projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[PATCH] drivers/scsi/initio.c: cleanups
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21#include <linux/config.h>
22#include <linux/module.h>
23#include <linux/init.h>
24#include <linux/kernel.h>
25#include <linux/ptrace.h>
26#include <linux/errno.h>
27#include <linux/sched.h>
28#include <linux/security.h>
29#include <linux/xattr.h>
30#include <linux/capability.h>
31#include <linux/unistd.h>
32#include <linux/mm.h>
33#include <linux/mman.h>
34#include <linux/slab.h>
35#include <linux/pagemap.h>
36#include <linux/swap.h>
37#include <linux/smp_lock.h>
38#include <linux/spinlock.h>
39#include <linux/syscalls.h>
40#include <linux/file.h>
41#include <linux/namei.h>
42#include <linux/mount.h>
43#include <linux/ext2_fs.h>
44#include <linux/proc_fs.h>
45#include <linux/kd.h>
46#include <linux/netfilter_ipv4.h>
47#include <linux/netfilter_ipv6.h>
48#include <linux/tty.h>
49#include <net/icmp.h>
50#include <net/ip.h> /* for sysctl_local_port_range[] */
51#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52#include <asm/uaccess.h>
53#include <asm/semaphore.h>
54#include <asm/ioctls.h>
55#include <linux/bitops.h>
56#include <linux/interrupt.h>
57#include <linux/netdevice.h> /* for network interface checks */
58#include <linux/netlink.h>
59#include <linux/tcp.h>
60#include <linux/udp.h>
61#include <linux/quota.h>
62#include <linux/un.h> /* for Unix socket types */
63#include <net/af_unix.h> /* for Unix socket types */
64#include <linux/parser.h>
65#include <linux/nfs_mount.h>
66#include <net/ipv6.h>
67#include <linux/hugetlb.h>
68#include <linux/personality.h>
69#include <linux/sysctl.h>
70#include <linux/audit.h>
71
72#include "avc.h"
73#include "objsec.h"
74#include "netif.h"
75
76#define XATTR_SELINUX_SUFFIX "selinux"
77#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
78
79extern unsigned int policydb_loaded_version;
80extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
81
82#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
83int selinux_enforcing = 0;
84
85static int __init enforcing_setup(char *str)
86{
87 selinux_enforcing = simple_strtol(str,NULL,0);
88 return 1;
89}
90__setup("enforcing=", enforcing_setup);
91#endif
92
93#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
94int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
95
96static int __init selinux_enabled_setup(char *str)
97{
98 selinux_enabled = simple_strtol(str, NULL, 0);
99 return 1;
100}
101__setup("selinux=", selinux_enabled_setup);
102#endif
103
104/* Original (dummy) security module. */
105static struct security_operations *original_ops = NULL;
106
107/* Minimal support for a secondary security module,
108 just to allow the use of the dummy or capability modules.
109 The owlsm module can alternatively be used as a secondary
110 module as long as CONFIG_OWLSM_FD is not enabled. */
111static struct security_operations *secondary_ops = NULL;
112
113/* Lists of inode and superblock security structures initialized
114 before the policy was loaded. */
115static LIST_HEAD(superblock_security_head);
116static DEFINE_SPINLOCK(sb_security_lock);
117
118/* Allocate and free functions for each kind of security blob. */
119
120static int task_alloc_security(struct task_struct *task)
121{
122 struct task_security_struct *tsec;
123
124 tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
125 if (!tsec)
126 return -ENOMEM;
127
128 memset(tsec, 0, sizeof(struct task_security_struct));
129 tsec->magic = SELINUX_MAGIC;
130 tsec->task = task;
131 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
132 task->security = tsec;
133
134 return 0;
135}
136
137static void task_free_security(struct task_struct *task)
138{
139 struct task_security_struct *tsec = task->security;
140
141 if (!tsec || tsec->magic != SELINUX_MAGIC)
142 return;
143
144 task->security = NULL;
145 kfree(tsec);
146}
147
148static int inode_alloc_security(struct inode *inode)
149{
150 struct task_security_struct *tsec = current->security;
151 struct inode_security_struct *isec;
152
153 isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
154 if (!isec)
155 return -ENOMEM;
156
157 memset(isec, 0, sizeof(struct inode_security_struct));
158 init_MUTEX(&isec->sem);
159 INIT_LIST_HEAD(&isec->list);
160 isec->magic = SELINUX_MAGIC;
161 isec->inode = inode;
162 isec->sid = SECINITSID_UNLABELED;
163 isec->sclass = SECCLASS_FILE;
164 if (tsec && tsec->magic == SELINUX_MAGIC)
165 isec->task_sid = tsec->sid;
166 else
167 isec->task_sid = SECINITSID_UNLABELED;
168 inode->i_security = isec;
169
170 return 0;
171}
172
173static void inode_free_security(struct inode *inode)
174{
175 struct inode_security_struct *isec = inode->i_security;
176 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
177
178 if (!isec || isec->magic != SELINUX_MAGIC)
179 return;
180
181 spin_lock(&sbsec->isec_lock);
182 if (!list_empty(&isec->list))
183 list_del_init(&isec->list);
184 spin_unlock(&sbsec->isec_lock);
185
186 inode->i_security = NULL;
187 kfree(isec);
188}
189
190static int file_alloc_security(struct file *file)
191{
192 struct task_security_struct *tsec = current->security;
193 struct file_security_struct *fsec;
194
195 fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
196 if (!fsec)
197 return -ENOMEM;
198
199 memset(fsec, 0, sizeof(struct file_security_struct));
200 fsec->magic = SELINUX_MAGIC;
201 fsec->file = file;
202 if (tsec && tsec->magic == SELINUX_MAGIC) {
203 fsec->sid = tsec->sid;
204 fsec->fown_sid = tsec->sid;
205 } else {
206 fsec->sid = SECINITSID_UNLABELED;
207 fsec->fown_sid = SECINITSID_UNLABELED;
208 }
209 file->f_security = fsec;
210
211 return 0;
212}
213
214static void file_free_security(struct file *file)
215{
216 struct file_security_struct *fsec = file->f_security;
217
218 if (!fsec || fsec->magic != SELINUX_MAGIC)
219 return;
220
221 file->f_security = NULL;
222 kfree(fsec);
223}
224
225static int superblock_alloc_security(struct super_block *sb)
226{
227 struct superblock_security_struct *sbsec;
228
229 sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
230 if (!sbsec)
231 return -ENOMEM;
232
233 memset(sbsec, 0, sizeof(struct superblock_security_struct));
234 init_MUTEX(&sbsec->sem);
235 INIT_LIST_HEAD(&sbsec->list);
236 INIT_LIST_HEAD(&sbsec->isec_head);
237 spin_lock_init(&sbsec->isec_lock);
238 sbsec->magic = SELINUX_MAGIC;
239 sbsec->sb = sb;
240 sbsec->sid = SECINITSID_UNLABELED;
241 sbsec->def_sid = SECINITSID_FILE;
242 sb->s_security = sbsec;
243
244 return 0;
245}
246
247static void superblock_free_security(struct super_block *sb)
248{
249 struct superblock_security_struct *sbsec = sb->s_security;
250
251 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
252 return;
253
254 spin_lock(&sb_security_lock);
255 if (!list_empty(&sbsec->list))
256 list_del_init(&sbsec->list);
257 spin_unlock(&sb_security_lock);
258
259 sb->s_security = NULL;
260 kfree(sbsec);
261}
262
263#ifdef CONFIG_SECURITY_NETWORK
264static int sk_alloc_security(struct sock *sk, int family, int priority)
265{
266 struct sk_security_struct *ssec;
267
268 if (family != PF_UNIX)
269 return 0;
270
271 ssec = kmalloc(sizeof(*ssec), priority);
272 if (!ssec)
273 return -ENOMEM;
274
275 memset(ssec, 0, sizeof(*ssec));
276 ssec->magic = SELINUX_MAGIC;
277 ssec->sk = sk;
278 ssec->peer_sid = SECINITSID_UNLABELED;
279 sk->sk_security = ssec;
280
281 return 0;
282}
283
284static void sk_free_security(struct sock *sk)
285{
286 struct sk_security_struct *ssec = sk->sk_security;
287
288 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
289 return;
290
291 sk->sk_security = NULL;
292 kfree(ssec);
293}
294#endif /* CONFIG_SECURITY_NETWORK */
295
296/* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298extern int ss_initialized;
299
300/* The file system's label must be initialized prior to use. */
301
302static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309};
310
311static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313static inline int inode_doinit(struct inode *inode)
314{
315 return inode_doinit_with_dentry(inode, NULL);
316}
317
318enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
322};
323
324static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
328};
329
330#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
331
332static int try_context_mount(struct super_block *sb, void *data)
333{
334 char *context = NULL, *defcontext = NULL;
335 const char *name;
336 u32 sid;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
340
341 if (!data)
342 goto out;
343
344 name = sb->s_type->name;
345
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
347
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
351
352 if (d->version < NFS_MOUNT_VERSION)
353 goto out;
354
355 if (d->context[0]) {
356 context = d->context;
357 seen |= Opt_context;
358 }
359 } else
360 goto out;
361
362 } else {
363 /* Standard string-based options. */
364 char *p, *options = data;
365
366 while ((p = strsep(&options, ",")) != NULL) {
367 int token;
368 substring_t args[MAX_OPT_ARGS];
369
370 if (!*p)
371 continue;
372
373 token = match_token(p, tokens, args);
374
375 switch (token) {
376 case Opt_context:
377 if (seen) {
378 rc = -EINVAL;
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
380 goto out_free;
381 }
382 context = match_strdup(&args[0]);
383 if (!context) {
384 rc = -ENOMEM;
385 goto out_free;
386 }
387 if (!alloc)
388 alloc = 1;
389 seen |= Opt_context;
390 break;
391
392 case Opt_fscontext:
393 if (seen & (Opt_context|Opt_fscontext)) {
394 rc = -EINVAL;
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
396 goto out_free;
397 }
398 context = match_strdup(&args[0]);
399 if (!context) {
400 rc = -ENOMEM;
401 goto out_free;
402 }
403 if (!alloc)
404 alloc = 1;
405 seen |= Opt_fscontext;
406 break;
407
408 case Opt_defcontext:
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
410 rc = -EINVAL;
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
414 goto out_free;
415 }
416 if (seen & (Opt_context|Opt_defcontext)) {
417 rc = -EINVAL;
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
419 goto out_free;
420 }
421 defcontext = match_strdup(&args[0]);
422 if (!defcontext) {
423 rc = -ENOMEM;
424 goto out_free;
425 }
426 if (!alloc)
427 alloc = 1;
428 seen |= Opt_defcontext;
429 break;
430
431 default:
432 rc = -EINVAL;
433 printk(KERN_WARNING "SELinux: unknown mount "
434 "option\n");
435 goto out_free;
436
437 }
438 }
439 }
440
441 if (!seen)
442 goto out;
443
444 if (context) {
445 rc = security_context_to_sid(context, strlen(context), &sid);
446 if (rc) {
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
450 goto out_free;
451 }
452
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
455 if (rc)
456 goto out_free;
457
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
460 if (rc)
461 goto out_free;
462
463 sbsec->sid = sid;
464
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
467 }
468
469 if (defcontext) {
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
471 if (rc) {
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
475 goto out_free;
476 }
477
478 if (sid == sbsec->def_sid)
479 goto out_free;
480
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
483 if (rc)
484 goto out_free;
485
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
488 if (rc)
489 goto out_free;
490
491 sbsec->def_sid = sid;
492 }
493
494out_free:
495 if (alloc) {
496 kfree(context);
497 kfree(defcontext);
498 }
499out:
500 return rc;
501}
502
503static int superblock_doinit(struct super_block *sb, void *data)
504{
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
508 int rc = 0;
509
510 down(&sbsec->sem);
511 if (sbsec->initialized)
512 goto out;
513
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
522 goto out;
523 }
524
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
527 if (rc) {
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
530 goto out;
531 }
532
533 rc = try_context_mount(sb, data);
534 if (rc)
535 goto out;
536
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
546 rc = -EOPNOTSUPP;
547 goto out;
548 }
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
555 else
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
559 goto out;
560 }
561 }
562
563 if (strcmp(sb->s_type->name, "proc") == 0)
564 sbsec->proc = 1;
565
566 sbsec->initialized = 1;
567
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
571 }
572 else {
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
576 }
577
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
580
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
584 populates itself. */
585 spin_lock(&sbsec->isec_lock);
586next_inode:
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
594 if (inode) {
595 if (!IS_PRIVATE (inode))
596 inode_doinit(inode);
597 iput(inode);
598 }
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
601 goto next_inode;
602 }
603 spin_unlock(&sbsec->isec_lock);
604out:
605 up(&sbsec->sem);
606 return rc;
607}
608
609static inline u16 inode_mode_to_security_class(umode_t mode)
610{
611 switch (mode & S_IFMT) {
612 case S_IFSOCK:
613 return SECCLASS_SOCK_FILE;
614 case S_IFLNK:
615 return SECCLASS_LNK_FILE;
616 case S_IFREG:
617 return SECCLASS_FILE;
618 case S_IFBLK:
619 return SECCLASS_BLK_FILE;
620 case S_IFDIR:
621 return SECCLASS_DIR;
622 case S_IFCHR:
623 return SECCLASS_CHR_FILE;
624 case S_IFIFO:
625 return SECCLASS_FIFO_FILE;
626
627 }
628
629 return SECCLASS_FILE;
630}
631
632static inline u16 socket_type_to_security_class(int family, int type, int protocol)
633{
634 switch (family) {
635 case PF_UNIX:
636 switch (type) {
637 case SOCK_STREAM:
638 case SOCK_SEQPACKET:
639 return SECCLASS_UNIX_STREAM_SOCKET;
640 case SOCK_DGRAM:
641 return SECCLASS_UNIX_DGRAM_SOCKET;
642 }
643 break;
644 case PF_INET:
645 case PF_INET6:
646 switch (type) {
647 case SOCK_STREAM:
648 return SECCLASS_TCP_SOCKET;
649 case SOCK_DGRAM:
650 return SECCLASS_UDP_SOCKET;
651 case SOCK_RAW:
652 return SECCLASS_RAWIP_SOCKET;
653 }
654 break;
655 case PF_NETLINK:
656 switch (protocol) {
657 case NETLINK_ROUTE:
658 return SECCLASS_NETLINK_ROUTE_SOCKET;
659 case NETLINK_FIREWALL:
660 return SECCLASS_NETLINK_FIREWALL_SOCKET;
661 case NETLINK_TCPDIAG:
662 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
663 case NETLINK_NFLOG:
664 return SECCLASS_NETLINK_NFLOG_SOCKET;
665 case NETLINK_XFRM:
666 return SECCLASS_NETLINK_XFRM_SOCKET;
667 case NETLINK_SELINUX:
668 return SECCLASS_NETLINK_SELINUX_SOCKET;
669 case NETLINK_AUDIT:
670 return SECCLASS_NETLINK_AUDIT_SOCKET;
671 case NETLINK_IP6_FW:
672 return SECCLASS_NETLINK_IP6FW_SOCKET;
673 case NETLINK_DNRTMSG:
674 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 675 case NETLINK_KOBJECT_UEVENT:
676 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 677 default:
678 return SECCLASS_NETLINK_SOCKET;
679 }
680 case PF_PACKET:
681 return SECCLASS_PACKET_SOCKET;
682 case PF_KEY:
683 return SECCLASS_KEY_SOCKET;
684 }
685
686 return SECCLASS_SOCKET;
687}
688
689#ifdef CONFIG_PROC_FS
690static int selinux_proc_get_sid(struct proc_dir_entry *de,
691 u16 tclass,
692 u32 *sid)
693{
694 int buflen, rc;
695 char *buffer, *path, *end;
696
697 buffer = (char*)__get_free_page(GFP_KERNEL);
698 if (!buffer)
699 return -ENOMEM;
700
701 buflen = PAGE_SIZE;
702 end = buffer+buflen;
703 *--end = '\0';
704 buflen--;
705 path = end-1;
706 *path = '/';
707 while (de && de != de->parent) {
708 buflen -= de->namelen + 1;
709 if (buflen < 0)
710 break;
711 end -= de->namelen;
712 memcpy(end, de->name, de->namelen);
713 *--end = '/';
714 path = end;
715 de = de->parent;
716 }
717 rc = security_genfs_sid("proc", path, tclass, sid);
718 free_page((unsigned long)buffer);
719 return rc;
720}
721#else
722static int selinux_proc_get_sid(struct proc_dir_entry *de,
723 u16 tclass,
724 u32 *sid)
725{
726 return -EINVAL;
727}
728#endif
729
730/* The inode's security attributes must be initialized before first use. */
731static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
732{
733 struct superblock_security_struct *sbsec = NULL;
734 struct inode_security_struct *isec = inode->i_security;
735 u32 sid;
736 struct dentry *dentry;
737#define INITCONTEXTLEN 255
738 char *context = NULL;
739 unsigned len = 0;
740 int rc = 0;
741 int hold_sem = 0;
742
743 if (isec->initialized)
744 goto out;
745
746 down(&isec->sem);
747 hold_sem = 1;
748 if (isec->initialized)
749 goto out;
750
751 sbsec = inode->i_sb->s_security;
752 if (!sbsec->initialized) {
753 /* Defer initialization until selinux_complete_init,
754 after the initial policy is loaded and the security
755 server is ready to handle calls. */
756 spin_lock(&sbsec->isec_lock);
757 if (list_empty(&isec->list))
758 list_add(&isec->list, &sbsec->isec_head);
759 spin_unlock(&sbsec->isec_lock);
760 goto out;
761 }
762
763 switch (sbsec->behavior) {
764 case SECURITY_FS_USE_XATTR:
765 if (!inode->i_op->getxattr) {
766 isec->sid = sbsec->def_sid;
767 break;
768 }
769
770 /* Need a dentry, since the xattr API requires one.
771 Life would be simpler if we could just pass the inode. */
772 if (opt_dentry) {
773 /* Called from d_instantiate or d_splice_alias. */
774 dentry = dget(opt_dentry);
775 } else {
776 /* Called from selinux_complete_init, try to find a dentry. */
777 dentry = d_find_alias(inode);
778 }
779 if (!dentry) {
780 printk(KERN_WARNING "%s: no dentry for dev=%s "
781 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
782 inode->i_ino);
783 goto out;
784 }
785
786 len = INITCONTEXTLEN;
787 context = kmalloc(len, GFP_KERNEL);
788 if (!context) {
789 rc = -ENOMEM;
790 dput(dentry);
791 goto out;
792 }
793 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
794 context, len);
795 if (rc == -ERANGE) {
796 /* Need a larger buffer. Query for the right size. */
797 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
798 NULL, 0);
799 if (rc < 0) {
800 dput(dentry);
801 goto out;
802 }
803 kfree(context);
804 len = rc;
805 context = kmalloc(len, GFP_KERNEL);
806 if (!context) {
807 rc = -ENOMEM;
808 dput(dentry);
809 goto out;
810 }
811 rc = inode->i_op->getxattr(dentry,
812 XATTR_NAME_SELINUX,
813 context, len);
814 }
815 dput(dentry);
816 if (rc < 0) {
817 if (rc != -ENODATA) {
818 printk(KERN_WARNING "%s: getxattr returned "
819 "%d for dev=%s ino=%ld\n", __FUNCTION__,
820 -rc, inode->i_sb->s_id, inode->i_ino);
821 kfree(context);
822 goto out;
823 }
824 /* Map ENODATA to the default file SID */
825 sid = sbsec->def_sid;
826 rc = 0;
827 } else {
828 rc = security_context_to_sid(context, rc, &sid);
829 if (rc) {
830 printk(KERN_WARNING "%s: context_to_sid(%s) "
831 "returned %d for dev=%s ino=%ld\n",
832 __FUNCTION__, context, -rc,
833 inode->i_sb->s_id, inode->i_ino);
834 kfree(context);
835 /* Leave with the unlabeled SID */
836 rc = 0;
837 break;
838 }
839 }
840 kfree(context);
841 isec->sid = sid;
842 break;
843 case SECURITY_FS_USE_TASK:
844 isec->sid = isec->task_sid;
845 break;
846 case SECURITY_FS_USE_TRANS:
847 /* Default to the fs SID. */
848 isec->sid = sbsec->sid;
849
850 /* Try to obtain a transition SID. */
851 isec->sclass = inode_mode_to_security_class(inode->i_mode);
852 rc = security_transition_sid(isec->task_sid,
853 sbsec->sid,
854 isec->sclass,
855 &sid);
856 if (rc)
857 goto out;
858 isec->sid = sid;
859 break;
860 default:
861 /* Default to the fs SID. */
862 isec->sid = sbsec->sid;
863
864 if (sbsec->proc) {
865 struct proc_inode *proci = PROC_I(inode);
866 if (proci->pde) {
867 isec->sclass = inode_mode_to_security_class(inode->i_mode);
868 rc = selinux_proc_get_sid(proci->pde,
869 isec->sclass,
870 &sid);
871 if (rc)
872 goto out;
873 isec->sid = sid;
874 }
875 }
876 break;
877 }
878
879 isec->initialized = 1;
880
881out:
882 if (isec->sclass == SECCLASS_FILE)
883 isec->sclass = inode_mode_to_security_class(inode->i_mode);
884
885 if (hold_sem)
886 up(&isec->sem);
887 return rc;
888}
889
890/* Convert a Linux signal to an access vector. */
891static inline u32 signal_to_av(int sig)
892{
893 u32 perm = 0;
894
895 switch (sig) {
896 case SIGCHLD:
897 /* Commonly granted from child to parent. */
898 perm = PROCESS__SIGCHLD;
899 break;
900 case SIGKILL:
901 /* Cannot be caught or ignored */
902 perm = PROCESS__SIGKILL;
903 break;
904 case SIGSTOP:
905 /* Cannot be caught or ignored */
906 perm = PROCESS__SIGSTOP;
907 break;
908 default:
909 /* All other signals. */
910 perm = PROCESS__SIGNAL;
911 break;
912 }
913
914 return perm;
915}
916
917/* Check permission betweeen a pair of tasks, e.g. signal checks,
918 fork check, ptrace check, etc. */
919static int task_has_perm(struct task_struct *tsk1,
920 struct task_struct *tsk2,
921 u32 perms)
922{
923 struct task_security_struct *tsec1, *tsec2;
924
925 tsec1 = tsk1->security;
926 tsec2 = tsk2->security;
927 return avc_has_perm(tsec1->sid, tsec2->sid,
928 SECCLASS_PROCESS, perms, NULL);
929}
930
931/* Check whether a task is allowed to use a capability. */
932static int task_has_capability(struct task_struct *tsk,
933 int cap)
934{
935 struct task_security_struct *tsec;
936 struct avc_audit_data ad;
937
938 tsec = tsk->security;
939
940 AVC_AUDIT_DATA_INIT(&ad,CAP);
941 ad.tsk = tsk;
942 ad.u.cap = cap;
943
944 return avc_has_perm(tsec->sid, tsec->sid,
945 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
946}
947
948/* Check whether a task is allowed to use a system operation. */
949static int task_has_system(struct task_struct *tsk,
950 u32 perms)
951{
952 struct task_security_struct *tsec;
953
954 tsec = tsk->security;
955
956 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
957 SECCLASS_SYSTEM, perms, NULL);
958}
959
960/* Check whether a task has a particular permission to an inode.
961 The 'adp' parameter is optional and allows other audit
962 data to be passed (e.g. the dentry). */
963static int inode_has_perm(struct task_struct *tsk,
964 struct inode *inode,
965 u32 perms,
966 struct avc_audit_data *adp)
967{
968 struct task_security_struct *tsec;
969 struct inode_security_struct *isec;
970 struct avc_audit_data ad;
971
972 tsec = tsk->security;
973 isec = inode->i_security;
974
975 if (!adp) {
976 adp = &ad;
977 AVC_AUDIT_DATA_INIT(&ad, FS);
978 ad.u.fs.inode = inode;
979 }
980
981 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
982}
983
984/* Same as inode_has_perm, but pass explicit audit data containing
985 the dentry to help the auditing code to more easily generate the
986 pathname if needed. */
987static inline int dentry_has_perm(struct task_struct *tsk,
988 struct vfsmount *mnt,
989 struct dentry *dentry,
990 u32 av)
991{
992 struct inode *inode = dentry->d_inode;
993 struct avc_audit_data ad;
994 AVC_AUDIT_DATA_INIT(&ad,FS);
995 ad.u.fs.mnt = mnt;
996 ad.u.fs.dentry = dentry;
997 return inode_has_perm(tsk, inode, av, &ad);
998}
999
1000/* Check whether a task can use an open file descriptor to
1001 access an inode in a given way. Check access to the
1002 descriptor itself, and then use dentry_has_perm to
1003 check a particular permission to the file.
1004 Access to the descriptor is implicitly granted if it
1005 has the same SID as the process. If av is zero, then
1006 access to the file is not checked, e.g. for cases
1007 where only the descriptor is affected like seek. */
1008static inline int file_has_perm(struct task_struct *tsk,
1009 struct file *file,
1010 u32 av)
1011{
1012 struct task_security_struct *tsec = tsk->security;
1013 struct file_security_struct *fsec = file->f_security;
1014 struct vfsmount *mnt = file->f_vfsmnt;
1015 struct dentry *dentry = file->f_dentry;
1016 struct inode *inode = dentry->d_inode;
1017 struct avc_audit_data ad;
1018 int rc;
1019
1020 AVC_AUDIT_DATA_INIT(&ad, FS);
1021 ad.u.fs.mnt = mnt;
1022 ad.u.fs.dentry = dentry;
1023
1024 if (tsec->sid != fsec->sid) {
1025 rc = avc_has_perm(tsec->sid, fsec->sid,
1026 SECCLASS_FD,
1027 FD__USE,
1028 &ad);
1029 if (rc)
1030 return rc;
1031 }
1032
1033 /* av is zero if only checking access to the descriptor. */
1034 if (av)
1035 return inode_has_perm(tsk, inode, av, &ad);
1036
1037 return 0;
1038}
1039
1040/* Check whether a task can create a file. */
1041static int may_create(struct inode *dir,
1042 struct dentry *dentry,
1043 u16 tclass)
1044{
1045 struct task_security_struct *tsec;
1046 struct inode_security_struct *dsec;
1047 struct superblock_security_struct *sbsec;
1048 u32 newsid;
1049 struct avc_audit_data ad;
1050 int rc;
1051
1052 tsec = current->security;
1053 dsec = dir->i_security;
1054 sbsec = dir->i_sb->s_security;
1055
1056 AVC_AUDIT_DATA_INIT(&ad, FS);
1057 ad.u.fs.dentry = dentry;
1058
1059 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1060 DIR__ADD_NAME | DIR__SEARCH,
1061 &ad);
1062 if (rc)
1063 return rc;
1064
1065 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1066 newsid = tsec->create_sid;
1067 } else {
1068 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1069 &newsid);
1070 if (rc)
1071 return rc;
1072 }
1073
1074 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1075 if (rc)
1076 return rc;
1077
1078 return avc_has_perm(newsid, sbsec->sid,
1079 SECCLASS_FILESYSTEM,
1080 FILESYSTEM__ASSOCIATE, &ad);
1081}
1082
1083#define MAY_LINK 0
1084#define MAY_UNLINK 1
1085#define MAY_RMDIR 2
1086
1087/* Check whether a task can link, unlink, or rmdir a file/directory. */
1088static int may_link(struct inode *dir,
1089 struct dentry *dentry,
1090 int kind)
1091
1092{
1093 struct task_security_struct *tsec;
1094 struct inode_security_struct *dsec, *isec;
1095 struct avc_audit_data ad;
1096 u32 av;
1097 int rc;
1098
1099 tsec = current->security;
1100 dsec = dir->i_security;
1101 isec = dentry->d_inode->i_security;
1102
1103 AVC_AUDIT_DATA_INIT(&ad, FS);
1104 ad.u.fs.dentry = dentry;
1105
1106 av = DIR__SEARCH;
1107 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1108 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1109 if (rc)
1110 return rc;
1111
1112 switch (kind) {
1113 case MAY_LINK:
1114 av = FILE__LINK;
1115 break;
1116 case MAY_UNLINK:
1117 av = FILE__UNLINK;
1118 break;
1119 case MAY_RMDIR:
1120 av = DIR__RMDIR;
1121 break;
1122 default:
1123 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1124 return 0;
1125 }
1126
1127 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1128 return rc;
1129}
1130
1131static inline int may_rename(struct inode *old_dir,
1132 struct dentry *old_dentry,
1133 struct inode *new_dir,
1134 struct dentry *new_dentry)
1135{
1136 struct task_security_struct *tsec;
1137 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1138 struct avc_audit_data ad;
1139 u32 av;
1140 int old_is_dir, new_is_dir;
1141 int rc;
1142
1143 tsec = current->security;
1144 old_dsec = old_dir->i_security;
1145 old_isec = old_dentry->d_inode->i_security;
1146 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1147 new_dsec = new_dir->i_security;
1148
1149 AVC_AUDIT_DATA_INIT(&ad, FS);
1150
1151 ad.u.fs.dentry = old_dentry;
1152 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1153 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1154 if (rc)
1155 return rc;
1156 rc = avc_has_perm(tsec->sid, old_isec->sid,
1157 old_isec->sclass, FILE__RENAME, &ad);
1158 if (rc)
1159 return rc;
1160 if (old_is_dir && new_dir != old_dir) {
1161 rc = avc_has_perm(tsec->sid, old_isec->sid,
1162 old_isec->sclass, DIR__REPARENT, &ad);
1163 if (rc)
1164 return rc;
1165 }
1166
1167 ad.u.fs.dentry = new_dentry;
1168 av = DIR__ADD_NAME | DIR__SEARCH;
1169 if (new_dentry->d_inode)
1170 av |= DIR__REMOVE_NAME;
1171 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1172 if (rc)
1173 return rc;
1174 if (new_dentry->d_inode) {
1175 new_isec = new_dentry->d_inode->i_security;
1176 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1177 rc = avc_has_perm(tsec->sid, new_isec->sid,
1178 new_isec->sclass,
1179 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1180 if (rc)
1181 return rc;
1182 }
1183
1184 return 0;
1185}
1186
1187/* Check whether a task can perform a filesystem operation. */
1188static int superblock_has_perm(struct task_struct *tsk,
1189 struct super_block *sb,
1190 u32 perms,
1191 struct avc_audit_data *ad)
1192{
1193 struct task_security_struct *tsec;
1194 struct superblock_security_struct *sbsec;
1195
1196 tsec = tsk->security;
1197 sbsec = sb->s_security;
1198 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1199 perms, ad);
1200}
1201
1202/* Convert a Linux mode and permission mask to an access vector. */
1203static inline u32 file_mask_to_av(int mode, int mask)
1204{
1205 u32 av = 0;
1206
1207 if ((mode & S_IFMT) != S_IFDIR) {
1208 if (mask & MAY_EXEC)
1209 av |= FILE__EXECUTE;
1210 if (mask & MAY_READ)
1211 av |= FILE__READ;
1212
1213 if (mask & MAY_APPEND)
1214 av |= FILE__APPEND;
1215 else if (mask & MAY_WRITE)
1216 av |= FILE__WRITE;
1217
1218 } else {
1219 if (mask & MAY_EXEC)
1220 av |= DIR__SEARCH;
1221 if (mask & MAY_WRITE)
1222 av |= DIR__WRITE;
1223 if (mask & MAY_READ)
1224 av |= DIR__READ;
1225 }
1226
1227 return av;
1228}
1229
1230/* Convert a Linux file to an access vector. */
1231static inline u32 file_to_av(struct file *file)
1232{
1233 u32 av = 0;
1234
1235 if (file->f_mode & FMODE_READ)
1236 av |= FILE__READ;
1237 if (file->f_mode & FMODE_WRITE) {
1238 if (file->f_flags & O_APPEND)
1239 av |= FILE__APPEND;
1240 else
1241 av |= FILE__WRITE;
1242 }
1243
1244 return av;
1245}
1246
1247/* Set an inode's SID to a specified value. */
1248static int inode_security_set_sid(struct inode *inode, u32 sid)
1249{
1250 struct inode_security_struct *isec = inode->i_security;
1251 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1252
1253 if (!sbsec->initialized) {
1254 /* Defer initialization to selinux_complete_init. */
1255 return 0;
1256 }
1257
1258 down(&isec->sem);
1259 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1260 isec->sid = sid;
1261 isec->initialized = 1;
1262 up(&isec->sem);
1263 return 0;
1264}
1265
1266/* Set the security attributes on a newly created file. */
1267static int post_create(struct inode *dir,
1268 struct dentry *dentry)
1269{
1270
1271 struct task_security_struct *tsec;
1272 struct inode *inode;
1273 struct inode_security_struct *dsec;
1274 struct superblock_security_struct *sbsec;
1275 u32 newsid;
1276 char *context;
1277 unsigned int len;
1278 int rc;
1279
1280 tsec = current->security;
1281 dsec = dir->i_security;
1282 sbsec = dir->i_sb->s_security;
1283
1284 inode = dentry->d_inode;
1285 if (!inode) {
1286 /* Some file system types (e.g. NFS) may not instantiate
1287 a dentry for all create operations (e.g. symlink),
1288 so we have to check to see if the inode is non-NULL. */
1289 printk(KERN_WARNING "post_create: no inode, dir (dev=%s, "
1290 "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1291 return 0;
1292 }
1293
1294 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1295 newsid = tsec->create_sid;
1296 } else {
1297 rc = security_transition_sid(tsec->sid, dsec->sid,
1298 inode_mode_to_security_class(inode->i_mode),
1299 &newsid);
1300 if (rc) {
1301 printk(KERN_WARNING "post_create: "
1302 "security_transition_sid failed, rc=%d (dev=%s "
1303 "ino=%ld)\n",
1304 -rc, inode->i_sb->s_id, inode->i_ino);
1305 return rc;
1306 }
1307 }
1308
1309 rc = inode_security_set_sid(inode, newsid);
1310 if (rc) {
1311 printk(KERN_WARNING "post_create: inode_security_set_sid "
1312 "failed, rc=%d (dev=%s ino=%ld)\n",
1313 -rc, inode->i_sb->s_id, inode->i_ino);
1314 return rc;
1315 }
1316
1317 if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1318 inode->i_op->setxattr) {
1319 /* Use extended attributes. */
1320 rc = security_sid_to_context(newsid, &context, &len);
1321 if (rc) {
1322 printk(KERN_WARNING "post_create: sid_to_context "
1323 "failed, rc=%d (dev=%s ino=%ld)\n",
1324 -rc, inode->i_sb->s_id, inode->i_ino);
1325 return rc;
1326 }
1327 down(&inode->i_sem);
1328 rc = inode->i_op->setxattr(dentry,
1329 XATTR_NAME_SELINUX,
1330 context, len, 0);
1331 up(&inode->i_sem);
1332 kfree(context);
1333 if (rc < 0) {
1334 printk(KERN_WARNING "post_create: setxattr failed, "
1335 "rc=%d (dev=%s ino=%ld)\n",
1336 -rc, inode->i_sb->s_id, inode->i_ino);
1337 return rc;
1338 }
1339 }
1340
1341 return 0;
1342}
1343
1344
1345/* Hook functions begin here. */
1346
1347static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1348{
1349 struct task_security_struct *psec = parent->security;
1350 struct task_security_struct *csec = child->security;
1351 int rc;
1352
1353 rc = secondary_ops->ptrace(parent,child);
1354 if (rc)
1355 return rc;
1356
1357 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1358 /* Save the SID of the tracing process for later use in apply_creds. */
1359 if (!rc)
1360 csec->ptrace_sid = psec->sid;
1361 return rc;
1362}
1363
1364static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1365 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1366{
1367 int error;
1368
1369 error = task_has_perm(current, target, PROCESS__GETCAP);
1370 if (error)
1371 return error;
1372
1373 return secondary_ops->capget(target, effective, inheritable, permitted);
1374}
1375
1376static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1377 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1378{
1379 int error;
1380
1381 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1382 if (error)
1383 return error;
1384
1385 return task_has_perm(current, target, PROCESS__SETCAP);
1386}
1387
1388static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1389 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390{
1391 secondary_ops->capset_set(target, effective, inheritable, permitted);
1392}
1393
1394static int selinux_capable(struct task_struct *tsk, int cap)
1395{
1396 int rc;
1397
1398 rc = secondary_ops->capable(tsk, cap);
1399 if (rc)
1400 return rc;
1401
1402 return task_has_capability(tsk,cap);
1403}
1404
1405static int selinux_sysctl(ctl_table *table, int op)
1406{
1407 int error = 0;
1408 u32 av;
1409 struct task_security_struct *tsec;
1410 u32 tsid;
1411 int rc;
1412
1413 rc = secondary_ops->sysctl(table, op);
1414 if (rc)
1415 return rc;
1416
1417 tsec = current->security;
1418
1419 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1420 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1421 if (rc) {
1422 /* Default to the well-defined sysctl SID. */
1423 tsid = SECINITSID_SYSCTL;
1424 }
1425
1426 /* The op values are "defined" in sysctl.c, thereby creating
1427 * a bad coupling between this module and sysctl.c */
1428 if(op == 001) {
1429 error = avc_has_perm(tsec->sid, tsid,
1430 SECCLASS_DIR, DIR__SEARCH, NULL);
1431 } else {
1432 av = 0;
1433 if (op & 004)
1434 av |= FILE__READ;
1435 if (op & 002)
1436 av |= FILE__WRITE;
1437 if (av)
1438 error = avc_has_perm(tsec->sid, tsid,
1439 SECCLASS_FILE, av, NULL);
1440 }
1441
1442 return error;
1443}
1444
1445static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1446{
1447 int rc = 0;
1448
1449 if (!sb)
1450 return 0;
1451
1452 switch (cmds) {
1453 case Q_SYNC:
1454 case Q_QUOTAON:
1455 case Q_QUOTAOFF:
1456 case Q_SETINFO:
1457 case Q_SETQUOTA:
1458 rc = superblock_has_perm(current,
1459 sb,
1460 FILESYSTEM__QUOTAMOD, NULL);
1461 break;
1462 case Q_GETFMT:
1463 case Q_GETINFO:
1464 case Q_GETQUOTA:
1465 rc = superblock_has_perm(current,
1466 sb,
1467 FILESYSTEM__QUOTAGET, NULL);
1468 break;
1469 default:
1470 rc = 0; /* let the kernel handle invalid cmds */
1471 break;
1472 }
1473 return rc;
1474}
1475
1476static int selinux_quota_on(struct dentry *dentry)
1477{
1478 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1479}
1480
1481static int selinux_syslog(int type)
1482{
1483 int rc;
1484
1485 rc = secondary_ops->syslog(type);
1486 if (rc)
1487 return rc;
1488
1489 switch (type) {
1490 case 3: /* Read last kernel messages */
1491 case 10: /* Return size of the log buffer */
1492 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1493 break;
1494 case 6: /* Disable logging to console */
1495 case 7: /* Enable logging to console */
1496 case 8: /* Set level of messages printed to console */
1497 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1498 break;
1499 case 0: /* Close log */
1500 case 1: /* Open log */
1501 case 2: /* Read from log */
1502 case 4: /* Read/clear last kernel messages */
1503 case 5: /* Clear ring buffer */
1504 default:
1505 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1506 break;
1507 }
1508 return rc;
1509}
1510
1511/*
1512 * Check that a process has enough memory to allocate a new virtual
1513 * mapping. 0 means there is enough memory for the allocation to
1514 * succeed and -ENOMEM implies there is not.
1515 *
1516 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1517 * if the capability is granted, but __vm_enough_memory requires 1 if
1518 * the capability is granted.
1519 *
1520 * Do not audit the selinux permission check, as this is applied to all
1521 * processes that allocate mappings.
1522 */
1523static int selinux_vm_enough_memory(long pages)
1524{
1525 int rc, cap_sys_admin = 0;
1526 struct task_security_struct *tsec = current->security;
1527
1528 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1529 if (rc == 0)
1530 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1531 SECCLASS_CAPABILITY,
1532 CAP_TO_MASK(CAP_SYS_ADMIN),
1533 NULL);
1534
1535 if (rc == 0)
1536 cap_sys_admin = 1;
1537
1538 return __vm_enough_memory(pages, cap_sys_admin);
1539}
1540
1541/* binprm security operations */
1542
1543static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1544{
1545 struct bprm_security_struct *bsec;
1546
1547 bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1548 if (!bsec)
1549 return -ENOMEM;
1550
1551 memset(bsec, 0, sizeof *bsec);
1552 bsec->magic = SELINUX_MAGIC;
1553 bsec->bprm = bprm;
1554 bsec->sid = SECINITSID_UNLABELED;
1555 bsec->set = 0;
1556
1557 bprm->security = bsec;
1558 return 0;
1559}
1560
1561static int selinux_bprm_set_security(struct linux_binprm *bprm)
1562{
1563 struct task_security_struct *tsec;
1564 struct inode *inode = bprm->file->f_dentry->d_inode;
1565 struct inode_security_struct *isec;
1566 struct bprm_security_struct *bsec;
1567 u32 newsid;
1568 struct avc_audit_data ad;
1569 int rc;
1570
1571 rc = secondary_ops->bprm_set_security(bprm);
1572 if (rc)
1573 return rc;
1574
1575 bsec = bprm->security;
1576
1577 if (bsec->set)
1578 return 0;
1579
1580 tsec = current->security;
1581 isec = inode->i_security;
1582
1583 /* Default to the current task SID. */
1584 bsec->sid = tsec->sid;
1585
1586 /* Reset create SID on execve. */
1587 tsec->create_sid = 0;
1588
1589 if (tsec->exec_sid) {
1590 newsid = tsec->exec_sid;
1591 /* Reset exec SID on execve. */
1592 tsec->exec_sid = 0;
1593 } else {
1594 /* Check for a default transition on this program. */
1595 rc = security_transition_sid(tsec->sid, isec->sid,
1596 SECCLASS_PROCESS, &newsid);
1597 if (rc)
1598 return rc;
1599 }
1600
1601 AVC_AUDIT_DATA_INIT(&ad, FS);
1602 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1603 ad.u.fs.dentry = bprm->file->f_dentry;
1604
1605 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1606 newsid = tsec->sid;
1607
1608 if (tsec->sid == newsid) {
1609 rc = avc_has_perm(tsec->sid, isec->sid,
1610 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1611 if (rc)
1612 return rc;
1613 } else {
1614 /* Check permissions for the transition. */
1615 rc = avc_has_perm(tsec->sid, newsid,
1616 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1617 if (rc)
1618 return rc;
1619
1620 rc = avc_has_perm(newsid, isec->sid,
1621 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1622 if (rc)
1623 return rc;
1624
1625 /* Clear any possibly unsafe personality bits on exec: */
1626 current->personality &= ~PER_CLEAR_ON_SETID;
1627
1628 /* Set the security field to the new SID. */
1629 bsec->sid = newsid;
1630 }
1631
1632 bsec->set = 1;
1633 return 0;
1634}
1635
1636static int selinux_bprm_check_security (struct linux_binprm *bprm)
1637{
1638 return secondary_ops->bprm_check_security(bprm);
1639}
1640
1641
1642static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1643{
1644 struct task_security_struct *tsec = current->security;
1645 int atsecure = 0;
1646
1647 if (tsec->osid != tsec->sid) {
1648 /* Enable secure mode for SIDs transitions unless
1649 the noatsecure permission is granted between
1650 the two SIDs, i.e. ahp returns 0. */
1651 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1652 SECCLASS_PROCESS,
1653 PROCESS__NOATSECURE, NULL);
1654 }
1655
1656 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1657}
1658
1659static void selinux_bprm_free_security(struct linux_binprm *bprm)
1660{
1661 struct bprm_security_struct *bsec = bprm->security;
1662 bprm->security = NULL;
1663 kfree(bsec);
1664}
1665
1666extern struct vfsmount *selinuxfs_mount;
1667extern struct dentry *selinux_null;
1668
1669/* Derived from fs/exec.c:flush_old_files. */
1670static inline void flush_unauthorized_files(struct files_struct * files)
1671{
1672 struct avc_audit_data ad;
1673 struct file *file, *devnull = NULL;
1674 struct tty_struct *tty = current->signal->tty;
1675 long j = -1;
1676
1677 if (tty) {
1678 file_list_lock();
1679 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1680 if (file) {
1681 /* Revalidate access to controlling tty.
1682 Use inode_has_perm on the tty inode directly rather
1683 than using file_has_perm, as this particular open
1684 file may belong to another process and we are only
1685 interested in the inode-based check here. */
1686 struct inode *inode = file->f_dentry->d_inode;
1687 if (inode_has_perm(current, inode,
1688 FILE__READ | FILE__WRITE, NULL)) {
1689 /* Reset controlling tty. */
1690 current->signal->tty = NULL;
1691 current->signal->tty_old_pgrp = 0;
1692 }
1693 }
1694 file_list_unlock();
1695 }
1696
1697 /* Revalidate access to inherited open files. */
1698
1699 AVC_AUDIT_DATA_INIT(&ad,FS);
1700
1701 spin_lock(&files->file_lock);
1702 for (;;) {
1703 unsigned long set, i;
1704 int fd;
1705
1706 j++;
1707 i = j * __NFDBITS;
1708 if (i >= files->max_fds || i >= files->max_fdset)
1709 break;
1710 set = files->open_fds->fds_bits[j];
1711 if (!set)
1712 continue;
1713 spin_unlock(&files->file_lock);
1714 for ( ; set ; i++,set >>= 1) {
1715 if (set & 1) {
1716 file = fget(i);
1717 if (!file)
1718 continue;
1719 if (file_has_perm(current,
1720 file,
1721 file_to_av(file))) {
1722 sys_close(i);
1723 fd = get_unused_fd();
1724 if (fd != i) {
1725 if (fd >= 0)
1726 put_unused_fd(fd);
1727 fput(file);
1728 continue;
1729 }
1730 if (devnull) {
1731 atomic_inc(&devnull->f_count);
1732 } else {
1733 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1734 if (!devnull) {
1735 put_unused_fd(fd);
1736 fput(file);
1737 continue;
1738 }
1739 }
1740 fd_install(fd, devnull);
1741 }
1742 fput(file);
1743 }
1744 }
1745 spin_lock(&files->file_lock);
1746
1747 }
1748 spin_unlock(&files->file_lock);
1749}
1750
1751static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1752{
1753 struct task_security_struct *tsec;
1754 struct bprm_security_struct *bsec;
1755 u32 sid;
1756 int rc;
1757
1758 secondary_ops->bprm_apply_creds(bprm, unsafe);
1759
1760 tsec = current->security;
1761
1762 bsec = bprm->security;
1763 sid = bsec->sid;
1764
1765 tsec->osid = tsec->sid;
1766 bsec->unsafe = 0;
1767 if (tsec->sid != sid) {
1768 /* Check for shared state. If not ok, leave SID
1769 unchanged and kill. */
1770 if (unsafe & LSM_UNSAFE_SHARE) {
1771 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1772 PROCESS__SHARE, NULL);
1773 if (rc) {
1774 bsec->unsafe = 1;
1775 return;
1776 }
1777 }
1778
1779 /* Check for ptracing, and update the task SID if ok.
1780 Otherwise, leave SID unchanged and kill. */
1781 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1782 rc = avc_has_perm(tsec->ptrace_sid, sid,
1783 SECCLASS_PROCESS, PROCESS__PTRACE,
1784 NULL);
1785 if (rc) {
1786 bsec->unsafe = 1;
1787 return;
1788 }
1789 }
1790 tsec->sid = sid;
1791 }
1792}
1793
1794/*
1795 * called after apply_creds without the task lock held
1796 */
1797static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1798{
1799 struct task_security_struct *tsec;
1800 struct rlimit *rlim, *initrlim;
1801 struct itimerval itimer;
1802 struct bprm_security_struct *bsec;
1803 int rc, i;
1804
1805 tsec = current->security;
1806 bsec = bprm->security;
1807
1808 if (bsec->unsafe) {
1809 force_sig_specific(SIGKILL, current);
1810 return;
1811 }
1812 if (tsec->osid == tsec->sid)
1813 return;
1814
1815 /* Close files for which the new task SID is not authorized. */
1816 flush_unauthorized_files(current->files);
1817
1818 /* Check whether the new SID can inherit signal state
1819 from the old SID. If not, clear itimers to avoid
1820 subsequent signal generation and flush and unblock
1821 signals. This must occur _after_ the task SID has
1822 been updated so that any kill done after the flush
1823 will be checked against the new SID. */
1824 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1825 PROCESS__SIGINH, NULL);
1826 if (rc) {
1827 memset(&itimer, 0, sizeof itimer);
1828 for (i = 0; i < 3; i++)
1829 do_setitimer(i, &itimer, NULL);
1830 flush_signals(current);
1831 spin_lock_irq(&current->sighand->siglock);
1832 flush_signal_handlers(current, 1);
1833 sigemptyset(&current->blocked);
1834 recalc_sigpending();
1835 spin_unlock_irq(&current->sighand->siglock);
1836 }
1837
1838 /* Check whether the new SID can inherit resource limits
1839 from the old SID. If not, reset all soft limits to
1840 the lower of the current task's hard limit and the init
1841 task's soft limit. Note that the setting of hard limits
1842 (even to lower them) can be controlled by the setrlimit
1843 check. The inclusion of the init task's soft limit into
1844 the computation is to avoid resetting soft limits higher
1845 than the default soft limit for cases where the default
1846 is lower than the hard limit, e.g. RLIMIT_CORE or
1847 RLIMIT_STACK.*/
1848 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1849 PROCESS__RLIMITINH, NULL);
1850 if (rc) {
1851 for (i = 0; i < RLIM_NLIMITS; i++) {
1852 rlim = current->signal->rlim + i;
1853 initrlim = init_task.signal->rlim+i;
1854 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1855 }
1856 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1857 /*
1858 * This will cause RLIMIT_CPU calculations
1859 * to be refigured.
1860 */
1861 current->it_prof_expires = jiffies_to_cputime(1);
1862 }
1863 }
1864
1865 /* Wake up the parent if it is waiting so that it can
1866 recheck wait permission to the new task SID. */
1867 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1868}
1869
1870/* superblock security operations */
1871
1872static int selinux_sb_alloc_security(struct super_block *sb)
1873{
1874 return superblock_alloc_security(sb);
1875}
1876
1877static void selinux_sb_free_security(struct super_block *sb)
1878{
1879 superblock_free_security(sb);
1880}
1881
1882static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1883{
1884 if (plen > olen)
1885 return 0;
1886
1887 return !memcmp(prefix, option, plen);
1888}
1889
1890static inline int selinux_option(char *option, int len)
1891{
1892 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1893 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1894 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1895}
1896
1897static inline void take_option(char **to, char *from, int *first, int len)
1898{
1899 if (!*first) {
1900 **to = ',';
1901 *to += 1;
1902 }
1903 else
1904 *first = 0;
1905 memcpy(*to, from, len);
1906 *to += len;
1907}
1908
1909static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1910{
1911 int fnosec, fsec, rc = 0;
1912 char *in_save, *in_curr, *in_end;
1913 char *sec_curr, *nosec_save, *nosec;
1914
1915 in_curr = orig;
1916 sec_curr = copy;
1917
1918 /* Binary mount data: just copy */
1919 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1920 copy_page(sec_curr, in_curr);
1921 goto out;
1922 }
1923
1924 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1925 if (!nosec) {
1926 rc = -ENOMEM;
1927 goto out;
1928 }
1929
1930 nosec_save = nosec;
1931 fnosec = fsec = 1;
1932 in_save = in_end = orig;
1933
1934 do {
1935 if (*in_end == ',' || *in_end == '\0') {
1936 int len = in_end - in_curr;
1937
1938 if (selinux_option(in_curr, len))
1939 take_option(&sec_curr, in_curr, &fsec, len);
1940 else
1941 take_option(&nosec, in_curr, &fnosec, len);
1942
1943 in_curr = in_end + 1;
1944 }
1945 } while (*in_end++);
1946
1947 copy_page(in_save, nosec_save);
da3caa20 1948 free_page((unsigned long)nosec_save);
1da177e4
LT		 1949out:
1950 return rc;
1951}
1952
1953static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1954{
1955 struct avc_audit_data ad;
1956 int rc;
1957
1958 rc = superblock_doinit(sb, data);
1959 if (rc)
1960 return rc;
1961
1962 AVC_AUDIT_DATA_INIT(&ad,FS);
1963 ad.u.fs.dentry = sb->s_root;
1964 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1965}
1966
1967static int selinux_sb_statfs(struct super_block *sb)
1968{
1969 struct avc_audit_data ad;
1970
1971 AVC_AUDIT_DATA_INIT(&ad,FS);
1972 ad.u.fs.dentry = sb->s_root;
1973 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1974}
1975
1976static int selinux_mount(char * dev_name,
1977 struct nameidata *nd,
1978 char * type,
1979 unsigned long flags,
1980 void * data)
1981{
1982 int rc;
1983
1984 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1985 if (rc)
1986 return rc;
1987
1988 if (flags & MS_REMOUNT)
1989 return superblock_has_perm(current, nd->mnt->mnt_sb,
1990 FILESYSTEM__REMOUNT, NULL);
1991 else
1992 return dentry_has_perm(current, nd->mnt, nd->dentry,
1993 FILE__MOUNTON);
1994}
1995
1996static int selinux_umount(struct vfsmount *mnt, int flags)
1997{
1998 int rc;
1999
2000 rc = secondary_ops->sb_umount(mnt, flags);
2001 if (rc)
2002 return rc;
2003
2004 return superblock_has_perm(current,mnt->mnt_sb,
2005 FILESYSTEM__UNMOUNT,NULL);
2006}
2007
2008/* inode security operations */
2009
2010static int selinux_inode_alloc_security(struct inode *inode)
2011{
2012 return inode_alloc_security(inode);
2013}
2014
2015static void selinux_inode_free_security(struct inode *inode)
2016{
2017 inode_free_security(inode);
2018}
2019
2020static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2021{
2022 return may_create(dir, dentry, SECCLASS_FILE);
2023}
2024
2025static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2026{
2027 post_create(dir, dentry);
2028}
2029
2030static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2031{
2032 int rc;
2033
2034 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2035 if (rc)
2036 return rc;
2037 return may_link(dir, old_dentry, MAY_LINK);
2038}
2039
2040static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2041{
2042 return;
2043}
2044
2045static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2046{
2047 int rc;
2048
2049 rc = secondary_ops->inode_unlink(dir, dentry);
2050 if (rc)
2051 return rc;
2052 return may_link(dir, dentry, MAY_UNLINK);
2053}
2054
2055static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2056{
2057 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2058}
2059
2060static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2061{
2062 post_create(dir, dentry);
2063}
2064
2065static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2066{
2067 return may_create(dir, dentry, SECCLASS_DIR);
2068}
2069
2070static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2071{
2072 post_create(dir, dentry);
2073}
2074
2075static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2076{
2077 return may_link(dir, dentry, MAY_RMDIR);
2078}
2079
2080static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2081{
2082 int rc;
2083
2084 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2085 if (rc)
2086 return rc;
2087
2088 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2089}
2090
2091static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2092{
2093 post_create(dir, dentry);
2094}
2095
2096static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2097 struct inode *new_inode, struct dentry *new_dentry)
2098{
2099 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2100}
2101
2102static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2103 struct inode *new_inode, struct dentry *new_dentry)
2104{
2105 return;
2106}
2107
2108static int selinux_inode_readlink(struct dentry *dentry)
2109{
2110 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2111}
2112
2113static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2114{
2115 int rc;
2116
2117 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2118 if (rc)
2119 return rc;
2120 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2121}
2122
2123static int selinux_inode_permission(struct inode *inode, int mask,
2124 struct nameidata *nd)
2125{
2126 int rc;
2127
2128 rc = secondary_ops->inode_permission(inode, mask, nd);
2129 if (rc)
2130 return rc;
2131
2132 if (!mask) {
2133 /* No permission to check. Existence test. */
2134 return 0;
2135 }
2136
2137 return inode_has_perm(current, inode,
2138 file_mask_to_av(inode->i_mode, mask), NULL);
2139}
2140
2141static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2142{
2143 int rc;
2144
2145 rc = secondary_ops->inode_setattr(dentry, iattr);
2146 if (rc)
2147 return rc;
2148
2149 if (iattr->ia_valid & ATTR_FORCE)
2150 return 0;
2151
2152 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2153 ATTR_ATIME_SET | ATTR_MTIME_SET))
2154 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2155
2156 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2157}
2158
2159static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2160{
2161 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2162}
2163
2164static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2165{
2166 struct task_security_struct *tsec = current->security;
2167 struct inode *inode = dentry->d_inode;
2168 struct inode_security_struct *isec = inode->i_security;
2169 struct superblock_security_struct *sbsec;
2170 struct avc_audit_data ad;
2171 u32 newsid;
2172 int rc = 0;
2173
2174 if (strcmp(name, XATTR_NAME_SELINUX)) {
2175 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2176 sizeof XATTR_SECURITY_PREFIX - 1) &&
2177 !capable(CAP_SYS_ADMIN)) {
2178 /* A different attribute in the security namespace.
2179 Restrict to administrator. */
2180 return -EPERM;
2181 }
2182
2183 /* Not an attribute we recognize, so just check the
2184 ordinary setattr permission. */
2185 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2186 }
2187
2188 sbsec = inode->i_sb->s_security;
2189 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2190 return -EOPNOTSUPP;
2191
2192 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2193 return -EPERM;
2194
2195 AVC_AUDIT_DATA_INIT(&ad,FS);
2196 ad.u.fs.dentry = dentry;
2197
2198 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2199 FILE__RELABELFROM, &ad);
2200 if (rc)
2201 return rc;
2202
2203 rc = security_context_to_sid(value, size, &newsid);
2204 if (rc)
2205 return rc;
2206
2207 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2208 FILE__RELABELTO, &ad);
2209 if (rc)
2210 return rc;
2211
2212 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2213 isec->sclass);
2214 if (rc)
2215 return rc;
2216
2217 return avc_has_perm(newsid,
2218 sbsec->sid,
2219 SECCLASS_FILESYSTEM,
2220 FILESYSTEM__ASSOCIATE,
2221 &ad);
2222}
2223
2224static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2225 void *value, size_t size, int flags)
2226{
2227 struct inode *inode = dentry->d_inode;
2228 struct inode_security_struct *isec = inode->i_security;
2229 u32 newsid;
2230 int rc;
2231
2232 if (strcmp(name, XATTR_NAME_SELINUX)) {
2233 /* Not an attribute we recognize, so nothing to do. */
2234 return;
2235 }
2236
2237 rc = security_context_to_sid(value, size, &newsid);
2238 if (rc) {
2239 printk(KERN_WARNING "%s: unable to obtain SID for context "
2240 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2241 return;
2242 }
2243
2244 isec->sid = newsid;
2245 return;
2246}
2247
2248static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2249{
2250 struct inode *inode = dentry->d_inode;
2251 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2252
2253 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2254 return -EOPNOTSUPP;
2255
2256 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2257}
2258
2259static int selinux_inode_listxattr (struct dentry *dentry)
2260{
2261 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2262}
2263
2264static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2265{
2266 if (strcmp(name, XATTR_NAME_SELINUX)) {
2267 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2268 sizeof XATTR_SECURITY_PREFIX - 1) &&
2269 !capable(CAP_SYS_ADMIN)) {
2270 /* A different attribute in the security namespace.
2271 Restrict to administrator. */
2272 return -EPERM;
2273 }
2274
2275 /* Not an attribute we recognize, so just check the
2276 ordinary setattr permission. Might want a separate
2277 permission for removexattr. */
2278 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2279 }
2280
2281 /* No one is allowed to remove a SELinux security label.
2282 You can change the label, but all data must be labeled. */
2283 return -EACCES;
2284}
2285
2286static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2287{
2288 struct inode_security_struct *isec = inode->i_security;
2289 char *context;
2290 unsigned len;
2291 int rc;
2292
2293 /* Permission check handled by selinux_inode_getxattr hook.*/
2294
2295 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2296 return -EOPNOTSUPP;
2297
2298 rc = security_sid_to_context(isec->sid, &context, &len);
2299 if (rc)
2300 return rc;
2301
2302 if (!buffer || !size) {
2303 kfree(context);
2304 return len;
2305 }
2306 if (size < len) {
2307 kfree(context);
2308 return -ERANGE;
2309 }
2310 memcpy(buffer, context, len);
2311 kfree(context);
2312 return len;
2313}
2314
2315static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2316 const void *value, size_t size, int flags)
2317{
2318 struct inode_security_struct *isec = inode->i_security;
2319 u32 newsid;
2320 int rc;
2321
2322 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2323 return -EOPNOTSUPP;
2324
2325 if (!value || !size)
2326 return -EACCES;
2327
2328 rc = security_context_to_sid((void*)value, size, &newsid);
2329 if (rc)
2330 return rc;
2331
2332 isec->sid = newsid;
2333 return 0;
2334}
2335
2336static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2337{
2338 const int len = sizeof(XATTR_NAME_SELINUX);
2339 if (buffer && len <= buffer_size)
2340 memcpy(buffer, XATTR_NAME_SELINUX, len);
2341 return len;
2342}
2343
2344/* file security operations */
2345
2346static int selinux_file_permission(struct file *file, int mask)
2347{
2348 struct inode *inode = file->f_dentry->d_inode;
2349
2350 if (!mask) {
2351 /* No permission to check. Existence test. */
2352 return 0;
2353 }
2354
2355 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2356 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2357 mask |= MAY_APPEND;
2358
2359 return file_has_perm(current, file,
2360 file_mask_to_av(inode->i_mode, mask));
2361}
2362
2363static int selinux_file_alloc_security(struct file *file)
2364{
2365 return file_alloc_security(file);
2366}
2367
2368static void selinux_file_free_security(struct file *file)
2369{
2370 file_free_security(file);
2371}
2372
2373static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2374 unsigned long arg)
2375{
2376 int error = 0;
2377
2378 switch (cmd) {
2379 case FIONREAD:
2380 /* fall through */
2381 case FIBMAP:
2382 /* fall through */
2383 case FIGETBSZ:
2384 /* fall through */
2385 case EXT2_IOC_GETFLAGS:
2386 /* fall through */
2387 case EXT2_IOC_GETVERSION:
2388 error = file_has_perm(current, file, FILE__GETATTR);
2389 break;
2390
2391 case EXT2_IOC_SETFLAGS:
2392 /* fall through */
2393 case EXT2_IOC_SETVERSION:
2394 error = file_has_perm(current, file, FILE__SETATTR);
2395 break;
2396
2397 /* sys_ioctl() checks */
2398 case FIONBIO:
2399 /* fall through */
2400 case FIOASYNC:
2401 error = file_has_perm(current, file, 0);
2402 break;
2403
2404 case KDSKBENT:
2405 case KDSKBSENT:
2406 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2407 break;
2408
2409 /* default case assumes that the command will go
2410 * to the file's ioctl() function.
2411 */
2412 default:
2413 error = file_has_perm(current, file, FILE__IOCTL);
2414
2415 }
2416 return error;
2417}
2418
2419static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2420{
2421#ifndef CONFIG_PPC32
2422 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2423 /*
2424 * We are making executable an anonymous mapping or a
2425 * private file mapping that will also be writable.
2426 * This has an additional check.
2427 */
2428 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2429 if (rc)
2430 return rc;
2431 }
2432#endif
2433
2434 if (file) {
2435 /* read access is always possible with a mapping */
2436 u32 av = FILE__READ;
2437
2438 /* write access only matters if the mapping is shared */
2439 if (shared && (prot & PROT_WRITE))
2440 av |= FILE__WRITE;
2441
2442 if (prot & PROT_EXEC)
2443 av |= FILE__EXECUTE;
2444
2445 return file_has_perm(current, file, av);
2446 }
2447 return 0;
2448}
2449
2450static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2451 unsigned long prot, unsigned long flags)
2452{
2453 int rc;
2454
2455 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2456 if (rc)
2457 return rc;
2458
2459 if (selinux_checkreqprot)
2460 prot = reqprot;
2461
2462 return file_map_prot_check(file, prot,
2463 (flags & MAP_TYPE) == MAP_SHARED);
2464}
2465
2466static int selinux_file_mprotect(struct vm_area_struct *vma,
2467 unsigned long reqprot,
2468 unsigned long prot)
2469{
2470 int rc;
2471
2472 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2473 if (rc)
2474 return rc;
2475
2476 if (selinux_checkreqprot)
2477 prot = reqprot;
2478
2479#ifndef CONFIG_PPC32