]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - security/selinux/hooks.c
projects / mirror_ubuntu-artful-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
selinux: use pernet operations for hook registration
[mirror_ubuntu-artful-kernel.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 * Copyright (C) 2016 Mellanox Technologies
21 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
24 * as published by the Free Software Foundation.
25 */
26
27 #include <linux/init.h>
28 #include <linux/kd.h>
29 #include <linux/kernel.h>
30 #include <linux/tracehook.h>
31 #include <linux/errno.h>
32 #include <linux/sched/signal.h>
33 #include <linux/sched/task.h>
34 #include <linux/lsm_hooks.h>
35 #include <linux/xattr.h>
36 #include <linux/capability.h>
37 #include <linux/unistd.h>
38 #include <linux/mm.h>
39 #include <linux/mman.h>
40 #include <linux/slab.h>
41 #include <linux/pagemap.h>
42 #include <linux/proc_fs.h>
43 #include <linux/swap.h>
44 #include <linux/spinlock.h>
45 #include <linux/syscalls.h>
46 #include <linux/dcache.h>
47 #include <linux/file.h>
48 #include <linux/fdtable.h>
49 #include <linux/namei.h>
50 #include <linux/mount.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
54 #include <net/icmp.h>
55 #include <net/ip.h> /* for local_port_range[] */
56 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h> /* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/quota.h>
71 #include <linux/un.h> /* for Unix socket types */
72 #include <net/af_unix.h> /* for Unix socket types */
73 #include <linux/parser.h>
74 #include <linux/nfs_mount.h>
75 #include <net/ipv6.h>
76 #include <linux/hugetlb.h>
77 #include <linux/personality.h>
78 #include <linux/audit.h>
79 #include <linux/string.h>
80 #include <linux/selinux.h>
81 #include <linux/mutex.h>
82 #include <linux/posix-timers.h>
83 #include <linux/syslog.h>
84 #include <linux/user_namespace.h>
85 #include <linux/export.h>
86 #include <linux/msg.h>
87 #include <linux/shm.h>
88
89 #include "avc.h"
90 #include "objsec.h"
91 #include "netif.h"
92 #include "netnode.h"
93 #include "netport.h"
94 #include "ibpkey.h"
95 #include "xfrm.h"
96 #include "netlabel.h"
97 #include "audit.h"
98 #include "avc_ss.h"
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!kstrtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!kstrtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132 static struct kmem_cache *file_security_cache;
133
134 /**
135 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
136 *
137 * Description:
138 * This function checks the SECMARK reference counter to see if any SECMARK
139 * targets are currently configured, if the reference counter is greater than
140 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
141 * enabled, false (0) if SECMARK is disabled. If the always_check_network
142 * policy capability is enabled, SECMARK is always considered enabled.
143 *
144 */
145 static int selinux_secmark_enabled(void)
146 {
147 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
148 }
149
150 /**
151 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
152 *
153 * Description:
154 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
155 * (1) if any are enabled or false (0) if neither are enabled. If the
156 * always_check_network policy capability is enabled, peer labeling
157 * is always considered enabled.
158 *
159 */
160 static int selinux_peerlbl_enabled(void)
161 {
162 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
163 }
164
165 static int selinux_netcache_avc_callback(u32 event)
166 {
167 if (event == AVC_CALLBACK_RESET) {
168 sel_netif_flush();
169 sel_netnode_flush();
170 sel_netport_flush();
171 synchronize_net();
172 }
173 return 0;
174 }
175
176 static int selinux_lsm_notifier_avc_callback(u32 event)
177 {
178 if (event == AVC_CALLBACK_RESET) {
179 sel_ib_pkey_flush();
180 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
181 }
182
183 return 0;
184 }
185
186 /*
187 * initialise the security for the init task
188 */
189 static void cred_init_security(void)
190 {
191 struct cred *cred = (struct cred *) current->real_cred;
192 struct task_security_struct *tsec;
193
194 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
195 if (!tsec)
196 panic("SELinux: Failed to initialize initial task.\n");
197
198 tsec->osid = tsec->sid = SECINITSID_KERNEL;
199 cred->security = tsec;
200 }
201
202 /*
203 * get the security ID of a set of credentials
204 */
205 static inline u32 cred_sid(const struct cred *cred)
206 {
207 const struct task_security_struct *tsec;
208
209 tsec = cred->security;
210 return tsec->sid;
211 }
212
213 /*
214 * get the objective security ID of a task
215 */
216 static inline u32 task_sid(const struct task_struct *task)
217 {
218 u32 sid;
219
220 rcu_read_lock();
221 sid = cred_sid(__task_cred(task));
222 rcu_read_unlock();
223 return sid;
224 }
225
226 /* Allocate and free functions for each kind of security blob. */
227
228 static int inode_alloc_security(struct inode *inode)
229 {
230 struct inode_security_struct *isec;
231 u32 sid = current_sid();
232
233 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
234 if (!isec)
235 return -ENOMEM;
236
237 spin_lock_init(&isec->lock);
238 INIT_LIST_HEAD(&isec->list);
239 isec->inode = inode;
240 isec->sid = SECINITSID_UNLABELED;
241 isec->sclass = SECCLASS_FILE;
242 isec->task_sid = sid;
243 isec->initialized = LABEL_INVALID;
244 inode->i_security = isec;
245
246 return 0;
247 }
248
249 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
250
251 /*
252 * Try reloading inode security labels that have been marked as invalid. The
253 * @may_sleep parameter indicates when sleeping and thus reloading labels is
254 * allowed; when set to false, returns -ECHILD when the label is
255 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
256 * when no dentry is available, set it to NULL instead.
257 */
258 static int __inode_security_revalidate(struct inode *inode,
259 struct dentry *opt_dentry,
260 bool may_sleep)
261 {
262 struct inode_security_struct *isec = inode->i_security;
263
264 might_sleep_if(may_sleep);
265
266 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
267 if (!may_sleep)
268 return -ECHILD;
269
270 /*
271 * Try reloading the inode security label. This will fail if
272 * @opt_dentry is NULL and no dentry for this inode can be
273 * found; in that case, continue using the old label.
274 */
275 inode_doinit_with_dentry(inode, opt_dentry);
276 }
277 return 0;
278 }
279
280 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
281 {
282 return inode->i_security;
283 }
284
285 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
286 {
287 int error;
288
289 error = __inode_security_revalidate(inode, NULL, !rcu);
290 if (error)
291 return ERR_PTR(error);
292 return inode->i_security;
293 }
294
295 /*
296 * Get the security label of an inode.
297 */
298 static struct inode_security_struct *inode_security(struct inode *inode)
299 {
300 __inode_security_revalidate(inode, NULL, true);
301 return inode->i_security;
302 }
303
304 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
305 {
306 struct inode *inode = d_backing_inode(dentry);
307
308 return inode->i_security;
309 }
310
311 /*
312 * Get the security label of a dentry's backing inode.
313 */
314 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
315 {
316 struct inode *inode = d_backing_inode(dentry);
317
318 __inode_security_revalidate(inode, dentry, true);
319 return inode->i_security;
320 }
321
322 static void inode_free_rcu(struct rcu_head *head)
323 {
324 struct inode_security_struct *isec;
325
326 isec = container_of(head, struct inode_security_struct, rcu);
327 kmem_cache_free(sel_inode_cache, isec);
328 }
329
330 static void inode_free_security(struct inode *inode)
331 {
332 struct inode_security_struct *isec = inode->i_security;
333 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
334
335 /*
336 * As not all inode security structures are in a list, we check for
337 * empty list outside of the lock to make sure that we won't waste
338 * time taking a lock doing nothing.
339 *
340 * The list_del_init() function can be safely called more than once.
341 * It should not be possible for this function to be called with
342 * concurrent list_add(), but for better safety against future changes
343 * in the code, we use list_empty_careful() here.
344 */
345 if (!list_empty_careful(&isec->list)) {
346 spin_lock(&sbsec->isec_lock);
347 list_del_init(&isec->list);
348 spin_unlock(&sbsec->isec_lock);
349 }
350
351 /*
352 * The inode may still be referenced in a path walk and
353 * a call to selinux_inode_permission() can be made
354 * after inode_free_security() is called. Ideally, the VFS
355 * wouldn't do this, but fixing that is a much harder
356 * job. For now, simply free the i_security via RCU, and
357 * leave the current inode->i_security pointer intact.
358 * The inode will be freed after the RCU grace period too.
359 */
360 call_rcu(&isec->rcu, inode_free_rcu);
361 }
362
363 static int file_alloc_security(struct file *file)
364 {
365 struct file_security_struct *fsec;
366 u32 sid = current_sid();
367
368 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
369 if (!fsec)
370 return -ENOMEM;
371
372 fsec->sid = sid;
373 fsec->fown_sid = sid;
374 file->f_security = fsec;
375
376 return 0;
377 }
378
379 static void file_free_security(struct file *file)
380 {
381 struct file_security_struct *fsec = file->f_security;
382 file->f_security = NULL;
383 kmem_cache_free(file_security_cache, fsec);
384 }
385
386 static int superblock_alloc_security(struct super_block *sb)
387 {
388 struct superblock_security_struct *sbsec;
389
390 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
391 if (!sbsec)
392 return -ENOMEM;
393
394 mutex_init(&sbsec->lock);
395 INIT_LIST_HEAD(&sbsec->isec_head);
396 spin_lock_init(&sbsec->isec_lock);
397 sbsec->sb = sb;
398 sbsec->sid = SECINITSID_UNLABELED;
399 sbsec->def_sid = SECINITSID_FILE;
400 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
401 sb->s_security = sbsec;
402
403 return 0;
404 }
405
406 static void superblock_free_security(struct super_block *sb)
407 {
408 struct superblock_security_struct *sbsec = sb->s_security;
409 sb->s_security = NULL;
410 kfree(sbsec);
411 }
412
413 static inline int inode_doinit(struct inode *inode)
414 {
415 return inode_doinit_with_dentry(inode, NULL);
416 }
417
418 enum {
419 Opt_error = -1,
420 Opt_context = 1,
421 Opt_fscontext = 2,
422 Opt_defcontext = 3,
423 Opt_rootcontext = 4,
424 Opt_labelsupport = 5,
425 Opt_nextmntopt = 6,
426 };
427
428 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429
430 static const match_table_t tokens = {
431 {Opt_context, CONTEXT_STR "%s"},
432 {Opt_fscontext, FSCONTEXT_STR "%s"},
433 {Opt_defcontext, DEFCONTEXT_STR "%s"},
434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
435 {Opt_labelsupport, LABELSUPP_STR},
436 {Opt_error, NULL},
437 };
438
439 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440
441 static int may_context_mount_sb_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
443 const struct cred *cred)
444 {
445 const struct task_security_struct *tsec = cred->security;
446 int rc;
447
448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
449 FILESYSTEM__RELABELFROM, NULL);
450 if (rc)
451 return rc;
452
453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELTO, NULL);
455 return rc;
456 }
457
458 static int may_context_mount_inode_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
460 const struct cred *cred)
461 {
462 const struct task_security_struct *tsec = cred->security;
463 int rc;
464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
466 if (rc)
467 return rc;
468
469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
470 FILESYSTEM__ASSOCIATE, NULL);
471 return rc;
472 }
473
474 static int selinux_is_sblabel_mnt(struct super_block *sb)
475 {
476 struct superblock_security_struct *sbsec = sb->s_security;
477
478 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
479 sbsec->behavior == SECURITY_FS_USE_TRANS ||
480 sbsec->behavior == SECURITY_FS_USE_TASK ||
481 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
482 /* Special handling. Genfs but also in-core setxattr handler */
483 !strcmp(sb->s_type->name, "sysfs") ||
484 !strcmp(sb->s_type->name, "pstore") ||
485 !strcmp(sb->s_type->name, "debugfs") ||
486 !strcmp(sb->s_type->name, "tracefs") ||
487 !strcmp(sb->s_type->name, "rootfs") ||
488 (selinux_policycap_cgroupseclabel &&
489 (!strcmp(sb->s_type->name, "cgroup") ||
490 !strcmp(sb->s_type->name, "cgroup2")));
491 }
492
493 static int sb_finish_set_opts(struct super_block *sb)
494 {
495 struct superblock_security_struct *sbsec = sb->s_security;
496 struct dentry *root = sb->s_root;
497 struct inode *root_inode = d_backing_inode(root);
498 int rc = 0;
499
500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
501 /* Make sure that the xattr handler exists and that no
502 error other than -ENODATA is returned by getxattr on
503 the root directory. -ENODATA is ok, as this may be
504 the first boot of the SELinux kernel before we have
505 assigned xattr values to the filesystem. */
506 if (!(root_inode->i_opflags & IOP_XATTR)) {
507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
508 "xattr support\n", sb->s_id, sb->s_type->name);
509 rc = -EOPNOTSUPP;
510 goto out;
511 }
512
513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
514 if (rc < 0 && rc != -ENODATA) {
515 if (rc == -EOPNOTSUPP)
516 printk(KERN_WARNING "SELinux: (dev %s, type "
517 "%s) has no security xattr handler\n",
518 sb->s_id, sb->s_type->name);
519 else
520 printk(KERN_WARNING "SELinux: (dev %s, type "
521 "%s) getxattr errno %d\n", sb->s_id,
522 sb->s_type->name, -rc);
523 goto out;
524 }
525 }
526
527 sbsec->flags |= SE_SBINITIALIZED;
528 if (selinux_is_sblabel_mnt(sb))
529 sbsec->flags |= SBLABEL_MNT;
530
531 /* Initialize the root inode. */
532 rc = inode_doinit_with_dentry(root_inode, root);
533
534 /* Initialize any other inodes associated with the superblock, e.g.
535 inodes created prior to initial policy load or inodes created
536 during get_sb by a pseudo filesystem that directly
537 populates itself. */
538 spin_lock(&sbsec->isec_lock);
539 next_inode:
540 if (!list_empty(&sbsec->isec_head)) {
541 struct inode_security_struct *isec =
542 list_entry(sbsec->isec_head.next,
543 struct inode_security_struct, list);
544 struct inode *inode = isec->inode;
545 list_del_init(&isec->list);
546 spin_unlock(&sbsec->isec_lock);
547 inode = igrab(inode);
548 if (inode) {
549 if (!IS_PRIVATE(inode))
550 inode_doinit(inode);
551 iput(inode);
552 }
553 spin_lock(&sbsec->isec_lock);
554 goto next_inode;
555 }
556 spin_unlock(&sbsec->isec_lock);
557 out:
558 return rc;
559 }
560
561 /*
562 * This function should allow an FS to ask what it's mount security
563 * options were so it can use those later for submounts, displaying
564 * mount options, or whatever.
565 */
566 static int selinux_get_mnt_opts(const struct super_block *sb,
567 struct security_mnt_opts *opts)
568 {
569 int rc = 0, i;
570 struct superblock_security_struct *sbsec = sb->s_security;
571 char *context = NULL;
572 u32 len;
573 char tmp;
574
575 security_init_mnt_opts(opts);
576
577 if (!(sbsec->flags & SE_SBINITIALIZED))
578 return -EINVAL;
579
580 if (!ss_initialized)
581 return -EINVAL;
582
583 /* make sure we always check enough bits to cover the mask */
584 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
585
586 tmp = sbsec->flags & SE_MNTMASK;
587 /* count the number of mount options for this sb */
588 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
589 if (tmp & 0x01)
590 opts->num_mnt_opts++;
591 tmp >>= 1;
592 }
593 /* Check if the Label support flag is set */
594 if (sbsec->flags & SBLABEL_MNT)
595 opts->num_mnt_opts++;
596
597 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
598 if (!opts->mnt_opts) {
599 rc = -ENOMEM;
600 goto out_free;
601 }
602
603 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
604 if (!opts->mnt_opts_flags) {
605 rc = -ENOMEM;
606 goto out_free;
607 }
608
609 i = 0;
610 if (sbsec->flags & FSCONTEXT_MNT) {
611 rc = security_sid_to_context(sbsec->sid, &context, &len);
612 if (rc)
613 goto out_free;
614 opts->mnt_opts[i] = context;
615 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
616 }
617 if (sbsec->flags & CONTEXT_MNT) {
618 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
619 if (rc)
620 goto out_free;
621 opts->mnt_opts[i] = context;
622 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
623 }
624 if (sbsec->flags & DEFCONTEXT_MNT) {
625 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
626 if (rc)
627 goto out_free;
628 opts->mnt_opts[i] = context;
629 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
630 }
631 if (sbsec->flags & ROOTCONTEXT_MNT) {
632 struct dentry *root = sbsec->sb->s_root;
633 struct inode_security_struct *isec = backing_inode_security(root);
634
635 rc = security_sid_to_context(isec->sid, &context, &len);
636 if (rc)
637 goto out_free;
638 opts->mnt_opts[i] = context;
639 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
640 }
641 if (sbsec->flags & SBLABEL_MNT) {
642 opts->mnt_opts[i] = NULL;
643 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
644 }
645
646 BUG_ON(i != opts->num_mnt_opts);
647
648 return 0;
649
650 out_free:
651 security_free_mnt_opts(opts);
652 return rc;
653 }
654
655 static int bad_option(struct superblock_security_struct *sbsec, char flag,
656 u32 old_sid, u32 new_sid)
657 {
658 char mnt_flags = sbsec->flags & SE_MNTMASK;
659
660 /* check if the old mount command had the same options */
661 if (sbsec->flags & SE_SBINITIALIZED)
662 if (!(sbsec->flags & flag) ||
663 (old_sid != new_sid))
664 return 1;
665
666 /* check if we were passed the same options twice,
667 * aka someone passed context=a,context=b
668 */
669 if (!(sbsec->flags & SE_SBINITIALIZED))
670 if (mnt_flags & flag)
671 return 1;
672 return 0;
673 }
674
675 /*
676 * Allow filesystems with binary mount data to explicitly set mount point
677 * labeling information.
678 */
679 static int selinux_set_mnt_opts(struct super_block *sb,
680 struct security_mnt_opts *opts,
681 unsigned long kern_flags,
682 unsigned long *set_kern_flags)
683 {
684 const struct cred *cred = current_cred();
685 int rc = 0, i;
686 struct superblock_security_struct *sbsec = sb->s_security;
687 const char *name = sb->s_type->name;
688 struct dentry *root = sbsec->sb->s_root;
689 struct inode_security_struct *root_isec;
690 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
691 u32 defcontext_sid = 0;
692 char **mount_options = opts->mnt_opts;
693 int *flags = opts->mnt_opts_flags;
694 int num_opts = opts->num_mnt_opts;
695
696 mutex_lock(&sbsec->lock);
697
698 if (!ss_initialized) {
699 if (!num_opts) {
700 /* Defer initialization until selinux_complete_init,
701 after the initial policy is loaded and the security
702 server is ready to handle calls. */
703 goto out;
704 }
705 rc = -EINVAL;
706 printk(KERN_WARNING "SELinux: Unable to set superblock options "
707 "before the security server is initialized\n");
708 goto out;
709 }
710 if (kern_flags && !set_kern_flags) {
711 /* Specifying internal flags without providing a place to
712 * place the results is not allowed */
713 rc = -EINVAL;
714 goto out;
715 }
716
717 /*
718 * Binary mount data FS will come through this function twice. Once
719 * from an explicit call and once from the generic calls from the vfs.
720 * Since the generic VFS calls will not contain any security mount data
721 * we need to skip the double mount verification.
722 *
723 * This does open a hole in which we will not notice if the first
724 * mount using this sb set explict options and a second mount using
725 * this sb does not set any security options. (The first options
726 * will be used for both mounts)
727 */
728 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
729 && (num_opts == 0))
730 goto out;
731
732 root_isec = backing_inode_security_novalidate(root);
733
734 /*
735 * parse the mount options, check if they are valid sids.
736 * also check if someone is trying to mount the same sb more
737 * than once with different security options.
738 */
739 for (i = 0; i < num_opts; i++) {
740 u32 sid;
741
742 if (flags[i] == SBLABEL_MNT)
743 continue;
744 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
745 if (rc) {
746 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
747 "(%s) failed for (dev %s, type %s) errno=%d\n",
748 mount_options[i], sb->s_id, name, rc);
749 goto out;
750 }
751 switch (flags[i]) {
752 case FSCONTEXT_MNT:
753 fscontext_sid = sid;
754
755 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
756 fscontext_sid))
757 goto out_double_mount;
758
759 sbsec->flags |= FSCONTEXT_MNT;
760 break;
761 case CONTEXT_MNT:
762 context_sid = sid;
763
764 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
765 context_sid))
766 goto out_double_mount;
767
768 sbsec->flags |= CONTEXT_MNT;
769 break;
770 case ROOTCONTEXT_MNT:
771 rootcontext_sid = sid;
772
773 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
774 rootcontext_sid))
775 goto out_double_mount;
776
777 sbsec->flags |= ROOTCONTEXT_MNT;
778
779 break;
780 case DEFCONTEXT_MNT:
781 defcontext_sid = sid;
782
783 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
784 defcontext_sid))
785 goto out_double_mount;
786
787 sbsec->flags |= DEFCONTEXT_MNT;
788
789 break;
790 default:
791 rc = -EINVAL;
792 goto out;
793 }
794 }
795
796 if (sbsec->flags & SE_SBINITIALIZED) {
797 /* previously mounted with options, but not on this attempt? */
798 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
799 goto out_double_mount;
800 rc = 0;
801 goto out;
802 }
803
804 if (strcmp(sb->s_type->name, "proc") == 0)
805 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
806
807 if (!strcmp(sb->s_type->name, "debugfs") ||
808 !strcmp(sb->s_type->name, "sysfs") ||
809 !strcmp(sb->s_type->name, "pstore"))
810 sbsec->flags |= SE_SBGENFS;
811
812 if (!sbsec->behavior) {
813 /*
814 * Determine the labeling behavior to use for this
815 * filesystem type.
816 */
817 rc = security_fs_use(sb);
818 if (rc) {
819 printk(KERN_WARNING
820 "%s: security_fs_use(%s) returned %d\n",
821 __func__, sb->s_type->name, rc);
822 goto out;
823 }
824 }
825
826 /*
827 * If this is a user namespace mount and the filesystem type is not
828 * explicitly whitelisted, then no contexts are allowed on the command
829 * line and security labels must be ignored.
830 */
831 if (sb->s_user_ns != &init_user_ns &&
832 strcmp(sb->s_type->name, "tmpfs") &&
833 strcmp(sb->s_type->name, "ramfs") &&
834 strcmp(sb->s_type->name, "devpts")) {
835 if (context_sid || fscontext_sid || rootcontext_sid ||
836 defcontext_sid) {
837 rc = -EACCES;
838 goto out;
839 }
840 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
841 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
842 rc = security_transition_sid(current_sid(), current_sid(),
843 SECCLASS_FILE, NULL,
844 &sbsec->mntpoint_sid);
845 if (rc)
846 goto out;
847 }
848 goto out_set_opts;
849 }
850
851 /* sets the context of the superblock for the fs being mounted. */
852 if (fscontext_sid) {
853 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
854 if (rc)
855 goto out;
856
857 sbsec->sid = fscontext_sid;
858 }
859
860 /*
861 * Switch to using mount point labeling behavior.
862 * sets the label used on all file below the mountpoint, and will set
863 * the superblock context if not already set.
864 */
865 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
866 sbsec->behavior = SECURITY_FS_USE_NATIVE;
867 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
868 }
869
870 if (context_sid) {
871 if (!fscontext_sid) {
872 rc = may_context_mount_sb_relabel(context_sid, sbsec,
873 cred);
874 if (rc)
875 goto out;
876 sbsec->sid = context_sid;
877 } else {
878 rc = may_context_mount_inode_relabel(context_sid, sbsec,
879 cred);
880 if (rc)
881 goto out;
882 }
883 if (!rootcontext_sid)
884 rootcontext_sid = context_sid;
885
886 sbsec->mntpoint_sid = context_sid;
887 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
888 }
889
890 if (rootcontext_sid) {
891 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
892 cred);
893 if (rc)
894 goto out;
895
896 root_isec->sid = rootcontext_sid;
897 root_isec->initialized = LABEL_INITIALIZED;
898 }
899
900 if (defcontext_sid) {
901 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
902 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
903 rc = -EINVAL;
904 printk(KERN_WARNING "SELinux: defcontext option is "
905 "invalid for this filesystem type\n");
906 goto out;
907 }
908
909 if (defcontext_sid != sbsec->def_sid) {
910 rc = may_context_mount_inode_relabel(defcontext_sid,
911 sbsec, cred);
912 if (rc)
913 goto out;
914 }
915
916 sbsec->def_sid = defcontext_sid;
917 }
918
919 out_set_opts:
920 rc = sb_finish_set_opts(sb);
921 out:
922 mutex_unlock(&sbsec->lock);
923 return rc;
924 out_double_mount:
925 rc = -EINVAL;
926 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
927 "security settings for (dev %s, type %s)\n", sb->s_id, name);
928 goto out;
929 }
930
931 static int selinux_cmp_sb_context(const struct super_block *oldsb,
932 const struct super_block *newsb)
933 {
934 struct superblock_security_struct *old = oldsb->s_security;
935 struct superblock_security_struct *new = newsb->s_security;
936 char oldflags = old->flags & SE_MNTMASK;
937 char newflags = new->flags & SE_MNTMASK;
938
939 if (oldflags != newflags)
940 goto mismatch;
941 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
942 goto mismatch;
943 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
944 goto mismatch;
945 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
946 goto mismatch;
947 if (oldflags & ROOTCONTEXT_MNT) {
948 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
949 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
950 if (oldroot->sid != newroot->sid)
951 goto mismatch;
952 }
953 return 0;
954 mismatch:
955 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
956 "different security settings for (dev %s, "
957 "type %s)\n", newsb->s_id, newsb->s_type->name);
958 return -EBUSY;
959 }
960
961 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
962 struct super_block *newsb)
963 {
964 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
965 struct superblock_security_struct *newsbsec = newsb->s_security;
966
967 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
968 int set_context = (oldsbsec->flags & CONTEXT_MNT);
969 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
970
971 /*
972 * if the parent was able to be mounted it clearly had no special lsm
973 * mount options. thus we can safely deal with this superblock later
974 */
975 if (!ss_initialized)
976 return 0;
977
978 /* how can we clone if the old one wasn't set up?? */
979 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
980
981 /* if fs is reusing a sb, make sure that the contexts match */
982 if (newsbsec->flags & SE_SBINITIALIZED)
983 return selinux_cmp_sb_context(oldsb, newsb);
984
985 mutex_lock(&newsbsec->lock);
986
987 newsbsec->flags = oldsbsec->flags;
988
989 newsbsec->sid = oldsbsec->sid;
990 newsbsec->def_sid = oldsbsec->def_sid;
991 newsbsec->behavior = oldsbsec->behavior;
992
993 if (set_context) {
994 u32 sid = oldsbsec->mntpoint_sid;
995
996 if (!set_fscontext)
997 newsbsec->sid = sid;
998 if (!set_rootcontext) {
999 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1000 newisec->sid = sid;
1001 }
1002 newsbsec->mntpoint_sid = sid;
1003 }
1004 if (set_rootcontext) {
1005 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1006 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1007
1008 newisec->sid = oldisec->sid;
1009 }
1010
1011 sb_finish_set_opts(newsb);
1012 mutex_unlock(&newsbsec->lock);
1013 return 0;
1014 }
1015
1016 static int selinux_parse_opts_str(char *options,
1017 struct security_mnt_opts *opts)
1018 {
1019 char *p;
1020 char *context = NULL, *defcontext = NULL;
1021 char *fscontext = NULL, *rootcontext = NULL;
1022 int rc, num_mnt_opts = 0;
1023
1024 opts->num_mnt_opts = 0;
1025
1026 /* Standard string-based options. */
1027 while ((p = strsep(&options, "|")) != NULL) {
1028 int token;
1029 substring_t args[MAX_OPT_ARGS];
1030
1031 if (!*p)
1032 continue;
1033
1034 token = match_token(p, tokens, args);
1035
1036 switch (token) {
1037 case Opt_context:
1038 if (context || defcontext) {
1039 rc = -EINVAL;
1040 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1041 goto out_err;
1042 }
1043 context = match_strdup(&args[0]);
1044 if (!context) {
1045 rc = -ENOMEM;
1046 goto out_err;
1047 }
1048 break;
1049
1050 case Opt_fscontext:
1051 if (fscontext) {
1052 rc = -EINVAL;
1053 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1054 goto out_err;
1055 }
1056 fscontext = match_strdup(&args[0]);
1057 if (!fscontext) {
1058 rc = -ENOMEM;
1059 goto out_err;
1060 }
1061 break;
1062
1063 case Opt_rootcontext:
1064 if (rootcontext) {
1065 rc = -EINVAL;
1066 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1067 goto out_err;
1068 }
1069 rootcontext = match_strdup(&args[0]);
1070 if (!rootcontext) {
1071 rc = -ENOMEM;
1072 goto out_err;
1073 }
1074 break;
1075
1076 case Opt_defcontext:
1077 if (context || defcontext) {
1078 rc = -EINVAL;
1079 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1080 goto out_err;
1081 }
1082 defcontext = match_strdup(&args[0]);
1083 if (!defcontext) {
1084 rc = -ENOMEM;
1085 goto out_err;
1086 }
1087 break;
1088 case Opt_labelsupport:
1089 break;
1090 default:
1091 rc = -EINVAL;
1092 printk(KERN_WARNING "SELinux: unknown mount option\n");
1093 goto out_err;
1094
1095 }
1096 }
1097
1098 rc = -ENOMEM;
1099 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1100 if (!opts->mnt_opts)
1101 goto out_err;
1102
1103 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1104 GFP_KERNEL);
1105 if (!opts->mnt_opts_flags) {
1106 kfree(opts->mnt_opts);
1107 goto out_err;
1108 }
1109
1110 if (fscontext) {
1111 opts->mnt_opts[num_mnt_opts] = fscontext;
1112 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1113 }
1114 if (context) {
1115 opts->mnt_opts[num_mnt_opts] = context;
1116 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1117 }
1118 if (rootcontext) {
1119 opts->mnt_opts[num_mnt_opts] = rootcontext;
1120 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1121 }
1122 if (defcontext) {
1123 opts->mnt_opts[num_mnt_opts] = defcontext;
1124 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1125 }
1126
1127 opts->num_mnt_opts = num_mnt_opts;
1128 return 0;
1129
1130 out_err:
1131 kfree(context);
1132 kfree(defcontext);
1133 kfree(fscontext);
1134 kfree(rootcontext);
1135 return rc;
1136 }
1137 /*
1138 * string mount options parsing and call set the sbsec
1139 */
1140 static int superblock_doinit(struct super_block *sb, void *data)
1141 {
1142 int rc = 0;
1143 char *options = data;
1144 struct security_mnt_opts opts;
1145
1146 security_init_mnt_opts(&opts);
1147
1148 if (!data)
1149 goto out;
1150
1151 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1152
1153 rc = selinux_parse_opts_str(options, &opts);
1154 if (rc)
1155 goto out_err;
1156
1157 out:
1158 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1159
1160 out_err:
1161 security_free_mnt_opts(&opts);
1162 return rc;
1163 }
1164
1165 static void selinux_write_opts(struct seq_file *m,
1166 struct security_mnt_opts *opts)
1167 {
1168 int i;
1169 char *prefix;
1170
1171 for (i = 0; i < opts->num_mnt_opts; i++) {
1172 char *has_comma;
1173
1174 if (opts->mnt_opts[i])
1175 has_comma = strchr(opts->mnt_opts[i], ',');
1176 else
1177 has_comma = NULL;
1178
1179 switch (opts->mnt_opts_flags[i]) {
1180 case CONTEXT_MNT:
1181 prefix = CONTEXT_STR;
1182 break;
1183 case FSCONTEXT_MNT:
1184 prefix = FSCONTEXT_STR;
1185 break;
1186 case ROOTCONTEXT_MNT:
1187 prefix = ROOTCONTEXT_STR;
1188 break;
1189 case DEFCONTEXT_MNT:
1190 prefix = DEFCONTEXT_STR;
1191 break;
1192 case SBLABEL_MNT:
1193 seq_putc(m, ',');
1194 seq_puts(m, LABELSUPP_STR);
1195 continue;
1196 default:
1197 BUG();
1198 return;
1199 };
1200 /* we need a comma before each option */
1201 seq_putc(m, ',');
1202 seq_puts(m, prefix);
1203 if (has_comma)
1204 seq_putc(m, '\"');
1205 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1206 if (has_comma)
1207 seq_putc(m, '\"');
1208 }
1209 }
1210
1211 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1212 {
1213 struct security_mnt_opts opts;
1214 int rc;
1215
1216 rc = selinux_get_mnt_opts(sb, &opts);
1217 if (rc) {
1218 /* before policy load we may get EINVAL, don't show anything */
1219 if (rc == -EINVAL)
1220 rc = 0;
1221 return rc;
1222 }
1223
1224 selinux_write_opts(m, &opts);
1225
1226 security_free_mnt_opts(&opts);
1227
1228 return rc;
1229 }
1230
1231 static inline u16 inode_mode_to_security_class(umode_t mode)
1232 {
1233 switch (mode & S_IFMT) {
1234 case S_IFSOCK:
1235 return SECCLASS_SOCK_FILE;
1236 case S_IFLNK:
1237 return SECCLASS_LNK_FILE;
1238 case S_IFREG:
1239 return SECCLASS_FILE;
1240 case S_IFBLK:
1241 return SECCLASS_BLK_FILE;
1242 case S_IFDIR:
1243 return SECCLASS_DIR;
1244 case S_IFCHR:
1245 return SECCLASS_CHR_FILE;
1246 case S_IFIFO:
1247 return SECCLASS_FIFO_FILE;
1248
1249 }
1250
1251 return SECCLASS_FILE;
1252 }
1253
1254 static inline int default_protocol_stream(int protocol)
1255 {
1256 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1257 }
1258
1259 static inline int default_protocol_dgram(int protocol)
1260 {
1261 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1262 }
1263
1264 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1265 {
1266 int extsockclass = selinux_policycap_extsockclass;
1267
1268 switch (family) {
1269 case PF_UNIX:
1270 switch (type) {
1271 case SOCK_STREAM:
1272 case SOCK_SEQPACKET:
1273 return SECCLASS_UNIX_STREAM_SOCKET;
1274 case SOCK_DGRAM:
1275 return SECCLASS_UNIX_DGRAM_SOCKET;
1276 }
1277 break;
1278 case PF_INET:
1279 case PF_INET6:
1280 switch (type) {
1281 case SOCK_STREAM:
1282 case SOCK_SEQPACKET:
1283 if (default_protocol_stream(protocol))
1284 return SECCLASS_TCP_SOCKET;
1285 else if (extsockclass && protocol == IPPROTO_SCTP)
1286 return SECCLASS_SCTP_SOCKET;
1287 else
1288 return SECCLASS_RAWIP_SOCKET;
1289 case SOCK_DGRAM:
1290 if (default_protocol_dgram(protocol))
1291 return SECCLASS_UDP_SOCKET;
1292 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1293 protocol == IPPROTO_ICMPV6))
1294 return SECCLASS_ICMP_SOCKET;
1295 else
1296 return SECCLASS_RAWIP_SOCKET;
1297 case SOCK_DCCP:
1298 return SECCLASS_DCCP_SOCKET;
1299 default:
1300 return SECCLASS_RAWIP_SOCKET;
1301 }
1302 break;
1303 case PF_NETLINK:
1304 switch (protocol) {
1305 case NETLINK_ROUTE:
1306 return SECCLASS_NETLINK_ROUTE_SOCKET;
1307 case NETLINK_SOCK_DIAG:
1308 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1309 case NETLINK_NFLOG:
1310 return SECCLASS_NETLINK_NFLOG_SOCKET;
1311 case NETLINK_XFRM:
1312 return SECCLASS_NETLINK_XFRM_SOCKET;
1313 case NETLINK_SELINUX:
1314 return SECCLASS_NETLINK_SELINUX_SOCKET;
1315 case NETLINK_ISCSI:
1316 return SECCLASS_NETLINK_ISCSI_SOCKET;
1317 case NETLINK_AUDIT:
1318 return SECCLASS_NETLINK_AUDIT_SOCKET;
1319 case NETLINK_FIB_LOOKUP:
1320 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1321 case NETLINK_CONNECTOR:
1322 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1323 case NETLINK_NETFILTER:
1324 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1325 case NETLINK_DNRTMSG:
1326 return SECCLASS_NETLINK_DNRT_SOCKET;
1327 case NETLINK_KOBJECT_UEVENT:
1328 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1329 case NETLINK_GENERIC:
1330 return SECCLASS_NETLINK_GENERIC_SOCKET;
1331 case NETLINK_SCSITRANSPORT:
1332 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1333 case NETLINK_RDMA:
1334 return SECCLASS_NETLINK_RDMA_SOCKET;
1335 case NETLINK_CRYPTO:
1336 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1337 default:
1338 return SECCLASS_NETLINK_SOCKET;
1339 }
1340 case PF_PACKET:
1341 return SECCLASS_PACKET_SOCKET;
1342 case PF_KEY:
1343 return SECCLASS_KEY_SOCKET;
1344 case PF_APPLETALK:
1345 return SECCLASS_APPLETALK_SOCKET;
1346 }
1347
1348 if (extsockclass) {
1349 switch (family) {
1350 case PF_AX25:
1351 return SECCLASS_AX25_SOCKET;
1352 case PF_IPX:
1353 return SECCLASS_IPX_SOCKET;
1354 case PF_NETROM:
1355 return SECCLASS_NETROM_SOCKET;
1356 case PF_ATMPVC:
1357 return SECCLASS_ATMPVC_SOCKET;
1358 case PF_X25:
1359 return SECCLASS_X25_SOCKET;
1360 case PF_ROSE:
1361 return SECCLASS_ROSE_SOCKET;
1362 case PF_DECnet:
1363 return SECCLASS_DECNET_SOCKET;
1364 case PF_ATMSVC:
1365 return SECCLASS_ATMSVC_SOCKET;
1366 case PF_RDS:
1367 return SECCLASS_RDS_SOCKET;
1368 case PF_IRDA:
1369 return SECCLASS_IRDA_SOCKET;
1370 case PF_PPPOX:
1371 return SECCLASS_PPPOX_SOCKET;
1372 case PF_LLC:
1373 return SECCLASS_LLC_SOCKET;
1374 case PF_CAN:
1375 return SECCLASS_CAN_SOCKET;
1376 case PF_TIPC:
1377 return SECCLASS_TIPC_SOCKET;
1378 case PF_BLUETOOTH:
1379 return SECCLASS_BLUETOOTH_SOCKET;
1380 case PF_IUCV:
1381 return SECCLASS_IUCV_SOCKET;
1382 case PF_RXRPC:
1383 return SECCLASS_RXRPC_SOCKET;
1384 case PF_ISDN:
1385 return SECCLASS_ISDN_SOCKET;
1386 case PF_PHONET:
1387 return SECCLASS_PHONET_SOCKET;
1388 case PF_IEEE802154:
1389 return SECCLASS_IEEE802154_SOCKET;
1390 case PF_CAIF:
1391 return SECCLASS_CAIF_SOCKET;
1392 case PF_ALG:
1393 return SECCLASS_ALG_SOCKET;
1394 case PF_NFC:
1395 return SECCLASS_NFC_SOCKET;
1396 case PF_VSOCK:
1397 return SECCLASS_VSOCK_SOCKET;
1398 case PF_KCM:
1399 return SECCLASS_KCM_SOCKET;
1400 case PF_QIPCRTR:
1401 return SECCLASS_QIPCRTR_SOCKET;
1402 case PF_SMC:
1403 return SECCLASS_SMC_SOCKET;
1404 #if PF_MAX > 44
1405 #error New address family defined, please update this function.
1406 #endif
1407 }
1408 }
1409
1410 return SECCLASS_SOCKET;
1411 }
1412
1413 static int selinux_genfs_get_sid(struct dentry *dentry,
1414 u16 tclass,
1415 u16 flags,
1416 u32 *sid)
1417 {
1418 int rc;
1419 struct super_block *sb = dentry->d_sb;
1420 char *buffer, *path;
1421
1422 buffer = (char *)__get_free_page(GFP_KERNEL);
1423 if (!buffer)
1424 return -ENOMEM;
1425
1426 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1427 if (IS_ERR(path))
1428 rc = PTR_ERR(path);
1429 else {
1430 if (flags & SE_SBPROC) {
1431 /* each process gets a /proc/PID/ entry. Strip off the
1432 * PID part to get a valid selinux labeling.
1433 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1434 while (path[1] >= '0' && path[1] <= '9') {
1435 path[1] = '/';
1436 path++;
1437 }
1438 }
1439 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1440 }
1441 free_page((unsigned long)buffer);
1442 return rc;
1443 }
1444
1445 /* The inode's security attributes must be initialized before first use. */
1446 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1447 {
1448 struct superblock_security_struct *sbsec = NULL;
1449 struct inode_security_struct *isec = inode->i_security;
1450 u32 task_sid, sid = 0;
1451 u16 sclass;
1452 struct dentry *dentry;
1453 #define INITCONTEXTLEN 255
1454 char *context = NULL;
1455 unsigned len = 0;
1456 int rc = 0;
1457
1458 if (isec->initialized == LABEL_INITIALIZED)
1459 return 0;
1460
1461 spin_lock(&isec->lock);
1462 if (isec->initialized == LABEL_INITIALIZED)
1463 goto out_unlock;
1464
1465 if (isec->sclass == SECCLASS_FILE)
1466 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1467
1468 sbsec = inode->i_sb->s_security;
1469 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1470 /* Defer initialization until selinux_complete_init,
1471 after the initial policy is loaded and the security
1472 server is ready to handle calls. */
1473 spin_lock(&sbsec->isec_lock);
1474 if (list_empty(&isec->list))
1475 list_add(&isec->list, &sbsec->isec_head);
1476 spin_unlock(&sbsec->isec_lock);
1477 goto out_unlock;
1478 }
1479
1480 sclass = isec->sclass;
1481 task_sid = isec->task_sid;
1482 sid = isec->sid;
1483 isec->initialized = LABEL_PENDING;
1484 spin_unlock(&isec->lock);
1485
1486 switch (sbsec->behavior) {
1487 case SECURITY_FS_USE_NATIVE:
1488 break;
1489 case SECURITY_FS_USE_XATTR:
1490 if (!(inode->i_opflags & IOP_XATTR)) {
1491 sid = sbsec->def_sid;
1492 break;
1493 }
1494 /* Need a dentry, since the xattr API requires one.
1495 Life would be simpler if we could just pass the inode. */
1496 if (opt_dentry) {
1497 /* Called from d_instantiate or d_splice_alias. */
1498 dentry = dget(opt_dentry);
1499 } else {
1500 /* Called from selinux_complete_init, try to find a dentry. */
1501 dentry = d_find_alias(inode);
1502 }
1503 if (!dentry) {
1504 /*
1505 * this is can be hit on boot when a file is accessed
1506 * before the policy is loaded. When we load policy we
1507 * may find inodes that have no dentry on the
1508 * sbsec->isec_head list. No reason to complain as these
1509 * will get fixed up the next time we go through
1510 * inode_doinit with a dentry, before these inodes could
1511 * be used again by userspace.
1512 */
1513 goto out;
1514 }
1515
1516 len = INITCONTEXTLEN;
1517 context = kmalloc(len+1, GFP_NOFS);
1518 if (!context) {
1519 rc = -ENOMEM;
1520 dput(dentry);
1521 goto out;
1522 }
1523 context[len] = '\0';
1524 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1525 if (rc == -ERANGE) {
1526 kfree(context);
1527
1528 /* Need a larger buffer. Query for the right size. */
1529 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1530 if (rc < 0) {
1531 dput(dentry);
1532 goto out;
1533 }
1534 len = rc;
1535 context = kmalloc(len+1, GFP_NOFS);
1536 if (!context) {
1537 rc = -ENOMEM;
1538 dput(dentry);
1539 goto out;
1540 }
1541 context[len] = '\0';
1542 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1543 }
1544 dput(dentry);
1545 if (rc < 0) {
1546 if (rc != -ENODATA) {
1547 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1548 "%d for dev=%s ino=%ld\n", __func__,
1549 -rc, inode->i_sb->s_id, inode->i_ino);
1550 kfree(context);
1551 goto out;
1552 }
1553 /* Map ENODATA to the default file SID */
1554 sid = sbsec->def_sid;
1555 rc = 0;
1556 } else {
1557 rc = security_context_to_sid_default(context, rc, &sid,
1558 sbsec->def_sid,
1559 GFP_NOFS);
1560 if (rc) {
1561 char *dev = inode->i_sb->s_id;
1562 unsigned long ino = inode->i_ino;
1563
1564 if (rc == -EINVAL) {
1565 if (printk_ratelimit())
1566 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1567 "context=%s. This indicates you may need to relabel the inode or the "
1568 "filesystem in question.\n", ino, dev, context);
1569 } else {
1570 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1571 "returned %d for dev=%s ino=%ld\n",
1572 __func__, context, -rc, dev, ino);
1573 }
1574 kfree(context);
1575 /* Leave with the unlabeled SID */
1576 rc = 0;
1577 break;
1578 }
1579 }
1580 kfree(context);
1581 break;
1582 case SECURITY_FS_USE_TASK:
1583 sid = task_sid;
1584 break;
1585 case SECURITY_FS_USE_TRANS:
1586 /* Default to the fs SID. */
1587 sid = sbsec->sid;
1588
1589 /* Try to obtain a transition SID. */
1590 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1591 if (rc)
1592 goto out;
1593 break;
1594 case SECURITY_FS_USE_MNTPOINT:
1595 sid = sbsec->mntpoint_sid;
1596 break;
1597 default:
1598 /* Default to the fs superblock SID. */
1599 sid = sbsec->sid;
1600
1601 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1602 /* We must have a dentry to determine the label on
1603 * procfs inodes */
1604 if (opt_dentry)
1605 /* Called from d_instantiate or
1606 * d_splice_alias. */
1607 dentry = dget(opt_dentry);
1608 else
1609 /* Called from selinux_complete_init, try to
1610 * find a dentry. */
1611 dentry = d_find_alias(inode);
1612 /*
1613 * This can be hit on boot when a file is accessed
1614 * before the policy is loaded. When we load policy we
1615 * may find inodes that have no dentry on the
1616 * sbsec->isec_head list. No reason to complain as
1617 * these will get fixed up the next time we go through
1618 * inode_doinit() with a dentry, before these inodes
1619 * could be used again by userspace.
1620 */
1621 if (!dentry)
1622 goto out;
1623 rc = selinux_genfs_get_sid(dentry, sclass,
1624 sbsec->flags, &sid);
1625 dput(dentry);
1626 if (rc)
1627 goto out;
1628 }
1629 break;
1630 }
1631
1632 out:
1633 spin_lock(&isec->lock);
1634 if (isec->initialized == LABEL_PENDING) {
1635 if (!sid || rc) {
1636 isec->initialized = LABEL_INVALID;
1637 goto out_unlock;
1638 }
1639
1640 isec->initialized = LABEL_INITIALIZED;
1641 isec->sid = sid;
1642 }
1643
1644 out_unlock:
1645 spin_unlock(&isec->lock);
1646 return rc;
1647 }
1648
1649 /* Convert a Linux signal to an access vector. */
1650 static inline u32 signal_to_av(int sig)
1651 {
1652 u32 perm = 0;
1653
1654 switch (sig) {
1655 case SIGCHLD:
1656 /* Commonly granted from child to parent. */
1657 perm = PROCESS__SIGCHLD;
1658 break;
1659 case SIGKILL:
1660 /* Cannot be caught or ignored */
1661 perm = PROCESS__SIGKILL;
1662 break;
1663 case SIGSTOP:
1664 /* Cannot be caught or ignored */
1665 perm = PROCESS__SIGSTOP;
1666 break;
1667 default:
1668 /* All other signals. */
1669 perm = PROCESS__SIGNAL;
1670 break;
1671 }
1672
1673 return perm;
1674 }
1675
1676 #if CAP_LAST_CAP > 63
1677 #error Fix SELinux to handle capabilities > 63.
1678 #endif
1679
1680 /* Check whether a task is allowed to use a capability. */
1681 static int cred_has_capability(const struct cred *cred,
1682 int cap, int audit, bool initns)
1683 {
1684 struct common_audit_data ad;
1685 struct av_decision avd;
1686 u16 sclass;
1687 u32 sid = cred_sid(cred);
1688 u32 av = CAP_TO_MASK(cap);
1689 int rc;
1690
1691 ad.type = LSM_AUDIT_DATA_CAP;
1692 ad.u.cap = cap;
1693
1694 switch (CAP_TO_INDEX(cap)) {
1695 case 0:
1696 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1697 break;
1698 case 1:
1699 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1700 break;
1701 default:
1702 printk(KERN_ERR
1703 "SELinux: out of range capability %d\n", cap);
1704 BUG();
1705 return -EINVAL;
1706 }
1707
1708 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1709 if (audit == SECURITY_CAP_AUDIT) {
1710 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1711 if (rc2)
1712 return rc2;
1713 }
1714 return rc;
1715 }
1716
1717 /* Check whether a task has a particular permission to an inode.
1718 The 'adp' parameter is optional and allows other audit
1719 data to be passed (e.g. the dentry). */
1720 static int inode_has_perm(const struct cred *cred,
1721 struct inode *inode,
1722 u32 perms,
1723 struct common_audit_data *adp)
1724 {
1725 struct inode_security_struct *isec;
1726 u32 sid;
1727
1728 validate_creds(cred);
1729
1730 if (unlikely(IS_PRIVATE(inode)))
1731 return 0;
1732
1733 sid = cred_sid(cred);
1734 isec = inode->i_security;
1735
1736 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1737 }
1738
1739 /* Same as inode_has_perm, but pass explicit audit data containing
1740 the dentry to help the auditing code to more easily generate the
1741 pathname if needed. */
1742 static inline int dentry_has_perm(const struct cred *cred,
1743 struct dentry *dentry,
1744 u32 av)
1745 {
1746 struct inode *inode = d_backing_inode(dentry);
1747 struct common_audit_data ad;
1748
1749 ad.type = LSM_AUDIT_DATA_DENTRY;
1750 ad.u.dentry = dentry;
1751 __inode_security_revalidate(inode, dentry, true);
1752 return inode_has_perm(cred, inode, av, &ad);
1753 }
1754
1755 /* Same as inode_has_perm, but pass explicit audit data containing
1756 the path to help the auditing code to more easily generate the
1757 pathname if needed. */
1758 static inline int path_has_perm(const struct cred *cred,
1759 const struct path *path,
1760 u32 av)
1761 {
1762 struct inode *inode = d_backing_inode(path->dentry);
1763 struct common_audit_data ad;
1764
1765 ad.type = LSM_AUDIT_DATA_PATH;
1766 ad.u.path = *path;
1767 __inode_security_revalidate(inode, path->dentry, true);
1768 return inode_has_perm(cred, inode, av, &ad);
1769 }
1770
1771 /* Same as path_has_perm, but uses the inode from the file struct. */
1772 static inline int file_path_has_perm(const struct cred *cred,
1773 struct file *file,
1774 u32 av)
1775 {
1776 struct common_audit_data ad;
1777
1778 ad.type = LSM_AUDIT_DATA_FILE;
1779 ad.u.file = file;
1780 return inode_has_perm(cred, file_inode(file), av, &ad);
1781 }
1782
1783 /* Check whether a task can use an open file descriptor to
1784 access an inode in a given way. Check access to the
1785 descriptor itself, and then use dentry_has_perm to
1786 check a particular permission to the file.
1787 Access to the descriptor is implicitly granted if it
1788 has the same SID as the process. If av is zero, then
1789 access to the file is not checked, e.g. for cases
1790 where only the descriptor is affected like seek. */
1791 static int file_has_perm(const struct cred *cred,
1792 struct file *file,
1793 u32 av)
1794 {
1795 struct file_security_struct *fsec = file->f_security;
1796 struct inode *inode = file_inode(file);
1797 struct common_audit_data ad;
1798 u32 sid = cred_sid(cred);
1799 int rc;
1800
1801 ad.type = LSM_AUDIT_DATA_FILE;
1802 ad.u.file = file;
1803
1804 if (sid != fsec->sid) {
1805 rc = avc_has_perm(sid, fsec->sid,
1806 SECCLASS_FD,
1807 FD__USE,
1808 &ad);
1809 if (rc)
1810 goto out;
1811 }
1812
1813 /* av is zero if only checking access to the descriptor. */
1814 rc = 0;
1815 if (av)
1816 rc = inode_has_perm(cred, inode, av, &ad);
1817
1818 out:
1819 return rc;
1820 }
1821
1822 /*
1823 * Determine the label for an inode that might be unioned.
1824 */
1825 static int
1826 selinux_determine_inode_label(const struct task_security_struct *tsec,
1827 struct inode *dir,
1828 const struct qstr *name, u16 tclass,
1829 u32 *_new_isid)
1830 {
1831 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1832
1833 if ((sbsec->flags & SE_SBINITIALIZED) &&
1834 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1835 *_new_isid = sbsec->mntpoint_sid;
1836 } else if ((sbsec->flags & SBLABEL_MNT) &&
1837 tsec->create_sid) {
1838 *_new_isid = tsec->create_sid;
1839 } else {
1840 const struct inode_security_struct *dsec = inode_security(dir);
1841 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1842 name, _new_isid);
1843 }
1844
1845 return 0;
1846 }
1847
1848 /* Check whether a task can create a file. */
1849 static int may_create(struct inode *dir,
1850 struct dentry *dentry,
1851 u16 tclass)
1852 {
1853 const struct task_security_struct *tsec = current_security();
1854 struct inode_security_struct *dsec;
1855 struct superblock_security_struct *sbsec;
1856 u32 sid, newsid;
1857 struct common_audit_data ad;
1858 int rc;
1859
1860 dsec = inode_security(dir);
1861 sbsec = dir->i_sb->s_security;
1862
1863 sid = tsec->sid;
1864
1865 ad.type = LSM_AUDIT_DATA_DENTRY;
1866 ad.u.dentry = dentry;
1867
1868 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1869 DIR__ADD_NAME | DIR__SEARCH,
1870 &ad);
1871 if (rc)
1872 return rc;
1873
1874 rc = selinux_determine_inode_label(current_security(), dir,
1875 &dentry->d_name, tclass, &newsid);
1876 if (rc)
1877 return rc;
1878
1879 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1880 if (rc)
1881 return rc;
1882
1883 return avc_has_perm(newsid, sbsec->sid,
1884 SECCLASS_FILESYSTEM,
1885 FILESYSTEM__ASSOCIATE, &ad);
1886 }
1887
1888 #define MAY_LINK 0
1889 #define MAY_UNLINK 1
1890 #define MAY_RMDIR 2
1891
1892 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1893 static int may_link(struct inode *dir,
1894 struct dentry *dentry,
1895 int kind)
1896
1897 {
1898 struct inode_security_struct *dsec, *isec;
1899 struct common_audit_data ad;
1900 u32 sid = current_sid();
1901 u32 av;
1902 int rc;
1903
1904 dsec = inode_security(dir);
1905 isec = backing_inode_security(dentry);
1906
1907 ad.type = LSM_AUDIT_DATA_DENTRY;
1908 ad.u.dentry = dentry;
1909
1910 av = DIR__SEARCH;
1911 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1912 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1913 if (rc)
1914 return rc;
1915
1916 switch (kind) {
1917 case MAY_LINK:
1918 av = FILE__LINK;
1919 break;
1920 case MAY_UNLINK:
1921 av = FILE__UNLINK;
1922 break;
1923 case MAY_RMDIR:
1924 av = DIR__RMDIR;
1925 break;
1926 default:
1927 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1928 __func__, kind);
1929 return 0;
1930 }
1931
1932 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1933 return rc;
1934 }
1935
1936 static inline int may_rename(struct inode *old_dir,
1937 struct dentry *old_dentry,
1938 struct inode *new_dir,
1939 struct dentry *new_dentry)
1940 {
1941 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1942 struct common_audit_data ad;
1943 u32 sid = current_sid();
1944 u32 av;
1945 int old_is_dir, new_is_dir;
1946 int rc;
1947
1948 old_dsec = inode_security(old_dir);
1949 old_isec = backing_inode_security(old_dentry);
1950 old_is_dir = d_is_dir(old_dentry);
1951 new_dsec = inode_security(new_dir);
1952
1953 ad.type = LSM_AUDIT_DATA_DENTRY;
1954
1955 ad.u.dentry = old_dentry;
1956 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1957 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1958 if (rc)
1959 return rc;
1960 rc = avc_has_perm(sid, old_isec->sid,
1961 old_isec->sclass, FILE__RENAME, &ad);
1962 if (rc)
1963 return rc;
1964 if (old_is_dir && new_dir != old_dir) {
1965 rc = avc_has_perm(sid, old_isec->sid,
1966 old_isec->sclass, DIR__REPARENT, &ad);
1967 if (rc)
1968 return rc;
1969 }
1970
1971 ad.u.dentry = new_dentry;
1972 av = DIR__ADD_NAME | DIR__SEARCH;
1973 if (d_is_positive(new_dentry))
1974 av |= DIR__REMOVE_NAME;
1975 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1976 if (rc)
1977 return rc;
1978 if (d_is_positive(new_dentry)) {
1979 new_isec = backing_inode_security(new_dentry);
1980 new_is_dir = d_is_dir(new_dentry);
1981 rc = avc_has_perm(sid, new_isec->sid,
1982 new_isec->sclass,
1983 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1984 if (rc)
1985 return rc;
1986 }
1987
1988 return 0;
1989 }
1990
1991 /* Check whether a task can perform a filesystem operation. */
1992 static int superblock_has_perm(const struct cred *cred,
1993 struct super_block *sb,
1994 u32 perms,
1995 struct common_audit_data *ad)
1996 {
1997 struct superblock_security_struct *sbsec;
1998 u32 sid = cred_sid(cred);
1999
2000 sbsec = sb->s_security;
2001 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2002 }
2003
2004 /* Convert a Linux mode and permission mask to an access vector. */
2005 static inline u32 file_mask_to_av(int mode, int mask)
2006 {
2007 u32 av = 0;
2008
2009 if (!S_ISDIR(mode)) {
2010 if (mask & MAY_EXEC)
2011 av |= FILE__EXECUTE;
2012 if (mask & MAY_READ)
2013 av |= FILE__READ;
2014
2015 if (mask & MAY_APPEND)
2016 av |= FILE__APPEND;
2017 else if (mask & MAY_WRITE)
2018 av |= FILE__WRITE;
2019
2020 } else {
2021 if (mask & MAY_EXEC)
2022 av |= DIR__SEARCH;
2023 if (mask & MAY_WRITE)
2024 av |= DIR__WRITE;
2025 if (mask & MAY_READ)
2026 av |= DIR__READ;
2027 }
2028
2029 return av;
2030 }
2031
2032 /* Convert a Linux file to an access vector. */
2033 static inline u32 file_to_av(struct file *file)
2034 {
2035 u32 av = 0;
2036
2037 if (file->f_mode & FMODE_READ)
2038 av |= FILE__READ;
2039 if (file->f_mode & FMODE_WRITE) {
2040 if (file->f_flags & O_APPEND)
2041 av |= FILE__APPEND;
2042 else
2043 av |= FILE__WRITE;
2044 }
2045 if (!av) {
2046 /*
2047 * Special file opened with flags 3 for ioctl-only use.
2048 */
2049 av = FILE__IOCTL;
2050 }
2051
2052 return av;
2053 }
2054
2055 /*
2056 * Convert a file to an access vector and include the correct open
2057 * open permission.
2058 */
2059 static inline u32 open_file_to_av(struct file *file)
2060 {
2061 u32 av = file_to_av(file);
2062 struct inode *inode = file_inode(file);
2063
2064 if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
2065 av |= FILE__OPEN;
2066
2067 return av;
2068 }
2069
2070 /* Hook functions begin here. */
2071
2072 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2073 {
2074 u32 mysid = current_sid();
2075 u32 mgrsid = task_sid(mgr);
2076
2077 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2078 BINDER__SET_CONTEXT_MGR, NULL);
2079 }
2080
2081 static int selinux_binder_transaction(struct task_struct *from,
2082 struct task_struct *to)
2083 {
2084 u32 mysid = current_sid();
2085 u32 fromsid = task_sid(from);
2086 u32 tosid = task_sid(to);
2087 int rc;
2088
2089 if (mysid != fromsid) {
2090 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2091 BINDER__IMPERSONATE, NULL);
2092 if (rc)
2093 return rc;
2094 }
2095
2096 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2097 NULL);
2098 }
2099
2100 static int selinux_binder_transfer_binder(struct task_struct *from,
2101 struct task_struct *to)
2102 {
2103 u32 fromsid = task_sid(from);
2104 u32 tosid = task_sid(to);
2105
2106 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2107 NULL);
2108 }
2109
2110 static int selinux_binder_transfer_file(struct task_struct *from,
2111 struct task_struct *to,
2112 struct file *file)
2113 {
2114 u32 sid = task_sid(to);
2115 struct file_security_struct *fsec = file->f_security;
2116 struct dentry *dentry = file->f_path.dentry;
2117 struct inode_security_struct *isec;
2118 struct common_audit_data ad;
2119 int rc;
2120
2121 ad.type = LSM_AUDIT_DATA_PATH;
2122 ad.u.path = file->f_path;
2123
2124 if (sid != fsec->sid) {
2125 rc = avc_has_perm(sid, fsec->sid,
2126 SECCLASS_FD,
2127 FD__USE,
2128 &ad);
2129 if (rc)
2130 return rc;
2131 }
2132
2133 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2134 return 0;
2135
2136 isec = backing_inode_security(dentry);
2137 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2138 &ad);
2139 }
2140
2141 static int selinux_ptrace_access_check(struct task_struct *child,
2142 unsigned int mode)
2143 {
2144 u32 sid = current_sid();
2145 u32 csid = task_sid(child);
2146
2147 if (mode & PTRACE_MODE_READ)
2148 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2149
2150 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2151 }
2152
2153 static int selinux_ptrace_traceme(struct task_struct *parent)
2154 {
2155 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2156 PROCESS__PTRACE, NULL);
2157 }
2158
2159 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2160 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2161 {
2162 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2163 PROCESS__GETCAP, NULL);
2164 }
2165
2166 static int selinux_capset(struct cred *new, const struct cred *old,
2167 const kernel_cap_t *effective,
2168 const kernel_cap_t *inheritable,
2169 const kernel_cap_t *permitted)
2170 {
2171 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2172 PROCESS__SETCAP, NULL);
2173 }
2174
2175 /*
2176 * (This comment used to live with the selinux_task_setuid hook,
2177 * which was removed).
2178 *
2179 * Since setuid only affects the current process, and since the SELinux
2180 * controls are not based on the Linux identity attributes, SELinux does not
2181 * need to control this operation. However, SELinux does control the use of
2182 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2183 */
2184
2185 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2186 int cap, int audit)
2187 {
2188 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2189 }
2190
2191 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2192 {
2193 const struct cred *cred = current_cred();
2194 int rc = 0;
2195
2196 if (!sb)
2197 return 0;
2198
2199 switch (cmds) {
2200 case Q_SYNC:
2201 case Q_QUOTAON:
2202 case Q_QUOTAOFF:
2203 case Q_SETINFO:
2204 case Q_SETQUOTA:
2205 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2206 break;
2207 case Q_GETFMT:
2208 case Q_GETINFO:
2209 case Q_GETQUOTA:
2210 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2211 break;
2212 default:
2213 rc = 0; /* let the kernel handle invalid cmds */
2214 break;
2215 }
2216 return rc;
2217 }
2218
2219 static int selinux_quota_on(struct dentry *dentry)
2220 {
2221 const struct cred *cred = current_cred();
2222
2223 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2224 }
2225
2226 static int selinux_syslog(int type)
2227 {
2228 switch (type) {
2229 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2230 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2231 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2232 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2233 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2234 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2235 /* Set level of messages printed to console */
2236 case SYSLOG_ACTION_CONSOLE_LEVEL:
2237 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2238 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2239 NULL);
2240 }
2241 /* All other syslog types */
2242 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2243 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2244 }
2245
2246 /*
2247 * Check that a process has enough memory to allocate a new virtual
2248 * mapping. 0 means there is enough memory for the allocation to
2249 * succeed and -ENOMEM implies there is not.
2250 *
2251 * Do not audit the selinux permission check, as this is applied to all
2252 * processes that allocate mappings.
2253 */
2254 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2255 {
2256 int rc, cap_sys_admin = 0;
2257
2258 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2259 SECURITY_CAP_NOAUDIT, true);
2260 if (rc == 0)
2261 cap_sys_admin = 1;
2262
2263 return cap_sys_admin;
2264 }
2265
2266 /* binprm security operations */
2267
2268 static u32 ptrace_parent_sid(void)
2269 {
2270 u32 sid = 0;
2271 struct task_struct *tracer;
2272
2273 rcu_read_lock();
2274 tracer = ptrace_parent(current);
2275 if (tracer)
2276 sid = task_sid(tracer);
2277 rcu_read_unlock();
2278
2279 return sid;
2280 }
2281
2282 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2283 const struct task_security_struct *old_tsec,
2284 const struct task_security_struct *new_tsec)
2285 {
2286 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2287 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2288 int rc;
2289
2290 if (!nnp && !nosuid)
2291 return 0; /* neither NNP nor nosuid */
2292
2293 if (new_tsec->sid == old_tsec->sid)
2294 return 0; /* No change in credentials */
2295
2296 /*
2297 * The only transitions we permit under NNP or nosuid
2298 * are transitions to bounded SIDs, i.e. SIDs that are
2299 * guaranteed to only be allowed a subset of the permissions
2300 * of the current SID.
2301 */
2302 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2303 if (rc) {
2304 /*
2305 * On failure, preserve the errno values for NNP vs nosuid.
2306 * NNP: Operation not permitted for caller.
2307 * nosuid: Permission denied to file.
2308 */
2309 if (nnp)
2310 return -EPERM;
2311 else
2312 return -EACCES;
2313 }
2314 return 0;
2315 }
2316
2317 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2318 {
2319 const struct task_security_struct *old_tsec;
2320 struct task_security_struct *new_tsec;
2321 struct inode_security_struct *isec;
2322 struct common_audit_data ad;
2323 struct inode *inode = file_inode(bprm->file);
2324 int rc;
2325
2326 /* SELinux context only depends on initial program or script and not
2327 * the script interpreter */
2328 if (bprm->cred_prepared)
2329 return 0;
2330
2331 old_tsec = current_security();
2332 new_tsec = bprm->cred->security;
2333 isec = inode_security(inode);
2334
2335 /* Default to the current task SID. */
2336 new_tsec->sid = old_tsec->sid;
2337 new_tsec->osid = old_tsec->sid;
2338
2339 /* Reset fs, key, and sock SIDs on execve. */
2340 new_tsec->create_sid = 0;
2341 new_tsec->keycreate_sid = 0;
2342 new_tsec->sockcreate_sid = 0;
2343
2344 if (old_tsec->exec_sid) {
2345 new_tsec->sid = old_tsec->exec_sid;
2346 /* Reset exec SID on execve. */
2347 new_tsec->exec_sid = 0;
2348
2349 /* Fail on NNP or nosuid if not an allowed transition. */
2350 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2351 if (rc)
2352 return rc;
2353 } else {
2354 /* Check for a default transition on this program. */
2355 rc = security_transition_sid(old_tsec->sid, isec->sid,
2356 SECCLASS_PROCESS, NULL,
2357 &new_tsec->sid);
2358 if (rc)
2359 return rc;
2360
2361 /*
2362 * Fallback to old SID on NNP or nosuid if not an allowed
2363 * transition.
2364 */
2365 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2366 if (rc)
2367 new_tsec->sid = old_tsec->sid;
2368 }
2369
2370 ad.type = LSM_AUDIT_DATA_FILE;
2371 ad.u.file = bprm->file;
2372
2373 if (new_tsec->sid == old_tsec->sid) {
2374 rc = avc_has_perm(old_tsec->sid, isec->sid,
2375 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2376 if (rc)
2377 return rc;
2378 } else {
2379 /* Check permissions for the transition. */
2380 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2381 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2382 if (rc)
2383 return rc;
2384
2385 rc = avc_has_perm(new_tsec->sid, isec->sid,
2386 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2387 if (rc)
2388 return rc;
2389
2390 /* Check for shared state */
2391 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2392 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2393 SECCLASS_PROCESS, PROCESS__SHARE,
2394 NULL);
2395 if (rc)
2396 return -EPERM;
2397 }
2398
2399 /* Make sure that anyone attempting to ptrace over a task that
2400 * changes its SID has the appropriate permit */
2401 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2402 u32 ptsid = ptrace_parent_sid();
2403 if (ptsid != 0) {
2404 rc = avc_has_perm(ptsid, new_tsec->sid,
2405 SECCLASS_PROCESS,
2406 PROCESS__PTRACE, NULL);
2407 if (rc)
2408 return -EPERM;
2409 }
2410 }
2411
2412 /* Clear any possibly unsafe personality bits on exec: */
2413 bprm->per_clear |= PER_CLEAR_ON_SETID;
2414 }
2415
2416 return 0;
2417 }
2418
2419 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2420 {
2421 const struct task_security_struct *tsec = current_security();
2422 u32 sid, osid;
2423 int atsecure = 0;
2424
2425 sid = tsec->sid;
2426 osid = tsec->osid;
2427
2428 if (osid != sid) {
2429 /* Enable secure mode for SIDs transitions unless
2430 the noatsecure permission is granted between
2431 the two SIDs, i.e. ahp returns 0. */
2432 atsecure = avc_has_perm(osid, sid,
2433 SECCLASS_PROCESS,
2434 PROCESS__NOATSECURE, NULL);
2435 }
2436
2437 return !!atsecure;
2438 }
2439
2440 static int match_file(const void *p, struct file *file, unsigned fd)
2441 {
2442 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2443 }
2444
2445 /* Derived from fs/exec.c:flush_old_files. */
2446 static inline void flush_unauthorized_files(const struct cred *cred,
2447 struct files_struct *files)
2448 {
2449 struct file *file, *devnull = NULL;
2450 struct tty_struct *tty;
2451 int drop_tty = 0;
2452 unsigned n;
2453
2454 tty = get_current_tty();
2455 if (tty) {
2456 spin_lock(&tty->files_lock);
2457 if (!list_empty(&tty->tty_files)) {
2458 struct tty_file_private *file_priv;
2459
2460 /* Revalidate access to controlling tty.
2461 Use file_path_has_perm on the tty path directly
2462 rather than using file_has_perm, as this particular
2463 open file may belong to another process and we are
2464 only interested in the inode-based check here. */
2465 file_priv = list_first_entry(&tty->tty_files,
2466 struct tty_file_private, list);
2467 file = file_priv->file;
2468 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2469 drop_tty = 1;
2470 }
2471 spin_unlock(&tty->files_lock);
2472 tty_kref_put(tty);
2473 }
2474 /* Reset controlling tty. */
2475 if (drop_tty)
2476 no_tty();
2477
2478 /* Revalidate access to inherited open files. */
2479 n = iterate_fd(files, 0, match_file, cred);
2480 if (!n) /* none found? */
2481 return;
2482
2483 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2484 if (IS_ERR(devnull))
2485 devnull = NULL;
2486 /* replace all the matching ones with this */
2487 do {
2488 replace_fd(n - 1, devnull, 0);
2489 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2490 if (devnull)
2491 fput(devnull);
2492 }
2493
2494 /*
2495 * Prepare a process for imminent new credential changes due to exec
2496 */
2497 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2498 {
2499 struct task_security_struct *new_tsec;
2500 struct rlimit *rlim, *initrlim;
2501 int rc, i;
2502
2503 new_tsec = bprm->cred->security;
2504 if (new_tsec->sid == new_tsec->osid)
2505 return;
2506
2507 /* Close files for which the new task SID is not authorized. */
2508 flush_unauthorized_files(bprm->cred, current->files);
2509
2510 /* Always clear parent death signal on SID transitions. */
2511 current->pdeath_signal = 0;
2512
2513 /* Check whether the new SID can inherit resource limits from the old
2514 * SID. If not, reset all soft limits to the lower of the current
2515 * task's hard limit and the init task's soft limit.
2516 *
2517 * Note that the setting of hard limits (even to lower them) can be
2518 * controlled by the setrlimit check. The inclusion of the init task's
2519 * soft limit into the computation is to avoid resetting soft limits
2520 * higher than the default soft limit for cases where the default is
2521 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2522 */
2523 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2524 PROCESS__RLIMITINH, NULL);
2525 if (rc) {
2526 /* protect against do_prlimit() */
2527 task_lock(current);
2528 for (i = 0; i < RLIM_NLIMITS; i++) {
2529 rlim = current->signal->rlim + i;
2530 initrlim = init_task.signal->rlim + i;
2531 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2532 }
2533 task_unlock(current);
2534 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2535 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2536 }
2537 }
2538
2539 /*
2540 * Clean up the process immediately after the installation of new credentials
2541 * due to exec
2542 */
2543 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2544 {
2545 const struct task_security_struct *tsec = current_security();
2546 struct itimerval itimer;
2547 u32 osid, sid;
2548 int rc, i;
2549
2550 osid = tsec->osid;
2551 sid = tsec->sid;
2552
2553 if (sid == osid)
2554 return;
2555
2556 /* Check whether the new SID can inherit signal state from the old SID.
2557 * If not, clear itimers to avoid subsequent signal generation and
2558 * flush and unblock signals.
2559 *
2560 * This must occur _after_ the task SID has been updated so that any
2561 * kill done after the flush will be checked against the new SID.
2562 */
2563 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2564 if (rc) {
2565 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2566 memset(&itimer, 0, sizeof itimer);
2567 for (i = 0; i < 3; i++)
2568 do_setitimer(i, &itimer, NULL);
2569 }
2570 spin_lock_irq(&current->sighand->siglock);
2571 if (!fatal_signal_pending(current)) {
2572 flush_sigqueue(&current->pending);
2573 flush_sigqueue(&current->signal->shared_pending);
2574 flush_signal_handlers(current, 1);
2575 sigemptyset(&current->blocked);
2576 recalc_sigpending();
2577 }
2578 spin_unlock_irq(&current->sighand->siglock);
2579 }
2580
2581 /* Wake up the parent if it is waiting so that it can recheck
2582 * wait permission to the new task SID. */
2583 read_lock(&tasklist_lock);
2584 __wake_up_parent(current, current->real_parent);
2585 read_unlock(&tasklist_lock);
2586 }
2587
2588 /* superblock security operations */
2589
2590 static int selinux_sb_alloc_security(struct super_block *sb)
2591 {
2592 return superblock_alloc_security(sb);
2593 }
2594
2595 static void selinux_sb_free_security(struct super_block *sb)
2596 {
2597 superblock_free_security(sb);
2598 }
2599
2600 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2601 {
2602 if (plen > olen)
2603 return 0;
2604
2605 return !memcmp(prefix, option, plen);
2606 }
2607
2608 static inline int selinux_option(char *option, int len)
2609 {
2610 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2611 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2612 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2613 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2614 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2615 }
2616
2617 static inline void take_option(char **to, char *from, int *first, int len)
2618 {
2619 if (!*first) {
2620 **to = ',';
2621 *to += 1;
2622 } else
2623 *first = 0;
2624 memcpy(*to, from, len);
2625 *to += len;
2626 }
2627
2628 static inline void take_selinux_option(char **to, char *from, int *first,
2629 int len)
2630 {
2631 int current_size = 0;
2632
2633 if (!*first) {
2634 **to = '|';
2635 *to += 1;
2636 } else
2637 *first = 0;
2638
2639 while (current_size < len) {
2640 if (*from != '"') {
2641 **to = *from;
2642 *to += 1;
2643 }
2644 from += 1;
2645 current_size += 1;
2646 }
2647 }
2648
2649 static int selinux_sb_copy_data(char *orig, char *copy)
2650 {
2651 int fnosec, fsec, rc = 0;
2652 char *in_save, *in_curr, *in_end;
2653 char *sec_curr, *nosec_save, *nosec;
2654 int open_quote = 0;
2655
2656 in_curr = orig;
2657 sec_curr = copy;
2658
2659 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2660 if (!nosec) {
2661 rc = -ENOMEM;
2662 goto out;
2663 }
2664
2665 nosec_save = nosec;
2666 fnosec = fsec = 1;
2667 in_save = in_end = orig;
2668
2669 do {
2670 if (*in_end == '"')
2671 open_quote = !open_quote;
2672 if ((*in_end == ',' && open_quote == 0) ||
2673 *in_end == '\0') {
2674 int len = in_end - in_curr;
2675
2676 if (selinux_option(in_curr, len))
2677 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2678 else
2679 take_option(&nosec, in_curr, &fnosec, len);
2680
2681 in_curr = in_end + 1;
2682 }
2683 } while (*in_end++);
2684
2685 strcpy(in_save, nosec_save);
2686 free_page((unsigned long)nosec_save);
2687 out:
2688 return rc;
2689 }
2690
2691 static int selinux_sb_remount(struct super_block *sb, void *data)
2692 {
2693 int rc, i, *flags;
2694 struct security_mnt_opts opts;
2695 char *secdata, **mount_options;
2696 struct superblock_security_struct *sbsec = sb->s_security;
2697
2698 if (!(sbsec->flags & SE_SBINITIALIZED))
2699 return 0;
2700
2701 if (!data)
2702 return 0;
2703
2704 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2705 return 0;
2706
2707 security_init_mnt_opts(&opts);
2708 secdata = alloc_secdata();
2709 if (!secdata)
2710 return -ENOMEM;
2711 rc = selinux_sb_copy_data(data, secdata);
2712 if (rc)
2713 goto out_free_secdata;
2714
2715 rc = selinux_parse_opts_str(secdata, &opts);
2716 if (rc)
2717 goto out_free_secdata;
2718
2719 mount_options = opts.mnt_opts;
2720 flags = opts.mnt_opts_flags;
2721
2722 for (i = 0; i < opts.num_mnt_opts; i++) {
2723 u32 sid;
2724
2725 if (flags[i] == SBLABEL_MNT)
2726 continue;
2727 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2728 if (rc) {
2729 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2730 "(%s) failed for (dev %s, type %s) errno=%d\n",
2731 mount_options[i], sb->s_id, sb->s_type->name, rc);
2732 goto out_free_opts;
2733 }
2734 rc = -EINVAL;
2735 switch (flags[i]) {
2736 case FSCONTEXT_MNT:
2737 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2738 goto out_bad_option;
2739 break;
2740 case CONTEXT_MNT:
2741 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2742 goto out_bad_option;
2743 break;
2744 case ROOTCONTEXT_MNT: {
2745 struct inode_security_struct *root_isec;
2746 root_isec = backing_inode_security(sb->s_root);
2747
2748 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2749 goto out_bad_option;
2750 break;
2751 }
2752 case DEFCONTEXT_MNT:
2753 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2754 goto out_bad_option;
2755 break;
2756 default:
2757 goto out_free_opts;
2758 }
2759 }
2760
2761 rc = 0;
2762 out_free_opts:
2763 security_free_mnt_opts(&opts);
2764 out_free_secdata:
2765 free_secdata(secdata);
2766 return rc;
2767 out_bad_option:
2768 printk(KERN_WARNING "SELinux: unable to change security options "
2769 "during remount (dev %s, type=%s)\n", sb->s_id,
2770 sb->s_type->name);
2771 goto out_free_opts;
2772 }
2773
2774 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2775 {
2776 const struct cred *cred = current_cred();
2777 struct common_audit_data ad;
2778 int rc;
2779
2780 rc = superblock_doinit(sb, data);
2781 if (rc)
2782 return rc;
2783
2784 /* Allow all mounts performed by the kernel */
2785 if (flags & MS_KERNMOUNT)
2786 return 0;
2787
2788 ad.type = LSM_AUDIT_DATA_DENTRY;
2789 ad.u.dentry = sb->s_root;
2790 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2791 }
2792
2793 static int selinux_sb_statfs(struct dentry *dentry)
2794 {
2795 const struct cred *cred = current_cred();
2796 struct common_audit_data ad;
2797
2798 ad.type = LSM_AUDIT_DATA_DENTRY;
2799 ad.u.dentry = dentry->d_sb->s_root;
2800 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2801 }
2802
2803 static int selinux_mount(const char *dev_name,
2804 const struct path *path,
2805 const char *type,
2806 unsigned long flags,
2807 void *data)
2808 {
2809 const struct cred *cred = current_cred();
2810
2811 if (flags & MS_REMOUNT)
2812 return superblock_has_perm(cred, path->dentry->d_sb,
2813 FILESYSTEM__REMOUNT, NULL);
2814 else
2815 return path_has_perm(cred, path, FILE__MOUNTON);
2816 }
2817
2818 static int selinux_umount(struct vfsmount *mnt, int flags)
2819 {
2820 const struct cred *cred = current_cred();
2821
2822 return superblock_has_perm(cred, mnt->mnt_sb,
2823 FILESYSTEM__UNMOUNT, NULL);
2824 }
2825
2826 /* inode security operations */
2827
2828 static int selinux_inode_alloc_security(struct inode *inode)
2829 {
2830 return inode_alloc_security(inode);
2831 }
2832
2833 static void selinux_inode_free_security(struct inode *inode)
2834 {
2835 inode_free_security(inode);
2836 }
2837
2838 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2839 const struct qstr *name, void **ctx,
2840 u32 *ctxlen)
2841 {
2842 u32 newsid;
2843 int rc;
2844
2845 rc = selinux_determine_inode_label(current_security(),
2846 d_inode(dentry->d_parent), name,
2847 inode_mode_to_security_class(mode),
2848 &newsid);
2849 if (rc)
2850 return rc;
2851
2852 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2853 }
2854
2855 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2856 struct qstr *name,
2857 const struct cred *old,
2858 struct cred *new)
2859 {
2860 u32 newsid;
2861 int rc;
2862 struct task_security_struct *tsec;
2863
2864 rc = selinux_determine_inode_label(old->security,
2865 d_inode(dentry->d_parent), name,
2866 inode_mode_to_security_class(mode),
2867 &newsid);
2868 if (rc)
2869 return rc;
2870
2871 tsec = new->security;
2872 tsec->create_sid = newsid;
2873 return 0;
2874 }
2875
2876 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2877 const struct qstr *qstr,
2878 const char **name,
2879 void **value, size_t *len)
2880 {
2881 const struct task_security_struct *tsec = current_security();
2882 struct superblock_security_struct *sbsec;
2883 u32 sid, newsid, clen;
2884 int rc;
2885 char *context;
2886
2887 sbsec = dir->i_sb->s_security;
2888
2889 sid = tsec->sid;
2890 newsid = tsec->create_sid;
2891
2892 rc = selinux_determine_inode_label(current_security(),
2893 dir, qstr,
2894 inode_mode_to_security_class(inode->i_mode),
2895 &newsid);
2896 if (rc)
2897 return rc;
2898
2899 /* Possibly defer initialization to selinux_complete_init. */
2900 if (sbsec->flags & SE_SBINITIALIZED) {
2901 struct inode_security_struct *isec = inode->i_security;
2902 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2903 isec->sid = newsid;
2904 isec->initialized = LABEL_INITIALIZED;
2905 }
2906
2907 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2908 return -EOPNOTSUPP;
2909
2910 if (name)
2911 *name = XATTR_SELINUX_SUFFIX;
2912
2913 if (value && len) {
2914 rc = security_sid_to_context_force(newsid, &context, &clen);
2915 if (rc)
2916 return rc;
2917 *value = context;
2918 *len = clen;
2919 }
2920
2921 return 0;
2922 }
2923
2924 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2925 {
2926 return may_create(dir, dentry, SECCLASS_FILE);
2927 }
2928
2929 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2930 {
2931 return may_link(dir, old_dentry, MAY_LINK);
2932 }
2933
2934 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2935 {
2936 return may_link(dir, dentry, MAY_UNLINK);
2937 }
2938
2939 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2940 {
2941 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2942 }
2943
2944 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2945 {
2946 return may_create(dir, dentry, SECCLASS_DIR);
2947 }
2948
2949 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2950 {
2951 return may_link(dir, dentry, MAY_RMDIR);
2952 }
2953
2954 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2955 {
2956 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2957 }
2958
2959 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2960 struct inode *new_inode, struct dentry *new_dentry)
2961 {
2962 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2963 }
2964
2965 static int selinux_inode_readlink(struct dentry *dentry)
2966 {
2967 const struct cred *cred = current_cred();
2968
2969 return dentry_has_perm(cred, dentry, FILE__READ);
2970 }
2971
2972 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2973 bool rcu)
2974 {
2975 const struct cred *cred = current_cred();
2976 struct common_audit_data ad;
2977 struct inode_security_struct *isec;
2978 u32 sid;
2979
2980 validate_creds(cred);
2981
2982 ad.type = LSM_AUDIT_DATA_DENTRY;
2983 ad.u.dentry = dentry;
2984 sid = cred_sid(cred);
2985 isec = inode_security_rcu(inode, rcu);
2986 if (IS_ERR(isec))
2987 return PTR_ERR(isec);
2988
2989 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2990 rcu ? MAY_NOT_BLOCK : 0);
2991 }
2992
2993 static noinline int audit_inode_permission(struct inode *inode,
2994 u32 perms, u32 audited, u32 denied,
2995 int result,
2996 unsigned flags)
2997 {
2998 struct common_audit_data ad;
2999 struct inode_security_struct *isec = inode->i_security;
3000 int rc;
3001
3002 ad.type = LSM_AUDIT_DATA_INODE;
3003 ad.u.inode = inode;
3004
3005 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3006 audited, denied, result, &ad, flags);
3007 if (rc)
3008 return rc;
3009 return 0;
3010 }
3011
3012 static int selinux_inode_permission(struct inode *inode, int mask)
3013 {
3014 const struct cred *cred = current_cred();
3015 u32 perms;
3016 bool from_access;
3017 unsigned flags = mask & MAY_NOT_BLOCK;
3018 struct inode_security_struct *isec;
3019 u32 sid;
3020 struct av_decision avd;
3021 int rc, rc2;
3022 u32 audited, denied;
3023
3024 from_access = mask & MAY_ACCESS;
3025 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3026
3027 /* No permission to check. Existence test. */
3028 if (!mask)
3029 return 0;
3030
3031 validate_creds(cred);
3032
3033 if (unlikely(IS_PRIVATE(inode)))
3034 return 0;
3035
3036 perms = file_mask_to_av(inode->i_mode, mask);
3037
3038 sid = cred_sid(cred);
3039 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3040 if (IS_ERR(isec))
3041 return PTR_ERR(isec);
3042
3043 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3044 audited = avc_audit_required(perms, &avd, rc,
3045 from_access ? FILE__AUDIT_ACCESS : 0,
3046 &denied);
3047 if (likely(!audited))
3048 return rc;
3049
3050 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3051 if (rc2)
3052 return rc2;
3053 return rc;
3054 }
3055
3056 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3057 {
3058 const struct cred *cred = current_cred();
3059 struct inode *inode = d_backing_inode(dentry);
3060 unsigned int ia_valid = iattr->ia_valid;
3061 __u32 av = FILE__WRITE;
3062
3063 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3064 if (ia_valid & ATTR_FORCE) {
3065 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3066 ATTR_FORCE);
3067 if (!ia_valid)
3068 return 0;
3069 }
3070
3071 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3072 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3073 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3074
3075 if (selinux_policycap_openperm &&
3076 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3077 (ia_valid & ATTR_SIZE) &&
3078 !(ia_valid & ATTR_FILE))
3079 av |= FILE__OPEN;
3080
3081 return dentry_has_perm(cred, dentry, av);
3082 }
3083
3084 static int selinux_inode_getattr(const struct path *path)
3085 {
3086 return path_has_perm(current_cred(), path, FILE__GETATTR);
3087 }
3088
3089 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3090 {
3091 const struct cred *cred = current_cred();
3092
3093 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3094 sizeof XATTR_SECURITY_PREFIX - 1)) {
3095 if (!strcmp(name, XATTR_NAME_CAPS)) {
3096 if (!capable(CAP_SETFCAP))
3097 return -EPERM;
3098 } else if (!capable(CAP_SYS_ADMIN)) {
3099 /* A different attribute in the security namespace.
3100 Restrict to administrator. */
3101 return -EPERM;
3102 }
3103 }
3104
3105 /* Not an attribute we recognize, so just check the
3106 ordinary setattr permission. */
3107 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3108 }
3109
3110 static bool has_cap_mac_admin(bool audit)
3111 {
3112 const struct cred *cred = current_cred();
3113 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3114
3115 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3116 return false;
3117 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3118 return false;
3119 return true;
3120 }
3121
3122 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3123 const void *value, size_t size, int flags)
3124 {
3125 struct inode *inode = d_backing_inode(dentry);
3126 struct inode_security_struct *isec;
3127 struct superblock_security_struct *sbsec;
3128 struct common_audit_data ad;
3129 u32 newsid, sid = current_sid();
3130 int rc = 0;
3131
3132 if (strcmp(name, XATTR_NAME_SELINUX))
3133 return selinux_inode_setotherxattr(dentry, name);
3134
3135 sbsec = inode->i_sb->s_security;
3136 if (!(sbsec->flags & SBLABEL_MNT))
3137 return -EOPNOTSUPP;
3138
3139 if (!inode_owner_or_capable(inode))
3140 return -EPERM;
3141
3142 ad.type = LSM_AUDIT_DATA_DENTRY;
3143 ad.u.dentry = dentry;
3144
3145 isec = backing_inode_security(dentry);
3146 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3147 FILE__RELABELFROM, &ad);
3148 if (rc)
3149 return rc;
3150
3151 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3152 if (rc == -EINVAL) {
3153 if (!has_cap_mac_admin(true)) {
3154 struct audit_buffer *ab;
3155 size_t audit_size;
3156 const char *str;
3157
3158 /* We strip a nul only if it is at the end, otherwise the
3159 * context contains a nul and we should audit that */
3160 if (value) {
3161 str = value;
3162 if (str[size - 1] == '\0')
3163 audit_size = size - 1;
3164 else
3165 audit_size = size;
3166 } else {
3167 str = "";
3168 audit_size = 0;
3169 }
3170 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3171 audit_log_format(ab, "op=setxattr invalid_context=");
3172 audit_log_n_untrustedstring(ab, value, audit_size);
3173 audit_log_end(ab);
3174
3175 return rc;
3176 }
3177 rc = security_context_to_sid_force(value, size, &newsid);
3178 }
3179 if (rc)
3180 return rc;
3181
3182 rc = avc_has_perm(sid, newsid, isec->sclass,
3183 FILE__RELABELTO, &ad);
3184 if (rc)
3185 return rc;
3186
3187 rc = security_validate_transition(isec->sid, newsid, sid,
3188 isec->sclass);
3189 if (rc)
3190 return rc;
3191
3192 return avc_has_perm(newsid,
3193 sbsec->sid,
3194 SECCLASS_FILESYSTEM,
3195 FILESYSTEM__ASSOCIATE,
3196 &ad);
3197 }
3198
3199 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3200 const void *value, size_t size,
3201 int flags)
3202 {
3203 struct inode *inode = d_backing_inode(dentry);
3204 struct inode_security_struct *isec;
3205 u32 newsid;
3206 int rc;
3207
3208 if (strcmp(name, XATTR_NAME_SELINUX)) {
3209 /* Not an attribute we recognize, so nothing to do. */
3210 return;
3211 }
3212
3213 rc = security_context_to_sid_force(value, size, &newsid);
3214 if (rc) {
3215 printk(KERN_ERR "SELinux: unable to map context to SID"
3216 "for (%s, %lu), rc=%d\n",
3217 inode->i_sb->s_id, inode->i_ino, -rc);
3218 return;
3219 }
3220
3221 isec = backing_inode_security(dentry);
3222 spin_lock(&isec->lock);
3223 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3224 isec->sid = newsid;
3225 isec->initialized = LABEL_INITIALIZED;
3226 spin_unlock(&isec->lock);
3227
3228 return;
3229 }
3230
3231 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3232 {
3233 const struct cred *cred = current_cred();
3234
3235 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3236 }
3237
3238 static int selinux_inode_listxattr(struct dentry *dentry)
3239 {
3240 const struct cred *cred = current_cred();
3241
3242 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3243 }
3244
3245 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3246 {
3247 if (strcmp(name, XATTR_NAME_SELINUX))
3248 return selinux_inode_setotherxattr(dentry, name);
3249
3250 /* No one is allowed to remove a SELinux security label.
3251 You can change the label, but all data must be labeled. */
3252 return -EACCES;
3253 }
3254
3255 /*
3256 * Copy the inode security context value to the user.
3257 *
3258 * Permission check is handled by selinux_inode_getxattr hook.
3259 */
3260 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3261 {
3262 u32 size;
3263 int error;
3264 char *context = NULL;
3265 struct inode_security_struct *isec;
3266
3267 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3268 return -EOPNOTSUPP;
3269
3270 /*
3271 * If the caller has CAP_MAC_ADMIN, then get the raw context
3272 * value even if it is not defined by current policy; otherwise,
3273 * use the in-core value under current policy.
3274 * Use the non-auditing forms of the permission checks since
3275 * getxattr may be called by unprivileged processes commonly
3276 * and lack of permission just means that we fall back to the
3277 * in-core context value, not a denial.
3278 */
3279 isec = inode_security(inode);
3280 if (has_cap_mac_admin(false))
3281 error = security_sid_to_context_force(isec->sid, &context,
3282 &size);
3283 else
3284 error = security_sid_to_context(isec->sid, &context, &size);
3285 if (error)
3286 return error;
3287 error = size;
3288 if (alloc) {
3289 *buffer = context;
3290 goto out_nofree;
3291 }
3292 kfree(context);
3293 out_nofree:
3294 return error;
3295 }
3296
3297 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3298 const void *value, size_t size, int flags)
3299 {
3300 struct inode_security_struct *isec = inode_security_novalidate(inode);
3301 u32 newsid;
3302 int rc;
3303
3304 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3305 return -EOPNOTSUPP;
3306
3307 if (!value || !size)
3308 return -EACCES;
3309
3310 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3311 if (rc)
3312 return rc;
3313
3314 spin_lock(&isec->lock);
3315 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3316 isec->sid = newsid;
3317 isec->initialized = LABEL_INITIALIZED;
3318 spin_unlock(&isec->lock);
3319 return 0;
3320 }
3321
3322 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3323 {
3324 const int len = sizeof(XATTR_NAME_SELINUX);
3325 if (buffer && len <= buffer_size)
3326 memcpy(buffer, XATTR_NAME_SELINUX, len);
3327 return len;
3328 }
3329
3330 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3331 {
3332 struct inode_security_struct *isec = inode_security_novalidate(inode);
3333 *secid = isec->sid;
3334 }
3335
3336 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3337 {
3338 u32 sid;
3339 struct task_security_struct *tsec;
3340 struct cred *new_creds = *new;
3341
3342 if (new_creds == NULL) {
3343 new_creds = prepare_creds();
3344 if (!new_creds)
3345 return -ENOMEM;
3346 }
3347
3348 tsec = new_creds->security;
3349 /* Get label from overlay inode and set it in create_sid */
3350 selinux_inode_getsecid(d_inode(src), &sid);
3351 tsec->create_sid = sid;
3352 *new = new_creds;
3353 return 0;
3354 }
3355
3356 static int selinux_inode_copy_up_xattr(const char *name)
3357 {
3358 /* The copy_up hook above sets the initial context on an inode, but we
3359 * don't then want to overwrite it by blindly copying all the lower
3360 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3361 */
3362 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3363 return 1; /* Discard */
3364 /*
3365 * Any other attribute apart from SELINUX is not claimed, supported
3366 * by selinux.
3367 */
3368 return -EOPNOTSUPP;
3369 }
3370
3371 /* file security operations */
3372
3373 static int selinux_revalidate_file_permission(struct file *file, int mask)
3374 {
3375 const struct cred *cred = current_cred();
3376 struct inode *inode = file_inode(file);
3377
3378 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3379 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3380 mask |= MAY_APPEND;
3381
3382 return file_has_perm(cred, file,
3383 file_mask_to_av(inode->i_mode, mask));
3384 }
3385
3386 static int selinux_file_permission(struct file *file, int mask)
3387 {
3388 struct inode *inode = file_inode(file);
3389 struct file_security_struct *fsec = file->f_security;
3390 struct inode_security_struct *isec;
3391 u32 sid = current_sid();
3392
3393 if (!mask)
3394 /* No permission to check. Existence test. */
3395 return 0;
3396
3397 isec = inode_security(inode);
3398 if (sid == fsec->sid && fsec->isid == isec->sid &&
3399 fsec->pseqno == avc_policy_seqno())
3400 /* No change since file_open check. */
3401 return 0;
3402
3403 return selinux_revalidate_file_permission(file, mask);
3404 }
3405
3406 static int selinux_file_alloc_security(struct file *file)
3407 {
3408 return file_alloc_security(file);
3409 }
3410
3411 static void selinux_file_free_security(struct file *file)
3412 {
3413 file_free_security(file);
3414 }
3415
3416 /*
3417 * Check whether a task has the ioctl permission and cmd
3418 * operation to an inode.
3419 */
3420 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3421 u32 requested, u16 cmd)
3422 {
3423 struct common_audit_data ad;
3424 struct file_security_struct *fsec = file->f_security;
3425 struct inode *inode = file_inode(file);
3426 struct inode_security_struct *isec;
3427 struct lsm_ioctlop_audit ioctl;
3428 u32 ssid = cred_sid(cred);
3429 int rc;
3430 u8 driver = cmd >> 8;
3431 u8 xperm = cmd & 0xff;
3432
3433 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3434 ad.u.op = &ioctl;
3435 ad.u.op->cmd = cmd;
3436 ad.u.op->path = file->f_path;
3437
3438 if (ssid != fsec->sid) {
3439 rc = avc_has_perm(ssid, fsec->sid,
3440 SECCLASS_FD,
3441 FD__USE,
3442 &ad);
3443 if (rc)
3444 goto out;
3445 }
3446
3447 if (unlikely(IS_PRIVATE(inode)))
3448 return 0;
3449
3450 isec = inode_security(inode);
3451 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3452 requested, driver, xperm, &ad);
3453 out:
3454 return rc;
3455 }
3456
3457 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3458 unsigned long arg)
3459 {
3460 const struct cred *cred = current_cred();
3461 int error = 0;
3462
3463 switch (cmd) {
3464 case FIONREAD:
3465 /* fall through */
3466 case FIBMAP:
3467 /* fall through */
3468 case FIGETBSZ:
3469 /* fall through */
3470 case FS_IOC_GETFLAGS:
3471 /* fall through */
3472 case FS_IOC_GETVERSION:
3473 error = file_has_perm(cred, file, FILE__GETATTR);
3474 break;
3475
3476 case FS_IOC_SETFLAGS:
3477 /* fall through */
3478 case FS_IOC_SETVERSION:
3479 error = file_has_perm(cred, file, FILE__SETATTR);
3480 break;
3481
3482 /* sys_ioctl() checks */
3483 case FIONBIO:
3484 /* fall through */
3485 case FIOASYNC:
3486 error = file_has_perm(cred, file, 0);
3487 break;
3488
3489 case KDSKBENT:
3490 case KDSKBSENT:
3491 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3492 SECURITY_CAP_AUDIT, true);
3493 break;
3494
3495 /* default case assumes that the command will go
3496 * to the file's ioctl() function.
3497 */
3498 default:
3499 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3500 }
3501 return error;
3502 }
3503
3504 static int default_noexec;
3505
3506 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3507 {
3508 const struct cred *cred = current_cred();
3509 u32 sid = cred_sid(cred);
3510 int rc = 0;
3511
3512 if (default_noexec &&
3513 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3514 (!shared && (prot & PROT_WRITE)))) {
3515 /*
3516 * We are making executable an anonymous mapping or a
3517 * private file mapping that will also be writable.
3518 * This has an additional check.
3519 */
3520 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3521 PROCESS__EXECMEM, NULL);
3522 if (rc)
3523 goto error;
3524 }
3525
3526 if (file) {
3527 /* read access is always possible with a mapping */
3528 u32 av = FILE__READ;
3529
3530 /* write access only matters if the mapping is shared */
3531 if (shared && (prot & PROT_WRITE))
3532 av |= FILE__WRITE;
3533
3534 if (prot & PROT_EXEC)
3535 av |= FILE__EXECUTE;
3536
3537 return file_has_perm(cred, file, av);
3538 }
3539
3540 error:
3541 return rc;
3542 }
3543
3544 static int selinux_mmap_addr(unsigned long addr)
3545 {
3546 int rc = 0;
3547
3548 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3549 u32 sid = current_sid();
3550 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3551 MEMPROTECT__MMAP_ZERO, NULL);
3552 }
3553
3554 return rc;
3555 }
3556
3557 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3558 unsigned long prot, unsigned long flags)
3559 {
3560 struct common_audit_data ad;
3561 int rc;
3562
3563 if (file) {
3564 ad.type = LSM_AUDIT_DATA_FILE;
3565 ad.u.file = file;
3566 rc = inode_has_perm(current_cred(), file_inode(file),
3567 FILE__MAP, &ad);
3568 if (rc)
3569 return rc;
3570 }
3571
3572 if (selinux_checkreqprot)
3573 prot = reqprot;
3574
3575 return file_map_prot_check(file, prot,
3576 (flags & MAP_TYPE) == MAP_SHARED);
3577 }
3578
3579 static int selinux_file_mprotect(struct vm_area_struct *vma,
3580 unsigned long reqprot,
3581 unsigned long prot)
3582 {
3583 const struct cred *cred = current_cred();
3584 u32 sid = cred_sid(cred);
3585
3586 if (selinux_checkreqprot)
3587 prot = reqprot;
3588
3589 if (default_noexec &&
3590 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3591 int rc = 0;
3592 if (vma->vm_start >= vma->vm_mm->start_brk &&
3593 vma->vm_end <= vma->vm_mm->brk) {
3594 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3595 PROCESS__EXECHEAP, NULL);
3596 } else if (!vma->vm_file &&
3597 ((vma->vm_start <= vma->vm_mm->start_stack &&
3598 vma->vm_end >= vma->vm_mm->start_stack) ||
3599 vma_is_stack_for_current(vma))) {
3600 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3601 PROCESS__EXECSTACK, NULL);
3602 } else if (vma->vm_file && vma->anon_vma) {
3603 /*
3604 * We are making executable a file mapping that has
3605 * had some COW done. Since pages might have been
3606 * written, check ability to execute the possibly
3607 * modified content. This typically should only
3608 * occur for text relocations.
3609 */
3610 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3611 }
3612 if (rc)
3613 return rc;
3614 }
3615
3616 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3617 }
3618
3619 static int selinux_file_lock(struct file *file, unsigned int cmd)
3620 {
3621 const struct cred *cred = current_cred();
3622
3623 return file_has_perm(cred, file, FILE__LOCK);
3624 }
3625
3626 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3627 unsigned long arg)
3628 {
3629 const struct cred *cred = current_cred();
3630 int err = 0;
3631
3632 switch (cmd) {
3633 case F_SETFL:
3634 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3635 err = file_has_perm(cred, file, FILE__WRITE);
3636 break;
3637 }
3638 /* fall through */
3639 case F_SETOWN:
3640 case F_SETSIG:
3641 case F_GETFL:
3642 case F_GETOWN:
3643 case F_GETSIG:
3644 case F_GETOWNER_UIDS:
3645 /* Just check FD__USE permission */
3646 err = file_has_perm(cred, file, 0);
3647 break;
3648 case F_GETLK:
3649 case F_SETLK:
3650 case F_SETLKW:
3651 case F_OFD_GETLK:
3652 case F_OFD_SETLK:
3653 case F_OFD_SETLKW:
3654 #if BITS_PER_LONG == 32
3655 case F_GETLK64:
3656 case F_SETLK64:
3657 case F_SETLKW64:
3658 #endif
3659 err = file_has_perm(cred, file, FILE__LOCK);
3660 break;
3661 }
3662
3663 return err;
3664 }
3665
3666 static void selinux_file_set_fowner(struct file *file)
3667 {
3668 struct file_security_struct *fsec;
3669
3670 fsec = file->f_security;
3671 fsec->fown_sid = current_sid();
3672 }
3673
3674 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3675 struct fown_struct *fown, int signum)
3676 {
3677 struct file *file;
3678 u32 sid = task_sid(tsk);
3679 u32 perm;
3680 struct file_security_struct *fsec;
3681
3682 /* struct fown_struct is never outside the context of a struct file */
3683 file = container_of(fown, struct file, f_owner);
3684
3685 fsec = file->f_security;
3686
3687 if (!signum)
3688 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3689 else
3690 perm = signal_to_av(signum);
3691
3692 return avc_has_perm(fsec->fown_sid, sid,
3693 SECCLASS_PROCESS, perm, NULL);
3694 }
3695
3696 static int selinux_file_receive(struct file *file)
3697 {
3698 const struct cred *cred = current_cred();
3699
3700 return file_has_perm(cred, file, file_to_av(file));
3701 }
3702
3703 static int selinux_file_open(struct file *file, const struct cred *cred)
3704 {
3705 struct file_security_struct *fsec;
3706 struct inode_security_struct *isec;
3707
3708 fsec = file->f_security;
3709 isec = inode_security(file_inode(file));
3710 /*
3711 * Save inode label and policy sequence number
3712 * at open-time so that selinux_file_permission
3713 * can determine whether revalidation is necessary.
3714 * Task label is already saved in the file security
3715 * struct as its SID.
3716 */
3717 fsec->isid = isec->sid;
3718 fsec->pseqno = avc_policy_seqno();
3719 /*
3720 * Since the inode label or policy seqno may have changed
3721 * between the selinux_inode_permission check and the saving
3722 * of state above, recheck that access is still permitted.
3723 * Otherwise, access might never be revalidated against the
3724 * new inode label or new policy.
3725 * This check is not redundant - do not remove.
3726 */
3727 return file_path_has_perm(cred, file, open_file_to_av(file));
3728 }
3729
3730 /* task security operations */
3731
3732 static int selinux_task_alloc(struct task_struct *task,
3733 unsigned long clone_flags)
3734 {
3735 u32 sid = current_sid();
3736
3737 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3738 }
3739
3740 /*
3741 * allocate the SELinux part of blank credentials
3742 */
3743 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3744 {
3745 struct task_security_struct *tsec;
3746
3747 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3748 if (!tsec)
3749 return -ENOMEM;
3750
3751 cred->security = tsec;
3752 return 0;
3753 }
3754
3755 /*
3756 * detach and free the LSM part of a set of credentials
3757 */
3758 static void selinux_cred_free(struct cred *cred)
3759 {
3760 struct task_security_struct *tsec = cred->security;
3761
3762 /*
3763 * cred->security == NULL if security_cred_alloc_blank() or
3764 * security_prepare_creds() returned an error.
3765 */
3766 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3767 cred->security = (void *) 0x7UL;
3768 kfree(tsec);
3769 }
3770
3771 /*
3772 * prepare a new set of credentials for modification
3773 */
3774 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3775 gfp_t gfp)
3776 {
3777 const struct task_security_struct *old_tsec;
3778 struct task_security_struct *tsec;
3779
3780 old_tsec = old->security;
3781
3782 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3783 if (!tsec)
3784 return -ENOMEM;
3785
3786 new->security = tsec;
3787 return 0;
3788 }
3789
3790 /*
3791 * transfer the SELinux data to a blank set of creds
3792 */
3793 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3794 {
3795 const struct task_security_struct *old_tsec = old->security;
3796 struct task_security_struct *tsec = new->security;
3797
3798 *tsec = *old_tsec;
3799 }
3800
3801 /*
3802 * set the security data for a kernel service
3803 * - all the creation contexts are set to unlabelled
3804 */
3805 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3806 {
3807 struct task_security_struct *tsec = new->security;
3808 u32 sid = current_sid();
3809 int ret;
3810
3811 ret = avc_has_perm(sid, secid,
3812 SECCLASS_KERNEL_SERVICE,
3813 KERNEL_SERVICE__USE_AS_OVERRIDE,
3814 NULL);
3815 if (ret == 0) {
3816 tsec->sid = secid;
3817 tsec->create_sid = 0;
3818 tsec->keycreate_sid = 0;
3819 tsec->sockcreate_sid = 0;
3820 }
3821 return ret;
3822 }
3823
3824 /*
3825 * set the file creation context in a security record to the same as the
3826 * objective context of the specified inode
3827 */
3828 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3829 {
3830 struct inode_security_struct *isec = inode_security(inode);
3831 struct task_security_struct *tsec = new->security;
3832 u32 sid = current_sid();
3833 int ret;
3834
3835 ret = avc_has_perm(sid, isec->sid,
3836 SECCLASS_KERNEL_SERVICE,
3837 KERNEL_SERVICE__CREATE_FILES_AS,
3838 NULL);
3839
3840 if (ret == 0)
3841 tsec->create_sid = isec->sid;
3842 return ret;
3843 }
3844
3845 static int selinux_kernel_module_request(char *kmod_name)
3846 {
3847 struct common_audit_data ad;
3848
3849 ad.type = LSM_AUDIT_DATA_KMOD;
3850 ad.u.kmod_name = kmod_name;
3851
3852 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3853 SYSTEM__MODULE_REQUEST, &ad);
3854 }
3855
3856 static int selinux_kernel_module_from_file(struct file *file)
3857 {
3858 struct common_audit_data ad;
3859 struct inode_security_struct *isec;
3860 struct file_security_struct *fsec;
3861 u32 sid = current_sid();
3862 int rc;
3863
3864 /* init_module */
3865 if (file == NULL)
3866 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3867 SYSTEM__MODULE_LOAD, NULL);
3868
3869 /* finit_module */
3870
3871 ad.type = LSM_AUDIT_DATA_FILE;
3872 ad.u.file = file;
3873
3874 fsec = file->f_security;
3875 if (sid != fsec->sid) {
3876 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3877 if (rc)
3878 return rc;
3879 }
3880
3881 isec = inode_security(file_inode(file));
3882 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3883 SYSTEM__MODULE_LOAD, &ad);
3884 }
3885
3886 static int selinux_kernel_read_file(struct file *file,
3887 enum kernel_read_file_id id)
3888 {
3889 int rc = 0;
3890
3891 switch (id) {
3892 case READING_MODULE:
3893 rc = selinux_kernel_module_from_file(file);
3894 break;
3895 default:
3896 break;
3897 }
3898
3899 return rc;
3900 }
3901
3902 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3903 {
3904 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3905 PROCESS__SETPGID, NULL);
3906 }
3907
3908 static int selinux_task_getpgid(struct task_struct *p)
3909 {
3910 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3911 PROCESS__GETPGID, NULL);
3912 }
3913
3914 static int selinux_task_getsid(struct task_struct *p)
3915 {
3916 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3917 PROCESS__GETSESSION, NULL);
3918 }
3919
3920 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3921 {
3922 *secid = task_sid(p);
3923 }
3924
3925 static int selinux_task_setnice(struct task_struct *p, int nice)
3926 {
3927 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3928 PROCESS__SETSCHED, NULL);
3929 }
3930
3931 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3932 {
3933 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3934 PROCESS__SETSCHED, NULL);
3935 }
3936
3937 static int selinux_task_getioprio(struct task_struct *p)
3938 {
3939 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3940 PROCESS__GETSCHED, NULL);
3941 }
3942
3943 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3944 unsigned int flags)
3945 {
3946 u32 av = 0;
3947
3948 if (!flags)
3949 return 0;
3950 if (flags & LSM_PRLIMIT_WRITE)
3951 av |= PROCESS__SETRLIMIT;
3952 if (flags & LSM_PRLIMIT_READ)
3953 av |= PROCESS__GETRLIMIT;
3954 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3955 SECCLASS_PROCESS, av, NULL);
3956 }
3957
3958 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3959 struct rlimit *new_rlim)
3960 {
3961 struct rlimit *old_rlim = p->signal->rlim + resource;
3962
3963 /* Control the ability to change the hard limit (whether
3964 lowering or raising it), so that the hard limit can
3965 later be used as a safe reset point for the soft limit
3966 upon context transitions. See selinux_bprm_committing_creds. */
3967 if (old_rlim->rlim_max != new_rlim->rlim_max)
3968 return avc_has_perm(current_sid(), task_sid(p),
3969 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3970
3971 return 0;
3972 }
3973
3974 static int selinux_task_setscheduler(struct task_struct *p)
3975 {
3976 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3977 PROCESS__SETSCHED, NULL);
3978 }
3979
3980 static int selinux_task_getscheduler(struct task_struct *p)
3981 {
3982 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3983 PROCESS__GETSCHED, NULL);
3984 }
3985
3986 static int selinux_task_movememory(struct task_struct *p)
3987 {
3988 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3989 PROCESS__SETSCHED, NULL);
3990 }
3991
3992 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3993 int sig, u32 secid)
3994 {
3995 u32 perm;
3996
3997 if (!sig)
3998 perm = PROCESS__SIGNULL; /* null signal; existence test */
3999 else
4000 perm = signal_to_av(sig);
4001 if (!secid)
4002 secid = current_sid();
4003 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4004 }
4005
4006 static void selinux_task_to_inode(struct task_struct *p,
4007 struct inode *inode)
4008 {
4009 struct inode_security_struct *isec = inode->i_security;
4010 u32 sid = task_sid(p);
4011
4012 spin_lock(&isec->lock);
4013 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4014 isec->sid = sid;
4015 isec->initialized = LABEL_INITIALIZED;
4016 spin_unlock(&isec->lock);
4017 }
4018
4019 /* Returns error only if unable to parse addresses */
4020 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4021 struct common_audit_data *ad, u8 *proto)
4022 {
4023 int offset, ihlen, ret = -EINVAL;
4024 struct iphdr _iph, *ih;
4025
4026 offset = skb_network_offset(skb);
4027 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4028 if (ih == NULL)
4029 goto out;
4030
4031 ihlen = ih->ihl * 4;
4032 if (ihlen < sizeof(_iph))
4033 goto out;
4034
4035 ad->u.net->v4info.saddr = ih->saddr;
4036 ad->u.net->v4info.daddr = ih->daddr;
4037 ret = 0;
4038
4039 if (proto)
4040 *proto = ih->protocol;
4041
4042 switch (ih->protocol) {
4043 case IPPROTO_TCP: {
4044 struct tcphdr _tcph, *th;
4045
4046 if (ntohs(ih->frag_off) & IP_OFFSET)
4047 break;
4048
4049 offset += ihlen;
4050 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4051 if (th == NULL)
4052 break;
4053
4054 ad->u.net->sport = th->source;
4055 ad->u.net->dport = th->dest;
4056 break;
4057 }
4058
4059 case IPPROTO_UDP: {
4060 struct udphdr _udph, *uh;
4061
4062 if (ntohs(ih->frag_off) & IP_OFFSET)
4063 break;
4064
4065 offset += ihlen;
4066 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4067 if (uh == NULL)
4068 break;
4069
4070 ad->u.net->sport = uh->source;
4071 ad->u.net->dport = uh->dest;
4072 break;
4073 }
4074
4075 case IPPROTO_DCCP: {
4076 struct dccp_hdr _dccph, *dh;
4077
4078 if (ntohs(ih->frag_off) & IP_OFFSET)
4079 break;
4080
4081 offset += ihlen;
4082 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4083 if (dh == NULL)
4084 break;
4085
4086 ad->u.net->sport = dh->dccph_sport;
4087 ad->u.net->dport = dh->dccph_dport;
4088 break;
4089 }
4090
4091 default:
4092 break;
4093 }
4094 out:
4095 return ret;
4096 }
4097
4098 #if IS_ENABLED(CONFIG_IPV6)
4099
4100 /* Returns error only if unable to parse addresses */
4101 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4102 struct common_audit_data *ad, u8 *proto)
4103 {
4104 u8 nexthdr;
4105 int ret = -EINVAL, offset;
4106 struct ipv6hdr _ipv6h, *ip6;
4107 __be16 frag_off;
4108
4109 offset = skb_network_offset(skb);
4110 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4111 if (ip6 == NULL)
4112 goto out;
4113
4114 ad->u.net->v6info.saddr = ip6->saddr;
4115 ad->u.net->v6info.daddr = ip6->daddr;
4116 ret = 0;
4117
4118 nexthdr = ip6->nexthdr;
4119 offset += sizeof(_ipv6h);
4120 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4121 if (offset < 0)
4122 goto out;
4123
4124 if (proto)
4125 *proto = nexthdr;
4126
4127 switch (nexthdr) {
4128 case IPPROTO_TCP: {
4129 struct tcphdr _tcph, *th;
4130
4131 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4132 if (th == NULL)
4133 break;
4134
4135 ad->u.net->sport = th->source;
4136 ad->u.net->dport = th->dest;
4137 break;
4138 }
4139
4140 case IPPROTO_UDP: {
4141 struct udphdr _udph, *uh;
4142
4143 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4144 if (uh == NULL)
4145 break;
4146
4147 ad->u.net->sport = uh->source;
4148 ad->u.net->dport = uh->dest;
4149 break;
4150 }
4151
4152 case IPPROTO_DCCP: {
4153 struct dccp_hdr _dccph, *dh;
4154
4155 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4156 if (dh == NULL)
4157 break;
4158
4159 ad->u.net->sport = dh->dccph_sport;
4160 ad->u.net->dport = dh->dccph_dport;
4161 break;
4162 }
4163
4164 /* includes fragments */
4165 default:
4166 break;
4167 }
4168 out:
4169 return ret;
4170 }
4171
4172 #endif /* IPV6 */
4173
4174 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4175 char **_addrp, int src, u8 *proto)
4176 {
4177 char *addrp;
4178 int ret;
4179
4180 switch (ad->u.net->family) {
4181 case PF_INET:
4182 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4183 if (ret)
4184 goto parse_error;
4185 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4186 &ad->u.net->v4info.daddr);
4187 goto okay;
4188
4189 #if IS_ENABLED(CONFIG_IPV6)
4190 case PF_INET6:
4191 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4192 if (ret)
4193 goto parse_error;
4194 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4195 &ad->u.net->v6info.daddr);
4196 goto okay;
4197 #endif /* IPV6 */
4198 default:
4199 addrp = NULL;
4200 goto okay;
4201 }
4202
4203 parse_error:
4204 printk(KERN_WARNING
4205 "SELinux: failure in selinux_parse_skb(),"
4206 " unable to parse packet\n");
4207 return ret;
4208
4209 okay:
4210 if (_addrp)
4211 *_addrp = addrp;
4212 return 0;
4213 }
4214
4215 /**
4216 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4217 * @skb: the packet
4218 * @family: protocol family
4219 * @sid: the packet's peer label SID
4220 *
4221 * Description:
4222 * Check the various different forms of network peer labeling and determine
4223 * the peer label/SID for the packet; most of the magic actually occurs in
4224 * the security server function security_net_peersid_cmp(). The function
4225 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4226 * or -EACCES if @sid is invalid due to inconsistencies with the different
4227 * peer labels.
4228 *
4229 */
4230 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4231 {
4232 int err;
4233 u32 xfrm_sid;
4234 u32 nlbl_sid;
4235 u32 nlbl_type;
4236
4237 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4238 if (unlikely(err))
4239 return -EACCES;
4240 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4241 if (unlikely(err))
4242 return -EACCES;
4243
4244 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4245 if (unlikely(err)) {
4246 printk(KERN_WARNING
4247 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4248 " unable to determine packet's peer label\n");
4249 return -EACCES;
4250 }
4251
4252 return 0;
4253 }
4254
4255 /**
4256 * selinux_conn_sid - Determine the child socket label for a connection
4257 * @sk_sid: the parent socket's SID
4258 * @skb_sid: the packet's SID
4259 * @conn_sid: the resulting connection SID
4260 *
4261 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4262 * combined with the MLS information from @skb_sid in order to create
4263 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4264 * of @sk_sid. Returns zero on success, negative values on failure.
4265 *
4266 */
4267 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4268 {
4269 int err = 0;
4270
4271 if (skb_sid != SECSID_NULL)
4272 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4273 else
4274 *conn_sid = sk_sid;
4275
4276 return err;
4277 }
4278
4279 /* socket security operations */
4280
4281 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4282 u16 secclass, u32 *socksid)
4283 {
4284 if (tsec->sockcreate_sid > SECSID_NULL) {
4285 *socksid = tsec->sockcreate_sid;
4286 return 0;
4287 }
4288
4289 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4290 socksid);
4291 }
4292
4293 static int sock_has_perm(struct sock *sk, u32 perms)
4294 {
4295 struct sk_security_struct *sksec = sk->sk_security;
4296 struct common_audit_data ad;
4297 struct lsm_network_audit net = {0,};
4298
4299 if (sksec->sid == SECINITSID_KERNEL)
4300 return 0;
4301
4302 ad.type = LSM_AUDIT_DATA_NET;
4303 ad.u.net = &net;
4304 ad.u.net->sk = sk;
4305
4306 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4307 &ad);
4308 }
4309
4310 static int selinux_socket_create(int family, int type,
4311 int protocol, int kern)
4312 {
4313 const struct task_security_struct *tsec = current_security();
4314 u32 newsid;
4315 u16 secclass;
4316 int rc;
4317
4318 if (kern)
4319 return 0;
4320
4321 secclass = socket_type_to_security_class(family, type, protocol);
4322 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4323 if (rc)
4324 return rc;
4325
4326 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4327 }
4328
4329 static int selinux_socket_post_create(struct socket *sock, int family,
4330 int type, int protocol, int kern)
4331 {
4332 const struct task_security_struct *tsec = current_security();
4333 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4334 struct sk_security_struct *sksec;
4335 u16 sclass = socket_type_to_security_class(family, type, protocol);
4336 u32 sid = SECINITSID_KERNEL;
4337 int err = 0;
4338
4339 if (!kern) {
4340 err = socket_sockcreate_sid(tsec, sclass, &sid);
4341 if (err)
4342 return err;
4343 }
4344
4345 isec->sclass = sclass;
4346 isec->sid = sid;
4347 isec->initialized = LABEL_INITIALIZED;
4348
4349 if (sock->sk) {
4350 sksec = sock->sk->sk_security;
4351 sksec->sclass = sclass;
4352 sksec->sid = sid;
4353 err = selinux_netlbl_socket_post_create(sock->sk, family);
4354 }
4355
4356 return err;
4357 }
4358
4359 /* Range of port numbers used to automatically bind.
4360 Need to determine whether we should perform a name_bind
4361 permission check between the socket and the port number. */
4362
4363 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4364 {
4365 struct sock *sk = sock->sk;
4366 u16 family;
4367 int err;
4368
4369 err = sock_has_perm(sk, SOCKET__BIND);
4370 if (err)
4371 goto out;
4372
4373 /*
4374 * If PF_INET or PF_INET6, check name_bind permission for the port.
4375 * Multiple address binding for SCTP is not supported yet: we just
4376 * check the first address now.
4377 */
4378 family = sk->sk_family;
4379 if (family == PF_INET || family == PF_INET6) {
4380 char *addrp;
4381 struct sk_security_struct *sksec = sk->sk_security;
4382 struct common_audit_data ad;
4383 struct lsm_network_audit net = {0,};
4384 struct sockaddr_in *addr4 = NULL;
4385 struct sockaddr_in6 *addr6 = NULL;
4386 unsigned short snum;
4387 u32 sid, node_perm;
4388
4389 if (family == PF_INET) {
4390 if (addrlen < sizeof(struct sockaddr_in)) {
4391 err = -EINVAL;
4392 goto out;
4393 }
4394 addr4 = (struct sockaddr_in *)address;
4395 snum = ntohs(addr4->sin_port);
4396 addrp = (char *)&addr4->sin_addr.s_addr;
4397 } else {
4398 if (addrlen < SIN6_LEN_RFC2133) {
4399 err = -EINVAL;
4400 goto out;
4401 }
4402 addr6 = (struct sockaddr_in6 *)address;
4403 snum = ntohs(addr6->sin6_port);
4404 addrp = (char *)&addr6->sin6_addr.s6_addr;
4405 }
4406
4407 if (snum) {
4408 int low, high;
4409
4410 inet_get_local_port_range(sock_net(sk), &low, &high);
4411
4412 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4413 snum > high) {
4414 err = sel_netport_sid(sk->sk_protocol,
4415 snum, &sid);
4416 if (err)
4417 goto out;
4418 ad.type = LSM_AUDIT_DATA_NET;
4419 ad.u.net = &net;
4420 ad.u.net->sport = htons(snum);
4421 ad.u.net->family = family;
4422 err = avc_has_perm(sksec->sid, sid,
4423 sksec->sclass,
4424 SOCKET__NAME_BIND, &ad);
4425 if (err)
4426 goto out;
4427 }
4428 }
4429
4430 switch (sksec->sclass) {
4431 case SECCLASS_TCP_SOCKET:
4432 node_perm = TCP_SOCKET__NODE_BIND;
4433 break;
4434
4435 case SECCLASS_UDP_SOCKET:
4436 node_perm = UDP_SOCKET__NODE_BIND;
4437 break;
4438
4439 case SECCLASS_DCCP_SOCKET:
4440 node_perm = DCCP_SOCKET__NODE_BIND;
4441 break;
4442
4443 default:
4444 node_perm = RAWIP_SOCKET__NODE_BIND;
4445 break;
4446 }
4447
4448 err = sel_netnode_sid(addrp, family, &sid);
4449 if (err)
4450 goto out;
4451
4452 ad.type = LSM_AUDIT_DATA_NET;
4453 ad.u.net = &net;
4454 ad.u.net->sport = htons(snum);
4455 ad.u.net->family = family;
4456
4457 if (family == PF_INET)
4458 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4459 else
4460 ad.u.net->v6info.saddr = addr6->sin6_addr;
4461
4462 err = avc_has_perm(sksec->sid, sid,
4463 sksec->sclass, node_perm, &ad);
4464 if (err)
4465 goto out;
4466 }
4467 out:
4468 return err;
4469 }
4470
4471 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4472 {
4473 struct sock *sk = sock->sk;
4474 struct sk_security_struct *sksec = sk->sk_security;
4475 int err;
4476
4477 err = sock_has_perm(sk, SOCKET__CONNECT);
4478 if (err)
4479 return err;
4480
4481 /*
4482 * If a TCP or DCCP socket, check name_connect permission for the port.
4483 */
4484 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4485 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4486 struct common_audit_data ad;
4487 struct lsm_network_audit net = {0,};
4488 struct sockaddr_in *addr4 = NULL;
4489 struct sockaddr_in6 *addr6 = NULL;
4490 unsigned short snum;
4491 u32 sid, perm;
4492
4493 if (sk->sk_family == PF_INET) {
4494 addr4 = (struct sockaddr_in *)address;
4495 if (addrlen < sizeof(struct sockaddr_in))
4496 return -EINVAL;
4497 snum = ntohs(addr4->sin_port);
4498 } else {
4499 addr6 = (struct sockaddr_in6 *)address;
4500 if (addrlen < SIN6_LEN_RFC2133)
4501 return -EINVAL;
4502 snum = ntohs(addr6->sin6_port);
4503 }
4504
4505 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4506 if (err)
4507 goto out;
4508
4509 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4510 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4511
4512 ad.type = LSM_AUDIT_DATA_NET;
4513 ad.u.net = &net;
4514 ad.u.net->dport = htons(snum);
4515 ad.u.net->family = sk->sk_family;
4516 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4517 if (err)
4518 goto out;
4519 }
4520
4521 err = selinux_netlbl_socket_connect(sk, address);
4522
4523 out:
4524 return err;
4525 }
4526
4527 static int selinux_socket_listen(struct socket *sock, int backlog)
4528 {
4529 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4530 }
4531
4532 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4533 {
4534 int err;
4535 struct inode_security_struct *isec;
4536 struct inode_security_struct *newisec;
4537 u16 sclass;
4538 u32 sid;
4539
4540 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4541 if (err)
4542 return err;
4543
4544 isec = inode_security_novalidate(SOCK_INODE(sock));
4545 spin_lock(&isec->lock);
4546 sclass = isec->sclass;
4547 sid = isec->sid;
4548 spin_unlock(&isec->lock);
4549
4550 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4551 newisec->sclass = sclass;
4552 newisec->sid = sid;
4553 newisec->initialized = LABEL_INITIALIZED;
4554
4555 return 0;
4556 }
4557
4558 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4559 int size)
4560 {
4561 return sock_has_perm(sock->sk, SOCKET__WRITE);
4562 }
4563
4564 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4565 int size, int flags)
4566 {
4567 return sock_has_perm(sock->sk, SOCKET__READ);
4568 }
4569
4570 static int selinux_socket_getsockname(struct socket *sock)
4571 {
4572 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4573 }
4574
4575 static int selinux_socket_getpeername(struct socket *sock)
4576 {
4577 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4578 }
4579
4580 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4581 {
4582 int err;
4583
4584 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4585 if (err)
4586 return err;
4587
4588 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4589 }
4590
4591 static int selinux_socket_getsockopt(struct socket *sock, int level,
4592 int optname)
4593 {
4594 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4595 }
4596
4597 static int selinux_socket_shutdown(struct socket *sock, int how)
4598 {
4599 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4600 }
4601
4602 static int selinux_socket_unix_stream_connect(struct sock *sock,
4603 struct sock *other,
4604 struct sock *newsk)
4605 {
4606 struct sk_security_struct *sksec_sock = sock->sk_security;
4607 struct sk_security_struct *sksec_other = other->sk_security;
4608 struct sk_security_struct *sksec_new = newsk->sk_security;
4609 struct common_audit_data ad;
4610 struct lsm_network_audit net = {0,};
4611 int err;
4612
4613 ad.type = LSM_AUDIT_DATA_NET;
4614 ad.u.net = &net;
4615 ad.u.net->sk = other;
4616
4617 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4618 sksec_other->sclass,
4619 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4620 if (err)
4621 return err;
4622
4623 /* server child socket */
4624 sksec_new->peer_sid = sksec_sock->sid;
4625 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4626 &sksec_new->sid);
4627 if (err)
4628 return err;
4629
4630 /* connecting socket */
4631 sksec_sock->peer_sid = sksec_new->sid;
4632
4633 return 0;
4634 }
4635
4636 static int selinux_socket_unix_may_send(struct socket *sock,
4637 struct socket *other)
4638 {
4639 struct sk_security_struct *ssec = sock->sk->sk_security;
4640 struct sk_security_struct *osec = other->sk->sk_security;
4641 struct common_audit_data ad;
4642 struct lsm_network_audit net = {0,};
4643
4644 ad.type = LSM_AUDIT_DATA_NET;
4645 ad.u.net = &net;
4646 ad.u.net->sk = other->sk;
4647
4648 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4649 &ad);
4650 }
4651
4652 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4653 char *addrp, u16 family, u32 peer_sid,
4654 struct common_audit_data *ad)
4655 {
4656 int err;
4657 u32 if_sid;
4658 u32 node_sid;
4659
4660 err = sel_netif_sid(ns, ifindex, &if_sid);
4661 if (err)
4662 return err;
4663 err = avc_has_perm(peer_sid, if_sid,
4664 SECCLASS_NETIF, NETIF__INGRESS, ad);
4665 if (err)
4666 return err;
4667
4668 err = sel_netnode_sid(addrp, family, &node_sid);
4669 if (err)
4670 return err;
4671 return avc_has_perm(peer_sid, node_sid,
4672 SECCLASS_NODE, NODE__RECVFROM, ad);
4673 }
4674
4675 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4676 u16 family)
4677 {
4678 int err = 0;
4679 struct sk_security_struct *sksec = sk->sk_security;
4680 u32 sk_sid = sksec->sid;
4681 struct common_audit_data ad;
4682 struct lsm_network_audit net = {0,};
4683 char *addrp;
4684
4685 ad.type = LSM_AUDIT_DATA_NET;
4686 ad.u.net = &net;
4687 ad.u.net->netif = skb->skb_iif;
4688 ad.u.net->family = family;
4689 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4690 if (err)
4691 return err;
4692
4693 if (selinux_secmark_enabled()) {
4694 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4695 PACKET__RECV, &ad);
4696 if (err)
4697 return err;
4698 }
4699
4700 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4701 if (err)
4702 return err;
4703 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4704
4705 return err;
4706 }
4707
4708 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4709 {
4710 int err;
4711 struct sk_security_struct *sksec = sk->sk_security;
4712 u16 family = sk->sk_family;
4713 u32 sk_sid = sksec->sid;
4714 struct common_audit_data ad;
4715 struct lsm_network_audit net = {0,};
4716 char *addrp;
4717 u8 secmark_active;
4718 u8 peerlbl_active;
4719
4720 if (family != PF_INET && family != PF_INET6)
4721 return 0;
4722
4723 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4724 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4725 family = PF_INET;
4726
4727 /* If any sort of compatibility mode is enabled then handoff processing
4728 * to the selinux_sock_rcv_skb_compat() function to deal with the
4729 * special handling. We do this in an attempt to keep this function
4730 * as fast and as clean as possible. */
4731 if (!selinux_policycap_netpeer)
4732 return selinux_sock_rcv_skb_compat(sk, skb, family);
4733
4734 secmark_active = selinux_secmark_enabled();
4735 peerlbl_active = selinux_peerlbl_enabled();
4736 if (!secmark_active && !peerlbl_active)
4737 return 0;
4738
4739 ad.type = LSM_AUDIT_DATA_NET;
4740 ad.u.net = &net;
4741 ad.u.net->netif = skb->skb_iif;
4742 ad.u.net->family = family;
4743 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4744 if (err)
4745 return err;
4746
4747 if (peerlbl_active) {
4748 u32 peer_sid;
4749
4750 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4751 if (err)
4752 return err;
4753 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4754 addrp, family, peer_sid, &ad);
4755 if (err) {
4756 selinux_netlbl_err(skb, family, err, 0);
4757 return err;
4758 }
4759 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4760 PEER__RECV, &ad);
4761 if (err) {
4762 selinux_netlbl_err(skb, family, err, 0);
4763 return err;
4764 }
4765 }
4766
4767 if (secmark_active) {
4768 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4769 PACKET__RECV, &ad);
4770 if (err)
4771 return err;
4772 }
4773
4774 return err;
4775 }
4776
4777 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4778 int __user *optlen, unsigned len)
4779 {
4780 int err = 0;
4781 char *scontext;
4782 u32 scontext_len;
4783 struct sk_security_struct *sksec = sock->sk->sk_security;
4784 u32 peer_sid = SECSID_NULL;
4785
4786 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4787 sksec->sclass == SECCLASS_TCP_SOCKET)
4788 peer_sid = sksec->peer_sid;
4789 if (peer_sid == SECSID_NULL)
4790 return -ENOPROTOOPT;
4791
4792 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4793 if (err)
4794 return err;
4795
4796 if (scontext_len > len) {
4797 err = -ERANGE;
4798 goto out_len;
4799 }
4800
4801 if (copy_to_user(optval, scontext, scontext_len))
4802 err = -EFAULT;
4803
4804 out_len:
4805 if (put_user(scontext_len, optlen))
4806 err = -EFAULT;
4807 kfree(scontext);
4808 return err;
4809 }
4810
4811 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4812 {
4813 u32 peer_secid = SECSID_NULL;
4814 u16 family;
4815 struct inode_security_struct *isec;
4816
4817 if (skb && skb->protocol == htons(ETH_P_IP))
4818 family = PF_INET;
4819 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4820 family = PF_INET6;
4821 else if (sock)
4822 family = sock->sk->sk_family;
4823 else
4824 goto out;
4825
4826 if (sock && family == PF_UNIX) {
4827 isec = inode_security_novalidate(SOCK_INODE(sock));
4828 peer_secid = isec->sid;
4829 } else if (skb)
4830 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4831
4832 out:
4833 *secid = peer_secid;
4834 if (peer_secid == SECSID_NULL)
4835 return -EINVAL;
4836 return 0;
4837 }
4838
4839 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4840 {
4841 struct sk_security_struct *sksec;
4842
4843 sksec = kzalloc(sizeof(*sksec), priority);
4844 if (!sksec)
4845 return -ENOMEM;
4846
4847 sksec->peer_sid = SECINITSID_UNLABELED;
4848 sksec->sid = SECINITSID_UNLABELED;
4849 sksec->sclass = SECCLASS_SOCKET;
4850 selinux_netlbl_sk_security_reset(sksec);
4851 sk->sk_security = sksec;
4852
4853 return 0;
4854 }
4855
4856 static void selinux_sk_free_security(struct sock *sk)
4857 {
4858 struct sk_security_struct *sksec = sk->sk_security;
4859
4860 sk->sk_security = NULL;
4861 selinux_netlbl_sk_security_free(sksec);
4862 kfree(sksec);
4863 }
4864
4865 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4866 {
4867 struct sk_security_struct *sksec = sk->sk_security;
4868 struct sk_security_struct *newsksec = newsk->sk_security;
4869
4870 newsksec->sid = sksec->sid;
4871 newsksec->peer_sid = sksec->peer_sid;
4872 newsksec->sclass = sksec->sclass;
4873
4874 selinux_netlbl_sk_security_reset(newsksec);
4875 }
4876
4877 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4878 {
4879 if (!sk)
4880 *secid = SECINITSID_ANY_SOCKET;
4881 else {
4882 struct sk_security_struct *sksec = sk->sk_security;
4883
4884 *secid = sksec->sid;
4885 }
4886 }
4887
4888 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4889 {
4890 struct inode_security_struct *isec =
4891 inode_security_novalidate(SOCK_INODE(parent));
4892 struct sk_security_struct *sksec = sk->sk_security;
4893
4894 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4895 sk->sk_family == PF_UNIX)
4896 isec->sid = sksec->sid;
4897 sksec->sclass = isec->sclass;
4898 }
4899
4900 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4901 struct request_sock *req)
4902 {
4903 struct sk_security_struct *sksec = sk->sk_security;
4904 int err;
4905 u16 family = req->rsk_ops->family;
4906 u32 connsid;
4907 u32 peersid;
4908
4909 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4910 if (err)
4911 return err;
4912 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4913 if (err)
4914 return err;
4915 req->secid = connsid;
4916 req->peer_secid = peersid;
4917
4918 return selinux_netlbl_inet_conn_request(req, family);
4919 }
4920
4921 static void selinux_inet_csk_clone(struct sock *newsk,
4922 const struct request_sock *req)
4923 {
4924 struct sk_security_struct *newsksec = newsk->sk_security;
4925
4926 newsksec->sid = req->secid;
4927 newsksec->peer_sid = req->peer_secid;
4928 /* NOTE: Ideally, we should also get the isec->sid for the
4929 new socket in sync, but we don't have the isec available yet.
4930 So we will wait until sock_graft to do it, by which
4931 time it will have been created and available. */
4932
4933 /* We don't need to take any sort of lock here as we are the only
4934 * thread with access to newsksec */
4935 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4936 }
4937
4938 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4939 {
4940 u16 family = sk->sk_family;
4941 struct sk_security_struct *sksec = sk->sk_security;
4942
4943 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4944 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4945 family = PF_INET;
4946
4947 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4948 }
4949
4950 static int selinux_secmark_relabel_packet(u32 sid)
4951 {
4952 const struct task_security_struct *__tsec;
4953 u32 tsid;
4954
4955 __tsec = current_security();
4956 tsid = __tsec->sid;
4957
4958 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4959 }
4960
4961 static void selinux_secmark_refcount_inc(void)
4962 {
4963 atomic_inc(&selinux_secmark_refcount);
4964 }
4965
4966 static void selinux_secmark_refcount_dec(void)
4967 {
4968 atomic_dec(&selinux_secmark_refcount);
4969 }
4970
4971 static void selinux_req_classify_flow(const struct request_sock *req,
4972 struct flowi *fl)
4973 {
4974 fl->flowi_secid = req->secid;
4975 }
4976
4977 static int selinux_tun_dev_alloc_security(void **security)
4978 {
4979 struct tun_security_struct *tunsec;
4980
4981 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4982 if (!tunsec)
4983 return -ENOMEM;
4984 tunsec->sid = current_sid();
4985
4986 *security = tunsec;
4987 return 0;
4988 }
4989
4990 static void selinux_tun_dev_free_security(void *security)
4991 {
4992 kfree(security);
4993 }
4994
4995 static int selinux_tun_dev_create(void)
4996 {
4997 u32 sid = current_sid();
4998
4999 /* we aren't taking into account the "sockcreate" SID since the socket
5000 * that is being created here is not a socket in the traditional sense,
5001 * instead it is a private sock, accessible only to the kernel, and
5002 * representing a wide range of network traffic spanning multiple
5003 * connections unlike traditional sockets - check the TUN driver to
5004 * get a better understanding of why this socket is special */
5005
5006 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5007 NULL);
5008 }
5009
5010 static int selinux_tun_dev_attach_queue(void *security)
5011 {
5012 struct tun_security_struct *tunsec = security;
5013
5014 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5015 TUN_SOCKET__ATTACH_QUEUE, NULL);
5016 }
5017
5018 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5019 {
5020 struct tun_security_struct *tunsec = security;
5021 struct sk_security_struct *sksec = sk->sk_security;
5022
5023 /* we don't currently perform any NetLabel based labeling here and it
5024 * isn't clear that we would want to do so anyway; while we could apply
5025 * labeling without the support of the TUN user the resulting labeled
5026 * traffic from the other end of the connection would almost certainly
5027 * cause confusion to the TUN user that had no idea network labeling
5028 * protocols were being used */
5029
5030 sksec->sid = tunsec->sid;
5031 sksec->sclass = SECCLASS_TUN_SOCKET;
5032
5033 return 0;
5034 }
5035
5036 static int selinux_tun_dev_open(void *security)
5037 {
5038 struct tun_security_struct *tunsec = security;
5039 u32 sid = current_sid();
5040 int err;
5041
5042 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5043 TUN_SOCKET__RELABELFROM, NULL);
5044 if (err)
5045 return err;
5046 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5047 TUN_SOCKET__RELABELTO, NULL);
5048 if (err)
5049 return err;
5050 tunsec->sid = sid;
5051
5052 return 0;
5053 }
5054
5055 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5056 {
5057 int err = 0;
5058 u32 perm;
5059 struct nlmsghdr *nlh;
5060 struct sk_security_struct *sksec = sk->sk_security;
5061
5062 if (skb->len < NLMSG_HDRLEN) {
5063 err = -EINVAL;
5064 goto out;
5065 }
5066 nlh = nlmsg_hdr(skb);
5067
5068 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5069 if (err) {
5070 if (err == -EINVAL) {
5071 pr_warn_ratelimited("SELinux: unrecognized netlink"
5072 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5073 " pig=%d comm=%s\n",
5074 sk->sk_protocol, nlh->nlmsg_type,
5075 secclass_map[sksec->sclass - 1].name,
5076 task_pid_nr(current), current->comm);
5077 if (!selinux_enforcing || security_get_allow_unknown())
5078 err = 0;
5079 }
5080
5081 /* Ignore */
5082 if (err == -ENOENT)
5083 err = 0;
5084 goto out;
5085 }
5086
5087 err = sock_has_perm(sk, perm);
5088 out:
5089 return err;
5090 }
5091
5092 #ifdef CONFIG_NETFILTER
5093
5094 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5095 const struct net_device *indev,
5096 u16 family)
5097 {
5098 int err;
5099 char *addrp;
5100 u32 peer_sid;
5101 struct common_audit_data ad;
5102 struct lsm_network_audit net = {0,};
5103 u8 secmark_active;
5104 u8 netlbl_active;
5105 u8 peerlbl_active;
5106
5107 if (!selinux_policycap_netpeer)
5108 return NF_ACCEPT;
5109
5110 secmark_active = selinux_secmark_enabled();
5111 netlbl_active = netlbl_enabled();
5112 peerlbl_active = selinux_peerlbl_enabled();
5113 if (!secmark_active && !peerlbl_active)
5114 return NF_ACCEPT;
5115
5116 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5117 return NF_DROP;
5118
5119 ad.type = LSM_AUDIT_DATA_NET;
5120 ad.u.net = &net;
5121 ad.u.net->netif = indev->ifindex;
5122 ad.u.net->family = family;
5123 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5124 return NF_DROP;
5125
5126 if (peerlbl_active) {
5127 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5128 addrp, family, peer_sid, &ad);
5129 if (err) {
5130 selinux_netlbl_err(skb, family, err, 1);
5131 return NF_DROP;
5132 }
5133 }
5134
5135 if (secmark_active)
5136 if (avc_has_perm(peer_sid, skb->secmark,
5137 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5138 return NF_DROP;
5139
5140 if (netlbl_active)
5141 /* we do this in the FORWARD path and not the POST_ROUTING
5142 * path because we want to make sure we apply the necessary
5143 * labeling before IPsec is applied so we can leverage AH
5144 * protection */
5145 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5146 return NF_DROP;
5147
5148 return NF_ACCEPT;
5149 }
5150
5151 static unsigned int selinux_ipv4_forward(void *priv,
5152 struct sk_buff *skb,
5153 const struct nf_hook_state *state)
5154 {
5155 return selinux_ip_forward(skb, state->in, PF_INET);
5156 }
5157
5158 #if IS_ENABLED(CONFIG_IPV6)
5159 static unsigned int selinux_ipv6_forward(void *priv,
5160 struct sk_buff *skb,
5161 const struct nf_hook_state *state)
5162 {
5163 return selinux_ip_forward(skb, state->in, PF_INET6);
5164 }
5165 #endif /* IPV6 */
5166
5167 static unsigned int selinux_ip_output(struct sk_buff *skb,
5168 u16 family)
5169 {
5170 struct sock *sk;
5171 u32 sid;
5172
5173 if (!netlbl_enabled())
5174 return NF_ACCEPT;
5175
5176 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5177 * because we want to make sure we apply the necessary labeling
5178 * before IPsec is applied so we can leverage AH protection */
5179 sk = skb->sk;
5180 if (sk) {
5181 struct sk_security_struct *sksec;
5182
5183 if (sk_listener(sk))
5184 /* if the socket is the listening state then this
5185 * packet is a SYN-ACK packet which means it needs to
5186 * be labeled based on the connection/request_sock and
5187 * not the parent socket. unfortunately, we can't
5188 * lookup the request_sock yet as it isn't queued on
5189 * the parent socket until after the SYN-ACK is sent.
5190 * the "solution" is to simply pass the packet as-is
5191 * as any IP option based labeling should be copied
5192 * from the initial connection request (in the IP
5193 * layer). it is far from ideal, but until we get a
5194 * security label in the packet itself this is the
5195 * best we can do. */
5196 return NF_ACCEPT;
5197
5198 /* standard practice, label using the parent socket */
5199 sksec = sk->sk_security;
5200 sid = sksec->sid;
5201 } else
5202 sid = SECINITSID_KERNEL;
5203 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5204 return NF_DROP;
5205
5206 return NF_ACCEPT;
5207 }
5208
5209 static unsigned int selinux_ipv4_output(void *priv,
5210 struct sk_buff *skb,
5211 const struct nf_hook_state *state)
5212 {
5213 return selinux_ip_output(skb, PF_INET);
5214 }
5215
5216 #if IS_ENABLED(CONFIG_IPV6)
5217 static unsigned int selinux_ipv6_output(void *priv,
5218 struct sk_buff *skb,
5219 const struct nf_hook_state *state)
5220 {
5221 return selinux_ip_output(skb, PF_INET6);
5222 }
5223 #endif /* IPV6 */
5224
5225 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5226 int ifindex,
5227 u16 family)
5228 {
5229 struct sock *sk = skb_to_full_sk(skb);
5230 struct sk_security_struct *sksec;
5231 struct common_audit_data ad;
5232 struct lsm_network_audit net = {0,};
5233 char *addrp;
5234 u8 proto;
5235
5236 if (sk == NULL)
5237 return NF_ACCEPT;
5238 sksec = sk->sk_security;
5239
5240 ad.type = LSM_AUDIT_DATA_NET;
5241 ad.u.net = &net;
5242 ad.u.net->netif = ifindex;
5243 ad.u.net->family = family;
5244 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5245 return NF_DROP;
5246
5247 if (selinux_secmark_enabled())
5248 if (avc_has_perm(sksec->sid, skb->secmark,
5249 SECCLASS_PACKET, PACKET__SEND, &ad))
5250 return NF_DROP_ERR(-ECONNREFUSED);
5251
5252 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5253 return NF_DROP_ERR(-ECONNREFUSED);
5254
5255 return NF_ACCEPT;
5256 }
5257
5258 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5259 const struct net_device *outdev,
5260 u16 family)
5261 {
5262 u32 secmark_perm;
5263 u32 peer_sid;
5264 int ifindex = outdev->ifindex;
5265 struct sock *sk;
5266 struct common_audit_data ad;
5267 struct lsm_network_audit net = {0,};
5268 char *addrp;
5269 u8 secmark_active;
5270 u8 peerlbl_active;
5271
5272 /* If any sort of compatibility mode is enabled then handoff processing
5273 * to the selinux_ip_postroute_compat() function to deal with the
5274 * special handling. We do this in an attempt to keep this function
5275 * as fast and as clean as possible. */
5276 if (!selinux_policycap_netpeer)
5277 return selinux_ip_postroute_compat(skb, ifindex, family);
5278
5279 secmark_active = selinux_secmark_enabled();
5280 peerlbl_active = selinux_peerlbl_enabled();
5281 if (!secmark_active && !peerlbl_active)
5282 return NF_ACCEPT;
5283
5284 sk = skb_to_full_sk(skb);
5285
5286 #ifdef CONFIG_XFRM
5287 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5288 * packet transformation so allow the packet to pass without any checks
5289 * since we'll have another chance to perform access control checks
5290 * when the packet is on it's final way out.
5291 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5292 * is NULL, in this case go ahead and apply access control.
5293 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5294 * TCP listening state we cannot wait until the XFRM processing
5295 * is done as we will miss out on the SA label if we do;
5296 * unfortunately, this means more work, but it is only once per
5297 * connection. */
5298 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5299 !(sk && sk_listener(sk)))
5300 return NF_ACCEPT;
5301 #endif
5302
5303 if (sk == NULL) {
5304 /* Without an associated socket the packet is either coming
5305 * from the kernel or it is being forwarded; check the packet
5306 * to determine which and if the packet is being forwarded
5307 * query the packet directly to determine the security label. */
5308 if (skb->skb_iif) {
5309 secmark_perm = PACKET__FORWARD_OUT;
5310 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5311 return NF_DROP;
5312 } else {
5313 secmark_perm = PACKET__SEND;
5314 peer_sid = SECINITSID_KERNEL;
5315 }
5316 } else if (sk_listener(sk)) {
5317 /* Locally generated packet but the associated socket is in the
5318 * listening state which means this is a SYN-ACK packet. In
5319 * this particular case the correct security label is assigned
5320 * to the connection/request_sock but unfortunately we can't
5321 * query the request_sock as it isn't queued on the parent
5322 * socket until after the SYN-ACK packet is sent; the only
5323 * viable choice is to regenerate the label like we do in
5324 * selinux_inet_conn_request(). See also selinux_ip_output()
5325 * for similar problems. */
5326 u32 skb_sid;
5327 struct sk_security_struct *sksec;
5328
5329 sksec = sk->sk_security;
5330 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5331 return NF_DROP;
5332 /* At this point, if the returned skb peerlbl is SECSID_NULL
5333 * and the packet has been through at least one XFRM
5334 * transformation then we must be dealing with the "final"
5335 * form of labeled IPsec packet; since we've already applied
5336 * all of our access controls on this packet we can safely
5337 * pass the packet. */
5338 if (skb_sid == SECSID_NULL) {
5339 switch (family) {
5340 case PF_INET:
5341 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5342 return NF_ACCEPT;
5343 break;
5344 case PF_INET6:
5345 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5346 return NF_ACCEPT;
5347 break;
5348 default:
5349 return NF_DROP_ERR(-ECONNREFUSED);
5350 }
5351 }
5352 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5353 return NF_DROP;
5354 secmark_perm = PACKET__SEND;
5355 } else {
5356 /* Locally generated packet, fetch the security label from the
5357 * associated socket. */
5358 struct sk_security_struct *sksec = sk->sk_security;
5359 peer_sid = sksec->sid;
5360 secmark_perm = PACKET__SEND;
5361 }
5362
5363 ad.type = LSM_AUDIT_DATA_NET;
5364 ad.u.net = &net;
5365 ad.u.net->netif = ifindex;
5366 ad.u.net->family = family;
5367 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5368 return NF_DROP;
5369
5370 if (secmark_active)
5371 if (avc_has_perm(peer_sid, skb->secmark,
5372 SECCLASS_PACKET, secmark_perm, &ad))
5373 return NF_DROP_ERR(-ECONNREFUSED);
5374
5375 if (peerlbl_active) {
5376 u32 if_sid;
5377 u32 node_sid;
5378
5379 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5380 return NF_DROP;
5381 if (avc_has_perm(peer_sid, if_sid,
5382 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5383 return NF_DROP_ERR(-ECONNREFUSED);
5384
5385 if (sel_netnode_sid(addrp, family, &node_sid))
5386 return NF_DROP;
5387 if (avc_has_perm(peer_sid, node_sid,
5388 SECCLASS_NODE, NODE__SENDTO, &ad))
5389 return NF_DROP_ERR(-ECONNREFUSED);
5390 }
5391
5392 return NF_ACCEPT;
5393 }
5394
5395 static unsigned int selinux_ipv4_postroute(void *priv,
5396 struct sk_buff *skb,
5397 const struct nf_hook_state *state)
5398 {
5399 return selinux_ip_postroute(skb, state->out, PF_INET);
5400 }
5401
5402 #if IS_ENABLED(CONFIG_IPV6)
5403 static unsigned int selinux_ipv6_postroute(void *priv,
5404 struct sk_buff *skb,
5405 const struct nf_hook_state *state)
5406 {
5407 return selinux_ip_postroute(skb, state->out, PF_INET6);
5408 }
5409 #endif /* IPV6 */
5410
5411 #endif /* CONFIG_NETFILTER */
5412
5413 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5414 {
5415 return selinux_nlmsg_perm(sk, skb);
5416 }
5417
5418 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5419 u16 sclass)
5420 {
5421 struct ipc_security_struct *isec;
5422
5423 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5424 if (!isec)
5425 return -ENOMEM;
5426
5427 isec->sclass = sclass;
5428 isec->sid = current_sid();
5429 perm->security = isec;
5430
5431 return 0;
5432 }
5433
5434 static void ipc_free_security(struct kern_ipc_perm *perm)
5435 {
5436 struct ipc_security_struct *isec = perm->security;
5437 perm->security = NULL;
5438 kfree(isec);
5439 }
5440
5441 static int msg_msg_alloc_security(struct msg_msg *msg)
5442 {
5443 struct msg_security_struct *msec;
5444
5445 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5446 if (!msec)
5447 return -ENOMEM;
5448
5449 msec->sid = SECINITSID_UNLABELED;
5450 msg->security = msec;
5451
5452 return 0;
5453 }
5454
5455 static void msg_msg_free_security(struct msg_msg *msg)
5456 {
5457 struct msg_security_struct *msec = msg->security;
5458
5459 msg->security = NULL;
5460 kfree(msec);
5461 }
5462
5463 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5464 u32 perms)
5465 {
5466 struct ipc_security_struct *isec;
5467 struct common_audit_data ad;
5468 u32 sid = current_sid();
5469
5470 isec = ipc_perms->security;
5471
5472 ad.type = LSM_AUDIT_DATA_IPC;
5473 ad.u.ipc_id = ipc_perms->key;
5474
5475 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5476 }
5477
5478 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5479 {
5480 return msg_msg_alloc_security(msg);
5481 }
5482
5483 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5484 {
5485 msg_msg_free_security(msg);
5486 }
5487
5488 /* message queue security operations */
5489 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5490 {
5491 struct ipc_security_struct *isec;
5492 struct common_audit_data ad;
5493 u32 sid = current_sid();
5494 int rc;
5495
5496 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5497 if (rc)
5498 return rc;
5499
5500 isec = msq->q_perm.security;
5501
5502 ad.type = LSM_AUDIT_DATA_IPC;
5503 ad.u.ipc_id = msq->q_perm.key;
5504
5505 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5506 MSGQ__CREATE, &ad);
5507 if (rc) {
5508 ipc_free_security(&msq->q_perm);
5509 return rc;
5510 }
5511 return 0;
5512 }
5513
5514 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5515 {
5516 ipc_free_security(&msq->q_perm);
5517 }
5518
5519 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5520 {
5521 struct ipc_security_struct *isec;
5522 struct common_audit_data ad;
5523 u32 sid = current_sid();
5524
5525 isec = msq->q_perm.security;
5526
5527 ad.type = LSM_AUDIT_DATA_IPC;
5528 ad.u.ipc_id = msq->q_perm.key;
5529
5530 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5531 MSGQ__ASSOCIATE, &ad);
5532 }
5533
5534 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5535 {
5536 int err;
5537 int perms;
5538
5539 switch (cmd) {
5540 case IPC_INFO:
5541 case MSG_INFO:
5542 /* No specific object, just general system-wide information. */
5543 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5544 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5545 case IPC_STAT:
5546 case MSG_STAT:
5547 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5548 break;
5549 case IPC_SET:
5550 perms = MSGQ__SETATTR;
5551 break;
5552 case IPC_RMID:
5553 perms = MSGQ__DESTROY;
5554 break;
5555 default:
5556 return 0;
5557 }
5558
5559 err = ipc_has_perm(&msq->q_perm, perms);
5560 return err;
5561 }
5562
5563 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5564 {
5565 struct ipc_security_struct *isec;
5566 struct msg_security_struct *msec;
5567 struct common_audit_data ad;
5568 u32 sid = current_sid();
5569 int rc;
5570
5571 isec = msq->q_perm.security;
5572 msec = msg->security;
5573
5574 /*
5575 * First time through, need to assign label to the message
5576 */
5577 if (msec->sid == SECINITSID_UNLABELED) {
5578 /*
5579 * Compute new sid based on current process and
5580 * message queue this message will be stored in
5581 */
5582 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5583 NULL, &msec->sid);
5584 if (rc)
5585 return rc;
5586 }
5587
5588 ad.type = LSM_AUDIT_DATA_IPC;
5589 ad.u.ipc_id = msq->q_perm.key;
5590
5591 /* Can this process write to the queue? */
5592 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5593 MSGQ__WRITE, &ad);
5594 if (!rc)
5595 /* Can this process send the message */
5596 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5597 MSG__SEND, &ad);
5598 if (!rc)
5599 /* Can the message be put in the queue? */
5600 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5601 MSGQ__ENQUEUE, &ad);
5602
5603 return rc;
5604 }
5605
5606 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5607 struct task_struct *target,
5608 long type, int mode)
5609 {
5610 struct ipc_security_struct *isec;
5611 struct msg_security_struct *msec;
5612 struct common_audit_data ad;
5613 u32 sid = task_sid(target);
5614 int rc;
5615
5616 isec = msq->q_perm.security;
5617 msec = msg->security;
5618
5619 ad.type = LSM_AUDIT_DATA_IPC;
5620 ad.u.ipc_id = msq->q_perm.key;
5621
5622 rc = avc_has_perm(sid, isec->sid,
5623 SECCLASS_MSGQ, MSGQ__READ, &ad);
5624 if (!rc)
5625 rc = avc_has_perm(sid, msec->sid,
5626 SECCLASS_MSG, MSG__RECEIVE, &ad);
5627 return rc;
5628 }
5629
5630 /* Shared Memory security operations */
5631 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5632 {
5633 struct ipc_security_struct *isec;
5634 struct common_audit_data ad;
5635 u32 sid = current_sid();
5636 int rc;
5637
5638 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5639 if (rc)
5640 return rc;
5641
5642 isec = shp->shm_perm.security;
5643
5644 ad.type = LSM_AUDIT_DATA_IPC;
5645 ad.u.ipc_id = shp->shm_perm.key;
5646
5647 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5648 SHM__CREATE, &ad);
5649 if (rc) {
5650 ipc_free_security(&shp->shm_perm);
5651 return rc;
5652 }
5653 return 0;
5654 }
5655
5656 static void selinux_shm_free_security(struct shmid_kernel *shp)
5657 {
5658 ipc_free_security(&shp->shm_perm);
5659 }
5660
5661 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5662 {
5663 struct ipc_security_struct *isec;
5664 struct common_audit_data ad;
5665 u32 sid = current_sid();
5666
5667 isec = shp->shm_perm.security;
5668
5669 ad.type = LSM_AUDIT_DATA_IPC;
5670 ad.u.ipc_id = shp->shm_perm.key;
5671
5672 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5673 SHM__ASSOCIATE, &ad);
5674 }
5675
5676 /* Note, at this point, shp is locked down */
5677 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5678 {
5679 int perms;
5680 int err;
5681
5682 switch (cmd) {
5683 case IPC_INFO:
5684 case SHM_INFO:
5685 /* No specific object, just general system-wide information. */
5686 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5687 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5688 case IPC_STAT:
5689 case SHM_STAT:
5690 perms = SHM__GETATTR | SHM__ASSOCIATE;
5691 break;
5692 case IPC_SET:
5693 perms = SHM__SETATTR;
5694 break;
5695 case SHM_LOCK:
5696 case SHM_UNLOCK:
5697 perms = SHM__LOCK;
5698 break;
5699 case IPC_RMID:
5700 perms = SHM__DESTROY;
5701 break;
5702 default:
5703 return 0;
5704 }
5705
5706 err = ipc_has_perm(&shp->shm_perm, perms);
5707 return err;
5708 }
5709
5710 static int selinux_shm_shmat(struct shmid_kernel *shp,
5711 char __user *shmaddr, int shmflg)
5712 {
5713 u32 perms;
5714
5715 if (shmflg & SHM_RDONLY)
5716 perms = SHM__READ;
5717 else
5718 perms = SHM__READ | SHM__WRITE;
5719
5720 return ipc_has_perm(&shp->shm_perm, perms);
5721 }
5722
5723 /* Semaphore security operations */
5724 static int selinux_sem_alloc_security(struct sem_array *sma)
5725 {
5726 struct ipc_security_struct *isec;
5727 struct common_audit_data ad;
5728 u32 sid = current_sid();
5729 int rc;
5730
5731 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5732 if (rc)
5733 return rc;
5734
5735 isec = sma->sem_perm.security;
5736
5737 ad.type = LSM_AUDIT_DATA_IPC;
5738 ad.u.ipc_id = sma->sem_perm.key;
5739
5740 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5741 SEM__CREATE, &ad);
5742 if (rc) {
5743 ipc_free_security(&sma->sem_perm);
5744 return rc;
5745 }
5746 return 0;
5747 }
5748
5749 static void selinux_sem_free_security(struct sem_array *sma)
5750 {
5751 ipc_free_security(&sma->sem_perm);
5752 }
5753
5754 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5755 {
5756 struct ipc_security_struct *isec;
5757 struct common_audit_data ad;
5758 u32 sid = current_sid();
5759
5760 isec = sma->sem_perm.security;
5761
5762 ad.type = LSM_AUDIT_DATA_IPC;
5763 ad.u.ipc_id = sma->sem_perm.key;
5764
5765 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5766 SEM__ASSOCIATE, &ad);
5767 }
5768
5769 /* Note, at this point, sma is locked down */
5770 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5771 {
5772 int err;
5773 u32 perms;
5774
5775 switch (cmd) {
5776 case IPC_INFO:
5777 case SEM_INFO:
5778 /* No specific object, just general system-wide information. */
5779 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5780 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5781 case GETPID:
5782 case GETNCNT:
5783 case GETZCNT:
5784 perms = SEM__GETATTR;
5785 break;
5786 case GETVAL:
5787 case GETALL:
5788 perms = SEM__READ;
5789 break;
5790 case SETVAL:
5791 case SETALL:
5792 perms = SEM__WRITE;
5793 break;
5794 case IPC_RMID:
5795 perms = SEM__DESTROY;
5796 break;
5797 case IPC_SET:
5798 perms = SEM__SETATTR;
5799 break;
5800 case IPC_STAT:
5801 case SEM_STAT:
5802 perms = SEM__GETATTR | SEM__ASSOCIATE;
5803 break;
5804 default:
5805 return 0;
5806 }
5807
5808 err = ipc_has_perm(&sma->sem_perm, perms);
5809 return err;
5810 }
5811
5812 static int selinux_sem_semop(struct sem_array *sma,
5813 struct sembuf *sops, unsigned nsops, int alter)
5814 {
5815 u32 perms;
5816
5817 if (alter)
5818 perms = SEM__READ | SEM__WRITE;
5819 else
5820 perms = SEM__READ;
5821
5822 return ipc_has_perm(&sma->sem_perm, perms);
5823 }
5824
5825 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5826 {
5827 u32 av = 0;
5828
5829 av = 0;
5830 if (flag & S_IRUGO)
5831 av |= IPC__UNIX_READ;
5832 if (flag & S_IWUGO)
5833 av |= IPC__UNIX_WRITE;
5834
5835 if (av == 0)
5836 return 0;
5837
5838 return ipc_has_perm(ipcp, av);
5839 }
5840
5841 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5842 {
5843 struct ipc_security_struct *isec = ipcp->security;
5844 *secid = isec->sid;
5845 }
5846
5847 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5848 {
5849 if (inode)
5850 inode_doinit_with_dentry(inode, dentry);
5851 }
5852
5853 static int selinux_getprocattr(struct task_struct *p,
5854 char *name, char **value)
5855 {
5856 const struct task_security_struct *__tsec;
5857 u32 sid;
5858 int error;
5859 unsigned len;
5860
5861 rcu_read_lock();
5862 __tsec = __task_cred(p)->security;
5863
5864 if (current != p) {
5865 error = avc_has_perm(current_sid(), __tsec->sid,
5866 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5867 if (error)
5868 goto bad;
5869 }
5870
5871 if (!strcmp(name, "current"))
5872 sid = __tsec->sid;
5873 else if (!strcmp(name, "prev"))
5874 sid = __tsec->osid;
5875 else if (!strcmp(name, "exec"))
5876 sid = __tsec->exec_sid;
5877 else if (!strcmp(name, "fscreate"))
5878 sid = __tsec->create_sid;
5879 else if (!strcmp(name, "keycreate"))
5880 sid = __tsec->keycreate_sid;
5881 else if (!strcmp(name, "sockcreate"))
5882 sid = __tsec->sockcreate_sid;
5883 else {
5884 error = -EINVAL;
5885 goto bad;
5886 }
5887 rcu_read_unlock();
5888
5889 if (!sid)
5890 return 0;
5891
5892 error = security_sid_to_context(sid, value, &len);
5893 if (error)
5894 return error;
5895 return len;
5896
5897 bad:
5898 rcu_read_unlock();
5899 return error;
5900 }
5901
5902 static int selinux_setprocattr(const char *name, void *value, size_t size)
5903 {
5904 struct task_security_struct *tsec;
5905 struct cred *new;
5906 u32 mysid = current_sid(), sid = 0, ptsid;
5907 int error;
5908 char *str = value;
5909
5910 /*
5911 * Basic control over ability to set these attributes at all.
5912 */
5913 if (!strcmp(name, "exec"))
5914 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5915 PROCESS__SETEXEC, NULL);
5916 else if (!strcmp(name, "fscreate"))
5917 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5918 PROCESS__SETFSCREATE, NULL);
5919 else if (!strcmp(name, "keycreate"))
5920 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5921 PROCESS__SETKEYCREATE, NULL);
5922 else if (!strcmp(name, "sockcreate"))
5923 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5924 PROCESS__SETSOCKCREATE, NULL);
5925 else if (!strcmp(name, "current"))
5926 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5927 PROCESS__SETCURRENT, NULL);
5928 else
5929 error = -EINVAL;
5930 if (error)
5931 return error;
5932
5933 /* Obtain a SID for the context, if one was specified. */
5934 if (size && str[0] && str[0] != '\n') {
5935 if (str[size-1] == '\n') {
5936 str[size-1] = 0;
5937 size--;
5938 }
5939 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5940 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5941 if (!has_cap_mac_admin(true)) {
5942 struct audit_buffer *ab;
5943 size_t audit_size;
5944
5945 /* We strip a nul only if it is at the end, otherwise the
5946 * context contains a nul and we should audit that */
5947 if (str[size - 1] == '\0')
5948 audit_size = size - 1;
5949 else
5950 audit_size = size;
5951 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5952 audit_log_format(ab, "op=fscreate invalid_context=");
5953 audit_log_n_untrustedstring(ab, value, audit_size);
5954 audit_log_end(ab);
5955
5956 return error;
5957 }
5958 error = security_context_to_sid_force(value, size,
5959 &sid);
5960 }
5961 if (error)
5962 return error;
5963 }
5964
5965 new = prepare_creds();
5966 if (!new)
5967 return -ENOMEM;
5968
5969 /* Permission checking based on the specified context is
5970 performed during the actual operation (execve,
5971 open/mkdir/...), when we know the full context of the
5972 operation. See selinux_bprm_set_creds for the execve
5973 checks and may_create for the file creation checks. The
5974 operation will then fail if the context is not permitted. */
5975 tsec = new->security;
5976 if (!strcmp(name, "exec")) {
5977 tsec->exec_sid = sid;
5978 } else if (!strcmp(name, "fscreate")) {
5979 tsec->create_sid = sid;
5980 } else if (!strcmp(name, "keycreate")) {
5981 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5982 NULL);
5983 if (error)
5984 goto abort_change;
5985 tsec->keycreate_sid = sid;
5986 } else if (!strcmp(name, "sockcreate")) {
5987 tsec->sockcreate_sid = sid;
5988 } else if (!strcmp(name, "current")) {
5989 error = -EINVAL;
5990 if (sid == 0)
5991 goto abort_change;
5992
5993 /* Only allow single threaded processes to change context */
5994 error = -EPERM;
5995 if (!current_is_single_threaded()) {
5996 error = security_bounded_transition(tsec->sid, sid);
5997 if (error)
5998 goto abort_change;
5999 }
6000
6001 /* Check permissions for the transition. */
6002 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6003 PROCESS__DYNTRANSITION, NULL);
6004 if (error)
6005 goto abort_change;
6006
6007 /* Check for ptracing, and update the task SID if ok.
6008 Otherwise, leave SID unchanged and fail. */
6009 ptsid = ptrace_parent_sid();
6010 if (ptsid != 0) {
6011 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6012 PROCESS__PTRACE, NULL);
6013 if (error)
6014 goto abort_change;
6015 }
6016
6017 tsec->sid = sid;
6018 } else {
6019 error = -EINVAL;
6020 goto abort_change;
6021 }
6022
6023 commit_creds(new);
6024 return size;
6025
6026 abort_change:
6027 abort_creds(new);
6028 return error;
6029 }
6030
6031 static int selinux_ismaclabel(const char *name)
6032 {
6033 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6034 }
6035
6036 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6037 {
6038 return security_sid_to_context(secid, secdata, seclen);
6039 }
6040
6041 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6042 {
6043 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6044 }
6045
6046 static void selinux_release_secctx(char *secdata, u32 seclen)
6047 {
6048 kfree(secdata);
6049 }
6050
6051 static void selinux_inode_invalidate_secctx(struct inode *inode)
6052 {
6053 struct inode_security_struct *isec = inode->i_security;
6054
6055 spin_lock(&isec->lock);
6056 isec->initialized = LABEL_INVALID;
6057 spin_unlock(&isec->lock);
6058 }
6059
6060 /*
6061 * called with inode->i_mutex locked
6062 */
6063 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6064 {
6065 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6066 }
6067
6068 /*
6069 * called with inode->i_mutex locked
6070 */
6071 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6072 {
6073 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6074 }
6075
6076 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6077 {
6078 int len = 0;
6079 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6080 ctx, true);
6081 if (len < 0)
6082 return len;
6083 *ctxlen = len;
6084 return 0;
6085 }
6086 #ifdef CONFIG_KEYS
6087
6088 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6089 unsigned long flags)
6090 {
6091 const struct task_security_struct *tsec;
6092 struct key_security_struct *ksec;
6093
6094 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6095 if (!ksec)
6096 return -ENOMEM;
6097
6098 tsec = cred->security;
6099 if (tsec->keycreate_sid)
6100 ksec->sid = tsec->keycreate_sid;
6101 else
6102 ksec->sid = tsec->sid;
6103
6104 k->security = ksec;
6105 return 0;
6106 }
6107
6108 static void selinux_key_free(struct key *k)
6109 {
6110 struct key_security_struct *ksec = k->security;
6111
6112 k->security = NULL;
6113 kfree(ksec);
6114 }
6115
6116 static int selinux_key_permission(key_ref_t key_ref,
6117 const struct cred *cred,
6118 unsigned perm)
6119 {
6120 struct key *key;
6121 struct key_security_struct *ksec;
6122 u32 sid;
6123
6124 /* if no specific permissions are requested, we skip the
6125 permission check. No serious, additional covert channels
6126 appear to be created. */
6127 if (perm == 0)
6128 return 0;
6129
6130 sid = cred_sid(cred);
6131
6132 key = key_ref_to_ptr(key_ref);
6133 ksec = key->security;
6134
6135 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6136 }
6137
6138 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6139 {
6140 struct key_security_struct *ksec = key->security;
6141 char *context = NULL;
6142 unsigned len;
6143 int rc;
6144
6145 rc = security_sid_to_context(ksec->sid, &context, &len);
6146 if (!rc)
6147 rc = len;
6148 *_buffer = context;
6149 return rc;
6150 }
6151 #endif
6152
6153 #ifdef CONFIG_SECURITY_INFINIBAND
6154 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6155 {
6156 struct common_audit_data ad;
6157 int err;
6158 u32 sid = 0;
6159 struct ib_security_struct *sec = ib_sec;
6160 struct lsm_ibpkey_audit ibpkey;
6161
6162 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6163 if (err)
6164 return err;
6165
6166 ad.type = LSM_AUDIT_DATA_IBPKEY;
6167 ibpkey.subnet_prefix = subnet_prefix;
6168 ibpkey.pkey = pkey_val;
6169 ad.u.ibpkey = &ibpkey;
6170 return avc_has_perm(sec->sid, sid,
6171 SECCLASS_INFINIBAND_PKEY,
6172 INFINIBAND_PKEY__ACCESS, &ad);
6173 }
6174
6175 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6176 u8 port_num)
6177 {
6178 struct common_audit_data ad;
6179 int err;
6180 u32 sid = 0;
6181 struct ib_security_struct *sec = ib_sec;
6182 struct lsm_ibendport_audit ibendport;
6183
6184 err = security_ib_endport_sid(dev_name, port_num, &sid);
6185
6186 if (err)
6187 return err;
6188
6189 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6190 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6191 ibendport.port = port_num;
6192 ad.u.ibendport = &ibendport;
6193 return avc_has_perm(sec->sid, sid,
6194 SECCLASS_INFINIBAND_ENDPORT,
6195 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6196 }
6197
6198 static int selinux_ib_alloc_security(void **ib_sec)
6199 {
6200 struct ib_security_struct *sec;
6201
6202 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6203 if (!sec)
6204 return -ENOMEM;
6205 sec->sid = current_sid();
6206
6207 *ib_sec = sec;
6208 return 0;
6209 }
6210
6211 static void selinux_ib_free_security(void *ib_sec)
6212 {
6213 kfree(ib_sec);
6214 }
6215 #endif
6216
6217 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6218 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6219 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6220 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6221 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6222
6223 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6224 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6225 LSM_HOOK_INIT(capget, selinux_capget),
6226 LSM_HOOK_INIT(capset, selinux_capset),
6227 LSM_HOOK_INIT(capable, selinux_capable),
6228 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6229 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6230 LSM_HOOK_INIT(syslog, selinux_syslog),
6231 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6232
6233 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6234
6235 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6236 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6237 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6238 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6239
6240 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6241 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6242 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6243 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6244 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6245 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6246 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6247 LSM_HOOK_INIT(sb_mount, selinux_mount),
6248 LSM_HOOK_INIT(sb_umount, selinux_umount),
6249 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6250 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6251 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6252
6253 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6254 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6255
6256 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6257 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6258 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6259 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6260 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6261 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6262 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6263 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6264 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6265 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6266 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6267 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6268 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6269 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6270 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6271 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6272 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6273 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6274 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6275 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6276 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6277 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6278 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6279 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6280 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6281 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6282 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6283
6284 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6285 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6286 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6287 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6288 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6289 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6290 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6291 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6292 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6293 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6294 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6295 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6296
6297 LSM_HOOK_INIT(file_open, selinux_file_open),
6298
6299 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6300 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6301 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6302 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6303 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6304 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6305 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6306 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6307 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6308 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6309 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6310 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6311 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6312 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6313 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6314 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6315 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6316 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6317 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6318 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6319 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6320 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6321 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6322
6323 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6324 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6325
6326 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6327 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6328
6329 LSM_HOOK_INIT(msg_queue_alloc_security,
6330 selinux_msg_queue_alloc_security),
6331 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6332 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6333 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6334 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6335 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6336
6337 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6338 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6339 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6340 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6341 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6342
6343 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6344 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6345 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6346 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6347 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6348
6349 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6350
6351 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6352 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6353
6354 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6355 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6356 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6357 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6358 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6359 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6360 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6361 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6362
6363 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6364 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6365
6366 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6367 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6368 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6369 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6370 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6371 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6372 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6373 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6374 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6375 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6376 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6377 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6378 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6379 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6380 LSM_HOOK_INIT(socket_getpeersec_stream,
6381 selinux_socket_getpeersec_stream),
6382 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6383 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6384 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6385 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6386 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6387 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6388 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6389 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6390 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6391 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6392 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6393 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6394 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6395 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6396 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6397 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6398 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6399 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6400 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6401 #ifdef CONFIG_SECURITY_INFINIBAND
6402 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6403 LSM_HOOK_INIT(ib_endport_manage_subnet,
6404 selinux_ib_endport_manage_subnet),
6405 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6406 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6407 #endif
6408 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6409 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6410 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6411 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6412 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6413 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6414 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6415 selinux_xfrm_state_alloc_acquire),
6416 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6417 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6418 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6419 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6420 selinux_xfrm_state_pol_flow_match),
6421 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6422 #endif
6423
6424 #ifdef CONFIG_KEYS
6425 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6426 LSM_HOOK_INIT(key_free, selinux_key_free),
6427 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6428 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6429 #endif
6430
6431 #ifdef CONFIG_AUDIT
6432 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6433 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6434 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6435 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6436 #endif
6437 };
6438
6439 static __init int selinux_init(void)
6440 {
6441 if (!security_module_enable("selinux")) {
6442 selinux_enabled = 0;
6443 return 0;
6444 }
6445
6446 if (!selinux_enabled) {
6447 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6448 return 0;
6449 }
6450
6451 printk(KERN_INFO "SELinux: Initializing.\n");
6452
6453 /* Set the security state for the initial task. */
6454 cred_init_security();
6455
6456 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6457
6458 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6459 sizeof(struct inode_security_struct),
6460 0, SLAB_PANIC, NULL);
6461 file_security_cache = kmem_cache_create("selinux_file_security",
6462 sizeof(struct file_security_struct),
6463 0, SLAB_PANIC, NULL);
6464 avc_init();
6465
6466 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6467
6468 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6469 panic("SELinux: Unable to register AVC netcache callback\n");
6470
6471 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6472 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6473
6474 if (selinux_enforcing)
6475 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6476 else
6477 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6478
6479 return 0;
6480 }
6481
6482 static void delayed_superblock_init(struct super_block *sb, void *unused)
6483 {
6484 superblock_doinit(sb, NULL);
6485 }
6486
6487 void selinux_complete_init(void)
6488 {
6489 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6490
6491 /* Set up any superblocks initialized prior to the policy load. */
6492 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6493 iterate_supers(delayed_superblock_init, NULL);
6494 }
6495
6496 /* SELinux requires early initialization in order to label
6497 all processes and objects when they are created. */
6498 security_initcall(selinux_init);
6499
6500 #if defined(CONFIG_NETFILTER)
6501
6502 static struct nf_hook_ops selinux_nf_ops[] = {
6503 {
6504 .hook = selinux_ipv4_postroute,
6505 .pf = NFPROTO_IPV4,
6506 .hooknum = NF_INET_POST_ROUTING,
6507 .priority = NF_IP_PRI_SELINUX_LAST,
6508 },
6509 {
6510 .hook = selinux_ipv4_forward,
6511 .pf = NFPROTO_IPV4,
6512 .hooknum = NF_INET_FORWARD,
6513 .priority = NF_IP_PRI_SELINUX_FIRST,
6514 },
6515 {
6516 .hook = selinux_ipv4_output,
6517 .pf = NFPROTO_IPV4,
6518 .hooknum = NF_INET_LOCAL_OUT,
6519 .priority = NF_IP_PRI_SELINUX_FIRST,
6520 },
6521 #if IS_ENABLED(CONFIG_IPV6)
6522 {
6523 .hook = selinux_ipv6_postroute,
6524 .pf = NFPROTO_IPV6,
6525 .hooknum = NF_INET_POST_ROUTING,
6526 .priority = NF_IP6_PRI_SELINUX_LAST,
6527 },
6528 {
6529 .hook = selinux_ipv6_forward,
6530 .pf = NFPROTO_IPV6,
6531 .hooknum = NF_INET_FORWARD,
6532 .priority = NF_IP6_PRI_SELINUX_FIRST,
6533 },
6534 {
6535 .hook = selinux_ipv6_output,
6536 .pf = NFPROTO_IPV6,
6537 .hooknum = NF_INET_LOCAL_OUT,
6538 .priority = NF_IP6_PRI_SELINUX_FIRST,
6539 },
6540 #endif /* IPV6 */
6541 };
6542
6543 static int __net_init selinux_nf_register(struct net *net)
6544 {
6545 return nf_register_net_hooks(net, selinux_nf_ops,
6546 ARRAY_SIZE(selinux_nf_ops));
6547 }
6548
6549 static void __net_exit selinux_nf_unregister(struct net *net)
6550 {
6551 nf_unregister_net_hooks(net, selinux_nf_ops,
6552 ARRAY_SIZE(selinux_nf_ops));
6553 }
6554
6555 static struct pernet_operations selinux_net_ops = {
6556 .init = selinux_nf_register,
6557 .exit = selinux_nf_unregister,
6558 };
6559
6560 static int __init selinux_nf_ip_init(void)
6561 {
6562 int err;
6563
6564 if (!selinux_enabled)
6565 return 0;
6566
6567 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6568
6569 err = register_pernet_subsys(&selinux_net_ops);
6570 if (err)
6571 panic("SELinux: register_pernet_subsys: error %d\n", err);
6572
6573 return 0;
6574 }
6575 __initcall(selinux_nf_ip_init);
6576
6577 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6578 static void selinux_nf_ip_exit(void)
6579 {
6580 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6581
6582 unregister_pernet_subsys(&selinux_net_ops);
6583 }
6584 #endif
6585
6586 #else /* CONFIG_NETFILTER */
6587
6588 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6589 #define selinux_nf_ip_exit()
6590 #endif
6591
6592 #endif /* CONFIG_NETFILTER */
6593
6594 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6595 static int selinux_disabled;
6596
6597 int selinux_disable(void)
6598 {
6599 if (ss_initialized) {
6600 /* Not permitted after initial policy load. */
6601 return -EINVAL;
6602 }
6603
6604 if (selinux_disabled) {
6605 /* Only do this once. */
6606 return -EINVAL;
6607 }
6608
6609 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6610
6611 selinux_disabled = 1;
6612 selinux_enabled = 0;
6613
6614 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6615
6616 /* Try to destroy the avc node cache */
6617 avc_disable();
6618
6619 /* Unregister netfilter hooks. */
6620 selinux_nf_ip_exit();
6621
6622 /* Unregister selinuxfs. */
6623 exit_sel_fs();
6624
6625 return 0;
6626 }
6627 #endif
Ubuntu Artful kernel mirror