprm_apply_creds = selinux_bprm_apply_creds,
4734 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4735 .bprm_set_security = selinux_bprm_set_security,
4736 .bprm_check_security = selinux_bprm_check_security,
4737 .bprm_secureexec = selinux_bprm_secureexec,
4738
4739 .sb_alloc_security = selinux_sb_alloc_security,
4740 .sb_free_security = selinux_sb_free_security,
4741 .sb_copy_data = selinux_sb_copy_data,
4742 .sb_kern_mount = selinux_sb_kern_mount,
4743 .sb_statfs = selinux_sb_statfs,
4744 .sb_mount = selinux_mount,
4745 .sb_umount = selinux_umount,
4746
4747 .inode_alloc_security = selinux_inode_alloc_security,
4748 .inode_free_security = selinux_inode_free_security,
4749 .inode_init_security = selinux_inode_init_security,
4750 .inode_create = selinux_inode_create,
4751 .inode_link = selinux_inode_link,
4752 .inode_unlink = selinux_inode_unlink,
4753 .inode_symlink = selinux_inode_symlink,
4754 .inode_mkdir = selinux_inode_mkdir,
4755 .inode_rmdir = selinux_inode_rmdir,
4756 .inode_mknod = selinux_inode_mknod,
4757 .inode_rename = selinux_inode_rename,
4758 .inode_readlink = selinux_inode_readlink,
4759 .inode_follow_link = selinux_inode_follow_link,
4760 .inode_permission = selinux_inode_permission,
4761 .inode_setattr = selinux_inode_setattr,
4762 .inode_getattr = selinux_inode_getattr,
4763 .inode_setxattr = selinux_inode_setxattr,
4764 .inode_post_setxattr = selinux_inode_post_setxattr,
4765 .inode_getxattr = selinux_inode_getxattr,
4766 .inode_listxattr = selinux_inode_listxattr,
4767 .inode_removexattr = selinux_inode_removexattr,
4768 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4769 .inode_getsecurity = selinux_inode_getsecurity,
4770 .inode_setsecurity = selinux_inode_setsecurity,
4771 .inode_listsecurity = selinux_inode_listsecurity,
4772
4773 .file_permission = selinux_file_permission,
4774 .file_alloc_security = selinux_file_alloc_security,
4775 .file_free_security = selinux_file_free_security,
4776 .file_ioctl = selinux_file_ioctl,
4777 .file_mmap = selinux_file_mmap,
4778 .file_mprotect = selinux_file_mprotect,
4779 .file_lock = selinux_file_lock,
4780 .file_fcntl = selinux_file_fcntl,
4781 .file_set_fowner = selinux_file_set_fowner,
4782 .file_send_sigiotask = selinux_file_send_sigiotask,
4783 .file_receive = selinux_file_receive,
4784
4785 .task_create = selinux_task_create,
4786 .task_alloc_security = selinux_task_alloc_security,
4787 .task_free_security = selinux_task_free_security,
4788 .task_setuid = selinux_task_setuid,
4789 .task_post_setuid = selinux_task_post_setuid,
4790 .task_setgid = selinux_task_setgid,
4791 .task_setpgid = selinux_task_setpgid,
4792 .task_getpgid = selinux_task_getpgid,
4793 .task_getsid = selinux_task_getsid,
4794 .task_getsecid = selinux_task_getsecid,
4795 .task_setgroups = selinux_task_setgroups,
4796 .task_setnice = selinux_task_setnice,
4797 .task_setioprio = selinux_task_setioprio,
4798 .task_getioprio = selinux_task_getioprio,
4799 .task_setrlimit = selinux_task_setrlimit,
4800 .task_setscheduler = selinux_task_setscheduler,
4801 .task_getscheduler = selinux_task_getscheduler,
4802 .task_movememory = selinux_task_movememory,
4803 .task_kill = selinux_task_kill,
4804 .task_wait = selinux_task_wait,
4805 .task_prctl = selinux_task_prctl,
4806 .task_reparent_to_init = selinux_task_reparent_to_init,
4807 .task_to_inode = selinux_task_to_inode,
4808
4809 .ipc_permission = selinux_ipc_permission,
4810
4811 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4812 .msg_msg_free_security = selinux_msg_msg_free_security,
4813
4814 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4815 .msg_queue_free_security = selinux_msg_queue_free_security,
4816 .msg_queue_associate = selinux_msg_queue_associate,
4817 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4818 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4819 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4820
4821 .shm_alloc_security = selinux_shm_alloc_security,
4822 .shm_free_security = selinux_shm_free_security,
4823 .shm_associate = selinux_shm_associate,
4824 .shm_shmctl = selinux_shm_shmctl,
4825 .shm_shmat = selinux_shm_shmat,
4826
4827 .sem_alloc_security = selinux_sem_alloc_security,
4828 .sem_free_security = selinux_sem_free_security,
4829 .sem_associate = selinux_sem_associate,
4830 .sem_semctl = selinux_sem_semctl,
4831 .sem_semop = selinux_sem_semop,
4832
4833 .register_security = selinux_register_security,
4834 .unregister_security = selinux_unregister_security,
4835
4836 .d_instantiate = selinux_d_instantiate,
4837
4838 .getprocattr = selinux_getprocattr,
4839 .setprocattr = selinux_setprocattr,
4840
4841 .secid_to_secctx = selinux_secid_to_secctx,
4842 .release_secctx = selinux_release_secctx,
4843
4844 .unix_stream_connect = selinux_socket_unix_stream_connect,
4845 .unix_may_send = selinux_socket_unix_may_send,
4846
4847 .socket_create = selinux_socket_create,
4848 .socket_post_create = selinux_socket_post_create,
4849 .socket_bind = selinux_socket_bind,
4850 .socket_connect = selinux_socket_connect,
4851 .socket_listen = selinux_socket_listen,
4852 .socket_accept = selinux_socket_accept,
4853 .socket_sendmsg = selinux_socket_sendmsg,
4854 .socket_recvmsg = selinux_socket_recvmsg,
4855 .socket_getsockname = selinux_socket_getsockname,
4856 .socket_getpeername = selinux_socket_getpeername,
4857 .socket_getsockopt = selinux_socket_getsockopt,
4858 .socket_setsockopt = selinux_socket_setsockopt,
4859 .socket_shutdown = selinux_socket_shutdown,
4860 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4861 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4862 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4863 .sk_alloc_security = selinux_sk_alloc_security,
4864 .sk_free_security = selinux_sk_free_security,
4865 .sk_clone_security = selinux_sk_clone_security,
4866 .sk_getsecid = selinux_sk_getsecid,
4867 .sock_graft = selinux_sock_graft,
4868 .inet_conn_request = selinux_inet_conn_request,
4869 .inet_csk_clone = selinux_inet_csk_clone,
4870 .inet_conn_established = selinux_inet_conn_established,
4871 .req_classify_flow = selinux_req_classify_flow,
4872
4873 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4874 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4875 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4876 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4877 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4878 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4879 .xfrm_state_free_security = selinux_xfrm_state_free,
4880 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4881 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4882 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
4883 .xfrm_decode_session = selinux_xfrm_decode_session,
4884 #endif
4885
4886 #ifdef CONFIG_KEYS
4887 .key_alloc = selinux_key_alloc,
4888 .key_free = selinux_key_free,
4889 .key_permission = selinux_key_permission,
4890 #endif
4891 };
4892
4893 static __init int selinux_init(void)
4894 {
4895 struct task_security_struct *tsec;
4896
4897 if (!selinux_enabled) {
4898 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4899 return 0;
4900 }
4901
4902 printk(KERN_INFO "SELinux: Initializing.\n");
4903
4904 /* Set the security state for the initial task. */
4905 if (task_alloc_security(current))
4906 panic("SELinux: Failed to initialize initial task.\n");
4907 tsec = current->security;
4908 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4909
4910 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4911 sizeof(struct inode_security_struct),
4912 0, SLAB_PANIC, NULL, NULL);
4913 avc_init();
4914
4915 original_ops = secondary_ops = security_ops;
4916 if (!secondary_ops)
4917 panic ("SELinux: No initial security operations\n");
4918 if (register_security (&selinux_ops))
4919 panic("SELinux: Unable to register with kernel.\n");
4920
4921 if (selinux_enforcing) {
4922 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
4923 } else {
4924 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
4925 }
4926
4927 #ifdef CONFIG_KEYS
4928 /* Add security information to initial keyrings */
4929 selinux_key_alloc(&root_user_keyring, current,
4930 KEY_ALLOC_NOT_IN_QUOTA);
4931 selinux_key_alloc(&root_session_keyring, current,
4932 KEY_ALLOC_NOT_IN_QUOTA);
4933 #endif
4934
4935 return 0;
4936 }
4937
4938 void selinux_complete_init(void)
4939 {
4940 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
4941
4942 /* Set up any superblocks initialized prior to the policy load. */
4943 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
4944 spin_lock(&sb_lock);
4945 spin_lock(&sb_security_lock);
4946 next_sb:
4947 if (!list_empty(&superblock_security_head)) {
4948 struct superblock_security_struct *sbsec =
4949 list_entry(superblock_security_head.next,
4950 struct superblock_security_struct,
4951 list);
4952 struct super_block *sb = sbsec->sb;
4953 sb->s_count++;
4954 spin_unlock(&sb_security_lock);
4955 spin_unlock(&sb_lock);
4956 down_read(&sb->s_umount);
4957 if (sb->s_root)
4958 superblock_doinit(sb, NULL);
4959 drop_super(sb);
4960 spin_lock(&sb_lock);
4961 spin_lock(&sb_security_lock);
4962 list_del_init(&sbsec->list);
4963 goto next_sb;
4964 }
4965 spin_unlock(&sb_security_lock);
4966 spin_unlock(&sb_lock);
4967 }
4968
4969 /* SELinux requires early initialization in order to label
4970 all processes and objects when they are created. */
4971 security_initcall(selinux_init);
4972
4973 #if defined(CONFIG_NETFILTER)
4974
4975 static struct nf_hook_ops selinux_ipv4_op = {
4976 .hook = selinux_ipv4_postroute_last,
4977 .owner = THIS_MODULE,
4978 .pf = PF_INET,
4979 .hooknum = NF_IP_POST_ROUTING,
4980 .priority = NF_IP_PRI_SELINUX_LAST,
4981 };
4982
4983 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4984
4985 static struct nf_hook_ops selinux_ipv6_op = {
4986 .hook = selinux_ipv6_postroute_last,
4987 .owner = THIS_MODULE,
4988 .pf = PF_INET6,
4989 .hooknum = NF_IP6_POST_ROUTING,
4990 .priority = NF_IP6_PRI_SELINUX_LAST,
4991 };
4992
4993 #endif /* IPV6 */
4994
4995 static int __init selinux_nf_ip_init(void)
4996 {
4997 int err = 0;
4998
4999 if (!selinux_enabled)
5000 goto out;
5001
5002 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5003
5004 err = nf_register_hook(&selinux_ipv4_op);
5005 if (err)
5006 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5007
5008 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5009
5010 err = nf_register_hook(&selinux_ipv6_op);
5011 if (err)
5012 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5013
5014 #endif /* IPV6 */
5015
5016 out:
5017 return err;
5018 }
5019
5020 __initcall(selinux_nf_ip_init);
5021
5022 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5023 static void selinux_nf_ip_exit(void)
5024 {
5025 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5026
5027 nf_unregister_hook(&selinux_ipv4_op);
5028 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5029 nf_unregister_hook(&selinux_ipv6_op);
5030 #endif /* IPV6 */
5031 }
5032 #endif
5033
5034 #else /* CONFIG_NETFILTER */
5035
5036 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5037 #define selinux_nf_ip_exit()
5038 #endif
5039
5040 #endif /* CONFIG_NETFILTER */
5041
5042 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5043 int selinux_disable(void)
5044 {
5045 extern void exit_sel_fs(void);
5046 static int selinux_disabled = 0;
5047
5048 if (ss_initialized) {
5049 /* Not permitted after initial policy load. */
5050 return -EINVAL;
5051 }
5052
5053 if (selinux_disabled) {
5054 /* Only do this once. */
5055 return -EINVAL;
5056 }
5057
5058 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5059
5060 selinux_disabled = 1;
5061 selinux_enabled = 0;
5062
5063 /* Reset security_ops to the secondary module, dummy or capability. */
5064 security_ops = secondary_ops;
5065
5066 /* Unregister netfilter hooks. */
5067 selinux_nf_ip_exit();
5068
5069 /* Unregister selinuxfs. */
5070 exit_sel_fs();
5071
5072 return 0;
5073 }
5074 #endif
5075
5076
ubuntu-bionic-kernel mirror