]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'for_paulus' of master.kernel.org:/pub/scm/linux/kernel/git/galak/powerpc
[mirror_ubuntu-bionic-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
21 */
22
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
33 #include <linux/mm.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h> /* for sysctl_local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/dccp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h> /* for Unix socket types */
64 #include <net/af_unix.h> /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
67 #include <net/ipv6.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
74 #include <linux/mutex.h>
75
76 #include "avc.h"
77 #include "objsec.h"
78 #include "netif.h"
79 #include "xfrm.h"
80 #include "selinux_netlabel.h"
81
82 #define XATTR_SELINUX_SUFFIX "selinux"
83 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84
85 extern unsigned int policydb_loaded_version;
86 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
87 extern int selinux_compat_net;
88
89 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
90 int selinux_enforcing = 0;
91
92 static int __init enforcing_setup(char *str)
93 {
94 selinux_enforcing = simple_strtol(str,NULL,0);
95 return 1;
96 }
97 __setup("enforcing=", enforcing_setup);
98 #endif
99
100 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
101 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102
103 static int __init selinux_enabled_setup(char *str)
104 {
105 selinux_enabled = simple_strtol(str, NULL, 0);
106 return 1;
107 }
108 __setup("selinux=", selinux_enabled_setup);
109 #else
110 int selinux_enabled = 1;
111 #endif
112
113 /* Original (dummy) security module. */
114 static struct security_operations *original_ops = NULL;
115
116 /* Minimal support for a secondary security module,
117 just to allow the use of the dummy or capability modules.
118 The owlsm module can alternatively be used as a secondary
119 module as long as CONFIG_OWLSM_FD is not enabled. */
120 static struct security_operations *secondary_ops = NULL;
121
122 /* Lists of inode and superblock security structures initialized
123 before the policy was loaded. */
124 static LIST_HEAD(superblock_security_head);
125 static DEFINE_SPINLOCK(sb_security_lock);
126
127 static struct kmem_cache *sel_inode_cache;
128
129 /* Return security context for a given sid or just the context
130 length if the buffer is null or length is 0 */
131 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132 {
133 char *context;
134 unsigned len;
135 int rc;
136
137 rc = security_sid_to_context(sid, &context, &len);
138 if (rc)
139 return rc;
140
141 if (!buffer || !size)
142 goto getsecurity_exit;
143
144 if (size < len) {
145 len = -ERANGE;
146 goto getsecurity_exit;
147 }
148 memcpy(buffer, context, len);
149
150 getsecurity_exit:
151 kfree(context);
152 return len;
153 }
154
155 /* Allocate and free functions for each kind of security blob. */
156
157 static int task_alloc_security(struct task_struct *task)
158 {
159 struct task_security_struct *tsec;
160
161 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 if (!tsec)
163 return -ENOMEM;
164
165 tsec->task = task;
166 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
167 task->security = tsec;
168
169 return 0;
170 }
171
172 static void task_free_security(struct task_struct *task)
173 {
174 struct task_security_struct *tsec = task->security;
175 task->security = NULL;
176 kfree(tsec);
177 }
178
179 static int inode_alloc_security(struct inode *inode)
180 {
181 struct task_security_struct *tsec = current->security;
182 struct inode_security_struct *isec;
183
184 isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
185 if (!isec)
186 return -ENOMEM;
187
188 mutex_init(&isec->lock);
189 INIT_LIST_HEAD(&isec->list);
190 isec->inode = inode;
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
195
196 return 0;
197 }
198
199 static void inode_free_security(struct inode *inode)
200 {
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
208
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
211 }
212
213 static int file_alloc_security(struct file *file)
214 {
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
217
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 if (!fsec)
220 return -ENOMEM;
221
222 fsec->file = file;
223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
225 file->f_security = fsec;
226
227 return 0;
228 }
229
230 static void file_free_security(struct file *file)
231 {
232 struct file_security_struct *fsec = file->f_security;
233 file->f_security = NULL;
234 kfree(fsec);
235 }
236
237 static int superblock_alloc_security(struct super_block *sb)
238 {
239 struct superblock_security_struct *sbsec;
240
241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 if (!sbsec)
243 return -ENOMEM;
244
245 mutex_init(&sbsec->lock);
246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
249 sbsec->sb = sb;
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
253 sb->s_security = sbsec;
254
255 return 0;
256 }
257
258 static void superblock_free_security(struct super_block *sb)
259 {
260 struct superblock_security_struct *sbsec = sb->s_security;
261
262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
266
267 sb->s_security = NULL;
268 kfree(sbsec);
269 }
270
271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
272 {
273 struct sk_security_struct *ssec;
274
275 ssec = kzalloc(sizeof(*ssec), priority);
276 if (!ssec)
277 return -ENOMEM;
278
279 ssec->sk = sk;
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
283
284 selinux_netlbl_sk_security_init(ssec, family);
285
286 return 0;
287 }
288
289 static void sk_free_security(struct sock *sk)
290 {
291 struct sk_security_struct *ssec = sk->sk_security;
292
293 sk->sk_security = NULL;
294 kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316 return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
323 Opt_rootcontext = 8,
324 };
325
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
331 };
332
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
334
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
338 {
339 int rc;
340
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
343 if (rc)
344 return rc;
345
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
348 return rc;
349 }
350
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
354 {
355 int rc;
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
358 if (rc)
359 return rc;
360
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
363 return rc;
364 }
365
366 static int try_context_mount(struct super_block *sb, void *data)
367 {
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
370 const char *name;
371 u32 sid;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
375
376 if (!data)
377 goto out;
378
379 name = sb->s_type->name;
380
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
382
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
386
387 if (d->version < NFS_MOUNT_VERSION)
388 goto out;
389
390 if (d->context[0]) {
391 context = d->context;
392 seen |= Opt_context;
393 }
394 } else
395 goto out;
396
397 } else {
398 /* Standard string-based options. */
399 char *p, *options = data;
400
401 while ((p = strsep(&options, "|")) != NULL) {
402 int token;
403 substring_t args[MAX_OPT_ARGS];
404
405 if (!*p)
406 continue;
407
408 token = match_token(p, tokens, args);
409
410 switch (token) {
411 case Opt_context:
412 if (seen & (Opt_context|Opt_defcontext)) {
413 rc = -EINVAL;
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
415 goto out_free;
416 }
417 context = match_strdup(&args[0]);
418 if (!context) {
419 rc = -ENOMEM;
420 goto out_free;
421 }
422 if (!alloc)
423 alloc = 1;
424 seen |= Opt_context;
425 break;
426
427 case Opt_fscontext:
428 if (seen & Opt_fscontext) {
429 rc = -EINVAL;
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
431 goto out_free;
432 }
433 fscontext = match_strdup(&args[0]);
434 if (!fscontext) {
435 rc = -ENOMEM;
436 goto out_free;
437 }
438 if (!alloc)
439 alloc = 1;
440 seen |= Opt_fscontext;
441 break;
442
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
445 rc = -EINVAL;
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
447 goto out_free;
448 }
449 rootcontext = match_strdup(&args[0]);
450 if (!rootcontext) {
451 rc = -ENOMEM;
452 goto out_free;
453 }
454 if (!alloc)
455 alloc = 1;
456 seen |= Opt_rootcontext;
457 break;
458
459 case Opt_defcontext:
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
461 rc = -EINVAL;
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
465 goto out_free;
466 }
467 if (seen & (Opt_context|Opt_defcontext)) {
468 rc = -EINVAL;
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
470 goto out_free;
471 }
472 defcontext = match_strdup(&args[0]);
473 if (!defcontext) {
474 rc = -ENOMEM;
475 goto out_free;
476 }
477 if (!alloc)
478 alloc = 1;
479 seen |= Opt_defcontext;
480 break;
481
482 default:
483 rc = -EINVAL;
484 printk(KERN_WARNING "SELinux: unknown mount "
485 "option\n");
486 goto out_free;
487
488 }
489 }
490 }
491
492 if (!seen)
493 goto out;
494
495 /* sets the context of the superblock for the fs being mounted. */
496 if (fscontext) {
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
498 if (rc) {
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
502 goto out_free;
503 }
504
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
506 if (rc)
507 goto out_free;
508
509 sbsec->sid = sid;
510 }
511
512 /*
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
516 */
517 if (context) {
518 rc = security_context_to_sid(context, strlen(context), &sid);
519 if (rc) {
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
523 goto out_free;
524 }
525
526 if (!fscontext) {
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
528 if (rc)
529 goto out_free;
530 sbsec->sid = sid;
531 } else {
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
533 if (rc)
534 goto out_free;
535 }
536 sbsec->mntpoint_sid = sid;
537
538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
539 }
540
541 if (rootcontext) {
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
545 if (rc) {
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
549 goto out_free;
550 }
551
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
553 if (rc)
554 goto out_free;
555
556 isec->sid = sid;
557 isec->initialized = 1;
558 }
559
560 if (defcontext) {
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
562 if (rc) {
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
566 goto out_free;
567 }
568
569 if (sid == sbsec->def_sid)
570 goto out_free;
571
572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
573 if (rc)
574 goto out_free;
575
576 sbsec->def_sid = sid;
577 }
578
579 out_free:
580 if (alloc) {
581 kfree(context);
582 kfree(defcontext);
583 kfree(fscontext);
584 kfree(rootcontext);
585 }
586 out:
587 return rc;
588 }
589
590 static int superblock_doinit(struct super_block *sb, void *data)
591 {
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
595 int rc = 0;
596
597 mutex_lock(&sbsec->lock);
598 if (sbsec->initialized)
599 goto out;
600
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
609 goto out;
610 }
611
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
614 if (rc) {
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
617 goto out;
618 }
619
620 rc = try_context_mount(sb, data);
621 if (rc)
622 goto out;
623
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
633 rc = -EOPNOTSUPP;
634 goto out;
635 }
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
642 else
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
646 goto out;
647 }
648 }
649
650 if (strcmp(sb->s_type->name, "proc") == 0)
651 sbsec->proc = 1;
652
653 sbsec->initialized = 1;
654
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
658 }
659 else {
660 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
663 }
664
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
667
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
671 populates itself. */
672 spin_lock(&sbsec->isec_lock);
673 next_inode:
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
681 if (inode) {
682 if (!IS_PRIVATE (inode))
683 inode_doinit(inode);
684 iput(inode);
685 }
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
688 goto next_inode;
689 }
690 spin_unlock(&sbsec->isec_lock);
691 out:
692 mutex_unlock(&sbsec->lock);
693 return rc;
694 }
695
696 static inline u16 inode_mode_to_security_class(umode_t mode)
697 {
698 switch (mode & S_IFMT) {
699 case S_IFSOCK:
700 return SECCLASS_SOCK_FILE;
701 case S_IFLNK:
702 return SECCLASS_LNK_FILE;
703 case S_IFREG:
704 return SECCLASS_FILE;
705 case S_IFBLK:
706 return SECCLASS_BLK_FILE;
707 case S_IFDIR:
708 return SECCLASS_DIR;
709 case S_IFCHR:
710 return SECCLASS_CHR_FILE;
711 case S_IFIFO:
712 return SECCLASS_FIFO_FILE;
713
714 }
715
716 return SECCLASS_FILE;
717 }
718
719 static inline int default_protocol_stream(int protocol)
720 {
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
722 }
723
724 static inline int default_protocol_dgram(int protocol)
725 {
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
727 }
728
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
730 {
731 switch (family) {
732 case PF_UNIX:
733 switch (type) {
734 case SOCK_STREAM:
735 case SOCK_SEQPACKET:
736 return SECCLASS_UNIX_STREAM_SOCKET;
737 case SOCK_DGRAM:
738 return SECCLASS_UNIX_DGRAM_SOCKET;
739 }
740 break;
741 case PF_INET:
742 case PF_INET6:
743 switch (type) {
744 case SOCK_STREAM:
745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
747 else
748 return SECCLASS_RAWIP_SOCKET;
749 case SOCK_DGRAM:
750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
752 else
753 return SECCLASS_RAWIP_SOCKET;
754 case SOCK_DCCP:
755 return SECCLASS_DCCP_SOCKET;
756 default:
757 return SECCLASS_RAWIP_SOCKET;
758 }
759 break;
760 case PF_NETLINK:
761 switch (protocol) {
762 case NETLINK_ROUTE:
763 return SECCLASS_NETLINK_ROUTE_SOCKET;
764 case NETLINK_FIREWALL:
765 return SECCLASS_NETLINK_FIREWALL_SOCKET;
766 case NETLINK_INET_DIAG:
767 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
768 case NETLINK_NFLOG:
769 return SECCLASS_NETLINK_NFLOG_SOCKET;
770 case NETLINK_XFRM:
771 return SECCLASS_NETLINK_XFRM_SOCKET;
772 case NETLINK_SELINUX:
773 return SECCLASS_NETLINK_SELINUX_SOCKET;
774 case NETLINK_AUDIT:
775 return SECCLASS_NETLINK_AUDIT_SOCKET;
776 case NETLINK_IP6_FW:
777 return SECCLASS_NETLINK_IP6FW_SOCKET;
778 case NETLINK_DNRTMSG:
779 return SECCLASS_NETLINK_DNRT_SOCKET;
780 case NETLINK_KOBJECT_UEVENT:
781 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
782 default:
783 return SECCLASS_NETLINK_SOCKET;
784 }
785 case PF_PACKET:
786 return SECCLASS_PACKET_SOCKET;
787 case PF_KEY:
788 return SECCLASS_KEY_SOCKET;
789 case PF_APPLETALK:
790 return SECCLASS_APPLETALK_SOCKET;
791 }
792
793 return SECCLASS_SOCKET;
794 }
795
796 #ifdef CONFIG_PROC_FS
797 static int selinux_proc_get_sid(struct proc_dir_entry *de,
798 u16 tclass,
799 u32 *sid)
800 {
801 int buflen, rc;
802 char *buffer, *path, *end;
803
804 buffer = (char*)__get_free_page(GFP_KERNEL);
805 if (!buffer)
806 return -ENOMEM;
807
808 buflen = PAGE_SIZE;
809 end = buffer+buflen;
810 *--end = '\0';
811 buflen--;
812 path = end-1;
813 *path = '/';
814 while (de && de != de->parent) {
815 buflen -= de->namelen + 1;
816 if (buflen < 0)
817 break;
818 end -= de->namelen;
819 memcpy(end, de->name, de->namelen);
820 *--end = '/';
821 path = end;
822 de = de->parent;
823 }
824 rc = security_genfs_sid("proc", path, tclass, sid);
825 free_page((unsigned long)buffer);
826 return rc;
827 }
828 #else
829 static int selinux_proc_get_sid(struct proc_dir_entry *de,
830 u16 tclass,
831 u32 *sid)
832 {
833 return -EINVAL;
834 }
835 #endif
836
837 /* The inode's security attributes must be initialized before first use. */
838 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
839 {
840 struct superblock_security_struct *sbsec = NULL;
841 struct inode_security_struct *isec = inode->i_security;
842 u32 sid;
843 struct dentry *dentry;
844 #define INITCONTEXTLEN 255
845 char *context = NULL;
846 unsigned len = 0;
847 int rc = 0;
848
849 if (isec->initialized)
850 goto out;
851
852 mutex_lock(&isec->lock);
853 if (isec->initialized)
854 goto out_unlock;
855
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
865 goto out_unlock;
866 }
867
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
872 break;
873 }
874
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
877 if (opt_dentry) {
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
880 } else {
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
883 }
884 if (!dentry) {
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
887 inode->i_ino);
888 goto out_unlock;
889 }
890
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
893 if (!context) {
894 rc = -ENOMEM;
895 dput(dentry);
896 goto out_unlock;
897 }
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
899 context, len);
900 if (rc == -ERANGE) {
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
903 NULL, 0);
904 if (rc < 0) {
905 dput(dentry);
906 goto out_unlock;
907 }
908 kfree(context);
909 len = rc;
910 context = kmalloc(len, GFP_KERNEL);
911 if (!context) {
912 rc = -ENOMEM;
913 dput(dentry);
914 goto out_unlock;
915 }
916 rc = inode->i_op->getxattr(dentry,
917 XATTR_NAME_SELINUX,
918 context, len);
919 }
920 dput(dentry);
921 if (rc < 0) {
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
926 kfree(context);
927 goto out_unlock;
928 }
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
931 rc = 0;
932 } else {
933 rc = security_context_to_sid_default(context, rc, &sid,
934 sbsec->def_sid);
935 if (rc) {
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
940 kfree(context);
941 /* Leave with the unlabeled SID */
942 rc = 0;
943 break;
944 }
945 }
946 kfree(context);
947 isec->sid = sid;
948 break;
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
951 break;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
955
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
959 sbsec->sid,
960 isec->sclass,
961 &sid);
962 if (rc)
963 goto out_unlock;
964 isec->sid = sid;
965 break;
966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
968 break;
969 default:
970 /* Default to the fs superblock SID. */
971 isec->sid = sbsec->sid;
972
973 if (sbsec->proc) {
974 struct proc_inode *proci = PROC_I(inode);
975 if (proci->pde) {
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
978 isec->sclass,
979 &sid);
980 if (rc)
981 goto out_unlock;
982 isec->sid = sid;
983 }
984 }
985 break;
986 }
987
988 isec->initialized = 1;
989
990 out_unlock:
991 mutex_unlock(&isec->lock);
992 out:
993 if (isec->sclass == SECCLASS_FILE)
994 isec->sclass = inode_mode_to_security_class(inode->i_mode);
995 return rc;
996 }
997
998 /* Convert a Linux signal to an access vector. */
999 static inline u32 signal_to_av(int sig)
1000 {
1001 u32 perm = 0;
1002
1003 switch (sig) {
1004 case SIGCHLD:
1005 /* Commonly granted from child to parent. */
1006 perm = PROCESS__SIGCHLD;
1007 break;
1008 case SIGKILL:
1009 /* Cannot be caught or ignored */
1010 perm = PROCESS__SIGKILL;
1011 break;
1012 case SIGSTOP:
1013 /* Cannot be caught or ignored */
1014 perm = PROCESS__SIGSTOP;
1015 break;
1016 default:
1017 /* All other signals. */
1018 perm = PROCESS__SIGNAL;
1019 break;
1020 }
1021
1022 return perm;
1023 }
1024
1025 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1026 fork check, ptrace check, etc. */
1027 static int task_has_perm(struct task_struct *tsk1,
1028 struct task_struct *tsk2,
1029 u32 perms)
1030 {
1031 struct task_security_struct *tsec1, *tsec2;
1032
1033 tsec1 = tsk1->security;
1034 tsec2 = tsk2->security;
1035 return avc_has_perm(tsec1->sid, tsec2->sid,
1036 SECCLASS_PROCESS, perms, NULL);
1037 }
1038
1039 /* Check whether a task is allowed to use a capability. */
1040 static int task_has_capability(struct task_struct *tsk,
1041 int cap)
1042 {
1043 struct task_security_struct *tsec;
1044 struct avc_audit_data ad;
1045
1046 tsec = tsk->security;
1047
1048 AVC_AUDIT_DATA_INIT(&ad,CAP);
1049 ad.tsk = tsk;
1050 ad.u.cap = cap;
1051
1052 return avc_has_perm(tsec->sid, tsec->sid,
1053 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1054 }
1055
1056 /* Check whether a task is allowed to use a system operation. */
1057 static int task_has_system(struct task_struct *tsk,
1058 u32 perms)
1059 {
1060 struct task_security_struct *tsec;
1061
1062 tsec = tsk->security;
1063
1064 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1065 SECCLASS_SYSTEM, perms, NULL);
1066 }
1067
1068 /* Check whether a task has a particular permission to an inode.
1069 The 'adp' parameter is optional and allows other audit
1070 data to be passed (e.g. the dentry). */
1071 static int inode_has_perm(struct task_struct *tsk,
1072 struct inode *inode,
1073 u32 perms,
1074 struct avc_audit_data *adp)
1075 {
1076 struct task_security_struct *tsec;
1077 struct inode_security_struct *isec;
1078 struct avc_audit_data ad;
1079
1080 tsec = tsk->security;
1081 isec = inode->i_security;
1082
1083 if (!adp) {
1084 adp = &ad;
1085 AVC_AUDIT_DATA_INIT(&ad, FS);
1086 ad.u.fs.inode = inode;
1087 }
1088
1089 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1090 }
1091
1092 /* Same as inode_has_perm, but pass explicit audit data containing
1093 the dentry to help the auditing code to more easily generate the
1094 pathname if needed. */
1095 static inline int dentry_has_perm(struct task_struct *tsk,
1096 struct vfsmount *mnt,
1097 struct dentry *dentry,
1098 u32 av)
1099 {
1100 struct inode *inode = dentry->d_inode;
1101 struct avc_audit_data ad;
1102 AVC_AUDIT_DATA_INIT(&ad,FS);
1103 ad.u.fs.mnt = mnt;
1104 ad.u.fs.dentry = dentry;
1105 return inode_has_perm(tsk, inode, av, &ad);
1106 }
1107
1108 /* Check whether a task can use an open file descriptor to
1109 access an inode in a given way. Check access to the
1110 descriptor itself, and then use dentry_has_perm to
1111 check a particular permission to the file.
1112 Access to the descriptor is implicitly granted if it
1113 has the same SID as the process. If av is zero, then
1114 access to the file is not checked, e.g. for cases
1115 where only the descriptor is affected like seek. */
1116 static int file_has_perm(struct task_struct *tsk,
1117 struct file *file,
1118 u32 av)
1119 {
1120 struct task_security_struct *tsec = tsk->security;
1121 struct file_security_struct *fsec = file->f_security;
1122 struct vfsmount *mnt = file->f_path.mnt;
1123 struct dentry *dentry = file->f_path.dentry;
1124 struct inode *inode = dentry->d_inode;
1125 struct avc_audit_data ad;
1126 int rc;
1127
1128 AVC_AUDIT_DATA_INIT(&ad, FS);
1129 ad.u.fs.mnt = mnt;
1130 ad.u.fs.dentry = dentry;
1131
1132 if (tsec->sid != fsec->sid) {
1133 rc = avc_has_perm(tsec->sid, fsec->sid,
1134 SECCLASS_FD,
1135 FD__USE,
1136 &ad);
1137 if (rc)
1138 return rc;
1139 }
1140
1141 /* av is zero if only checking access to the descriptor. */
1142 if (av)
1143 return inode_has_perm(tsk, inode, av, &ad);
1144
1145 return 0;
1146 }
1147
1148 /* Check whether a task can create a file. */
1149 static int may_create(struct inode *dir,
1150 struct dentry *dentry,
1151 u16 tclass)
1152 {
1153 struct task_security_struct *tsec;
1154 struct inode_security_struct *dsec;
1155 struct superblock_security_struct *sbsec;
1156 u32 newsid;
1157 struct avc_audit_data ad;
1158 int rc;
1159
1160 tsec = current->security;
1161 dsec = dir->i_security;
1162 sbsec = dir->i_sb->s_security;
1163
1164 AVC_AUDIT_DATA_INIT(&ad, FS);
1165 ad.u.fs.dentry = dentry;
1166
1167 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1168 DIR__ADD_NAME | DIR__SEARCH,
1169 &ad);
1170 if (rc)
1171 return rc;
1172
1173 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1174 newsid = tsec->create_sid;
1175 } else {
1176 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1177 &newsid);
1178 if (rc)
1179 return rc;
1180 }
1181
1182 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1183 if (rc)
1184 return rc;
1185
1186 return avc_has_perm(newsid, sbsec->sid,
1187 SECCLASS_FILESYSTEM,
1188 FILESYSTEM__ASSOCIATE, &ad);
1189 }
1190
1191 /* Check whether a task can create a key. */
1192 static int may_create_key(u32 ksid,
1193 struct task_struct *ctx)
1194 {
1195 struct task_security_struct *tsec;
1196
1197 tsec = ctx->security;
1198
1199 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1200 }
1201
1202 #define MAY_LINK 0
1203 #define MAY_UNLINK 1
1204 #define MAY_RMDIR 2
1205
1206 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1207 static int may_link(struct inode *dir,
1208 struct dentry *dentry,
1209 int kind)
1210
1211 {
1212 struct task_security_struct *tsec;
1213 struct inode_security_struct *dsec, *isec;
1214 struct avc_audit_data ad;
1215 u32 av;
1216 int rc;
1217
1218 tsec = current->security;
1219 dsec = dir->i_security;
1220 isec = dentry->d_inode->i_security;
1221
1222 AVC_AUDIT_DATA_INIT(&ad, FS);
1223 ad.u.fs.dentry = dentry;
1224
1225 av = DIR__SEARCH;
1226 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1227 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1228 if (rc)
1229 return rc;
1230
1231 switch (kind) {
1232 case MAY_LINK:
1233 av = FILE__LINK;
1234 break;
1235 case MAY_UNLINK:
1236 av = FILE__UNLINK;
1237 break;
1238 case MAY_RMDIR:
1239 av = DIR__RMDIR;
1240 break;
1241 default:
1242 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1243 return 0;
1244 }
1245
1246 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1247 return rc;
1248 }
1249
1250 static inline int may_rename(struct inode *old_dir,
1251 struct dentry *old_dentry,
1252 struct inode *new_dir,
1253 struct dentry *new_dentry)
1254 {
1255 struct task_security_struct *tsec;
1256 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1257 struct avc_audit_data ad;
1258 u32 av;
1259 int old_is_dir, new_is_dir;
1260 int rc;
1261
1262 tsec = current->security;
1263 old_dsec = old_dir->i_security;
1264 old_isec = old_dentry->d_inode->i_security;
1265 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1266 new_dsec = new_dir->i_security;
1267
1268 AVC_AUDIT_DATA_INIT(&ad, FS);
1269
1270 ad.u.fs.dentry = old_dentry;
1271 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1272 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1273 if (rc)
1274 return rc;
1275 rc = avc_has_perm(tsec->sid, old_isec->sid,
1276 old_isec->sclass, FILE__RENAME, &ad);
1277 if (rc)
1278 return rc;
1279 if (old_is_dir && new_dir != old_dir) {
1280 rc = avc_has_perm(tsec->sid, old_isec->sid,
1281 old_isec->sclass, DIR__REPARENT, &ad);
1282 if (rc)
1283 return rc;
1284 }
1285
1286 ad.u.fs.dentry = new_dentry;
1287 av = DIR__ADD_NAME | DIR__SEARCH;
1288 if (new_dentry->d_inode)
1289 av |= DIR__REMOVE_NAME;
1290 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1291 if (rc)
1292 return rc;
1293 if (new_dentry->d_inode) {
1294 new_isec = new_dentry->d_inode->i_security;
1295 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1296 rc = avc_has_perm(tsec->sid, new_isec->sid,
1297 new_isec->sclass,
1298 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1299 if (rc)
1300 return rc;
1301 }
1302
1303 return 0;
1304 }
1305
1306 /* Check whether a task can perform a filesystem operation. */
1307 static int superblock_has_perm(struct task_struct *tsk,
1308 struct super_block *sb,
1309 u32 perms,
1310 struct avc_audit_data *ad)
1311 {
1312 struct task_security_struct *tsec;
1313 struct superblock_security_struct *sbsec;
1314
1315 tsec = tsk->security;
1316 sbsec = sb->s_security;
1317 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1318 perms, ad);
1319 }
1320
1321 /* Convert a Linux mode and permission mask to an access vector. */
1322 static inline u32 file_mask_to_av(int mode, int mask)
1323 {
1324 u32 av = 0;
1325
1326 if ((mode & S_IFMT) != S_IFDIR) {
1327 if (mask & MAY_EXEC)
1328 av |= FILE__EXECUTE;
1329 if (mask & MAY_READ)
1330 av |= FILE__READ;
1331
1332 if (mask & MAY_APPEND)
1333 av |= FILE__APPEND;
1334 else if (mask & MAY_WRITE)
1335 av |= FILE__WRITE;
1336
1337 } else {
1338 if (mask & MAY_EXEC)
1339 av |= DIR__SEARCH;
1340 if (mask & MAY_WRITE)
1341 av |= DIR__WRITE;
1342 if (mask & MAY_READ)
1343 av |= DIR__READ;
1344 }
1345
1346 return av;
1347 }
1348
1349 /* Convert a Linux file to an access vector. */
1350 static inline u32 file_to_av(struct file *file)
1351 {
1352 u32 av = 0;
1353
1354 if (file->f_mode & FMODE_READ)
1355 av |= FILE__READ;
1356 if (file->f_mode & FMODE_WRITE) {
1357 if (file->f_flags & O_APPEND)
1358 av |= FILE__APPEND;
1359 else
1360 av |= FILE__WRITE;
1361 }
1362
1363 return av;
1364 }
1365
1366 /* Hook functions begin here. */
1367
1368 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1369 {
1370 struct task_security_struct *psec = parent->security;
1371 struct task_security_struct *csec = child->security;
1372 int rc;
1373
1374 rc = secondary_ops->ptrace(parent,child);
1375 if (rc)
1376 return rc;
1377
1378 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1379 /* Save the SID of the tracing process for later use in apply_creds. */
1380 if (!(child->ptrace & PT_PTRACED) && !rc)
1381 csec->ptrace_sid = psec->sid;
1382 return rc;
1383 }
1384
1385 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1386 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1387 {
1388 int error;
1389
1390 error = task_has_perm(current, target, PROCESS__GETCAP);
1391 if (error)
1392 return error;
1393
1394 return secondary_ops->capget(target, effective, inheritable, permitted);
1395 }
1396
1397 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1398 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1399 {
1400 int error;
1401
1402 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1403 if (error)
1404 return error;
1405
1406 return task_has_perm(current, target, PROCESS__SETCAP);
1407 }
1408
1409 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1410 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1411 {
1412 secondary_ops->capset_set(target, effective, inheritable, permitted);
1413 }
1414
1415 static int selinux_capable(struct task_struct *tsk, int cap)
1416 {
1417 int rc;
1418
1419 rc = secondary_ops->capable(tsk, cap);
1420 if (rc)
1421 return rc;
1422
1423 return task_has_capability(tsk,cap);
1424 }
1425
1426 static int selinux_sysctl(ctl_table *table, int op)
1427 {
1428 int error = 0;
1429 u32 av;
1430 struct task_security_struct *tsec;
1431 u32 tsid;
1432 int rc;
1433
1434 rc = secondary_ops->sysctl(table, op);
1435 if (rc)
1436 return rc;
1437
1438 tsec = current->security;
1439
1440 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1441 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1442 if (rc) {
1443 /* Default to the well-defined sysctl SID. */
1444 tsid = SECINITSID_SYSCTL;
1445 }
1446
1447 /* The op values are "defined" in sysctl.c, thereby creating
1448 * a bad coupling between this module and sysctl.c */
1449 if(op == 001) {
1450 error = avc_has_perm(tsec->sid, tsid,
1451 SECCLASS_DIR, DIR__SEARCH, NULL);
1452 } else {
1453 av = 0;
1454 if (op & 004)
1455 av |= FILE__READ;
1456 if (op & 002)
1457 av |= FILE__WRITE;
1458 if (av)
1459 error = avc_has_perm(tsec->sid, tsid,
1460 SECCLASS_FILE, av, NULL);
1461 }
1462
1463 return error;
1464 }
1465
1466 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1467 {
1468 int rc = 0;
1469
1470 if (!sb)
1471 return 0;
1472
1473 switch (cmds) {
1474 case Q_SYNC:
1475 case Q_QUOTAON:
1476 case Q_QUOTAOFF:
1477 case Q_SETINFO:
1478 case Q_SETQUOTA:
1479 rc = superblock_has_perm(current,
1480 sb,
1481 FILESYSTEM__QUOTAMOD, NULL);
1482 break;
1483 case Q_GETFMT:
1484 case Q_GETINFO:
1485 case Q_GETQUOTA:
1486 rc = superblock_has_perm(current,
1487 sb,
1488 FILESYSTEM__QUOTAGET, NULL);
1489 break;
1490 default:
1491 rc = 0; /* let the kernel handle invalid cmds */
1492 break;
1493 }
1494 return rc;
1495 }
1496
1497 static int selinux_quota_on(struct dentry *dentry)
1498 {
1499 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1500 }
1501
1502 static int selinux_syslog(int type)
1503 {
1504 int rc;
1505
1506 rc = secondary_ops->syslog(type);
1507 if (rc)
1508 return rc;
1509
1510 switch (type) {
1511 case 3: /* Read last kernel messages */
1512 case 10: /* Return size of the log buffer */
1513 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1514 break;
1515 case 6: /* Disable logging to console */
1516 case 7: /* Enable logging to console */
1517 case 8: /* Set level of messages printed to console */
1518 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1519 break;
1520 case 0: /* Close log */
1521 case 1: /* Open log */
1522 case 2: /* Read from log */
1523 case 4: /* Read/clear last kernel messages */
1524 case 5: /* Clear ring buffer */
1525 default:
1526 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1527 break;
1528 }
1529 return rc;
1530 }
1531
1532 /*
1533 * Check that a process has enough memory to allocate a new virtual
1534 * mapping. 0 means there is enough memory for the allocation to
1535 * succeed and -ENOMEM implies there is not.
1536 *
1537 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1538 * if the capability is granted, but __vm_enough_memory requires 1 if
1539 * the capability is granted.
1540 *
1541 * Do not audit the selinux permission check, as this is applied to all
1542 * processes that allocate mappings.
1543 */
1544 static int selinux_vm_enough_memory(long pages)
1545 {
1546 int rc, cap_sys_admin = 0;
1547 struct task_security_struct *tsec = current->security;
1548
1549 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1550 if (rc == 0)
1551 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1552 SECCLASS_CAPABILITY,
1553 CAP_TO_MASK(CAP_SYS_ADMIN),
1554 NULL);
1555
1556 if (rc == 0)
1557 cap_sys_admin = 1;
1558
1559 return __vm_enough_memory(pages, cap_sys_admin);
1560 }
1561
1562 /* binprm security operations */
1563
1564 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1565 {
1566 struct bprm_security_struct *bsec;
1567
1568 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1569 if (!bsec)
1570 return -ENOMEM;
1571
1572 bsec->bprm = bprm;
1573 bsec->sid = SECINITSID_UNLABELED;
1574 bsec->set = 0;
1575
1576 bprm->security = bsec;
1577 return 0;
1578 }
1579
1580 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1581 {
1582 struct task_security_struct *tsec;
1583 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1584 struct inode_security_struct *isec;
1585 struct bprm_security_struct *bsec;
1586 u32 newsid;
1587 struct avc_audit_data ad;
1588 int rc;
1589
1590 rc = secondary_ops->bprm_set_security(bprm);
1591 if (rc)
1592 return rc;
1593
1594 bsec = bprm->security;
1595
1596 if (bsec->set)
1597 return 0;
1598
1599 tsec = current->security;
1600 isec = inode->i_security;
1601
1602 /* Default to the current task SID. */
1603 bsec->sid = tsec->sid;
1604
1605 /* Reset fs, key, and sock SIDs on execve. */
1606 tsec->create_sid = 0;
1607 tsec->keycreate_sid = 0;
1608 tsec->sockcreate_sid = 0;
1609
1610 if (tsec->exec_sid) {
1611 newsid = tsec->exec_sid;
1612 /* Reset exec SID on execve. */
1613 tsec->exec_sid = 0;
1614 } else {
1615 /* Check for a default transition on this program. */
1616 rc = security_transition_sid(tsec->sid, isec->sid,
1617 SECCLASS_PROCESS, &newsid);
1618 if (rc)
1619 return rc;
1620 }
1621
1622 AVC_AUDIT_DATA_INIT(&ad, FS);
1623 ad.u.fs.mnt = bprm->file->f_path.mnt;
1624 ad.u.fs.dentry = bprm->file->f_path.dentry;
1625
1626 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1627 newsid = tsec->sid;
1628
1629 if (tsec->sid == newsid) {
1630 rc = avc_has_perm(tsec->sid, isec->sid,
1631 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1632 if (rc)
1633 return rc;
1634 } else {
1635 /* Check permissions for the transition. */
1636 rc = avc_has_perm(tsec->sid, newsid,
1637 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1638 if (rc)
1639 return rc;
1640
1641 rc = avc_has_perm(newsid, isec->sid,
1642 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1643 if (rc)
1644 return rc;
1645
1646 /* Clear any possibly unsafe personality bits on exec: */
1647 current->personality &= ~PER_CLEAR_ON_SETID;
1648
1649 /* Set the security field to the new SID. */
1650 bsec->sid = newsid;
1651 }
1652
1653 bsec->set = 1;
1654 return 0;
1655 }
1656
1657 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1658 {
1659 return secondary_ops->bprm_check_security(bprm);
1660 }
1661
1662
1663 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1664 {
1665 struct task_security_struct *tsec = current->security;
1666 int atsecure = 0;
1667
1668 if (tsec->osid != tsec->sid) {
1669 /* Enable secure mode for SIDs transitions unless
1670 the noatsecure permission is granted between
1671 the two SIDs, i.e. ahp returns 0. */
1672 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1673 SECCLASS_PROCESS,
1674 PROCESS__NOATSECURE, NULL);
1675 }
1676
1677 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1678 }
1679
1680 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1681 {
1682 kfree(bprm->security);
1683 bprm->security = NULL;
1684 }
1685
1686 extern struct vfsmount *selinuxfs_mount;
1687 extern struct dentry *selinux_null;
1688
1689 /* Derived from fs/exec.c:flush_old_files. */
1690 static inline void flush_unauthorized_files(struct files_struct * files)
1691 {
1692 struct avc_audit_data ad;
1693 struct file *file, *devnull = NULL;
1694 struct tty_struct *tty;
1695 struct fdtable *fdt;
1696 long j = -1;
1697 int drop_tty = 0;
1698
1699 mutex_lock(&tty_mutex);
1700 tty = get_current_tty();
1701 if (tty) {
1702 file_list_lock();
1703 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1704 if (file) {
1705 /* Revalidate access to controlling tty.
1706 Use inode_has_perm on the tty inode directly rather
1707 than using file_has_perm, as this particular open
1708 file may belong to another process and we are only
1709 interested in the inode-based check here. */
1710 struct inode *inode = file->f_path.dentry->d_inode;
1711 if (inode_has_perm(current, inode,
1712 FILE__READ | FILE__WRITE, NULL)) {
1713 drop_tty = 1;
1714 }
1715 }
1716 file_list_unlock();
1717
1718 /* Reset controlling tty. */
1719 if (drop_tty)
1720 proc_set_tty(current, NULL);
1721 }
1722 mutex_unlock(&tty_mutex);
1723
1724 /* Revalidate access to inherited open files. */
1725
1726 AVC_AUDIT_DATA_INIT(&ad,FS);
1727
1728 spin_lock(&files->file_lock);
1729 for (;;) {
1730 unsigned long set, i;
1731 int fd;
1732
1733 j++;
1734 i = j * __NFDBITS;
1735 fdt = files_fdtable(files);
1736 if (i >= fdt->max_fds)
1737 break;
1738 set = fdt->open_fds->fds_bits[j];
1739 if (!set)
1740 continue;
1741 spin_unlock(&files->file_lock);
1742 for ( ; set ; i++,set >>= 1) {
1743 if (set & 1) {
1744 file = fget(i);
1745 if (!file)
1746 continue;
1747 if (file_has_perm(current,
1748 file,
1749 file_to_av(file))) {
1750 sys_close(i);
1751 fd = get_unused_fd();
1752 if (fd != i) {
1753 if (fd >= 0)
1754 put_unused_fd(fd);
1755 fput(file);
1756 continue;
1757 }
1758 if (devnull) {
1759 get_file(devnull);
1760 } else {
1761 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1762 if (IS_ERR(devnull)) {
1763 devnull = NULL;
1764 put_unused_fd(fd);
1765 fput(file);
1766 continue;
1767 }
1768 }
1769 fd_install(fd, devnull);
1770 }
1771 fput(file);
1772 }
1773 }
1774 spin_lock(&files->file_lock);
1775
1776 }
1777 spin_unlock(&files->file_lock);
1778 }
1779
1780 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1781 {
1782 struct task_security_struct *tsec;
1783 struct bprm_security_struct *bsec;
1784 u32 sid;
1785 int rc;
1786
1787 secondary_ops->bprm_apply_creds(bprm, unsafe);
1788
1789 tsec = current->security;
1790
1791 bsec = bprm->security;
1792 sid = bsec->sid;
1793
1794 tsec->osid = tsec->sid;
1795 bsec->unsafe = 0;
1796 if (tsec->sid != sid) {
1797 /* Check for shared state. If not ok, leave SID
1798 unchanged and kill. */
1799 if (unsafe & LSM_UNSAFE_SHARE) {
1800 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1801 PROCESS__SHARE, NULL);
1802 if (rc) {
1803 bsec->unsafe = 1;
1804 return;
1805 }
1806 }
1807
1808 /* Check for ptracing, and update the task SID if ok.
1809 Otherwise, leave SID unchanged and kill. */
1810 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1811 rc = avc_has_perm(tsec->ptrace_sid, sid,
1812 SECCLASS_PROCESS, PROCESS__PTRACE,
1813 NULL);
1814 if (rc) {
1815 bsec->unsafe = 1;
1816 return;
1817 }
1818 }
1819 tsec->sid = sid;
1820 }
1821 }
1822
1823 /*
1824 * called after apply_creds without the task lock held
1825 */
1826 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1827 {
1828 struct task_security_struct *tsec;
1829 struct rlimit *rlim, *initrlim;
1830 struct itimerval itimer;
1831 struct bprm_security_struct *bsec;
1832 int rc, i;
1833
1834 tsec = current->security;
1835 bsec = bprm->security;
1836
1837 if (bsec->unsafe) {
1838 force_sig_specific(SIGKILL, current);
1839 return;
1840 }
1841 if (tsec->osid == tsec->sid)
1842 return;
1843
1844 /* Close files for which the new task SID is not authorized. */
1845 flush_unauthorized_files(current->files);
1846
1847 /* Check whether the new SID can inherit signal state
1848 from the old SID. If not, clear itimers to avoid
1849 subsequent signal generation and flush and unblock
1850 signals. This must occur _after_ the task SID has
1851 been updated so that any kill done after the flush
1852 will be checked against the new SID. */
1853 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1854 PROCESS__SIGINH, NULL);
1855 if (rc) {
1856 memset(&itimer, 0, sizeof itimer);
1857 for (i = 0; i < 3; i++)
1858 do_setitimer(i, &itimer, NULL);
1859 flush_signals(current);
1860 spin_lock_irq(&current->sighand->siglock);
1861 flush_signal_handlers(current, 1);
1862 sigemptyset(&current->blocked);
1863 recalc_sigpending();
1864 spin_unlock_irq(&current->sighand->siglock);
1865 }
1866
1867 /* Check whether the new SID can inherit resource limits
1868 from the old SID. If not, reset all soft limits to
1869 the lower of the current task's hard limit and the init
1870 task's soft limit. Note that the setting of hard limits
1871 (even to lower them) can be controlled by the setrlimit
1872 check. The inclusion of the init task's soft limit into
1873 the computation is to avoid resetting soft limits higher
1874 than the default soft limit for cases where the default
1875 is lower than the hard limit, e.g. RLIMIT_CORE or
1876 RLIMIT_STACK.*/
1877 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1878 PROCESS__RLIMITINH, NULL);
1879 if (rc) {
1880 for (i = 0; i < RLIM_NLIMITS; i++) {
1881 rlim = current->signal->rlim + i;
1882 initrlim = init_task.signal->rlim+i;
1883 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1884 }
1885 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1886 /*
1887 * This will cause RLIMIT_CPU calculations
1888 * to be refigured.
1889 */
1890 current->it_prof_expires = jiffies_to_cputime(1);
1891 }
1892 }
1893
1894 /* Wake up the parent if it is waiting so that it can
1895 recheck wait permission to the new task SID. */
1896 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1897 }
1898
1899 /* superblock security operations */
1900
1901 static int selinux_sb_alloc_security(struct super_block *sb)
1902 {
1903 return superblock_alloc_security(sb);
1904 }
1905
1906 static void selinux_sb_free_security(struct super_block *sb)
1907 {
1908 superblock_free_security(sb);
1909 }
1910
1911 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1912 {
1913 if (plen > olen)
1914 return 0;
1915
1916 return !memcmp(prefix, option, plen);
1917 }
1918
1919 static inline int selinux_option(char *option, int len)
1920 {
1921 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1922 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1923 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1924 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1925 }
1926
1927 static inline void take_option(char **to, char *from, int *first, int len)
1928 {
1929 if (!*first) {
1930 **to = ',';
1931 *to += 1;
1932 } else
1933 *first = 0;
1934 memcpy(*to, from, len);
1935 *to += len;
1936 }
1937
1938 static inline void take_selinux_option(char **to, char *from, int *first,
1939 int len)
1940 {
1941 int current_size = 0;
1942
1943 if (!*first) {
1944 **to = '|';
1945 *to += 1;
1946 }
1947 else
1948 *first = 0;
1949
1950 while (current_size < len) {
1951 if (*from != '"') {
1952 **to = *from;
1953 *to += 1;
1954 }
1955 from += 1;
1956 current_size += 1;
1957 }
1958 }
1959
1960 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1961 {
1962 int fnosec, fsec, rc = 0;
1963 char *in_save, *in_curr, *in_end;
1964 char *sec_curr, *nosec_save, *nosec;
1965 int open_quote = 0;
1966
1967 in_curr = orig;
1968 sec_curr = copy;
1969
1970 /* Binary mount data: just copy */
1971 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1972 copy_page(sec_curr, in_curr);
1973 goto out;
1974 }
1975
1976 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1977 if (!nosec) {
1978 rc = -ENOMEM;
1979 goto out;
1980 }
1981
1982 nosec_save = nosec;
1983 fnosec = fsec = 1;
1984 in_save = in_end = orig;
1985
1986 do {
1987 if (*in_end == '"')
1988 open_quote = !open_quote;
1989 if ((*in_end == ',' && open_quote == 0) ||
1990 *in_end == '\0') {
1991 int len = in_end - in_curr;
1992
1993 if (selinux_option(in_curr, len))
1994 take_selinux_option(&sec_curr, in_curr, &fsec, len);
1995 else
1996 take_option(&nosec, in_curr, &fnosec, len);
1997
1998 in_curr = in_end + 1;
1999 }
2000 } while (*in_end++);
2001
2002 strcpy(in_save, nosec_save);
2003 free_page((unsigned long)nosec_save);
2004 out:
2005 return rc;
2006 }
2007
2008 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2009 {
2010 struct avc_audit_data ad;
2011 int rc;
2012
2013 rc = superblock_doinit(sb, data);
2014 if (rc)
2015 return rc;
2016
2017 AVC_AUDIT_DATA_INIT(&ad,FS);
2018 ad.u.fs.dentry = sb->s_root;
2019 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2020 }
2021
2022 static int selinux_sb_statfs(struct dentry *dentry)
2023 {
2024 struct avc_audit_data ad;
2025
2026 AVC_AUDIT_DATA_INIT(&ad,FS);
2027 ad.u.fs.dentry = dentry->d_sb->s_root;
2028 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2029 }
2030
2031 static int selinux_mount(char * dev_name,
2032 struct nameidata *nd,
2033 char * type,
2034 unsigned long flags,
2035 void * data)
2036 {
2037 int rc;
2038
2039 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2040 if (rc)
2041 return rc;
2042
2043 if (flags & MS_REMOUNT)
2044 return superblock_has_perm(current, nd->mnt->mnt_sb,
2045 FILESYSTEM__REMOUNT, NULL);
2046 else
2047 return dentry_has_perm(current, nd->mnt, nd->dentry,
2048 FILE__MOUNTON);
2049 }
2050
2051 static int selinux_umount(struct vfsmount *mnt, int flags)
2052 {
2053 int rc;
2054
2055 rc = secondary_ops->sb_umount(mnt, flags);
2056 if (rc)
2057 return rc;
2058
2059 return superblock_has_perm(current,mnt->mnt_sb,
2060 FILESYSTEM__UNMOUNT,NULL);
2061 }
2062
2063 /* inode security operations */
2064
2065 static int selinux_inode_alloc_security(struct inode *inode)
2066 {
2067 return inode_alloc_security(inode);
2068 }
2069
2070 static void selinux_inode_free_security(struct inode *inode)
2071 {
2072 inode_free_security(inode);
2073 }
2074
2075 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2076 char **name, void **value,
2077 size_t *len)
2078 {
2079 struct task_security_struct *tsec;
2080 struct inode_security_struct *dsec;
2081 struct superblock_security_struct *sbsec;
2082 u32 newsid, clen;
2083 int rc;
2084 char *namep = NULL, *context;
2085
2086 tsec = current->security;
2087 dsec = dir->i_security;
2088 sbsec = dir->i_sb->s_security;
2089
2090 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2091 newsid = tsec->create_sid;
2092 } else {
2093 rc = security_transition_sid(tsec->sid, dsec->sid,
2094 inode_mode_to_security_class(inode->i_mode),
2095 &newsid);
2096 if (rc) {
2097 printk(KERN_WARNING "%s: "
2098 "security_transition_sid failed, rc=%d (dev=%s "
2099 "ino=%ld)\n",
2100 __FUNCTION__,
2101 -rc, inode->i_sb->s_id, inode->i_ino);
2102 return rc;
2103 }
2104 }
2105
2106 /* Possibly defer initialization to selinux_complete_init. */
2107 if (sbsec->initialized) {
2108 struct inode_security_struct *isec = inode->i_security;
2109 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2110 isec->sid = newsid;
2111 isec->initialized = 1;
2112 }
2113
2114 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2115 return -EOPNOTSUPP;
2116
2117 if (name) {
2118 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2119 if (!namep)
2120 return -ENOMEM;
2121 *name = namep;
2122 }
2123
2124 if (value && len) {
2125 rc = security_sid_to_context(newsid, &context, &clen);
2126 if (rc) {
2127 kfree(namep);
2128 return rc;
2129 }
2130 *value = context;
2131 *len = clen;
2132 }
2133
2134 return 0;
2135 }
2136
2137 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2138 {
2139 return may_create(dir, dentry, SECCLASS_FILE);
2140 }
2141
2142 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2143 {
2144 int rc;
2145
2146 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2147 if (rc)
2148 return rc;
2149 return may_link(dir, old_dentry, MAY_LINK);
2150 }
2151
2152 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2153 {
2154 int rc;
2155
2156 rc = secondary_ops->inode_unlink(dir, dentry);
2157 if (rc)
2158 return rc;
2159 return may_link(dir, dentry, MAY_UNLINK);
2160 }
2161
2162 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2163 {
2164 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2165 }
2166
2167 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2168 {
2169 return may_create(dir, dentry, SECCLASS_DIR);
2170 }
2171
2172 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2173 {
2174 return may_link(dir, dentry, MAY_RMDIR);
2175 }
2176
2177 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2178 {
2179 int rc;
2180
2181 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2182 if (rc)
2183 return rc;
2184
2185 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2186 }
2187
2188 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2189 struct inode *new_inode, struct dentry *new_dentry)
2190 {
2191 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2192 }
2193
2194 static int selinux_inode_readlink(struct dentry *dentry)
2195 {
2196 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2197 }
2198
2199 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2200 {
2201 int rc;
2202
2203 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2204 if (rc)
2205 return rc;
2206 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2207 }
2208
2209 static int selinux_inode_permission(struct inode *inode, int mask,
2210 struct nameidata *nd)
2211 {
2212 int rc;
2213
2214 rc = secondary_ops->inode_permission(inode, mask, nd);
2215 if (rc)
2216 return rc;
2217
2218 if (!mask) {
2219 /* No permission to check. Existence test. */
2220 return 0;
2221 }
2222
2223 return inode_has_perm(current, inode,
2224 file_mask_to_av(inode->i_mode, mask), NULL);
2225 }
2226
2227 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2228 {
2229 int rc;
2230
2231 rc = secondary_ops->inode_setattr(dentry, iattr);
2232 if (rc)
2233 return rc;
2234
2235 if (iattr->ia_valid & ATTR_FORCE)
2236 return 0;
2237
2238 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2239 ATTR_ATIME_SET | ATTR_MTIME_SET))
2240 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2241
2242 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2243 }
2244
2245 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2246 {
2247 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2248 }
2249
2250 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2251 {
2252 struct task_security_struct *tsec = current->security;
2253 struct inode *inode = dentry->d_inode;
2254 struct inode_security_struct *isec = inode->i_security;
2255 struct superblock_security_struct *sbsec;
2256 struct avc_audit_data ad;
2257 u32 newsid;
2258 int rc = 0;
2259
2260 if (strcmp(name, XATTR_NAME_SELINUX)) {
2261 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2262 sizeof XATTR_SECURITY_PREFIX - 1) &&
2263 !capable(CAP_SYS_ADMIN)) {
2264 /* A different attribute in the security namespace.
2265 Restrict to administrator. */
2266 return -EPERM;
2267 }
2268
2269 /* Not an attribute we recognize, so just check the
2270 ordinary setattr permission. */
2271 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2272 }
2273
2274 sbsec = inode->i_sb->s_security;
2275 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2276 return -EOPNOTSUPP;
2277
2278 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2279 return -EPERM;
2280
2281 AVC_AUDIT_DATA_INIT(&ad,FS);
2282 ad.u.fs.dentry = dentry;
2283
2284 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2285 FILE__RELABELFROM, &ad);
2286 if (rc)
2287 return rc;
2288
2289 rc = security_context_to_sid(value, size, &newsid);
2290 if (rc)
2291 return rc;
2292
2293 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2294 FILE__RELABELTO, &ad);
2295 if (rc)
2296 return rc;
2297
2298 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2299 isec->sclass);
2300 if (rc)
2301 return rc;
2302
2303 return avc_has_perm(newsid,
2304 sbsec->sid,
2305 SECCLASS_FILESYSTEM,
2306 FILESYSTEM__ASSOCIATE,
2307 &ad);
2308 }
2309
2310 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2311 void *value, size_t size, int flags)
2312 {
2313 struct inode *inode = dentry->d_inode;
2314 struct inode_security_struct *isec = inode->i_security;
2315 u32 newsid;
2316 int rc;
2317
2318 if (strcmp(name, XATTR_NAME_SELINUX)) {
2319 /* Not an attribute we recognize, so nothing to do. */
2320 return;
2321 }
2322
2323 rc = security_context_to_sid(value, size, &newsid);
2324 if (rc) {
2325 printk(KERN_WARNING "%s: unable to obtain SID for context "
2326 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2327 return;
2328 }
2329
2330 isec->sid = newsid;
2331 return;
2332 }
2333
2334 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2335 {
2336 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2337 }
2338
2339 static int selinux_inode_listxattr (struct dentry *dentry)
2340 {
2341 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2342 }
2343
2344 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2345 {
2346 if (strcmp(name, XATTR_NAME_SELINUX)) {
2347 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2348 sizeof XATTR_SECURITY_PREFIX - 1) &&
2349 !capable(CAP_SYS_ADMIN)) {
2350 /* A different attribute in the security namespace.
2351 Restrict to administrator. */
2352 return -EPERM;
2353 }
2354
2355 /* Not an attribute we recognize, so just check the
2356 ordinary setattr permission. Might want a separate
2357 permission for removexattr. */
2358 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2359 }
2360
2361 /* No one is allowed to remove a SELinux security label.
2362 You can change the label, but all data must be labeled. */
2363 return -EACCES;
2364 }
2365
2366 static const char *selinux_inode_xattr_getsuffix(void)
2367 {
2368 return XATTR_SELINUX_SUFFIX;
2369 }
2370
2371 /*
2372 * Copy the in-core inode security context value to the user. If the
2373 * getxattr() prior to this succeeded, check to see if we need to
2374 * canonicalize the value to be finally returned to the user.
2375 *
2376 * Permission check is handled by selinux_inode_getxattr hook.
2377 */
2378 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2379 {
2380 struct inode_security_struct *isec = inode->i_security;
2381
2382 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2383 return -EOPNOTSUPP;
2384
2385 return selinux_getsecurity(isec->sid, buffer, size);
2386 }
2387
2388 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2389 const void *value, size_t size, int flags)
2390 {
2391 struct inode_security_struct *isec = inode->i_security;
2392 u32 newsid;
2393 int rc;
2394
2395 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2396 return -EOPNOTSUPP;
2397
2398 if (!value || !size)
2399 return -EACCES;
2400
2401 rc = security_context_to_sid((void*)value, size, &newsid);
2402 if (rc)
2403 return rc;
2404
2405 isec->sid = newsid;
2406 return 0;
2407 }
2408
2409 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2410 {
2411 const int len = sizeof(XATTR_NAME_SELINUX);
2412 if (buffer && len <= buffer_size)
2413 memcpy(buffer, XATTR_NAME_SELINUX, len);
2414 return len;
2415 }
2416
2417 /* file security operations */
2418
2419 static int selinux_file_permission(struct file *file, int mask)
2420 {
2421 int rc;
2422 struct inode *inode = file->f_path.dentry->d_inode;
2423
2424 if (!mask) {
2425 /* No permission to check. Existence test. */
2426 return 0;
2427 }
2428
2429 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2430 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2431 mask |= MAY_APPEND;
2432
2433 rc = file_has_perm(current, file,
2434 file_mask_to_av(inode->i_mode, mask));
2435 if (rc)
2436 return rc;
2437
2438 return selinux_netlbl_inode_permission(inode, mask);
2439 }
2440
2441 static int selinux_file_alloc_security(struct file *file)
2442 {
2443 return file_alloc_security(file);
2444 }
2445
2446 static void selinux_file_free_security(struct file *file)
2447 {
2448 file_free_security(file);
2449 }
2450
2451 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2452 unsigned long arg)
2453 {
2454 int error = 0;
2455
2456 switch (cmd) {
2457 case FIONREAD:
2458 /* fall through */
2459 case FIBMAP:
2460 /* fall through */
2461 case FIGETBSZ:
2462 /* fall through */
2463 case EXT2_IOC_GETFLAGS:
2464 /* fall through */
2465 case EXT2_IOC_GETVERSION:
2466 error = file_has_perm(current, file, FILE__GETATTR);
2467 break;
2468
2469 case EXT2_IOC_SETFLAGS:
2470 /* fall through */
2471 case EXT2_IOC_SETVERSION:
2472 error = file_has_perm(current, file, FILE__SETATTR);
2473 break;
2474
2475 /* sys_ioctl() checks */
2476 case FIONBIO:
2477 /* fall through */
2478 case FIOASYNC:
2479 error = file_has_perm(current, file, 0);
2480 break;
2481
2482 case KDSKBENT:
2483 case KDSKBSENT:
2484 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2485 break;
2486
2487 /* default case assumes that the command will go
2488 * to the file's ioctl() function.
2489 */
2490 default:
2491 error = file_has_perm(current, file, FILE__IOCTL);
2492
2493 }
2494 return error;
2495 }
2496
2497 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2498 {
2499 #ifndef CONFIG_PPC32
2500 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2501 /*
2502 * We are making executable an anonymous mapping or a
2503 * private file mapping that will also be writable.
2504 * This has an additional check.
2505 */
2506 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2507 if (rc)
2508 return rc;
2509 }
2510 #endif
2511
2512 if (file) {
2513 /* read access is always possible with a mapping */
2514 u32 av = FILE__READ;
2515
2516 /* write access only matters if the mapping is shared */
2517 if (shared && (prot & PROT_WRITE))
2518 av |= FILE__WRITE;
2519
2520 if (prot & PROT_EXEC)
2521 av |= FILE__EXECUTE;
2522
2523 return file_has_perm(current, file, av);
2524 }
2525 return 0;
2526 }
2527
2528 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2529 unsigned long prot, unsigned long flags)
2530 {
2531 int rc;
2532
2533 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2534 if (rc)
2535 return rc;
2536
2537 if (selinux_checkreqprot)
2538 prot = reqprot;
2539
2540 return file_map_prot_check(file, prot,
2541 (flags & MAP_TYPE) == MAP_SHARED);
2542 }
2543
2544 static int selinux_file_mprotect(struct vm_area_struct *vma,
2545 unsigned long reqprot,
2546 unsigned long prot)
2547 {
2548 int rc;
2549
2550 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2551 if (rc)
2552 return rc;
2553
2554 if (selinux_checkreqprot)
2555 prot = reqprot;
2556
2557 #ifndef CONFIG_PPC32
2558 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2559 rc = 0;
2560 if (vma->vm_start >= vma->vm_mm->start_brk &&
2561 vma->vm_end <= vma->vm_mm->brk) {
2562 rc = task_has_perm(current, current,
2563 PROCESS__EXECHEAP);
2564 } else if (!vma->vm_file &&
2565 vma->vm_start <= vma->vm_mm->start_stack &&
2566 vma->vm_end >= vma->vm_mm->start_stack) {
2567 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2568 } else if (vma->vm_file && vma->anon_vma) {
2569 /*
2570 * We are making executable a file mapping that has
2571 * had some COW done. Since pages might have been
2572 * written, check ability to execute the possibly
2573 * modified content. This typically should only
2574 * occur for text relocations.
2575 */
2576 rc = file_has_perm(current, vma->vm_file,
2577 FILE__EXECMOD);
2578 }
2579 if (rc)
2580 return rc;
2581 }
2582 #endif
2583
2584 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2585 }
2586
2587 static int selinux_file_lock(struct file *file, unsigned int cmd)
2588 {
2589 return file_has_perm(current, file, FILE__LOCK);
2590 }
2591
2592 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2593 unsigned long arg)
2594 {
2595 int err = 0;
2596
2597 switch (cmd) {
2598 case F_SETFL:
2599 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2600 err = -EINVAL;
2601 break;
2602 }
2603
2604 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2605 err = file_has_perm(current, file,FILE__WRITE);
2606 break;
2607 }
2608 /* fall through */
2609 case F_SETOWN:
2610 case F_SETSIG:
2611 case F_GETFL:
2612 case F_GETOWN:
2613 case F_GETSIG:
2614 /* Just check FD__USE permission */
2615 err = file_has_perm(current, file, 0);
2616 break;
2617 case F_GETLK:
2618 case F_SETLK:
2619 case F_SETLKW:
2620 #if BITS_PER_LONG == 32
2621 case F_GETLK64:
2622 case F_SETLK64:
2623 case F_SETLKW64:
2624 #endif
2625 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2626 err = -EINVAL;
2627 break;
2628 }
2629 err = file_has_perm(current, file, FILE__LOCK);
2630 break;
2631 }
2632
2633 return err;
2634 }
2635
2636 static int selinux_file_set_fowner(struct file *file)
2637 {
2638 struct task_security_struct *tsec;
2639 struct file_security_struct *fsec;
2640
2641 tsec = current->security;
2642 fsec = file->f_security;
2643 fsec->fown_sid = tsec->sid;
2644
2645 return 0;
2646 }
2647
2648 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2649 struct fown_struct *fown, int signum)
2650 {
2651 struct file *file;
2652 u32 perm;
2653 struct task_security_struct *tsec;
2654 struct file_security_struct *fsec;
2655
2656 /* struct fown_struct is never outside the context of a struct file */
2657 file = container_of(fown, struct file, f_owner);
2658
2659 tsec = tsk->security;
2660 fsec = file->f_security;
2661
2662 if (!signum)
2663 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2664 else
2665 perm = signal_to_av(signum);
2666
2667 return avc_has_perm(fsec->fown_sid, tsec->sid,
2668 SECCLASS_PROCESS, perm, NULL);
2669 }
2670
2671 static int selinux_file_receive(struct file *file)
2672 {
2673 return file_has_perm(current, file, file_to_av(file));
2674 }
2675
2676 /* task security operations */
2677
2678 static int selinux_task_create(unsigned long clone_flags)
2679 {
2680 int rc;
2681
2682 rc = secondary_ops->task_create(clone_flags);
2683 if (rc)
2684 return rc;
2685
2686 return task_has_perm(current, current, PROCESS__FORK);
2687 }
2688
2689 static int selinux_task_alloc_security(struct task_struct *tsk)
2690 {
2691 struct task_security_struct *tsec1, *tsec2;
2692 int rc;
2693
2694 tsec1 = current->security;
2695
2696 rc = task_alloc_security(tsk);
2697 if (rc)
2698 return rc;
2699 tsec2 = tsk->security;
2700
2701 tsec2->osid = tsec1->osid;
2702 tsec2->sid = tsec1->sid;
2703
2704 /* Retain the exec, fs, key, and sock SIDs across fork */
2705 tsec2->exec_sid = tsec1->exec_sid;
2706 tsec2->create_sid = tsec1->create_sid;
2707 tsec2->keycreate_sid = tsec1->keycreate_sid;
2708 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2709
2710 /* Retain ptracer SID across fork, if any.
2711 This will be reset by the ptrace hook upon any
2712 subsequent ptrace_attach operations. */
2713 tsec2->ptrace_sid = tsec1->ptrace_sid;
2714
2715 return 0;
2716 }
2717
2718 static void selinux_task_free_security(struct task_struct *tsk)
2719 {
2720 task_free_security(tsk);
2721 }
2722
2723 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2724 {
2725 /* Since setuid only affects the current process, and
2726 since the SELinux controls are not based on the Linux
2727 identity attributes, SELinux does not need to control
2728 this operation. However, SELinux does control the use
2729 of the CAP_SETUID and CAP_SETGID capabilities using the
2730 capable hook. */
2731 return 0;
2732 }
2733
2734 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2735 {
2736 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2737 }
2738
2739 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2740 {
2741 /* See the comment for setuid above. */
2742 return 0;
2743 }
2744
2745 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2746 {
2747 return task_has_perm(current, p, PROCESS__SETPGID);
2748 }
2749
2750 static int selinux_task_getpgid(struct task_struct *p)
2751 {
2752 return task_has_perm(current, p, PROCESS__GETPGID);
2753 }
2754
2755 static int selinux_task_getsid(struct task_struct *p)
2756 {
2757 return task_has_perm(current, p, PROCESS__GETSESSION);
2758 }
2759
2760 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2761 {
2762 selinux_get_task_sid(p, secid);
2763 }
2764
2765 static int selinux_task_setgroups(struct group_info *group_info)
2766 {
2767 /* See the comment for setuid above. */
2768 return 0;
2769 }
2770
2771 static int selinux_task_setnice(struct task_struct *p, int nice)
2772 {
2773 int rc;
2774
2775 rc = secondary_ops->task_setnice(p, nice);
2776 if (rc)
2777 return rc;
2778
2779 return task_has_perm(current,p, PROCESS__SETSCHED);
2780 }
2781
2782 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2783 {
2784 return task_has_perm(current, p, PROCESS__SETSCHED);
2785 }
2786
2787 static int selinux_task_getioprio(struct task_struct *p)
2788 {
2789 return task_has_perm(current, p, PROCESS__GETSCHED);
2790 }
2791
2792 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2793 {
2794 struct rlimit *old_rlim = current->signal->rlim + resource;
2795 int rc;
2796
2797 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2798 if (rc)
2799 return rc;
2800
2801 /* Control the ability to change the hard limit (whether
2802 lowering or raising it), so that the hard limit can
2803 later be used as a safe reset point for the soft limit
2804 upon context transitions. See selinux_bprm_apply_creds. */
2805 if (old_rlim->rlim_max != new_rlim->rlim_max)
2806 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2807
2808 return 0;
2809 }
2810
2811 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2812 {
2813 return task_has_perm(current, p, PROCESS__SETSCHED);
2814 }
2815
2816 static int selinux_task_getscheduler(struct task_struct *p)
2817 {
2818 return task_has_perm(current, p, PROCESS__GETSCHED);
2819 }
2820
2821 static int selinux_task_movememory(struct task_struct *p)
2822 {
2823 return task_has_perm(current, p, PROCESS__SETSCHED);
2824 }
2825
2826 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2827 int sig, u32 secid)
2828 {
2829 u32 perm;
2830 int rc;
2831 struct task_security_struct *tsec;
2832
2833 rc = secondary_ops->task_kill(p, info, sig, secid);
2834 if (rc)
2835 return rc;
2836
2837 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2838 return 0;
2839
2840 if (!sig)
2841 perm = PROCESS__SIGNULL; /* null signal; existence test */
2842 else
2843 perm = signal_to_av(sig);
2844 tsec = p->security;
2845 if (secid)
2846 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2847 else
2848 rc = task_has_perm(current, p, perm);
2849 return rc;
2850 }
2851
2852 static int selinux_task_prctl(int option,
2853 unsigned long arg2,
2854 unsigned long arg3,
2855 unsigned long arg4,
2856 unsigned long arg5)
2857 {
2858 /* The current prctl operations do not appear to require
2859 any SELinux controls since they merely observe or modify
2860 the state of the current process. */
2861 return 0;
2862 }
2863
2864 static int selinux_task_wait(struct task_struct *p)
2865 {
2866 u32 perm;
2867
2868 perm = signal_to_av(p->exit_signal);
2869
2870 return task_has_perm(p, current, perm);
2871 }
2872
2873 static void selinux_task_reparent_to_init(struct task_struct *p)
2874 {
2875 struct task_security_struct *tsec;
2876
2877 secondary_ops->task_reparent_to_init(p);
2878
2879 tsec = p->security;
2880 tsec->osid = tsec->sid;
2881 tsec->sid = SECINITSID_KERNEL;
2882 return;
2883 }
2884
2885 static void selinux_task_to_inode(struct task_struct *p,
2886 struct inode *inode)
2887 {
2888 struct task_security_struct *tsec = p->security;
2889 struct inode_security_struct *isec = inode->i_security;
2890
2891 isec->sid = tsec->sid;
2892 isec->initialized = 1;
2893 return;
2894 }
2895
2896 /* Returns error only if unable to parse addresses */
2897 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2898 struct avc_audit_data *ad, u8 *proto)
2899 {
2900 int offset, ihlen, ret = -EINVAL;
2901 struct iphdr _iph, *ih;
2902
2903 offset = skb->nh.raw - skb->data;
2904 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2905 if (ih == NULL)
2906 goto out;
2907
2908 ihlen = ih->ihl * 4;
2909 if (ihlen < sizeof(_iph))
2910 goto out;
2911
2912 ad->u.net.v4info.saddr = ih->saddr;
2913 ad->u.net.v4info.daddr = ih->daddr;
2914 ret = 0;
2915
2916 if (proto)
2917 *proto = ih->protocol;
2918
2919 switch (ih->protocol) {
2920 case IPPROTO_TCP: {
2921 struct tcphdr _tcph, *th;
2922
2923 if (ntohs(ih->frag_off) & IP_OFFSET)
2924 break;
2925
2926 offset += ihlen;
2927 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2928 if (th == NULL)
2929 break;
2930
2931 ad->u.net.sport = th->source;
2932 ad->u.net.dport = th->dest;
2933 break;
2934 }
2935
2936 case IPPROTO_UDP: {
2937 struct udphdr _udph, *uh;
2938
2939 if (ntohs(ih->frag_off) & IP_OFFSET)
2940 break;
2941
2942 offset += ihlen;
2943 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2944 if (uh == NULL)
2945 break;
2946
2947 ad->u.net.sport = uh->source;
2948 ad->u.net.dport = uh->dest;
2949 break;
2950 }
2951
2952 case IPPROTO_DCCP: {
2953 struct dccp_hdr _dccph, *dh;
2954
2955 if (ntohs(ih->frag_off) & IP_OFFSET)
2956 break;
2957
2958 offset += ihlen;
2959 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
2960 if (dh == NULL)
2961 break;
2962
2963 ad->u.net.sport = dh->dccph_sport;
2964 ad->u.net.dport = dh->dccph_dport;
2965 break;
2966 }
2967
2968 default:
2969 break;
2970 }
2971 out:
2972 return ret;
2973 }
2974
2975 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2976
2977 /* Returns error only if unable to parse addresses */
2978 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
2979 struct avc_audit_data *ad, u8 *proto)
2980 {
2981 u8 nexthdr;
2982 int ret = -EINVAL, offset;
2983 struct ipv6hdr _ipv6h, *ip6;
2984
2985 offset = skb->nh.raw - skb->data;
2986 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2987 if (ip6 == NULL)
2988 goto out;
2989
2990 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2991 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2992 ret = 0;
2993
2994 nexthdr = ip6->nexthdr;
2995 offset += sizeof(_ipv6h);
2996 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2997 if (offset < 0)
2998 goto out;
2999
3000 if (proto)
3001 *proto = nexthdr;
3002
3003 switch (nexthdr) {
3004 case IPPROTO_TCP: {
3005 struct tcphdr _tcph, *th;
3006
3007 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3008 if (th == NULL)
3009 break;
3010
3011 ad->u.net.sport = th->source;
3012 ad->u.net.dport = th->dest;
3013 break;
3014 }
3015
3016 case IPPROTO_UDP: {
3017 struct udphdr _udph, *uh;
3018
3019 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3020 if (uh == NULL)
3021 break;
3022
3023 ad->u.net.sport = uh->source;
3024 ad->u.net.dport = uh->dest;
3025 break;
3026 }
3027
3028 case IPPROTO_DCCP: {
3029 struct dccp_hdr _dccph, *dh;
3030
3031 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3032 if (dh == NULL)
3033 break;
3034
3035 ad->u.net.sport = dh->dccph_sport;
3036 ad->u.net.dport = dh->dccph_dport;
3037 break;
3038 }
3039
3040 /* includes fragments */
3041 default:
3042 break;
3043 }
3044 out:
3045 return ret;
3046 }
3047
3048 #endif /* IPV6 */
3049
3050 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3051 char **addrp, int *len, int src, u8 *proto)
3052 {
3053 int ret = 0;
3054
3055 switch (ad->u.net.family) {
3056 case PF_INET:
3057 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3058 if (ret || !addrp)
3059 break;
3060 *len = 4;
3061 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3062 &ad->u.net.v4info.daddr);
3063 break;
3064
3065 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3066 case PF_INET6:
3067 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3068 if (ret || !addrp)
3069 break;
3070 *len = 16;
3071 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3072 &ad->u.net.v6info.daddr);
3073 break;
3074 #endif /* IPV6 */
3075 default:
3076 break;
3077 }
3078
3079 return ret;
3080 }
3081
3082 /* socket security operations */
3083 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3084 u32 perms)
3085 {
3086 struct inode_security_struct *isec;
3087 struct task_security_struct *tsec;
3088 struct avc_audit_data ad;
3089 int err = 0;
3090
3091 tsec = task->security;
3092 isec = SOCK_INODE(sock)->i_security;
3093
3094 if (isec->sid == SECINITSID_KERNEL)
3095 goto out;
3096
3097 AVC_AUDIT_DATA_INIT(&ad,NET);
3098 ad.u.net.sk = sock->sk;
3099 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3100
3101 out:
3102 return err;
3103 }
3104
3105 static int selinux_socket_create(int family, int type,
3106 int protocol, int kern)
3107 {
3108 int err = 0;
3109 struct task_security_struct *tsec;
3110 u32 newsid;
3111
3112 if (kern)
3113 goto out;
3114
3115 tsec = current->security;
3116 newsid = tsec->sockcreate_sid ? : tsec->sid;
3117 err = avc_has_perm(tsec->sid, newsid,
3118 socket_type_to_security_class(family, type,
3119 protocol), SOCKET__CREATE, NULL);
3120
3121 out:
3122 return err;
3123 }
3124
3125 static int selinux_socket_post_create(struct socket *sock, int family,
3126 int type, int protocol, int kern)
3127 {
3128 int err = 0;
3129 struct inode_security_struct *isec;
3130 struct task_security_struct *tsec;
3131 struct sk_security_struct *sksec;
3132 u32 newsid;
3133
3134 isec = SOCK_INODE(sock)->i_security;
3135
3136 tsec = current->security;
3137 newsid = tsec->sockcreate_sid ? : tsec->sid;
3138 isec->sclass = socket_type_to_security_class(family, type, protocol);
3139 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3140 isec->initialized = 1;
3141
3142 if (sock->sk) {
3143 sksec = sock->sk->sk_security;
3144 sksec->sid = isec->sid;
3145 err = selinux_netlbl_socket_post_create(sock);
3146 }
3147
3148 return err;
3149 }
3150
3151 /* Range of port numbers used to automatically bind.
3152 Need to determine whether we should perform a name_bind
3153 permission check between the socket and the port number. */
3154 #define ip_local_port_range_0 sysctl_local_port_range[0]
3155 #define ip_local_port_range_1 sysctl_local_port_range[1]
3156
3157 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3158 {
3159 u16 family;
3160 int err;
3161
3162 err = socket_has_perm(current, sock, SOCKET__BIND);
3163 if (err)
3164 goto out;
3165
3166 /*
3167 * If PF_INET or PF_INET6, check name_bind permission for the port.
3168 * Multiple address binding for SCTP is not supported yet: we just
3169 * check the first address now.
3170 */
3171 family = sock->sk->sk_family;
3172 if (family == PF_INET || family == PF_INET6) {
3173 char *addrp;
3174 struct inode_security_struct *isec;
3175 struct task_security_struct *tsec;
3176 struct avc_audit_data ad;
3177 struct sockaddr_in *addr4 = NULL;
3178 struct sockaddr_in6 *addr6 = NULL;
3179 unsigned short snum;
3180 struct sock *sk = sock->sk;
3181 u32 sid, node_perm, addrlen;
3182
3183 tsec = current->security;
3184 isec = SOCK_INODE(sock)->i_security;
3185
3186 if (family == PF_INET) {
3187 addr4 = (struct sockaddr_in *)address;
3188 snum = ntohs(addr4->sin_port);
3189 addrlen = sizeof(addr4->sin_addr.s_addr);
3190 addrp = (char *)&addr4->sin_addr.s_addr;
3191 } else {
3192 addr6 = (struct sockaddr_in6 *)address;
3193 snum = ntohs(addr6->sin6_port);
3194 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3195 addrp = (char *)&addr6->sin6_addr.s6_addr;
3196 }
3197
3198 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3199 snum > ip_local_port_range_1)) {
3200 err = security_port_sid(sk->sk_family, sk->sk_type,
3201 sk->sk_protocol, snum, &sid);
3202 if (err)
3203 goto out;
3204 AVC_AUDIT_DATA_INIT(&ad,NET);
3205 ad.u.net.sport = htons(snum);
3206 ad.u.net.family = family;
3207 err = avc_has_perm(isec->sid, sid,
3208 isec->sclass,
3209 SOCKET__NAME_BIND, &ad);
3210 if (err)
3211 goto out;
3212 }
3213
3214 switch(isec->sclass) {
3215 case SECCLASS_TCP_SOCKET:
3216 node_perm = TCP_SOCKET__NODE_BIND;
3217 break;
3218
3219 case SECCLASS_UDP_SOCKET:
3220 node_perm = UDP_SOCKET__NODE_BIND;
3221 break;
3222
3223 case SECCLASS_DCCP_SOCKET:
3224 node_perm = DCCP_SOCKET__NODE_BIND;
3225 break;
3226
3227 default:
3228 node_perm = RAWIP_SOCKET__NODE_BIND;
3229 break;
3230 }
3231
3232 err = security_node_sid(family, addrp, addrlen, &sid);
3233 if (err)
3234 goto out;
3235
3236 AVC_AUDIT_DATA_INIT(&ad,NET);
3237 ad.u.net.sport = htons(snum);
3238 ad.u.net.family = family;
3239
3240 if (family == PF_INET)
3241 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3242 else
3243 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3244
3245 err = avc_has_perm(isec->sid, sid,
3246 isec->sclass, node_perm, &ad);
3247 if (err)
3248 goto out;
3249 }
3250 out:
3251 return err;
3252 }
3253
3254 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3255 {
3256 struct inode_security_struct *isec;
3257 int err;
3258
3259 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3260 if (err)
3261 return err;
3262
3263 /*
3264 * If a TCP or DCCP socket, check name_connect permission for the port.
3265 */
3266 isec = SOCK_INODE(sock)->i_security;
3267 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3268 isec->sclass == SECCLASS_DCCP_SOCKET) {
3269 struct sock *sk = sock->sk;
3270 struct avc_audit_data ad;
3271 struct sockaddr_in *addr4 = NULL;
3272 struct sockaddr_in6 *addr6 = NULL;
3273 unsigned short snum;
3274 u32 sid, perm;
3275
3276 if (sk->sk_family == PF_INET) {
3277 addr4 = (struct sockaddr_in *)address;
3278 if (addrlen < sizeof(struct sockaddr_in))
3279 return -EINVAL;
3280 snum = ntohs(addr4->sin_port);
3281 } else {
3282 addr6 = (struct sockaddr_in6 *)address;
3283 if (addrlen < SIN6_LEN_RFC2133)
3284 return -EINVAL;
3285 snum = ntohs(addr6->sin6_port);
3286 }
3287
3288 err = security_port_sid(sk->sk_family, sk->sk_type,
3289 sk->sk_protocol, snum, &sid);
3290 if (err)
3291 goto out;
3292
3293 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3294 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3295
3296 AVC_AUDIT_DATA_INIT(&ad,NET);
3297 ad.u.net.dport = htons(snum);
3298 ad.u.net.family = sk->sk_family;
3299 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3300 if (err)
3301 goto out;
3302 }
3303
3304 out:
3305 return err;
3306 }
3307
3308 static int selinux_socket_listen(struct socket *sock, int backlog)
3309 {
3310 return socket_has_perm(current, sock, SOCKET__LISTEN);
3311 }
3312
3313 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3314 {
3315 int err;
3316 struct inode_security_struct *isec;
3317 struct inode_security_struct *newisec;
3318
3319 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3320 if (err)
3321 return err;
3322
3323 newisec = SOCK_INODE(newsock)->i_security;
3324
3325 isec = SOCK_INODE(sock)->i_security;
3326 newisec->sclass = isec->sclass;
3327 newisec->sid = isec->sid;
3328 newisec->initialized = 1;
3329
3330 return 0;
3331 }
3332
3333 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3334 int size)
3335 {
3336 int rc;
3337
3338 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3339 if (rc)
3340 return rc;
3341
3342 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3343 }
3344
3345 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3346 int size, int flags)
3347 {
3348 return socket_has_perm(current, sock, SOCKET__READ);
3349 }
3350
3351 static int selinux_socket_getsockname(struct socket *sock)
3352 {
3353 return socket_has_perm(current, sock, SOCKET__GETATTR);
3354 }
3355
3356 static int selinux_socket_getpeername(struct socket *sock)
3357 {
3358 return socket_has_perm(current, sock, SOCKET__GETATTR);
3359 }
3360
3361 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3362 {
3363 int err;
3364
3365 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3366 if (err)
3367 return err;
3368
3369 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3370 }
3371
3372 static int selinux_socket_getsockopt(struct socket *sock, int level,
3373 int optname)
3374 {
3375 return socket_has_perm(current, sock, SOCKET__GETOPT);
3376 }
3377
3378 static int selinux_socket_shutdown(struct socket *sock, int how)
3379 {
3380 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3381 }
3382
3383 static int selinux_socket_unix_stream_connect(struct socket *sock,
3384 struct socket *other,
3385 struct sock *newsk)
3386 {
3387 struct sk_security_struct *ssec;
3388 struct inode_security_struct *isec;
3389 struct inode_security_struct *other_isec;
3390 struct avc_audit_data ad;
3391 int err;
3392
3393 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3394 if (err)
3395 return err;
3396
3397 isec = SOCK_INODE(sock)->i_security;
3398 other_isec = SOCK_INODE(other)->i_security;
3399
3400 AVC_AUDIT_DATA_INIT(&ad,NET);
3401 ad.u.net.sk = other->sk;
3402
3403 err = avc_has_perm(isec->sid, other_isec->sid,
3404 isec->sclass,
3405 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3406 if (err)
3407 return err;
3408
3409 /* connecting socket */
3410 ssec = sock->sk->sk_security;
3411 ssec->peer_sid = other_isec->sid;
3412
3413 /* server child socket */
3414 ssec = newsk->sk_security;
3415 ssec->peer_sid = isec->sid;
3416 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3417
3418 return err;
3419 }
3420
3421 static int selinux_socket_unix_may_send(struct socket *sock,
3422 struct socket *other)
3423 {
3424 struct inode_security_struct *isec;
3425 struct inode_security_struct *other_isec;
3426 struct avc_audit_data ad;
3427 int err;
3428
3429 isec = SOCK_INODE(sock)->i_security;
3430 other_isec = SOCK_INODE(other)->i_security;
3431
3432 AVC_AUDIT_DATA_INIT(&ad,NET);
3433 ad.u.net.sk = other->sk;
3434
3435 err = avc_has_perm(isec->sid, other_isec->sid,
3436 isec->sclass, SOCKET__SENDTO, &ad);
3437 if (err)
3438 return err;
3439
3440 return 0;
3441 }
3442
3443 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3444 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3445 {
3446 int err = 0;
3447 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3448 struct socket *sock;
3449 u16 sock_class = 0;
3450 u32 sock_sid = 0;
3451
3452 read_lock_bh(&sk->sk_callback_lock);
3453 sock = sk->sk_socket;
3454 if (sock) {
3455 struct inode *inode;
3456 inode = SOCK_INODE(sock);
3457 if (inode) {
3458 struct inode_security_struct *isec;
3459 isec = inode->i_security;
3460 sock_sid = isec->sid;
3461 sock_class = isec->sclass;
3462 }
3463 }
3464 read_unlock_bh(&sk->sk_callback_lock);
3465 if (!sock_sid)
3466 goto out;
3467
3468 if (!skb->dev)
3469 goto out;
3470
3471 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3472 if (err)
3473 goto out;
3474
3475 switch (sock_class) {
3476 case SECCLASS_UDP_SOCKET:
3477 netif_perm = NETIF__UDP_RECV;
3478 node_perm = NODE__UDP_RECV;
3479 recv_perm = UDP_SOCKET__RECV_MSG;
3480 break;
3481
3482 case SECCLASS_TCP_SOCKET:
3483 netif_perm = NETIF__TCP_RECV;
3484 node_perm = NODE__TCP_RECV;
3485 recv_perm = TCP_SOCKET__RECV_MSG;
3486 break;
3487
3488 case SECCLASS_DCCP_SOCKET:
3489 netif_perm = NETIF__DCCP_RECV;
3490 node_perm = NODE__DCCP_RECV;
3491 recv_perm = DCCP_SOCKET__RECV_MSG;
3492 break;
3493
3494 default:
3495 netif_perm = NETIF__RAWIP_RECV;
3496 node_perm = NODE__RAWIP_RECV;
3497 break;
3498 }
3499
3500 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3501 if (err)
3502 goto out;
3503
3504 err = security_node_sid(family, addrp, len, &node_sid);
3505 if (err)
3506 goto out;
3507
3508 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3509 if (err)
3510 goto out;
3511
3512 if (recv_perm) {
3513 u32 port_sid;
3514
3515 err = security_port_sid(sk->sk_family, sk->sk_type,
3516 sk->sk_protocol, ntohs(ad->u.net.sport),
3517 &port_sid);
3518 if (err)
3519 goto out;
3520
3521 err = avc_has_perm(sock_sid, port_sid,
3522 sock_class, recv_perm, ad);
3523 }
3524
3525 out:
3526 return err;
3527 }
3528
3529 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3530 {
3531 u16 family;
3532 char *addrp;
3533 int len, err = 0;
3534 struct avc_audit_data ad;
3535 struct sk_security_struct *sksec = sk->sk_security;
3536
3537 family = sk->sk_family;
3538 if (family != PF_INET && family != PF_INET6)
3539 goto out;
3540
3541 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3542 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3543 family = PF_INET;
3544
3545 AVC_AUDIT_DATA_INIT(&ad, NET);
3546 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3547 ad.u.net.family = family;
3548
3549 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3550 if (err)
3551 goto out;
3552
3553 if (selinux_compat_net)
3554 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3555 addrp, len);
3556 else
3557 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3558 PACKET__RECV, &ad);
3559 if (err)
3560 goto out;
3561
3562 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3563 if (err)
3564 goto out;
3565
3566 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3567 out:
3568 return err;
3569 }
3570
3571 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3572 int __user *optlen, unsigned len)
3573 {
3574 int err = 0;
3575 char *scontext;
3576 u32 scontext_len;
3577 struct sk_security_struct *ssec;
3578 struct inode_security_struct *isec;
3579 u32 peer_sid = SECSID_NULL;
3580
3581 isec = SOCK_INODE(sock)->i_security;
3582
3583 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3584 isec->sclass == SECCLASS_TCP_SOCKET) {
3585 ssec = sock->sk->sk_security;
3586 peer_sid = ssec->peer_sid;
3587 }
3588 if (peer_sid == SECSID_NULL) {
3589 err = -ENOPROTOOPT;
3590 goto out;
3591 }
3592
3593 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3594
3595 if (err)
3596 goto out;
3597
3598 if (scontext_len > len) {
3599 err = -ERANGE;
3600 goto out_len;
3601 }
3602
3603 if (copy_to_user(optval, scontext, scontext_len))
3604 err = -EFAULT;
3605
3606 out_len:
3607 if (put_user(scontext_len, optlen))
3608 err = -EFAULT;
3609
3610 kfree(scontext);
3611 out:
3612 return err;
3613 }
3614
3615 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3616 {
3617 u32 peer_secid = SECSID_NULL;
3618 int err = 0;
3619
3620 if (sock && sock->sk->sk_family == PF_UNIX)
3621 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3622 else if (skb)
3623 security_skb_extlbl_sid(skb,
3624 SECINITSID_UNLABELED,
3625 &peer_secid);
3626
3627 if (peer_secid == SECSID_NULL)
3628 err = -EINVAL;
3629 *secid = peer_secid;
3630
3631 return err;
3632 }
3633
3634 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3635 {
3636 return sk_alloc_security(sk, family, priority);
3637 }
3638
3639 static void selinux_sk_free_security(struct sock *sk)
3640 {
3641 sk_free_security(sk);
3642 }
3643
3644 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3645 {
3646 struct sk_security_struct *ssec = sk->sk_security;
3647 struct sk_security_struct *newssec = newsk->sk_security;
3648
3649 newssec->sid = ssec->sid;
3650 newssec->peer_sid = ssec->peer_sid;
3651
3652 selinux_netlbl_sk_security_clone(ssec, newssec);
3653 }
3654
3655 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3656 {
3657 if (!sk)
3658 *secid = SECINITSID_ANY_SOCKET;
3659 else {
3660 struct sk_security_struct *sksec = sk->sk_security;
3661
3662 *secid = sksec->sid;
3663 }
3664 }
3665
3666 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3667 {
3668 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3669 struct sk_security_struct *sksec = sk->sk_security;
3670
3671 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3672 sk->sk_family == PF_UNIX)
3673 isec->sid = sksec->sid;
3674
3675 selinux_netlbl_sock_graft(sk, parent);
3676 }
3677
3678 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3679 struct request_sock *req)
3680 {
3681 struct sk_security_struct *sksec = sk->sk_security;
3682 int err;
3683 u32 newsid;
3684 u32 peersid;
3685
3686 security_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3687 if (peersid == SECSID_NULL) {
3688 req->secid = sksec->sid;
3689 req->peer_secid = SECSID_NULL;
3690 return 0;
3691 }
3692
3693 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3694 if (err)
3695 return err;
3696
3697 req->secid = newsid;
3698 req->peer_secid = peersid;
3699 return 0;
3700 }
3701
3702 static void selinux_inet_csk_clone(struct sock *newsk,
3703 const struct request_sock *req)
3704 {
3705 struct sk_security_struct *newsksec = newsk->sk_security;
3706
3707 newsksec->sid = req->secid;
3708 newsksec->peer_sid = req->peer_secid;
3709 /* NOTE: Ideally, we should also get the isec->sid for the
3710 new socket in sync, but we don't have the isec available yet.
3711 So we will wait until sock_graft to do it, by which
3712 time it will have been created and available. */
3713
3714 /* We don't need to take any sort of lock here as we are the only
3715 * thread with access to newsksec */
3716 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3717 }
3718
3719 static void selinux_inet_conn_established(struct sock *sk,
3720 struct sk_buff *skb)
3721 {
3722 struct sk_security_struct *sksec = sk->sk_security;
3723
3724 security_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3725 }
3726
3727 static void selinux_req_classify_flow(const struct request_sock *req,
3728 struct flowi *fl)
3729 {
3730 fl->secid = req->secid;
3731 }
3732
3733 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3734 {
3735 int err = 0;
3736 u32 perm;
3737 struct nlmsghdr *nlh;
3738 struct socket *sock = sk->sk_socket;
3739 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3740
3741 if (skb->len < NLMSG_SPACE(0)) {
3742 err = -EINVAL;
3743 goto out;
3744 }
3745 nlh = (struct nlmsghdr *)skb->data;
3746
3747 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3748 if (err) {
3749 if (err == -EINVAL) {
3750 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3751 "SELinux: unrecognized netlink message"
3752 " type=%hu for sclass=%hu\n",
3753 nlh->nlmsg_type, isec->sclass);
3754 if (!selinux_enforcing)
3755 err = 0;
3756 }
3757
3758 /* Ignore */
3759 if (err == -ENOENT)
3760 err = 0;
3761 goto out;
3762 }
3763
3764 err = socket_has_perm(current, sock, perm);
3765 out:
3766 return err;
3767 }
3768
3769 #ifdef CONFIG_NETFILTER
3770
3771 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3772 struct avc_audit_data *ad,
3773 u16 family, char *addrp, int len)
3774 {
3775 int err = 0;
3776 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3777 struct socket *sock;
3778 struct inode *inode;
3779 struct inode_security_struct *isec;
3780
3781 sock = sk->sk_socket;
3782 if (!sock)
3783 goto out;
3784
3785 inode = SOCK_INODE(sock);
3786 if (!inode)
3787 goto out;
3788
3789 isec = inode->i_security;
3790
3791 err = sel_netif_sids(dev, &if_sid, NULL);
3792 if (err)
3793 goto out;
3794
3795 switch (isec->sclass) {
3796 case SECCLASS_UDP_SOCKET:
3797 netif_perm = NETIF__UDP_SEND;
3798 node_perm = NODE__UDP_SEND;
3799 send_perm = UDP_SOCKET__SEND_MSG;
3800 break;
3801
3802 case SECCLASS_TCP_SOCKET:
3803 netif_perm = NETIF__TCP_SEND;
3804 node_perm = NODE__TCP_SEND;
3805 send_perm = TCP_SOCKET__SEND_MSG;
3806 break;
3807
3808 case SECCLASS_DCCP_SOCKET:
3809 netif_perm = NETIF__DCCP_SEND;
3810 node_perm = NODE__DCCP_SEND;
3811 send_perm = DCCP_SOCKET__SEND_MSG;
3812 break;
3813
3814 default:
3815 netif_perm = NETIF__RAWIP_SEND;
3816 node_perm = NODE__RAWIP_SEND;
3817 break;
3818 }
3819
3820 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3821 if (err)
3822 goto out;
3823
3824 err = security_node_sid(family, addrp, len, &node_sid);
3825 if (err)
3826 goto out;
3827
3828 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3829 if (err)
3830 goto out;
3831
3832 if (send_perm) {
3833 u32 port_sid;
3834
3835 err = security_port_sid(sk->sk_family,
3836 sk->sk_type,
3837 sk->sk_protocol,
3838 ntohs(ad->u.net.dport),
3839 &port_sid);
3840 if (err)
3841 goto out;
3842
3843 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3844 send_perm, ad);
3845 }
3846 out:
3847 return err;
3848 }
3849
3850 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3851 struct sk_buff **pskb,
3852 const struct net_device *in,
3853 const struct net_device *out,
3854 int (*okfn)(struct sk_buff *),
3855 u16 family)
3856 {
3857 char *addrp;
3858 int len, err = 0;
3859 struct sock *sk;
3860 struct sk_buff *skb = *pskb;
3861 struct avc_audit_data ad;
3862 struct net_device *dev = (struct net_device *)out;
3863 struct sk_security_struct *sksec;
3864 u8 proto;
3865
3866 sk = skb->sk;
3867 if (!sk)
3868 goto out;
3869
3870 sksec = sk->sk_security;
3871
3872 AVC_AUDIT_DATA_INIT(&ad, NET);
3873 ad.u.net.netif = dev->name;
3874 ad.u.net.family = family;
3875
3876 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3877 if (err)
3878 goto out;
3879
3880 if (selinux_compat_net)
3881 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3882 family, addrp, len);
3883 else
3884 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3885 PACKET__SEND, &ad);
3886
3887 if (err)
3888 goto out;
3889
3890 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3891 out:
3892 return err ? NF_DROP : NF_ACCEPT;
3893 }
3894
3895 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3896 struct sk_buff **pskb,
3897 const struct net_device *in,
3898 const struct net_device *out,
3899 int (*okfn)(struct sk_buff *))
3900 {
3901 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3902 }
3903
3904 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3905
3906 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3907 struct sk_buff **pskb,
3908 const struct net_device *in,
3909 const struct net_device *out,
3910 int (*okfn)(struct sk_buff *))
3911 {
3912 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3913 }
3914
3915 #endif /* IPV6 */
3916
3917 #endif /* CONFIG_NETFILTER */
3918
3919 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3920 {
3921 int err;
3922
3923 err = secondary_ops->netlink_send(sk, skb);
3924 if (err)
3925 return err;
3926
3927 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3928 err = selinux_nlmsg_perm(sk, skb);
3929
3930 return err;
3931 }
3932
3933 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3934 {
3935 int err;
3936 struct avc_audit_data ad;
3937
3938 err = secondary_ops->netlink_recv(skb, capability);
3939 if (err)
3940 return err;
3941
3942 AVC_AUDIT_DATA_INIT(&ad, CAP);
3943 ad.u.cap = capability;
3944
3945 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3946 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3947 }
3948
3949 static int ipc_alloc_security(struct task_struct *task,
3950 struct kern_ipc_perm *perm,
3951 u16 sclass)
3952 {
3953 struct task_security_struct *tsec = task->security;
3954 struct ipc_security_struct *isec;
3955
3956 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3957 if (!isec)
3958 return -ENOMEM;
3959
3960 isec->sclass = sclass;
3961 isec->ipc_perm = perm;
3962 isec->sid = tsec->sid;
3963 perm->security = isec;
3964
3965 return 0;
3966 }
3967
3968 static void ipc_free_security(struct kern_ipc_perm *perm)
3969 {
3970 struct ipc_security_struct *isec = perm->security;
3971 perm->security = NULL;
3972 kfree(isec);
3973 }
3974
3975 static int msg_msg_alloc_security(struct msg_msg *msg)
3976 {
3977 struct msg_security_struct *msec;
3978
3979 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3980 if (!msec)
3981 return -ENOMEM;
3982
3983 msec->msg = msg;
3984 msec->sid = SECINITSID_UNLABELED;
3985 msg->security = msec;
3986
3987 return 0;
3988 }
3989
3990 static void msg_msg_free_security(struct msg_msg *msg)
3991 {
3992 struct msg_security_struct *msec = msg->security;
3993
3994 msg->security = NULL;
3995 kfree(msec);
3996 }
3997
3998 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3999 u32 perms)
4000 {
4001 struct task_security_struct *tsec;
4002 struct ipc_security_struct *isec;
4003 struct avc_audit_data ad;
4004
4005 tsec = current->security;
4006 isec = ipc_perms->security;
4007
4008 AVC_AUDIT_DATA_INIT(&ad, IPC);
4009 ad.u.ipc_id = ipc_perms->key;
4010
4011 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4012 }
4013
4014 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4015 {
4016 return msg_msg_alloc_security(msg);
4017 }
4018
4019 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4020 {
4021 msg_msg_free_security(msg);
4022 }
4023
4024 /* message queue security operations */
4025 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4026 {
4027 struct task_security_struct *tsec;
4028 struct ipc_security_struct *isec;
4029 struct avc_audit_data ad;
4030 int rc;
4031
4032 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4033 if (rc)
4034 return rc;
4035
4036 tsec = current->security;
4037 isec = msq->q_perm.security;
4038
4039 AVC_AUDIT_DATA_INIT(&ad, IPC);
4040 ad.u.ipc_id = msq->q_perm.key;
4041
4042 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4043 MSGQ__CREATE, &ad);
4044 if (rc) {
4045 ipc_free_security(&msq->q_perm);
4046 return rc;
4047 }
4048 return 0;
4049 }
4050
4051 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4052 {
4053 ipc_free_security(&msq->q_perm);
4054 }
4055
4056 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4057 {
4058 struct task_security_struct *tsec;
4059 struct ipc_security_struct *isec;
4060 struct avc_audit_data ad;
4061
4062 tsec = current->security;
4063 isec = msq->q_perm.security;
4064
4065 AVC_AUDIT_DATA_INIT(&ad, IPC);
4066 ad.u.ipc_id = msq->q_perm.key;
4067
4068 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4069 MSGQ__ASSOCIATE, &ad);
4070 }
4071
4072 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4073 {
4074 int err;
4075 int perms;
4076
4077 switch(cmd) {
4078 case IPC_INFO:
4079 case MSG_INFO:
4080 /* No specific object, just general system-wide information. */
4081 return task_has_system(current, SYSTEM__IPC_INFO);
4082 case IPC_STAT:
4083 case MSG_STAT:
4084 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4085 break;
4086 case IPC_SET:
4087 perms = MSGQ__SETATTR;
4088 break;
4089 case IPC_RMID:
4090 perms = MSGQ__DESTROY;
4091 break;
4092 default:
4093 return 0;
4094 }
4095
4096 err = ipc_has_perm(&msq->q_perm, perms);
4097 return err;
4098 }
4099
4100 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4101 {
4102 struct task_security_struct *tsec;
4103 struct ipc_security_struct *isec;
4104 struct msg_security_struct *msec;
4105 struct avc_audit_data ad;
4106 int rc;
4107
4108 tsec = current->security;
4109 isec = msq->q_perm.security;
4110 msec = msg->security;
4111
4112 /*
4113 * First time through, need to assign label to the message
4114 */
4115 if (msec->sid == SECINITSID_UNLABELED) {
4116 /*
4117 * Compute new sid based on current process and
4118 * message queue this message will be stored in
4119 */
4120 rc = security_transition_sid(tsec->sid,
4121 isec->sid,
4122 SECCLASS_MSG,
4123 &msec->sid);
4124 if (rc)
4125 return rc;
4126 }
4127
4128 AVC_AUDIT_DATA_INIT(&ad, IPC);
4129 ad.u.ipc_id = msq->q_perm.key;
4130
4131 /* Can this process write to the queue? */
4132 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4133 MSGQ__WRITE, &ad);
4134 if (!rc)
4135 /* Can this process send the message */
4136 rc = avc_has_perm(tsec->sid, msec->sid,
4137 SECCLASS_MSG, MSG__SEND, &ad);
4138 if (!rc)
4139 /* Can the message be put in the queue? */
4140 rc = avc_has_perm(msec->sid, isec->sid,
4141 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4142
4143 return rc;
4144 }
4145
4146 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4147 struct task_struct *target,
4148 long type, int mode)
4149 {
4150 struct task_security_struct *tsec;
4151 struct ipc_security_struct *isec;
4152 struct msg_security_struct *msec;
4153 struct avc_audit_data ad;
4154 int rc;
4155
4156 tsec = target->security;
4157 isec = msq->q_perm.security;
4158 msec = msg->security;
4159
4160 AVC_AUDIT_DATA_INIT(&ad, IPC);
4161 ad.u.ipc_id = msq->q_perm.key;
4162
4163 rc = avc_has_perm(tsec->sid, isec->sid,
4164 SECCLASS_MSGQ, MSGQ__READ, &ad);
4165 if (!rc)
4166 rc = avc_has_perm(tsec->sid, msec->sid,
4167 SECCLASS_MSG, MSG__RECEIVE, &ad);
4168 return rc;
4169 }
4170
4171 /* Shared Memory security operations */
4172 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4173 {
4174 struct task_security_struct *tsec;
4175 struct ipc_security_struct *isec;
4176 struct avc_audit_data ad;
4177 int rc;
4178
4179 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4180 if (rc)
4181 return rc;
4182
4183 tsec = current->security;
4184 isec = shp->shm_perm.security;
4185
4186 AVC_AUDIT_DATA_INIT(&ad, IPC);
4187 ad.u.ipc_id = shp->shm_perm.key;
4188
4189 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4190 SHM__CREATE, &ad);
4191 if (rc) {
4192 ipc_free_security(&shp->shm_perm);
4193 return rc;
4194 }
4195 return 0;
4196 }
4197
4198 static void selinux_shm_free_security(struct shmid_kernel *shp)
4199 {
4200 ipc_free_security(&shp->shm_perm);
4201 }
4202
4203 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4204 {
4205 struct task_security_struct *tsec;
4206 struct ipc_security_struct *isec;
4207 struct avc_audit_data ad;
4208
4209 tsec = current->security;
4210 isec = shp->shm_perm.security;
4211
4212 AVC_AUDIT_DATA_INIT(&ad, IPC);
4213 ad.u.ipc_id = shp->shm_perm.key;
4214
4215 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4216 SHM__ASSOCIATE, &ad);
4217 }
4218
4219 /* Note, at this point, shp is locked down */
4220 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4221 {
4222 int perms;
4223 int err;
4224
4225 switch(cmd) {
4226 case IPC_INFO:
4227 case SHM_INFO:
4228 /* No specific object, just general system-wide information. */
4229 return task_has_system(current, SYSTEM__IPC_INFO);
4230 case IPC_STAT:
4231 case SHM_STAT:
4232 perms = SHM__GETATTR | SHM__ASSOCIATE;
4233 break;
4234 case IPC_SET:
4235 perms = SHM__SETATTR;
4236 break;
4237 case SHM_LOCK:
4238 case SHM_UNLOCK:
4239 perms = SHM__LOCK;
4240 break;
4241 case IPC_RMID:
4242 perms = SHM__DESTROY;
4243 break;
4244 default:
4245 return 0;
4246 }
4247
4248 err = ipc_has_perm(&shp->shm_perm, perms);
4249 return err;
4250 }
4251
4252 static int selinux_shm_shmat(struct shmid_kernel *shp,
4253 char __user *shmaddr, int shmflg)
4254 {
4255 u32 perms;
4256 int rc;
4257
4258 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4259 if (rc)
4260 return rc;
4261
4262 if (shmflg & SHM_RDONLY)
4263 perms = SHM__READ;
4264 else
4265 perms = SHM__READ | SHM__WRITE;
4266
4267 return ipc_has_perm(&shp->shm_perm, perms);
4268 }
4269
4270 /* Semaphore security operations */
4271 static int selinux_sem_alloc_security(struct sem_array *sma)
4272 {
4273 struct task_security_struct *tsec;
4274 struct ipc_security_struct *isec;
4275 struct avc_audit_data ad;
4276 int rc;
4277
4278 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4279 if (rc)
4280 return rc;
4281
4282 tsec = current->security;
4283 isec = sma->sem_perm.security;
4284
4285 AVC_AUDIT_DATA_INIT(&ad, IPC);
4286 ad.u.ipc_id = sma->sem_perm.key;
4287
4288 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4289 SEM__CREATE, &ad);
4290 if (rc) {
4291 ipc_free_security(&sma->sem_perm);
4292 return rc;
4293 }
4294 return 0;
4295 }
4296
4297 static void selinux_sem_free_security(struct sem_array *sma)
4298 {
4299 ipc_free_security(&sma->sem_perm);
4300 }
4301
4302 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4303 {
4304 struct task_security_struct *tsec;
4305 struct ipc_security_struct *isec;
4306 struct avc_audit_data ad;
4307
4308 tsec = current->security;
4309 isec = sma->sem_perm.security;
4310
4311 AVC_AUDIT_DATA_INIT(&ad, IPC);
4312 ad.u.ipc_id = sma->sem_perm.key;
4313
4314 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4315 SEM__ASSOCIATE, &ad);
4316 }
4317
4318 /* Note, at this point, sma is locked down */
4319 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4320 {
4321 int err;
4322 u32 perms;
4323
4324 switch(cmd) {
4325 case IPC_INFO:
4326 case SEM_INFO:
4327 /* No specific object, just general system-wide information. */
4328 return task_has_system(current, SYSTEM__IPC_INFO);
4329 case GETPID:
4330 case GETNCNT:
4331 case GETZCNT:
4332 perms = SEM__GETATTR;
4333 break;
4334 case GETVAL:
4335 case GETALL:
4336 perms = SEM__READ;
4337 break;
4338 case SETVAL:
4339 case SETALL:
4340 perms = SEM__WRITE;
4341 break;
4342 case IPC_RMID:
4343 perms = SEM__DESTROY;
4344 break;
4345 case IPC_SET:
4346 perms = SEM__SETATTR;
4347 break;
4348 case IPC_STAT:
4349 case SEM_STAT:
4350 perms = SEM__GETATTR | SEM__ASSOCIATE;
4351 break;
4352 default:
4353 return 0;
4354 }
4355
4356 err = ipc_has_perm(&sma->sem_perm, perms);
4357 return err;
4358 }
4359
4360 static int selinux_sem_semop(struct sem_array *sma,
4361 struct sembuf *sops, unsigned nsops, int alter)
4362 {
4363 u32 perms;
4364
4365 if (alter)
4366 perms = SEM__READ | SEM__WRITE;
4367 else
4368 perms = SEM__READ;
4369
4370 return ipc_has_perm(&sma->sem_perm, perms);
4371 }
4372
4373 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4374 {
4375 u32 av = 0;
4376
4377 av = 0;
4378 if (flag & S_IRUGO)
4379 av |= IPC__UNIX_READ;
4380 if (flag & S_IWUGO)
4381 av |= IPC__UNIX_WRITE;
4382
4383 if (av == 0)
4384 return 0;
4385
4386 return ipc_has_perm(ipcp, av);
4387 }
4388
4389 /* module stacking operations */
4390 static int selinux_register_security (const char *name, struct security_operations *ops)
4391 {
4392 if (secondary_ops != original_ops) {
4393 printk(KERN_INFO "%s: There is already a secondary security "
4394 "module registered.\n", __FUNCTION__);
4395 return -EINVAL;
4396 }
4397
4398 secondary_ops = ops;
4399
4400 printk(KERN_INFO "%s: Registering secondary module %s\n",
4401 __FUNCTION__,
4402 name);
4403
4404 return 0;
4405 }
4406
4407 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4408 {
4409 if (ops != secondary_ops) {
4410 printk (KERN_INFO "%s: trying to unregister a security module "
4411 "that is not registered.\n", __FUNCTION__);
4412 return -EINVAL;
4413 }
4414
4415 secondary_ops = original_ops;
4416
4417 return 0;
4418 }
4419
4420 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4421 {
4422 if (inode)
4423 inode_doinit_with_dentry(inode, dentry);
4424 }
4425
4426 static int selinux_getprocattr(struct task_struct *p,
4427 char *name, void *value, size_t size)
4428 {
4429 struct task_security_struct *tsec;
4430 u32 sid;
4431 int error;
4432
4433 if (current != p) {
4434 error = task_has_perm(current, p, PROCESS__GETATTR);
4435 if (error)
4436 return error;
4437 }
4438
4439 tsec = p->security;
4440
4441 if (!strcmp(name, "current"))
4442 sid = tsec->sid;
4443 else if (!strcmp(name, "prev"))
4444 sid = tsec->osid;
4445 else if (!strcmp(name, "exec"))
4446 sid = tsec->exec_sid;
4447 else if (!strcmp(name, "fscreate"))
4448 sid = tsec->create_sid;
4449 else if (!strcmp(name, "keycreate"))
4450 sid = tsec->keycreate_sid;
4451 else if (!strcmp(name, "sockcreate"))
4452 sid = tsec->sockcreate_sid;
4453 else
4454 return -EINVAL;
4455
4456 if (!sid)
4457 return 0;
4458
4459 return selinux_getsecurity(sid, value, size);
4460 }
4461
4462 static int selinux_setprocattr(struct task_struct *p,
4463 char *name, void *value, size_t size)
4464 {
4465 struct task_security_struct *tsec;
4466 u32 sid = 0;
4467 int error;
4468 char *str = value;
4469
4470 if (current != p) {
4471 /* SELinux only allows a process to change its own
4472 security attributes. */
4473 return -EACCES;
4474 }
4475
4476 /*
4477 * Basic control over ability to set these attributes at all.
4478 * current == p, but we'll pass them separately in case the
4479 * above restriction is ever removed.
4480 */
4481 if (!strcmp(name, "exec"))
4482 error = task_has_perm(current, p, PROCESS__SETEXEC);
4483 else if (!strcmp(name, "fscreate"))
4484 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4485 else if (!strcmp(name, "keycreate"))
4486 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4487 else if (!strcmp(name, "sockcreate"))
4488 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4489 else if (!strcmp(name, "current"))
4490 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4491 else
4492 error = -EINVAL;
4493 if (error)
4494 return error;
4495
4496 /* Obtain a SID for the context, if one was specified. */
4497 if (size && str[1] && str[1] != '\n') {
4498 if (str[size-1] == '\n') {
4499 str[size-1] = 0;
4500 size--;
4501 }
4502 error = security_context_to_sid(value, size, &sid);
4503 if (error)
4504 return error;
4505 }
4506
4507 /* Permission checking based on the specified context is
4508 performed during the actual operation (execve,
4509 open/mkdir/...), when we know the full context of the
4510 operation. See selinux_bprm_set_security for the execve
4511 checks and may_create for the file creation checks. The
4512 operation will then fail if the context is not permitted. */
4513 tsec = p->security;
4514 if (!strcmp(name, "exec"))
4515 tsec->exec_sid = sid;
4516 else if (!strcmp(name, "fscreate"))
4517 tsec->create_sid = sid;
4518 else if (!strcmp(name, "keycreate")) {
4519 error = may_create_key(sid, p);
4520 if (error)
4521 return error;
4522 tsec->keycreate_sid = sid;
4523 } else if (!strcmp(name, "sockcreate"))
4524 tsec->sockcreate_sid = sid;
4525 else if (!strcmp(name, "current")) {
4526 struct av_decision avd;
4527
4528 if (sid == 0)
4529 return -EINVAL;
4530
4531 /* Only allow single threaded processes to change context */
4532 if (atomic_read(&p->mm->mm_users) != 1) {
4533 struct task_struct *g, *t;
4534 struct mm_struct *mm = p->mm;
4535 read_lock(&tasklist_lock);
4536 do_each_thread(g, t)
4537 if (t->mm == mm && t != p) {
4538 read_unlock(&tasklist_lock);
4539 return -EPERM;
4540 }
4541 while_each_thread(g, t);
4542 read_unlock(&tasklist_lock);
4543 }
4544
4545 /* Check permissions for the transition. */
4546 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4547 PROCESS__DYNTRANSITION, NULL);
4548 if (error)
4549 return error;
4550
4551 /* Check for ptracing, and update the task SID if ok.
4552 Otherwise, leave SID unchanged and fail. */
4553 task_lock(p);
4554 if (p->ptrace & PT_PTRACED) {
4555 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4556 SECCLASS_PROCESS,
4557 PROCESS__PTRACE, &avd);
4558 if (!error)
4559 tsec->sid = sid;
4560 task_unlock(p);
4561 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4562 PROCESS__PTRACE, &avd, error, NULL);
4563 if (error)
4564 return error;
4565 } else {
4566 tsec->sid = sid;
4567 task_unlock(p);
4568 }
4569 }
4570 else
4571 return -EINVAL;
4572
4573 return size;
4574 }
4575
4576 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4577 {
4578 return security_sid_to_context(secid, secdata, seclen);
4579 }
4580
4581 static void selinux_release_secctx(char *secdata, u32 seclen)
4582 {
4583 if (secdata)
4584 kfree(secdata);
4585 }
4586
4587 #ifdef CONFIG_KEYS
4588
4589 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4590 unsigned long flags)
4591 {
4592 struct task_security_struct *tsec = tsk->security;
4593 struct key_security_struct *ksec;
4594
4595 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4596 if (!ksec)
4597 return -ENOMEM;
4598
4599 ksec->obj = k;
4600 if (tsec->keycreate_sid)
4601 ksec->sid = tsec->keycreate_sid;
4602 else
4603 ksec->sid = tsec->sid;
4604 k->security = ksec;
4605
4606 return 0;
4607 }
4608
4609 static void selinux_key_free(struct key *k)
4610 {
4611 struct key_security_struct *ksec = k->security;
4612
4613 k->security = NULL;
4614 kfree(ksec);
4615 }
4616
4617 static int selinux_key_permission(key_ref_t key_ref,
4618 struct task_struct *ctx,
4619 key_perm_t perm)
4620 {
4621 struct key *key;
4622 struct task_security_struct *tsec;
4623 struct key_security_struct *ksec;
4624
4625 key = key_ref_to_ptr(key_ref);
4626
4627 tsec = ctx->security;
4628 ksec = key->security;
4629
4630 /* if no specific permissions are requested, we skip the
4631 permission check. No serious, additional covert channels
4632 appear to be created. */
4633 if (perm == 0)
4634 return 0;
4635
4636 return avc_has_perm(tsec->sid, ksec->sid,
4637 SECCLASS_KEY, perm, NULL);
4638 }
4639
4640 #endif
4641
4642 static struct security_operations selinux_ops = {
4643 .ptrace = selinux_ptrace,
4644 .capget = selinux_capget,
4645 .capset_check = selinux_capset_check,
4646 .capset_set = selinux_capset_set,
4647 .sysctl = selinux_sysctl,
4648 .capable = selinux_capable,
4649 .quotactl = selinux_quotactl,
4650 .quota_on = selinux_quota_on,
4651 .syslog = selinux_syslog,
4652 .vm_enough_memory = selinux_vm_enough_memory,
4653
4654 .netlink_send = selinux_netlink_send,
4655 .netlink_recv = selinux_netlink_recv,
4656
4657 .bprm_alloc_security = selinux_bprm_alloc_security,
4658 .bprm_free_security = selinux_bprm_free_security,
4659 .bprm_apply_creds = selinux_bprm_apply_creds,
4660 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4661 .bprm_set_security = selinux_bprm_set_security,
4662 .bprm_check_security = selinux_bprm_check_security,
4663 .bprm_secureexec = selinux_bprm_secureexec,
4664
4665 .sb_alloc_security = selinux_sb_alloc_security,
4666 .sb_free_security = selinux_sb_free_security,
4667 .sb_copy_data = selinux_sb_copy_data,
4668 .sb_kern_mount = selinux_sb_kern_mount,
4669 .sb_statfs = selinux_sb_statfs,
4670 .sb_mount = selinux_mount,
4671 .sb_umount = selinux_umount,
4672
4673 .inode_alloc_security = selinux_inode_alloc_security,
4674 .inode_free_security = selinux_inode_free_security,
4675 .inode_init_security = selinux_inode_init_security,
4676 .inode_create = selinux_inode_create,
4677 .inode_link = selinux_inode_link,
4678 .inode_unlink = selinux_inode_unlink,
4679 .inode_symlink = selinux_inode_symlink,
4680 .inode_mkdir = selinux_inode_mkdir,
4681 .inode_rmdir = selinux_inode_rmdir,
4682 .inode_mknod = selinux_inode_mknod,
4683 .inode_rename = selinux_inode_rename,
4684 .inode_readlink = selinux_inode_readlink,
4685 .inode_follow_link = selinux_inode_follow_link,
4686 .inode_permission = selinux_inode_permission,
4687 .inode_setattr = selinux_inode_setattr,
4688 .inode_getattr = selinux_inode_getattr,
4689 .inode_setxattr = selinux_inode_setxattr,
4690 .inode_post_setxattr = selinux_inode_post_setxattr,
4691 .inode_getxattr = selinux_inode_getxattr,
4692 .inode_listxattr = selinux_inode_listxattr,
4693 .inode_removexattr = selinux_inode_removexattr,
4694 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4695 .inode_getsecurity = selinux_inode_getsecurity,
4696 .inode_setsecurity = selinux_inode_setsecurity,
4697 .inode_listsecurity = selinux_inode_listsecurity,
4698
4699 .file_permission = selinux_file_permission,
4700 .file_alloc_security = selinux_file_alloc_security,
4701 .file_free_security = selinux_file_free_security,
4702 .file_ioctl = selinux_file_ioctl,
4703 .file_mmap = selinux_file_mmap,
4704 .file_mprotect = selinux_file_mprotect,
4705 .file_lock = selinux_file_lock,
4706 .file_fcntl = selinux_file_fcntl,
4707 .file_set_fowner = selinux_file_set_fowner,
4708 .file_send_sigiotask = selinux_file_send_sigiotask,
4709 .file_receive = selinux_file_receive,
4710
4711 .task_create = selinux_task_create,
4712 .task_alloc_security = selinux_task_alloc_security,
4713 .task_free_security = selinux_task_free_security,
4714 .task_setuid = selinux_task_setuid,
4715 .task_post_setuid = selinux_task_post_setuid,
4716 .task_setgid = selinux_task_setgid,
4717 .task_setpgid = selinux_task_setpgid,
4718 .task_getpgid = selinux_task_getpgid,
4719 .task_getsid = selinux_task_getsid,
4720 .task_getsecid = selinux_task_getsecid,
4721 .task_setgroups = selinux_task_setgroups,
4722 .task_setnice = selinux_task_setnice,
4723 .task_setioprio = selinux_task_setioprio,
4724 .task_getioprio = selinux_task_getioprio,
4725 .task_setrlimit = selinux_task_setrlimit,
4726 .task_setscheduler = selinux_task_setscheduler,
4727 .task_getscheduler = selinux_task_getscheduler,
4728 .task_movememory = selinux_task_movememory,
4729 .task_kill = selinux_task_kill,
4730 .task_wait = selinux_task_wait,
4731 .task_prctl = selinux_task_prctl,
4732 .task_reparent_to_init = selinux_task_reparent_to_init,
4733 .task_to_inode = selinux_task_to_inode,
4734
4735 .ipc_permission = selinux_ipc_permission,
4736
4737 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4738 .msg_msg_free_security = selinux_msg_msg_free_security,
4739
4740 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4741 .msg_queue_free_security = selinux_msg_queue_free_security,
4742 .msg_queue_associate = selinux_msg_queue_associate,
4743 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4744 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4745 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4746
4747 .shm_alloc_security = selinux_shm_alloc_security,
4748 .shm_free_security = selinux_shm_free_security,
4749 .shm_associate = selinux_shm_associate,
4750 .shm_shmctl = selinux_shm_shmctl,
4751 .shm_shmat = selinux_shm_shmat,
4752
4753 .sem_alloc_security = selinux_sem_alloc_security,
4754 .sem_free_security = selinux_sem_free_security,
4755 .sem_associate = selinux_sem_associate,
4756 .sem_semctl = selinux_sem_semctl,
4757 .sem_semop = selinux_sem_semop,
4758
4759 .register_security = selinux_register_security,
4760 .unregister_security = selinux_unregister_security,
4761
4762 .d_instantiate = selinux_d_instantiate,
4763
4764 .getprocattr = selinux_getprocattr,
4765 .setprocattr = selinux_setprocattr,
4766
4767 .secid_to_secctx = selinux_secid_to_secctx,
4768 .release_secctx = selinux_release_secctx,
4769
4770 .unix_stream_connect = selinux_socket_unix_stream_connect,
4771 .unix_may_send = selinux_socket_unix_may_send,
4772
4773 .socket_create = selinux_socket_create,
4774 .socket_post_create = selinux_socket_post_create,
4775 .socket_bind = selinux_socket_bind,
4776 .socket_connect = selinux_socket_connect,
4777 .socket_listen = selinux_socket_listen,
4778 .socket_accept = selinux_socket_accept,
4779 .socket_sendmsg = selinux_socket_sendmsg,
4780 .socket_recvmsg = selinux_socket_recvmsg,
4781 .socket_getsockname = selinux_socket_getsockname,
4782 .socket_getpeername = selinux_socket_getpeername,
4783 .socket_getsockopt = selinux_socket_getsockopt,
4784 .socket_setsockopt = selinux_socket_setsockopt,
4785 .socket_shutdown = selinux_socket_shutdown,
4786 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4787 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4788 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4789 .sk_alloc_security = selinux_sk_alloc_security,
4790 .sk_free_security = selinux_sk_free_security,
4791 .sk_clone_security = selinux_sk_clone_security,
4792 .sk_getsecid = selinux_sk_getsecid,
4793 .sock_graft = selinux_sock_graft,
4794 .inet_conn_request = selinux_inet_conn_request,
4795 .inet_csk_clone = selinux_inet_csk_clone,
4796 .inet_conn_established = selinux_inet_conn_established,
4797 .req_classify_flow = selinux_req_classify_flow,
4798
4799 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4800 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4801 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4802 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4803 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4804 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4805 .xfrm_state_free_security = selinux_xfrm_state_free,
4806 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4807 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4808 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
4809 .xfrm_decode_session = selinux_xfrm_decode_session,
4810 #endif
4811
4812 #ifdef CONFIG_KEYS
4813 .key_alloc = selinux_key_alloc,
4814 .key_free = selinux_key_free,
4815 .key_permission = selinux_key_permission,
4816 #endif
4817 };
4818
4819 static __init int selinux_init(void)
4820 {
4821 struct task_security_struct *tsec;
4822
4823 if (!selinux_enabled) {
4824 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4825 return 0;
4826 }
4827
4828 printk(KERN_INFO "SELinux: Initializing.\n");
4829
4830 /* Set the security state for the initial task. */
4831 if (task_alloc_security(current))
4832 panic("SELinux: Failed to initialize initial task.\n");
4833 tsec = current->security;
4834 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4835
4836 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4837 sizeof(struct inode_security_struct),
4838 0, SLAB_PANIC, NULL, NULL);
4839 avc_init();
4840
4841 original_ops = secondary_ops = security_ops;
4842 if (!secondary_ops)
4843 panic ("SELinux: No initial security operations\n");
4844 if (register_security (&selinux_ops))
4845 panic("SELinux: Unable to register with kernel.\n");
4846
4847 if (selinux_enforcing) {
4848 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4849 } else {
4850 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4851 }
4852
4853 #ifdef CONFIG_KEYS
4854 /* Add security information to initial keyrings */
4855 selinux_key_alloc(&root_user_keyring, current,
4856 KEY_ALLOC_NOT_IN_QUOTA);
4857 selinux_key_alloc(&root_session_keyring, current,
4858 KEY_ALLOC_NOT_IN_QUOTA);
4859 #endif
4860
4861 return 0;
4862 }
4863
4864 void selinux_complete_init(void)
4865 {
4866 printk(KERN_INFO "SELinux: Completing initialization.\n");
4867
4868 /* Set up any superblocks initialized prior to the policy load. */
4869 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4870 spin_lock(&sb_lock);
4871 spin_lock(&sb_security_lock);
4872 next_sb:
4873 if (!list_empty(&superblock_security_head)) {
4874 struct superblock_security_struct *sbsec =
4875 list_entry(superblock_security_head.next,
4876 struct superblock_security_struct,
4877 list);
4878 struct super_block *sb = sbsec->sb;
4879 sb->s_count++;
4880 spin_unlock(&sb_security_lock);
4881 spin_unlock(&sb_lock);
4882 down_read(&sb->s_umount);
4883 if (sb->s_root)
4884 superblock_doinit(sb, NULL);
4885 drop_super(sb);
4886 spin_lock(&sb_lock);
4887 spin_lock(&sb_security_lock);
4888 list_del_init(&sbsec->list);
4889 goto next_sb;
4890 }
4891 spin_unlock(&sb_security_lock);
4892 spin_unlock(&sb_lock);
4893 }
4894
4895 /* SELinux requires early initialization in order to label
4896 all processes and objects when they are created. */
4897 security_initcall(selinux_init);
4898
4899 #if defined(CONFIG_NETFILTER)
4900
4901 static struct nf_hook_ops selinux_ipv4_op = {
4902 .hook = selinux_ipv4_postroute_last,
4903 .owner = THIS_MODULE,
4904 .pf = PF_INET,
4905 .hooknum = NF_IP_POST_ROUTING,
4906 .priority = NF_IP_PRI_SELINUX_LAST,
4907 };
4908
4909 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4910
4911 static struct nf_hook_ops selinux_ipv6_op = {
4912 .hook = selinux_ipv6_postroute_last,
4913 .owner = THIS_MODULE,
4914 .pf = PF_INET6,
4915 .hooknum = NF_IP6_POST_ROUTING,
4916 .priority = NF_IP6_PRI_SELINUX_LAST,
4917 };
4918
4919 #endif /* IPV6 */
4920
4921 static int __init selinux_nf_ip_init(void)
4922 {
4923 int err = 0;
4924
4925 if (!selinux_enabled)
4926 goto out;
4927
4928 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4929
4930 err = nf_register_hook(&selinux_ipv4_op);
4931 if (err)
4932 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4933
4934 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4935
4936 err = nf_register_hook(&selinux_ipv6_op);
4937 if (err)
4938 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4939
4940 #endif /* IPV6 */
4941
4942 out:
4943 return err;
4944 }
4945
4946 __initcall(selinux_nf_ip_init);
4947
4948 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4949 static void selinux_nf_ip_exit(void)
4950 {
4951 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4952
4953 nf_unregister_hook(&selinux_ipv4_op);
4954 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4955 nf_unregister_hook(&selinux_ipv6_op);
4956 #endif /* IPV6 */
4957 }
4958 #endif
4959
4960 #else /* CONFIG_NETFILTER */
4961
4962 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4963 #define selinux_nf_ip_exit()
4964 #endif
4965
4966 #endif /* CONFIG_NETFILTER */
4967
4968 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4969 int selinux_disable(void)
4970 {
4971 extern void exit_sel_fs(void);
4972 static int selinux_disabled = 0;
4973
4974 if (ss_initialized) {
4975 /* Not permitted after initial policy load. */
4976 return -EINVAL;
4977 }
4978
4979 if (selinux_disabled) {
4980 /* Only do this once. */
4981 return -EINVAL;
4982 }
4983
4984 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4985
4986 selinux_disabled = 1;
4987 selinux_enabled = 0;
4988
4989 /* Reset security_ops to the secondary module, dummy or capability. */
4990 security_ops = secondary_ops;
4991
4992 /* Unregister netfilter hooks. */
4993 selinux_nf_ip_exit();
4994
4995 /* Unregister selinuxfs. */
4996 exit_sel_fs();
4997
4998 return 0;
4999 }
5000 #endif
5001
5002
ubuntu-bionic-kernel mirror