]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-artful-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
selinux: only invoke capabilities and selinux for CAP_MAC_ADMIN checks
[mirror_ubuntu-artful-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched/signal.h>
32 #include <linux/sched/task.h>
33 #include <linux/lsm_hooks.h>
34 #include <linux/xattr.h>
35 #include <linux/capability.h>
36 #include <linux/unistd.h>
37 #include <linux/mm.h>
38 #include <linux/mman.h>
39 #include <linux/slab.h>
40 #include <linux/pagemap.h>
41 #include <linux/proc_fs.h>
42 #include <linux/swap.h>
43 #include <linux/spinlock.h>
44 #include <linux/syscalls.h>
45 #include <linux/dcache.h>
46 #include <linux/file.h>
47 #include <linux/fdtable.h>
48 #include <linux/namei.h>
49 #include <linux/mount.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
53 #include <net/icmp.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 /* SECMARK reference count */
99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
100
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
103
104 static int __init enforcing_setup(char *str)
105 {
106 unsigned long enforcing;
107 if (!kstrtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
109 return 1;
110 }
111 __setup("enforcing=", enforcing_setup);
112 #endif
113
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117 static int __init selinux_enabled_setup(char *str)
118 {
119 unsigned long enabled;
120 if (!kstrtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
122 return 1;
123 }
124 __setup("selinux=", selinux_enabled_setup);
125 #else
126 int selinux_enabled = 1;
127 #endif
128
129 static struct kmem_cache *sel_inode_cache;
130 static struct kmem_cache *file_security_cache;
131
132 /**
133 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
134 *
135 * Description:
136 * This function checks the SECMARK reference counter to see if any SECMARK
137 * targets are currently configured, if the reference counter is greater than
138 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
139 * enabled, false (0) if SECMARK is disabled. If the always_check_network
140 * policy capability is enabled, SECMARK is always considered enabled.
141 *
142 */
143 static int selinux_secmark_enabled(void)
144 {
145 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
146 }
147
148 /**
149 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
150 *
151 * Description:
152 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
153 * (1) if any are enabled or false (0) if neither are enabled. If the
154 * always_check_network policy capability is enabled, peer labeling
155 * is always considered enabled.
156 *
157 */
158 static int selinux_peerlbl_enabled(void)
159 {
160 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
161 }
162
163 static int selinux_netcache_avc_callback(u32 event)
164 {
165 if (event == AVC_CALLBACK_RESET) {
166 sel_netif_flush();
167 sel_netnode_flush();
168 sel_netport_flush();
169 synchronize_net();
170 }
171 return 0;
172 }
173
174 /*
175 * initialise the security for the init task
176 */
177 static void cred_init_security(void)
178 {
179 struct cred *cred = (struct cred *) current->real_cred;
180 struct task_security_struct *tsec;
181
182 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
183 if (!tsec)
184 panic("SELinux: Failed to initialize initial task.\n");
185
186 tsec->osid = tsec->sid = SECINITSID_KERNEL;
187 cred->security = tsec;
188 }
189
190 /*
191 * get the security ID of a set of credentials
192 */
193 static inline u32 cred_sid(const struct cred *cred)
194 {
195 const struct task_security_struct *tsec;
196
197 tsec = cred->security;
198 return tsec->sid;
199 }
200
201 /*
202 * get the objective security ID of a task
203 */
204 static inline u32 task_sid(const struct task_struct *task)
205 {
206 u32 sid;
207
208 rcu_read_lock();
209 sid = cred_sid(__task_cred(task));
210 rcu_read_unlock();
211 return sid;
212 }
213
214 /* Allocate and free functions for each kind of security blob. */
215
216 static int inode_alloc_security(struct inode *inode)
217 {
218 struct inode_security_struct *isec;
219 u32 sid = current_sid();
220
221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
222 if (!isec)
223 return -ENOMEM;
224
225 spin_lock_init(&isec->lock);
226 INIT_LIST_HEAD(&isec->list);
227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
230 isec->task_sid = sid;
231 isec->initialized = LABEL_INVALID;
232 inode->i_security = isec;
233
234 return 0;
235 }
236
237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
238
239 /*
240 * Try reloading inode security labels that have been marked as invalid. The
241 * @may_sleep parameter indicates when sleeping and thus reloading labels is
242 * allowed; when set to false, returns -ECHILD when the label is
243 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
244 * when no dentry is available, set it to NULL instead.
245 */
246 static int __inode_security_revalidate(struct inode *inode,
247 struct dentry *opt_dentry,
248 bool may_sleep)
249 {
250 struct inode_security_struct *isec = inode->i_security;
251
252 might_sleep_if(may_sleep);
253
254 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
255 if (!may_sleep)
256 return -ECHILD;
257
258 /*
259 * Try reloading the inode security label. This will fail if
260 * @opt_dentry is NULL and no dentry for this inode can be
261 * found; in that case, continue using the old label.
262 */
263 inode_doinit_with_dentry(inode, opt_dentry);
264 }
265 return 0;
266 }
267
268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
269 {
270 return inode->i_security;
271 }
272
273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
274 {
275 int error;
276
277 error = __inode_security_revalidate(inode, NULL, !rcu);
278 if (error)
279 return ERR_PTR(error);
280 return inode->i_security;
281 }
282
283 /*
284 * Get the security label of an inode.
285 */
286 static struct inode_security_struct *inode_security(struct inode *inode)
287 {
288 __inode_security_revalidate(inode, NULL, true);
289 return inode->i_security;
290 }
291
292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
293 {
294 struct inode *inode = d_backing_inode(dentry);
295
296 return inode->i_security;
297 }
298
299 /*
300 * Get the security label of a dentry's backing inode.
301 */
302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
303 {
304 struct inode *inode = d_backing_inode(dentry);
305
306 __inode_security_revalidate(inode, dentry, true);
307 return inode->i_security;
308 }
309
310 static void inode_free_rcu(struct rcu_head *head)
311 {
312 struct inode_security_struct *isec;
313
314 isec = container_of(head, struct inode_security_struct, rcu);
315 kmem_cache_free(sel_inode_cache, isec);
316 }
317
318 static void inode_free_security(struct inode *inode)
319 {
320 struct inode_security_struct *isec = inode->i_security;
321 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
322
323 /*
324 * As not all inode security structures are in a list, we check for
325 * empty list outside of the lock to make sure that we won't waste
326 * time taking a lock doing nothing.
327 *
328 * The list_del_init() function can be safely called more than once.
329 * It should not be possible for this function to be called with
330 * concurrent list_add(), but for better safety against future changes
331 * in the code, we use list_empty_careful() here.
332 */
333 if (!list_empty_careful(&isec->list)) {
334 spin_lock(&sbsec->isec_lock);
335 list_del_init(&isec->list);
336 spin_unlock(&sbsec->isec_lock);
337 }
338
339 /*
340 * The inode may still be referenced in a path walk and
341 * a call to selinux_inode_permission() can be made
342 * after inode_free_security() is called. Ideally, the VFS
343 * wouldn't do this, but fixing that is a much harder
344 * job. For now, simply free the i_security via RCU, and
345 * leave the current inode->i_security pointer intact.
346 * The inode will be freed after the RCU grace period too.
347 */
348 call_rcu(&isec->rcu, inode_free_rcu);
349 }
350
351 static int file_alloc_security(struct file *file)
352 {
353 struct file_security_struct *fsec;
354 u32 sid = current_sid();
355
356 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
357 if (!fsec)
358 return -ENOMEM;
359
360 fsec->sid = sid;
361 fsec->fown_sid = sid;
362 file->f_security = fsec;
363
364 return 0;
365 }
366
367 static void file_free_security(struct file *file)
368 {
369 struct file_security_struct *fsec = file->f_security;
370 file->f_security = NULL;
371 kmem_cache_free(file_security_cache, fsec);
372 }
373
374 static int superblock_alloc_security(struct super_block *sb)
375 {
376 struct superblock_security_struct *sbsec;
377
378 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
379 if (!sbsec)
380 return -ENOMEM;
381
382 mutex_init(&sbsec->lock);
383 INIT_LIST_HEAD(&sbsec->isec_head);
384 spin_lock_init(&sbsec->isec_lock);
385 sbsec->sb = sb;
386 sbsec->sid = SECINITSID_UNLABELED;
387 sbsec->def_sid = SECINITSID_FILE;
388 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
389 sb->s_security = sbsec;
390
391 return 0;
392 }
393
394 static void superblock_free_security(struct super_block *sb)
395 {
396 struct superblock_security_struct *sbsec = sb->s_security;
397 sb->s_security = NULL;
398 kfree(sbsec);
399 }
400
401 /* The file system's label must be initialized prior to use. */
402
403 static const char *labeling_behaviors[7] = {
404 "uses xattr",
405 "uses transition SIDs",
406 "uses task SIDs",
407 "uses genfs_contexts",
408 "not configured for labeling",
409 "uses mountpoint labeling",
410 "uses native labeling",
411 };
412
413 static inline int inode_doinit(struct inode *inode)
414 {
415 return inode_doinit_with_dentry(inode, NULL);
416 }
417
418 enum {
419 Opt_error = -1,
420 Opt_context = 1,
421 Opt_fscontext = 2,
422 Opt_defcontext = 3,
423 Opt_rootcontext = 4,
424 Opt_labelsupport = 5,
425 Opt_nextmntopt = 6,
426 };
427
428 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429
430 static const match_table_t tokens = {
431 {Opt_context, CONTEXT_STR "%s"},
432 {Opt_fscontext, FSCONTEXT_STR "%s"},
433 {Opt_defcontext, DEFCONTEXT_STR "%s"},
434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
435 {Opt_labelsupport, LABELSUPP_STR},
436 {Opt_error, NULL},
437 };
438
439 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440
441 static int may_context_mount_sb_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
443 const struct cred *cred)
444 {
445 const struct task_security_struct *tsec = cred->security;
446 int rc;
447
448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
449 FILESYSTEM__RELABELFROM, NULL);
450 if (rc)
451 return rc;
452
453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELTO, NULL);
455 return rc;
456 }
457
458 static int may_context_mount_inode_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
460 const struct cred *cred)
461 {
462 const struct task_security_struct *tsec = cred->security;
463 int rc;
464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
466 if (rc)
467 return rc;
468
469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
470 FILESYSTEM__ASSOCIATE, NULL);
471 return rc;
472 }
473
474 static int selinux_is_sblabel_mnt(struct super_block *sb)
475 {
476 struct superblock_security_struct *sbsec = sb->s_security;
477
478 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
479 sbsec->behavior == SECURITY_FS_USE_TRANS ||
480 sbsec->behavior == SECURITY_FS_USE_TASK ||
481 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
482 /* Special handling. Genfs but also in-core setxattr handler */
483 !strcmp(sb->s_type->name, "sysfs") ||
484 !strcmp(sb->s_type->name, "pstore") ||
485 !strcmp(sb->s_type->name, "debugfs") ||
486 !strcmp(sb->s_type->name, "tracefs") ||
487 !strcmp(sb->s_type->name, "rootfs") ||
488 (selinux_policycap_cgroupseclabel &&
489 (!strcmp(sb->s_type->name, "cgroup") ||
490 !strcmp(sb->s_type->name, "cgroup2")));
491 }
492
493 static int sb_finish_set_opts(struct super_block *sb)
494 {
495 struct superblock_security_struct *sbsec = sb->s_security;
496 struct dentry *root = sb->s_root;
497 struct inode *root_inode = d_backing_inode(root);
498 int rc = 0;
499
500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
501 /* Make sure that the xattr handler exists and that no
502 error other than -ENODATA is returned by getxattr on
503 the root directory. -ENODATA is ok, as this may be
504 the first boot of the SELinux kernel before we have
505 assigned xattr values to the filesystem. */
506 if (!(root_inode->i_opflags & IOP_XATTR)) {
507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
508 "xattr support\n", sb->s_id, sb->s_type->name);
509 rc = -EOPNOTSUPP;
510 goto out;
511 }
512
513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
514 if (rc < 0 && rc != -ENODATA) {
515 if (rc == -EOPNOTSUPP)
516 printk(KERN_WARNING "SELinux: (dev %s, type "
517 "%s) has no security xattr handler\n",
518 sb->s_id, sb->s_type->name);
519 else
520 printk(KERN_WARNING "SELinux: (dev %s, type "
521 "%s) getxattr errno %d\n", sb->s_id,
522 sb->s_type->name, -rc);
523 goto out;
524 }
525 }
526
527 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
528 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
529 sb->s_id, sb->s_type->name);
530
531 sbsec->flags |= SE_SBINITIALIZED;
532 if (selinux_is_sblabel_mnt(sb))
533 sbsec->flags |= SBLABEL_MNT;
534
535 /* Initialize the root inode. */
536 rc = inode_doinit_with_dentry(root_inode, root);
537
538 /* Initialize any other inodes associated with the superblock, e.g.
539 inodes created prior to initial policy load or inodes created
540 during get_sb by a pseudo filesystem that directly
541 populates itself. */
542 spin_lock(&sbsec->isec_lock);
543 next_inode:
544 if (!list_empty(&sbsec->isec_head)) {
545 struct inode_security_struct *isec =
546 list_entry(sbsec->isec_head.next,
547 struct inode_security_struct, list);
548 struct inode *inode = isec->inode;
549 list_del_init(&isec->list);
550 spin_unlock(&sbsec->isec_lock);
551 inode = igrab(inode);
552 if (inode) {
553 if (!IS_PRIVATE(inode))
554 inode_doinit(inode);
555 iput(inode);
556 }
557 spin_lock(&sbsec->isec_lock);
558 goto next_inode;
559 }
560 spin_unlock(&sbsec->isec_lock);
561 out:
562 return rc;
563 }
564
565 /*
566 * This function should allow an FS to ask what it's mount security
567 * options were so it can use those later for submounts, displaying
568 * mount options, or whatever.
569 */
570 static int selinux_get_mnt_opts(const struct super_block *sb,
571 struct security_mnt_opts *opts)
572 {
573 int rc = 0, i;
574 struct superblock_security_struct *sbsec = sb->s_security;
575 char *context = NULL;
576 u32 len;
577 char tmp;
578
579 security_init_mnt_opts(opts);
580
581 if (!(sbsec->flags & SE_SBINITIALIZED))
582 return -EINVAL;
583
584 if (!ss_initialized)
585 return -EINVAL;
586
587 /* make sure we always check enough bits to cover the mask */
588 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
589
590 tmp = sbsec->flags & SE_MNTMASK;
591 /* count the number of mount options for this sb */
592 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
593 if (tmp & 0x01)
594 opts->num_mnt_opts++;
595 tmp >>= 1;
596 }
597 /* Check if the Label support flag is set */
598 if (sbsec->flags & SBLABEL_MNT)
599 opts->num_mnt_opts++;
600
601 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
602 if (!opts->mnt_opts) {
603 rc = -ENOMEM;
604 goto out_free;
605 }
606
607 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
608 if (!opts->mnt_opts_flags) {
609 rc = -ENOMEM;
610 goto out_free;
611 }
612
613 i = 0;
614 if (sbsec->flags & FSCONTEXT_MNT) {
615 rc = security_sid_to_context(sbsec->sid, &context, &len);
616 if (rc)
617 goto out_free;
618 opts->mnt_opts[i] = context;
619 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
620 }
621 if (sbsec->flags & CONTEXT_MNT) {
622 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
623 if (rc)
624 goto out_free;
625 opts->mnt_opts[i] = context;
626 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
627 }
628 if (sbsec->flags & DEFCONTEXT_MNT) {
629 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
630 if (rc)
631 goto out_free;
632 opts->mnt_opts[i] = context;
633 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
634 }
635 if (sbsec->flags & ROOTCONTEXT_MNT) {
636 struct dentry *root = sbsec->sb->s_root;
637 struct inode_security_struct *isec = backing_inode_security(root);
638
639 rc = security_sid_to_context(isec->sid, &context, &len);
640 if (rc)
641 goto out_free;
642 opts->mnt_opts[i] = context;
643 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
644 }
645 if (sbsec->flags & SBLABEL_MNT) {
646 opts->mnt_opts[i] = NULL;
647 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
648 }
649
650 BUG_ON(i != opts->num_mnt_opts);
651
652 return 0;
653
654 out_free:
655 security_free_mnt_opts(opts);
656 return rc;
657 }
658
659 static int bad_option(struct superblock_security_struct *sbsec, char flag,
660 u32 old_sid, u32 new_sid)
661 {
662 char mnt_flags = sbsec->flags & SE_MNTMASK;
663
664 /* check if the old mount command had the same options */
665 if (sbsec->flags & SE_SBINITIALIZED)
666 if (!(sbsec->flags & flag) ||
667 (old_sid != new_sid))
668 return 1;
669
670 /* check if we were passed the same options twice,
671 * aka someone passed context=a,context=b
672 */
673 if (!(sbsec->flags & SE_SBINITIALIZED))
674 if (mnt_flags & flag)
675 return 1;
676 return 0;
677 }
678
679 /*
680 * Allow filesystems with binary mount data to explicitly set mount point
681 * labeling information.
682 */
683 static int selinux_set_mnt_opts(struct super_block *sb,
684 struct security_mnt_opts *opts,
685 unsigned long kern_flags,
686 unsigned long *set_kern_flags)
687 {
688 const struct cred *cred = current_cred();
689 int rc = 0, i;
690 struct superblock_security_struct *sbsec = sb->s_security;
691 const char *name = sb->s_type->name;
692 struct dentry *root = sbsec->sb->s_root;
693 struct inode_security_struct *root_isec;
694 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
695 u32 defcontext_sid = 0;
696 char **mount_options = opts->mnt_opts;
697 int *flags = opts->mnt_opts_flags;
698 int num_opts = opts->num_mnt_opts;
699
700 mutex_lock(&sbsec->lock);
701
702 if (!ss_initialized) {
703 if (!num_opts) {
704 /* Defer initialization until selinux_complete_init,
705 after the initial policy is loaded and the security
706 server is ready to handle calls. */
707 goto out;
708 }
709 rc = -EINVAL;
710 printk(KERN_WARNING "SELinux: Unable to set superblock options "
711 "before the security server is initialized\n");
712 goto out;
713 }
714 if (kern_flags && !set_kern_flags) {
715 /* Specifying internal flags without providing a place to
716 * place the results is not allowed */
717 rc = -EINVAL;
718 goto out;
719 }
720
721 /*
722 * Binary mount data FS will come through this function twice. Once
723 * from an explicit call and once from the generic calls from the vfs.
724 * Since the generic VFS calls will not contain any security mount data
725 * we need to skip the double mount verification.
726 *
727 * This does open a hole in which we will not notice if the first
728 * mount using this sb set explict options and a second mount using
729 * this sb does not set any security options. (The first options
730 * will be used for both mounts)
731 */
732 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
733 && (num_opts == 0))
734 goto out;
735
736 root_isec = backing_inode_security_novalidate(root);
737
738 /*
739 * parse the mount options, check if they are valid sids.
740 * also check if someone is trying to mount the same sb more
741 * than once with different security options.
742 */
743 for (i = 0; i < num_opts; i++) {
744 u32 sid;
745
746 if (flags[i] == SBLABEL_MNT)
747 continue;
748 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
749 if (rc) {
750 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
751 "(%s) failed for (dev %s, type %s) errno=%d\n",
752 mount_options[i], sb->s_id, name, rc);
753 goto out;
754 }
755 switch (flags[i]) {
756 case FSCONTEXT_MNT:
757 fscontext_sid = sid;
758
759 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
760 fscontext_sid))
761 goto out_double_mount;
762
763 sbsec->flags |= FSCONTEXT_MNT;
764 break;
765 case CONTEXT_MNT:
766 context_sid = sid;
767
768 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
769 context_sid))
770 goto out_double_mount;
771
772 sbsec->flags |= CONTEXT_MNT;
773 break;
774 case ROOTCONTEXT_MNT:
775 rootcontext_sid = sid;
776
777 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
778 rootcontext_sid))
779 goto out_double_mount;
780
781 sbsec->flags |= ROOTCONTEXT_MNT;
782
783 break;
784 case DEFCONTEXT_MNT:
785 defcontext_sid = sid;
786
787 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
788 defcontext_sid))
789 goto out_double_mount;
790
791 sbsec->flags |= DEFCONTEXT_MNT;
792
793 break;
794 default:
795 rc = -EINVAL;
796 goto out;
797 }
798 }
799
800 if (sbsec->flags & SE_SBINITIALIZED) {
801 /* previously mounted with options, but not on this attempt? */
802 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
803 goto out_double_mount;
804 rc = 0;
805 goto out;
806 }
807
808 if (strcmp(sb->s_type->name, "proc") == 0)
809 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
810
811 if (!strcmp(sb->s_type->name, "debugfs") ||
812 !strcmp(sb->s_type->name, "sysfs") ||
813 !strcmp(sb->s_type->name, "pstore"))
814 sbsec->flags |= SE_SBGENFS;
815
816 if (!sbsec->behavior) {
817 /*
818 * Determine the labeling behavior to use for this
819 * filesystem type.
820 */
821 rc = security_fs_use(sb);
822 if (rc) {
823 printk(KERN_WARNING
824 "%s: security_fs_use(%s) returned %d\n",
825 __func__, sb->s_type->name, rc);
826 goto out;
827 }
828 }
829
830 /*
831 * If this is a user namespace mount and the filesystem type is not
832 * explicitly whitelisted, then no contexts are allowed on the command
833 * line and security labels must be ignored.
834 */
835 if (sb->s_user_ns != &init_user_ns &&
836 strcmp(sb->s_type->name, "tmpfs") &&
837 strcmp(sb->s_type->name, "ramfs") &&
838 strcmp(sb->s_type->name, "devpts")) {
839 if (context_sid || fscontext_sid || rootcontext_sid ||
840 defcontext_sid) {
841 rc = -EACCES;
842 goto out;
843 }
844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 rc = security_transition_sid(current_sid(), current_sid(),
847 SECCLASS_FILE, NULL,
848 &sbsec->mntpoint_sid);
849 if (rc)
850 goto out;
851 }
852 goto out_set_opts;
853 }
854
855 /* sets the context of the superblock for the fs being mounted. */
856 if (fscontext_sid) {
857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
858 if (rc)
859 goto out;
860
861 sbsec->sid = fscontext_sid;
862 }
863
864 /*
865 * Switch to using mount point labeling behavior.
866 * sets the label used on all file below the mountpoint, and will set
867 * the superblock context if not already set.
868 */
869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
872 }
873
874 if (context_sid) {
875 if (!fscontext_sid) {
876 rc = may_context_mount_sb_relabel(context_sid, sbsec,
877 cred);
878 if (rc)
879 goto out;
880 sbsec->sid = context_sid;
881 } else {
882 rc = may_context_mount_inode_relabel(context_sid, sbsec,
883 cred);
884 if (rc)
885 goto out;
886 }
887 if (!rootcontext_sid)
888 rootcontext_sid = context_sid;
889
890 sbsec->mntpoint_sid = context_sid;
891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
892 }
893
894 if (rootcontext_sid) {
895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
896 cred);
897 if (rc)
898 goto out;
899
900 root_isec->sid = rootcontext_sid;
901 root_isec->initialized = LABEL_INITIALIZED;
902 }
903
904 if (defcontext_sid) {
905 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
907 rc = -EINVAL;
908 printk(KERN_WARNING "SELinux: defcontext option is "
909 "invalid for this filesystem type\n");
910 goto out;
911 }
912
913 if (defcontext_sid != sbsec->def_sid) {
914 rc = may_context_mount_inode_relabel(defcontext_sid,
915 sbsec, cred);
916 if (rc)
917 goto out;
918 }
919
920 sbsec->def_sid = defcontext_sid;
921 }
922
923 out_set_opts:
924 rc = sb_finish_set_opts(sb);
925 out:
926 mutex_unlock(&sbsec->lock);
927 return rc;
928 out_double_mount:
929 rc = -EINVAL;
930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
931 "security settings for (dev %s, type %s)\n", sb->s_id, name);
932 goto out;
933 }
934
935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 const struct super_block *newsb)
937 {
938 struct superblock_security_struct *old = oldsb->s_security;
939 struct superblock_security_struct *new = newsb->s_security;
940 char oldflags = old->flags & SE_MNTMASK;
941 char newflags = new->flags & SE_MNTMASK;
942
943 if (oldflags != newflags)
944 goto mismatch;
945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
946 goto mismatch;
947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
948 goto mismatch;
949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
950 goto mismatch;
951 if (oldflags & ROOTCONTEXT_MNT) {
952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
954 if (oldroot->sid != newroot->sid)
955 goto mismatch;
956 }
957 return 0;
958 mismatch:
959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
960 "different security settings for (dev %s, "
961 "type %s)\n", newsb->s_id, newsb->s_type->name);
962 return -EBUSY;
963 }
964
965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
966 struct super_block *newsb)
967 {
968 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 struct superblock_security_struct *newsbsec = newsb->s_security;
970
971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
972 int set_context = (oldsbsec->flags & CONTEXT_MNT);
973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
974
975 /*
976 * if the parent was able to be mounted it clearly had no special lsm
977 * mount options. thus we can safely deal with this superblock later
978 */
979 if (!ss_initialized)
980 return 0;
981
982 /* how can we clone if the old one wasn't set up?? */
983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
984
985 /* if fs is reusing a sb, make sure that the contexts match */
986 if (newsbsec->flags & SE_SBINITIALIZED)
987 return selinux_cmp_sb_context(oldsb, newsb);
988
989 mutex_lock(&newsbsec->lock);
990
991 newsbsec->flags = oldsbsec->flags;
992
993 newsbsec->sid = oldsbsec->sid;
994 newsbsec->def_sid = oldsbsec->def_sid;
995 newsbsec->behavior = oldsbsec->behavior;
996
997 if (set_context) {
998 u32 sid = oldsbsec->mntpoint_sid;
999
1000 if (!set_fscontext)
1001 newsbsec->sid = sid;
1002 if (!set_rootcontext) {
1003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1004 newisec->sid = sid;
1005 }
1006 newsbsec->mntpoint_sid = sid;
1007 }
1008 if (set_rootcontext) {
1009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1011
1012 newisec->sid = oldisec->sid;
1013 }
1014
1015 sb_finish_set_opts(newsb);
1016 mutex_unlock(&newsbsec->lock);
1017 return 0;
1018 }
1019
1020 static int selinux_parse_opts_str(char *options,
1021 struct security_mnt_opts *opts)
1022 {
1023 char *p;
1024 char *context = NULL, *defcontext = NULL;
1025 char *fscontext = NULL, *rootcontext = NULL;
1026 int rc, num_mnt_opts = 0;
1027
1028 opts->num_mnt_opts = 0;
1029
1030 /* Standard string-based options. */
1031 while ((p = strsep(&options, "|")) != NULL) {
1032 int token;
1033 substring_t args[MAX_OPT_ARGS];
1034
1035 if (!*p)
1036 continue;
1037
1038 token = match_token(p, tokens, args);
1039
1040 switch (token) {
1041 case Opt_context:
1042 if (context || defcontext) {
1043 rc = -EINVAL;
1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045 goto out_err;
1046 }
1047 context = match_strdup(&args[0]);
1048 if (!context) {
1049 rc = -ENOMEM;
1050 goto out_err;
1051 }
1052 break;
1053
1054 case Opt_fscontext:
1055 if (fscontext) {
1056 rc = -EINVAL;
1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058 goto out_err;
1059 }
1060 fscontext = match_strdup(&args[0]);
1061 if (!fscontext) {
1062 rc = -ENOMEM;
1063 goto out_err;
1064 }
1065 break;
1066
1067 case Opt_rootcontext:
1068 if (rootcontext) {
1069 rc = -EINVAL;
1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071 goto out_err;
1072 }
1073 rootcontext = match_strdup(&args[0]);
1074 if (!rootcontext) {
1075 rc = -ENOMEM;
1076 goto out_err;
1077 }
1078 break;
1079
1080 case Opt_defcontext:
1081 if (context || defcontext) {
1082 rc = -EINVAL;
1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084 goto out_err;
1085 }
1086 defcontext = match_strdup(&args[0]);
1087 if (!defcontext) {
1088 rc = -ENOMEM;
1089 goto out_err;
1090 }
1091 break;
1092 case Opt_labelsupport:
1093 break;
1094 default:
1095 rc = -EINVAL;
1096 printk(KERN_WARNING "SELinux: unknown mount option\n");
1097 goto out_err;
1098
1099 }
1100 }
1101
1102 rc = -ENOMEM;
1103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1104 if (!opts->mnt_opts)
1105 goto out_err;
1106
1107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1108 GFP_KERNEL);
1109 if (!opts->mnt_opts_flags) {
1110 kfree(opts->mnt_opts);
1111 goto out_err;
1112 }
1113
1114 if (fscontext) {
1115 opts->mnt_opts[num_mnt_opts] = fscontext;
1116 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1117 }
1118 if (context) {
1119 opts->mnt_opts[num_mnt_opts] = context;
1120 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1121 }
1122 if (rootcontext) {
1123 opts->mnt_opts[num_mnt_opts] = rootcontext;
1124 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1125 }
1126 if (defcontext) {
1127 opts->mnt_opts[num_mnt_opts] = defcontext;
1128 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1129 }
1130
1131 opts->num_mnt_opts = num_mnt_opts;
1132 return 0;
1133
1134 out_err:
1135 kfree(context);
1136 kfree(defcontext);
1137 kfree(fscontext);
1138 kfree(rootcontext);
1139 return rc;
1140 }
1141 /*
1142 * string mount options parsing and call set the sbsec
1143 */
1144 static int superblock_doinit(struct super_block *sb, void *data)
1145 {
1146 int rc = 0;
1147 char *options = data;
1148 struct security_mnt_opts opts;
1149
1150 security_init_mnt_opts(&opts);
1151
1152 if (!data)
1153 goto out;
1154
1155 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1156
1157 rc = selinux_parse_opts_str(options, &opts);
1158 if (rc)
1159 goto out_err;
1160
1161 out:
1162 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1163
1164 out_err:
1165 security_free_mnt_opts(&opts);
1166 return rc;
1167 }
1168
1169 static void selinux_write_opts(struct seq_file *m,
1170 struct security_mnt_opts *opts)
1171 {
1172 int i;
1173 char *prefix;
1174
1175 for (i = 0; i < opts->num_mnt_opts; i++) {
1176 char *has_comma;
1177
1178 if (opts->mnt_opts[i])
1179 has_comma = strchr(opts->mnt_opts[i], ',');
1180 else
1181 has_comma = NULL;
1182
1183 switch (opts->mnt_opts_flags[i]) {
1184 case CONTEXT_MNT:
1185 prefix = CONTEXT_STR;
1186 break;
1187 case FSCONTEXT_MNT:
1188 prefix = FSCONTEXT_STR;
1189 break;
1190 case ROOTCONTEXT_MNT:
1191 prefix = ROOTCONTEXT_STR;
1192 break;
1193 case DEFCONTEXT_MNT:
1194 prefix = DEFCONTEXT_STR;
1195 break;
1196 case SBLABEL_MNT:
1197 seq_putc(m, ',');
1198 seq_puts(m, LABELSUPP_STR);
1199 continue;
1200 default:
1201 BUG();
1202 return;
1203 };
1204 /* we need a comma before each option */
1205 seq_putc(m, ',');
1206 seq_puts(m, prefix);
1207 if (has_comma)
1208 seq_putc(m, '\"');
1209 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1210 if (has_comma)
1211 seq_putc(m, '\"');
1212 }
1213 }
1214
1215 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1216 {
1217 struct security_mnt_opts opts;
1218 int rc;
1219
1220 rc = selinux_get_mnt_opts(sb, &opts);
1221 if (rc) {
1222 /* before policy load we may get EINVAL, don't show anything */
1223 if (rc == -EINVAL)
1224 rc = 0;
1225 return rc;
1226 }
1227
1228 selinux_write_opts(m, &opts);
1229
1230 security_free_mnt_opts(&opts);
1231
1232 return rc;
1233 }
1234
1235 static inline u16 inode_mode_to_security_class(umode_t mode)
1236 {
1237 switch (mode & S_IFMT) {
1238 case S_IFSOCK:
1239 return SECCLASS_SOCK_FILE;
1240 case S_IFLNK:
1241 return SECCLASS_LNK_FILE;
1242 case S_IFREG:
1243 return SECCLASS_FILE;
1244 case S_IFBLK:
1245 return SECCLASS_BLK_FILE;
1246 case S_IFDIR:
1247 return SECCLASS_DIR;
1248 case S_IFCHR:
1249 return SECCLASS_CHR_FILE;
1250 case S_IFIFO:
1251 return SECCLASS_FIFO_FILE;
1252
1253 }
1254
1255 return SECCLASS_FILE;
1256 }
1257
1258 static inline int default_protocol_stream(int protocol)
1259 {
1260 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1261 }
1262
1263 static inline int default_protocol_dgram(int protocol)
1264 {
1265 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1266 }
1267
1268 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1269 {
1270 int extsockclass = selinux_policycap_extsockclass;
1271
1272 switch (family) {
1273 case PF_UNIX:
1274 switch (type) {
1275 case SOCK_STREAM:
1276 case SOCK_SEQPACKET:
1277 return SECCLASS_UNIX_STREAM_SOCKET;
1278 case SOCK_DGRAM:
1279 return SECCLASS_UNIX_DGRAM_SOCKET;
1280 }
1281 break;
1282 case PF_INET:
1283 case PF_INET6:
1284 switch (type) {
1285 case SOCK_STREAM:
1286 case SOCK_SEQPACKET:
1287 if (default_protocol_stream(protocol))
1288 return SECCLASS_TCP_SOCKET;
1289 else if (extsockclass && protocol == IPPROTO_SCTP)
1290 return SECCLASS_SCTP_SOCKET;
1291 else
1292 return SECCLASS_RAWIP_SOCKET;
1293 case SOCK_DGRAM:
1294 if (default_protocol_dgram(protocol))
1295 return SECCLASS_UDP_SOCKET;
1296 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1297 protocol == IPPROTO_ICMPV6))
1298 return SECCLASS_ICMP_SOCKET;
1299 else
1300 return SECCLASS_RAWIP_SOCKET;
1301 case SOCK_DCCP:
1302 return SECCLASS_DCCP_SOCKET;
1303 default:
1304 return SECCLASS_RAWIP_SOCKET;
1305 }
1306 break;
1307 case PF_NETLINK:
1308 switch (protocol) {
1309 case NETLINK_ROUTE:
1310 return SECCLASS_NETLINK_ROUTE_SOCKET;
1311 case NETLINK_SOCK_DIAG:
1312 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1313 case NETLINK_NFLOG:
1314 return SECCLASS_NETLINK_NFLOG_SOCKET;
1315 case NETLINK_XFRM:
1316 return SECCLASS_NETLINK_XFRM_SOCKET;
1317 case NETLINK_SELINUX:
1318 return SECCLASS_NETLINK_SELINUX_SOCKET;
1319 case NETLINK_ISCSI:
1320 return SECCLASS_NETLINK_ISCSI_SOCKET;
1321 case NETLINK_AUDIT:
1322 return SECCLASS_NETLINK_AUDIT_SOCKET;
1323 case NETLINK_FIB_LOOKUP:
1324 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1325 case NETLINK_CONNECTOR:
1326 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1327 case NETLINK_NETFILTER:
1328 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1329 case NETLINK_DNRTMSG:
1330 return SECCLASS_NETLINK_DNRT_SOCKET;
1331 case NETLINK_KOBJECT_UEVENT:
1332 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1333 case NETLINK_GENERIC:
1334 return SECCLASS_NETLINK_GENERIC_SOCKET;
1335 case NETLINK_SCSITRANSPORT:
1336 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1337 case NETLINK_RDMA:
1338 return SECCLASS_NETLINK_RDMA_SOCKET;
1339 case NETLINK_CRYPTO:
1340 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1341 default:
1342 return SECCLASS_NETLINK_SOCKET;
1343 }
1344 case PF_PACKET:
1345 return SECCLASS_PACKET_SOCKET;
1346 case PF_KEY:
1347 return SECCLASS_KEY_SOCKET;
1348 case PF_APPLETALK:
1349 return SECCLASS_APPLETALK_SOCKET;
1350 }
1351
1352 if (extsockclass) {
1353 switch (family) {
1354 case PF_AX25:
1355 return SECCLASS_AX25_SOCKET;
1356 case PF_IPX:
1357 return SECCLASS_IPX_SOCKET;
1358 case PF_NETROM:
1359 return SECCLASS_NETROM_SOCKET;
1360 case PF_ATMPVC:
1361 return SECCLASS_ATMPVC_SOCKET;
1362 case PF_X25:
1363 return SECCLASS_X25_SOCKET;
1364 case PF_ROSE:
1365 return SECCLASS_ROSE_SOCKET;
1366 case PF_DECnet:
1367 return SECCLASS_DECNET_SOCKET;
1368 case PF_ATMSVC:
1369 return SECCLASS_ATMSVC_SOCKET;
1370 case PF_RDS:
1371 return SECCLASS_RDS_SOCKET;
1372 case PF_IRDA:
1373 return SECCLASS_IRDA_SOCKET;
1374 case PF_PPPOX:
1375 return SECCLASS_PPPOX_SOCKET;
1376 case PF_LLC:
1377 return SECCLASS_LLC_SOCKET;
1378 case PF_CAN:
1379 return SECCLASS_CAN_SOCKET;
1380 case PF_TIPC:
1381 return SECCLASS_TIPC_SOCKET;
1382 case PF_BLUETOOTH:
1383 return SECCLASS_BLUETOOTH_SOCKET;
1384 case PF_IUCV:
1385 return SECCLASS_IUCV_SOCKET;
1386 case PF_RXRPC:
1387 return SECCLASS_RXRPC_SOCKET;
1388 case PF_ISDN:
1389 return SECCLASS_ISDN_SOCKET;
1390 case PF_PHONET:
1391 return SECCLASS_PHONET_SOCKET;
1392 case PF_IEEE802154:
1393 return SECCLASS_IEEE802154_SOCKET;
1394 case PF_CAIF:
1395 return SECCLASS_CAIF_SOCKET;
1396 case PF_ALG:
1397 return SECCLASS_ALG_SOCKET;
1398 case PF_NFC:
1399 return SECCLASS_NFC_SOCKET;
1400 case PF_VSOCK:
1401 return SECCLASS_VSOCK_SOCKET;
1402 case PF_KCM:
1403 return SECCLASS_KCM_SOCKET;
1404 case PF_QIPCRTR:
1405 return SECCLASS_QIPCRTR_SOCKET;
1406 case PF_SMC:
1407 return SECCLASS_SMC_SOCKET;
1408 #if PF_MAX > 44
1409 #error New address family defined, please update this function.
1410 #endif
1411 }
1412 }
1413
1414 return SECCLASS_SOCKET;
1415 }
1416
1417 static int selinux_genfs_get_sid(struct dentry *dentry,
1418 u16 tclass,
1419 u16 flags,
1420 u32 *sid)
1421 {
1422 int rc;
1423 struct super_block *sb = dentry->d_sb;
1424 char *buffer, *path;
1425
1426 buffer = (char *)__get_free_page(GFP_KERNEL);
1427 if (!buffer)
1428 return -ENOMEM;
1429
1430 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1431 if (IS_ERR(path))
1432 rc = PTR_ERR(path);
1433 else {
1434 if (flags & SE_SBPROC) {
1435 /* each process gets a /proc/PID/ entry. Strip off the
1436 * PID part to get a valid selinux labeling.
1437 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1438 while (path[1] >= '0' && path[1] <= '9') {
1439 path[1] = '/';
1440 path++;
1441 }
1442 }
1443 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1444 }
1445 free_page((unsigned long)buffer);
1446 return rc;
1447 }
1448
1449 /* The inode's security attributes must be initialized before first use. */
1450 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1451 {
1452 struct superblock_security_struct *sbsec = NULL;
1453 struct inode_security_struct *isec = inode->i_security;
1454 u32 task_sid, sid = 0;
1455 u16 sclass;
1456 struct dentry *dentry;
1457 #define INITCONTEXTLEN 255
1458 char *context = NULL;
1459 unsigned len = 0;
1460 int rc = 0;
1461
1462 if (isec->initialized == LABEL_INITIALIZED)
1463 return 0;
1464
1465 spin_lock(&isec->lock);
1466 if (isec->initialized == LABEL_INITIALIZED)
1467 goto out_unlock;
1468
1469 if (isec->sclass == SECCLASS_FILE)
1470 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1471
1472 sbsec = inode->i_sb->s_security;
1473 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1474 /* Defer initialization until selinux_complete_init,
1475 after the initial policy is loaded and the security
1476 server is ready to handle calls. */
1477 spin_lock(&sbsec->isec_lock);
1478 if (list_empty(&isec->list))
1479 list_add(&isec->list, &sbsec->isec_head);
1480 spin_unlock(&sbsec->isec_lock);
1481 goto out_unlock;
1482 }
1483
1484 sclass = isec->sclass;
1485 task_sid = isec->task_sid;
1486 sid = isec->sid;
1487 isec->initialized = LABEL_PENDING;
1488 spin_unlock(&isec->lock);
1489
1490 switch (sbsec->behavior) {
1491 case SECURITY_FS_USE_NATIVE:
1492 break;
1493 case SECURITY_FS_USE_XATTR:
1494 if (!(inode->i_opflags & IOP_XATTR)) {
1495 sid = sbsec->def_sid;
1496 break;
1497 }
1498 /* Need a dentry, since the xattr API requires one.
1499 Life would be simpler if we could just pass the inode. */
1500 if (opt_dentry) {
1501 /* Called from d_instantiate or d_splice_alias. */
1502 dentry = dget(opt_dentry);
1503 } else {
1504 /* Called from selinux_complete_init, try to find a dentry. */
1505 dentry = d_find_alias(inode);
1506 }
1507 if (!dentry) {
1508 /*
1509 * this is can be hit on boot when a file is accessed
1510 * before the policy is loaded. When we load policy we
1511 * may find inodes that have no dentry on the
1512 * sbsec->isec_head list. No reason to complain as these
1513 * will get fixed up the next time we go through
1514 * inode_doinit with a dentry, before these inodes could
1515 * be used again by userspace.
1516 */
1517 goto out;
1518 }
1519
1520 len = INITCONTEXTLEN;
1521 context = kmalloc(len+1, GFP_NOFS);
1522 if (!context) {
1523 rc = -ENOMEM;
1524 dput(dentry);
1525 goto out;
1526 }
1527 context[len] = '\0';
1528 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1529 if (rc == -ERANGE) {
1530 kfree(context);
1531
1532 /* Need a larger buffer. Query for the right size. */
1533 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1534 if (rc < 0) {
1535 dput(dentry);
1536 goto out;
1537 }
1538 len = rc;
1539 context = kmalloc(len+1, GFP_NOFS);
1540 if (!context) {
1541 rc = -ENOMEM;
1542 dput(dentry);
1543 goto out;
1544 }
1545 context[len] = '\0';
1546 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1547 }
1548 dput(dentry);
1549 if (rc < 0) {
1550 if (rc != -ENODATA) {
1551 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1552 "%d for dev=%s ino=%ld\n", __func__,
1553 -rc, inode->i_sb->s_id, inode->i_ino);
1554 kfree(context);
1555 goto out;
1556 }
1557 /* Map ENODATA to the default file SID */
1558 sid = sbsec->def_sid;
1559 rc = 0;
1560 } else {
1561 rc = security_context_to_sid_default(context, rc, &sid,
1562 sbsec->def_sid,
1563 GFP_NOFS);
1564 if (rc) {
1565 char *dev = inode->i_sb->s_id;
1566 unsigned long ino = inode->i_ino;
1567
1568 if (rc == -EINVAL) {
1569 if (printk_ratelimit())
1570 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1571 "context=%s. This indicates you may need to relabel the inode or the "
1572 "filesystem in question.\n", ino, dev, context);
1573 } else {
1574 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1575 "returned %d for dev=%s ino=%ld\n",
1576 __func__, context, -rc, dev, ino);
1577 }
1578 kfree(context);
1579 /* Leave with the unlabeled SID */
1580 rc = 0;
1581 break;
1582 }
1583 }
1584 kfree(context);
1585 break;
1586 case SECURITY_FS_USE_TASK:
1587 sid = task_sid;
1588 break;
1589 case SECURITY_FS_USE_TRANS:
1590 /* Default to the fs SID. */
1591 sid = sbsec->sid;
1592
1593 /* Try to obtain a transition SID. */
1594 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1595 if (rc)
1596 goto out;
1597 break;
1598 case SECURITY_FS_USE_MNTPOINT:
1599 sid = sbsec->mntpoint_sid;
1600 break;
1601 default:
1602 /* Default to the fs superblock SID. */
1603 sid = sbsec->sid;
1604
1605 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1606 /* We must have a dentry to determine the label on
1607 * procfs inodes */
1608 if (opt_dentry)
1609 /* Called from d_instantiate or
1610 * d_splice_alias. */
1611 dentry = dget(opt_dentry);
1612 else
1613 /* Called from selinux_complete_init, try to
1614 * find a dentry. */
1615 dentry = d_find_alias(inode);
1616 /*
1617 * This can be hit on boot when a file is accessed
1618 * before the policy is loaded. When we load policy we
1619 * may find inodes that have no dentry on the
1620 * sbsec->isec_head list. No reason to complain as
1621 * these will get fixed up the next time we go through
1622 * inode_doinit() with a dentry, before these inodes
1623 * could be used again by userspace.
1624 */
1625 if (!dentry)
1626 goto out;
1627 rc = selinux_genfs_get_sid(dentry, sclass,
1628 sbsec->flags, &sid);
1629 dput(dentry);
1630 if (rc)
1631 goto out;
1632 }
1633 break;
1634 }
1635
1636 out:
1637 spin_lock(&isec->lock);
1638 if (isec->initialized == LABEL_PENDING) {
1639 if (!sid || rc) {
1640 isec->initialized = LABEL_INVALID;
1641 goto out_unlock;
1642 }
1643
1644 isec->initialized = LABEL_INITIALIZED;
1645 isec->sid = sid;
1646 }
1647
1648 out_unlock:
1649 spin_unlock(&isec->lock);
1650 return rc;
1651 }
1652
1653 /* Convert a Linux signal to an access vector. */
1654 static inline u32 signal_to_av(int sig)
1655 {
1656 u32 perm = 0;
1657
1658 switch (sig) {
1659 case SIGCHLD:
1660 /* Commonly granted from child to parent. */
1661 perm = PROCESS__SIGCHLD;
1662 break;
1663 case SIGKILL:
1664 /* Cannot be caught or ignored */
1665 perm = PROCESS__SIGKILL;
1666 break;
1667 case SIGSTOP:
1668 /* Cannot be caught or ignored */
1669 perm = PROCESS__SIGSTOP;
1670 break;
1671 default:
1672 /* All other signals. */
1673 perm = PROCESS__SIGNAL;
1674 break;
1675 }
1676
1677 return perm;
1678 }
1679
1680 #if CAP_LAST_CAP > 63
1681 #error Fix SELinux to handle capabilities > 63.
1682 #endif
1683
1684 /* Check whether a task is allowed to use a capability. */
1685 static int cred_has_capability(const struct cred *cred,
1686 int cap, int audit, bool initns)
1687 {
1688 struct common_audit_data ad;
1689 struct av_decision avd;
1690 u16 sclass;
1691 u32 sid = cred_sid(cred);
1692 u32 av = CAP_TO_MASK(cap);
1693 int rc;
1694
1695 ad.type = LSM_AUDIT_DATA_CAP;
1696 ad.u.cap = cap;
1697
1698 switch (CAP_TO_INDEX(cap)) {
1699 case 0:
1700 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1701 break;
1702 case 1:
1703 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1704 break;
1705 default:
1706 printk(KERN_ERR
1707 "SELinux: out of range capability %d\n", cap);
1708 BUG();
1709 return -EINVAL;
1710 }
1711
1712 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1713 if (audit == SECURITY_CAP_AUDIT) {
1714 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1715 if (rc2)
1716 return rc2;
1717 }
1718 return rc;
1719 }
1720
1721 /* Check whether a task has a particular permission to an inode.
1722 The 'adp' parameter is optional and allows other audit
1723 data to be passed (e.g. the dentry). */
1724 static int inode_has_perm(const struct cred *cred,
1725 struct inode *inode,
1726 u32 perms,
1727 struct common_audit_data *adp)
1728 {
1729 struct inode_security_struct *isec;
1730 u32 sid;
1731
1732 validate_creds(cred);
1733
1734 if (unlikely(IS_PRIVATE(inode)))
1735 return 0;
1736
1737 sid = cred_sid(cred);
1738 isec = inode->i_security;
1739
1740 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1741 }
1742
1743 /* Same as inode_has_perm, but pass explicit audit data containing
1744 the dentry to help the auditing code to more easily generate the
1745 pathname if needed. */
1746 static inline int dentry_has_perm(const struct cred *cred,
1747 struct dentry *dentry,
1748 u32 av)
1749 {
1750 struct inode *inode = d_backing_inode(dentry);
1751 struct common_audit_data ad;
1752
1753 ad.type = LSM_AUDIT_DATA_DENTRY;
1754 ad.u.dentry = dentry;
1755 __inode_security_revalidate(inode, dentry, true);
1756 return inode_has_perm(cred, inode, av, &ad);
1757 }
1758
1759 /* Same as inode_has_perm, but pass explicit audit data containing
1760 the path to help the auditing code to more easily generate the
1761 pathname if needed. */
1762 static inline int path_has_perm(const struct cred *cred,
1763 const struct path *path,
1764 u32 av)
1765 {
1766 struct inode *inode = d_backing_inode(path->dentry);
1767 struct common_audit_data ad;
1768
1769 ad.type = LSM_AUDIT_DATA_PATH;
1770 ad.u.path = *path;
1771 __inode_security_revalidate(inode, path->dentry, true);
1772 return inode_has_perm(cred, inode, av, &ad);
1773 }
1774
1775 /* Same as path_has_perm, but uses the inode from the file struct. */
1776 static inline int file_path_has_perm(const struct cred *cred,
1777 struct file *file,
1778 u32 av)
1779 {
1780 struct common_audit_data ad;
1781
1782 ad.type = LSM_AUDIT_DATA_FILE;
1783 ad.u.file = file;
1784 return inode_has_perm(cred, file_inode(file), av, &ad);
1785 }
1786
1787 /* Check whether a task can use an open file descriptor to
1788 access an inode in a given way. Check access to the
1789 descriptor itself, and then use dentry_has_perm to
1790 check a particular permission to the file.
1791 Access to the descriptor is implicitly granted if it
1792 has the same SID as the process. If av is zero, then
1793 access to the file is not checked, e.g. for cases
1794 where only the descriptor is affected like seek. */
1795 static int file_has_perm(const struct cred *cred,
1796 struct file *file,
1797 u32 av)
1798 {
1799 struct file_security_struct *fsec = file->f_security;
1800 struct inode *inode = file_inode(file);
1801 struct common_audit_data ad;
1802 u32 sid = cred_sid(cred);
1803 int rc;
1804
1805 ad.type = LSM_AUDIT_DATA_FILE;
1806 ad.u.file = file;
1807
1808 if (sid != fsec->sid) {
1809 rc = avc_has_perm(sid, fsec->sid,
1810 SECCLASS_FD,
1811 FD__USE,
1812 &ad);
1813 if (rc)
1814 goto out;
1815 }
1816
1817 /* av is zero if only checking access to the descriptor. */
1818 rc = 0;
1819 if (av)
1820 rc = inode_has_perm(cred, inode, av, &ad);
1821
1822 out:
1823 return rc;
1824 }
1825
1826 /*
1827 * Determine the label for an inode that might be unioned.
1828 */
1829 static int
1830 selinux_determine_inode_label(const struct task_security_struct *tsec,
1831 struct inode *dir,
1832 const struct qstr *name, u16 tclass,
1833 u32 *_new_isid)
1834 {
1835 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1836
1837 if ((sbsec->flags & SE_SBINITIALIZED) &&
1838 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1839 *_new_isid = sbsec->mntpoint_sid;
1840 } else if ((sbsec->flags & SBLABEL_MNT) &&
1841 tsec->create_sid) {
1842 *_new_isid = tsec->create_sid;
1843 } else {
1844 const struct inode_security_struct *dsec = inode_security(dir);
1845 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1846 name, _new_isid);
1847 }
1848
1849 return 0;
1850 }
1851
1852 /* Check whether a task can create a file. */
1853 static int may_create(struct inode *dir,
1854 struct dentry *dentry,
1855 u16 tclass)
1856 {
1857 const struct task_security_struct *tsec = current_security();
1858 struct inode_security_struct *dsec;
1859 struct superblock_security_struct *sbsec;
1860 u32 sid, newsid;
1861 struct common_audit_data ad;
1862 int rc;
1863
1864 dsec = inode_security(dir);
1865 sbsec = dir->i_sb->s_security;
1866
1867 sid = tsec->sid;
1868
1869 ad.type = LSM_AUDIT_DATA_DENTRY;
1870 ad.u.dentry = dentry;
1871
1872 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1873 DIR__ADD_NAME | DIR__SEARCH,
1874 &ad);
1875 if (rc)
1876 return rc;
1877
1878 rc = selinux_determine_inode_label(current_security(), dir,
1879 &dentry->d_name, tclass, &newsid);
1880 if (rc)
1881 return rc;
1882
1883 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1884 if (rc)
1885 return rc;
1886
1887 return avc_has_perm(newsid, sbsec->sid,
1888 SECCLASS_FILESYSTEM,
1889 FILESYSTEM__ASSOCIATE, &ad);
1890 }
1891
1892 #define MAY_LINK 0
1893 #define MAY_UNLINK 1
1894 #define MAY_RMDIR 2
1895
1896 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1897 static int may_link(struct inode *dir,
1898 struct dentry *dentry,
1899 int kind)
1900
1901 {
1902 struct inode_security_struct *dsec, *isec;
1903 struct common_audit_data ad;
1904 u32 sid = current_sid();
1905 u32 av;
1906 int rc;
1907
1908 dsec = inode_security(dir);
1909 isec = backing_inode_security(dentry);
1910
1911 ad.type = LSM_AUDIT_DATA_DENTRY;
1912 ad.u.dentry = dentry;
1913
1914 av = DIR__SEARCH;
1915 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1916 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1917 if (rc)
1918 return rc;
1919
1920 switch (kind) {
1921 case MAY_LINK:
1922 av = FILE__LINK;
1923 break;
1924 case MAY_UNLINK:
1925 av = FILE__UNLINK;
1926 break;
1927 case MAY_RMDIR:
1928 av = DIR__RMDIR;
1929 break;
1930 default:
1931 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1932 __func__, kind);
1933 return 0;
1934 }
1935
1936 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1937 return rc;
1938 }
1939
1940 static inline int may_rename(struct inode *old_dir,
1941 struct dentry *old_dentry,
1942 struct inode *new_dir,
1943 struct dentry *new_dentry)
1944 {
1945 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1946 struct common_audit_data ad;
1947 u32 sid = current_sid();
1948 u32 av;
1949 int old_is_dir, new_is_dir;
1950 int rc;
1951
1952 old_dsec = inode_security(old_dir);
1953 old_isec = backing_inode_security(old_dentry);
1954 old_is_dir = d_is_dir(old_dentry);
1955 new_dsec = inode_security(new_dir);
1956
1957 ad.type = LSM_AUDIT_DATA_DENTRY;
1958
1959 ad.u.dentry = old_dentry;
1960 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1961 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1962 if (rc)
1963 return rc;
1964 rc = avc_has_perm(sid, old_isec->sid,
1965 old_isec->sclass, FILE__RENAME, &ad);
1966 if (rc)
1967 return rc;
1968 if (old_is_dir && new_dir != old_dir) {
1969 rc = avc_has_perm(sid, old_isec->sid,
1970 old_isec->sclass, DIR__REPARENT, &ad);
1971 if (rc)
1972 return rc;
1973 }
1974
1975 ad.u.dentry = new_dentry;
1976 av = DIR__ADD_NAME | DIR__SEARCH;
1977 if (d_is_positive(new_dentry))
1978 av |= DIR__REMOVE_NAME;
1979 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1980 if (rc)
1981 return rc;
1982 if (d_is_positive(new_dentry)) {
1983 new_isec = backing_inode_security(new_dentry);
1984 new_is_dir = d_is_dir(new_dentry);
1985 rc = avc_has_perm(sid, new_isec->sid,
1986 new_isec->sclass,
1987 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1988 if (rc)
1989 return rc;
1990 }
1991
1992 return 0;
1993 }
1994
1995 /* Check whether a task can perform a filesystem operation. */
1996 static int superblock_has_perm(const struct cred *cred,
1997 struct super_block *sb,
1998 u32 perms,
1999 struct common_audit_data *ad)
2000 {
2001 struct superblock_security_struct *sbsec;
2002 u32 sid = cred_sid(cred);
2003
2004 sbsec = sb->s_security;
2005 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2006 }
2007
2008 /* Convert a Linux mode and permission mask to an access vector. */
2009 static inline u32 file_mask_to_av(int mode, int mask)
2010 {
2011 u32 av = 0;
2012
2013 if (!S_ISDIR(mode)) {
2014 if (mask & MAY_EXEC)
2015 av |= FILE__EXECUTE;
2016 if (mask & MAY_READ)
2017 av |= FILE__READ;
2018
2019 if (mask & MAY_APPEND)
2020 av |= FILE__APPEND;
2021 else if (mask & MAY_WRITE)
2022 av |= FILE__WRITE;
2023
2024 } else {
2025 if (mask & MAY_EXEC)
2026 av |= DIR__SEARCH;
2027 if (mask & MAY_WRITE)
2028 av |= DIR__WRITE;
2029 if (mask & MAY_READ)
2030 av |= DIR__READ;
2031 }
2032
2033 return av;
2034 }
2035
2036 /* Convert a Linux file to an access vector. */
2037 static inline u32 file_to_av(struct file *file)
2038 {
2039 u32 av = 0;
2040
2041 if (file->f_mode & FMODE_READ)
2042 av |= FILE__READ;
2043 if (file->f_mode & FMODE_WRITE) {
2044 if (file->f_flags & O_APPEND)
2045 av |= FILE__APPEND;
2046 else
2047 av |= FILE__WRITE;
2048 }
2049 if (!av) {
2050 /*
2051 * Special file opened with flags 3 for ioctl-only use.
2052 */
2053 av = FILE__IOCTL;
2054 }
2055
2056 return av;
2057 }
2058
2059 /*
2060 * Convert a file to an access vector and include the correct open
2061 * open permission.
2062 */
2063 static inline u32 open_file_to_av(struct file *file)
2064 {
2065 u32 av = file_to_av(file);
2066
2067 if (selinux_policycap_openperm)
2068 av |= FILE__OPEN;
2069
2070 return av;
2071 }
2072
2073 /* Hook functions begin here. */
2074
2075 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2076 {
2077 u32 mysid = current_sid();
2078 u32 mgrsid = task_sid(mgr);
2079
2080 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2081 BINDER__SET_CONTEXT_MGR, NULL);
2082 }
2083
2084 static int selinux_binder_transaction(struct task_struct *from,
2085 struct task_struct *to)
2086 {
2087 u32 mysid = current_sid();
2088 u32 fromsid = task_sid(from);
2089 u32 tosid = task_sid(to);
2090 int rc;
2091
2092 if (mysid != fromsid) {
2093 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2094 BINDER__IMPERSONATE, NULL);
2095 if (rc)
2096 return rc;
2097 }
2098
2099 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2100 NULL);
2101 }
2102
2103 static int selinux_binder_transfer_binder(struct task_struct *from,
2104 struct task_struct *to)
2105 {
2106 u32 fromsid = task_sid(from);
2107 u32 tosid = task_sid(to);
2108
2109 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2110 NULL);
2111 }
2112
2113 static int selinux_binder_transfer_file(struct task_struct *from,
2114 struct task_struct *to,
2115 struct file *file)
2116 {
2117 u32 sid = task_sid(to);
2118 struct file_security_struct *fsec = file->f_security;
2119 struct dentry *dentry = file->f_path.dentry;
2120 struct inode_security_struct *isec;
2121 struct common_audit_data ad;
2122 int rc;
2123
2124 ad.type = LSM_AUDIT_DATA_PATH;
2125 ad.u.path = file->f_path;
2126
2127 if (sid != fsec->sid) {
2128 rc = avc_has_perm(sid, fsec->sid,
2129 SECCLASS_FD,
2130 FD__USE,
2131 &ad);
2132 if (rc)
2133 return rc;
2134 }
2135
2136 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2137 return 0;
2138
2139 isec = backing_inode_security(dentry);
2140 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2141 &ad);
2142 }
2143
2144 static int selinux_ptrace_access_check(struct task_struct *child,
2145 unsigned int mode)
2146 {
2147 u32 sid = current_sid();
2148 u32 csid = task_sid(child);
2149
2150 if (mode & PTRACE_MODE_READ)
2151 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2152
2153 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2154 }
2155
2156 static int selinux_ptrace_traceme(struct task_struct *parent)
2157 {
2158 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2159 PROCESS__PTRACE, NULL);
2160 }
2161
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2164 {
2165 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2166 PROCESS__GETCAP, NULL);
2167 }
2168
2169 static int selinux_capset(struct cred *new, const struct cred *old,
2170 const kernel_cap_t *effective,
2171 const kernel_cap_t *inheritable,
2172 const kernel_cap_t *permitted)
2173 {
2174 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2175 PROCESS__SETCAP, NULL);
2176 }
2177
2178 /*
2179 * (This comment used to live with the selinux_task_setuid hook,
2180 * which was removed).
2181 *
2182 * Since setuid only affects the current process, and since the SELinux
2183 * controls are not based on the Linux identity attributes, SELinux does not
2184 * need to control this operation. However, SELinux does control the use of
2185 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2186 */
2187
2188 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2189 int cap, int audit)
2190 {
2191 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2192 }
2193
2194 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2195 {
2196 const struct cred *cred = current_cred();
2197 int rc = 0;
2198
2199 if (!sb)
2200 return 0;
2201
2202 switch (cmds) {
2203 case Q_SYNC:
2204 case Q_QUOTAON:
2205 case Q_QUOTAOFF:
2206 case Q_SETINFO:
2207 case Q_SETQUOTA:
2208 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2209 break;
2210 case Q_GETFMT:
2211 case Q_GETINFO:
2212 case Q_GETQUOTA:
2213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2214 break;
2215 default:
2216 rc = 0; /* let the kernel handle invalid cmds */
2217 break;
2218 }
2219 return rc;
2220 }
2221
2222 static int selinux_quota_on(struct dentry *dentry)
2223 {
2224 const struct cred *cred = current_cred();
2225
2226 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2227 }
2228
2229 static int selinux_syslog(int type)
2230 {
2231 switch (type) {
2232 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2233 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2234 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2235 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2236 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2237 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2238 /* Set level of messages printed to console */
2239 case SYSLOG_ACTION_CONSOLE_LEVEL:
2240 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2241 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2242 NULL);
2243 }
2244 /* All other syslog types */
2245 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2246 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2247 }
2248
2249 /*
2250 * Check that a process has enough memory to allocate a new virtual
2251 * mapping. 0 means there is enough memory for the allocation to
2252 * succeed and -ENOMEM implies there is not.
2253 *
2254 * Do not audit the selinux permission check, as this is applied to all
2255 * processes that allocate mappings.
2256 */
2257 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2258 {
2259 int rc, cap_sys_admin = 0;
2260
2261 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2262 SECURITY_CAP_NOAUDIT, true);
2263 if (rc == 0)
2264 cap_sys_admin = 1;
2265
2266 return cap_sys_admin;
2267 }
2268
2269 /* binprm security operations */
2270
2271 static u32 ptrace_parent_sid(void)
2272 {
2273 u32 sid = 0;
2274 struct task_struct *tracer;
2275
2276 rcu_read_lock();
2277 tracer = ptrace_parent(current);
2278 if (tracer)
2279 sid = task_sid(tracer);
2280 rcu_read_unlock();
2281
2282 return sid;
2283 }
2284
2285 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2286 const struct task_security_struct *old_tsec,
2287 const struct task_security_struct *new_tsec)
2288 {
2289 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2290 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2291 int rc;
2292
2293 if (!nnp && !nosuid)
2294 return 0; /* neither NNP nor nosuid */
2295
2296 if (new_tsec->sid == old_tsec->sid)
2297 return 0; /* No change in credentials */
2298
2299 /*
2300 * The only transitions we permit under NNP or nosuid
2301 * are transitions to bounded SIDs, i.e. SIDs that are
2302 * guaranteed to only be allowed a subset of the permissions
2303 * of the current SID.
2304 */
2305 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2306 if (rc) {
2307 /*
2308 * On failure, preserve the errno values for NNP vs nosuid.
2309 * NNP: Operation not permitted for caller.
2310 * nosuid: Permission denied to file.
2311 */
2312 if (nnp)
2313 return -EPERM;
2314 else
2315 return -EACCES;
2316 }
2317 return 0;
2318 }
2319
2320 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2321 {
2322 const struct task_security_struct *old_tsec;
2323 struct task_security_struct *new_tsec;
2324 struct inode_security_struct *isec;
2325 struct common_audit_data ad;
2326 struct inode *inode = file_inode(bprm->file);
2327 int rc;
2328
2329 /* SELinux context only depends on initial program or script and not
2330 * the script interpreter */
2331 if (bprm->cred_prepared)
2332 return 0;
2333
2334 old_tsec = current_security();
2335 new_tsec = bprm->cred->security;
2336 isec = inode_security(inode);
2337
2338 /* Default to the current task SID. */
2339 new_tsec->sid = old_tsec->sid;
2340 new_tsec->osid = old_tsec->sid;
2341
2342 /* Reset fs, key, and sock SIDs on execve. */
2343 new_tsec->create_sid = 0;
2344 new_tsec->keycreate_sid = 0;
2345 new_tsec->sockcreate_sid = 0;
2346
2347 if (old_tsec->exec_sid) {
2348 new_tsec->sid = old_tsec->exec_sid;
2349 /* Reset exec SID on execve. */
2350 new_tsec->exec_sid = 0;
2351
2352 /* Fail on NNP or nosuid if not an allowed transition. */
2353 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2354 if (rc)
2355 return rc;
2356 } else {
2357 /* Check for a default transition on this program. */
2358 rc = security_transition_sid(old_tsec->sid, isec->sid,
2359 SECCLASS_PROCESS, NULL,
2360 &new_tsec->sid);
2361 if (rc)
2362 return rc;
2363
2364 /*
2365 * Fallback to old SID on NNP or nosuid if not an allowed
2366 * transition.
2367 */
2368 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2369 if (rc)
2370 new_tsec->sid = old_tsec->sid;
2371 }
2372
2373 ad.type = LSM_AUDIT_DATA_FILE;
2374 ad.u.file = bprm->file;
2375
2376 if (new_tsec->sid == old_tsec->sid) {
2377 rc = avc_has_perm(old_tsec->sid, isec->sid,
2378 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2379 if (rc)
2380 return rc;
2381 } else {
2382 /* Check permissions for the transition. */
2383 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2384 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2385 if (rc)
2386 return rc;
2387
2388 rc = avc_has_perm(new_tsec->sid, isec->sid,
2389 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2390 if (rc)
2391 return rc;
2392
2393 /* Check for shared state */
2394 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2395 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2396 SECCLASS_PROCESS, PROCESS__SHARE,
2397 NULL);
2398 if (rc)
2399 return -EPERM;
2400 }
2401
2402 /* Make sure that anyone attempting to ptrace over a task that
2403 * changes its SID has the appropriate permit */
2404 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2405 u32 ptsid = ptrace_parent_sid();
2406 if (ptsid != 0) {
2407 rc = avc_has_perm(ptsid, new_tsec->sid,
2408 SECCLASS_PROCESS,
2409 PROCESS__PTRACE, NULL);
2410 if (rc)
2411 return -EPERM;
2412 }
2413 }
2414
2415 /* Clear any possibly unsafe personality bits on exec: */
2416 bprm->per_clear |= PER_CLEAR_ON_SETID;
2417 }
2418
2419 return 0;
2420 }
2421
2422 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2423 {
2424 const struct task_security_struct *tsec = current_security();
2425 u32 sid, osid;
2426 int atsecure = 0;
2427
2428 sid = tsec->sid;
2429 osid = tsec->osid;
2430
2431 if (osid != sid) {
2432 /* Enable secure mode for SIDs transitions unless
2433 the noatsecure permission is granted between
2434 the two SIDs, i.e. ahp returns 0. */
2435 atsecure = avc_has_perm(osid, sid,
2436 SECCLASS_PROCESS,
2437 PROCESS__NOATSECURE, NULL);
2438 }
2439
2440 return !!atsecure;
2441 }
2442
2443 static int match_file(const void *p, struct file *file, unsigned fd)
2444 {
2445 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2446 }
2447
2448 /* Derived from fs/exec.c:flush_old_files. */
2449 static inline void flush_unauthorized_files(const struct cred *cred,
2450 struct files_struct *files)
2451 {
2452 struct file *file, *devnull = NULL;
2453 struct tty_struct *tty;
2454 int drop_tty = 0;
2455 unsigned n;
2456
2457 tty = get_current_tty();
2458 if (tty) {
2459 spin_lock(&tty->files_lock);
2460 if (!list_empty(&tty->tty_files)) {
2461 struct tty_file_private *file_priv;
2462
2463 /* Revalidate access to controlling tty.
2464 Use file_path_has_perm on the tty path directly
2465 rather than using file_has_perm, as this particular
2466 open file may belong to another process and we are
2467 only interested in the inode-based check here. */
2468 file_priv = list_first_entry(&tty->tty_files,
2469 struct tty_file_private, list);
2470 file = file_priv->file;
2471 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2472 drop_tty = 1;
2473 }
2474 spin_unlock(&tty->files_lock);
2475 tty_kref_put(tty);
2476 }
2477 /* Reset controlling tty. */
2478 if (drop_tty)
2479 no_tty();
2480
2481 /* Revalidate access to inherited open files. */
2482 n = iterate_fd(files, 0, match_file, cred);
2483 if (!n) /* none found? */
2484 return;
2485
2486 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2487 if (IS_ERR(devnull))
2488 devnull = NULL;
2489 /* replace all the matching ones with this */
2490 do {
2491 replace_fd(n - 1, devnull, 0);
2492 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2493 if (devnull)
2494 fput(devnull);
2495 }
2496
2497 /*
2498 * Prepare a process for imminent new credential changes due to exec
2499 */
2500 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2501 {
2502 struct task_security_struct *new_tsec;
2503 struct rlimit *rlim, *initrlim;
2504 int rc, i;
2505
2506 new_tsec = bprm->cred->security;
2507 if (new_tsec->sid == new_tsec->osid)
2508 return;
2509
2510 /* Close files for which the new task SID is not authorized. */
2511 flush_unauthorized_files(bprm->cred, current->files);
2512
2513 /* Always clear parent death signal on SID transitions. */
2514 current->pdeath_signal = 0;
2515
2516 /* Check whether the new SID can inherit resource limits from the old
2517 * SID. If not, reset all soft limits to the lower of the current
2518 * task's hard limit and the init task's soft limit.
2519 *
2520 * Note that the setting of hard limits (even to lower them) can be
2521 * controlled by the setrlimit check. The inclusion of the init task's
2522 * soft limit into the computation is to avoid resetting soft limits
2523 * higher than the default soft limit for cases where the default is
2524 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2525 */
2526 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2527 PROCESS__RLIMITINH, NULL);
2528 if (rc) {
2529 /* protect against do_prlimit() */
2530 task_lock(current);
2531 for (i = 0; i < RLIM_NLIMITS; i++) {
2532 rlim = current->signal->rlim + i;
2533 initrlim = init_task.signal->rlim + i;
2534 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2535 }
2536 task_unlock(current);
2537 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2538 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2539 }
2540 }
2541
2542 /*
2543 * Clean up the process immediately after the installation of new credentials
2544 * due to exec
2545 */
2546 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2547 {
2548 const struct task_security_struct *tsec = current_security();
2549 struct itimerval itimer;
2550 u32 osid, sid;
2551 int rc, i;
2552
2553 osid = tsec->osid;
2554 sid = tsec->sid;
2555
2556 if (sid == osid)
2557 return;
2558
2559 /* Check whether the new SID can inherit signal state from the old SID.
2560 * If not, clear itimers to avoid subsequent signal generation and
2561 * flush and unblock signals.
2562 *
2563 * This must occur _after_ the task SID has been updated so that any
2564 * kill done after the flush will be checked against the new SID.
2565 */
2566 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2567 if (rc) {
2568 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2569 memset(&itimer, 0, sizeof itimer);
2570 for (i = 0; i < 3; i++)
2571 do_setitimer(i, &itimer, NULL);
2572 }
2573 spin_lock_irq(&current->sighand->siglock);
2574 if (!fatal_signal_pending(current)) {
2575 flush_sigqueue(&current->pending);
2576 flush_sigqueue(&current->signal->shared_pending);
2577 flush_signal_handlers(current, 1);
2578 sigemptyset(&current->blocked);
2579 recalc_sigpending();
2580 }
2581 spin_unlock_irq(&current->sighand->siglock);
2582 }
2583
2584 /* Wake up the parent if it is waiting so that it can recheck
2585 * wait permission to the new task SID. */
2586 read_lock(&tasklist_lock);
2587 __wake_up_parent(current, current->real_parent);
2588 read_unlock(&tasklist_lock);
2589 }
2590
2591 /* superblock security operations */
2592
2593 static int selinux_sb_alloc_security(struct super_block *sb)
2594 {
2595 return superblock_alloc_security(sb);
2596 }
2597
2598 static void selinux_sb_free_security(struct super_block *sb)
2599 {
2600 superblock_free_security(sb);
2601 }
2602
2603 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2604 {
2605 if (plen > olen)
2606 return 0;
2607
2608 return !memcmp(prefix, option, plen);
2609 }
2610
2611 static inline int selinux_option(char *option, int len)
2612 {
2613 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2614 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2615 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2616 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2617 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2618 }
2619
2620 static inline void take_option(char **to, char *from, int *first, int len)
2621 {
2622 if (!*first) {
2623 **to = ',';
2624 *to += 1;
2625 } else
2626 *first = 0;
2627 memcpy(*to, from, len);
2628 *to += len;
2629 }
2630
2631 static inline void take_selinux_option(char **to, char *from, int *first,
2632 int len)
2633 {
2634 int current_size = 0;
2635
2636 if (!*first) {
2637 **to = '|';
2638 *to += 1;
2639 } else
2640 *first = 0;
2641
2642 while (current_size < len) {
2643 if (*from != '"') {
2644 **to = *from;
2645 *to += 1;
2646 }
2647 from += 1;
2648 current_size += 1;
2649 }
2650 }
2651
2652 static int selinux_sb_copy_data(char *orig, char *copy)
2653 {
2654 int fnosec, fsec, rc = 0;
2655 char *in_save, *in_curr, *in_end;
2656 char *sec_curr, *nosec_save, *nosec;
2657 int open_quote = 0;
2658
2659 in_curr = orig;
2660 sec_curr = copy;
2661
2662 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2663 if (!nosec) {
2664 rc = -ENOMEM;
2665 goto out;
2666 }
2667
2668 nosec_save = nosec;
2669 fnosec = fsec = 1;
2670 in_save = in_end = orig;
2671
2672 do {
2673 if (*in_end == '"')
2674 open_quote = !open_quote;
2675 if ((*in_end == ',' && open_quote == 0) ||
2676 *in_end == '\0') {
2677 int len = in_end - in_curr;
2678
2679 if (selinux_option(in_curr, len))
2680 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2681 else
2682 take_option(&nosec, in_curr, &fnosec, len);
2683
2684 in_curr = in_end + 1;
2685 }
2686 } while (*in_end++);
2687
2688 strcpy(in_save, nosec_save);
2689 free_page((unsigned long)nosec_save);
2690 out:
2691 return rc;
2692 }
2693
2694 static int selinux_sb_remount(struct super_block *sb, void *data)
2695 {
2696 int rc, i, *flags;
2697 struct security_mnt_opts opts;
2698 char *secdata, **mount_options;
2699 struct superblock_security_struct *sbsec = sb->s_security;
2700
2701 if (!(sbsec->flags & SE_SBINITIALIZED))
2702 return 0;
2703
2704 if (!data)
2705 return 0;
2706
2707 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2708 return 0;
2709
2710 security_init_mnt_opts(&opts);
2711 secdata = alloc_secdata();
2712 if (!secdata)
2713 return -ENOMEM;
2714 rc = selinux_sb_copy_data(data, secdata);
2715 if (rc)
2716 goto out_free_secdata;
2717
2718 rc = selinux_parse_opts_str(secdata, &opts);
2719 if (rc)
2720 goto out_free_secdata;
2721
2722 mount_options = opts.mnt_opts;
2723 flags = opts.mnt_opts_flags;
2724
2725 for (i = 0; i < opts.num_mnt_opts; i++) {
2726 u32 sid;
2727
2728 if (flags[i] == SBLABEL_MNT)
2729 continue;
2730 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2731 if (rc) {
2732 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2733 "(%s) failed for (dev %s, type %s) errno=%d\n",
2734 mount_options[i], sb->s_id, sb->s_type->name, rc);
2735 goto out_free_opts;
2736 }
2737 rc = -EINVAL;
2738 switch (flags[i]) {
2739 case FSCONTEXT_MNT:
2740 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2741 goto out_bad_option;
2742 break;
2743 case CONTEXT_MNT:
2744 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2745 goto out_bad_option;
2746 break;
2747 case ROOTCONTEXT_MNT: {
2748 struct inode_security_struct *root_isec;
2749 root_isec = backing_inode_security(sb->s_root);
2750
2751 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2752 goto out_bad_option;
2753 break;
2754 }
2755 case DEFCONTEXT_MNT:
2756 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757 goto out_bad_option;
2758 break;
2759 default:
2760 goto out_free_opts;
2761 }
2762 }
2763
2764 rc = 0;
2765 out_free_opts:
2766 security_free_mnt_opts(&opts);
2767 out_free_secdata:
2768 free_secdata(secdata);
2769 return rc;
2770 out_bad_option:
2771 printk(KERN_WARNING "SELinux: unable to change security options "
2772 "during remount (dev %s, type=%s)\n", sb->s_id,
2773 sb->s_type->name);
2774 goto out_free_opts;
2775 }
2776
2777 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2778 {
2779 const struct cred *cred = current_cred();
2780 struct common_audit_data ad;
2781 int rc;
2782
2783 rc = superblock_doinit(sb, data);
2784 if (rc)
2785 return rc;
2786
2787 /* Allow all mounts performed by the kernel */
2788 if (flags & MS_KERNMOUNT)
2789 return 0;
2790
2791 ad.type = LSM_AUDIT_DATA_DENTRY;
2792 ad.u.dentry = sb->s_root;
2793 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2794 }
2795
2796 static int selinux_sb_statfs(struct dentry *dentry)
2797 {
2798 const struct cred *cred = current_cred();
2799 struct common_audit_data ad;
2800
2801 ad.type = LSM_AUDIT_DATA_DENTRY;
2802 ad.u.dentry = dentry->d_sb->s_root;
2803 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2804 }
2805
2806 static int selinux_mount(const char *dev_name,
2807 const struct path *path,
2808 const char *type,
2809 unsigned long flags,
2810 void *data)
2811 {
2812 const struct cred *cred = current_cred();
2813
2814 if (flags & MS_REMOUNT)
2815 return superblock_has_perm(cred, path->dentry->d_sb,
2816 FILESYSTEM__REMOUNT, NULL);
2817 else
2818 return path_has_perm(cred, path, FILE__MOUNTON);
2819 }
2820
2821 static int selinux_umount(struct vfsmount *mnt, int flags)
2822 {
2823 const struct cred *cred = current_cred();
2824
2825 return superblock_has_perm(cred, mnt->mnt_sb,
2826 FILESYSTEM__UNMOUNT, NULL);
2827 }
2828
2829 /* inode security operations */
2830
2831 static int selinux_inode_alloc_security(struct inode *inode)
2832 {
2833 return inode_alloc_security(inode);
2834 }
2835
2836 static void selinux_inode_free_security(struct inode *inode)
2837 {
2838 inode_free_security(inode);
2839 }
2840
2841 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2842 const struct qstr *name, void **ctx,
2843 u32 *ctxlen)
2844 {
2845 u32 newsid;
2846 int rc;
2847
2848 rc = selinux_determine_inode_label(current_security(),
2849 d_inode(dentry->d_parent), name,
2850 inode_mode_to_security_class(mode),
2851 &newsid);
2852 if (rc)
2853 return rc;
2854
2855 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2856 }
2857
2858 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2859 struct qstr *name,
2860 const struct cred *old,
2861 struct cred *new)
2862 {
2863 u32 newsid;
2864 int rc;
2865 struct task_security_struct *tsec;
2866
2867 rc = selinux_determine_inode_label(old->security,
2868 d_inode(dentry->d_parent), name,
2869 inode_mode_to_security_class(mode),
2870 &newsid);
2871 if (rc)
2872 return rc;
2873
2874 tsec = new->security;
2875 tsec->create_sid = newsid;
2876 return 0;
2877 }
2878
2879 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2880 const struct qstr *qstr,
2881 const char **name,
2882 void **value, size_t *len)
2883 {
2884 const struct task_security_struct *tsec = current_security();
2885 struct superblock_security_struct *sbsec;
2886 u32 sid, newsid, clen;
2887 int rc;
2888 char *context;
2889
2890 sbsec = dir->i_sb->s_security;
2891
2892 sid = tsec->sid;
2893 newsid = tsec->create_sid;
2894
2895 rc = selinux_determine_inode_label(current_security(),
2896 dir, qstr,
2897 inode_mode_to_security_class(inode->i_mode),
2898 &newsid);
2899 if (rc)
2900 return rc;
2901
2902 /* Possibly defer initialization to selinux_complete_init. */
2903 if (sbsec->flags & SE_SBINITIALIZED) {
2904 struct inode_security_struct *isec = inode->i_security;
2905 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2906 isec->sid = newsid;
2907 isec->initialized = LABEL_INITIALIZED;
2908 }
2909
2910 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2911 return -EOPNOTSUPP;
2912
2913 if (name)
2914 *name = XATTR_SELINUX_SUFFIX;
2915
2916 if (value && len) {
2917 rc = security_sid_to_context_force(newsid, &context, &clen);
2918 if (rc)
2919 return rc;
2920 *value = context;
2921 *len = clen;
2922 }
2923
2924 return 0;
2925 }
2926
2927 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2928 {
2929 return may_create(dir, dentry, SECCLASS_FILE);
2930 }
2931
2932 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2933 {
2934 return may_link(dir, old_dentry, MAY_LINK);
2935 }
2936
2937 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2938 {
2939 return may_link(dir, dentry, MAY_UNLINK);
2940 }
2941
2942 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2943 {
2944 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2945 }
2946
2947 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2948 {
2949 return may_create(dir, dentry, SECCLASS_DIR);
2950 }
2951
2952 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2953 {
2954 return may_link(dir, dentry, MAY_RMDIR);
2955 }
2956
2957 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2958 {
2959 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2960 }
2961
2962 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2963 struct inode *new_inode, struct dentry *new_dentry)
2964 {
2965 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2966 }
2967
2968 static int selinux_inode_readlink(struct dentry *dentry)
2969 {
2970 const struct cred *cred = current_cred();
2971
2972 return dentry_has_perm(cred, dentry, FILE__READ);
2973 }
2974
2975 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2976 bool rcu)
2977 {
2978 const struct cred *cred = current_cred();
2979 struct common_audit_data ad;
2980 struct inode_security_struct *isec;
2981 u32 sid;
2982
2983 validate_creds(cred);
2984
2985 ad.type = LSM_AUDIT_DATA_DENTRY;
2986 ad.u.dentry = dentry;
2987 sid = cred_sid(cred);
2988 isec = inode_security_rcu(inode, rcu);
2989 if (IS_ERR(isec))
2990 return PTR_ERR(isec);
2991
2992 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2993 rcu ? MAY_NOT_BLOCK : 0);
2994 }
2995
2996 static noinline int audit_inode_permission(struct inode *inode,
2997 u32 perms, u32 audited, u32 denied,
2998 int result,
2999 unsigned flags)
3000 {
3001 struct common_audit_data ad;
3002 struct inode_security_struct *isec = inode->i_security;
3003 int rc;
3004
3005 ad.type = LSM_AUDIT_DATA_INODE;
3006 ad.u.inode = inode;
3007
3008 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3009 audited, denied, result, &ad, flags);
3010 if (rc)
3011 return rc;
3012 return 0;
3013 }
3014
3015 static int selinux_inode_permission(struct inode *inode, int mask)
3016 {
3017 const struct cred *cred = current_cred();
3018 u32 perms;
3019 bool from_access;
3020 unsigned flags = mask & MAY_NOT_BLOCK;
3021 struct inode_security_struct *isec;
3022 u32 sid;
3023 struct av_decision avd;
3024 int rc, rc2;
3025 u32 audited, denied;
3026
3027 from_access = mask & MAY_ACCESS;
3028 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3029
3030 /* No permission to check. Existence test. */
3031 if (!mask)
3032 return 0;
3033
3034 validate_creds(cred);
3035
3036 if (unlikely(IS_PRIVATE(inode)))
3037 return 0;
3038
3039 perms = file_mask_to_av(inode->i_mode, mask);
3040
3041 sid = cred_sid(cred);
3042 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3043 if (IS_ERR(isec))
3044 return PTR_ERR(isec);
3045
3046 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3047 audited = avc_audit_required(perms, &avd, rc,
3048 from_access ? FILE__AUDIT_ACCESS : 0,
3049 &denied);
3050 if (likely(!audited))
3051 return rc;
3052
3053 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3054 if (rc2)
3055 return rc2;
3056 return rc;
3057 }
3058
3059 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3060 {
3061 const struct cred *cred = current_cred();
3062 unsigned int ia_valid = iattr->ia_valid;
3063 __u32 av = FILE__WRITE;
3064
3065 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3066 if (ia_valid & ATTR_FORCE) {
3067 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3068 ATTR_FORCE);
3069 if (!ia_valid)
3070 return 0;
3071 }
3072
3073 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3074 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3075 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3076
3077 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3078 && !(ia_valid & ATTR_FILE))
3079 av |= FILE__OPEN;
3080
3081 return dentry_has_perm(cred, dentry, av);
3082 }
3083
3084 static int selinux_inode_getattr(const struct path *path)
3085 {
3086 return path_has_perm(current_cred(), path, FILE__GETATTR);
3087 }
3088
3089 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3090 {
3091 const struct cred *cred = current_cred();
3092
3093 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3094 sizeof XATTR_SECURITY_PREFIX - 1)) {
3095 if (!strcmp(name, XATTR_NAME_CAPS)) {
3096 if (!capable(CAP_SETFCAP))
3097 return -EPERM;
3098 } else if (!capable(CAP_SYS_ADMIN)) {
3099 /* A different attribute in the security namespace.
3100 Restrict to administrator. */
3101 return -EPERM;
3102 }
3103 }
3104
3105 /* Not an attribute we recognize, so just check the
3106 ordinary setattr permission. */
3107 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3108 }
3109
3110 static bool has_cap_mac_admin(bool audit)
3111 {
3112 const struct cred *cred = current_cred();
3113 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3114
3115 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3116 return false;
3117 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3118 return false;
3119 return true;
3120 }
3121
3122 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3123 const void *value, size_t size, int flags)
3124 {
3125 struct inode *inode = d_backing_inode(dentry);
3126 struct inode_security_struct *isec;
3127 struct superblock_security_struct *sbsec;
3128 struct common_audit_data ad;
3129 u32 newsid, sid = current_sid();
3130 int rc = 0;
3131
3132 if (strcmp(name, XATTR_NAME_SELINUX))
3133 return selinux_inode_setotherxattr(dentry, name);
3134
3135 sbsec = inode->i_sb->s_security;
3136 if (!(sbsec->flags & SBLABEL_MNT))
3137 return -EOPNOTSUPP;
3138
3139 if (!inode_owner_or_capable(inode))
3140 return -EPERM;
3141
3142 ad.type = LSM_AUDIT_DATA_DENTRY;
3143 ad.u.dentry = dentry;
3144
3145 isec = backing_inode_security(dentry);
3146 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3147 FILE__RELABELFROM, &ad);
3148 if (rc)
3149 return rc;
3150
3151 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3152 if (rc == -EINVAL) {
3153 if (!has_cap_mac_admin(true)) {
3154 struct audit_buffer *ab;
3155 size_t audit_size;
3156 const char *str;
3157
3158 /* We strip a nul only if it is at the end, otherwise the
3159 * context contains a nul and we should audit that */
3160 if (value) {
3161 str = value;
3162 if (str[size - 1] == '\0')
3163 audit_size = size - 1;
3164 else
3165 audit_size = size;
3166 } else {
3167 str = "";
3168 audit_size = 0;
3169 }
3170 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3171 audit_log_format(ab, "op=setxattr invalid_context=");
3172 audit_log_n_untrustedstring(ab, value, audit_size);
3173 audit_log_end(ab);
3174
3175 return rc;
3176 }
3177 rc = security_context_to_sid_force(value, size, &newsid);
3178 }
3179 if (rc)
3180 return rc;
3181
3182 rc = avc_has_perm(sid, newsid, isec->sclass,
3183 FILE__RELABELTO, &ad);
3184 if (rc)
3185 return rc;
3186
3187 rc = security_validate_transition(isec->sid, newsid, sid,
3188 isec->sclass);
3189 if (rc)
3190 return rc;
3191
3192 return avc_has_perm(newsid,
3193 sbsec->sid,
3194 SECCLASS_FILESYSTEM,
3195 FILESYSTEM__ASSOCIATE,
3196 &ad);
3197 }
3198
3199 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3200 const void *value, size_t size,
3201 int flags)
3202 {
3203 struct inode *inode = d_backing_inode(dentry);
3204 struct inode_security_struct *isec;
3205 u32 newsid;
3206 int rc;
3207
3208 if (strcmp(name, XATTR_NAME_SELINUX)) {
3209 /* Not an attribute we recognize, so nothing to do. */
3210 return;
3211 }
3212
3213 rc = security_context_to_sid_force(value, size, &newsid);
3214 if (rc) {
3215 printk(KERN_ERR "SELinux: unable to map context to SID"
3216 "for (%s, %lu), rc=%d\n",
3217 inode->i_sb->s_id, inode->i_ino, -rc);
3218 return;
3219 }
3220
3221 isec = backing_inode_security(dentry);
3222 spin_lock(&isec->lock);
3223 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3224 isec->sid = newsid;
3225 isec->initialized = LABEL_INITIALIZED;
3226 spin_unlock(&isec->lock);
3227
3228 return;
3229 }
3230
3231 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3232 {
3233 const struct cred *cred = current_cred();
3234
3235 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3236 }
3237
3238 static int selinux_inode_listxattr(struct dentry *dentry)
3239 {
3240 const struct cred *cred = current_cred();
3241
3242 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3243 }
3244
3245 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3246 {
3247 if (strcmp(name, XATTR_NAME_SELINUX))
3248 return selinux_inode_setotherxattr(dentry, name);
3249
3250 /* No one is allowed to remove a SELinux security label.
3251 You can change the label, but all data must be labeled. */
3252 return -EACCES;
3253 }
3254
3255 /*
3256 * Copy the inode security context value to the user.
3257 *
3258 * Permission check is handled by selinux_inode_getxattr hook.
3259 */
3260 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3261 {
3262 u32 size;
3263 int error;
3264 char *context = NULL;
3265 struct inode_security_struct *isec;
3266
3267 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3268 return -EOPNOTSUPP;
3269
3270 /*
3271 * If the caller has CAP_MAC_ADMIN, then get the raw context
3272 * value even if it is not defined by current policy; otherwise,
3273 * use the in-core value under current policy.
3274 * Use the non-auditing forms of the permission checks since
3275 * getxattr may be called by unprivileged processes commonly
3276 * and lack of permission just means that we fall back to the
3277 * in-core context value, not a denial.
3278 */
3279 isec = inode_security(inode);
3280 if (has_cap_mac_admin(false))
3281 error = security_sid_to_context_force(isec->sid, &context,
3282 &size);
3283 else
3284 error = security_sid_to_context(isec->sid, &context, &size);
3285 if (error)
3286 return error;
3287 error = size;
3288 if (alloc) {
3289 *buffer = context;
3290 goto out_nofree;
3291 }
3292 kfree(context);
3293 out_nofree:
3294 return error;
3295 }
3296
3297 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3298 const void *value, size_t size, int flags)
3299 {
3300 struct inode_security_struct *isec = inode_security_novalidate(inode);
3301 u32 newsid;
3302 int rc;
3303
3304 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3305 return -EOPNOTSUPP;
3306
3307 if (!value || !size)
3308 return -EACCES;
3309
3310 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3311 if (rc)
3312 return rc;
3313
3314 spin_lock(&isec->lock);
3315 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3316 isec->sid = newsid;
3317 isec->initialized = LABEL_INITIALIZED;
3318 spin_unlock(&isec->lock);
3319 return 0;
3320 }
3321
3322 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3323 {
3324 const int len = sizeof(XATTR_NAME_SELINUX);
3325 if (buffer && len <= buffer_size)
3326 memcpy(buffer, XATTR_NAME_SELINUX, len);
3327 return len;
3328 }
3329
3330 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3331 {
3332 struct inode_security_struct *isec = inode_security_novalidate(inode);
3333 *secid = isec->sid;
3334 }
3335
3336 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3337 {
3338 u32 sid;
3339 struct task_security_struct *tsec;
3340 struct cred *new_creds = *new;
3341
3342 if (new_creds == NULL) {
3343 new_creds = prepare_creds();
3344 if (!new_creds)
3345 return -ENOMEM;
3346 }
3347
3348 tsec = new_creds->security;
3349 /* Get label from overlay inode and set it in create_sid */
3350 selinux_inode_getsecid(d_inode(src), &sid);
3351 tsec->create_sid = sid;
3352 *new = new_creds;
3353 return 0;
3354 }
3355
3356 static int selinux_inode_copy_up_xattr(const char *name)
3357 {
3358 /* The copy_up hook above sets the initial context on an inode, but we
3359 * don't then want to overwrite it by blindly copying all the lower
3360 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3361 */
3362 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3363 return 1; /* Discard */
3364 /*
3365 * Any other attribute apart from SELINUX is not claimed, supported
3366 * by selinux.
3367 */
3368 return -EOPNOTSUPP;
3369 }
3370
3371 /* file security operations */
3372
3373 static int selinux_revalidate_file_permission(struct file *file, int mask)
3374 {
3375 const struct cred *cred = current_cred();
3376 struct inode *inode = file_inode(file);
3377
3378 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3379 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3380 mask |= MAY_APPEND;
3381
3382 return file_has_perm(cred, file,
3383 file_mask_to_av(inode->i_mode, mask));
3384 }
3385
3386 static int selinux_file_permission(struct file *file, int mask)
3387 {
3388 struct inode *inode = file_inode(file);
3389 struct file_security_struct *fsec = file->f_security;
3390 struct inode_security_struct *isec;
3391 u32 sid = current_sid();
3392
3393 if (!mask)
3394 /* No permission to check. Existence test. */
3395 return 0;
3396
3397 isec = inode_security(inode);
3398 if (sid == fsec->sid && fsec->isid == isec->sid &&
3399 fsec->pseqno == avc_policy_seqno())
3400 /* No change since file_open check. */
3401 return 0;
3402
3403 return selinux_revalidate_file_permission(file, mask);
3404 }
3405
3406 static int selinux_file_alloc_security(struct file *file)
3407 {
3408 return file_alloc_security(file);
3409 }
3410
3411 static void selinux_file_free_security(struct file *file)
3412 {
3413 file_free_security(file);
3414 }
3415
3416 /*
3417 * Check whether a task has the ioctl permission and cmd
3418 * operation to an inode.
3419 */
3420 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3421 u32 requested, u16 cmd)
3422 {
3423 struct common_audit_data ad;
3424 struct file_security_struct *fsec = file->f_security;
3425 struct inode *inode = file_inode(file);
3426 struct inode_security_struct *isec;
3427 struct lsm_ioctlop_audit ioctl;
3428 u32 ssid = cred_sid(cred);
3429 int rc;
3430 u8 driver = cmd >> 8;
3431 u8 xperm = cmd & 0xff;
3432
3433 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3434 ad.u.op = &ioctl;
3435 ad.u.op->cmd = cmd;
3436 ad.u.op->path = file->f_path;
3437
3438 if (ssid != fsec->sid) {
3439 rc = avc_has_perm(ssid, fsec->sid,
3440 SECCLASS_FD,
3441 FD__USE,
3442 &ad);
3443 if (rc)
3444 goto out;
3445 }
3446
3447 if (unlikely(IS_PRIVATE(inode)))
3448 return 0;
3449
3450 isec = inode_security(inode);
3451 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3452 requested, driver, xperm, &ad);
3453 out:
3454 return rc;
3455 }
3456
3457 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3458 unsigned long arg)
3459 {
3460 const struct cred *cred = current_cred();
3461 int error = 0;
3462
3463 switch (cmd) {
3464 case FIONREAD:
3465 /* fall through */
3466 case FIBMAP:
3467 /* fall through */
3468 case FIGETBSZ:
3469 /* fall through */
3470 case FS_IOC_GETFLAGS:
3471 /* fall through */
3472 case FS_IOC_GETVERSION:
3473 error = file_has_perm(cred, file, FILE__GETATTR);
3474 break;
3475
3476 case FS_IOC_SETFLAGS:
3477 /* fall through */
3478 case FS_IOC_SETVERSION:
3479 error = file_has_perm(cred, file, FILE__SETATTR);
3480 break;
3481
3482 /* sys_ioctl() checks */
3483 case FIONBIO:
3484 /* fall through */
3485 case FIOASYNC:
3486 error = file_has_perm(cred, file, 0);
3487 break;
3488
3489 case KDSKBENT:
3490 case KDSKBSENT:
3491 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3492 SECURITY_CAP_AUDIT, true);
3493 break;
3494
3495 /* default case assumes that the command will go
3496 * to the file's ioctl() function.
3497 */
3498 default:
3499 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3500 }
3501 return error;
3502 }
3503
3504 static int default_noexec;
3505
3506 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3507 {
3508 const struct cred *cred = current_cred();
3509 u32 sid = cred_sid(cred);
3510 int rc = 0;
3511
3512 if (default_noexec &&
3513 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3514 (!shared && (prot & PROT_WRITE)))) {
3515 /*
3516 * We are making executable an anonymous mapping or a
3517 * private file mapping that will also be writable.
3518 * This has an additional check.
3519 */
3520 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3521 PROCESS__EXECMEM, NULL);
3522 if (rc)
3523 goto error;
3524 }
3525
3526 if (file) {
3527 /* read access is always possible with a mapping */
3528 u32 av = FILE__READ;
3529
3530 /* write access only matters if the mapping is shared */
3531 if (shared && (prot & PROT_WRITE))
3532 av |= FILE__WRITE;
3533
3534 if (prot & PROT_EXEC)
3535 av |= FILE__EXECUTE;
3536
3537 return file_has_perm(cred, file, av);
3538 }
3539
3540 error:
3541 return rc;
3542 }
3543
3544 static int selinux_mmap_addr(unsigned long addr)
3545 {
3546 int rc = 0;
3547
3548 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3549 u32 sid = current_sid();
3550 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3551 MEMPROTECT__MMAP_ZERO, NULL);
3552 }
3553
3554 return rc;
3555 }
3556
3557 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3558 unsigned long prot, unsigned long flags)
3559 {
3560 if (selinux_checkreqprot)
3561 prot = reqprot;
3562
3563 return file_map_prot_check(file, prot,
3564 (flags & MAP_TYPE) == MAP_SHARED);
3565 }
3566
3567 static int selinux_file_mprotect(struct vm_area_struct *vma,
3568 unsigned long reqprot,
3569 unsigned long prot)
3570 {
3571 const struct cred *cred = current_cred();
3572 u32 sid = cred_sid(cred);
3573
3574 if (selinux_checkreqprot)
3575 prot = reqprot;
3576
3577 if (default_noexec &&
3578 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3579 int rc = 0;
3580 if (vma->vm_start >= vma->vm_mm->start_brk &&
3581 vma->vm_end <= vma->vm_mm->brk) {
3582 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3583 PROCESS__EXECHEAP, NULL);
3584 } else if (!vma->vm_file &&
3585 ((vma->vm_start <= vma->vm_mm->start_stack &&
3586 vma->vm_end >= vma->vm_mm->start_stack) ||
3587 vma_is_stack_for_current(vma))) {
3588 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3589 PROCESS__EXECSTACK, NULL);
3590 } else if (vma->vm_file && vma->anon_vma) {
3591 /*
3592 * We are making executable a file mapping that has
3593 * had some COW done. Since pages might have been
3594 * written, check ability to execute the possibly
3595 * modified content. This typically should only
3596 * occur for text relocations.
3597 */
3598 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3599 }
3600 if (rc)
3601 return rc;
3602 }
3603
3604 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3605 }
3606
3607 static int selinux_file_lock(struct file *file, unsigned int cmd)
3608 {
3609 const struct cred *cred = current_cred();
3610
3611 return file_has_perm(cred, file, FILE__LOCK);
3612 }
3613
3614 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3615 unsigned long arg)
3616 {
3617 const struct cred *cred = current_cred();
3618 int err = 0;
3619
3620 switch (cmd) {
3621 case F_SETFL:
3622 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3623 err = file_has_perm(cred, file, FILE__WRITE);
3624 break;
3625 }
3626 /* fall through */
3627 case F_SETOWN:
3628 case F_SETSIG:
3629 case F_GETFL:
3630 case F_GETOWN:
3631 case F_GETSIG:
3632 case F_GETOWNER_UIDS:
3633 /* Just check FD__USE permission */
3634 err = file_has_perm(cred, file, 0);
3635 break;
3636 case F_GETLK:
3637 case F_SETLK:
3638 case F_SETLKW:
3639 case F_OFD_GETLK:
3640 case F_OFD_SETLK:
3641 case F_OFD_SETLKW:
3642 #if BITS_PER_LONG == 32
3643 case F_GETLK64:
3644 case F_SETLK64:
3645 case F_SETLKW64:
3646 #endif
3647 err = file_has_perm(cred, file, FILE__LOCK);
3648 break;
3649 }
3650
3651 return err;
3652 }
3653
3654 static void selinux_file_set_fowner(struct file *file)
3655 {
3656 struct file_security_struct *fsec;
3657
3658 fsec = file->f_security;
3659 fsec->fown_sid = current_sid();
3660 }
3661
3662 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3663 struct fown_struct *fown, int signum)
3664 {
3665 struct file *file;
3666 u32 sid = task_sid(tsk);
3667 u32 perm;
3668 struct file_security_struct *fsec;
3669
3670 /* struct fown_struct is never outside the context of a struct file */
3671 file = container_of(fown, struct file, f_owner);
3672
3673 fsec = file->f_security;
3674
3675 if (!signum)
3676 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3677 else
3678 perm = signal_to_av(signum);
3679
3680 return avc_has_perm(fsec->fown_sid, sid,
3681 SECCLASS_PROCESS, perm, NULL);
3682 }
3683
3684 static int selinux_file_receive(struct file *file)
3685 {
3686 const struct cred *cred = current_cred();
3687
3688 return file_has_perm(cred, file, file_to_av(file));
3689 }
3690
3691 static int selinux_file_open(struct file *file, const struct cred *cred)
3692 {
3693 struct file_security_struct *fsec;
3694 struct inode_security_struct *isec;
3695
3696 fsec = file->f_security;
3697 isec = inode_security(file_inode(file));
3698 /*
3699 * Save inode label and policy sequence number
3700 * at open-time so that selinux_file_permission
3701 * can determine whether revalidation is necessary.
3702 * Task label is already saved in the file security
3703 * struct as its SID.
3704 */
3705 fsec->isid = isec->sid;
3706 fsec->pseqno = avc_policy_seqno();
3707 /*
3708 * Since the inode label or policy seqno may have changed
3709 * between the selinux_inode_permission check and the saving
3710 * of state above, recheck that access is still permitted.
3711 * Otherwise, access might never be revalidated against the
3712 * new inode label or new policy.
3713 * This check is not redundant - do not remove.
3714 */
3715 return file_path_has_perm(cred, file, open_file_to_av(file));
3716 }
3717
3718 /* task security operations */
3719
3720 static int selinux_task_alloc(struct task_struct *task,
3721 unsigned long clone_flags)
3722 {
3723 u32 sid = current_sid();
3724
3725 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3726 }
3727
3728 /*
3729 * allocate the SELinux part of blank credentials
3730 */
3731 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3732 {
3733 struct task_security_struct *tsec;
3734
3735 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3736 if (!tsec)
3737 return -ENOMEM;
3738
3739 cred->security = tsec;
3740 return 0;
3741 }
3742
3743 /*
3744 * detach and free the LSM part of a set of credentials
3745 */
3746 static void selinux_cred_free(struct cred *cred)
3747 {
3748 struct task_security_struct *tsec = cred->security;
3749
3750 /*
3751 * cred->security == NULL if security_cred_alloc_blank() or
3752 * security_prepare_creds() returned an error.
3753 */
3754 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3755 cred->security = (void *) 0x7UL;
3756 kfree(tsec);
3757 }
3758
3759 /*
3760 * prepare a new set of credentials for modification
3761 */
3762 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3763 gfp_t gfp)
3764 {
3765 const struct task_security_struct *old_tsec;
3766 struct task_security_struct *tsec;
3767
3768 old_tsec = old->security;
3769
3770 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3771 if (!tsec)
3772 return -ENOMEM;
3773
3774 new->security = tsec;
3775 return 0;
3776 }
3777
3778 /*
3779 * transfer the SELinux data to a blank set of creds
3780 */
3781 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3782 {
3783 const struct task_security_struct *old_tsec = old->security;
3784 struct task_security_struct *tsec = new->security;
3785
3786 *tsec = *old_tsec;
3787 }
3788
3789 /*
3790 * set the security data for a kernel service
3791 * - all the creation contexts are set to unlabelled
3792 */
3793 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3794 {
3795 struct task_security_struct *tsec = new->security;
3796 u32 sid = current_sid();
3797 int ret;
3798
3799 ret = avc_has_perm(sid, secid,
3800 SECCLASS_KERNEL_SERVICE,
3801 KERNEL_SERVICE__USE_AS_OVERRIDE,
3802 NULL);
3803 if (ret == 0) {
3804 tsec->sid = secid;
3805 tsec->create_sid = 0;
3806 tsec->keycreate_sid = 0;
3807 tsec->sockcreate_sid = 0;
3808 }
3809 return ret;
3810 }
3811
3812 /*
3813 * set the file creation context in a security record to the same as the
3814 * objective context of the specified inode
3815 */
3816 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3817 {
3818 struct inode_security_struct *isec = inode_security(inode);
3819 struct task_security_struct *tsec = new->security;
3820 u32 sid = current_sid();
3821 int ret;
3822
3823 ret = avc_has_perm(sid, isec->sid,
3824 SECCLASS_KERNEL_SERVICE,
3825 KERNEL_SERVICE__CREATE_FILES_AS,
3826 NULL);
3827
3828 if (ret == 0)
3829 tsec->create_sid = isec->sid;
3830 return ret;
3831 }
3832
3833 static int selinux_kernel_module_request(char *kmod_name)
3834 {
3835 struct common_audit_data ad;
3836
3837 ad.type = LSM_AUDIT_DATA_KMOD;
3838 ad.u.kmod_name = kmod_name;
3839
3840 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3841 SYSTEM__MODULE_REQUEST, &ad);
3842 }
3843
3844 static int selinux_kernel_module_from_file(struct file *file)
3845 {
3846 struct common_audit_data ad;
3847 struct inode_security_struct *isec;
3848 struct file_security_struct *fsec;
3849 u32 sid = current_sid();
3850 int rc;
3851
3852 /* init_module */
3853 if (file == NULL)
3854 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3855 SYSTEM__MODULE_LOAD, NULL);
3856
3857 /* finit_module */
3858
3859 ad.type = LSM_AUDIT_DATA_FILE;
3860 ad.u.file = file;
3861
3862 fsec = file->f_security;
3863 if (sid != fsec->sid) {
3864 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3865 if (rc)
3866 return rc;
3867 }
3868
3869 isec = inode_security(file_inode(file));
3870 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3871 SYSTEM__MODULE_LOAD, &ad);
3872 }
3873
3874 static int selinux_kernel_read_file(struct file *file,
3875 enum kernel_read_file_id id)
3876 {
3877 int rc = 0;
3878
3879 switch (id) {
3880 case READING_MODULE:
3881 rc = selinux_kernel_module_from_file(file);
3882 break;
3883 default:
3884 break;
3885 }
3886
3887 return rc;
3888 }
3889
3890 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3891 {
3892 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3893 PROCESS__SETPGID, NULL);
3894 }
3895
3896 static int selinux_task_getpgid(struct task_struct *p)
3897 {
3898 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3899 PROCESS__GETPGID, NULL);
3900 }
3901
3902 static int selinux_task_getsid(struct task_struct *p)
3903 {
3904 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3905 PROCESS__GETSESSION, NULL);
3906 }
3907
3908 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3909 {
3910 *secid = task_sid(p);
3911 }
3912
3913 static int selinux_task_setnice(struct task_struct *p, int nice)
3914 {
3915 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3916 PROCESS__SETSCHED, NULL);
3917 }
3918
3919 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3920 {
3921 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3922 PROCESS__SETSCHED, NULL);
3923 }
3924
3925 static int selinux_task_getioprio(struct task_struct *p)
3926 {
3927 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3928 PROCESS__GETSCHED, NULL);
3929 }
3930
3931 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3932 unsigned int flags)
3933 {
3934 u32 av = 0;
3935
3936 if (!flags)
3937 return 0;
3938 if (flags & LSM_PRLIMIT_WRITE)
3939 av |= PROCESS__SETRLIMIT;
3940 if (flags & LSM_PRLIMIT_READ)
3941 av |= PROCESS__GETRLIMIT;
3942 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3943 SECCLASS_PROCESS, av, NULL);
3944 }
3945
3946 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3947 struct rlimit *new_rlim)
3948 {
3949 struct rlimit *old_rlim = p->signal->rlim + resource;
3950
3951 /* Control the ability to change the hard limit (whether
3952 lowering or raising it), so that the hard limit can
3953 later be used as a safe reset point for the soft limit
3954 upon context transitions. See selinux_bprm_committing_creds. */
3955 if (old_rlim->rlim_max != new_rlim->rlim_max)
3956 return avc_has_perm(current_sid(), task_sid(p),
3957 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3958
3959 return 0;
3960 }
3961
3962 static int selinux_task_setscheduler(struct task_struct *p)
3963 {
3964 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3965 PROCESS__SETSCHED, NULL);
3966 }
3967
3968 static int selinux_task_getscheduler(struct task_struct *p)
3969 {
3970 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3971 PROCESS__GETSCHED, NULL);
3972 }
3973
3974 static int selinux_task_movememory(struct task_struct *p)
3975 {
3976 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3977 PROCESS__SETSCHED, NULL);
3978 }
3979
3980 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3981 int sig, u32 secid)
3982 {
3983 u32 perm;
3984
3985 if (!sig)
3986 perm = PROCESS__SIGNULL; /* null signal; existence test */
3987 else
3988 perm = signal_to_av(sig);
3989 if (!secid)
3990 secid = current_sid();
3991 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3992 }
3993
3994 static void selinux_task_to_inode(struct task_struct *p,
3995 struct inode *inode)
3996 {
3997 struct inode_security_struct *isec = inode->i_security;
3998 u32 sid = task_sid(p);
3999
4000 spin_lock(&isec->lock);
4001 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4002 isec->sid = sid;
4003 isec->initialized = LABEL_INITIALIZED;
4004 spin_unlock(&isec->lock);
4005 }
4006
4007 /* Returns error only if unable to parse addresses */
4008 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4009 struct common_audit_data *ad, u8 *proto)
4010 {
4011 int offset, ihlen, ret = -EINVAL;
4012 struct iphdr _iph, *ih;
4013
4014 offset = skb_network_offset(skb);
4015 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4016 if (ih == NULL)
4017 goto out;
4018
4019 ihlen = ih->ihl * 4;
4020 if (ihlen < sizeof(_iph))
4021 goto out;
4022
4023 ad->u.net->v4info.saddr = ih->saddr;
4024 ad->u.net->v4info.daddr = ih->daddr;
4025 ret = 0;
4026
4027 if (proto)
4028 *proto = ih->protocol;
4029
4030 switch (ih->protocol) {
4031 case IPPROTO_TCP: {
4032 struct tcphdr _tcph, *th;
4033
4034 if (ntohs(ih->frag_off) & IP_OFFSET)
4035 break;
4036
4037 offset += ihlen;
4038 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4039 if (th == NULL)
4040 break;
4041
4042 ad->u.net->sport = th->source;
4043 ad->u.net->dport = th->dest;
4044 break;
4045 }
4046
4047 case IPPROTO_UDP: {
4048 struct udphdr _udph, *uh;
4049
4050 if (ntohs(ih->frag_off) & IP_OFFSET)
4051 break;
4052
4053 offset += ihlen;
4054 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4055 if (uh == NULL)
4056 break;
4057
4058 ad->u.net->sport = uh->source;
4059 ad->u.net->dport = uh->dest;
4060 break;
4061 }
4062
4063 case IPPROTO_DCCP: {
4064 struct dccp_hdr _dccph, *dh;
4065
4066 if (ntohs(ih->frag_off) & IP_OFFSET)
4067 break;
4068
4069 offset += ihlen;
4070 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4071 if (dh == NULL)
4072 break;
4073
4074 ad->u.net->sport = dh->dccph_sport;
4075 ad->u.net->dport = dh->dccph_dport;
4076 break;
4077 }
4078
4079 default:
4080 break;
4081 }
4082 out:
4083 return ret;
4084 }
4085
4086 #if IS_ENABLED(CONFIG_IPV6)
4087
4088 /* Returns error only if unable to parse addresses */
4089 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4090 struct common_audit_data *ad, u8 *proto)
4091 {
4092 u8 nexthdr;
4093 int ret = -EINVAL, offset;
4094 struct ipv6hdr _ipv6h, *ip6;
4095 __be16 frag_off;
4096
4097 offset = skb_network_offset(skb);
4098 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4099 if (ip6 == NULL)
4100 goto out;
4101
4102 ad->u.net->v6info.saddr = ip6->saddr;
4103 ad->u.net->v6info.daddr = ip6->daddr;
4104 ret = 0;
4105
4106 nexthdr = ip6->nexthdr;
4107 offset += sizeof(_ipv6h);
4108 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4109 if (offset < 0)
4110 goto out;
4111
4112 if (proto)
4113 *proto = nexthdr;
4114
4115 switch (nexthdr) {
4116 case IPPROTO_TCP: {
4117 struct tcphdr _tcph, *th;
4118
4119 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4120 if (th == NULL)
4121 break;
4122
4123 ad->u.net->sport = th->source;
4124 ad->u.net->dport = th->dest;
4125 break;
4126 }
4127
4128 case IPPROTO_UDP: {
4129 struct udphdr _udph, *uh;
4130
4131 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4132 if (uh == NULL)
4133 break;
4134
4135 ad->u.net->sport = uh->source;
4136 ad->u.net->dport = uh->dest;
4137 break;
4138 }
4139
4140 case IPPROTO_DCCP: {
4141 struct dccp_hdr _dccph, *dh;
4142
4143 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4144 if (dh == NULL)
4145 break;
4146
4147 ad->u.net->sport = dh->dccph_sport;
4148 ad->u.net->dport = dh->dccph_dport;
4149 break;
4150 }
4151
4152 /* includes fragments */
4153 default:
4154 break;
4155 }
4156 out:
4157 return ret;
4158 }
4159
4160 #endif /* IPV6 */
4161
4162 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4163 char **_addrp, int src, u8 *proto)
4164 {
4165 char *addrp;
4166 int ret;
4167
4168 switch (ad->u.net->family) {
4169 case PF_INET:
4170 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4171 if (ret)
4172 goto parse_error;
4173 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4174 &ad->u.net->v4info.daddr);
4175 goto okay;
4176
4177 #if IS_ENABLED(CONFIG_IPV6)
4178 case PF_INET6:
4179 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4180 if (ret)
4181 goto parse_error;
4182 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4183 &ad->u.net->v6info.daddr);
4184 goto okay;
4185 #endif /* IPV6 */
4186 default:
4187 addrp = NULL;
4188 goto okay;
4189 }
4190
4191 parse_error:
4192 printk(KERN_WARNING
4193 "SELinux: failure in selinux_parse_skb(),"
4194 " unable to parse packet\n");
4195 return ret;
4196
4197 okay:
4198 if (_addrp)
4199 *_addrp = addrp;
4200 return 0;
4201 }
4202
4203 /**
4204 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4205 * @skb: the packet
4206 * @family: protocol family
4207 * @sid: the packet's peer label SID
4208 *
4209 * Description:
4210 * Check the various different forms of network peer labeling and determine
4211 * the peer label/SID for the packet; most of the magic actually occurs in
4212 * the security server function security_net_peersid_cmp(). The function
4213 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4214 * or -EACCES if @sid is invalid due to inconsistencies with the different
4215 * peer labels.
4216 *
4217 */
4218 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4219 {
4220 int err;
4221 u32 xfrm_sid;
4222 u32 nlbl_sid;
4223 u32 nlbl_type;
4224
4225 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4226 if (unlikely(err))
4227 return -EACCES;
4228 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4229 if (unlikely(err))
4230 return -EACCES;
4231
4232 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4233 if (unlikely(err)) {
4234 printk(KERN_WARNING
4235 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4236 " unable to determine packet's peer label\n");
4237 return -EACCES;
4238 }
4239
4240 return 0;
4241 }
4242
4243 /**
4244 * selinux_conn_sid - Determine the child socket label for a connection
4245 * @sk_sid: the parent socket's SID
4246 * @skb_sid: the packet's SID
4247 * @conn_sid: the resulting connection SID
4248 *
4249 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4250 * combined with the MLS information from @skb_sid in order to create
4251 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4252 * of @sk_sid. Returns zero on success, negative values on failure.
4253 *
4254 */
4255 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4256 {
4257 int err = 0;
4258
4259 if (skb_sid != SECSID_NULL)
4260 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4261 else
4262 *conn_sid = sk_sid;
4263
4264 return err;
4265 }
4266
4267 /* socket security operations */
4268
4269 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4270 u16 secclass, u32 *socksid)
4271 {
4272 if (tsec->sockcreate_sid > SECSID_NULL) {
4273 *socksid = tsec->sockcreate_sid;
4274 return 0;
4275 }
4276
4277 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4278 socksid);
4279 }
4280
4281 static int sock_has_perm(struct sock *sk, u32 perms)
4282 {
4283 struct sk_security_struct *sksec = sk->sk_security;
4284 struct common_audit_data ad;
4285 struct lsm_network_audit net = {0,};
4286
4287 if (sksec->sid == SECINITSID_KERNEL)
4288 return 0;
4289
4290 ad.type = LSM_AUDIT_DATA_NET;
4291 ad.u.net = &net;
4292 ad.u.net->sk = sk;
4293
4294 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4295 &ad);
4296 }
4297
4298 static int selinux_socket_create(int family, int type,
4299 int protocol, int kern)
4300 {
4301 const struct task_security_struct *tsec = current_security();
4302 u32 newsid;
4303 u16 secclass;
4304 int rc;
4305
4306 if (kern)
4307 return 0;
4308
4309 secclass = socket_type_to_security_class(family, type, protocol);
4310 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4311 if (rc)
4312 return rc;
4313
4314 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4315 }
4316
4317 static int selinux_socket_post_create(struct socket *sock, int family,
4318 int type, int protocol, int kern)
4319 {
4320 const struct task_security_struct *tsec = current_security();
4321 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4322 struct sk_security_struct *sksec;
4323 u16 sclass = socket_type_to_security_class(family, type, protocol);
4324 u32 sid = SECINITSID_KERNEL;
4325 int err = 0;
4326
4327 if (!kern) {
4328 err = socket_sockcreate_sid(tsec, sclass, &sid);
4329 if (err)
4330 return err;
4331 }
4332
4333 isec->sclass = sclass;
4334 isec->sid = sid;
4335 isec->initialized = LABEL_INITIALIZED;
4336
4337 if (sock->sk) {
4338 sksec = sock->sk->sk_security;
4339 sksec->sclass = sclass;
4340 sksec->sid = sid;
4341 err = selinux_netlbl_socket_post_create(sock->sk, family);
4342 }
4343
4344 return err;
4345 }
4346
4347 /* Range of port numbers used to automatically bind.
4348 Need to determine whether we should perform a name_bind
4349 permission check between the socket and the port number. */
4350
4351 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4352 {
4353 struct sock *sk = sock->sk;
4354 u16 family;
4355 int err;
4356
4357 err = sock_has_perm(sk, SOCKET__BIND);
4358 if (err)
4359 goto out;
4360
4361 /*
4362 * If PF_INET or PF_INET6, check name_bind permission for the port.
4363 * Multiple address binding for SCTP is not supported yet: we just
4364 * check the first address now.
4365 */
4366 family = sk->sk_family;
4367 if (family == PF_INET || family == PF_INET6) {
4368 char *addrp;
4369 struct sk_security_struct *sksec = sk->sk_security;
4370 struct common_audit_data ad;
4371 struct lsm_network_audit net = {0,};
4372 struct sockaddr_in *addr4 = NULL;
4373 struct sockaddr_in6 *addr6 = NULL;
4374 unsigned short snum;
4375 u32 sid, node_perm;
4376
4377 if (family == PF_INET) {
4378 if (addrlen < sizeof(struct sockaddr_in)) {
4379 err = -EINVAL;
4380 goto out;
4381 }
4382 addr4 = (struct sockaddr_in *)address;
4383 snum = ntohs(addr4->sin_port);
4384 addrp = (char *)&addr4->sin_addr.s_addr;
4385 } else {
4386 if (addrlen < SIN6_LEN_RFC2133) {
4387 err = -EINVAL;
4388 goto out;
4389 }
4390 addr6 = (struct sockaddr_in6 *)address;
4391 snum = ntohs(addr6->sin6_port);
4392 addrp = (char *)&addr6->sin6_addr.s6_addr;
4393 }
4394
4395 if (snum) {
4396 int low, high;
4397
4398 inet_get_local_port_range(sock_net(sk), &low, &high);
4399
4400 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4401 snum > high) {
4402 err = sel_netport_sid(sk->sk_protocol,
4403 snum, &sid);
4404 if (err)
4405 goto out;
4406 ad.type = LSM_AUDIT_DATA_NET;
4407 ad.u.net = &net;
4408 ad.u.net->sport = htons(snum);
4409 ad.u.net->family = family;
4410 err = avc_has_perm(sksec->sid, sid,
4411 sksec->sclass,
4412 SOCKET__NAME_BIND, &ad);
4413 if (err)
4414 goto out;
4415 }
4416 }
4417
4418 switch (sksec->sclass) {
4419 case SECCLASS_TCP_SOCKET:
4420 node_perm = TCP_SOCKET__NODE_BIND;
4421 break;
4422
4423 case SECCLASS_UDP_SOCKET:
4424 node_perm = UDP_SOCKET__NODE_BIND;
4425 break;
4426
4427 case SECCLASS_DCCP_SOCKET:
4428 node_perm = DCCP_SOCKET__NODE_BIND;
4429 break;
4430
4431 default:
4432 node_perm = RAWIP_SOCKET__NODE_BIND;
4433 break;
4434 }
4435
4436 err = sel_netnode_sid(addrp, family, &sid);
4437 if (err)
4438 goto out;
4439
4440 ad.type = LSM_AUDIT_DATA_NET;
4441 ad.u.net = &net;
4442 ad.u.net->sport = htons(snum);
4443 ad.u.net->family = family;
4444
4445 if (family == PF_INET)
4446 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4447 else
4448 ad.u.net->v6info.saddr = addr6->sin6_addr;
4449
4450 err = avc_has_perm(sksec->sid, sid,
4451 sksec->sclass, node_perm, &ad);
4452 if (err)
4453 goto out;
4454 }
4455 out:
4456 return err;
4457 }
4458
4459 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4460 {
4461 struct sock *sk = sock->sk;
4462 struct sk_security_struct *sksec = sk->sk_security;
4463 int err;
4464
4465 err = sock_has_perm(sk, SOCKET__CONNECT);
4466 if (err)
4467 return err;
4468
4469 /*
4470 * If a TCP or DCCP socket, check name_connect permission for the port.
4471 */
4472 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4473 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4474 struct common_audit_data ad;
4475 struct lsm_network_audit net = {0,};
4476 struct sockaddr_in *addr4 = NULL;
4477 struct sockaddr_in6 *addr6 = NULL;
4478 unsigned short snum;
4479 u32 sid, perm;
4480
4481 if (sk->sk_family == PF_INET) {
4482 addr4 = (struct sockaddr_in *)address;
4483 if (addrlen < sizeof(struct sockaddr_in))
4484 return -EINVAL;
4485 snum = ntohs(addr4->sin_port);
4486 } else {
4487 addr6 = (struct sockaddr_in6 *)address;
4488 if (addrlen < SIN6_LEN_RFC2133)
4489 return -EINVAL;
4490 snum = ntohs(addr6->sin6_port);
4491 }
4492
4493 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4494 if (err)
4495 goto out;
4496
4497 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4498 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4499
4500 ad.type = LSM_AUDIT_DATA_NET;
4501 ad.u.net = &net;
4502 ad.u.net->dport = htons(snum);
4503 ad.u.net->family = sk->sk_family;
4504 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4505 if (err)
4506 goto out;
4507 }
4508
4509 err = selinux_netlbl_socket_connect(sk, address);
4510
4511 out:
4512 return err;
4513 }
4514
4515 static int selinux_socket_listen(struct socket *sock, int backlog)
4516 {
4517 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4518 }
4519
4520 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4521 {
4522 int err;
4523 struct inode_security_struct *isec;
4524 struct inode_security_struct *newisec;
4525 u16 sclass;
4526 u32 sid;
4527
4528 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4529 if (err)
4530 return err;
4531
4532 isec = inode_security_novalidate(SOCK_INODE(sock));
4533 spin_lock(&isec->lock);
4534 sclass = isec->sclass;
4535 sid = isec->sid;
4536 spin_unlock(&isec->lock);
4537
4538 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4539 newisec->sclass = sclass;
4540 newisec->sid = sid;
4541 newisec->initialized = LABEL_INITIALIZED;
4542
4543 return 0;
4544 }
4545
4546 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4547 int size)
4548 {
4549 return sock_has_perm(sock->sk, SOCKET__WRITE);
4550 }
4551
4552 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4553 int size, int flags)
4554 {
4555 return sock_has_perm(sock->sk, SOCKET__READ);
4556 }
4557
4558 static int selinux_socket_getsockname(struct socket *sock)
4559 {
4560 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4561 }
4562
4563 static int selinux_socket_getpeername(struct socket *sock)
4564 {
4565 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4566 }
4567
4568 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4569 {
4570 int err;
4571
4572 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4573 if (err)
4574 return err;
4575
4576 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4577 }
4578
4579 static int selinux_socket_getsockopt(struct socket *sock, int level,
4580 int optname)
4581 {
4582 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4583 }
4584
4585 static int selinux_socket_shutdown(struct socket *sock, int how)
4586 {
4587 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4588 }
4589
4590 static int selinux_socket_unix_stream_connect(struct sock *sock,
4591 struct sock *other,
4592 struct sock *newsk)
4593 {
4594 struct sk_security_struct *sksec_sock = sock->sk_security;
4595 struct sk_security_struct *sksec_other = other->sk_security;
4596 struct sk_security_struct *sksec_new = newsk->sk_security;
4597 struct common_audit_data ad;
4598 struct lsm_network_audit net = {0,};
4599 int err;
4600
4601 ad.type = LSM_AUDIT_DATA_NET;
4602 ad.u.net = &net;
4603 ad.u.net->sk = other;
4604
4605 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4606 sksec_other->sclass,
4607 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4608 if (err)
4609 return err;
4610
4611 /* server child socket */
4612 sksec_new->peer_sid = sksec_sock->sid;
4613 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4614 &sksec_new->sid);
4615 if (err)
4616 return err;
4617
4618 /* connecting socket */
4619 sksec_sock->peer_sid = sksec_new->sid;
4620
4621 return 0;
4622 }
4623
4624 static int selinux_socket_unix_may_send(struct socket *sock,
4625 struct socket *other)
4626 {
4627 struct sk_security_struct *ssec = sock->sk->sk_security;
4628 struct sk_security_struct *osec = other->sk->sk_security;
4629 struct common_audit_data ad;
4630 struct lsm_network_audit net = {0,};
4631
4632 ad.type = LSM_AUDIT_DATA_NET;
4633 ad.u.net = &net;
4634 ad.u.net->sk = other->sk;
4635
4636 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4637 &ad);
4638 }
4639
4640 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4641 char *addrp, u16 family, u32 peer_sid,
4642 struct common_audit_data *ad)
4643 {
4644 int err;
4645 u32 if_sid;
4646 u32 node_sid;
4647
4648 err = sel_netif_sid(ns, ifindex, &if_sid);
4649 if (err)
4650 return err;
4651 err = avc_has_perm(peer_sid, if_sid,
4652 SECCLASS_NETIF, NETIF__INGRESS, ad);
4653 if (err)
4654 return err;
4655
4656 err = sel_netnode_sid(addrp, family, &node_sid);
4657 if (err)
4658 return err;
4659 return avc_has_perm(peer_sid, node_sid,
4660 SECCLASS_NODE, NODE__RECVFROM, ad);
4661 }
4662
4663 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4664 u16 family)
4665 {
4666 int err = 0;
4667 struct sk_security_struct *sksec = sk->sk_security;
4668 u32 sk_sid = sksec->sid;
4669 struct common_audit_data ad;
4670 struct lsm_network_audit net = {0,};
4671 char *addrp;
4672
4673 ad.type = LSM_AUDIT_DATA_NET;
4674 ad.u.net = &net;
4675 ad.u.net->netif = skb->skb_iif;
4676 ad.u.net->family = family;
4677 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4678 if (err)
4679 return err;
4680
4681 if (selinux_secmark_enabled()) {
4682 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4683 PACKET__RECV, &ad);
4684 if (err)
4685 return err;
4686 }
4687
4688 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4689 if (err)
4690 return err;
4691 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4692
4693 return err;
4694 }
4695
4696 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4697 {
4698 int err;
4699 struct sk_security_struct *sksec = sk->sk_security;
4700 u16 family = sk->sk_family;
4701 u32 sk_sid = sksec->sid;
4702 struct common_audit_data ad;
4703 struct lsm_network_audit net = {0,};
4704 char *addrp;
4705 u8 secmark_active;
4706 u8 peerlbl_active;
4707
4708 if (family != PF_INET && family != PF_INET6)
4709 return 0;
4710
4711 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4712 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4713 family = PF_INET;
4714
4715 /* If any sort of compatibility mode is enabled then handoff processing
4716 * to the selinux_sock_rcv_skb_compat() function to deal with the
4717 * special handling. We do this in an attempt to keep this function
4718 * as fast and as clean as possible. */
4719 if (!selinux_policycap_netpeer)
4720 return selinux_sock_rcv_skb_compat(sk, skb, family);
4721
4722 secmark_active = selinux_secmark_enabled();
4723 peerlbl_active = selinux_peerlbl_enabled();
4724 if (!secmark_active && !peerlbl_active)
4725 return 0;
4726
4727 ad.type = LSM_AUDIT_DATA_NET;
4728 ad.u.net = &net;
4729 ad.u.net->netif = skb->skb_iif;
4730 ad.u.net->family = family;
4731 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4732 if (err)
4733 return err;
4734
4735 if (peerlbl_active) {
4736 u32 peer_sid;
4737
4738 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4739 if (err)
4740 return err;
4741 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4742 addrp, family, peer_sid, &ad);
4743 if (err) {
4744 selinux_netlbl_err(skb, family, err, 0);
4745 return err;
4746 }
4747 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4748 PEER__RECV, &ad);
4749 if (err) {
4750 selinux_netlbl_err(skb, family, err, 0);
4751 return err;
4752 }
4753 }
4754
4755 if (secmark_active) {
4756 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4757 PACKET__RECV, &ad);
4758 if (err)
4759 return err;
4760 }
4761
4762 return err;
4763 }
4764
4765 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4766 int __user *optlen, unsigned len)
4767 {
4768 int err = 0;
4769 char *scontext;
4770 u32 scontext_len;
4771 struct sk_security_struct *sksec = sock->sk->sk_security;
4772 u32 peer_sid = SECSID_NULL;
4773
4774 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4775 sksec->sclass == SECCLASS_TCP_SOCKET)
4776 peer_sid = sksec->peer_sid;
4777 if (peer_sid == SECSID_NULL)
4778 return -ENOPROTOOPT;
4779
4780 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4781 if (err)
4782 return err;
4783
4784 if (scontext_len > len) {
4785 err = -ERANGE;
4786 goto out_len;
4787 }
4788
4789 if (copy_to_user(optval, scontext, scontext_len))
4790 err = -EFAULT;
4791
4792 out_len:
4793 if (put_user(scontext_len, optlen))
4794 err = -EFAULT;
4795 kfree(scontext);
4796 return err;
4797 }
4798
4799 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4800 {
4801 u32 peer_secid = SECSID_NULL;
4802 u16 family;
4803 struct inode_security_struct *isec;
4804
4805 if (skb && skb->protocol == htons(ETH_P_IP))
4806 family = PF_INET;
4807 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4808 family = PF_INET6;
4809 else if (sock)
4810 family = sock->sk->sk_family;
4811 else
4812 goto out;
4813
4814 if (sock && family == PF_UNIX) {
4815 isec = inode_security_novalidate(SOCK_INODE(sock));
4816 peer_secid = isec->sid;
4817 } else if (skb)
4818 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4819
4820 out:
4821 *secid = peer_secid;
4822 if (peer_secid == SECSID_NULL)
4823 return -EINVAL;
4824 return 0;
4825 }
4826
4827 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4828 {
4829 struct sk_security_struct *sksec;
4830
4831 sksec = kzalloc(sizeof(*sksec), priority);
4832 if (!sksec)
4833 return -ENOMEM;
4834
4835 sksec->peer_sid = SECINITSID_UNLABELED;
4836 sksec->sid = SECINITSID_UNLABELED;
4837 sksec->sclass = SECCLASS_SOCKET;
4838 selinux_netlbl_sk_security_reset(sksec);
4839 sk->sk_security = sksec;
4840
4841 return 0;
4842 }
4843
4844 static void selinux_sk_free_security(struct sock *sk)
4845 {
4846 struct sk_security_struct *sksec = sk->sk_security;
4847
4848 sk->sk_security = NULL;
4849 selinux_netlbl_sk_security_free(sksec);
4850 kfree(sksec);
4851 }
4852
4853 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4854 {
4855 struct sk_security_struct *sksec = sk->sk_security;
4856 struct sk_security_struct *newsksec = newsk->sk_security;
4857
4858 newsksec->sid = sksec->sid;
4859 newsksec->peer_sid = sksec->peer_sid;
4860 newsksec->sclass = sksec->sclass;
4861
4862 selinux_netlbl_sk_security_reset(newsksec);
4863 }
4864
4865 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4866 {
4867 if (!sk)
4868 *secid = SECINITSID_ANY_SOCKET;
4869 else {
4870 struct sk_security_struct *sksec = sk->sk_security;
4871
4872 *secid = sksec->sid;
4873 }
4874 }
4875
4876 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4877 {
4878 struct inode_security_struct *isec =
4879 inode_security_novalidate(SOCK_INODE(parent));
4880 struct sk_security_struct *sksec = sk->sk_security;
4881
4882 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4883 sk->sk_family == PF_UNIX)
4884 isec->sid = sksec->sid;
4885 sksec->sclass = isec->sclass;
4886 }
4887
4888 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4889 struct request_sock *req)
4890 {
4891 struct sk_security_struct *sksec = sk->sk_security;
4892 int err;
4893 u16 family = req->rsk_ops->family;
4894 u32 connsid;
4895 u32 peersid;
4896
4897 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4898 if (err)
4899 return err;
4900 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4901 if (err)
4902 return err;
4903 req->secid = connsid;
4904 req->peer_secid = peersid;
4905
4906 return selinux_netlbl_inet_conn_request(req, family);
4907 }
4908
4909 static void selinux_inet_csk_clone(struct sock *newsk,
4910 const struct request_sock *req)
4911 {
4912 struct sk_security_struct *newsksec = newsk->sk_security;
4913
4914 newsksec->sid = req->secid;
4915 newsksec->peer_sid = req->peer_secid;
4916 /* NOTE: Ideally, we should also get the isec->sid for the
4917 new socket in sync, but we don't have the isec available yet.
4918 So we will wait until sock_graft to do it, by which
4919 time it will have been created and available. */
4920
4921 /* We don't need to take any sort of lock here as we are the only
4922 * thread with access to newsksec */
4923 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4924 }
4925
4926 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4927 {
4928 u16 family = sk->sk_family;
4929 struct sk_security_struct *sksec = sk->sk_security;
4930
4931 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4932 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4933 family = PF_INET;
4934
4935 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4936 }
4937
4938 static int selinux_secmark_relabel_packet(u32 sid)
4939 {
4940 const struct task_security_struct *__tsec;
4941 u32 tsid;
4942
4943 __tsec = current_security();
4944 tsid = __tsec->sid;
4945
4946 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4947 }
4948
4949 static void selinux_secmark_refcount_inc(void)
4950 {
4951 atomic_inc(&selinux_secmark_refcount);
4952 }
4953
4954 static void selinux_secmark_refcount_dec(void)
4955 {
4956 atomic_dec(&selinux_secmark_refcount);
4957 }
4958
4959 static void selinux_req_classify_flow(const struct request_sock *req,
4960 struct flowi *fl)
4961 {
4962 fl->flowi_secid = req->secid;
4963 }
4964
4965 static int selinux_tun_dev_alloc_security(void **security)
4966 {
4967 struct tun_security_struct *tunsec;
4968
4969 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4970 if (!tunsec)
4971 return -ENOMEM;
4972 tunsec->sid = current_sid();
4973
4974 *security = tunsec;
4975 return 0;
4976 }
4977
4978 static void selinux_tun_dev_free_security(void *security)
4979 {
4980 kfree(security);
4981 }
4982
4983 static int selinux_tun_dev_create(void)
4984 {
4985 u32 sid = current_sid();
4986
4987 /* we aren't taking into account the "sockcreate" SID since the socket
4988 * that is being created here is not a socket in the traditional sense,
4989 * instead it is a private sock, accessible only to the kernel, and
4990 * representing a wide range of network traffic spanning multiple
4991 * connections unlike traditional sockets - check the TUN driver to
4992 * get a better understanding of why this socket is special */
4993
4994 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4995 NULL);
4996 }
4997
4998 static int selinux_tun_dev_attach_queue(void *security)
4999 {
5000 struct tun_security_struct *tunsec = security;
5001
5002 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5003 TUN_SOCKET__ATTACH_QUEUE, NULL);
5004 }
5005
5006 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5007 {
5008 struct tun_security_struct *tunsec = security;
5009 struct sk_security_struct *sksec = sk->sk_security;
5010
5011 /* we don't currently perform any NetLabel based labeling here and it
5012 * isn't clear that we would want to do so anyway; while we could apply
5013 * labeling without the support of the TUN user the resulting labeled
5014 * traffic from the other end of the connection would almost certainly
5015 * cause confusion to the TUN user that had no idea network labeling
5016 * protocols were being used */
5017
5018 sksec->sid = tunsec->sid;
5019 sksec->sclass = SECCLASS_TUN_SOCKET;
5020
5021 return 0;
5022 }
5023
5024 static int selinux_tun_dev_open(void *security)
5025 {
5026 struct tun_security_struct *tunsec = security;
5027 u32 sid = current_sid();
5028 int err;
5029
5030 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5031 TUN_SOCKET__RELABELFROM, NULL);
5032 if (err)
5033 return err;
5034 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5035 TUN_SOCKET__RELABELTO, NULL);
5036 if (err)
5037 return err;
5038 tunsec->sid = sid;
5039
5040 return 0;
5041 }
5042
5043 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5044 {
5045 int err = 0;
5046 u32 perm;
5047 struct nlmsghdr *nlh;
5048 struct sk_security_struct *sksec = sk->sk_security;
5049
5050 if (skb->len < NLMSG_HDRLEN) {
5051 err = -EINVAL;
5052 goto out;
5053 }
5054 nlh = nlmsg_hdr(skb);
5055
5056 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5057 if (err) {
5058 if (err == -EINVAL) {
5059 pr_warn_ratelimited("SELinux: unrecognized netlink"
5060 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5061 " pig=%d comm=%s\n",
5062 sk->sk_protocol, nlh->nlmsg_type,
5063 secclass_map[sksec->sclass - 1].name,
5064 task_pid_nr(current), current->comm);
5065 if (!selinux_enforcing || security_get_allow_unknown())
5066 err = 0;
5067 }
5068
5069 /* Ignore */
5070 if (err == -ENOENT)
5071 err = 0;
5072 goto out;
5073 }
5074
5075 err = sock_has_perm(sk, perm);
5076 out:
5077 return err;
5078 }
5079
5080 #ifdef CONFIG_NETFILTER
5081
5082 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5083 const struct net_device *indev,
5084 u16 family)
5085 {
5086 int err;
5087 char *addrp;
5088 u32 peer_sid;
5089 struct common_audit_data ad;
5090 struct lsm_network_audit net = {0,};
5091 u8 secmark_active;
5092 u8 netlbl_active;
5093 u8 peerlbl_active;
5094
5095 if (!selinux_policycap_netpeer)
5096 return NF_ACCEPT;
5097
5098 secmark_active = selinux_secmark_enabled();
5099 netlbl_active = netlbl_enabled();
5100 peerlbl_active = selinux_peerlbl_enabled();
5101 if (!secmark_active && !peerlbl_active)
5102 return NF_ACCEPT;
5103
5104 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5105 return NF_DROP;
5106
5107 ad.type = LSM_AUDIT_DATA_NET;
5108 ad.u.net = &net;
5109 ad.u.net->netif = indev->ifindex;
5110 ad.u.net->family = family;
5111 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5112 return NF_DROP;
5113
5114 if (peerlbl_active) {
5115 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5116 addrp, family, peer_sid, &ad);
5117 if (err) {
5118 selinux_netlbl_err(skb, family, err, 1);
5119 return NF_DROP;
5120 }
5121 }
5122
5123 if (secmark_active)
5124 if (avc_has_perm(peer_sid, skb->secmark,
5125 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5126 return NF_DROP;
5127
5128 if (netlbl_active)
5129 /* we do this in the FORWARD path and not the POST_ROUTING
5130 * path because we want to make sure we apply the necessary
5131 * labeling before IPsec is applied so we can leverage AH
5132 * protection */
5133 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5134 return NF_DROP;
5135
5136 return NF_ACCEPT;
5137 }
5138
5139 static unsigned int selinux_ipv4_forward(void *priv,
5140 struct sk_buff *skb,
5141 const struct nf_hook_state *state)
5142 {
5143 return selinux_ip_forward(skb, state->in, PF_INET);
5144 }
5145
5146 #if IS_ENABLED(CONFIG_IPV6)
5147 static unsigned int selinux_ipv6_forward(void *priv,
5148 struct sk_buff *skb,
5149 const struct nf_hook_state *state)
5150 {
5151 return selinux_ip_forward(skb, state->in, PF_INET6);
5152 }
5153 #endif /* IPV6 */
5154
5155 static unsigned int selinux_ip_output(struct sk_buff *skb,
5156 u16 family)
5157 {
5158 struct sock *sk;
5159 u32 sid;
5160
5161 if (!netlbl_enabled())
5162 return NF_ACCEPT;
5163
5164 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5165 * because we want to make sure we apply the necessary labeling
5166 * before IPsec is applied so we can leverage AH protection */
5167 sk = skb->sk;
5168 if (sk) {
5169 struct sk_security_struct *sksec;
5170
5171 if (sk_listener(sk))
5172 /* if the socket is the listening state then this
5173 * packet is a SYN-ACK packet which means it needs to
5174 * be labeled based on the connection/request_sock and
5175 * not the parent socket. unfortunately, we can't
5176 * lookup the request_sock yet as it isn't queued on
5177 * the parent socket until after the SYN-ACK is sent.
5178 * the "solution" is to simply pass the packet as-is
5179 * as any IP option based labeling should be copied
5180 * from the initial connection request (in the IP
5181 * layer). it is far from ideal, but until we get a
5182 * security label in the packet itself this is the
5183 * best we can do. */
5184 return NF_ACCEPT;
5185
5186 /* standard practice, label using the parent socket */
5187 sksec = sk->sk_security;
5188 sid = sksec->sid;
5189 } else
5190 sid = SECINITSID_KERNEL;
5191 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5192 return NF_DROP;
5193
5194 return NF_ACCEPT;
5195 }
5196
5197 static unsigned int selinux_ipv4_output(void *priv,
5198 struct sk_buff *skb,
5199 const struct nf_hook_state *state)
5200 {
5201 return selinux_ip_output(skb, PF_INET);
5202 }
5203
5204 #if IS_ENABLED(CONFIG_IPV6)
5205 static unsigned int selinux_ipv6_output(void *priv,
5206 struct sk_buff *skb,
5207 const struct nf_hook_state *state)
5208 {
5209 return selinux_ip_output(skb, PF_INET6);
5210 }
5211 #endif /* IPV6 */
5212
5213 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5214 int ifindex,
5215 u16 family)
5216 {
5217 struct sock *sk = skb_to_full_sk(skb);
5218 struct sk_security_struct *sksec;
5219 struct common_audit_data ad;
5220 struct lsm_network_audit net = {0,};
5221 char *addrp;
5222 u8 proto;
5223
5224 if (sk == NULL)
5225 return NF_ACCEPT;
5226 sksec = sk->sk_security;
5227
5228 ad.type = LSM_AUDIT_DATA_NET;
5229 ad.u.net = &net;
5230 ad.u.net->netif = ifindex;
5231 ad.u.net->family = family;
5232 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5233 return NF_DROP;
5234
5235 if (selinux_secmark_enabled())
5236 if (avc_has_perm(sksec->sid, skb->secmark,
5237 SECCLASS_PACKET, PACKET__SEND, &ad))
5238 return NF_DROP_ERR(-ECONNREFUSED);
5239
5240 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5241 return NF_DROP_ERR(-ECONNREFUSED);
5242
5243 return NF_ACCEPT;
5244 }
5245
5246 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5247 const struct net_device *outdev,
5248 u16 family)
5249 {
5250 u32 secmark_perm;
5251 u32 peer_sid;
5252 int ifindex = outdev->ifindex;
5253 struct sock *sk;
5254 struct common_audit_data ad;
5255 struct lsm_network_audit net = {0,};
5256 char *addrp;
5257 u8 secmark_active;
5258 u8 peerlbl_active;
5259
5260 /* If any sort of compatibility mode is enabled then handoff processing
5261 * to the selinux_ip_postroute_compat() function to deal with the
5262 * special handling. We do this in an attempt to keep this function
5263 * as fast and as clean as possible. */
5264 if (!selinux_policycap_netpeer)
5265 return selinux_ip_postroute_compat(skb, ifindex, family);
5266
5267 secmark_active = selinux_secmark_enabled();
5268 peerlbl_active = selinux_peerlbl_enabled();
5269 if (!secmark_active && !peerlbl_active)
5270 return NF_ACCEPT;
5271
5272 sk = skb_to_full_sk(skb);
5273
5274 #ifdef CONFIG_XFRM
5275 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5276 * packet transformation so allow the packet to pass without any checks
5277 * since we'll have another chance to perform access control checks
5278 * when the packet is on it's final way out.
5279 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5280 * is NULL, in this case go ahead and apply access control.
5281 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5282 * TCP listening state we cannot wait until the XFRM processing
5283 * is done as we will miss out on the SA label if we do;
5284 * unfortunately, this means more work, but it is only once per
5285 * connection. */
5286 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5287 !(sk && sk_listener(sk)))
5288 return NF_ACCEPT;
5289 #endif
5290
5291 if (sk == NULL) {
5292 /* Without an associated socket the packet is either coming
5293 * from the kernel or it is being forwarded; check the packet
5294 * to determine which and if the packet is being forwarded
5295 * query the packet directly to determine the security label. */
5296 if (skb->skb_iif) {
5297 secmark_perm = PACKET__FORWARD_OUT;
5298 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5299 return NF_DROP;
5300 } else {
5301 secmark_perm = PACKET__SEND;
5302 peer_sid = SECINITSID_KERNEL;
5303 }
5304 } else if (sk_listener(sk)) {
5305 /* Locally generated packet but the associated socket is in the
5306 * listening state which means this is a SYN-ACK packet. In
5307 * this particular case the correct security label is assigned
5308 * to the connection/request_sock but unfortunately we can't
5309 * query the request_sock as it isn't queued on the parent
5310 * socket until after the SYN-ACK packet is sent; the only
5311 * viable choice is to regenerate the label like we do in
5312 * selinux_inet_conn_request(). See also selinux_ip_output()
5313 * for similar problems. */
5314 u32 skb_sid;
5315 struct sk_security_struct *sksec;
5316
5317 sksec = sk->sk_security;
5318 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5319 return NF_DROP;
5320 /* At this point, if the returned skb peerlbl is SECSID_NULL
5321 * and the packet has been through at least one XFRM
5322 * transformation then we must be dealing with the "final"
5323 * form of labeled IPsec packet; since we've already applied
5324 * all of our access controls on this packet we can safely
5325 * pass the packet. */
5326 if (skb_sid == SECSID_NULL) {
5327 switch (family) {
5328 case PF_INET:
5329 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5330 return NF_ACCEPT;
5331 break;
5332 case PF_INET6:
5333 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5334 return NF_ACCEPT;
5335 break;
5336 default:
5337 return NF_DROP_ERR(-ECONNREFUSED);
5338 }
5339 }
5340 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5341 return NF_DROP;
5342 secmark_perm = PACKET__SEND;
5343 } else {
5344 /* Locally generated packet, fetch the security label from the
5345 * associated socket. */
5346 struct sk_security_struct *sksec = sk->sk_security;
5347 peer_sid = sksec->sid;
5348 secmark_perm = PACKET__SEND;
5349 }
5350
5351 ad.type = LSM_AUDIT_DATA_NET;
5352 ad.u.net = &net;
5353 ad.u.net->netif = ifindex;
5354 ad.u.net->family = family;
5355 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5356 return NF_DROP;
5357
5358 if (secmark_active)
5359 if (avc_has_perm(peer_sid, skb->secmark,
5360 SECCLASS_PACKET, secmark_perm, &ad))
5361 return NF_DROP_ERR(-ECONNREFUSED);
5362
5363 if (peerlbl_active) {
5364 u32 if_sid;
5365 u32 node_sid;
5366
5367 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5368 return NF_DROP;
5369 if (avc_has_perm(peer_sid, if_sid,
5370 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5371 return NF_DROP_ERR(-ECONNREFUSED);
5372
5373 if (sel_netnode_sid(addrp, family, &node_sid))
5374 return NF_DROP;
5375 if (avc_has_perm(peer_sid, node_sid,
5376 SECCLASS_NODE, NODE__SENDTO, &ad))
5377 return NF_DROP_ERR(-ECONNREFUSED);
5378 }
5379
5380 return NF_ACCEPT;
5381 }
5382
5383 static unsigned int selinux_ipv4_postroute(void *priv,
5384 struct sk_buff *skb,
5385 const struct nf_hook_state *state)
5386 {
5387 return selinux_ip_postroute(skb, state->out, PF_INET);
5388 }
5389
5390 #if IS_ENABLED(CONFIG_IPV6)
5391 static unsigned int selinux_ipv6_postroute(void *priv,
5392 struct sk_buff *skb,
5393 const struct nf_hook_state *state)
5394 {
5395 return selinux_ip_postroute(skb, state->out, PF_INET6);
5396 }
5397 #endif /* IPV6 */
5398
5399 #endif /* CONFIG_NETFILTER */
5400
5401 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5402 {
5403 return selinux_nlmsg_perm(sk, skb);
5404 }
5405
5406 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5407 u16 sclass)
5408 {
5409 struct ipc_security_struct *isec;
5410
5411 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5412 if (!isec)
5413 return -ENOMEM;
5414
5415 isec->sclass = sclass;
5416 isec->sid = current_sid();
5417 perm->security = isec;
5418
5419 return 0;
5420 }
5421
5422 static void ipc_free_security(struct kern_ipc_perm *perm)
5423 {
5424 struct ipc_security_struct *isec = perm->security;
5425 perm->security = NULL;
5426 kfree(isec);
5427 }
5428
5429 static int msg_msg_alloc_security(struct msg_msg *msg)
5430 {
5431 struct msg_security_struct *msec;
5432
5433 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5434 if (!msec)
5435 return -ENOMEM;
5436
5437 msec->sid = SECINITSID_UNLABELED;
5438 msg->security = msec;
5439
5440 return 0;
5441 }
5442
5443 static void msg_msg_free_security(struct msg_msg *msg)
5444 {
5445 struct msg_security_struct *msec = msg->security;
5446
5447 msg->security = NULL;
5448 kfree(msec);
5449 }
5450
5451 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5452 u32 perms)
5453 {
5454 struct ipc_security_struct *isec;
5455 struct common_audit_data ad;
5456 u32 sid = current_sid();
5457
5458 isec = ipc_perms->security;
5459
5460 ad.type = LSM_AUDIT_DATA_IPC;
5461 ad.u.ipc_id = ipc_perms->key;
5462
5463 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5464 }
5465
5466 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5467 {
5468 return msg_msg_alloc_security(msg);
5469 }
5470
5471 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5472 {
5473 msg_msg_free_security(msg);
5474 }
5475
5476 /* message queue security operations */
5477 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5478 {
5479 struct ipc_security_struct *isec;
5480 struct common_audit_data ad;
5481 u32 sid = current_sid();
5482 int rc;
5483
5484 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5485 if (rc)
5486 return rc;
5487
5488 isec = msq->q_perm.security;
5489
5490 ad.type = LSM_AUDIT_DATA_IPC;
5491 ad.u.ipc_id = msq->q_perm.key;
5492
5493 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5494 MSGQ__CREATE, &ad);
5495 if (rc) {
5496 ipc_free_security(&msq->q_perm);
5497 return rc;
5498 }
5499 return 0;
5500 }
5501
5502 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5503 {
5504 ipc_free_security(&msq->q_perm);
5505 }
5506
5507 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5508 {
5509 struct ipc_security_struct *isec;
5510 struct common_audit_data ad;
5511 u32 sid = current_sid();
5512
5513 isec = msq->q_perm.security;
5514
5515 ad.type = LSM_AUDIT_DATA_IPC;
5516 ad.u.ipc_id = msq->q_perm.key;
5517
5518 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5519 MSGQ__ASSOCIATE, &ad);
5520 }
5521
5522 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5523 {
5524 int err;
5525 int perms;
5526
5527 switch (cmd) {
5528 case IPC_INFO:
5529 case MSG_INFO:
5530 /* No specific object, just general system-wide information. */
5531 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5532 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5533 case IPC_STAT:
5534 case MSG_STAT:
5535 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5536 break;
5537 case IPC_SET:
5538 perms = MSGQ__SETATTR;
5539 break;
5540 case IPC_RMID:
5541 perms = MSGQ__DESTROY;
5542 break;
5543 default:
5544 return 0;
5545 }
5546
5547 err = ipc_has_perm(&msq->q_perm, perms);
5548 return err;
5549 }
5550
5551 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5552 {
5553 struct ipc_security_struct *isec;
5554 struct msg_security_struct *msec;
5555 struct common_audit_data ad;
5556 u32 sid = current_sid();
5557 int rc;
5558
5559 isec = msq->q_perm.security;
5560 msec = msg->security;
5561
5562 /*
5563 * First time through, need to assign label to the message
5564 */
5565 if (msec->sid == SECINITSID_UNLABELED) {
5566 /*
5567 * Compute new sid based on current process and
5568 * message queue this message will be stored in
5569 */
5570 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5571 NULL, &msec->sid);
5572 if (rc)
5573 return rc;
5574 }
5575
5576 ad.type = LSM_AUDIT_DATA_IPC;
5577 ad.u.ipc_id = msq->q_perm.key;
5578
5579 /* Can this process write to the queue? */
5580 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5581 MSGQ__WRITE, &ad);
5582 if (!rc)
5583 /* Can this process send the message */
5584 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5585 MSG__SEND, &ad);
5586 if (!rc)
5587 /* Can the message be put in the queue? */
5588 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5589 MSGQ__ENQUEUE, &ad);
5590
5591 return rc;
5592 }
5593
5594 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5595 struct task_struct *target,
5596 long type, int mode)
5597 {
5598 struct ipc_security_struct *isec;
5599 struct msg_security_struct *msec;
5600 struct common_audit_data ad;
5601 u32 sid = task_sid(target);
5602 int rc;
5603
5604 isec = msq->q_perm.security;
5605 msec = msg->security;
5606
5607 ad.type = LSM_AUDIT_DATA_IPC;
5608 ad.u.ipc_id = msq->q_perm.key;
5609
5610 rc = avc_has_perm(sid, isec->sid,
5611 SECCLASS_MSGQ, MSGQ__READ, &ad);
5612 if (!rc)
5613 rc = avc_has_perm(sid, msec->sid,
5614 SECCLASS_MSG, MSG__RECEIVE, &ad);
5615 return rc;
5616 }
5617
5618 /* Shared Memory security operations */
5619 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5620 {
5621 struct ipc_security_struct *isec;
5622 struct common_audit_data ad;
5623 u32 sid = current_sid();
5624 int rc;
5625
5626 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5627 if (rc)
5628 return rc;
5629
5630 isec = shp->shm_perm.security;
5631
5632 ad.type = LSM_AUDIT_DATA_IPC;
5633 ad.u.ipc_id = shp->shm_perm.key;
5634
5635 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5636 SHM__CREATE, &ad);
5637 if (rc) {
5638 ipc_free_security(&shp->shm_perm);
5639 return rc;
5640 }
5641 return 0;
5642 }
5643
5644 static void selinux_shm_free_security(struct shmid_kernel *shp)
5645 {
5646 ipc_free_security(&shp->shm_perm);
5647 }
5648
5649 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5650 {
5651 struct ipc_security_struct *isec;
5652 struct common_audit_data ad;
5653 u32 sid = current_sid();
5654
5655 isec = shp->shm_perm.security;
5656
5657 ad.type = LSM_AUDIT_DATA_IPC;
5658 ad.u.ipc_id = shp->shm_perm.key;
5659
5660 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5661 SHM__ASSOCIATE, &ad);
5662 }
5663
5664 /* Note, at this point, shp is locked down */
5665 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5666 {
5667 int perms;
5668 int err;
5669
5670 switch (cmd) {
5671 case IPC_INFO:
5672 case SHM_INFO:
5673 /* No specific object, just general system-wide information. */
5674 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5675 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5676 case IPC_STAT:
5677 case SHM_STAT:
5678 perms = SHM__GETATTR | SHM__ASSOCIATE;
5679 break;
5680 case IPC_SET:
5681 perms = SHM__SETATTR;
5682 break;
5683 case SHM_LOCK:
5684 case SHM_UNLOCK:
5685 perms = SHM__LOCK;
5686 break;
5687 case IPC_RMID:
5688 perms = SHM__DESTROY;
5689 break;
5690 default:
5691 return 0;
5692 }
5693
5694 err = ipc_has_perm(&shp->shm_perm, perms);
5695 return err;
5696 }
5697
5698 static int selinux_shm_shmat(struct shmid_kernel *shp,
5699 char __user *shmaddr, int shmflg)
5700 {
5701 u32 perms;
5702
5703 if (shmflg & SHM_RDONLY)
5704 perms = SHM__READ;
5705 else
5706 perms = SHM__READ | SHM__WRITE;
5707
5708 return ipc_has_perm(&shp->shm_perm, perms);
5709 }
5710
5711 /* Semaphore security operations */
5712 static int selinux_sem_alloc_security(struct sem_array *sma)
5713 {
5714 struct ipc_security_struct *isec;
5715 struct common_audit_data ad;
5716 u32 sid = current_sid();
5717 int rc;
5718
5719 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5720 if (rc)
5721 return rc;
5722
5723 isec = sma->sem_perm.security;
5724
5725 ad.type = LSM_AUDIT_DATA_IPC;
5726 ad.u.ipc_id = sma->sem_perm.key;
5727
5728 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5729 SEM__CREATE, &ad);
5730 if (rc) {
5731 ipc_free_security(&sma->sem_perm);
5732 return rc;
5733 }
5734 return 0;
5735 }
5736
5737 static void selinux_sem_free_security(struct sem_array *sma)
5738 {
5739 ipc_free_security(&sma->sem_perm);
5740 }
5741
5742 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5743 {
5744 struct ipc_security_struct *isec;
5745 struct common_audit_data ad;
5746 u32 sid = current_sid();
5747
5748 isec = sma->sem_perm.security;
5749
5750 ad.type = LSM_AUDIT_DATA_IPC;
5751 ad.u.ipc_id = sma->sem_perm.key;
5752
5753 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5754 SEM__ASSOCIATE, &ad);
5755 }
5756
5757 /* Note, at this point, sma is locked down */
5758 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5759 {
5760 int err;
5761 u32 perms;
5762
5763 switch (cmd) {
5764 case IPC_INFO:
5765 case SEM_INFO:
5766 /* No specific object, just general system-wide information. */
5767 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5768 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5769 case GETPID:
5770 case GETNCNT:
5771 case GETZCNT:
5772 perms = SEM__GETATTR;
5773 break;
5774 case GETVAL:
5775 case GETALL:
5776 perms = SEM__READ;
5777 break;
5778 case SETVAL:
5779 case SETALL:
5780 perms = SEM__WRITE;
5781 break;
5782 case IPC_RMID:
5783 perms = SEM__DESTROY;
5784 break;
5785 case IPC_SET:
5786 perms = SEM__SETATTR;
5787 break;
5788 case IPC_STAT:
5789 case SEM_STAT:
5790 perms = SEM__GETATTR | SEM__ASSOCIATE;
5791 break;
5792 default:
5793 return 0;
5794 }
5795
5796 err = ipc_has_perm(&sma->sem_perm, perms);
5797 return err;
5798 }
5799
5800 static int selinux_sem_semop(struct sem_array *sma,
5801 struct sembuf *sops, unsigned nsops, int alter)
5802 {
5803 u32 perms;
5804
5805 if (alter)
5806 perms = SEM__READ | SEM__WRITE;
5807 else
5808 perms = SEM__READ;
5809
5810 return ipc_has_perm(&sma->sem_perm, perms);
5811 }
5812
5813 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5814 {
5815 u32 av = 0;
5816
5817 av = 0;
5818 if (flag & S_IRUGO)
5819 av |= IPC__UNIX_READ;
5820 if (flag & S_IWUGO)
5821 av |= IPC__UNIX_WRITE;
5822
5823 if (av == 0)
5824 return 0;
5825
5826 return ipc_has_perm(ipcp, av);
5827 }
5828
5829 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5830 {
5831 struct ipc_security_struct *isec = ipcp->security;
5832 *secid = isec->sid;
5833 }
5834
5835 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5836 {
5837 if (inode)
5838 inode_doinit_with_dentry(inode, dentry);
5839 }
5840
5841 static int selinux_getprocattr(struct task_struct *p,
5842 char *name, char **value)
5843 {
5844 const struct task_security_struct *__tsec;
5845 u32 sid;
5846 int error;
5847 unsigned len;
5848
5849 rcu_read_lock();
5850 __tsec = __task_cred(p)->security;
5851
5852 if (current != p) {
5853 error = avc_has_perm(current_sid(), __tsec->sid,
5854 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5855 if (error)
5856 goto bad;
5857 }
5858
5859 if (!strcmp(name, "current"))
5860 sid = __tsec->sid;
5861 else if (!strcmp(name, "prev"))
5862 sid = __tsec->osid;
5863 else if (!strcmp(name, "exec"))
5864 sid = __tsec->exec_sid;
5865 else if (!strcmp(name, "fscreate"))
5866 sid = __tsec->create_sid;
5867 else if (!strcmp(name, "keycreate"))
5868 sid = __tsec->keycreate_sid;
5869 else if (!strcmp(name, "sockcreate"))
5870 sid = __tsec->sockcreate_sid;
5871 else {
5872 error = -EINVAL;
5873 goto bad;
5874 }
5875 rcu_read_unlock();
5876
5877 if (!sid)
5878 return 0;
5879
5880 error = security_sid_to_context(sid, value, &len);
5881 if (error)
5882 return error;
5883 return len;
5884
5885 bad:
5886 rcu_read_unlock();
5887 return error;
5888 }
5889
5890 static int selinux_setprocattr(const char *name, void *value, size_t size)
5891 {
5892 struct task_security_struct *tsec;
5893 struct cred *new;
5894 u32 mysid = current_sid(), sid = 0, ptsid;
5895 int error;
5896 char *str = value;
5897
5898 /*
5899 * Basic control over ability to set these attributes at all.
5900 */
5901 if (!strcmp(name, "exec"))
5902 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5903 PROCESS__SETEXEC, NULL);
5904 else if (!strcmp(name, "fscreate"))
5905 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5906 PROCESS__SETFSCREATE, NULL);
5907 else if (!strcmp(name, "keycreate"))
5908 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5909 PROCESS__SETKEYCREATE, NULL);
5910 else if (!strcmp(name, "sockcreate"))
5911 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5912 PROCESS__SETSOCKCREATE, NULL);
5913 else if (!strcmp(name, "current"))
5914 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5915 PROCESS__SETCURRENT, NULL);
5916 else
5917 error = -EINVAL;
5918 if (error)
5919 return error;
5920
5921 /* Obtain a SID for the context, if one was specified. */
5922 if (size && str[0] && str[0] != '\n') {
5923 if (str[size-1] == '\n') {
5924 str[size-1] = 0;
5925 size--;
5926 }
5927 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5928 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5929 if (!has_cap_mac_admin(true)) {
5930 struct audit_buffer *ab;
5931 size_t audit_size;
5932
5933 /* We strip a nul only if it is at the end, otherwise the
5934 * context contains a nul and we should audit that */
5935 if (str[size - 1] == '\0')
5936 audit_size = size - 1;
5937 else
5938 audit_size = size;
5939 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5940 audit_log_format(ab, "op=fscreate invalid_context=");
5941 audit_log_n_untrustedstring(ab, value, audit_size);
5942 audit_log_end(ab);
5943
5944 return error;
5945 }
5946 error = security_context_to_sid_force(value, size,
5947 &sid);
5948 }
5949 if (error)
5950 return error;
5951 }
5952
5953 new = prepare_creds();
5954 if (!new)
5955 return -ENOMEM;
5956
5957 /* Permission checking based on the specified context is
5958 performed during the actual operation (execve,
5959 open/mkdir/...), when we know the full context of the
5960 operation. See selinux_bprm_set_creds for the execve
5961 checks and may_create for the file creation checks. The
5962 operation will then fail if the context is not permitted. */
5963 tsec = new->security;
5964 if (!strcmp(name, "exec")) {
5965 tsec->exec_sid = sid;
5966 } else if (!strcmp(name, "fscreate")) {
5967 tsec->create_sid = sid;
5968 } else if (!strcmp(name, "keycreate")) {
5969 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5970 NULL);
5971 if (error)
5972 goto abort_change;
5973 tsec->keycreate_sid = sid;
5974 } else if (!strcmp(name, "sockcreate")) {
5975 tsec->sockcreate_sid = sid;
5976 } else if (!strcmp(name, "current")) {
5977 error = -EINVAL;
5978 if (sid == 0)
5979 goto abort_change;
5980
5981 /* Only allow single threaded processes to change context */
5982 error = -EPERM;
5983 if (!current_is_single_threaded()) {
5984 error = security_bounded_transition(tsec->sid, sid);
5985 if (error)
5986 goto abort_change;
5987 }
5988
5989 /* Check permissions for the transition. */
5990 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5991 PROCESS__DYNTRANSITION, NULL);
5992 if (error)
5993 goto abort_change;
5994
5995 /* Check for ptracing, and update the task SID if ok.
5996 Otherwise, leave SID unchanged and fail. */
5997 ptsid = ptrace_parent_sid();
5998 if (ptsid != 0) {
5999 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6000 PROCESS__PTRACE, NULL);
6001 if (error)
6002 goto abort_change;
6003 }
6004
6005 tsec->sid = sid;
6006 } else {
6007 error = -EINVAL;
6008 goto abort_change;
6009 }
6010
6011 commit_creds(new);
6012 return size;
6013
6014 abort_change:
6015 abort_creds(new);
6016 return error;
6017 }
6018
6019 static int selinux_ismaclabel(const char *name)
6020 {
6021 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6022 }
6023
6024 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6025 {
6026 return security_sid_to_context(secid, secdata, seclen);
6027 }
6028
6029 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6030 {
6031 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6032 }
6033
6034 static void selinux_release_secctx(char *secdata, u32 seclen)
6035 {
6036 kfree(secdata);
6037 }
6038
6039 static void selinux_inode_invalidate_secctx(struct inode *inode)
6040 {
6041 struct inode_security_struct *isec = inode->i_security;
6042
6043 spin_lock(&isec->lock);
6044 isec->initialized = LABEL_INVALID;
6045 spin_unlock(&isec->lock);
6046 }
6047
6048 /*
6049 * called with inode->i_mutex locked
6050 */
6051 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6052 {
6053 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6054 }
6055
6056 /*
6057 * called with inode->i_mutex locked
6058 */
6059 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6060 {
6061 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6062 }
6063
6064 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6065 {
6066 int len = 0;
6067 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6068 ctx, true);
6069 if (len < 0)
6070 return len;
6071 *ctxlen = len;
6072 return 0;
6073 }
6074 #ifdef CONFIG_KEYS
6075
6076 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6077 unsigned long flags)
6078 {
6079 const struct task_security_struct *tsec;
6080 struct key_security_struct *ksec;
6081
6082 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6083 if (!ksec)
6084 return -ENOMEM;
6085
6086 tsec = cred->security;
6087 if (tsec->keycreate_sid)
6088 ksec->sid = tsec->keycreate_sid;
6089 else
6090 ksec->sid = tsec->sid;
6091
6092 k->security = ksec;
6093 return 0;
6094 }
6095
6096 static void selinux_key_free(struct key *k)
6097 {
6098 struct key_security_struct *ksec = k->security;
6099
6100 k->security = NULL;
6101 kfree(ksec);
6102 }
6103
6104 static int selinux_key_permission(key_ref_t key_ref,
6105 const struct cred *cred,
6106 unsigned perm)
6107 {
6108 struct key *key;
6109 struct key_security_struct *ksec;
6110 u32 sid;
6111
6112 /* if no specific permissions are requested, we skip the
6113 permission check. No serious, additional covert channels
6114 appear to be created. */
6115 if (perm == 0)
6116 return 0;
6117
6118 sid = cred_sid(cred);
6119
6120 key = key_ref_to_ptr(key_ref);
6121 ksec = key->security;
6122
6123 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6124 }
6125
6126 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6127 {
6128 struct key_security_struct *ksec = key->security;
6129 char *context = NULL;
6130 unsigned len;
6131 int rc;
6132
6133 rc = security_sid_to_context(ksec->sid, &context, &len);
6134 if (!rc)
6135 rc = len;
6136 *_buffer = context;
6137 return rc;
6138 }
6139
6140 #endif
6141
6142 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6143 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6144 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6145 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6146 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6147
6148 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6149 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6150 LSM_HOOK_INIT(capget, selinux_capget),
6151 LSM_HOOK_INIT(capset, selinux_capset),
6152 LSM_HOOK_INIT(capable, selinux_capable),
6153 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6154 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6155 LSM_HOOK_INIT(syslog, selinux_syslog),
6156 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6157
6158 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6159
6160 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6161 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6162 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6163 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6164
6165 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6166 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6167 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6168 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6169 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6170 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6171 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6172 LSM_HOOK_INIT(sb_mount, selinux_mount),
6173 LSM_HOOK_INIT(sb_umount, selinux_umount),
6174 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6175 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6176 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6177
6178 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6179 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6180
6181 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6182 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6183 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6184 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6185 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6186 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6187 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6188 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6189 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6190 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6191 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6192 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6193 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6194 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6195 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6196 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6197 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6198 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6199 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6200 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6201 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6202 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6203 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6204 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6205 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6206 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6207 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6208
6209 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6210 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6211 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6212 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6213 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6214 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6215 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6216 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6217 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6218 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6219 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6220 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6221
6222 LSM_HOOK_INIT(file_open, selinux_file_open),
6223
6224 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6225 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6226 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6227 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6228 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6229 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6230 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6231 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6232 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6233 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6234 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6235 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6236 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6237 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6238 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6239 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6240 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6241 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6242 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6243 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6244 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6245 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6246 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6247
6248 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6249 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6250
6251 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6252 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6253
6254 LSM_HOOK_INIT(msg_queue_alloc_security,
6255 selinux_msg_queue_alloc_security),
6256 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6257 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6258 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6259 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6260 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6261
6262 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6263 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6264 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6265 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6266 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6267
6268 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6269 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6270 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6271 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6272 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6273
6274 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6275
6276 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6277 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6278
6279 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6280 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6281 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6282 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6283 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6284 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6285 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6286 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6287
6288 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6289 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6290
6291 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6292 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6293 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6294 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6295 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6296 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6297 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6298 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6299 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6300 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6301 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6302 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6303 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6304 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6305 LSM_HOOK_INIT(socket_getpeersec_stream,
6306 selinux_socket_getpeersec_stream),
6307 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6308 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6309 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6310 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6311 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6312 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6313 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6314 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6315 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6316 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6317 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6318 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6319 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6320 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6321 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6322 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6323 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6324 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6325 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6326
6327 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6328 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6329 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6330 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6331 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6332 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6333 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6334 selinux_xfrm_state_alloc_acquire),
6335 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6336 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6337 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6338 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6339 selinux_xfrm_state_pol_flow_match),
6340 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6341 #endif
6342
6343 #ifdef CONFIG_KEYS
6344 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6345 LSM_HOOK_INIT(key_free, selinux_key_free),
6346 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6347 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6348 #endif
6349
6350 #ifdef CONFIG_AUDIT
6351 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6352 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6353 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6354 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6355 #endif
6356 };
6357
6358 static __init int selinux_init(void)
6359 {
6360 if (!security_module_enable("selinux")) {
6361 selinux_enabled = 0;
6362 return 0;
6363 }
6364
6365 if (!selinux_enabled) {
6366 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6367 return 0;
6368 }
6369
6370 printk(KERN_INFO "SELinux: Initializing.\n");
6371
6372 /* Set the security state for the initial task. */
6373 cred_init_security();
6374
6375 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6376
6377 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6378 sizeof(struct inode_security_struct),
6379 0, SLAB_PANIC, NULL);
6380 file_security_cache = kmem_cache_create("selinux_file_security",
6381 sizeof(struct file_security_struct),
6382 0, SLAB_PANIC, NULL);
6383 avc_init();
6384
6385 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6386
6387 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6388 panic("SELinux: Unable to register AVC netcache callback\n");
6389
6390 if (selinux_enforcing)
6391 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6392 else
6393 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6394
6395 return 0;
6396 }
6397
6398 static void delayed_superblock_init(struct super_block *sb, void *unused)
6399 {
6400 superblock_doinit(sb, NULL);
6401 }
6402
6403 void selinux_complete_init(void)
6404 {
6405 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6406
6407 /* Set up any superblocks initialized prior to the policy load. */
6408 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6409 iterate_supers(delayed_superblock_init, NULL);
6410 }
6411
6412 /* SELinux requires early initialization in order to label
6413 all processes and objects when they are created. */
6414 security_initcall(selinux_init);
6415
6416 #if defined(CONFIG_NETFILTER)
6417
6418 static struct nf_hook_ops selinux_nf_ops[] = {
6419 {
6420 .hook = selinux_ipv4_postroute,
6421 .pf = NFPROTO_IPV4,
6422 .hooknum = NF_INET_POST_ROUTING,
6423 .priority = NF_IP_PRI_SELINUX_LAST,
6424 },
6425 {
6426 .hook = selinux_ipv4_forward,
6427 .pf = NFPROTO_IPV4,
6428 .hooknum = NF_INET_FORWARD,
6429 .priority = NF_IP_PRI_SELINUX_FIRST,
6430 },
6431 {
6432 .hook = selinux_ipv4_output,
6433 .pf = NFPROTO_IPV4,
6434 .hooknum = NF_INET_LOCAL_OUT,
6435 .priority = NF_IP_PRI_SELINUX_FIRST,
6436 },
6437 #if IS_ENABLED(CONFIG_IPV6)
6438 {
6439 .hook = selinux_ipv6_postroute,
6440 .pf = NFPROTO_IPV6,
6441 .hooknum = NF_INET_POST_ROUTING,
6442 .priority = NF_IP6_PRI_SELINUX_LAST,
6443 },
6444 {
6445 .hook = selinux_ipv6_forward,
6446 .pf = NFPROTO_IPV6,
6447 .hooknum = NF_INET_FORWARD,
6448 .priority = NF_IP6_PRI_SELINUX_FIRST,
6449 },
6450 {
6451 .hook = selinux_ipv6_output,
6452 .pf = NFPROTO_IPV6,
6453 .hooknum = NF_INET_LOCAL_OUT,
6454 .priority = NF_IP6_PRI_SELINUX_FIRST,
6455 },
6456 #endif /* IPV6 */
6457 };
6458
6459 static int __init selinux_nf_ip_init(void)
6460 {
6461 int err;
6462
6463 if (!selinux_enabled)
6464 return 0;
6465
6466 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6467
6468 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6469 if (err)
6470 panic("SELinux: nf_register_hooks: error %d\n", err);
6471
6472 return 0;
6473 }
6474
6475 __initcall(selinux_nf_ip_init);
6476
6477 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6478 static void selinux_nf_ip_exit(void)
6479 {
6480 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6481
6482 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6483 }
6484 #endif
6485
6486 #else /* CONFIG_NETFILTER */
6487
6488 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6489 #define selinux_nf_ip_exit()
6490 #endif
6491
6492 #endif /* CONFIG_NETFILTER */
6493
6494 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6495 static int selinux_disabled;
6496
6497 int selinux_disable(void)
6498 {
6499 if (ss_initialized) {
6500 /* Not permitted after initial policy load. */
6501 return -EINVAL;
6502 }
6503
6504 if (selinux_disabled) {
6505 /* Only do this once. */
6506 return -EINVAL;
6507 }
6508
6509 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6510
6511 selinux_disabled = 1;
6512 selinux_enabled = 0;
6513
6514 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6515
6516 /* Try to destroy the avc node cache */
6517 avc_disable();
6518
6519 /* Unregister netfilter hooks. */
6520 selinux_nf_ip_exit();
6521
6522 /* Unregister selinuxfs. */
6523 exit_sel_fs();
6524
6525 return 0;
6526 }
6527 #endif
Ubuntu Artful kernel mirror