2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78 #include <linux/posix-timers.h>
79 #include <linux/syslog.h>
90 #define XATTR_SELINUX_SUFFIX "selinux"
91 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
93 #define NUM_SEL_MNT_OPTS 5
95 extern int selinux_nlmsg_lookup(u16 sclass
, u16 nlmsg_type
, u32
*perm
);
96 extern struct security_operations
*security_ops
;
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount
= ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing
;
104 static int __init
enforcing_setup(char *str
)
106 unsigned long enforcing
;
107 if (!strict_strtoul(str
, 0, &enforcing
))
108 selinux_enforcing
= enforcing
? 1 : 0;
111 __setup("enforcing=", enforcing_setup
);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
117 static int __init
selinux_enabled_setup(char *str
)
119 unsigned long enabled
;
120 if (!strict_strtoul(str
, 0, &enabled
))
121 selinux_enabled
= enabled
? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup
);
126 int selinux_enabled
= 1;
129 static struct kmem_cache
*sel_inode_cache
;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
141 static int selinux_secmark_enabled(void)
143 return (atomic_read(&selinux_secmark_refcount
) > 0);
147 * initialise the security for the init task
149 static void cred_init_security(void)
151 struct cred
*cred
= (struct cred
*) current
->real_cred
;
152 struct task_security_struct
*tsec
;
154 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
156 panic("SELinux: Failed to initialize initial task.\n");
158 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
159 cred
->security
= tsec
;
163 * get the security ID of a set of credentials
165 static inline u32
cred_sid(const struct cred
*cred
)
167 const struct task_security_struct
*tsec
;
169 tsec
= cred
->security
;
174 * get the objective security ID of a task
176 static inline u32
task_sid(const struct task_struct
*task
)
181 sid
= cred_sid(__task_cred(task
));
187 * get the subjective security ID of the current task
189 static inline u32
current_sid(void)
191 const struct task_security_struct
*tsec
= current_cred()->security
;
196 /* Allocate and free functions for each kind of security blob. */
198 static int inode_alloc_security(struct inode
*inode
)
200 struct inode_security_struct
*isec
;
201 u32 sid
= current_sid();
203 isec
= kmem_cache_zalloc(sel_inode_cache
, GFP_NOFS
);
207 mutex_init(&isec
->lock
);
208 INIT_LIST_HEAD(&isec
->list
);
210 isec
->sid
= SECINITSID_UNLABELED
;
211 isec
->sclass
= SECCLASS_FILE
;
212 isec
->task_sid
= sid
;
213 inode
->i_security
= isec
;
218 static void inode_free_security(struct inode
*inode
)
220 struct inode_security_struct
*isec
= inode
->i_security
;
221 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
223 spin_lock(&sbsec
->isec_lock
);
224 if (!list_empty(&isec
->list
))
225 list_del_init(&isec
->list
);
226 spin_unlock(&sbsec
->isec_lock
);
228 inode
->i_security
= NULL
;
229 kmem_cache_free(sel_inode_cache
, isec
);
232 static int file_alloc_security(struct file
*file
)
234 struct file_security_struct
*fsec
;
235 u32 sid
= current_sid();
237 fsec
= kzalloc(sizeof(struct file_security_struct
), GFP_KERNEL
);
242 fsec
->fown_sid
= sid
;
243 file
->f_security
= fsec
;
248 static void file_free_security(struct file
*file
)
250 struct file_security_struct
*fsec
= file
->f_security
;
251 file
->f_security
= NULL
;
255 static int superblock_alloc_security(struct super_block
*sb
)
257 struct superblock_security_struct
*sbsec
;
259 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
263 mutex_init(&sbsec
->lock
);
264 INIT_LIST_HEAD(&sbsec
->isec_head
);
265 spin_lock_init(&sbsec
->isec_lock
);
267 sbsec
->sid
= SECINITSID_UNLABELED
;
268 sbsec
->def_sid
= SECINITSID_FILE
;
269 sbsec
->mntpoint_sid
= SECINITSID_UNLABELED
;
270 sb
->s_security
= sbsec
;
275 static void superblock_free_security(struct super_block
*sb
)
277 struct superblock_security_struct
*sbsec
= sb
->s_security
;
278 sb
->s_security
= NULL
;
282 static int sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
284 struct sk_security_struct
*sksec
;
286 sksec
= kzalloc(sizeof(*sksec
), priority
);
290 sksec
->peer_sid
= SECINITSID_UNLABELED
;
291 sksec
->sid
= SECINITSID_UNLABELED
;
292 sk
->sk_security
= sksec
;
294 selinux_netlbl_sk_security_reset(sksec
);
299 static void sk_free_security(struct sock
*sk
)
301 struct sk_security_struct
*sksec
= sk
->sk_security
;
303 sk
->sk_security
= NULL
;
304 selinux_netlbl_sk_security_free(sksec
);
308 /* The security server must be initialized before
309 any labeling or access decisions can be provided. */
310 extern int ss_initialized
;
312 /* The file system's label must be initialized prior to use. */
314 static const char *labeling_behaviors
[6] = {
316 "uses transition SIDs",
318 "uses genfs_contexts",
319 "not configured for labeling",
320 "uses mountpoint labeling",
323 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
325 static inline int inode_doinit(struct inode
*inode
)
327 return inode_doinit_with_dentry(inode
, NULL
);
336 Opt_labelsupport
= 5,
339 static const match_table_t tokens
= {
340 {Opt_context
, CONTEXT_STR
"%s"},
341 {Opt_fscontext
, FSCONTEXT_STR
"%s"},
342 {Opt_defcontext
, DEFCONTEXT_STR
"%s"},
343 {Opt_rootcontext
, ROOTCONTEXT_STR
"%s"},
344 {Opt_labelsupport
, LABELSUPP_STR
},
348 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
350 static int may_context_mount_sb_relabel(u32 sid
,
351 struct superblock_security_struct
*sbsec
,
352 const struct cred
*cred
)
354 const struct task_security_struct
*tsec
= cred
->security
;
357 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
358 FILESYSTEM__RELABELFROM
, NULL
);
362 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
363 FILESYSTEM__RELABELTO
, NULL
);
367 static int may_context_mount_inode_relabel(u32 sid
,
368 struct superblock_security_struct
*sbsec
,
369 const struct cred
*cred
)
371 const struct task_security_struct
*tsec
= cred
->security
;
373 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
374 FILESYSTEM__RELABELFROM
, NULL
);
378 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
379 FILESYSTEM__ASSOCIATE
, NULL
);
383 static int sb_finish_set_opts(struct super_block
*sb
)
385 struct superblock_security_struct
*sbsec
= sb
->s_security
;
386 struct dentry
*root
= sb
->s_root
;
387 struct inode
*root_inode
= root
->d_inode
;
390 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
391 /* Make sure that the xattr handler exists and that no
392 error other than -ENODATA is returned by getxattr on
393 the root directory. -ENODATA is ok, as this may be
394 the first boot of the SELinux kernel before we have
395 assigned xattr values to the filesystem. */
396 if (!root_inode
->i_op
->getxattr
) {
397 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
398 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
402 rc
= root_inode
->i_op
->getxattr(root
, XATTR_NAME_SELINUX
, NULL
, 0);
403 if (rc
< 0 && rc
!= -ENODATA
) {
404 if (rc
== -EOPNOTSUPP
)
405 printk(KERN_WARNING
"SELinux: (dev %s, type "
406 "%s) has no security xattr handler\n",
407 sb
->s_id
, sb
->s_type
->name
);
409 printk(KERN_WARNING
"SELinux: (dev %s, type "
410 "%s) getxattr errno %d\n", sb
->s_id
,
411 sb
->s_type
->name
, -rc
);
416 sbsec
->flags
|= (SE_SBINITIALIZED
| SE_SBLABELSUPP
);
418 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
))
419 printk(KERN_ERR
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
420 sb
->s_id
, sb
->s_type
->name
);
422 printk(KERN_DEBUG
"SELinux: initialized (dev %s, type %s), %s\n",
423 sb
->s_id
, sb
->s_type
->name
,
424 labeling_behaviors
[sbsec
->behavior
-1]);
426 if (sbsec
->behavior
== SECURITY_FS_USE_GENFS
||
427 sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
||
428 sbsec
->behavior
== SECURITY_FS_USE_NONE
||
429 sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
))
430 sbsec
->flags
&= ~SE_SBLABELSUPP
;
432 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
433 if (strncmp(sb
->s_type
->name
, "sysfs", sizeof("sysfs")) == 0)
434 sbsec
->flags
|= SE_SBLABELSUPP
;
436 /* Initialize the root inode. */
437 rc
= inode_doinit_with_dentry(root_inode
, root
);
439 /* Initialize any other inodes associated with the superblock, e.g.
440 inodes created prior to initial policy load or inodes created
441 during get_sb by a pseudo filesystem that directly
443 spin_lock(&sbsec
->isec_lock
);
445 if (!list_empty(&sbsec
->isec_head
)) {
446 struct inode_security_struct
*isec
=
447 list_entry(sbsec
->isec_head
.next
,
448 struct inode_security_struct
, list
);
449 struct inode
*inode
= isec
->inode
;
450 spin_unlock(&sbsec
->isec_lock
);
451 inode
= igrab(inode
);
453 if (!IS_PRIVATE(inode
))
457 spin_lock(&sbsec
->isec_lock
);
458 list_del_init(&isec
->list
);
461 spin_unlock(&sbsec
->isec_lock
);
467 * This function should allow an FS to ask what it's mount security
468 * options were so it can use those later for submounts, displaying
469 * mount options, or whatever.
471 static int selinux_get_mnt_opts(const struct super_block
*sb
,
472 struct security_mnt_opts
*opts
)
475 struct superblock_security_struct
*sbsec
= sb
->s_security
;
476 char *context
= NULL
;
480 security_init_mnt_opts(opts
);
482 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
488 tmp
= sbsec
->flags
& SE_MNTMASK
;
489 /* count the number of mount options for this sb */
490 for (i
= 0; i
< 8; i
++) {
492 opts
->num_mnt_opts
++;
495 /* Check if the Label support flag is set */
496 if (sbsec
->flags
& SE_SBLABELSUPP
)
497 opts
->num_mnt_opts
++;
499 opts
->mnt_opts
= kcalloc(opts
->num_mnt_opts
, sizeof(char *), GFP_ATOMIC
);
500 if (!opts
->mnt_opts
) {
505 opts
->mnt_opts_flags
= kcalloc(opts
->num_mnt_opts
, sizeof(int), GFP_ATOMIC
);
506 if (!opts
->mnt_opts_flags
) {
512 if (sbsec
->flags
& FSCONTEXT_MNT
) {
513 rc
= security_sid_to_context(sbsec
->sid
, &context
, &len
);
516 opts
->mnt_opts
[i
] = context
;
517 opts
->mnt_opts_flags
[i
++] = FSCONTEXT_MNT
;
519 if (sbsec
->flags
& CONTEXT_MNT
) {
520 rc
= security_sid_to_context(sbsec
->mntpoint_sid
, &context
, &len
);
523 opts
->mnt_opts
[i
] = context
;
524 opts
->mnt_opts_flags
[i
++] = CONTEXT_MNT
;
526 if (sbsec
->flags
& DEFCONTEXT_MNT
) {
527 rc
= security_sid_to_context(sbsec
->def_sid
, &context
, &len
);
530 opts
->mnt_opts
[i
] = context
;
531 opts
->mnt_opts_flags
[i
++] = DEFCONTEXT_MNT
;
533 if (sbsec
->flags
& ROOTCONTEXT_MNT
) {
534 struct inode
*root
= sbsec
->sb
->s_root
->d_inode
;
535 struct inode_security_struct
*isec
= root
->i_security
;
537 rc
= security_sid_to_context(isec
->sid
, &context
, &len
);
540 opts
->mnt_opts
[i
] = context
;
541 opts
->mnt_opts_flags
[i
++] = ROOTCONTEXT_MNT
;
543 if (sbsec
->flags
& SE_SBLABELSUPP
) {
544 opts
->mnt_opts
[i
] = NULL
;
545 opts
->mnt_opts_flags
[i
++] = SE_SBLABELSUPP
;
548 BUG_ON(i
!= opts
->num_mnt_opts
);
553 security_free_mnt_opts(opts
);
557 static int bad_option(struct superblock_security_struct
*sbsec
, char flag
,
558 u32 old_sid
, u32 new_sid
)
560 char mnt_flags
= sbsec
->flags
& SE_MNTMASK
;
562 /* check if the old mount command had the same options */
563 if (sbsec
->flags
& SE_SBINITIALIZED
)
564 if (!(sbsec
->flags
& flag
) ||
565 (old_sid
!= new_sid
))
568 /* check if we were passed the same options twice,
569 * aka someone passed context=a,context=b
571 if (!(sbsec
->flags
& SE_SBINITIALIZED
))
572 if (mnt_flags
& flag
)
578 * Allow filesystems with binary mount data to explicitly set mount point
579 * labeling information.
581 static int selinux_set_mnt_opts(struct super_block
*sb
,
582 struct security_mnt_opts
*opts
)
584 const struct cred
*cred
= current_cred();
586 struct superblock_security_struct
*sbsec
= sb
->s_security
;
587 const char *name
= sb
->s_type
->name
;
588 struct inode
*inode
= sbsec
->sb
->s_root
->d_inode
;
589 struct inode_security_struct
*root_isec
= inode
->i_security
;
590 u32 fscontext_sid
= 0, context_sid
= 0, rootcontext_sid
= 0;
591 u32 defcontext_sid
= 0;
592 char **mount_options
= opts
->mnt_opts
;
593 int *flags
= opts
->mnt_opts_flags
;
594 int num_opts
= opts
->num_mnt_opts
;
596 mutex_lock(&sbsec
->lock
);
598 if (!ss_initialized
) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
606 printk(KERN_WARNING
"SELinux: Unable to set superblock options "
607 "before the security server is initialized\n");
612 * Binary mount data FS will come through this function twice. Once
613 * from an explicit call and once from the generic calls from the vfs.
614 * Since the generic VFS calls will not contain any security mount data
615 * we need to skip the double mount verification.
617 * This does open a hole in which we will not notice if the first
618 * mount using this sb set explict options and a second mount using
619 * this sb does not set any security options. (The first options
620 * will be used for both mounts)
622 if ((sbsec
->flags
& SE_SBINITIALIZED
) && (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
)
627 * parse the mount options, check if they are valid sids.
628 * also check if someone is trying to mount the same sb more
629 * than once with different security options.
631 for (i
= 0; i
< num_opts
; i
++) {
634 if (flags
[i
] == SE_SBLABELSUPP
)
636 rc
= security_context_to_sid(mount_options
[i
],
637 strlen(mount_options
[i
]), &sid
);
639 printk(KERN_WARNING
"SELinux: security_context_to_sid"
640 "(%s) failed for (dev %s, type %s) errno=%d\n",
641 mount_options
[i
], sb
->s_id
, name
, rc
);
648 if (bad_option(sbsec
, FSCONTEXT_MNT
, sbsec
->sid
,
650 goto out_double_mount
;
652 sbsec
->flags
|= FSCONTEXT_MNT
;
657 if (bad_option(sbsec
, CONTEXT_MNT
, sbsec
->mntpoint_sid
,
659 goto out_double_mount
;
661 sbsec
->flags
|= CONTEXT_MNT
;
663 case ROOTCONTEXT_MNT
:
664 rootcontext_sid
= sid
;
666 if (bad_option(sbsec
, ROOTCONTEXT_MNT
, root_isec
->sid
,
668 goto out_double_mount
;
670 sbsec
->flags
|= ROOTCONTEXT_MNT
;
674 defcontext_sid
= sid
;
676 if (bad_option(sbsec
, DEFCONTEXT_MNT
, sbsec
->def_sid
,
678 goto out_double_mount
;
680 sbsec
->flags
|= DEFCONTEXT_MNT
;
689 if (sbsec
->flags
& SE_SBINITIALIZED
) {
690 /* previously mounted with options, but not on this attempt? */
691 if ((sbsec
->flags
& SE_MNTMASK
) && !num_opts
)
692 goto out_double_mount
;
697 if (strcmp(sb
->s_type
->name
, "proc") == 0)
698 sbsec
->flags
|= SE_SBPROC
;
700 /* Determine the labeling behavior to use for this filesystem type. */
701 rc
= security_fs_use((sbsec
->flags
& SE_SBPROC
) ? "proc" : sb
->s_type
->name
, &sbsec
->behavior
, &sbsec
->sid
);
703 printk(KERN_WARNING
"%s: security_fs_use(%s) returned %d\n",
704 __func__
, sb
->s_type
->name
, rc
);
708 /* sets the context of the superblock for the fs being mounted. */
710 rc
= may_context_mount_sb_relabel(fscontext_sid
, sbsec
, cred
);
714 sbsec
->sid
= fscontext_sid
;
718 * Switch to using mount point labeling behavior.
719 * sets the label used on all file below the mountpoint, and will set
720 * the superblock context if not already set.
723 if (!fscontext_sid
) {
724 rc
= may_context_mount_sb_relabel(context_sid
, sbsec
,
728 sbsec
->sid
= context_sid
;
730 rc
= may_context_mount_inode_relabel(context_sid
, sbsec
,
735 if (!rootcontext_sid
)
736 rootcontext_sid
= context_sid
;
738 sbsec
->mntpoint_sid
= context_sid
;
739 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
742 if (rootcontext_sid
) {
743 rc
= may_context_mount_inode_relabel(rootcontext_sid
, sbsec
,
748 root_isec
->sid
= rootcontext_sid
;
749 root_isec
->initialized
= 1;
752 if (defcontext_sid
) {
753 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
) {
755 printk(KERN_WARNING
"SELinux: defcontext option is "
756 "invalid for this filesystem type\n");
760 if (defcontext_sid
!= sbsec
->def_sid
) {
761 rc
= may_context_mount_inode_relabel(defcontext_sid
,
767 sbsec
->def_sid
= defcontext_sid
;
770 rc
= sb_finish_set_opts(sb
);
772 mutex_unlock(&sbsec
->lock
);
776 printk(KERN_WARNING
"SELinux: mount invalid. Same superblock, different "
777 "security settings for (dev %s, type %s)\n", sb
->s_id
, name
);
781 static void selinux_sb_clone_mnt_opts(const struct super_block
*oldsb
,
782 struct super_block
*newsb
)
784 const struct superblock_security_struct
*oldsbsec
= oldsb
->s_security
;
785 struct superblock_security_struct
*newsbsec
= newsb
->s_security
;
787 int set_fscontext
= (oldsbsec
->flags
& FSCONTEXT_MNT
);
788 int set_context
= (oldsbsec
->flags
& CONTEXT_MNT
);
789 int set_rootcontext
= (oldsbsec
->flags
& ROOTCONTEXT_MNT
);
792 * if the parent was able to be mounted it clearly had no special lsm
793 * mount options. thus we can safely deal with this superblock later
798 /* how can we clone if the old one wasn't set up?? */
799 BUG_ON(!(oldsbsec
->flags
& SE_SBINITIALIZED
));
801 /* if fs is reusing a sb, just let its options stand... */
802 if (newsbsec
->flags
& SE_SBINITIALIZED
)
805 mutex_lock(&newsbsec
->lock
);
807 newsbsec
->flags
= oldsbsec
->flags
;
809 newsbsec
->sid
= oldsbsec
->sid
;
810 newsbsec
->def_sid
= oldsbsec
->def_sid
;
811 newsbsec
->behavior
= oldsbsec
->behavior
;
814 u32 sid
= oldsbsec
->mntpoint_sid
;
818 if (!set_rootcontext
) {
819 struct inode
*newinode
= newsb
->s_root
->d_inode
;
820 struct inode_security_struct
*newisec
= newinode
->i_security
;
823 newsbsec
->mntpoint_sid
= sid
;
825 if (set_rootcontext
) {
826 const struct inode
*oldinode
= oldsb
->s_root
->d_inode
;
827 const struct inode_security_struct
*oldisec
= oldinode
->i_security
;
828 struct inode
*newinode
= newsb
->s_root
->d_inode
;
829 struct inode_security_struct
*newisec
= newinode
->i_security
;
831 newisec
->sid
= oldisec
->sid
;
834 sb_finish_set_opts(newsb
);
835 mutex_unlock(&newsbsec
->lock
);
838 static int selinux_parse_opts_str(char *options
,
839 struct security_mnt_opts
*opts
)
842 char *context
= NULL
, *defcontext
= NULL
;
843 char *fscontext
= NULL
, *rootcontext
= NULL
;
844 int rc
, num_mnt_opts
= 0;
846 opts
->num_mnt_opts
= 0;
848 /* Standard string-based options. */
849 while ((p
= strsep(&options
, "|")) != NULL
) {
851 substring_t args
[MAX_OPT_ARGS
];
856 token
= match_token(p
, tokens
, args
);
860 if (context
|| defcontext
) {
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
865 context
= match_strdup(&args
[0]);
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
878 fscontext
= match_strdup(&args
[0]);
885 case Opt_rootcontext
:
888 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
891 rootcontext
= match_strdup(&args
[0]);
899 if (context
|| defcontext
) {
901 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
904 defcontext
= match_strdup(&args
[0]);
910 case Opt_labelsupport
:
914 printk(KERN_WARNING
"SELinux: unknown mount option\n");
921 opts
->mnt_opts
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(char *), GFP_ATOMIC
);
925 opts
->mnt_opts_flags
= kcalloc(NUM_SEL_MNT_OPTS
, sizeof(int), GFP_ATOMIC
);
926 if (!opts
->mnt_opts_flags
) {
927 kfree(opts
->mnt_opts
);
932 opts
->mnt_opts
[num_mnt_opts
] = fscontext
;
933 opts
->mnt_opts_flags
[num_mnt_opts
++] = FSCONTEXT_MNT
;
936 opts
->mnt_opts
[num_mnt_opts
] = context
;
937 opts
->mnt_opts_flags
[num_mnt_opts
++] = CONTEXT_MNT
;
940 opts
->mnt_opts
[num_mnt_opts
] = rootcontext
;
941 opts
->mnt_opts_flags
[num_mnt_opts
++] = ROOTCONTEXT_MNT
;
944 opts
->mnt_opts
[num_mnt_opts
] = defcontext
;
945 opts
->mnt_opts_flags
[num_mnt_opts
++] = DEFCONTEXT_MNT
;
948 opts
->num_mnt_opts
= num_mnt_opts
;
959 * string mount options parsing and call set the sbsec
961 static int superblock_doinit(struct super_block
*sb
, void *data
)
964 char *options
= data
;
965 struct security_mnt_opts opts
;
967 security_init_mnt_opts(&opts
);
972 BUG_ON(sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
);
974 rc
= selinux_parse_opts_str(options
, &opts
);
979 rc
= selinux_set_mnt_opts(sb
, &opts
);
982 security_free_mnt_opts(&opts
);
986 static void selinux_write_opts(struct seq_file
*m
,
987 struct security_mnt_opts
*opts
)
992 for (i
= 0; i
< opts
->num_mnt_opts
; i
++) {
995 if (opts
->mnt_opts
[i
])
996 has_comma
= strchr(opts
->mnt_opts
[i
], ',');
1000 switch (opts
->mnt_opts_flags
[i
]) {
1002 prefix
= CONTEXT_STR
;
1005 prefix
= FSCONTEXT_STR
;
1007 case ROOTCONTEXT_MNT
:
1008 prefix
= ROOTCONTEXT_STR
;
1010 case DEFCONTEXT_MNT
:
1011 prefix
= DEFCONTEXT_STR
;
1013 case SE_SBLABELSUPP
:
1015 seq_puts(m
, LABELSUPP_STR
);
1020 /* we need a comma before each option */
1022 seq_puts(m
, prefix
);
1025 seq_puts(m
, opts
->mnt_opts
[i
]);
1031 static int selinux_sb_show_options(struct seq_file
*m
, struct super_block
*sb
)
1033 struct security_mnt_opts opts
;
1036 rc
= selinux_get_mnt_opts(sb
, &opts
);
1038 /* before policy load we may get EINVAL, don't show anything */
1044 selinux_write_opts(m
, &opts
);
1046 security_free_mnt_opts(&opts
);
1051 static inline u16
inode_mode_to_security_class(umode_t mode
)
1053 switch (mode
& S_IFMT
) {
1055 return SECCLASS_SOCK_FILE
;
1057 return SECCLASS_LNK_FILE
;
1059 return SECCLASS_FILE
;
1061 return SECCLASS_BLK_FILE
;
1063 return SECCLASS_DIR
;
1065 return SECCLASS_CHR_FILE
;
1067 return SECCLASS_FIFO_FILE
;
1071 return SECCLASS_FILE
;
1074 static inline int default_protocol_stream(int protocol
)
1076 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
1079 static inline int default_protocol_dgram(int protocol
)
1081 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
1084 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
1090 case SOCK_SEQPACKET
:
1091 return SECCLASS_UNIX_STREAM_SOCKET
;
1093 return SECCLASS_UNIX_DGRAM_SOCKET
;
1100 if (default_protocol_stream(protocol
))
1101 return SECCLASS_TCP_SOCKET
;
1103 return SECCLASS_RAWIP_SOCKET
;
1105 if (default_protocol_dgram(protocol
))
1106 return SECCLASS_UDP_SOCKET
;
1108 return SECCLASS_RAWIP_SOCKET
;
1110 return SECCLASS_DCCP_SOCKET
;
1112 return SECCLASS_RAWIP_SOCKET
;
1118 return SECCLASS_NETLINK_ROUTE_SOCKET
;
1119 case NETLINK_FIREWALL
:
1120 return SECCLASS_NETLINK_FIREWALL_SOCKET
;
1121 case NETLINK_INET_DIAG
:
1122 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
1124 return SECCLASS_NETLINK_NFLOG_SOCKET
;
1126 return SECCLASS_NETLINK_XFRM_SOCKET
;
1127 case NETLINK_SELINUX
:
1128 return SECCLASS_NETLINK_SELINUX_SOCKET
;
1130 return SECCLASS_NETLINK_AUDIT_SOCKET
;
1131 case NETLINK_IP6_FW
:
1132 return SECCLASS_NETLINK_IP6FW_SOCKET
;
1133 case NETLINK_DNRTMSG
:
1134 return SECCLASS_NETLINK_DNRT_SOCKET
;
1135 case NETLINK_KOBJECT_UEVENT
:
1136 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
1138 return SECCLASS_NETLINK_SOCKET
;
1141 return SECCLASS_PACKET_SOCKET
;
1143 return SECCLASS_KEY_SOCKET
;
1145 return SECCLASS_APPLETALK_SOCKET
;
1148 return SECCLASS_SOCKET
;
1151 #ifdef CONFIG_PROC_FS
1152 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
1157 char *buffer
, *path
, *end
;
1159 buffer
= (char *)__get_free_page(GFP_KERNEL
);
1164 end
= buffer
+buflen
;
1169 while (de
&& de
!= de
->parent
) {
1170 buflen
-= de
->namelen
+ 1;
1174 memcpy(end
, de
->name
, de
->namelen
);
1179 rc
= security_genfs_sid("proc", path
, tclass
, sid
);
1180 free_page((unsigned long)buffer
);
1184 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
1192 /* The inode's security attributes must be initialized before first use. */
1193 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
1195 struct superblock_security_struct
*sbsec
= NULL
;
1196 struct inode_security_struct
*isec
= inode
->i_security
;
1198 struct dentry
*dentry
;
1199 #define INITCONTEXTLEN 255
1200 char *context
= NULL
;
1204 if (isec
->initialized
)
1207 mutex_lock(&isec
->lock
);
1208 if (isec
->initialized
)
1211 sbsec
= inode
->i_sb
->s_security
;
1212 if (!(sbsec
->flags
& SE_SBINITIALIZED
)) {
1213 /* Defer initialization until selinux_complete_init,
1214 after the initial policy is loaded and the security
1215 server is ready to handle calls. */
1216 spin_lock(&sbsec
->isec_lock
);
1217 if (list_empty(&isec
->list
))
1218 list_add(&isec
->list
, &sbsec
->isec_head
);
1219 spin_unlock(&sbsec
->isec_lock
);
1223 switch (sbsec
->behavior
) {
1224 case SECURITY_FS_USE_XATTR
:
1225 if (!inode
->i_op
->getxattr
) {
1226 isec
->sid
= sbsec
->def_sid
;
1230 /* Need a dentry, since the xattr API requires one.
1231 Life would be simpler if we could just pass the inode. */
1233 /* Called from d_instantiate or d_splice_alias. */
1234 dentry
= dget(opt_dentry
);
1236 /* Called from selinux_complete_init, try to find a dentry. */
1237 dentry
= d_find_alias(inode
);
1241 * this is can be hit on boot when a file is accessed
1242 * before the policy is loaded. When we load policy we
1243 * may find inodes that have no dentry on the
1244 * sbsec->isec_head list. No reason to complain as these
1245 * will get fixed up the next time we go through
1246 * inode_doinit with a dentry, before these inodes could
1247 * be used again by userspace.
1252 len
= INITCONTEXTLEN
;
1253 context
= kmalloc(len
+1, GFP_NOFS
);
1259 context
[len
] = '\0';
1260 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
1262 if (rc
== -ERANGE
) {
1265 /* Need a larger buffer. Query for the right size. */
1266 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
1273 context
= kmalloc(len
+1, GFP_NOFS
);
1279 context
[len
] = '\0';
1280 rc
= inode
->i_op
->getxattr(dentry
,
1286 if (rc
!= -ENODATA
) {
1287 printk(KERN_WARNING
"SELinux: %s: getxattr returned "
1288 "%d for dev=%s ino=%ld\n", __func__
,
1289 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1293 /* Map ENODATA to the default file SID */
1294 sid
= sbsec
->def_sid
;
1297 rc
= security_context_to_sid_default(context
, rc
, &sid
,
1301 char *dev
= inode
->i_sb
->s_id
;
1302 unsigned long ino
= inode
->i_ino
;
1304 if (rc
== -EINVAL
) {
1305 if (printk_ratelimit())
1306 printk(KERN_NOTICE
"SELinux: inode=%lu on dev=%s was found to have an invalid "
1307 "context=%s. This indicates you may need to relabel the inode or the "
1308 "filesystem in question.\n", ino
, dev
, context
);
1310 printk(KERN_WARNING
"SELinux: %s: context_to_sid(%s) "
1311 "returned %d for dev=%s ino=%ld\n",
1312 __func__
, context
, -rc
, dev
, ino
);
1315 /* Leave with the unlabeled SID */
1323 case SECURITY_FS_USE_TASK
:
1324 isec
->sid
= isec
->task_sid
;
1326 case SECURITY_FS_USE_TRANS
:
1327 /* Default to the fs SID. */
1328 isec
->sid
= sbsec
->sid
;
1330 /* Try to obtain a transition SID. */
1331 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1332 rc
= security_transition_sid(isec
->task_sid
,
1340 case SECURITY_FS_USE_MNTPOINT
:
1341 isec
->sid
= sbsec
->mntpoint_sid
;
1344 /* Default to the fs superblock SID. */
1345 isec
->sid
= sbsec
->sid
;
1347 if ((sbsec
->flags
& SE_SBPROC
) && !S_ISLNK(inode
->i_mode
)) {
1348 struct proc_inode
*proci
= PROC_I(inode
);
1350 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1351 rc
= selinux_proc_get_sid(proci
->pde
,
1362 isec
->initialized
= 1;
1365 mutex_unlock(&isec
->lock
);
1367 if (isec
->sclass
== SECCLASS_FILE
)
1368 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1372 /* Convert a Linux signal to an access vector. */
1373 static inline u32
signal_to_av(int sig
)
1379 /* Commonly granted from child to parent. */
1380 perm
= PROCESS__SIGCHLD
;
1383 /* Cannot be caught or ignored */
1384 perm
= PROCESS__SIGKILL
;
1387 /* Cannot be caught or ignored */
1388 perm
= PROCESS__SIGSTOP
;
1391 /* All other signals. */
1392 perm
= PROCESS__SIGNAL
;
1400 * Check permission between a pair of credentials
1401 * fork check, ptrace check, etc.
1403 static int cred_has_perm(const struct cred
*actor
,
1404 const struct cred
*target
,
1407 u32 asid
= cred_sid(actor
), tsid
= cred_sid(target
);
1409 return avc_has_perm(asid
, tsid
, SECCLASS_PROCESS
, perms
, NULL
);
1413 * Check permission between a pair of tasks, e.g. signal checks,
1414 * fork check, ptrace check, etc.
1415 * tsk1 is the actor and tsk2 is the target
1416 * - this uses the default subjective creds of tsk1
1418 static int task_has_perm(const struct task_struct
*tsk1
,
1419 const struct task_struct
*tsk2
,
1422 const struct task_security_struct
*__tsec1
, *__tsec2
;
1426 __tsec1
= __task_cred(tsk1
)->security
; sid1
= __tsec1
->sid
;
1427 __tsec2
= __task_cred(tsk2
)->security
; sid2
= __tsec2
->sid
;
1429 return avc_has_perm(sid1
, sid2
, SECCLASS_PROCESS
, perms
, NULL
);
1433 * Check permission between current and another task, e.g. signal checks,
1434 * fork check, ptrace check, etc.
1435 * current is the actor and tsk2 is the target
1436 * - this uses current's subjective creds
1438 static int current_has_perm(const struct task_struct
*tsk
,
1443 sid
= current_sid();
1444 tsid
= task_sid(tsk
);
1445 return avc_has_perm(sid
, tsid
, SECCLASS_PROCESS
, perms
, NULL
);
1448 #if CAP_LAST_CAP > 63
1449 #error Fix SELinux to handle capabilities > 63.
1452 /* Check whether a task is allowed to use a capability. */
1453 static int task_has_capability(struct task_struct
*tsk
,
1454 const struct cred
*cred
,
1457 struct common_audit_data ad
;
1458 struct av_decision avd
;
1460 u32 sid
= cred_sid(cred
);
1461 u32 av
= CAP_TO_MASK(cap
);
1464 COMMON_AUDIT_DATA_INIT(&ad
, CAP
);
1468 switch (CAP_TO_INDEX(cap
)) {
1470 sclass
= SECCLASS_CAPABILITY
;
1473 sclass
= SECCLASS_CAPABILITY2
;
1477 "SELinux: out of range capability %d\n", cap
);
1481 rc
= avc_has_perm_noaudit(sid
, sid
, sclass
, av
, 0, &avd
);
1482 if (audit
== SECURITY_CAP_AUDIT
)
1483 avc_audit(sid
, sid
, sclass
, av
, &avd
, rc
, &ad
);
1487 /* Check whether a task is allowed to use a system operation. */
1488 static int task_has_system(struct task_struct
*tsk
,
1491 u32 sid
= task_sid(tsk
);
1493 return avc_has_perm(sid
, SECINITSID_KERNEL
,
1494 SECCLASS_SYSTEM
, perms
, NULL
);
1497 /* Check whether a task has a particular permission to an inode.
1498 The 'adp' parameter is optional and allows other audit
1499 data to be passed (e.g. the dentry). */
1500 static int inode_has_perm(const struct cred
*cred
,
1501 struct inode
*inode
,
1503 struct common_audit_data
*adp
)
1505 struct inode_security_struct
*isec
;
1506 struct common_audit_data ad
;
1509 validate_creds(cred
);
1511 if (unlikely(IS_PRIVATE(inode
)))
1514 sid
= cred_sid(cred
);
1515 isec
= inode
->i_security
;
1519 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
1520 ad
.u
.fs
.inode
= inode
;
1523 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
1526 /* Same as inode_has_perm, but pass explicit audit data containing
1527 the dentry to help the auditing code to more easily generate the
1528 pathname if needed. */
1529 static inline int dentry_has_perm(const struct cred
*cred
,
1530 struct vfsmount
*mnt
,
1531 struct dentry
*dentry
,
1534 struct inode
*inode
= dentry
->d_inode
;
1535 struct common_audit_data ad
;
1537 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
1538 ad
.u
.fs
.path
.mnt
= mnt
;
1539 ad
.u
.fs
.path
.dentry
= dentry
;
1540 return inode_has_perm(cred
, inode
, av
, &ad
);
1543 /* Check whether a task can use an open file descriptor to
1544 access an inode in a given way. Check access to the
1545 descriptor itself, and then use dentry_has_perm to
1546 check a particular permission to the file.
1547 Access to the descriptor is implicitly granted if it
1548 has the same SID as the process. If av is zero, then
1549 access to the file is not checked, e.g. for cases
1550 where only the descriptor is affected like seek. */
1551 static int file_has_perm(const struct cred
*cred
,
1555 struct file_security_struct
*fsec
= file
->f_security
;
1556 struct inode
*inode
= file
->f_path
.dentry
->d_inode
;
1557 struct common_audit_data ad
;
1558 u32 sid
= cred_sid(cred
);
1561 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
1562 ad
.u
.fs
.path
= file
->f_path
;
1564 if (sid
!= fsec
->sid
) {
1565 rc
= avc_has_perm(sid
, fsec
->sid
,
1573 /* av is zero if only checking access to the descriptor. */
1576 rc
= inode_has_perm(cred
, inode
, av
, &ad
);
1582 /* Check whether a task can create a file. */
1583 static int may_create(struct inode
*dir
,
1584 struct dentry
*dentry
,
1587 const struct cred
*cred
= current_cred();
1588 const struct task_security_struct
*tsec
= cred
->security
;
1589 struct inode_security_struct
*dsec
;
1590 struct superblock_security_struct
*sbsec
;
1592 struct common_audit_data ad
;
1595 dsec
= dir
->i_security
;
1596 sbsec
= dir
->i_sb
->s_security
;
1599 newsid
= tsec
->create_sid
;
1601 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
1602 ad
.u
.fs
.path
.dentry
= dentry
;
1604 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
,
1605 DIR__ADD_NAME
| DIR__SEARCH
,
1610 if (!newsid
|| !(sbsec
->flags
& SE_SBLABELSUPP
)) {
1611 rc
= security_transition_sid(sid
, dsec
->sid
, tclass
, &newsid
);
1616 rc
= avc_has_perm(sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1620 return avc_has_perm(newsid
, sbsec
->sid
,
1621 SECCLASS_FILESYSTEM
,
1622 FILESYSTEM__ASSOCIATE
, &ad
);
1625 /* Check whether a task can create a key. */
1626 static int may_create_key(u32 ksid
,
1627 struct task_struct
*ctx
)
1629 u32 sid
= task_sid(ctx
);
1631 return avc_has_perm(sid
, ksid
, SECCLASS_KEY
, KEY__CREATE
, NULL
);
1635 #define MAY_UNLINK 1
1638 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1639 static int may_link(struct inode
*dir
,
1640 struct dentry
*dentry
,
1644 struct inode_security_struct
*dsec
, *isec
;
1645 struct common_audit_data ad
;
1646 u32 sid
= current_sid();
1650 dsec
= dir
->i_security
;
1651 isec
= dentry
->d_inode
->i_security
;
1653 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
1654 ad
.u
.fs
.path
.dentry
= dentry
;
1657 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1658 rc
= avc_has_perm(sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1673 printk(KERN_WARNING
"SELinux: %s: unrecognized kind %d\n",
1678 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1682 static inline int may_rename(struct inode
*old_dir
,
1683 struct dentry
*old_dentry
,
1684 struct inode
*new_dir
,
1685 struct dentry
*new_dentry
)
1687 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1688 struct common_audit_data ad
;
1689 u32 sid
= current_sid();
1691 int old_is_dir
, new_is_dir
;
1694 old_dsec
= old_dir
->i_security
;
1695 old_isec
= old_dentry
->d_inode
->i_security
;
1696 old_is_dir
= S_ISDIR(old_dentry
->d_inode
->i_mode
);
1697 new_dsec
= new_dir
->i_security
;
1699 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
1701 ad
.u
.fs
.path
.dentry
= old_dentry
;
1702 rc
= avc_has_perm(sid
, old_dsec
->sid
, SECCLASS_DIR
,
1703 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1706 rc
= avc_has_perm(sid
, old_isec
->sid
,
1707 old_isec
->sclass
, FILE__RENAME
, &ad
);
1710 if (old_is_dir
&& new_dir
!= old_dir
) {
1711 rc
= avc_has_perm(sid
, old_isec
->sid
,
1712 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1717 ad
.u
.fs
.path
.dentry
= new_dentry
;
1718 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1719 if (new_dentry
->d_inode
)
1720 av
|= DIR__REMOVE_NAME
;
1721 rc
= avc_has_perm(sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1724 if (new_dentry
->d_inode
) {
1725 new_isec
= new_dentry
->d_inode
->i_security
;
1726 new_is_dir
= S_ISDIR(new_dentry
->d_inode
->i_mode
);
1727 rc
= avc_has_perm(sid
, new_isec
->sid
,
1729 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1737 /* Check whether a task can perform a filesystem operation. */
1738 static int superblock_has_perm(const struct cred
*cred
,
1739 struct super_block
*sb
,
1741 struct common_audit_data
*ad
)
1743 struct superblock_security_struct
*sbsec
;
1744 u32 sid
= cred_sid(cred
);
1746 sbsec
= sb
->s_security
;
1747 return avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
, perms
, ad
);
1750 /* Convert a Linux mode and permission mask to an access vector. */
1751 static inline u32
file_mask_to_av(int mode
, int mask
)
1755 if ((mode
& S_IFMT
) != S_IFDIR
) {
1756 if (mask
& MAY_EXEC
)
1757 av
|= FILE__EXECUTE
;
1758 if (mask
& MAY_READ
)
1761 if (mask
& MAY_APPEND
)
1763 else if (mask
& MAY_WRITE
)
1767 if (mask
& MAY_EXEC
)
1769 if (mask
& MAY_WRITE
)
1771 if (mask
& MAY_READ
)
1778 /* Convert a Linux file to an access vector. */
1779 static inline u32
file_to_av(struct file
*file
)
1783 if (file
->f_mode
& FMODE_READ
)
1785 if (file
->f_mode
& FMODE_WRITE
) {
1786 if (file
->f_flags
& O_APPEND
)
1793 * Special file opened with flags 3 for ioctl-only use.
1802 * Convert a file to an access vector and include the correct open
1805 static inline u32
open_file_to_av(struct file
*file
)
1807 u32 av
= file_to_av(file
);
1809 if (selinux_policycap_openperm
) {
1810 mode_t mode
= file
->f_path
.dentry
->d_inode
->i_mode
;
1812 * lnk files and socks do not really have an 'open'
1816 else if (S_ISCHR(mode
))
1817 av
|= CHR_FILE__OPEN
;
1818 else if (S_ISBLK(mode
))
1819 av
|= BLK_FILE__OPEN
;
1820 else if (S_ISFIFO(mode
))
1821 av
|= FIFO_FILE__OPEN
;
1822 else if (S_ISDIR(mode
))
1824 else if (S_ISSOCK(mode
))
1825 av
|= SOCK_FILE__OPEN
;
1827 printk(KERN_ERR
"SELinux: WARNING: inside %s with "
1828 "unknown mode:%o\n", __func__
, mode
);
1833 /* Hook functions begin here. */
1835 static int selinux_ptrace_access_check(struct task_struct
*child
,
1840 rc
= cap_ptrace_access_check(child
, mode
);
1844 if (mode
== PTRACE_MODE_READ
) {
1845 u32 sid
= current_sid();
1846 u32 csid
= task_sid(child
);
1847 return avc_has_perm(sid
, csid
, SECCLASS_FILE
, FILE__READ
, NULL
);
1850 return current_has_perm(child
, PROCESS__PTRACE
);
1853 static int selinux_ptrace_traceme(struct task_struct
*parent
)
1857 rc
= cap_ptrace_traceme(parent
);
1861 return task_has_perm(parent
, current
, PROCESS__PTRACE
);
1864 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
1865 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1869 error
= current_has_perm(target
, PROCESS__GETCAP
);
1873 return cap_capget(target
, effective
, inheritable
, permitted
);
1876 static int selinux_capset(struct cred
*new, const struct cred
*old
,
1877 const kernel_cap_t
*effective
,
1878 const kernel_cap_t
*inheritable
,
1879 const kernel_cap_t
*permitted
)
1883 error
= cap_capset(new, old
,
1884 effective
, inheritable
, permitted
);
1888 return cred_has_perm(old
, new, PROCESS__SETCAP
);
1892 * (This comment used to live with the selinux_task_setuid hook,
1893 * which was removed).
1895 * Since setuid only affects the current process, and since the SELinux
1896 * controls are not based on the Linux identity attributes, SELinux does not
1897 * need to control this operation. However, SELinux does control the use of
1898 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1901 static int selinux_capable(struct task_struct
*tsk
, const struct cred
*cred
,
1906 rc
= cap_capable(tsk
, cred
, cap
, audit
);
1910 return task_has_capability(tsk
, cred
, cap
, audit
);
1913 static int selinux_sysctl_get_sid(ctl_table
*table
, u16 tclass
, u32
*sid
)
1916 char *buffer
, *path
, *end
;
1919 buffer
= (char *)__get_free_page(GFP_KERNEL
);
1924 end
= buffer
+buflen
;
1930 const char *name
= table
->procname
;
1931 size_t namelen
= strlen(name
);
1932 buflen
-= namelen
+ 1;
1936 memcpy(end
, name
, namelen
);
1939 table
= table
->parent
;
1945 memcpy(end
, "/sys", 4);
1947 rc
= security_genfs_sid("proc", path
, tclass
, sid
);
1949 free_page((unsigned long)buffer
);
1954 static int selinux_sysctl(ctl_table
*table
, int op
)
1961 sid
= current_sid();
1963 rc
= selinux_sysctl_get_sid(table
, (op
== 0001) ?
1964 SECCLASS_DIR
: SECCLASS_FILE
, &tsid
);
1966 /* Default to the well-defined sysctl SID. */
1967 tsid
= SECINITSID_SYSCTL
;
1970 /* The op values are "defined" in sysctl.c, thereby creating
1971 * a bad coupling between this module and sysctl.c */
1973 error
= avc_has_perm(sid
, tsid
,
1974 SECCLASS_DIR
, DIR__SEARCH
, NULL
);
1982 error
= avc_has_perm(sid
, tsid
,
1983 SECCLASS_FILE
, av
, NULL
);
1989 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
1991 const struct cred
*cred
= current_cred();
2003 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAMOD
, NULL
);
2008 rc
= superblock_has_perm(cred
, sb
, FILESYSTEM__QUOTAGET
, NULL
);
2011 rc
= 0; /* let the kernel handle invalid cmds */
2017 static int selinux_quota_on(struct dentry
*dentry
)
2019 const struct cred
*cred
= current_cred();
2021 return dentry_has_perm(cred
, NULL
, dentry
, FILE__QUOTAON
);
2024 static int selinux_syslog(int type
, bool from_file
)
2028 rc
= cap_syslog(type
, from_file
);
2033 case SYSLOG_ACTION_READ_ALL
: /* Read last kernel messages */
2034 case SYSLOG_ACTION_SIZE_BUFFER
: /* Return size of the log buffer */
2035 rc
= task_has_system(current
, SYSTEM__SYSLOG_READ
);
2037 case SYSLOG_ACTION_CONSOLE_OFF
: /* Disable logging to console */
2038 case SYSLOG_ACTION_CONSOLE_ON
: /* Enable logging to console */
2039 /* Set level of messages printed to console */
2040 case SYSLOG_ACTION_CONSOLE_LEVEL
:
2041 rc
= task_has_system(current
, SYSTEM__SYSLOG_CONSOLE
);
2043 case SYSLOG_ACTION_CLOSE
: /* Close log */
2044 case SYSLOG_ACTION_OPEN
: /* Open log */
2045 case SYSLOG_ACTION_READ
: /* Read from log */
2046 case SYSLOG_ACTION_READ_CLEAR
: /* Read/clear last kernel messages */
2047 case SYSLOG_ACTION_CLEAR
: /* Clear ring buffer */
2049 rc
= task_has_system(current
, SYSTEM__SYSLOG_MOD
);
2056 * Check that a process has enough memory to allocate a new virtual
2057 * mapping. 0 means there is enough memory for the allocation to
2058 * succeed and -ENOMEM implies there is not.
2060 * Do not audit the selinux permission check, as this is applied to all
2061 * processes that allocate mappings.
2063 static int selinux_vm_enough_memory(struct mm_struct
*mm
, long pages
)
2065 int rc
, cap_sys_admin
= 0;
2067 rc
= selinux_capable(current
, current_cred(), CAP_SYS_ADMIN
,
2068 SECURITY_CAP_NOAUDIT
);
2072 return __vm_enough_memory(mm
, pages
, cap_sys_admin
);
2075 /* binprm security operations */
2077 static int selinux_bprm_set_creds(struct linux_binprm
*bprm
)
2079 const struct task_security_struct
*old_tsec
;
2080 struct task_security_struct
*new_tsec
;
2081 struct inode_security_struct
*isec
;
2082 struct common_audit_data ad
;
2083 struct inode
*inode
= bprm
->file
->f_path
.dentry
->d_inode
;
2086 rc
= cap_bprm_set_creds(bprm
);
2090 /* SELinux context only depends on initial program or script and not
2091 * the script interpreter */
2092 if (bprm
->cred_prepared
)
2095 old_tsec
= current_security();
2096 new_tsec
= bprm
->cred
->security
;
2097 isec
= inode
->i_security
;
2099 /* Default to the current task SID. */
2100 new_tsec
->sid
= old_tsec
->sid
;
2101 new_tsec
->osid
= old_tsec
->sid
;
2103 /* Reset fs, key, and sock SIDs on execve. */
2104 new_tsec
->create_sid
= 0;
2105 new_tsec
->keycreate_sid
= 0;
2106 new_tsec
->sockcreate_sid
= 0;
2108 if (old_tsec
->exec_sid
) {
2109 new_tsec
->sid
= old_tsec
->exec_sid
;
2110 /* Reset exec SID on execve. */
2111 new_tsec
->exec_sid
= 0;
2113 /* Check for a default transition on this program. */
2114 rc
= security_transition_sid(old_tsec
->sid
, isec
->sid
,
2115 SECCLASS_PROCESS
, &new_tsec
->sid
);
2120 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
2121 ad
.u
.fs
.path
= bprm
->file
->f_path
;
2123 if (bprm
->file
->f_path
.mnt
->mnt_flags
& MNT_NOSUID
)
2124 new_tsec
->sid
= old_tsec
->sid
;
2126 if (new_tsec
->sid
== old_tsec
->sid
) {
2127 rc
= avc_has_perm(old_tsec
->sid
, isec
->sid
,
2128 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
2132 /* Check permissions for the transition. */
2133 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2134 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
2138 rc
= avc_has_perm(new_tsec
->sid
, isec
->sid
,
2139 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
2143 /* Check for shared state */
2144 if (bprm
->unsafe
& LSM_UNSAFE_SHARE
) {
2145 rc
= avc_has_perm(old_tsec
->sid
, new_tsec
->sid
,
2146 SECCLASS_PROCESS
, PROCESS__SHARE
,
2152 /* Make sure that anyone attempting to ptrace over a task that
2153 * changes its SID has the appropriate permit */
2155 (LSM_UNSAFE_PTRACE
| LSM_UNSAFE_PTRACE_CAP
)) {
2156 struct task_struct
*tracer
;
2157 struct task_security_struct
*sec
;
2161 tracer
= tracehook_tracer_task(current
);
2162 if (likely(tracer
!= NULL
)) {
2163 sec
= __task_cred(tracer
)->security
;
2169 rc
= avc_has_perm(ptsid
, new_tsec
->sid
,
2171 PROCESS__PTRACE
, NULL
);
2177 /* Clear any possibly unsafe personality bits on exec: */
2178 bprm
->per_clear
|= PER_CLEAR_ON_SETID
;
2184 static int selinux_bprm_secureexec(struct linux_binprm
*bprm
)
2186 const struct cred
*cred
= current_cred();
2187 const struct task_security_struct
*tsec
= cred
->security
;
2195 /* Enable secure mode for SIDs transitions unless
2196 the noatsecure permission is granted between
2197 the two SIDs, i.e. ahp returns 0. */
2198 atsecure
= avc_has_perm(osid
, sid
,
2200 PROCESS__NOATSECURE
, NULL
);
2203 return (atsecure
|| cap_bprm_secureexec(bprm
));
2206 extern struct vfsmount
*selinuxfs_mount
;
2207 extern struct dentry
*selinux_null
;
2209 /* Derived from fs/exec.c:flush_old_files. */
2210 static inline void flush_unauthorized_files(const struct cred
*cred
,
2211 struct files_struct
*files
)
2213 struct common_audit_data ad
;
2214 struct file
*file
, *devnull
= NULL
;
2215 struct tty_struct
*tty
;
2216 struct fdtable
*fdt
;
2220 tty
= get_current_tty();
2223 if (!list_empty(&tty
->tty_files
)) {
2224 struct inode
*inode
;
2226 /* Revalidate access to controlling tty.
2227 Use inode_has_perm on the tty inode directly rather
2228 than using file_has_perm, as this particular open
2229 file may belong to another process and we are only
2230 interested in the inode-based check here. */
2231 file
= list_first_entry(&tty
->tty_files
, struct file
, f_u
.fu_list
);
2232 inode
= file
->f_path
.dentry
->d_inode
;
2233 if (inode_has_perm(cred
, inode
,
2234 FILE__READ
| FILE__WRITE
, NULL
)) {
2241 /* Reset controlling tty. */
2245 /* Revalidate access to inherited open files. */
2247 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
2249 spin_lock(&files
->file_lock
);
2251 unsigned long set
, i
;
2256 fdt
= files_fdtable(files
);
2257 if (i
>= fdt
->max_fds
)
2259 set
= fdt
->open_fds
->fds_bits
[j
];
2262 spin_unlock(&files
->file_lock
);
2263 for ( ; set
; i
++, set
>>= 1) {
2268 if (file_has_perm(cred
,
2270 file_to_av(file
))) {
2272 fd
= get_unused_fd();
2282 devnull
= dentry_open(
2284 mntget(selinuxfs_mount
),
2286 if (IS_ERR(devnull
)) {
2293 fd_install(fd
, devnull
);
2298 spin_lock(&files
->file_lock
);
2301 spin_unlock(&files
->file_lock
);
2305 * Prepare a process for imminent new credential changes due to exec
2307 static void selinux_bprm_committing_creds(struct linux_binprm
*bprm
)
2309 struct task_security_struct
*new_tsec
;
2310 struct rlimit
*rlim
, *initrlim
;
2313 new_tsec
= bprm
->cred
->security
;
2314 if (new_tsec
->sid
== new_tsec
->osid
)
2317 /* Close files for which the new task SID is not authorized. */
2318 flush_unauthorized_files(bprm
->cred
, current
->files
);
2320 /* Always clear parent death signal on SID transitions. */
2321 current
->pdeath_signal
= 0;
2323 /* Check whether the new SID can inherit resource limits from the old
2324 * SID. If not, reset all soft limits to the lower of the current
2325 * task's hard limit and the init task's soft limit.
2327 * Note that the setting of hard limits (even to lower them) can be
2328 * controlled by the setrlimit check. The inclusion of the init task's
2329 * soft limit into the computation is to avoid resetting soft limits
2330 * higher than the default soft limit for cases where the default is
2331 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2333 rc
= avc_has_perm(new_tsec
->osid
, new_tsec
->sid
, SECCLASS_PROCESS
,
2334 PROCESS__RLIMITINH
, NULL
);
2336 /* protect against do_prlimit() */
2338 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
2339 rlim
= current
->signal
->rlim
+ i
;
2340 initrlim
= init_task
.signal
->rlim
+ i
;
2341 rlim
->rlim_cur
= min(rlim
->rlim_max
, initrlim
->rlim_cur
);
2343 task_unlock(current
);
2344 update_rlimit_cpu(current
, rlimit(RLIMIT_CPU
));
2349 * Clean up the process immediately after the installation of new credentials
2352 static void selinux_bprm_committed_creds(struct linux_binprm
*bprm
)
2354 const struct task_security_struct
*tsec
= current_security();
2355 struct itimerval itimer
;
2365 /* Check whether the new SID can inherit signal state from the old SID.
2366 * If not, clear itimers to avoid subsequent signal generation and
2367 * flush and unblock signals.
2369 * This must occur _after_ the task SID has been updated so that any
2370 * kill done after the flush will be checked against the new SID.
2372 rc
= avc_has_perm(osid
, sid
, SECCLASS_PROCESS
, PROCESS__SIGINH
, NULL
);
2374 memset(&itimer
, 0, sizeof itimer
);
2375 for (i
= 0; i
< 3; i
++)
2376 do_setitimer(i
, &itimer
, NULL
);
2377 spin_lock_irq(¤t
->sighand
->siglock
);
2378 if (!(current
->signal
->flags
& SIGNAL_GROUP_EXIT
)) {
2379 __flush_signals(current
);
2380 flush_signal_handlers(current
, 1);
2381 sigemptyset(¤t
->blocked
);
2383 spin_unlock_irq(¤t
->sighand
->siglock
);
2386 /* Wake up the parent if it is waiting so that it can recheck
2387 * wait permission to the new task SID. */
2388 read_lock(&tasklist_lock
);
2389 __wake_up_parent(current
, current
->real_parent
);
2390 read_unlock(&tasklist_lock
);
2393 /* superblock security operations */
2395 static int selinux_sb_alloc_security(struct super_block
*sb
)
2397 return superblock_alloc_security(sb
);
2400 static void selinux_sb_free_security(struct super_block
*sb
)
2402 superblock_free_security(sb
);
2405 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
2410 return !memcmp(prefix
, option
, plen
);
2413 static inline int selinux_option(char *option
, int len
)
2415 return (match_prefix(CONTEXT_STR
, sizeof(CONTEXT_STR
)-1, option
, len
) ||
2416 match_prefix(FSCONTEXT_STR
, sizeof(FSCONTEXT_STR
)-1, option
, len
) ||
2417 match_prefix(DEFCONTEXT_STR
, sizeof(DEFCONTEXT_STR
)-1, option
, len
) ||
2418 match_prefix(ROOTCONTEXT_STR
, sizeof(ROOTCONTEXT_STR
)-1, option
, len
) ||
2419 match_prefix(LABELSUPP_STR
, sizeof(LABELSUPP_STR
)-1, option
, len
));
2422 static inline void take_option(char **to
, char *from
, int *first
, int len
)
2429 memcpy(*to
, from
, len
);
2433 static inline void take_selinux_option(char **to
, char *from
, int *first
,
2436 int current_size
= 0;
2444 while (current_size
< len
) {
2454 static int selinux_sb_copy_data(char *orig
, char *copy
)
2456 int fnosec
, fsec
, rc
= 0;
2457 char *in_save
, *in_curr
, *in_end
;
2458 char *sec_curr
, *nosec_save
, *nosec
;
2464 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
2472 in_save
= in_end
= orig
;
2476 open_quote
= !open_quote
;
2477 if ((*in_end
== ',' && open_quote
== 0) ||
2479 int len
= in_end
- in_curr
;
2481 if (selinux_option(in_curr
, len
))
2482 take_selinux_option(&sec_curr
, in_curr
, &fsec
, len
);
2484 take_option(&nosec
, in_curr
, &fnosec
, len
);
2486 in_curr
= in_end
+ 1;
2488 } while (*in_end
++);
2490 strcpy(in_save
, nosec_save
);
2491 free_page((unsigned long)nosec_save
);
2496 static int selinux_sb_kern_mount(struct super_block
*sb
, int flags
, void *data
)
2498 const struct cred
*cred
= current_cred();
2499 struct common_audit_data ad
;
2502 rc
= superblock_doinit(sb
, data
);
2506 /* Allow all mounts performed by the kernel */
2507 if (flags
& MS_KERNMOUNT
)
2510 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
2511 ad
.u
.fs
.path
.dentry
= sb
->s_root
;
2512 return superblock_has_perm(cred
, sb
, FILESYSTEM__MOUNT
, &ad
);
2515 static int selinux_sb_statfs(struct dentry
*dentry
)
2517 const struct cred
*cred
= current_cred();
2518 struct common_audit_data ad
;
2520 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
2521 ad
.u
.fs
.path
.dentry
= dentry
->d_sb
->s_root
;
2522 return superblock_has_perm(cred
, dentry
->d_sb
, FILESYSTEM__GETATTR
, &ad
);
2525 static int selinux_mount(char *dev_name
,
2528 unsigned long flags
,
2531 const struct cred
*cred
= current_cred();
2533 if (flags
& MS_REMOUNT
)
2534 return superblock_has_perm(cred
, path
->mnt
->mnt_sb
,
2535 FILESYSTEM__REMOUNT
, NULL
);
2537 return dentry_has_perm(cred
, path
->mnt
, path
->dentry
,
2541 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
2543 const struct cred
*cred
= current_cred();
2545 return superblock_has_perm(cred
, mnt
->mnt_sb
,
2546 FILESYSTEM__UNMOUNT
, NULL
);
2549 /* inode security operations */
2551 static int selinux_inode_alloc_security(struct inode
*inode
)
2553 return inode_alloc_security(inode
);
2556 static void selinux_inode_free_security(struct inode
*inode
)
2558 inode_free_security(inode
);
2561 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
2562 char **name
, void **value
,
2565 const struct cred
*cred
= current_cred();
2566 const struct task_security_struct
*tsec
= cred
->security
;
2567 struct inode_security_struct
*dsec
;
2568 struct superblock_security_struct
*sbsec
;
2569 u32 sid
, newsid
, clen
;
2571 char *namep
= NULL
, *context
;
2573 dsec
= dir
->i_security
;
2574 sbsec
= dir
->i_sb
->s_security
;
2577 newsid
= tsec
->create_sid
;
2579 if (!newsid
|| !(sbsec
->flags
& SE_SBLABELSUPP
)) {
2580 rc
= security_transition_sid(sid
, dsec
->sid
,
2581 inode_mode_to_security_class(inode
->i_mode
),
2584 printk(KERN_WARNING
"%s: "
2585 "security_transition_sid failed, rc=%d (dev=%s "
2588 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
2593 /* Possibly defer initialization to selinux_complete_init. */
2594 if (sbsec
->flags
& SE_SBINITIALIZED
) {
2595 struct inode_security_struct
*isec
= inode
->i_security
;
2596 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
2598 isec
->initialized
= 1;
2601 if (!ss_initialized
|| !(sbsec
->flags
& SE_SBLABELSUPP
))
2605 namep
= kstrdup(XATTR_SELINUX_SUFFIX
, GFP_NOFS
);
2612 rc
= security_sid_to_context_force(newsid
, &context
, &clen
);
2624 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2626 return may_create(dir
, dentry
, SECCLASS_FILE
);
2629 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2631 return may_link(dir
, old_dentry
, MAY_LINK
);
2634 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2636 return may_link(dir
, dentry
, MAY_UNLINK
);
2639 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2641 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2644 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2646 return may_create(dir
, dentry
, SECCLASS_DIR
);
2649 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2651 return may_link(dir
, dentry
, MAY_RMDIR
);
2654 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, int mode
, dev_t dev
)
2656 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2659 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2660 struct inode
*new_inode
, struct dentry
*new_dentry
)
2662 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2665 static int selinux_inode_readlink(struct dentry
*dentry
)
2667 const struct cred
*cred
= current_cred();
2669 return dentry_has_perm(cred
, NULL
, dentry
, FILE__READ
);
2672 static int selinux_inode_follow_link(struct dentry
*dentry
, struct nameidata
*nameidata
)
2674 const struct cred
*cred
= current_cred();
2676 return dentry_has_perm(cred
, NULL
, dentry
, FILE__READ
);
2679 static int selinux_inode_permission(struct inode
*inode
, int mask
)
2681 const struct cred
*cred
= current_cred();
2684 /* No permission to check. Existence test. */
2688 return inode_has_perm(cred
, inode
,
2689 file_mask_to_av(inode
->i_mode
, mask
), NULL
);
2692 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
2694 const struct cred
*cred
= current_cred();
2695 unsigned int ia_valid
= iattr
->ia_valid
;
2697 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2698 if (ia_valid
& ATTR_FORCE
) {
2699 ia_valid
&= ~(ATTR_KILL_SUID
| ATTR_KILL_SGID
| ATTR_MODE
|
2705 if (ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
2706 ATTR_ATIME_SET
| ATTR_MTIME_SET
| ATTR_TIMES_SET
))
2707 return dentry_has_perm(cred
, NULL
, dentry
, FILE__SETATTR
);
2709 return dentry_has_perm(cred
, NULL
, dentry
, FILE__WRITE
);
2712 static int selinux_inode_getattr(struct vfsmount
*mnt
, struct dentry
*dentry
)
2714 const struct cred
*cred
= current_cred();
2716 return dentry_has_perm(cred
, mnt
, dentry
, FILE__GETATTR
);
2719 static int selinux_inode_setotherxattr(struct dentry
*dentry
, const char *name
)
2721 const struct cred
*cred
= current_cred();
2723 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2724 sizeof XATTR_SECURITY_PREFIX
- 1)) {
2725 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
2726 if (!capable(CAP_SETFCAP
))
2728 } else if (!capable(CAP_SYS_ADMIN
)) {
2729 /* A different attribute in the security namespace.
2730 Restrict to administrator. */
2735 /* Not an attribute we recognize, so just check the
2736 ordinary setattr permission. */
2737 return dentry_has_perm(cred
, NULL
, dentry
, FILE__SETATTR
);
2740 static int selinux_inode_setxattr(struct dentry
*dentry
, const char *name
,
2741 const void *value
, size_t size
, int flags
)
2743 struct inode
*inode
= dentry
->d_inode
;
2744 struct inode_security_struct
*isec
= inode
->i_security
;
2745 struct superblock_security_struct
*sbsec
;
2746 struct common_audit_data ad
;
2747 u32 newsid
, sid
= current_sid();
2750 if (strcmp(name
, XATTR_NAME_SELINUX
))
2751 return selinux_inode_setotherxattr(dentry
, name
);
2753 sbsec
= inode
->i_sb
->s_security
;
2754 if (!(sbsec
->flags
& SE_SBLABELSUPP
))
2757 if (!is_owner_or_cap(inode
))
2760 COMMON_AUDIT_DATA_INIT(&ad
, FS
);
2761 ad
.u
.fs
.path
.dentry
= dentry
;
2763 rc
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
,
2764 FILE__RELABELFROM
, &ad
);
2768 rc
= security_context_to_sid(value
, size
, &newsid
);
2769 if (rc
== -EINVAL
) {
2770 if (!capable(CAP_MAC_ADMIN
))
2772 rc
= security_context_to_sid_force(value
, size
, &newsid
);
2777 rc
= avc_has_perm(sid
, newsid
, isec
->sclass
,
2778 FILE__RELABELTO
, &ad
);
2782 rc
= security_validate_transition(isec
->sid
, newsid
, sid
,
2787 return avc_has_perm(newsid
,
2789 SECCLASS_FILESYSTEM
,
2790 FILESYSTEM__ASSOCIATE
,
2794 static void selinux_inode_post_setxattr(struct dentry
*dentry
, const char *name
,
2795 const void *value
, size_t size
,
2798 struct inode
*inode
= dentry
->d_inode
;
2799 struct inode_security_struct
*isec
= inode
->i_security
;
2803 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2804 /* Not an attribute we recognize, so nothing to do. */
2808 rc
= security_context_to_sid_force(value
, size
, &newsid
);
2810 printk(KERN_ERR
"SELinux: unable to map context to SID"
2811 "for (%s, %lu), rc=%d\n",
2812 inode
->i_sb
->s_id
, inode
->i_ino
, -rc
);
2820 static int selinux_inode_getxattr(struct dentry
*dentry
, const char *name
)
2822 const struct cred
*cred
= current_cred();
2824 return dentry_has_perm(cred
, NULL
, dentry
, FILE__GETATTR
);
2827 static int selinux_inode_listxattr(struct dentry
*dentry
)
2829 const struct cred
*cred
= current_cred();
2831 return dentry_has_perm(cred
, NULL
, dentry
, FILE__GETATTR
);
2834 static int selinux_inode_removexattr(struct dentry
*dentry
, const char *name
)
2836 if (strcmp(name
, XATTR_NAME_SELINUX
))
2837 return selinux_inode_setotherxattr(dentry
, name
);
2839 /* No one is allowed to remove a SELinux security label.
2840 You can change the label, but all data must be labeled. */
2845 * Copy the inode security context value to the user.
2847 * Permission check is handled by selinux_inode_getxattr hook.
2849 static int selinux_inode_getsecurity(const struct inode
*inode
, const char *name
, void **buffer
, bool alloc
)
2853 char *context
= NULL
;
2854 struct inode_security_struct
*isec
= inode
->i_security
;
2856 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2860 * If the caller has CAP_MAC_ADMIN, then get the raw context
2861 * value even if it is not defined by current policy; otherwise,
2862 * use the in-core value under current policy.
2863 * Use the non-auditing forms of the permission checks since
2864 * getxattr may be called by unprivileged processes commonly
2865 * and lack of permission just means that we fall back to the
2866 * in-core context value, not a denial.
2868 error
= selinux_capable(current
, current_cred(), CAP_MAC_ADMIN
,
2869 SECURITY_CAP_NOAUDIT
);
2871 error
= security_sid_to_context_force(isec
->sid
, &context
,
2874 error
= security_sid_to_context(isec
->sid
, &context
, &size
);
2887 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
2888 const void *value
, size_t size
, int flags
)
2890 struct inode_security_struct
*isec
= inode
->i_security
;
2894 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2897 if (!value
|| !size
)
2900 rc
= security_context_to_sid((void *)value
, size
, &newsid
);
2905 isec
->initialized
= 1;
2909 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
2911 const int len
= sizeof(XATTR_NAME_SELINUX
);
2912 if (buffer
&& len
<= buffer_size
)
2913 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
2917 static void selinux_inode_getsecid(const struct inode
*inode
, u32
*secid
)
2919 struct inode_security_struct
*isec
= inode
->i_security
;
2923 /* file security operations */
2925 static int selinux_revalidate_file_permission(struct file
*file
, int mask
)
2927 const struct cred
*cred
= current_cred();
2928 struct inode
*inode
= file
->f_path
.dentry
->d_inode
;
2930 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2931 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
2934 return file_has_perm(cred
, file
,
2935 file_mask_to_av(inode
->i_mode
, mask
));
2938 static int selinux_file_permission(struct file
*file
, int mask
)
2940 struct inode
*inode
= file
->f_path
.dentry
->d_inode
;
2941 struct file_security_struct
*fsec
= file
->f_security
;
2942 struct inode_security_struct
*isec
= inode
->i_security
;
2943 u32 sid
= current_sid();
2946 /* No permission to check. Existence test. */
2949 if (sid
== fsec
->sid
&& fsec
->isid
== isec
->sid
&&
2950 fsec
->pseqno
== avc_policy_seqno())
2951 /* No change since dentry_open check. */
2954 return selinux_revalidate_file_permission(file
, mask
);
2957 static int selinux_file_alloc_security(struct file
*file
)
2959 return file_alloc_security(file
);
2962 static void selinux_file_free_security(struct file
*file
)
2964 file_free_security(file
);
2967 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
2970 const struct cred
*cred
= current_cred();
2973 if (_IOC_DIR(cmd
) & _IOC_WRITE
)
2975 if (_IOC_DIR(cmd
) & _IOC_READ
)
2980 return file_has_perm(cred
, file
, av
);
2983 static int default_noexec
;
2985 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
2987 const struct cred
*cred
= current_cred();
2990 if (default_noexec
&&
2991 (prot
& PROT_EXEC
) && (!file
|| (!shared
&& (prot
& PROT_WRITE
)))) {
2993 * We are making executable an anonymous mapping or a
2994 * private file mapping that will also be writable.
2995 * This has an additional check.
2997 rc
= cred_has_perm(cred
, cred
, PROCESS__EXECMEM
);
3003 /* read access is always possible with a mapping */
3004 u32 av
= FILE__READ
;
3006 /* write access only matters if the mapping is shared */
3007 if (shared
&& (prot
& PROT_WRITE
))
3010 if (prot
& PROT_EXEC
)
3011 av
|= FILE__EXECUTE
;
3013 return file_has_perm(cred
, file
, av
);
3020 static int selinux_file_mmap(struct file
*file
, unsigned long reqprot
,
3021 unsigned long prot
, unsigned long flags
,
3022 unsigned long addr
, unsigned long addr_only
)
3025 u32 sid
= current_sid();
3028 * notice that we are intentionally putting the SELinux check before
3029 * the secondary cap_file_mmap check. This is such a likely attempt
3030 * at bad behaviour/exploit that we always want to get the AVC, even
3031 * if DAC would have also denied the operation.
3033 if (addr
< CONFIG_LSM_MMAP_MIN_ADDR
) {
3034 rc
= avc_has_perm(sid
, sid
, SECCLASS_MEMPROTECT
,
3035 MEMPROTECT__MMAP_ZERO
, NULL
);
3040 /* do DAC check on address space usage */
3041 rc
= cap_file_mmap(file
, reqprot
, prot
, flags
, addr
, addr_only
);
3042 if (rc
|| addr_only
)
3045 if (selinux_checkreqprot
)
3048 return file_map_prot_check(file
, prot
,
3049 (flags
& MAP_TYPE
) == MAP_SHARED
);
3052 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
3053 unsigned long reqprot
,
3056 const struct cred
*cred
= current_cred();
3058 if (selinux_checkreqprot
)
3061 if (default_noexec
&&
3062 (prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXEC
)) {
3064 if (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
3065 vma
->vm_end
<= vma
->vm_mm
->brk
) {
3066 rc
= cred_has_perm(cred
, cred
, PROCESS__EXECHEAP
);
3067 } else if (!vma
->vm_file
&&
3068 vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
3069 vma
->vm_end
>= vma
->vm_mm
->start_stack
) {
3070 rc
= current_has_perm(current
, PROCESS__EXECSTACK
);
3071 } else if (vma
->vm_file
&& vma
->anon_vma
) {
3073 * We are making executable a file mapping that has
3074 * had some COW done. Since pages might have been
3075 * written, check ability to execute the possibly
3076 * modified content. This typically should only
3077 * occur for text relocations.
3079 rc
= file_has_perm(cred
, vma
->vm_file
, FILE__EXECMOD
);
3085 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
3088 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
3090 const struct cred
*cred
= current_cred();
3092 return file_has_perm(cred
, file
, FILE__LOCK
);
3095 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
3098 const struct cred
*cred
= current_cred();
3103 if (!file
->f_path
.dentry
|| !file
->f_path
.dentry
->d_inode
) {
3108 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
3109 err
= file_has_perm(cred
, file
, FILE__WRITE
);
3118 /* Just check FD__USE permission */
3119 err
= file_has_perm(cred
, file
, 0);
3124 #if BITS_PER_LONG == 32
3129 if (!file
->f_path
.dentry
|| !file
->f_path
.dentry
->d_inode
) {
3133 err
= file_has_perm(cred
, file
, FILE__LOCK
);
3140 static int selinux_file_set_fowner(struct file
*file
)
3142 struct file_security_struct
*fsec
;
3144 fsec
= file
->f_security
;
3145 fsec
->fown_sid
= current_sid();
3150 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
3151 struct fown_struct
*fown
, int signum
)
3154 u32 sid
= task_sid(tsk
);
3156 struct file_security_struct
*fsec
;
3158 /* struct fown_struct is never outside the context of a struct file */
3159 file
= container_of(fown
, struct file
, f_owner
);
3161 fsec
= file
->f_security
;
3164 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
3166 perm
= signal_to_av(signum
);
3168 return avc_has_perm(fsec
->fown_sid
, sid
,
3169 SECCLASS_PROCESS
, perm
, NULL
);
3172 static int selinux_file_receive(struct file
*file
)
3174 const struct cred
*cred
= current_cred();
3176 return file_has_perm(cred
, file
, file_to_av(file
));
3179 static int selinux_dentry_open(struct file
*file
, const struct cred
*cred
)
3181 struct file_security_struct
*fsec
;
3182 struct inode
*inode
;
3183 struct inode_security_struct
*isec
;
3185 inode
= file
->f_path
.dentry
->d_inode
;
3186 fsec
= file
->f_security
;
3187 isec
= inode
->i_security
;
3189 * Save inode label and policy sequence number
3190 * at open-time so that selinux_file_permission
3191 * can determine whether revalidation is necessary.
3192 * Task label is already saved in the file security
3193 * struct as its SID.
3195 fsec
->isid
= isec
->sid
;
3196 fsec
->pseqno
= avc_policy_seqno();
3198 * Since the inode label or policy seqno may have changed
3199 * between the selinux_inode_permission check and the saving
3200 * of state above, recheck that access is still permitted.
3201 * Otherwise, access might never be revalidated against the
3202 * new inode label or new policy.
3203 * This check is not redundant - do not remove.
3205 return inode_has_perm(cred
, inode
, open_file_to_av(file
), NULL
);
3208 /* task security operations */
3210 static int selinux_task_create(unsigned long clone_flags
)
3212 return current_has_perm(current
, PROCESS__FORK
);
3216 * allocate the SELinux part of blank credentials
3218 static int selinux_cred_alloc_blank(struct cred
*cred
, gfp_t gfp
)
3220 struct task_security_struct
*tsec
;
3222 tsec
= kzalloc(sizeof(struct task_security_struct
), gfp
);
3226 cred
->security
= tsec
;
3231 * detach and free the LSM part of a set of credentials
3233 static void selinux_cred_free(struct cred
*cred
)
3235 struct task_security_struct
*tsec
= cred
->security
;
3237 BUG_ON((unsigned long) cred
->security
< PAGE_SIZE
);
3238 cred
->security
= (void *) 0x7UL
;
3243 * prepare a new set of credentials for modification
3245 static int selinux_cred_prepare(struct cred
*new, const struct cred
*old
,
3248 const struct task_security_struct
*old_tsec
;
3249 struct task_security_struct
*tsec
;
3251 old_tsec
= old
->security
;
3253 tsec
= kmemdup(old_tsec
, sizeof(struct task_security_struct
), gfp
);
3257 new->security
= tsec
;
3262 * transfer the SELinux data to a blank set of creds
3264 static void selinux_cred_transfer(struct cred
*new, const struct cred
*old
)
3266 const struct task_security_struct
*old_tsec
= old
->security
;
3267 struct task_security_struct
*tsec
= new->security
;
3273 * set the security data for a kernel service
3274 * - all the creation contexts are set to unlabelled
3276 static int selinux_kernel_act_as(struct cred
*new, u32 secid
)
3278 struct task_security_struct
*tsec
= new->security
;
3279 u32 sid
= current_sid();
3282 ret
= avc_has_perm(sid
, secid
,
3283 SECCLASS_KERNEL_SERVICE
,
3284 KERNEL_SERVICE__USE_AS_OVERRIDE
,
3288 tsec
->create_sid
= 0;
3289 tsec
->keycreate_sid
= 0;
3290 tsec
->sockcreate_sid
= 0;
3296 * set the file creation context in a security record to the same as the
3297 * objective context of the specified inode
3299 static int selinux_kernel_create_files_as(struct cred
*new, struct inode
*inode
)
3301 struct inode_security_struct
*isec
= inode
->i_security
;
3302 struct task_security_struct
*tsec
= new->security
;
3303 u32 sid
= current_sid();
3306 ret
= avc_has_perm(sid
, isec
->sid
,
3307 SECCLASS_KERNEL_SERVICE
,
3308 KERNEL_SERVICE__CREATE_FILES_AS
,
3312 tsec
->create_sid
= isec
->sid
;
3316 static int selinux_kernel_module_request(char *kmod_name
)
3319 struct common_audit_data ad
;
3321 sid
= task_sid(current
);
3323 COMMON_AUDIT_DATA_INIT(&ad
, KMOD
);
3324 ad
.u
.kmod_name
= kmod_name
;
3326 return avc_has_perm(sid
, SECINITSID_KERNEL
, SECCLASS_SYSTEM
,
3327 SYSTEM__MODULE_REQUEST
, &ad
);
3330 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
3332 return current_has_perm(p
, PROCESS__SETPGID
);
3335 static int selinux_task_getpgid(struct task_struct
*p
)
3337 return current_has_perm(p
, PROCESS__GETPGID
);
3340 static int selinux_task_getsid(struct task_struct
*p
)
3342 return current_has_perm(p
, PROCESS__GETSESSION
);
3345 static void selinux_task_getsecid(struct task_struct
*p
, u32
*secid
)
3347 *secid
= task_sid(p
);
3350 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
3354 rc
= cap_task_setnice(p
, nice
);
3358 return current_has_perm(p
, PROCESS__SETSCHED
);
3361 static int selinux_task_setioprio(struct task_struct
*p
, int ioprio
)
3365 rc
= cap_task_setioprio(p
, ioprio
);
3369 return current_has_perm(p
, PROCESS__SETSCHED
);
3372 static int selinux_task_getioprio(struct task_struct
*p
)
3374 return current_has_perm(p
, PROCESS__GETSCHED
);
3377 static int selinux_task_setrlimit(struct task_struct
*p
, unsigned int resource
,
3378 struct rlimit
*new_rlim
)
3380 struct rlimit
*old_rlim
= p
->signal
->rlim
+ resource
;
3382 /* Control the ability to change the hard limit (whether
3383 lowering or raising it), so that the hard limit can
3384 later be used as a safe reset point for the soft limit
3385 upon context transitions. See selinux_bprm_committing_creds. */
3386 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
3387 return current_has_perm(p
, PROCESS__SETRLIMIT
);
3392 static int selinux_task_setscheduler(struct task_struct
*p
, int policy
, struct sched_param
*lp
)
3396 rc
= cap_task_setscheduler(p
, policy
, lp
);
3400 return current_has_perm(p
, PROCESS__SETSCHED
);
3403 static int selinux_task_getscheduler(struct task_struct
*p
)
3405 return current_has_perm(p
, PROCESS__GETSCHED
);
3408 static int selinux_task_movememory(struct task_struct
*p
)
3410 return current_has_perm(p
, PROCESS__SETSCHED
);
3413 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
,
3420 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
3422 perm
= signal_to_av(sig
);
3424 rc
= avc_has_perm(secid
, task_sid(p
),
3425 SECCLASS_PROCESS
, perm
, NULL
);
3427 rc
= current_has_perm(p
, perm
);
3431 static int selinux_task_wait(struct task_struct
*p
)
3433 return task_has_perm(p
, current
, PROCESS__SIGCHLD
);
3436 static void selinux_task_to_inode(struct task_struct
*p
,
3437 struct inode
*inode
)
3439 struct inode_security_struct
*isec
= inode
->i_security
;
3440 u32 sid
= task_sid(p
);
3443 isec
->initialized
= 1;
3446 /* Returns error only if unable to parse addresses */
3447 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
,
3448 struct common_audit_data
*ad
, u8
*proto
)
3450 int offset
, ihlen
, ret
= -EINVAL
;
3451 struct iphdr _iph
, *ih
;
3453 offset
= skb_network_offset(skb
);
3454 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
3458 ihlen
= ih
->ihl
* 4;
3459 if (ihlen
< sizeof(_iph
))
3462 ad
->u
.net
.v4info
.saddr
= ih
->saddr
;
3463 ad
->u
.net
.v4info
.daddr
= ih
->daddr
;
3467 *proto
= ih
->protocol
;
3469 switch (ih
->protocol
) {
3471 struct tcphdr _tcph
, *th
;
3473 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
3477 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
3481 ad
->u
.net
.sport
= th
->source
;
3482 ad
->u
.net
.dport
= th
->dest
;
3487 struct udphdr _udph
, *uh
;
3489 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
3493 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
3497 ad
->u
.net
.sport
= uh
->source
;
3498 ad
->u
.net
.dport
= uh
->dest
;
3502 case IPPROTO_DCCP
: {
3503 struct dccp_hdr _dccph
, *dh
;
3505 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
3509 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
3513 ad
->u
.net
.sport
= dh
->dccph_sport
;
3514 ad
->u
.net
.dport
= dh
->dccph_dport
;
3525 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3527 /* Returns error only if unable to parse addresses */
3528 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
,
3529 struct common_audit_data
*ad
, u8
*proto
)
3532 int ret
= -EINVAL
, offset
;
3533 struct ipv6hdr _ipv6h
, *ip6
;
3535 offset
= skb_network_offset(skb
);
3536 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
3540 ipv6_addr_copy(&ad
->u
.net
.v6info
.saddr
, &ip6
->saddr
);
3541 ipv6_addr_copy(&ad
->u
.net
.v6info
.daddr
, &ip6
->daddr
);
3544 nexthdr
= ip6
->nexthdr
;
3545 offset
+= sizeof(_ipv6h
);
3546 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
);
3555 struct tcphdr _tcph
, *th
;
3557 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
3561 ad
->u
.net
.sport
= th
->source
;
3562 ad
->u
.net
.dport
= th
->dest
;
3567 struct udphdr _udph
, *uh
;
3569 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
3573 ad
->u
.net
.sport
= uh
->source
;
3574 ad
->u
.net
.dport
= uh
->dest
;
3578 case IPPROTO_DCCP
: {
3579 struct dccp_hdr _dccph
, *dh
;
3581 dh
= skb_header_pointer(skb
, offset
, sizeof(_dccph
), &_dccph
);
3585 ad
->u
.net
.sport
= dh
->dccph_sport
;
3586 ad
->u
.net
.dport
= dh
->dccph_dport
;
3590 /* includes fragments */
3600 static int selinux_parse_skb(struct sk_buff
*skb
, struct common_audit_data
*ad
,
3601 char **_addrp
, int src
, u8
*proto
)
3606 switch (ad
->u
.net
.family
) {
3608 ret
= selinux_parse_skb_ipv4(skb
, ad
, proto
);
3611 addrp
= (char *)(src
? &ad
->u
.net
.v4info
.saddr
:
3612 &ad
->u
.net
.v4info
.daddr
);
3615 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3617 ret
= selinux_parse_skb_ipv6(skb
, ad
, proto
);
3620 addrp
= (char *)(src
? &ad
->u
.net
.v6info
.saddr
:
3621 &ad
->u
.net
.v6info
.daddr
);
3631 "SELinux: failure in selinux_parse_skb(),"
3632 " unable to parse packet\n");
3642 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3644 * @family: protocol family
3645 * @sid: the packet's peer label SID
3648 * Check the various different forms of network peer labeling and determine
3649 * the peer label/SID for the packet; most of the magic actually occurs in
3650 * the security server function security_net_peersid_cmp(). The function
3651 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3652 * or -EACCES if @sid is invalid due to inconsistencies with the different
3656 static int selinux_skb_peerlbl_sid(struct sk_buff
*skb
, u16 family
, u32
*sid
)
3663 selinux_skb_xfrm_sid(skb
, &xfrm_sid
);
3664 selinux_netlbl_skbuff_getsid(skb
, family
, &nlbl_type
, &nlbl_sid
);
3666 err
= security_net_peersid_resolve(nlbl_sid
, nlbl_type
, xfrm_sid
, sid
);
3667 if (unlikely(err
)) {
3669 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3670 " unable to determine packet's peer label\n");
3677 /* socket security operations */
3678 static int socket_has_perm(struct task_struct
*task
, struct socket
*sock
,
3681 struct inode_security_struct
*isec
;
3682 struct common_audit_data ad
;
3686 isec
= SOCK_INODE(sock
)->i_security
;
3688 if (isec
->sid
== SECINITSID_KERNEL
)
3690 sid
= task_sid(task
);
3692 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
3693 ad
.u
.net
.sk
= sock
->sk
;
3694 err
= avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3700 static int selinux_socket_create(int family
, int type
,
3701 int protocol
, int kern
)
3703 const struct cred
*cred
= current_cred();
3704 const struct task_security_struct
*tsec
= cred
->security
;
3713 newsid
= tsec
->sockcreate_sid
?: sid
;
3715 secclass
= socket_type_to_security_class(family
, type
, protocol
);
3716 err
= avc_has_perm(sid
, newsid
, secclass
, SOCKET__CREATE
, NULL
);
3722 static int selinux_socket_post_create(struct socket
*sock
, int family
,
3723 int type
, int protocol
, int kern
)
3725 const struct cred
*cred
= current_cred();
3726 const struct task_security_struct
*tsec
= cred
->security
;
3727 struct inode_security_struct
*isec
;
3728 struct sk_security_struct
*sksec
;
3733 newsid
= tsec
->sockcreate_sid
;
3735 isec
= SOCK_INODE(sock
)->i_security
;
3738 isec
->sid
= SECINITSID_KERNEL
;
3744 isec
->sclass
= socket_type_to_security_class(family
, type
, protocol
);
3745 isec
->initialized
= 1;
3748 sksec
= sock
->sk
->sk_security
;
3749 sksec
->sid
= isec
->sid
;
3750 sksec
->sclass
= isec
->sclass
;
3751 err
= selinux_netlbl_socket_post_create(sock
->sk
, family
);
3757 /* Range of port numbers used to automatically bind.
3758 Need to determine whether we should perform a name_bind
3759 permission check between the socket and the port number. */
3761 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3766 err
= socket_has_perm(current
, sock
, SOCKET__BIND
);
3771 * If PF_INET or PF_INET6, check name_bind permission for the port.
3772 * Multiple address binding for SCTP is not supported yet: we just
3773 * check the first address now.
3775 family
= sock
->sk
->sk_family
;
3776 if (family
== PF_INET
|| family
== PF_INET6
) {
3778 struct inode_security_struct
*isec
;
3779 struct common_audit_data ad
;
3780 struct sockaddr_in
*addr4
= NULL
;
3781 struct sockaddr_in6
*addr6
= NULL
;
3782 unsigned short snum
;
3783 struct sock
*sk
= sock
->sk
;
3786 isec
= SOCK_INODE(sock
)->i_security
;
3788 if (family
== PF_INET
) {
3789 addr4
= (struct sockaddr_in
*)address
;
3790 snum
= ntohs(addr4
->sin_port
);
3791 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
3793 addr6
= (struct sockaddr_in6
*)address
;
3794 snum
= ntohs(addr6
->sin6_port
);
3795 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
3801 inet_get_local_port_range(&low
, &high
);
3803 if (snum
< max(PROT_SOCK
, low
) || snum
> high
) {
3804 err
= sel_netport_sid(sk
->sk_protocol
,
3808 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
3809 ad
.u
.net
.sport
= htons(snum
);
3810 ad
.u
.net
.family
= family
;
3811 err
= avc_has_perm(isec
->sid
, sid
,
3813 SOCKET__NAME_BIND
, &ad
);
3819 switch (isec
->sclass
) {
3820 case SECCLASS_TCP_SOCKET
:
3821 node_perm
= TCP_SOCKET__NODE_BIND
;
3824 case SECCLASS_UDP_SOCKET
:
3825 node_perm
= UDP_SOCKET__NODE_BIND
;
3828 case SECCLASS_DCCP_SOCKET
:
3829 node_perm
= DCCP_SOCKET__NODE_BIND
;
3833 node_perm
= RAWIP_SOCKET__NODE_BIND
;
3837 err
= sel_netnode_sid(addrp
, family
, &sid
);
3841 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
3842 ad
.u
.net
.sport
= htons(snum
);
3843 ad
.u
.net
.family
= family
;
3845 if (family
== PF_INET
)
3846 ad
.u
.net
.v4info
.saddr
= addr4
->sin_addr
.s_addr
;
3848 ipv6_addr_copy(&ad
.u
.net
.v6info
.saddr
, &addr6
->sin6_addr
);
3850 err
= avc_has_perm(isec
->sid
, sid
,
3851 isec
->sclass
, node_perm
, &ad
);
3859 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3861 struct sock
*sk
= sock
->sk
;
3862 struct inode_security_struct
*isec
;
3865 err
= socket_has_perm(current
, sock
, SOCKET__CONNECT
);
3870 * If a TCP or DCCP socket, check name_connect permission for the port.
3872 isec
= SOCK_INODE(sock
)->i_security
;
3873 if (isec
->sclass
== SECCLASS_TCP_SOCKET
||
3874 isec
->sclass
== SECCLASS_DCCP_SOCKET
) {
3875 struct common_audit_data ad
;
3876 struct sockaddr_in
*addr4
= NULL
;
3877 struct sockaddr_in6
*addr6
= NULL
;
3878 unsigned short snum
;
3881 if (sk
->sk_family
== PF_INET
) {
3882 addr4
= (struct sockaddr_in
*)address
;
3883 if (addrlen
< sizeof(struct sockaddr_in
))
3885 snum
= ntohs(addr4
->sin_port
);
3887 addr6
= (struct sockaddr_in6
*)address
;
3888 if (addrlen
< SIN6_LEN_RFC2133
)
3890 snum
= ntohs(addr6
->sin6_port
);
3893 err
= sel_netport_sid(sk
->sk_protocol
, snum
, &sid
);
3897 perm
= (isec
->sclass
== SECCLASS_TCP_SOCKET
) ?
3898 TCP_SOCKET__NAME_CONNECT
: DCCP_SOCKET__NAME_CONNECT
;
3900 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
3901 ad
.u
.net
.dport
= htons(snum
);
3902 ad
.u
.net
.family
= sk
->sk_family
;
3903 err
= avc_has_perm(isec
->sid
, sid
, isec
->sclass
, perm
, &ad
);
3908 err
= selinux_netlbl_socket_connect(sk
, address
);
3914 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
3916 return socket_has_perm(current
, sock
, SOCKET__LISTEN
);
3919 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
3922 struct inode_security_struct
*isec
;
3923 struct inode_security_struct
*newisec
;
3925 err
= socket_has_perm(current
, sock
, SOCKET__ACCEPT
);
3929 newisec
= SOCK_INODE(newsock
)->i_security
;
3931 isec
= SOCK_INODE(sock
)->i_security
;
3932 newisec
->sclass
= isec
->sclass
;
3933 newisec
->sid
= isec
->sid
;
3934 newisec
->initialized
= 1;
3939 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
3942 return socket_has_perm(current
, sock
, SOCKET__WRITE
);
3945 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
3946 int size
, int flags
)
3948 return socket_has_perm(current
, sock
, SOCKET__READ
);
3951 static int selinux_socket_getsockname(struct socket
*sock
)
3953 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3956 static int selinux_socket_getpeername(struct socket
*sock
)
3958 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3961 static int selinux_socket_setsockopt(struct socket
*sock
, int level
, int optname
)
3965 err
= socket_has_perm(current
, sock
, SOCKET__SETOPT
);
3969 return selinux_netlbl_socket_setsockopt(sock
, level
, optname
);
3972 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
3975 return socket_has_perm(current
, sock
, SOCKET__GETOPT
);
3978 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
3980 return socket_has_perm(current
, sock
, SOCKET__SHUTDOWN
);
3983 static int selinux_socket_unix_stream_connect(struct socket
*sock
,
3984 struct socket
*other
,
3987 struct sk_security_struct
*sksec
;
3988 struct inode_security_struct
*isec
;
3989 struct inode_security_struct
*other_isec
;
3990 struct common_audit_data ad
;
3993 isec
= SOCK_INODE(sock
)->i_security
;
3994 other_isec
= SOCK_INODE(other
)->i_security
;
3996 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
3997 ad
.u
.net
.sk
= other
->sk
;
3999 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
4001 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
4005 /* connecting socket */
4006 sksec
= sock
->sk
->sk_security
;
4007 sksec
->peer_sid
= other_isec
->sid
;
4009 /* server child socket */
4010 sksec
= newsk
->sk_security
;
4011 sksec
->peer_sid
= isec
->sid
;
4012 err
= security_sid_mls_copy(other_isec
->sid
, sksec
->peer_sid
, &sksec
->sid
);
4017 static int selinux_socket_unix_may_send(struct socket
*sock
,
4018 struct socket
*other
)
4020 struct inode_security_struct
*isec
;
4021 struct inode_security_struct
*other_isec
;
4022 struct common_audit_data ad
;
4025 isec
= SOCK_INODE(sock
)->i_security
;
4026 other_isec
= SOCK_INODE(other
)->i_security
;
4028 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
4029 ad
.u
.net
.sk
= other
->sk
;
4031 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
4032 isec
->sclass
, SOCKET__SENDTO
, &ad
);
4039 static int selinux_inet_sys_rcv_skb(int ifindex
, char *addrp
, u16 family
,
4041 struct common_audit_data
*ad
)
4047 err
= sel_netif_sid(ifindex
, &if_sid
);
4050 err
= avc_has_perm(peer_sid
, if_sid
,
4051 SECCLASS_NETIF
, NETIF__INGRESS
, ad
);
4055 err
= sel_netnode_sid(addrp
, family
, &node_sid
);
4058 return avc_has_perm(peer_sid
, node_sid
,
4059 SECCLASS_NODE
, NODE__RECVFROM
, ad
);
4062 static int selinux_sock_rcv_skb_compat(struct sock
*sk
, struct sk_buff
*skb
,
4066 struct sk_security_struct
*sksec
= sk
->sk_security
;
4068 u32 sk_sid
= sksec
->sid
;
4069 struct common_audit_data ad
;
4072 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
4073 ad
.u
.net
.netif
= skb
->skb_iif
;
4074 ad
.u
.net
.family
= family
;
4075 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4079 if (selinux_secmark_enabled()) {
4080 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4086 if (selinux_policycap_netpeer
) {
4087 err
= selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
);
4090 err
= avc_has_perm(sk_sid
, peer_sid
,
4091 SECCLASS_PEER
, PEER__RECV
, &ad
);
4093 selinux_netlbl_err(skb
, err
, 0);
4095 err
= selinux_netlbl_sock_rcv_skb(sksec
, skb
, family
, &ad
);
4098 err
= selinux_xfrm_sock_rcv_skb(sksec
->sid
, skb
, &ad
);
4104 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
4107 struct sk_security_struct
*sksec
= sk
->sk_security
;
4108 u16 family
= sk
->sk_family
;
4109 u32 sk_sid
= sksec
->sid
;
4110 struct common_audit_data ad
;
4115 if (family
!= PF_INET
&& family
!= PF_INET6
)
4118 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4119 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4122 /* If any sort of compatibility mode is enabled then handoff processing
4123 * to the selinux_sock_rcv_skb_compat() function to deal with the
4124 * special handling. We do this in an attempt to keep this function
4125 * as fast and as clean as possible. */
4126 if (!selinux_policycap_netpeer
)
4127 return selinux_sock_rcv_skb_compat(sk
, skb
, family
);
4129 secmark_active
= selinux_secmark_enabled();
4130 peerlbl_active
= netlbl_enabled() || selinux_xfrm_enabled();
4131 if (!secmark_active
&& !peerlbl_active
)
4134 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
4135 ad
.u
.net
.netif
= skb
->skb_iif
;
4136 ad
.u
.net
.family
= family
;
4137 err
= selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
);
4141 if (peerlbl_active
) {
4144 err
= selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
);
4147 err
= selinux_inet_sys_rcv_skb(skb
->skb_iif
, addrp
, family
,
4150 selinux_netlbl_err(skb
, err
, 0);
4153 err
= avc_has_perm(sk_sid
, peer_sid
, SECCLASS_PEER
,
4156 selinux_netlbl_err(skb
, err
, 0);
4159 if (secmark_active
) {
4160 err
= avc_has_perm(sk_sid
, skb
->secmark
, SECCLASS_PACKET
,
4169 static int selinux_socket_getpeersec_stream(struct socket
*sock
, char __user
*optval
,
4170 int __user
*optlen
, unsigned len
)
4175 struct sk_security_struct
*sksec
;
4176 struct inode_security_struct
*isec
;
4177 u32 peer_sid
= SECSID_NULL
;
4179 isec
= SOCK_INODE(sock
)->i_security
;
4181 if (isec
->sclass
== SECCLASS_UNIX_STREAM_SOCKET
||
4182 isec
->sclass
== SECCLASS_TCP_SOCKET
) {
4183 sksec
= sock
->sk
->sk_security
;
4184 peer_sid
= sksec
->peer_sid
;
4186 if (peer_sid
== SECSID_NULL
) {
4191 err
= security_sid_to_context(peer_sid
, &scontext
, &scontext_len
);
4196 if (scontext_len
> len
) {
4201 if (copy_to_user(optval
, scontext
, scontext_len
))
4205 if (put_user(scontext_len
, optlen
))
4213 static int selinux_socket_getpeersec_dgram(struct socket
*sock
, struct sk_buff
*skb
, u32
*secid
)
4215 u32 peer_secid
= SECSID_NULL
;
4218 if (skb
&& skb
->protocol
== htons(ETH_P_IP
))
4220 else if (skb
&& skb
->protocol
== htons(ETH_P_IPV6
))
4223 family
= sock
->sk
->sk_family
;
4227 if (sock
&& family
== PF_UNIX
)
4228 selinux_inode_getsecid(SOCK_INODE(sock
), &peer_secid
);
4230 selinux_skb_peerlbl_sid(skb
, family
, &peer_secid
);
4233 *secid
= peer_secid
;
4234 if (peer_secid
== SECSID_NULL
)
4239 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
4241 return sk_alloc_security(sk
, family
, priority
);
4244 static void selinux_sk_free_security(struct sock
*sk
)
4246 sk_free_security(sk
);
4249 static void selinux_sk_clone_security(const struct sock
*sk
, struct sock
*newsk
)
4251 struct sk_security_struct
*sksec
= sk
->sk_security
;
4252 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4254 newsksec
->sid
= sksec
->sid
;
4255 newsksec
->peer_sid
= sksec
->peer_sid
;
4256 newsksec
->sclass
= sksec
->sclass
;
4258 selinux_netlbl_sk_security_reset(newsksec
);
4261 static void selinux_sk_getsecid(struct sock
*sk
, u32
*secid
)
4264 *secid
= SECINITSID_ANY_SOCKET
;
4266 struct sk_security_struct
*sksec
= sk
->sk_security
;
4268 *secid
= sksec
->sid
;
4272 static void selinux_sock_graft(struct sock
*sk
, struct socket
*parent
)
4274 struct inode_security_struct
*isec
= SOCK_INODE(parent
)->i_security
;
4275 struct sk_security_struct
*sksec
= sk
->sk_security
;
4277 if (sk
->sk_family
== PF_INET
|| sk
->sk_family
== PF_INET6
||
4278 sk
->sk_family
== PF_UNIX
)
4279 isec
->sid
= sksec
->sid
;
4280 sksec
->sclass
= isec
->sclass
;
4283 static int selinux_inet_conn_request(struct sock
*sk
, struct sk_buff
*skb
,
4284 struct request_sock
*req
)
4286 struct sk_security_struct
*sksec
= sk
->sk_security
;
4288 u16 family
= sk
->sk_family
;
4292 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4293 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4296 err
= selinux_skb_peerlbl_sid(skb
, family
, &peersid
);
4299 if (peersid
== SECSID_NULL
) {
4300 req
->secid
= sksec
->sid
;
4301 req
->peer_secid
= SECSID_NULL
;
4303 err
= security_sid_mls_copy(sksec
->sid
, peersid
, &newsid
);
4306 req
->secid
= newsid
;
4307 req
->peer_secid
= peersid
;
4310 return selinux_netlbl_inet_conn_request(req
, family
);
4313 static void selinux_inet_csk_clone(struct sock
*newsk
,
4314 const struct request_sock
*req
)
4316 struct sk_security_struct
*newsksec
= newsk
->sk_security
;
4318 newsksec
->sid
= req
->secid
;
4319 newsksec
->peer_sid
= req
->peer_secid
;
4320 /* NOTE: Ideally, we should also get the isec->sid for the
4321 new socket in sync, but we don't have the isec available yet.
4322 So we will wait until sock_graft to do it, by which
4323 time it will have been created and available. */
4325 /* We don't need to take any sort of lock here as we are the only
4326 * thread with access to newsksec */
4327 selinux_netlbl_inet_csk_clone(newsk
, req
->rsk_ops
->family
);
4330 static void selinux_inet_conn_established(struct sock
*sk
, struct sk_buff
*skb
)
4332 u16 family
= sk
->sk_family
;
4333 struct sk_security_struct
*sksec
= sk
->sk_security
;
4335 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4336 if (family
== PF_INET6
&& skb
->protocol
== htons(ETH_P_IP
))
4339 selinux_skb_peerlbl_sid(skb
, family
, &sksec
->peer_sid
);
4342 static void selinux_req_classify_flow(const struct request_sock
*req
,
4345 fl
->secid
= req
->secid
;
4348 static int selinux_tun_dev_create(void)
4350 u32 sid
= current_sid();
4352 /* we aren't taking into account the "sockcreate" SID since the socket
4353 * that is being created here is not a socket in the traditional sense,
4354 * instead it is a private sock, accessible only to the kernel, and
4355 * representing a wide range of network traffic spanning multiple
4356 * connections unlike traditional sockets - check the TUN driver to
4357 * get a better understanding of why this socket is special */
4359 return avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
, TUN_SOCKET__CREATE
,
4363 static void selinux_tun_dev_post_create(struct sock
*sk
)
4365 struct sk_security_struct
*sksec
= sk
->sk_security
;
4367 /* we don't currently perform any NetLabel based labeling here and it
4368 * isn't clear that we would want to do so anyway; while we could apply
4369 * labeling without the support of the TUN user the resulting labeled
4370 * traffic from the other end of the connection would almost certainly
4371 * cause confusion to the TUN user that had no idea network labeling
4372 * protocols were being used */
4374 /* see the comments in selinux_tun_dev_create() about why we don't use
4375 * the sockcreate SID here */
4377 sksec
->sid
= current_sid();
4378 sksec
->sclass
= SECCLASS_TUN_SOCKET
;
4381 static int selinux_tun_dev_attach(struct sock
*sk
)
4383 struct sk_security_struct
*sksec
= sk
->sk_security
;
4384 u32 sid
= current_sid();
4387 err
= avc_has_perm(sid
, sksec
->sid
, SECCLASS_TUN_SOCKET
,
4388 TUN_SOCKET__RELABELFROM
, NULL
);
4391 err
= avc_has_perm(sid
, sid
, SECCLASS_TUN_SOCKET
,
4392 TUN_SOCKET__RELABELTO
, NULL
);
4401 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
4405 struct nlmsghdr
*nlh
;
4406 struct socket
*sock
= sk
->sk_socket
;
4407 struct inode_security_struct
*isec
= SOCK_INODE(sock
)->i_security
;
4409 if (skb
->len
< NLMSG_SPACE(0)) {
4413 nlh
= nlmsg_hdr(skb
);
4415 err
= selinux_nlmsg_lookup(isec
->sclass
, nlh
->nlmsg_type
, &perm
);
4417 if (err
== -EINVAL
) {
4418 audit_log(current
->audit_context
, GFP_KERNEL
, AUDIT_SELINUX_ERR
,
4419 "SELinux: unrecognized netlink message"
4420 " type=%hu for sclass=%hu\n",
4421 nlh
->nlmsg_type
, isec
->sclass
);
4422 if (!selinux_enforcing
|| security_get_allow_unknown())
4432 err
= socket_has_perm(current
, sock
, perm
);
4437 #ifdef CONFIG_NETFILTER
4439 static unsigned int selinux_ip_forward(struct sk_buff
*skb
, int ifindex
,
4445 struct common_audit_data ad
;
4450 if (!selinux_policycap_netpeer
)
4453 secmark_active
= selinux_secmark_enabled();
4454 netlbl_active
= netlbl_enabled();
4455 peerlbl_active
= netlbl_active
|| selinux_xfrm_enabled();
4456 if (!secmark_active
&& !peerlbl_active
)
4459 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
) != 0)
4462 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
4463 ad
.u
.net
.netif
= ifindex
;
4464 ad
.u
.net
.family
= family
;
4465 if (selinux_parse_skb(skb
, &ad
, &addrp
, 1, NULL
) != 0)
4468 if (peerlbl_active
) {
4469 err
= selinux_inet_sys_rcv_skb(ifindex
, addrp
, family
,
4472 selinux_netlbl_err(skb
, err
, 1);
4478 if (avc_has_perm(peer_sid
, skb
->secmark
,
4479 SECCLASS_PACKET
, PACKET__FORWARD_IN
, &ad
))
4483 /* we do this in the FORWARD path and not the POST_ROUTING
4484 * path because we want to make sure we apply the necessary
4485 * labeling before IPsec is applied so we can leverage AH
4487 if (selinux_netlbl_skbuff_setsid(skb
, family
, peer_sid
) != 0)
4493 static unsigned int selinux_ipv4_forward(unsigned int hooknum
,
4494 struct sk_buff
*skb
,
4495 const struct net_device
*in
,
4496 const struct net_device
*out
,
4497 int (*okfn
)(struct sk_buff
*))
4499 return selinux_ip_forward(skb
, in
->ifindex
, PF_INET
);
4502 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4503 static unsigned int selinux_ipv6_forward(unsigned int hooknum
,
4504 struct sk_buff
*skb
,
4505 const struct net_device
*in
,
4506 const struct net_device
*out
,
4507 int (*okfn
)(struct sk_buff
*))
4509 return selinux_ip_forward(skb
, in
->ifindex
, PF_INET6
);
4513 static unsigned int selinux_ip_output(struct sk_buff
*skb
,
4518 if (!netlbl_enabled())
4521 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4522 * because we want to make sure we apply the necessary labeling
4523 * before IPsec is applied so we can leverage AH protection */
4525 struct sk_security_struct
*sksec
= skb
->sk
->sk_security
;
4528 sid
= SECINITSID_KERNEL
;
4529 if (selinux_netlbl_skbuff_setsid(skb
, family
, sid
) != 0)
4535 static unsigned int selinux_ipv4_output(unsigned int hooknum
,
4536 struct sk_buff
*skb
,
4537 const struct net_device
*in
,
4538 const struct net_device
*out
,
4539 int (*okfn
)(struct sk_buff
*))
4541 return selinux_ip_output(skb
, PF_INET
);
4544 static unsigned int selinux_ip_postroute_compat(struct sk_buff
*skb
,
4548 struct sock
*sk
= skb
->sk
;
4549 struct sk_security_struct
*sksec
;
4550 struct common_audit_data ad
;
4556 sksec
= sk
->sk_security
;
4558 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
4559 ad
.u
.net
.netif
= ifindex
;
4560 ad
.u
.net
.family
= family
;
4561 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, &proto
))
4564 if (selinux_secmark_enabled())
4565 if (avc_has_perm(sksec
->sid
, skb
->secmark
,
4566 SECCLASS_PACKET
, PACKET__SEND
, &ad
))
4569 if (selinux_policycap_netpeer
)
4570 if (selinux_xfrm_postroute_last(sksec
->sid
, skb
, &ad
, proto
))
4576 static unsigned int selinux_ip_postroute(struct sk_buff
*skb
, int ifindex
,
4582 struct common_audit_data ad
;
4587 /* If any sort of compatibility mode is enabled then handoff processing
4588 * to the selinux_ip_postroute_compat() function to deal with the
4589 * special handling. We do this in an attempt to keep this function
4590 * as fast and as clean as possible. */
4591 if (!selinux_policycap_netpeer
)
4592 return selinux_ip_postroute_compat(skb
, ifindex
, family
);
4594 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4595 * packet transformation so allow the packet to pass without any checks
4596 * since we'll have another chance to perform access control checks
4597 * when the packet is on it's final way out.
4598 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4599 * is NULL, in this case go ahead and apply access control. */
4600 if (skb_dst(skb
) != NULL
&& skb_dst(skb
)->xfrm
!= NULL
)
4603 secmark_active
= selinux_secmark_enabled();
4604 peerlbl_active
= netlbl_enabled() || selinux_xfrm_enabled();
4605 if (!secmark_active
&& !peerlbl_active
)
4608 /* if the packet is being forwarded then get the peer label from the
4609 * packet itself; otherwise check to see if it is from a local
4610 * application or the kernel, if from an application get the peer label
4611 * from the sending socket, otherwise use the kernel's sid */
4616 if (IPCB(skb
)->flags
& IPSKB_FORWARDED
)
4617 secmark_perm
= PACKET__FORWARD_OUT
;
4619 secmark_perm
= PACKET__SEND
;
4622 if (IP6CB(skb
)->flags
& IP6SKB_FORWARDED
)
4623 secmark_perm
= PACKET__FORWARD_OUT
;
4625 secmark_perm
= PACKET__SEND
;
4630 if (secmark_perm
== PACKET__FORWARD_OUT
) {
4631 if (selinux_skb_peerlbl_sid(skb
, family
, &peer_sid
))
4634 peer_sid
= SECINITSID_KERNEL
;
4636 struct sk_security_struct
*sksec
= sk
->sk_security
;
4637 peer_sid
= sksec
->sid
;
4638 secmark_perm
= PACKET__SEND
;
4641 COMMON_AUDIT_DATA_INIT(&ad
, NET
);
4642 ad
.u
.net
.netif
= ifindex
;
4643 ad
.u
.net
.family
= family
;
4644 if (selinux_parse_skb(skb
, &ad
, &addrp
, 0, NULL
))
4648 if (avc_has_perm(peer_sid
, skb
->secmark
,
4649 SECCLASS_PACKET
, secmark_perm
, &ad
))
4652 if (peerlbl_active
) {
4656 if (sel_netif_sid(ifindex
, &if_sid
))
4658 if (avc_has_perm(peer_sid
, if_sid
,
4659 SECCLASS_NETIF
, NETIF__EGRESS
, &ad
))
4662 if (sel_netnode_sid(addrp
, family
, &node_sid
))
4664 if (avc_has_perm(peer_sid
, node_sid
,
4665 SECCLASS_NODE
, NODE__SENDTO
, &ad
))
4672 static unsigned int selinux_ipv4_postroute(unsigned int hooknum
,
4673 struct sk_buff
*skb
,
4674 const struct net_device
*in
,
4675 const struct net_device
*out
,
4676 int (*okfn
)(struct sk_buff
*))
4678 return selinux_ip_postroute(skb
, out
->ifindex
, PF_INET
);
4681 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4682 static unsigned int selinux_ipv6_postroute(unsigned int hooknum
,
4683 struct sk_buff
*skb
,
4684 const struct net_device
*in
,
4685 const struct net_device
*out
,
4686 int (*okfn
)(struct sk_buff
*))
4688 return selinux_ip_postroute(skb
, out
->ifindex
, PF_INET6
);
4692 #endif /* CONFIG_NETFILTER */
4694 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
4698 err
= cap_netlink_send(sk
, skb
);
4702 return selinux_nlmsg_perm(sk
, skb
);
4705 static int selinux_netlink_recv(struct sk_buff
*skb
, int capability
)
4708 struct common_audit_data ad
;
4710 err
= cap_netlink_recv(skb
, capability
);
4714 COMMON_AUDIT_DATA_INIT(&ad
, CAP
);
4715 ad
.u
.cap
= capability
;
4717 return avc_has_perm(NETLINK_CB(skb
).sid
, NETLINK_CB(skb
).sid
,
4718 SECCLASS_CAPABILITY
, CAP_TO_MASK(capability
), &ad
);
4721 static int ipc_alloc_security(struct task_struct
*task
,
4722 struct kern_ipc_perm
*perm
,
4725 struct ipc_security_struct
*isec
;
4728 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
4732 sid
= task_sid(task
);
4733 isec
->sclass
= sclass
;
4735 perm
->security
= isec
;
4740 static void ipc_free_security(struct kern_ipc_perm
*perm
)
4742 struct ipc_security_struct
*isec
= perm
->security
;
4743 perm
->security
= NULL
;
4747 static int msg_msg_alloc_security(struct msg_msg
*msg
)
4749 struct msg_security_struct
*msec
;
4751 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
4755 msec
->sid
= SECINITSID_UNLABELED
;
4756 msg
->security
= msec
;
4761 static void msg_msg_free_security(struct msg_msg
*msg
)
4763 struct msg_security_struct
*msec
= msg
->security
;
4765 msg
->security
= NULL
;
4769 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
4772 struct ipc_security_struct
*isec
;
4773 struct common_audit_data ad
;
4774 u32 sid
= current_sid();
4776 isec
= ipc_perms
->security
;
4778 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4779 ad
.u
.ipc_id
= ipc_perms
->key
;
4781 return avc_has_perm(sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
4784 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
4786 return msg_msg_alloc_security(msg
);
4789 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
4791 msg_msg_free_security(msg
);
4794 /* message queue security operations */
4795 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
4797 struct ipc_security_struct
*isec
;
4798 struct common_audit_data ad
;
4799 u32 sid
= current_sid();
4802 rc
= ipc_alloc_security(current
, &msq
->q_perm
, SECCLASS_MSGQ
);
4806 isec
= msq
->q_perm
.security
;
4808 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4809 ad
.u
.ipc_id
= msq
->q_perm
.key
;
4811 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
4814 ipc_free_security(&msq
->q_perm
);
4820 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
4822 ipc_free_security(&msq
->q_perm
);
4825 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
4827 struct ipc_security_struct
*isec
;
4828 struct common_audit_data ad
;
4829 u32 sid
= current_sid();
4831 isec
= msq
->q_perm
.security
;
4833 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4834 ad
.u
.ipc_id
= msq
->q_perm
.key
;
4836 return avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
4837 MSGQ__ASSOCIATE
, &ad
);
4840 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
4848 /* No specific object, just general system-wide information. */
4849 return task_has_system(current
, SYSTEM__IPC_INFO
);
4852 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
4855 perms
= MSGQ__SETATTR
;
4858 perms
= MSGQ__DESTROY
;
4864 err
= ipc_has_perm(&msq
->q_perm
, perms
);
4868 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
4870 struct ipc_security_struct
*isec
;
4871 struct msg_security_struct
*msec
;
4872 struct common_audit_data ad
;
4873 u32 sid
= current_sid();
4876 isec
= msq
->q_perm
.security
;
4877 msec
= msg
->security
;
4880 * First time through, need to assign label to the message
4882 if (msec
->sid
== SECINITSID_UNLABELED
) {
4884 * Compute new sid based on current process and
4885 * message queue this message will be stored in
4887 rc
= security_transition_sid(sid
, isec
->sid
, SECCLASS_MSG
,
4893 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4894 ad
.u
.ipc_id
= msq
->q_perm
.key
;
4896 /* Can this process write to the queue? */
4897 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_MSGQ
,
4900 /* Can this process send the message */
4901 rc
= avc_has_perm(sid
, msec
->sid
, SECCLASS_MSG
,
4904 /* Can the message be put in the queue? */
4905 rc
= avc_has_perm(msec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
4906 MSGQ__ENQUEUE
, &ad
);
4911 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
4912 struct task_struct
*target
,
4913 long type
, int mode
)
4915 struct ipc_security_struct
*isec
;
4916 struct msg_security_struct
*msec
;
4917 struct common_audit_data ad
;
4918 u32 sid
= task_sid(target
);
4921 isec
= msq
->q_perm
.security
;
4922 msec
= msg
->security
;
4924 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4925 ad
.u
.ipc_id
= msq
->q_perm
.key
;
4927 rc
= avc_has_perm(sid
, isec
->sid
,
4928 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
4930 rc
= avc_has_perm(sid
, msec
->sid
,
4931 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
4935 /* Shared Memory security operations */
4936 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
4938 struct ipc_security_struct
*isec
;
4939 struct common_audit_data ad
;
4940 u32 sid
= current_sid();
4943 rc
= ipc_alloc_security(current
, &shp
->shm_perm
, SECCLASS_SHM
);
4947 isec
= shp
->shm_perm
.security
;
4949 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4950 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
4952 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
4955 ipc_free_security(&shp
->shm_perm
);
4961 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
4963 ipc_free_security(&shp
->shm_perm
);
4966 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
4968 struct ipc_security_struct
*isec
;
4969 struct common_audit_data ad
;
4970 u32 sid
= current_sid();
4972 isec
= shp
->shm_perm
.security
;
4974 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
4975 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
4977 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SHM
,
4978 SHM__ASSOCIATE
, &ad
);
4981 /* Note, at this point, shp is locked down */
4982 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
4990 /* No specific object, just general system-wide information. */
4991 return task_has_system(current
, SYSTEM__IPC_INFO
);
4994 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
4997 perms
= SHM__SETATTR
;
5004 perms
= SHM__DESTROY
;
5010 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
5014 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
5015 char __user
*shmaddr
, int shmflg
)
5019 if (shmflg
& SHM_RDONLY
)
5022 perms
= SHM__READ
| SHM__WRITE
;
5024 return ipc_has_perm(&shp
->shm_perm
, perms
);
5027 /* Semaphore security operations */
5028 static int selinux_sem_alloc_security(struct sem_array
*sma
)
5030 struct ipc_security_struct
*isec
;
5031 struct common_audit_data ad
;
5032 u32 sid
= current_sid();
5035 rc
= ipc_alloc_security(current
, &sma
->sem_perm
, SECCLASS_SEM
);
5039 isec
= sma
->sem_perm
.security
;
5041 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
5042 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5044 rc
= avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5047 ipc_free_security(&sma
->sem_perm
);
5053 static void selinux_sem_free_security(struct sem_array
*sma
)
5055 ipc_free_security(&sma
->sem_perm
);
5058 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
5060 struct ipc_security_struct
*isec
;
5061 struct common_audit_data ad
;
5062 u32 sid
= current_sid();
5064 isec
= sma
->sem_perm
.security
;
5066 COMMON_AUDIT_DATA_INIT(&ad
, IPC
);
5067 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
5069 return avc_has_perm(sid
, isec
->sid
, SECCLASS_SEM
,
5070 SEM__ASSOCIATE
, &ad
);
5073 /* Note, at this point, sma is locked down */
5074 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
5082 /* No specific object, just general system-wide information. */
5083 return task_has_system(current
, SYSTEM__IPC_INFO
);
5087 perms
= SEM__GETATTR
;
5098 perms
= SEM__DESTROY
;
5101 perms
= SEM__SETATTR
;
5105 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
5111 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
5115 static int selinux_sem_semop(struct sem_array
*sma
,
5116 struct sembuf
*sops
, unsigned nsops
, int alter
)
5121 perms
= SEM__READ
| SEM__WRITE
;
5125 return ipc_has_perm(&sma
->sem_perm
, perms
);
5128 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
5134 av
|= IPC__UNIX_READ
;
5136 av
|= IPC__UNIX_WRITE
;
5141 return ipc_has_perm(ipcp
, av
);
5144 static void selinux_ipc_getsecid(struct kern_ipc_perm
*ipcp
, u32
*secid
)
5146 struct ipc_security_struct
*isec
= ipcp
->security
;
5150 static void selinux_d_instantiate(struct dentry
*dentry
, struct inode
*inode
)
5153 inode_doinit_with_dentry(inode
, dentry
);
5156 static int selinux_getprocattr(struct task_struct
*p
,
5157 char *name
, char **value
)
5159 const struct task_security_struct
*__tsec
;
5165 error
= current_has_perm(p
, PROCESS__GETATTR
);
5171 __tsec
= __task_cred(p
)->security
;
5173 if (!strcmp(name
, "current"))
5175 else if (!strcmp(name
, "prev"))
5177 else if (!strcmp(name
, "exec"))
5178 sid
= __tsec
->exec_sid
;
5179 else if (!strcmp(name
, "fscreate"))
5180 sid
= __tsec
->create_sid
;
5181 else if (!strcmp(name
, "keycreate"))
5182 sid
= __tsec
->keycreate_sid
;
5183 else if (!strcmp(name
, "sockcreate"))
5184 sid
= __tsec
->sockcreate_sid
;
5192 error
= security_sid_to_context(sid
, value
, &len
);
5202 static int selinux_setprocattr(struct task_struct
*p
,
5203 char *name
, void *value
, size_t size
)
5205 struct task_security_struct
*tsec
;
5206 struct task_struct
*tracer
;
5213 /* SELinux only allows a process to change its own
5214 security attributes. */
5219 * Basic control over ability to set these attributes at all.
5220 * current == p, but we'll pass them separately in case the
5221 * above restriction is ever removed.
5223 if (!strcmp(name
, "exec"))
5224 error
= current_has_perm(p
, PROCESS__SETEXEC
);
5225 else if (!strcmp(name
, "fscreate"))
5226 error
= current_has_perm(p
, PROCESS__SETFSCREATE
);
5227 else if (!strcmp(name
, "keycreate"))
5228 error
= current_has_perm(p
, PROCESS__SETKEYCREATE
);
5229 else if (!strcmp(name
, "sockcreate"))
5230 error
= current_has_perm(p
, PROCESS__SETSOCKCREATE
);
5231 else if (!strcmp(name
, "current"))
5232 error
= current_has_perm(p
, PROCESS__SETCURRENT
);
5238 /* Obtain a SID for the context, if one was specified. */
5239 if (size
&& str
[1] && str
[1] != '\n') {
5240 if (str
[size
-1] == '\n') {
5244 error
= security_context_to_sid(value
, size
, &sid
);
5245 if (error
== -EINVAL
&& !strcmp(name
, "fscreate")) {
5246 if (!capable(CAP_MAC_ADMIN
))
5248 error
= security_context_to_sid_force(value
, size
,
5255 new = prepare_creds();
5259 /* Permission checking based on the specified context is
5260 performed during the actual operation (execve,
5261 open/mkdir/...), when we know the full context of the
5262 operation. See selinux_bprm_set_creds for the execve
5263 checks and may_create for the file creation checks. The
5264 operation will then fail if the context is not permitted. */
5265 tsec
= new->security
;
5266 if (!strcmp(name
, "exec")) {
5267 tsec
->exec_sid
= sid
;
5268 } else if (!strcmp(name
, "fscreate")) {
5269 tsec
->create_sid
= sid
;
5270 } else if (!strcmp(name
, "keycreate")) {
5271 error
= may_create_key(sid
, p
);
5274 tsec
->keycreate_sid
= sid
;
5275 } else if (!strcmp(name
, "sockcreate")) {
5276 tsec
->sockcreate_sid
= sid
;
5277 } else if (!strcmp(name
, "current")) {
5282 /* Only allow single threaded processes to change context */
5284 if (!current_is_single_threaded()) {
5285 error
= security_bounded_transition(tsec
->sid
, sid
);
5290 /* Check permissions for the transition. */
5291 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
5292 PROCESS__DYNTRANSITION
, NULL
);
5296 /* Check for ptracing, and update the task SID if ok.
5297 Otherwise, leave SID unchanged and fail. */
5300 tracer
= tracehook_tracer_task(p
);
5302 ptsid
= task_sid(tracer
);
5306 error
= avc_has_perm(ptsid
, sid
, SECCLASS_PROCESS
,
5307 PROCESS__PTRACE
, NULL
);
5326 static int selinux_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
5328 return security_sid_to_context(secid
, secdata
, seclen
);
5331 static int selinux_secctx_to_secid(const char *secdata
, u32 seclen
, u32
*secid
)
5333 return security_context_to_sid(secdata
, seclen
, secid
);
5336 static void selinux_release_secctx(char *secdata
, u32 seclen
)
5342 * called with inode->i_mutex locked
5344 static int selinux_inode_notifysecctx(struct inode
*inode
, void *ctx
, u32 ctxlen
)
5346 return selinux_inode_setsecurity(inode
, XATTR_SELINUX_SUFFIX
, ctx
, ctxlen
, 0);
5350 * called with inode->i_mutex locked
5352 static int selinux_inode_setsecctx(struct dentry
*dentry
, void *ctx
, u32 ctxlen
)
5354 return __vfs_setxattr_noperm(dentry
, XATTR_NAME_SELINUX
, ctx
, ctxlen
, 0);
5357 static int selinux_inode_getsecctx(struct inode
*inode
, void **ctx
, u32
*ctxlen
)
5360 len
= selinux_inode_getsecurity(inode
, XATTR_SELINUX_SUFFIX
,
5369 static int selinux_key_alloc(struct key
*k
, const struct cred
*cred
,
5370 unsigned long flags
)
5372 const struct task_security_struct
*tsec
;
5373 struct key_security_struct
*ksec
;
5375 ksec
= kzalloc(sizeof(struct key_security_struct
), GFP_KERNEL
);
5379 tsec
= cred
->security
;
5380 if (tsec
->keycreate_sid
)
5381 ksec
->sid
= tsec
->keycreate_sid
;
5383 ksec
->sid
= tsec
->sid
;
5389 static void selinux_key_free(struct key
*k
)
5391 struct key_security_struct
*ksec
= k
->security
;
5397 static int selinux_key_permission(key_ref_t key_ref
,
5398 const struct cred
*cred
,
5402 struct key_security_struct
*ksec
;
5405 /* if no specific permissions are requested, we skip the
5406 permission check. No serious, additional covert channels
5407 appear to be created. */
5411 sid
= cred_sid(cred
);
5413 key
= key_ref_to_ptr(key_ref
);
5414 ksec
= key
->security
;
5416 return avc_has_perm(sid
, ksec
->sid
, SECCLASS_KEY
, perm
, NULL
);
5419 static int selinux_key_getsecurity(struct key
*key
, char **_buffer
)
5421 struct key_security_struct
*ksec
= key
->security
;
5422 char *context
= NULL
;
5426 rc
= security_sid_to_context(ksec
->sid
, &context
, &len
);
5435 static struct security_operations selinux_ops
= {
5438 .ptrace_access_check
= selinux_ptrace_access_check
,
5439 .ptrace_traceme
= selinux_ptrace_traceme
,
5440 .capget
= selinux_capget
,
5441 .capset
= selinux_capset
,
5442 .sysctl
= selinux_sysctl
,
5443 .capable
= selinux_capable
,
5444 .quotactl
= selinux_quotactl
,
5445 .quota_on
= selinux_quota_on
,
5446 .syslog
= selinux_syslog
,
5447 .vm_enough_memory
= selinux_vm_enough_memory
,
5449 .netlink_send
= selinux_netlink_send
,
5450 .netlink_recv
= selinux_netlink_recv
,
5452 .bprm_set_creds
= selinux_bprm_set_creds
,
5453 .bprm_committing_creds
= selinux_bprm_committing_creds
,
5454 .bprm_committed_creds
= selinux_bprm_committed_creds
,
5455 .bprm_secureexec
= selinux_bprm_secureexec
,
5457 .sb_alloc_security
= selinux_sb_alloc_security
,
5458 .sb_free_security
= selinux_sb_free_security
,
5459 .sb_copy_data
= selinux_sb_copy_data
,
5460 .sb_kern_mount
= selinux_sb_kern_mount
,
5461 .sb_show_options
= selinux_sb_show_options
,
5462 .sb_statfs
= selinux_sb_statfs
,
5463 .sb_mount
= selinux_mount
,
5464 .sb_umount
= selinux_umount
,
5465 .sb_set_mnt_opts
= selinux_set_mnt_opts
,
5466 .sb_clone_mnt_opts
= selinux_sb_clone_mnt_opts
,
5467 .sb_parse_opts_str
= selinux_parse_opts_str
,
5470 .inode_alloc_security
= selinux_inode_alloc_security
,
5471 .inode_free_security
= selinux_inode_free_security
,
5472 .inode_init_security
= selinux_inode_init_security
,
5473 .inode_create
= selinux_inode_create
,
5474 .inode_link
= selinux_inode_link
,
5475 .inode_unlink
= selinux_inode_unlink
,
5476 .inode_symlink
= selinux_inode_symlink
,
5477 .inode_mkdir
= selinux_inode_mkdir
,
5478 .inode_rmdir
= selinux_inode_rmdir
,
5479 .inode_mknod
= selinux_inode_mknod
,
5480 .inode_rename
= selinux_inode_rename
,
5481 .inode_readlink
= selinux_inode_readlink
,
5482 .inode_follow_link
= selinux_inode_follow_link
,
5483 .inode_permission
= selinux_inode_permission
,
5484 .inode_setattr
= selinux_inode_setattr
,
5485 .inode_getattr
= selinux_inode_getattr
,
5486 .inode_setxattr
= selinux_inode_setxattr
,
5487 .inode_post_setxattr
= selinux_inode_post_setxattr
,
5488 .inode_getxattr
= selinux_inode_getxattr
,
5489 .inode_listxattr
= selinux_inode_listxattr
,
5490 .inode_removexattr
= selinux_inode_removexattr
,
5491 .inode_getsecurity
= selinux_inode_getsecurity
,
5492 .inode_setsecurity
= selinux_inode_setsecurity
,
5493 .inode_listsecurity
= selinux_inode_listsecurity
,
5494 .inode_getsecid
= selinux_inode_getsecid
,
5496 .file_permission
= selinux_file_permission
,
5497 .file_alloc_security
= selinux_file_alloc_security
,
5498 .file_free_security
= selinux_file_free_security
,
5499 .file_ioctl
= selinux_file_ioctl
,
5500 .file_mmap
= selinux_file_mmap
,
5501 .file_mprotect
= selinux_file_mprotect
,
5502 .file_lock
= selinux_file_lock
,
5503 .file_fcntl
= selinux_file_fcntl
,
5504 .file_set_fowner
= selinux_file_set_fowner
,
5505 .file_send_sigiotask
= selinux_file_send_sigiotask
,
5506 .file_receive
= selinux_file_receive
,
5508 .dentry_open
= selinux_dentry_open
,
5510 .task_create
= selinux_task_create
,
5511 .cred_alloc_blank
= selinux_cred_alloc_blank
,
5512 .cred_free
= selinux_cred_free
,
5513 .cred_prepare
= selinux_cred_prepare
,
5514 .cred_transfer
= selinux_cred_transfer
,
5515 .kernel_act_as
= selinux_kernel_act_as
,
5516 .kernel_create_files_as
= selinux_kernel_create_files_as
,
5517 .kernel_module_request
= selinux_kernel_module_request
,
5518 .task_setpgid
= selinux_task_setpgid
,
5519 .task_getpgid
= selinux_task_getpgid
,
5520 .task_getsid
= selinux_task_getsid
,
5521 .task_getsecid
= selinux_task_getsecid
,
5522 .task_setnice
= selinux_task_setnice
,
5523 .task_setioprio
= selinux_task_setioprio
,
5524 .task_getioprio
= selinux_task_getioprio
,
5525 .task_setrlimit
= selinux_task_setrlimit
,
5526 .task_setscheduler
= selinux_task_setscheduler
,
5527 .task_getscheduler
= selinux_task_getscheduler
,
5528 .task_movememory
= selinux_task_movememory
,
5529 .task_kill
= selinux_task_kill
,
5530 .task_wait
= selinux_task_wait
,
5531 .task_to_inode
= selinux_task_to_inode
,
5533 .ipc_permission
= selinux_ipc_permission
,
5534 .ipc_getsecid
= selinux_ipc_getsecid
,
5536 .msg_msg_alloc_security
= selinux_msg_msg_alloc_security
,
5537 .msg_msg_free_security
= selinux_msg_msg_free_security
,
5539 .msg_queue_alloc_security
= selinux_msg_queue_alloc_security
,
5540 .msg_queue_free_security
= selinux_msg_queue_free_security
,
5541 .msg_queue_associate
= selinux_msg_queue_associate
,
5542 .msg_queue_msgctl
= selinux_msg_queue_msgctl
,
5543 .msg_queue_msgsnd
= selinux_msg_queue_msgsnd
,
5544 .msg_queue_msgrcv
= selinux_msg_queue_msgrcv
,
5546 .shm_alloc_security
= selinux_shm_alloc_security
,
5547 .shm_free_security
= selinux_shm_free_security
,
5548 .shm_associate
= selinux_shm_associate
,
5549 .shm_shmctl
= selinux_shm_shmctl
,
5550 .shm_shmat
= selinux_shm_shmat
,
5552 .sem_alloc_security
= selinux_sem_alloc_security
,
5553 .sem_free_security
= selinux_sem_free_security
,
5554 .sem_associate
= selinux_sem_associate
,
5555 .sem_semctl
= selinux_sem_semctl
,
5556 .sem_semop
= selinux_sem_semop
,
5558 .d_instantiate
= selinux_d_instantiate
,
5560 .getprocattr
= selinux_getprocattr
,
5561 .setprocattr
= selinux_setprocattr
,
5563 .secid_to_secctx
= selinux_secid_to_secctx
,
5564 .secctx_to_secid
= selinux_secctx_to_secid
,
5565 .release_secctx
= selinux_release_secctx
,
5566 .inode_notifysecctx
= selinux_inode_notifysecctx
,
5567 .inode_setsecctx
= selinux_inode_setsecctx
,
5568 .inode_getsecctx
= selinux_inode_getsecctx
,
5570 .unix_stream_connect
= selinux_socket_unix_stream_connect
,
5571 .unix_may_send
= selinux_socket_unix_may_send
,
5573 .socket_create
= selinux_socket_create
,
5574 .socket_post_create
= selinux_socket_post_create
,
5575 .socket_bind
= selinux_socket_bind
,
5576 .socket_connect
= selinux_socket_connect
,
5577 .socket_listen
= selinux_socket_listen
,
5578 .socket_accept
= selinux_socket_accept
,
5579 .socket_sendmsg
= selinux_socket_sendmsg
,
5580 .socket_recvmsg
= selinux_socket_recvmsg
,
5581 .socket_getsockname
= selinux_socket_getsockname
,
5582 .socket_getpeername
= selinux_socket_getpeername
,
5583 .socket_getsockopt
= selinux_socket_getsockopt
,
5584 .socket_setsockopt
= selinux_socket_setsockopt
,
5585 .socket_shutdown
= selinux_socket_shutdown
,
5586 .socket_sock_rcv_skb
= selinux_socket_sock_rcv_skb
,
5587 .socket_getpeersec_stream
= selinux_socket_getpeersec_stream
,
5588 .socket_getpeersec_dgram
= selinux_socket_getpeersec_dgram
,
5589 .sk_alloc_security
= selinux_sk_alloc_security
,
5590 .sk_free_security
= selinux_sk_free_security
,
5591 .sk_clone_security
= selinux_sk_clone_security
,
5592 .sk_getsecid
= selinux_sk_getsecid
,
5593 .sock_graft
= selinux_sock_graft
,
5594 .inet_conn_request
= selinux_inet_conn_request
,
5595 .inet_csk_clone
= selinux_inet_csk_clone
,
5596 .inet_conn_established
= selinux_inet_conn_established
,
5597 .req_classify_flow
= selinux_req_classify_flow
,
5598 .tun_dev_create
= selinux_tun_dev_create
,
5599 .tun_dev_post_create
= selinux_tun_dev_post_create
,
5600 .tun_dev_attach
= selinux_tun_dev_attach
,
5602 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5603 .xfrm_policy_alloc_security
= selinux_xfrm_policy_alloc
,
5604 .xfrm_policy_clone_security
= selinux_xfrm_policy_clone
,
5605 .xfrm_policy_free_security
= selinux_xfrm_policy_free
,
5606 .xfrm_policy_delete_security
= selinux_xfrm_policy_delete
,
5607 .xfrm_state_alloc_security
= selinux_xfrm_state_alloc
,
5608 .xfrm_state_free_security
= selinux_xfrm_state_free
,
5609 .xfrm_state_delete_security
= selinux_xfrm_state_delete
,
5610 .xfrm_policy_lookup
= selinux_xfrm_policy_lookup
,
5611 .xfrm_state_pol_flow_match
= selinux_xfrm_state_pol_flow_match
,
5612 .xfrm_decode_session
= selinux_xfrm_decode_session
,
5616 .key_alloc
= selinux_key_alloc
,
5617 .key_free
= selinux_key_free
,
5618 .key_permission
= selinux_key_permission
,
5619 .key_getsecurity
= selinux_key_getsecurity
,
5623 .audit_rule_init
= selinux_audit_rule_init
,
5624 .audit_rule_known
= selinux_audit_rule_known
,
5625 .audit_rule_match
= selinux_audit_rule_match
,
5626 .audit_rule_free
= selinux_audit_rule_free
,
5630 static __init
int selinux_init(void)
5632 if (!security_module_enable(&selinux_ops
)) {
5633 selinux_enabled
= 0;
5637 if (!selinux_enabled
) {
5638 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
5642 printk(KERN_INFO
"SELinux: Initializing.\n");
5644 /* Set the security state for the initial task. */
5645 cred_init_security();
5647 default_noexec
= !(VM_DATA_DEFAULT_FLAGS
& VM_EXEC
);
5649 sel_inode_cache
= kmem_cache_create("selinux_inode_security",
5650 sizeof(struct inode_security_struct
),
5651 0, SLAB_PANIC
, NULL
);
5654 if (register_security(&selinux_ops
))
5655 panic("SELinux: Unable to register with kernel.\n");
5657 if (selinux_enforcing
)
5658 printk(KERN_DEBUG
"SELinux: Starting in enforcing mode\n");
5660 printk(KERN_DEBUG
"SELinux: Starting in permissive mode\n");
5665 static void delayed_superblock_init(struct super_block
*sb
, void *unused
)
5667 superblock_doinit(sb
, NULL
);
5670 void selinux_complete_init(void)
5672 printk(KERN_DEBUG
"SELinux: Completing initialization.\n");
5674 /* Set up any superblocks initialized prior to the policy load. */
5675 printk(KERN_DEBUG
"SELinux: Setting up existing superblocks.\n");
5676 iterate_supers(delayed_superblock_init
, NULL
);
5679 /* SELinux requires early initialization in order to label
5680 all processes and objects when they are created. */
5681 security_initcall(selinux_init
);
5683 #if defined(CONFIG_NETFILTER)
5685 static struct nf_hook_ops selinux_ipv4_ops
[] = {
5687 .hook
= selinux_ipv4_postroute
,
5688 .owner
= THIS_MODULE
,
5690 .hooknum
= NF_INET_POST_ROUTING
,
5691 .priority
= NF_IP_PRI_SELINUX_LAST
,
5694 .hook
= selinux_ipv4_forward
,
5695 .owner
= THIS_MODULE
,
5697 .hooknum
= NF_INET_FORWARD
,
5698 .priority
= NF_IP_PRI_SELINUX_FIRST
,
5701 .hook
= selinux_ipv4_output
,
5702 .owner
= THIS_MODULE
,
5704 .hooknum
= NF_INET_LOCAL_OUT
,
5705 .priority
= NF_IP_PRI_SELINUX_FIRST
,
5709 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5711 static struct nf_hook_ops selinux_ipv6_ops
[] = {
5713 .hook
= selinux_ipv6_postroute
,
5714 .owner
= THIS_MODULE
,
5716 .hooknum
= NF_INET_POST_ROUTING
,
5717 .priority
= NF_IP6_PRI_SELINUX_LAST
,
5720 .hook
= selinux_ipv6_forward
,
5721 .owner
= THIS_MODULE
,
5723 .hooknum
= NF_INET_FORWARD
,
5724 .priority
= NF_IP6_PRI_SELINUX_FIRST
,
5730 static int __init
selinux_nf_ip_init(void)
5734 if (!selinux_enabled
)
5737 printk(KERN_DEBUG
"SELinux: Registering netfilter hooks\n");
5739 err
= nf_register_hooks(selinux_ipv4_ops
, ARRAY_SIZE(selinux_ipv4_ops
));
5741 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err
);
5743 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5744 err
= nf_register_hooks(selinux_ipv6_ops
, ARRAY_SIZE(selinux_ipv6_ops
));
5746 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err
);
5753 __initcall(selinux_nf_ip_init
);
5755 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5756 static void selinux_nf_ip_exit(void)
5758 printk(KERN_DEBUG
"SELinux: Unregistering netfilter hooks\n");
5760 nf_unregister_hooks(selinux_ipv4_ops
, ARRAY_SIZE(selinux_ipv4_ops
));
5761 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5762 nf_unregister_hooks(selinux_ipv6_ops
, ARRAY_SIZE(selinux_ipv6_ops
));
5767 #else /* CONFIG_NETFILTER */
5769 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5770 #define selinux_nf_ip_exit()
5773 #endif /* CONFIG_NETFILTER */
5775 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5776 static int selinux_disabled
;
5778 int selinux_disable(void)
5780 extern void exit_sel_fs(void);
5782 if (ss_initialized
) {
5783 /* Not permitted after initial policy load. */
5787 if (selinux_disabled
) {
5788 /* Only do this once. */
5792 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
5794 selinux_disabled
= 1;
5795 selinux_enabled
= 0;
5797 reset_security_ops();
5799 /* Try to destroy the avc node cache */
5802 /* Unregister netfilter hooks. */
5803 selinux_nf_ip_exit();
5805 /* Unregister selinuxfs. */