projects / GitHub / exynos8895 / android_kernel_samsung_universal8895.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge commit 'v3.14' into next
[GitHub/exynos8895/android_kernel_samsung_universal8895.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
74 #include <net/ipv6.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 extern struct security_operations *security_ops;
99
100 /* SECMARK reference count */
101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
102
103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
104 int selinux_enforcing;
105
106 static int __init enforcing_setup(char *str)
107 {
108 unsigned long enforcing;
109 if (!kstrtoul(str, 0, &enforcing))
110 selinux_enforcing = enforcing ? 1 : 0;
111 return 1;
112 }
113 __setup("enforcing=", enforcing_setup);
114 #endif
115
116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
118
119 static int __init selinux_enabled_setup(char *str)
120 {
121 unsigned long enabled;
122 if (!kstrtoul(str, 0, &enabled))
123 selinux_enabled = enabled ? 1 : 0;
124 return 1;
125 }
126 __setup("selinux=", selinux_enabled_setup);
127 #else
128 int selinux_enabled = 1;
129 #endif
130
131 static struct kmem_cache *sel_inode_cache;
132
133 /**
134 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 *
136 * Description:
137 * This function checks the SECMARK reference counter to see if any SECMARK
138 * targets are currently configured, if the reference counter is greater than
139 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
140 * enabled, false (0) if SECMARK is disabled. If the always_check_network
141 * policy capability is enabled, SECMARK is always considered enabled.
142 *
143 */
144 static int selinux_secmark_enabled(void)
145 {
146 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
147 }
148
149 /**
150 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
151 *
152 * Description:
153 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
154 * (1) if any are enabled or false (0) if neither are enabled. If the
155 * always_check_network policy capability is enabled, peer labeling
156 * is always considered enabled.
157 *
158 */
159 static int selinux_peerlbl_enabled(void)
160 {
161 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
162 }
163
164 /*
165 * initialise the security for the init task
166 */
167 static void cred_init_security(void)
168 {
169 struct cred *cred = (struct cred *) current->real_cred;
170 struct task_security_struct *tsec;
171
172 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
173 if (!tsec)
174 panic("SELinux: Failed to initialize initial task.\n");
175
176 tsec->osid = tsec->sid = SECINITSID_KERNEL;
177 cred->security = tsec;
178 }
179
180 /*
181 * get the security ID of a set of credentials
182 */
183 static inline u32 cred_sid(const struct cred *cred)
184 {
185 const struct task_security_struct *tsec;
186
187 tsec = cred->security;
188 return tsec->sid;
189 }
190
191 /*
192 * get the objective security ID of a task
193 */
194 static inline u32 task_sid(const struct task_struct *task)
195 {
196 u32 sid;
197
198 rcu_read_lock();
199 sid = cred_sid(__task_cred(task));
200 rcu_read_unlock();
201 return sid;
202 }
203
204 /*
205 * get the subjective security ID of the current task
206 */
207 static inline u32 current_sid(void)
208 {
209 const struct task_security_struct *tsec = current_security();
210
211 return tsec->sid;
212 }
213
214 /* Allocate and free functions for each kind of security blob. */
215
216 static int inode_alloc_security(struct inode *inode)
217 {
218 struct inode_security_struct *isec;
219 u32 sid = current_sid();
220
221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
222 if (!isec)
223 return -ENOMEM;
224
225 mutex_init(&isec->lock);
226 INIT_LIST_HEAD(&isec->list);
227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
230 isec->task_sid = sid;
231 inode->i_security = isec;
232
233 return 0;
234 }
235
236 static void inode_free_rcu(struct rcu_head *head)
237 {
238 struct inode_security_struct *isec;
239
240 isec = container_of(head, struct inode_security_struct, rcu);
241 kmem_cache_free(sel_inode_cache, isec);
242 }
243
244 static void inode_free_security(struct inode *inode)
245 {
246 struct inode_security_struct *isec = inode->i_security;
247 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
248
249 spin_lock(&sbsec->isec_lock);
250 if (!list_empty(&isec->list))
251 list_del_init(&isec->list);
252 spin_unlock(&sbsec->isec_lock);
253
254 /*
255 * The inode may still be referenced in a path walk and
256 * a call to selinux_inode_permission() can be made
257 * after inode_free_security() is called. Ideally, the VFS
258 * wouldn't do this, but fixing that is a much harder
259 * job. For now, simply free the i_security via RCU, and
260 * leave the current inode->i_security pointer intact.
261 * The inode will be freed after the RCU grace period too.
262 */
263 call_rcu(&isec->rcu, inode_free_rcu);
264 }
265
266 static int file_alloc_security(struct file *file)
267 {
268 struct file_security_struct *fsec;
269 u32 sid = current_sid();
270
271 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
272 if (!fsec)
273 return -ENOMEM;
274
275 fsec->sid = sid;
276 fsec->fown_sid = sid;
277 file->f_security = fsec;
278
279 return 0;
280 }
281
282 static void file_free_security(struct file *file)
283 {
284 struct file_security_struct *fsec = file->f_security;
285 file->f_security = NULL;
286 kfree(fsec);
287 }
288
289 static int superblock_alloc_security(struct super_block *sb)
290 {
291 struct superblock_security_struct *sbsec;
292
293 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
294 if (!sbsec)
295 return -ENOMEM;
296
297 mutex_init(&sbsec->lock);
298 INIT_LIST_HEAD(&sbsec->isec_head);
299 spin_lock_init(&sbsec->isec_lock);
300 sbsec->sb = sb;
301 sbsec->sid = SECINITSID_UNLABELED;
302 sbsec->def_sid = SECINITSID_FILE;
303 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
304 sb->s_security = sbsec;
305
306 return 0;
307 }
308
309 static void superblock_free_security(struct super_block *sb)
310 {
311 struct superblock_security_struct *sbsec = sb->s_security;
312 sb->s_security = NULL;
313 kfree(sbsec);
314 }
315
316 /* The file system's label must be initialized prior to use. */
317
318 static const char *labeling_behaviors[7] = {
319 "uses xattr",
320 "uses transition SIDs",
321 "uses task SIDs",
322 "uses genfs_contexts",
323 "not configured for labeling",
324 "uses mountpoint labeling",
325 "uses native labeling",
326 };
327
328 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
329
330 static inline int inode_doinit(struct inode *inode)
331 {
332 return inode_doinit_with_dentry(inode, NULL);
333 }
334
335 enum {
336 Opt_error = -1,
337 Opt_context = 1,
338 Opt_fscontext = 2,
339 Opt_defcontext = 3,
340 Opt_rootcontext = 4,
341 Opt_labelsupport = 5,
342 Opt_nextmntopt = 6,
343 };
344
345 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
346
347 static const match_table_t tokens = {
348 {Opt_context, CONTEXT_STR "%s"},
349 {Opt_fscontext, FSCONTEXT_STR "%s"},
350 {Opt_defcontext, DEFCONTEXT_STR "%s"},
351 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
352 {Opt_labelsupport, LABELSUPP_STR},
353 {Opt_error, NULL},
354 };
355
356 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
357
358 static int may_context_mount_sb_relabel(u32 sid,
359 struct superblock_security_struct *sbsec,
360 const struct cred *cred)
361 {
362 const struct task_security_struct *tsec = cred->security;
363 int rc;
364
365 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
366 FILESYSTEM__RELABELFROM, NULL);
367 if (rc)
368 return rc;
369
370 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
371 FILESYSTEM__RELABELTO, NULL);
372 return rc;
373 }
374
375 static int may_context_mount_inode_relabel(u32 sid,
376 struct superblock_security_struct *sbsec,
377 const struct cred *cred)
378 {
379 const struct task_security_struct *tsec = cred->security;
380 int rc;
381 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
382 FILESYSTEM__RELABELFROM, NULL);
383 if (rc)
384 return rc;
385
386 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
387 FILESYSTEM__ASSOCIATE, NULL);
388 return rc;
389 }
390
391 static int selinux_is_sblabel_mnt(struct super_block *sb)
392 {
393 struct superblock_security_struct *sbsec = sb->s_security;
394
395 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
396 sbsec->behavior == SECURITY_FS_USE_TRANS ||
397 sbsec->behavior == SECURITY_FS_USE_TASK)
398 return 1;
399
400 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
401 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
402 return 1;
403
404 /*
405 * Special handling for rootfs. Is genfs but supports
406 * setting SELinux context on in-core inodes.
407 */
408 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
409 return 1;
410
411 return 0;
412 }
413
414 static int sb_finish_set_opts(struct super_block *sb)
415 {
416 struct superblock_security_struct *sbsec = sb->s_security;
417 struct dentry *root = sb->s_root;
418 struct inode *root_inode = root->d_inode;
419 int rc = 0;
420
421 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
422 /* Make sure that the xattr handler exists and that no
423 error other than -ENODATA is returned by getxattr on
424 the root directory. -ENODATA is ok, as this may be
425 the first boot of the SELinux kernel before we have
426 assigned xattr values to the filesystem. */
427 if (!root_inode->i_op->getxattr) {
428 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
429 "xattr support\n", sb->s_id, sb->s_type->name);
430 rc = -EOPNOTSUPP;
431 goto out;
432 }
433 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
434 if (rc < 0 && rc != -ENODATA) {
435 if (rc == -EOPNOTSUPP)
436 printk(KERN_WARNING "SELinux: (dev %s, type "
437 "%s) has no security xattr handler\n",
438 sb->s_id, sb->s_type->name);
439 else
440 printk(KERN_WARNING "SELinux: (dev %s, type "
441 "%s) getxattr errno %d\n", sb->s_id,
442 sb->s_type->name, -rc);
443 goto out;
444 }
445 }
446
447 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
448 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
449 sb->s_id, sb->s_type->name);
450 else
451 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
452 sb->s_id, sb->s_type->name,
453 labeling_behaviors[sbsec->behavior-1]);
454
455 sbsec->flags |= SE_SBINITIALIZED;
456 if (selinux_is_sblabel_mnt(sb))
457 sbsec->flags |= SBLABEL_MNT;
458
459 /* Initialize the root inode. */
460 rc = inode_doinit_with_dentry(root_inode, root);
461
462 /* Initialize any other inodes associated with the superblock, e.g.
463 inodes created prior to initial policy load or inodes created
464 during get_sb by a pseudo filesystem that directly
465 populates itself. */
466 spin_lock(&sbsec->isec_lock);
467 next_inode:
468 if (!list_empty(&sbsec->isec_head)) {
469 struct inode_security_struct *isec =
470 list_entry(sbsec->isec_head.next,
471 struct inode_security_struct, list);
472 struct inode *inode = isec->inode;
473 spin_unlock(&sbsec->isec_lock);
474 inode = igrab(inode);
475 if (inode) {
476 if (!IS_PRIVATE(inode))
477 inode_doinit(inode);
478 iput(inode);
479 }
480 spin_lock(&sbsec->isec_lock);
481 list_del_init(&isec->list);
482 goto next_inode;
483 }
484 spin_unlock(&sbsec->isec_lock);
485 out:
486 return rc;
487 }
488
489 /*
490 * This function should allow an FS to ask what it's mount security
491 * options were so it can use those later for submounts, displaying
492 * mount options, or whatever.
493 */
494 static int selinux_get_mnt_opts(const struct super_block *sb,
495 struct security_mnt_opts *opts)
496 {
497 int rc = 0, i;
498 struct superblock_security_struct *sbsec = sb->s_security;
499 char *context = NULL;
500 u32 len;
501 char tmp;
502
503 security_init_mnt_opts(opts);
504
505 if (!(sbsec->flags & SE_SBINITIALIZED))
506 return -EINVAL;
507
508 if (!ss_initialized)
509 return -EINVAL;
510
511 /* make sure we always check enough bits to cover the mask */
512 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
513
514 tmp = sbsec->flags & SE_MNTMASK;
515 /* count the number of mount options for this sb */
516 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
517 if (tmp & 0x01)
518 opts->num_mnt_opts++;
519 tmp >>= 1;
520 }
521 /* Check if the Label support flag is set */
522 if (sbsec->flags & SBLABEL_MNT)
523 opts->num_mnt_opts++;
524
525 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
526 if (!opts->mnt_opts) {
527 rc = -ENOMEM;
528 goto out_free;
529 }
530
531 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
532 if (!opts->mnt_opts_flags) {
533 rc = -ENOMEM;
534 goto out_free;
535 }
536
537 i = 0;
538 if (sbsec->flags & FSCONTEXT_MNT) {
539 rc = security_sid_to_context(sbsec->sid, &context, &len);
540 if (rc)
541 goto out_free;
542 opts->mnt_opts[i] = context;
543 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
544 }
545 if (sbsec->flags & CONTEXT_MNT) {
546 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
547 if (rc)
548 goto out_free;
549 opts->mnt_opts[i] = context;
550 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
551 }
552 if (sbsec->flags & DEFCONTEXT_MNT) {
553 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
554 if (rc)
555 goto out_free;
556 opts->mnt_opts[i] = context;
557 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
558 }
559 if (sbsec->flags & ROOTCONTEXT_MNT) {
560 struct inode *root = sbsec->sb->s_root->d_inode;
561 struct inode_security_struct *isec = root->i_security;
562
563 rc = security_sid_to_context(isec->sid, &context, &len);
564 if (rc)
565 goto out_free;
566 opts->mnt_opts[i] = context;
567 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
568 }
569 if (sbsec->flags & SBLABEL_MNT) {
570 opts->mnt_opts[i] = NULL;
571 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
572 }
573
574 BUG_ON(i != opts->num_mnt_opts);
575
576 return 0;
577
578 out_free:
579 security_free_mnt_opts(opts);
580 return rc;
581 }
582
583 static int bad_option(struct superblock_security_struct *sbsec, char flag,
584 u32 old_sid, u32 new_sid)
585 {
586 char mnt_flags = sbsec->flags & SE_MNTMASK;
587
588 /* check if the old mount command had the same options */
589 if (sbsec->flags & SE_SBINITIALIZED)
590 if (!(sbsec->flags & flag) ||
591 (old_sid != new_sid))
592 return 1;
593
594 /* check if we were passed the same options twice,
595 * aka someone passed context=a,context=b
596 */
597 if (!(sbsec->flags & SE_SBINITIALIZED))
598 if (mnt_flags & flag)
599 return 1;
600 return 0;
601 }
602
603 /*
604 * Allow filesystems with binary mount data to explicitly set mount point
605 * labeling information.
606 */
607 static int selinux_set_mnt_opts(struct super_block *sb,
608 struct security_mnt_opts *opts,
609 unsigned long kern_flags,
610 unsigned long *set_kern_flags)
611 {
612 const struct cred *cred = current_cred();
613 int rc = 0, i;
614 struct superblock_security_struct *sbsec = sb->s_security;
615 const char *name = sb->s_type->name;
616 struct inode *inode = sbsec->sb->s_root->d_inode;
617 struct inode_security_struct *root_isec = inode->i_security;
618 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
619 u32 defcontext_sid = 0;
620 char **mount_options = opts->mnt_opts;
621 int *flags = opts->mnt_opts_flags;
622 int num_opts = opts->num_mnt_opts;
623
624 mutex_lock(&sbsec->lock);
625
626 if (!ss_initialized) {
627 if (!num_opts) {
628 /* Defer initialization until selinux_complete_init,
629 after the initial policy is loaded and the security
630 server is ready to handle calls. */
631 goto out;
632 }
633 rc = -EINVAL;
634 printk(KERN_WARNING "SELinux: Unable to set superblock options "
635 "before the security server is initialized\n");
636 goto out;
637 }
638 if (kern_flags && !set_kern_flags) {
639 /* Specifying internal flags without providing a place to
640 * place the results is not allowed */
641 rc = -EINVAL;
642 goto out;
643 }
644
645 /*
646 * Binary mount data FS will come through this function twice. Once
647 * from an explicit call and once from the generic calls from the vfs.
648 * Since the generic VFS calls will not contain any security mount data
649 * we need to skip the double mount verification.
650 *
651 * This does open a hole in which we will not notice if the first
652 * mount using this sb set explict options and a second mount using
653 * this sb does not set any security options. (The first options
654 * will be used for both mounts)
655 */
656 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
657 && (num_opts == 0))
658 goto out;
659
660 /*
661 * parse the mount options, check if they are valid sids.
662 * also check if someone is trying to mount the same sb more
663 * than once with different security options.
664 */
665 for (i = 0; i < num_opts; i++) {
666 u32 sid;
667
668 if (flags[i] == SBLABEL_MNT)
669 continue;
670 rc = security_context_to_sid(mount_options[i],
671 strlen(mount_options[i]), &sid, GFP_KERNEL);
672 if (rc) {
673 printk(KERN_WARNING "SELinux: security_context_to_sid"
674 "(%s) failed for (dev %s, type %s) errno=%d\n",
675 mount_options[i], sb->s_id, name, rc);
676 goto out;
677 }
678 switch (flags[i]) {
679 case FSCONTEXT_MNT:
680 fscontext_sid = sid;
681
682 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
683 fscontext_sid))
684 goto out_double_mount;
685
686 sbsec->flags |= FSCONTEXT_MNT;
687 break;
688 case CONTEXT_MNT:
689 context_sid = sid;
690
691 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
692 context_sid))
693 goto out_double_mount;
694
695 sbsec->flags |= CONTEXT_MNT;
696 break;
697 case ROOTCONTEXT_MNT:
698 rootcontext_sid = sid;
699
700 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
701 rootcontext_sid))
702 goto out_double_mount;
703
704 sbsec->flags |= ROOTCONTEXT_MNT;
705
706 break;
707 case DEFCONTEXT_MNT:
708 defcontext_sid = sid;
709
710 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 defcontext_sid))
712 goto out_double_mount;
713
714 sbsec->flags |= DEFCONTEXT_MNT;
715
716 break;
717 default:
718 rc = -EINVAL;
719 goto out;
720 }
721 }
722
723 if (sbsec->flags & SE_SBINITIALIZED) {
724 /* previously mounted with options, but not on this attempt? */
725 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
726 goto out_double_mount;
727 rc = 0;
728 goto out;
729 }
730
731 if (strcmp(sb->s_type->name, "proc") == 0)
732 sbsec->flags |= SE_SBPROC;
733
734 if (!sbsec->behavior) {
735 /*
736 * Determine the labeling behavior to use for this
737 * filesystem type.
738 */
739 rc = security_fs_use(sb);
740 if (rc) {
741 printk(KERN_WARNING
742 "%s: security_fs_use(%s) returned %d\n",
743 __func__, sb->s_type->name, rc);
744 goto out;
745 }
746 }
747 /* sets the context of the superblock for the fs being mounted. */
748 if (fscontext_sid) {
749 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
750 if (rc)
751 goto out;
752
753 sbsec->sid = fscontext_sid;
754 }
755
756 /*
757 * Switch to using mount point labeling behavior.
758 * sets the label used on all file below the mountpoint, and will set
759 * the superblock context if not already set.
760 */
761 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
762 sbsec->behavior = SECURITY_FS_USE_NATIVE;
763 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
764 }
765
766 if (context_sid) {
767 if (!fscontext_sid) {
768 rc = may_context_mount_sb_relabel(context_sid, sbsec,
769 cred);
770 if (rc)
771 goto out;
772 sbsec->sid = context_sid;
773 } else {
774 rc = may_context_mount_inode_relabel(context_sid, sbsec,
775 cred);
776 if (rc)
777 goto out;
778 }
779 if (!rootcontext_sid)
780 rootcontext_sid = context_sid;
781
782 sbsec->mntpoint_sid = context_sid;
783 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
784 }
785
786 if (rootcontext_sid) {
787 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
788 cred);
789 if (rc)
790 goto out;
791
792 root_isec->sid = rootcontext_sid;
793 root_isec->initialized = 1;
794 }
795
796 if (defcontext_sid) {
797 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
798 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
799 rc = -EINVAL;
800 printk(KERN_WARNING "SELinux: defcontext option is "
801 "invalid for this filesystem type\n");
802 goto out;
803 }
804
805 if (defcontext_sid != sbsec->def_sid) {
806 rc = may_context_mount_inode_relabel(defcontext_sid,
807 sbsec, cred);
808 if (rc)
809 goto out;
810 }
811
812 sbsec->def_sid = defcontext_sid;
813 }
814
815 rc = sb_finish_set_opts(sb);
816 out:
817 mutex_unlock(&sbsec->lock);
818 return rc;
819 out_double_mount:
820 rc = -EINVAL;
821 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
822 "security settings for (dev %s, type %s)\n", sb->s_id, name);
823 goto out;
824 }
825
826 static int selinux_cmp_sb_context(const struct super_block *oldsb,
827 const struct super_block *newsb)
828 {
829 struct superblock_security_struct *old = oldsb->s_security;
830 struct superblock_security_struct *new = newsb->s_security;
831 char oldflags = old->flags & SE_MNTMASK;
832 char newflags = new->flags & SE_MNTMASK;
833
834 if (oldflags != newflags)
835 goto mismatch;
836 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
837 goto mismatch;
838 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
839 goto mismatch;
840 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
841 goto mismatch;
842 if (oldflags & ROOTCONTEXT_MNT) {
843 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
844 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
845 if (oldroot->sid != newroot->sid)
846 goto mismatch;
847 }
848 return 0;
849 mismatch:
850 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
851 "different security settings for (dev %s, "
852 "type %s)\n", newsb->s_id, newsb->s_type->name);
853 return -EBUSY;
854 }
855
856 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
857 struct super_block *newsb)
858 {
859 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
860 struct superblock_security_struct *newsbsec = newsb->s_security;
861
862 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
863 int set_context = (oldsbsec->flags & CONTEXT_MNT);
864 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
865
866 /*
867 * if the parent was able to be mounted it clearly had no special lsm
868 * mount options. thus we can safely deal with this superblock later
869 */
870 if (!ss_initialized)
871 return 0;
872
873 /* how can we clone if the old one wasn't set up?? */
874 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
875
876 /* if fs is reusing a sb, make sure that the contexts match */
877 if (newsbsec->flags & SE_SBINITIALIZED)
878 return selinux_cmp_sb_context(oldsb, newsb);
879
880 mutex_lock(&newsbsec->lock);
881
882 newsbsec->flags = oldsbsec->flags;
883
884 newsbsec->sid = oldsbsec->sid;
885 newsbsec->def_sid = oldsbsec->def_sid;
886 newsbsec->behavior = oldsbsec->behavior;
887
888 if (set_context) {
889 u32 sid = oldsbsec->mntpoint_sid;
890
891 if (!set_fscontext)
892 newsbsec->sid = sid;
893 if (!set_rootcontext) {
894 struct inode *newinode = newsb->s_root->d_inode;
895 struct inode_security_struct *newisec = newinode->i_security;
896 newisec->sid = sid;
897 }
898 newsbsec->mntpoint_sid = sid;
899 }
900 if (set_rootcontext) {
901 const struct inode *oldinode = oldsb->s_root->d_inode;
902 const struct inode_security_struct *oldisec = oldinode->i_security;
903 struct inode *newinode = newsb->s_root->d_inode;
904 struct inode_security_struct *newisec = newinode->i_security;
905
906 newisec->sid = oldisec->sid;
907 }
908
909 sb_finish_set_opts(newsb);
910 mutex_unlock(&newsbsec->lock);
911 return 0;
912 }
913
914 static int selinux_parse_opts_str(char *options,
915 struct security_mnt_opts *opts)
916 {
917 char *p;
918 char *context = NULL, *defcontext = NULL;
919 char *fscontext = NULL, *rootcontext = NULL;
920 int rc, num_mnt_opts = 0;
921
922 opts->num_mnt_opts = 0;
923
924 /* Standard string-based options. */
925 while ((p = strsep(&options, "|")) != NULL) {
926 int token;
927 substring_t args[MAX_OPT_ARGS];
928
929 if (!*p)
930 continue;
931
932 token = match_token(p, tokens, args);
933
934 switch (token) {
935 case Opt_context:
936 if (context || defcontext) {
937 rc = -EINVAL;
938 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
939 goto out_err;
940 }
941 context = match_strdup(&args[0]);
942 if (!context) {
943 rc = -ENOMEM;
944 goto out_err;
945 }
946 break;
947
948 case Opt_fscontext:
949 if (fscontext) {
950 rc = -EINVAL;
951 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
952 goto out_err;
953 }
954 fscontext = match_strdup(&args[0]);
955 if (!fscontext) {
956 rc = -ENOMEM;
957 goto out_err;
958 }
959 break;
960
961 case Opt_rootcontext:
962 if (rootcontext) {
963 rc = -EINVAL;
964 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
965 goto out_err;
966 }
967 rootcontext = match_strdup(&args[0]);
968 if (!rootcontext) {
969 rc = -ENOMEM;
970 goto out_err;
971 }
972 break;
973
974 case Opt_defcontext:
975 if (context || defcontext) {
976 rc = -EINVAL;
977 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
978 goto out_err;
979 }
980 defcontext = match_strdup(&args[0]);
981 if (!defcontext) {
982 rc = -ENOMEM;
983 goto out_err;
984 }
985 break;
986 case Opt_labelsupport:
987 break;
988 default:
989 rc = -EINVAL;
990 printk(KERN_WARNING "SELinux: unknown mount option\n");
991 goto out_err;
992
993 }
994 }
995
996 rc = -ENOMEM;
997 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
998 if (!opts->mnt_opts)
999 goto out_err;
1000
1001 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1002 if (!opts->mnt_opts_flags) {
1003 kfree(opts->mnt_opts);
1004 goto out_err;
1005 }
1006
1007 if (fscontext) {
1008 opts->mnt_opts[num_mnt_opts] = fscontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1010 }
1011 if (context) {
1012 opts->mnt_opts[num_mnt_opts] = context;
1013 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1014 }
1015 if (rootcontext) {
1016 opts->mnt_opts[num_mnt_opts] = rootcontext;
1017 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1018 }
1019 if (defcontext) {
1020 opts->mnt_opts[num_mnt_opts] = defcontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1022 }
1023
1024 opts->num_mnt_opts = num_mnt_opts;
1025 return 0;
1026
1027 out_err:
1028 kfree(context);
1029 kfree(defcontext);
1030 kfree(fscontext);
1031 kfree(rootcontext);
1032 return rc;
1033 }
1034 /*
1035 * string mount options parsing and call set the sbsec
1036 */
1037 static int superblock_doinit(struct super_block *sb, void *data)
1038 {
1039 int rc = 0;
1040 char *options = data;
1041 struct security_mnt_opts opts;
1042
1043 security_init_mnt_opts(&opts);
1044
1045 if (!data)
1046 goto out;
1047
1048 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1049
1050 rc = selinux_parse_opts_str(options, &opts);
1051 if (rc)
1052 goto out_err;
1053
1054 out:
1055 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1056
1057 out_err:
1058 security_free_mnt_opts(&opts);
1059 return rc;
1060 }
1061
1062 static void selinux_write_opts(struct seq_file *m,
1063 struct security_mnt_opts *opts)
1064 {
1065 int i;
1066 char *prefix;
1067
1068 for (i = 0; i < opts->num_mnt_opts; i++) {
1069 char *has_comma;
1070
1071 if (opts->mnt_opts[i])
1072 has_comma = strchr(opts->mnt_opts[i], ',');
1073 else
1074 has_comma = NULL;
1075
1076 switch (opts->mnt_opts_flags[i]) {
1077 case CONTEXT_MNT:
1078 prefix = CONTEXT_STR;
1079 break;
1080 case FSCONTEXT_MNT:
1081 prefix = FSCONTEXT_STR;
1082 break;
1083 case ROOTCONTEXT_MNT:
1084 prefix = ROOTCONTEXT_STR;
1085 break;
1086 case DEFCONTEXT_MNT:
1087 prefix = DEFCONTEXT_STR;
1088 break;
1089 case SBLABEL_MNT:
1090 seq_putc(m, ',');
1091 seq_puts(m, LABELSUPP_STR);
1092 continue;
1093 default:
1094 BUG();
1095 return;
1096 };
1097 /* we need a comma before each option */
1098 seq_putc(m, ',');
1099 seq_puts(m, prefix);
1100 if (has_comma)
1101 seq_putc(m, '\"');
1102 seq_puts(m, opts->mnt_opts[i]);
1103 if (has_comma)
1104 seq_putc(m, '\"');
1105 }
1106 }
1107
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1109 {
1110 struct security_mnt_opts opts;
1111 int rc;
1112
1113 rc = selinux_get_mnt_opts(sb, &opts);
1114 if (rc) {
1115 /* before policy load we may get EINVAL, don't show anything */
1116 if (rc == -EINVAL)
1117 rc = 0;
1118 return rc;
1119 }
1120
1121 selinux_write_opts(m, &opts);
1122
1123 security_free_mnt_opts(&opts);
1124
1125 return rc;
1126 }
1127
1128 static inline u16 inode_mode_to_security_class(umode_t mode)
1129 {
1130 switch (mode & S_IFMT) {
1131 case S_IFSOCK:
1132 return SECCLASS_SOCK_FILE;
1133 case S_IFLNK:
1134 return SECCLASS_LNK_FILE;
1135 case S_IFREG:
1136 return SECCLASS_FILE;
1137 case S_IFBLK:
1138 return SECCLASS_BLK_FILE;
1139 case S_IFDIR:
1140 return SECCLASS_DIR;
1141 case S_IFCHR:
1142 return SECCLASS_CHR_FILE;
1143 case S_IFIFO:
1144 return SECCLASS_FIFO_FILE;
1145
1146 }
1147
1148 return SECCLASS_FILE;
1149 }
1150
1151 static inline int default_protocol_stream(int protocol)
1152 {
1153 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1154 }
1155
1156 static inline int default_protocol_dgram(int protocol)
1157 {
1158 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1159 }
1160
1161 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1162 {
1163 switch (family) {
1164 case PF_UNIX:
1165 switch (type) {
1166 case SOCK_STREAM:
1167 case SOCK_SEQPACKET:
1168 return SECCLASS_UNIX_STREAM_SOCKET;
1169 case SOCK_DGRAM:
1170 return SECCLASS_UNIX_DGRAM_SOCKET;
1171 }
1172 break;
1173 case PF_INET:
1174 case PF_INET6:
1175 switch (type) {
1176 case SOCK_STREAM:
1177 if (default_protocol_stream(protocol))
1178 return SECCLASS_TCP_SOCKET;
1179 else
1180 return SECCLASS_RAWIP_SOCKET;
1181 case SOCK_DGRAM:
1182 if (default_protocol_dgram(protocol))
1183 return SECCLASS_UDP_SOCKET;
1184 else
1185 return SECCLASS_RAWIP_SOCKET;
1186 case SOCK_DCCP:
1187 return SECCLASS_DCCP_SOCKET;
1188 default:
1189 return SECCLASS_RAWIP_SOCKET;
1190 }
1191 break;
1192 case PF_NETLINK:
1193 switch (protocol) {
1194 case NETLINK_ROUTE:
1195 return SECCLASS_NETLINK_ROUTE_SOCKET;
1196 case NETLINK_FIREWALL:
1197 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1198 case NETLINK_SOCK_DIAG:
1199 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1200 case NETLINK_NFLOG:
1201 return SECCLASS_NETLINK_NFLOG_SOCKET;
1202 case NETLINK_XFRM:
1203 return SECCLASS_NETLINK_XFRM_SOCKET;
1204 case NETLINK_SELINUX:
1205 return SECCLASS_NETLINK_SELINUX_SOCKET;
1206 case NETLINK_AUDIT:
1207 return SECCLASS_NETLINK_AUDIT_SOCKET;
1208 case NETLINK_IP6_FW:
1209 return SECCLASS_NETLINK_IP6FW_SOCKET;
1210 case NETLINK_DNRTMSG:
1211 return SECCLASS_NETLINK_DNRT_SOCKET;
1212 case NETLINK_KOBJECT_UEVENT:
1213 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1214 default:
1215 return SECCLASS_NETLINK_SOCKET;
1216 }
1217 case PF_PACKET:
1218 return SECCLASS_PACKET_SOCKET;
1219 case PF_KEY:
1220 return SECCLASS_KEY_SOCKET;
1221 case PF_APPLETALK:
1222 return SECCLASS_APPLETALK_SOCKET;
1223 }
1224
1225 return SECCLASS_SOCKET;
1226 }
1227
1228 #ifdef CONFIG_PROC_FS
1229 static int selinux_proc_get_sid(struct dentry *dentry,
1230 u16 tclass,
1231 u32 *sid)
1232 {
1233 int rc;
1234 char *buffer, *path;
1235
1236 buffer = (char *)__get_free_page(GFP_KERNEL);
1237 if (!buffer)
1238 return -ENOMEM;
1239
1240 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1241 if (IS_ERR(path))
1242 rc = PTR_ERR(path);
1243 else {
1244 /* each process gets a /proc/PID/ entry. Strip off the
1245 * PID part to get a valid selinux labeling.
1246 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1247 while (path[1] >= '0' && path[1] <= '9') {
1248 path[1] = '/';
1249 path++;
1250 }
1251 rc = security_genfs_sid("proc", path, tclass, sid);
1252 }
1253 free_page((unsigned long)buffer);
1254 return rc;
1255 }
1256 #else
1257 static int selinux_proc_get_sid(struct dentry *dentry,
1258 u16 tclass,
1259 u32 *sid)
1260 {
1261 return -EINVAL;
1262 }
1263 #endif
1264
1265 /* The inode's security attributes must be initialized before first use. */
1266 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1267 {
1268 struct superblock_security_struct *sbsec = NULL;
1269 struct inode_security_struct *isec = inode->i_security;
1270 u32 sid;
1271 struct dentry *dentry;
1272 #define INITCONTEXTLEN 255
1273 char *context = NULL;
1274 unsigned len = 0;
1275 int rc = 0;
1276
1277 if (isec->initialized)
1278 goto out;
1279
1280 mutex_lock(&isec->lock);
1281 if (isec->initialized)
1282 goto out_unlock;
1283
1284 sbsec = inode->i_sb->s_security;
1285 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1286 /* Defer initialization until selinux_complete_init,
1287 after the initial policy is loaded and the security
1288 server is ready to handle calls. */
1289 spin_lock(&sbsec->isec_lock);
1290 if (list_empty(&isec->list))
1291 list_add(&isec->list, &sbsec->isec_head);
1292 spin_unlock(&sbsec->isec_lock);
1293 goto out_unlock;
1294 }
1295
1296 switch (sbsec->behavior) {
1297 case SECURITY_FS_USE_NATIVE:
1298 break;
1299 case SECURITY_FS_USE_XATTR:
1300 if (!inode->i_op->getxattr) {
1301 isec->sid = sbsec->def_sid;
1302 break;
1303 }
1304
1305 /* Need a dentry, since the xattr API requires one.
1306 Life would be simpler if we could just pass the inode. */
1307 if (opt_dentry) {
1308 /* Called from d_instantiate or d_splice_alias. */
1309 dentry = dget(opt_dentry);
1310 } else {
1311 /* Called from selinux_complete_init, try to find a dentry. */
1312 dentry = d_find_alias(inode);
1313 }
1314 if (!dentry) {
1315 /*
1316 * this is can be hit on boot when a file is accessed
1317 * before the policy is loaded. When we load policy we
1318 * may find inodes that have no dentry on the
1319 * sbsec->isec_head list. No reason to complain as these
1320 * will get fixed up the next time we go through
1321 * inode_doinit with a dentry, before these inodes could
1322 * be used again by userspace.
1323 */
1324 goto out_unlock;
1325 }
1326
1327 len = INITCONTEXTLEN;
1328 context = kmalloc(len+1, GFP_NOFS);
1329 if (!context) {
1330 rc = -ENOMEM;
1331 dput(dentry);
1332 goto out_unlock;
1333 }
1334 context[len] = '\0';
1335 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336 context, len);
1337 if (rc == -ERANGE) {
1338 kfree(context);
1339
1340 /* Need a larger buffer. Query for the right size. */
1341 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1342 NULL, 0);
1343 if (rc < 0) {
1344 dput(dentry);
1345 goto out_unlock;
1346 }
1347 len = rc;
1348 context = kmalloc(len+1, GFP_NOFS);
1349 if (!context) {
1350 rc = -ENOMEM;
1351 dput(dentry);
1352 goto out_unlock;
1353 }
1354 context[len] = '\0';
1355 rc = inode->i_op->getxattr(dentry,
1356 XATTR_NAME_SELINUX,
1357 context, len);
1358 }
1359 dput(dentry);
1360 if (rc < 0) {
1361 if (rc != -ENODATA) {
1362 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1363 "%d for dev=%s ino=%ld\n", __func__,
1364 -rc, inode->i_sb->s_id, inode->i_ino);
1365 kfree(context);
1366 goto out_unlock;
1367 }
1368 /* Map ENODATA to the default file SID */
1369 sid = sbsec->def_sid;
1370 rc = 0;
1371 } else {
1372 rc = security_context_to_sid_default(context, rc, &sid,
1373 sbsec->def_sid,
1374 GFP_NOFS);
1375 if (rc) {
1376 char *dev = inode->i_sb->s_id;
1377 unsigned long ino = inode->i_ino;
1378
1379 if (rc == -EINVAL) {
1380 if (printk_ratelimit())
1381 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1382 "context=%s. This indicates you may need to relabel the inode or the "
1383 "filesystem in question.\n", ino, dev, context);
1384 } else {
1385 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1386 "returned %d for dev=%s ino=%ld\n",
1387 __func__, context, -rc, dev, ino);
1388 }
1389 kfree(context);
1390 /* Leave with the unlabeled SID */
1391 rc = 0;
1392 break;
1393 }
1394 }
1395 kfree(context);
1396 isec->sid = sid;
1397 break;
1398 case SECURITY_FS_USE_TASK:
1399 isec->sid = isec->task_sid;
1400 break;
1401 case SECURITY_FS_USE_TRANS:
1402 /* Default to the fs SID. */
1403 isec->sid = sbsec->sid;
1404
1405 /* Try to obtain a transition SID. */
1406 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1407 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1408 isec->sclass, NULL, &sid);
1409 if (rc)
1410 goto out_unlock;
1411 isec->sid = sid;
1412 break;
1413 case SECURITY_FS_USE_MNTPOINT:
1414 isec->sid = sbsec->mntpoint_sid;
1415 break;
1416 default:
1417 /* Default to the fs superblock SID. */
1418 isec->sid = sbsec->sid;
1419
1420 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1421 /* We must have a dentry to determine the label on
1422 * procfs inodes */
1423 if (opt_dentry)
1424 /* Called from d_instantiate or
1425 * d_splice_alias. */
1426 dentry = dget(opt_dentry);
1427 else
1428 /* Called from selinux_complete_init, try to
1429 * find a dentry. */
1430 dentry = d_find_alias(inode);
1431 /*
1432 * This can be hit on boot when a file is accessed
1433 * before the policy is loaded. When we load policy we
1434 * may find inodes that have no dentry on the
1435 * sbsec->isec_head list. No reason to complain as
1436 * these will get fixed up the next time we go through
1437 * inode_doinit() with a dentry, before these inodes
1438 * could be used again by userspace.
1439 */
1440 if (!dentry)
1441 goto out_unlock;
1442 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1443 rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1444 dput(dentry);
1445 if (rc)
1446 goto out_unlock;
1447 isec->sid = sid;
1448 }
1449 break;
1450 }
1451
1452 isec->initialized = 1;
1453
1454 out_unlock:
1455 mutex_unlock(&isec->lock);
1456 out:
1457 if (isec->sclass == SECCLASS_FILE)
1458 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1459 return rc;
1460 }
1461
1462 /* Convert a Linux signal to an access vector. */
1463 static inline u32 signal_to_av(int sig)
1464 {
1465 u32 perm = 0;
1466
1467 switch (sig) {
1468 case SIGCHLD:
1469 /* Commonly granted from child to parent. */
1470 perm = PROCESS__SIGCHLD;
1471 break;
1472 case SIGKILL:
1473 /* Cannot be caught or ignored */
1474 perm = PROCESS__SIGKILL;
1475 break;
1476 case SIGSTOP:
1477 /* Cannot be caught or ignored */
1478 perm = PROCESS__SIGSTOP;
1479 break;
1480 default:
1481 /* All other signals. */
1482 perm = PROCESS__SIGNAL;
1483 break;
1484 }
1485
1486 return perm;
1487 }
1488
1489 /*
1490 * Check permission between a pair of credentials
1491 * fork check, ptrace check, etc.
1492 */
1493 static int cred_has_perm(const struct cred *actor,
1494 const struct cred *target,
1495 u32 perms)
1496 {
1497 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1498
1499 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1500 }
1501
1502 /*
1503 * Check permission between a pair of tasks, e.g. signal checks,
1504 * fork check, ptrace check, etc.
1505 * tsk1 is the actor and tsk2 is the target
1506 * - this uses the default subjective creds of tsk1
1507 */
1508 static int task_has_perm(const struct task_struct *tsk1,
1509 const struct task_struct *tsk2,
1510 u32 perms)
1511 {
1512 const struct task_security_struct *__tsec1, *__tsec2;
1513 u32 sid1, sid2;
1514
1515 rcu_read_lock();
1516 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1517 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1518 rcu_read_unlock();
1519 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 /*
1523 * Check permission between current and another task, e.g. signal checks,
1524 * fork check, ptrace check, etc.
1525 * current is the actor and tsk2 is the target
1526 * - this uses current's subjective creds
1527 */
1528 static int current_has_perm(const struct task_struct *tsk,
1529 u32 perms)
1530 {
1531 u32 sid, tsid;
1532
1533 sid = current_sid();
1534 tsid = task_sid(tsk);
1535 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1536 }
1537
1538 #if CAP_LAST_CAP > 63
1539 #error Fix SELinux to handle capabilities > 63.
1540 #endif
1541
1542 /* Check whether a task is allowed to use a capability. */
1543 static int cred_has_capability(const struct cred *cred,
1544 int cap, int audit)
1545 {
1546 struct common_audit_data ad;
1547 struct av_decision avd;
1548 u16 sclass;
1549 u32 sid = cred_sid(cred);
1550 u32 av = CAP_TO_MASK(cap);
1551 int rc;
1552
1553 ad.type = LSM_AUDIT_DATA_CAP;
1554 ad.u.cap = cap;
1555
1556 switch (CAP_TO_INDEX(cap)) {
1557 case 0:
1558 sclass = SECCLASS_CAPABILITY;
1559 break;
1560 case 1:
1561 sclass = SECCLASS_CAPABILITY2;
1562 break;
1563 default:
1564 printk(KERN_ERR
1565 "SELinux: out of range capability %d\n", cap);
1566 BUG();
1567 return -EINVAL;
1568 }
1569
1570 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1571 if (audit == SECURITY_CAP_AUDIT) {
1572 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1573 if (rc2)
1574 return rc2;
1575 }
1576 return rc;
1577 }
1578
1579 /* Check whether a task is allowed to use a system operation. */
1580 static int task_has_system(struct task_struct *tsk,
1581 u32 perms)
1582 {
1583 u32 sid = task_sid(tsk);
1584
1585 return avc_has_perm(sid, SECINITSID_KERNEL,
1586 SECCLASS_SYSTEM, perms, NULL);
1587 }
1588
1589 /* Check whether a task has a particular permission to an inode.
1590 The 'adp' parameter is optional and allows other audit
1591 data to be passed (e.g. the dentry). */
1592 static int inode_has_perm(const struct cred *cred,
1593 struct inode *inode,
1594 u32 perms,
1595 struct common_audit_data *adp)
1596 {
1597 struct inode_security_struct *isec;
1598 u32 sid;
1599
1600 validate_creds(cred);
1601
1602 if (unlikely(IS_PRIVATE(inode)))
1603 return 0;
1604
1605 sid = cred_sid(cred);
1606 isec = inode->i_security;
1607
1608 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1609 }
1610
1611 /* Same as inode_has_perm, but pass explicit audit data containing
1612 the dentry to help the auditing code to more easily generate the
1613 pathname if needed. */
1614 static inline int dentry_has_perm(const struct cred *cred,
1615 struct dentry *dentry,
1616 u32 av)
1617 {
1618 struct inode *inode = dentry->d_inode;
1619 struct common_audit_data ad;
1620
1621 ad.type = LSM_AUDIT_DATA_DENTRY;
1622 ad.u.dentry = dentry;
1623 return inode_has_perm(cred, inode, av, &ad);
1624 }
1625
1626 /* Same as inode_has_perm, but pass explicit audit data containing
1627 the path to help the auditing code to more easily generate the
1628 pathname if needed. */
1629 static inline int path_has_perm(const struct cred *cred,
1630 struct path *path,
1631 u32 av)
1632 {
1633 struct inode *inode = path->dentry->d_inode;
1634 struct common_audit_data ad;
1635
1636 ad.type = LSM_AUDIT_DATA_PATH;
1637 ad.u.path = *path;
1638 return inode_has_perm(cred, inode, av, &ad);
1639 }
1640
1641 /* Same as path_has_perm, but uses the inode from the file struct. */
1642 static inline int file_path_has_perm(const struct cred *cred,
1643 struct file *file,
1644 u32 av)
1645 {
1646 struct common_audit_data ad;
1647
1648 ad.type = LSM_AUDIT_DATA_PATH;
1649 ad.u.path = file->f_path;
1650 return inode_has_perm(cred, file_inode(file), av, &ad);
1651 }
1652
1653 /* Check whether a task can use an open file descriptor to
1654 access an inode in a given way. Check access to the
1655 descriptor itself, and then use dentry_has_perm to
1656 check a particular permission to the file.
1657 Access to the descriptor is implicitly granted if it
1658 has the same SID as the process. If av is zero, then
1659 access to the file is not checked, e.g. for cases
1660 where only the descriptor is affected like seek. */
1661 static int file_has_perm(const struct cred *cred,
1662 struct file *file,
1663 u32 av)
1664 {
1665 struct file_security_struct *fsec = file->f_security;
1666 struct inode *inode = file_inode(file);
1667 struct common_audit_data ad;
1668 u32 sid = cred_sid(cred);
1669 int rc;
1670
1671 ad.type = LSM_AUDIT_DATA_PATH;
1672 ad.u.path = file->f_path;
1673
1674 if (sid != fsec->sid) {
1675 rc = avc_has_perm(sid, fsec->sid,
1676 SECCLASS_FD,
1677 FD__USE,
1678 &ad);
1679 if (rc)
1680 goto out;
1681 }
1682
1683 /* av is zero if only checking access to the descriptor. */
1684 rc = 0;
1685 if (av)
1686 rc = inode_has_perm(cred, inode, av, &ad);
1687
1688 out:
1689 return rc;
1690 }
1691
1692 /* Check whether a task can create a file. */
1693 static int may_create(struct inode *dir,
1694 struct dentry *dentry,
1695 u16 tclass)
1696 {
1697 const struct task_security_struct *tsec = current_security();
1698 struct inode_security_struct *dsec;
1699 struct superblock_security_struct *sbsec;
1700 u32 sid, newsid;
1701 struct common_audit_data ad;
1702 int rc;
1703
1704 dsec = dir->i_security;
1705 sbsec = dir->i_sb->s_security;
1706
1707 sid = tsec->sid;
1708 newsid = tsec->create_sid;
1709
1710 ad.type = LSM_AUDIT_DATA_DENTRY;
1711 ad.u.dentry = dentry;
1712
1713 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1714 DIR__ADD_NAME | DIR__SEARCH,
1715 &ad);
1716 if (rc)
1717 return rc;
1718
1719 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1720 rc = security_transition_sid(sid, dsec->sid, tclass,
1721 &dentry->d_name, &newsid);
1722 if (rc)
1723 return rc;
1724 }
1725
1726 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1727 if (rc)
1728 return rc;
1729
1730 return avc_has_perm(newsid, sbsec->sid,
1731 SECCLASS_FILESYSTEM,
1732 FILESYSTEM__ASSOCIATE, &ad);
1733 }
1734
1735 /* Check whether a task can create a key. */
1736 static int may_create_key(u32 ksid,
1737 struct task_struct *ctx)
1738 {
1739 u32 sid = task_sid(ctx);
1740
1741 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1742 }
1743
1744 #define MAY_LINK 0
1745 #define MAY_UNLINK 1
1746 #define MAY_RMDIR 2
1747
1748 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1749 static int may_link(struct inode *dir,
1750 struct dentry *dentry,
1751 int kind)
1752
1753 {
1754 struct inode_security_struct *dsec, *isec;
1755 struct common_audit_data ad;
1756 u32 sid = current_sid();
1757 u32 av;
1758 int rc;
1759
1760 dsec = dir->i_security;
1761 isec = dentry->d_inode->i_security;
1762
1763 ad.type = LSM_AUDIT_DATA_DENTRY;
1764 ad.u.dentry = dentry;
1765
1766 av = DIR__SEARCH;
1767 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1768 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1769 if (rc)
1770 return rc;
1771
1772 switch (kind) {
1773 case MAY_LINK:
1774 av = FILE__LINK;
1775 break;
1776 case MAY_UNLINK:
1777 av = FILE__UNLINK;
1778 break;
1779 case MAY_RMDIR:
1780 av = DIR__RMDIR;
1781 break;
1782 default:
1783 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1784 __func__, kind);
1785 return 0;
1786 }
1787
1788 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1789 return rc;
1790 }
1791
1792 static inline int may_rename(struct inode *old_dir,
1793 struct dentry *old_dentry,
1794 struct inode *new_dir,
1795 struct dentry *new_dentry)
1796 {
1797 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1798 struct common_audit_data ad;
1799 u32 sid = current_sid();
1800 u32 av;
1801 int old_is_dir, new_is_dir;
1802 int rc;
1803
1804 old_dsec = old_dir->i_security;
1805 old_isec = old_dentry->d_inode->i_security;
1806 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1807 new_dsec = new_dir->i_security;
1808
1809 ad.type = LSM_AUDIT_DATA_DENTRY;
1810
1811 ad.u.dentry = old_dentry;
1812 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1813 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1814 if (rc)
1815 return rc;
1816 rc = avc_has_perm(sid, old_isec->sid,
1817 old_isec->sclass, FILE__RENAME, &ad);
1818 if (rc)
1819 return rc;
1820 if (old_is_dir && new_dir != old_dir) {
1821 rc = avc_has_perm(sid, old_isec->sid,
1822 old_isec->sclass, DIR__REPARENT, &ad);
1823 if (rc)
1824 return rc;
1825 }
1826
1827 ad.u.dentry = new_dentry;
1828 av = DIR__ADD_NAME | DIR__SEARCH;
1829 if (new_dentry->d_inode)
1830 av |= DIR__REMOVE_NAME;
1831 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1832 if (rc)
1833 return rc;
1834 if (new_dentry->d_inode) {
1835 new_isec = new_dentry->d_inode->i_security;
1836 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1837 rc = avc_has_perm(sid, new_isec->sid,
1838 new_isec->sclass,
1839 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1840 if (rc)
1841 return rc;
1842 }
1843
1844 return 0;
1845 }
1846
1847 /* Check whether a task can perform a filesystem operation. */
1848 static int superblock_has_perm(const struct cred *cred,
1849 struct super_block *sb,
1850 u32 perms,
1851 struct common_audit_data *ad)
1852 {
1853 struct superblock_security_struct *sbsec;
1854 u32 sid = cred_sid(cred);
1855
1856 sbsec = sb->s_security;
1857 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1858 }
1859
1860 /* Convert a Linux mode and permission mask to an access vector. */
1861 static inline u32 file_mask_to_av(int mode, int mask)
1862 {
1863 u32 av = 0;
1864
1865 if (!S_ISDIR(mode)) {
1866 if (mask & MAY_EXEC)
1867 av |= FILE__EXECUTE;
1868 if (mask & MAY_READ)
1869 av |= FILE__READ;
1870
1871 if (mask & MAY_APPEND)
1872 av |= FILE__APPEND;
1873 else if (mask & MAY_WRITE)
1874 av |= FILE__WRITE;
1875
1876 } else {
1877 if (mask & MAY_EXEC)
1878 av |= DIR__SEARCH;
1879 if (mask & MAY_WRITE)
1880 av |= DIR__WRITE;
1881 if (mask & MAY_READ)
1882 av |= DIR__READ;
1883 }
1884
1885 return av;
1886 }
1887
1888 /* Convert a Linux file to an access vector. */
1889 static inline u32 file_to_av(struct file *file)
1890 {
1891 u32 av = 0;
1892
1893 if (file->f_mode & FMODE_READ)
1894 av |= FILE__READ;
1895 if (file->f_mode & FMODE_WRITE) {
1896 if (file->f_flags & O_APPEND)
1897 av |= FILE__APPEND;
1898 else
1899 av |= FILE__WRITE;
1900 }
1901 if (!av) {
1902 /*
1903 * Special file opened with flags 3 for ioctl-only use.
1904 */
1905 av = FILE__IOCTL;
1906 }
1907
1908 return av;
1909 }
1910
1911 /*
1912 * Convert a file to an access vector and include the correct open
1913 * open permission.
1914 */
1915 static inline u32 open_file_to_av(struct file *file)
1916 {
1917 u32 av = file_to_av(file);
1918
1919 if (selinux_policycap_openperm)
1920 av |= FILE__OPEN;
1921
1922 return av;
1923 }
1924
1925 /* Hook functions begin here. */
1926
1927 static int selinux_ptrace_access_check(struct task_struct *child,
1928 unsigned int mode)
1929 {
1930 int rc;
1931
1932 rc = cap_ptrace_access_check(child, mode);
1933 if (rc)
1934 return rc;
1935
1936 if (mode & PTRACE_MODE_READ) {
1937 u32 sid = current_sid();
1938 u32 csid = task_sid(child);
1939 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1940 }
1941
1942 return current_has_perm(child, PROCESS__PTRACE);
1943 }
1944
1945 static int selinux_ptrace_traceme(struct task_struct *parent)
1946 {
1947 int rc;
1948
1949 rc = cap_ptrace_traceme(parent);
1950 if (rc)
1951 return rc;
1952
1953 return task_has_perm(parent, current, PROCESS__PTRACE);
1954 }
1955
1956 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1957 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1958 {
1959 int error;
1960
1961 error = current_has_perm(target, PROCESS__GETCAP);
1962 if (error)
1963 return error;
1964
1965 return cap_capget(target, effective, inheritable, permitted);
1966 }
1967
1968 static int selinux_capset(struct cred *new, const struct cred *old,
1969 const kernel_cap_t *effective,
1970 const kernel_cap_t *inheritable,
1971 const kernel_cap_t *permitted)
1972 {
1973 int error;
1974
1975 error = cap_capset(new, old,
1976 effective, inheritable, permitted);
1977 if (error)
1978 return error;
1979
1980 return cred_has_perm(old, new, PROCESS__SETCAP);
1981 }
1982
1983 /*
1984 * (This comment used to live with the selinux_task_setuid hook,
1985 * which was removed).
1986 *
1987 * Since setuid only affects the current process, and since the SELinux
1988 * controls are not based on the Linux identity attributes, SELinux does not
1989 * need to control this operation. However, SELinux does control the use of
1990 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1991 */
1992
1993 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1994 int cap, int audit)
1995 {
1996 int rc;
1997
1998 rc = cap_capable(cred, ns, cap, audit);
1999 if (rc)
2000 return rc;
2001
2002 return cred_has_capability(cred, cap, audit);
2003 }
2004
2005 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2006 {
2007 const struct cred *cred = current_cred();
2008 int rc = 0;
2009
2010 if (!sb)
2011 return 0;
2012
2013 switch (cmds) {
2014 case Q_SYNC:
2015 case Q_QUOTAON:
2016 case Q_QUOTAOFF:
2017 case Q_SETINFO:
2018 case Q_SETQUOTA:
2019 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2020 break;
2021 case Q_GETFMT:
2022 case Q_GETINFO:
2023 case Q_GETQUOTA:
2024 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2025 break;
2026 default:
2027 rc = 0; /* let the kernel handle invalid cmds */
2028 break;
2029 }
2030 return rc;
2031 }
2032
2033 static int selinux_quota_on(struct dentry *dentry)
2034 {
2035 const struct cred *cred = current_cred();
2036
2037 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2038 }
2039
2040 static int selinux_syslog(int type)
2041 {
2042 int rc;
2043
2044 switch (type) {
2045 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2046 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2047 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2048 break;
2049 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2050 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2051 /* Set level of messages printed to console */
2052 case SYSLOG_ACTION_CONSOLE_LEVEL:
2053 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2054 break;
2055 case SYSLOG_ACTION_CLOSE: /* Close log */
2056 case SYSLOG_ACTION_OPEN: /* Open log */
2057 case SYSLOG_ACTION_READ: /* Read from log */
2058 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2059 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2060 default:
2061 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2062 break;
2063 }
2064 return rc;
2065 }
2066
2067 /*
2068 * Check that a process has enough memory to allocate a new virtual
2069 * mapping. 0 means there is enough memory for the allocation to
2070 * succeed and -ENOMEM implies there is not.
2071 *
2072 * Do not audit the selinux permission check, as this is applied to all
2073 * processes that allocate mappings.
2074 */
2075 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2076 {
2077 int rc, cap_sys_admin = 0;
2078
2079 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2080 SECURITY_CAP_NOAUDIT);
2081 if (rc == 0)
2082 cap_sys_admin = 1;
2083
2084 return __vm_enough_memory(mm, pages, cap_sys_admin);
2085 }
2086
2087 /* binprm security operations */
2088
2089 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2090 {
2091 const struct task_security_struct *old_tsec;
2092 struct task_security_struct *new_tsec;
2093 struct inode_security_struct *isec;
2094 struct common_audit_data ad;
2095 struct inode *inode = file_inode(bprm->file);
2096 int rc;
2097
2098 rc = cap_bprm_set_creds(bprm);
2099 if (rc)
2100 return rc;
2101
2102 /* SELinux context only depends on initial program or script and not
2103 * the script interpreter */
2104 if (bprm->cred_prepared)
2105 return 0;
2106
2107 old_tsec = current_security();
2108 new_tsec = bprm->cred->security;
2109 isec = inode->i_security;
2110
2111 /* Default to the current task SID. */
2112 new_tsec->sid = old_tsec->sid;
2113 new_tsec->osid = old_tsec->sid;
2114
2115 /* Reset fs, key, and sock SIDs on execve. */
2116 new_tsec->create_sid = 0;
2117 new_tsec->keycreate_sid = 0;
2118 new_tsec->sockcreate_sid = 0;
2119
2120 if (old_tsec->exec_sid) {
2121 new_tsec->sid = old_tsec->exec_sid;
2122 /* Reset exec SID on execve. */
2123 new_tsec->exec_sid = 0;
2124
2125 /*
2126 * Minimize confusion: if no_new_privs and a transition is
2127 * explicitly requested, then fail the exec.
2128 */
2129 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2130 return -EPERM;
2131 } else {
2132 /* Check for a default transition on this program. */
2133 rc = security_transition_sid(old_tsec->sid, isec->sid,
2134 SECCLASS_PROCESS, NULL,
2135 &new_tsec->sid);
2136 if (rc)
2137 return rc;
2138 }
2139
2140 ad.type = LSM_AUDIT_DATA_PATH;
2141 ad.u.path = bprm->file->f_path;
2142
2143 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2144 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2145 new_tsec->sid = old_tsec->sid;
2146
2147 if (new_tsec->sid == old_tsec->sid) {
2148 rc = avc_has_perm(old_tsec->sid, isec->sid,
2149 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2150 if (rc)
2151 return rc;
2152 } else {
2153 /* Check permissions for the transition. */
2154 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2155 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2156 if (rc)
2157 return rc;
2158
2159 rc = avc_has_perm(new_tsec->sid, isec->sid,
2160 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2161 if (rc)
2162 return rc;
2163
2164 /* Check for shared state */
2165 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2166 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2167 SECCLASS_PROCESS, PROCESS__SHARE,
2168 NULL);
2169 if (rc)
2170 return -EPERM;
2171 }
2172
2173 /* Make sure that anyone attempting to ptrace over a task that
2174 * changes its SID has the appropriate permit */
2175 if (bprm->unsafe &
2176 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2177 struct task_struct *tracer;
2178 struct task_security_struct *sec;
2179 u32 ptsid = 0;
2180
2181 rcu_read_lock();
2182 tracer = ptrace_parent(current);
2183 if (likely(tracer != NULL)) {
2184 sec = __task_cred(tracer)->security;
2185 ptsid = sec->sid;
2186 }
2187 rcu_read_unlock();
2188
2189 if (ptsid != 0) {
2190 rc = avc_has_perm(ptsid, new_tsec->sid,
2191 SECCLASS_PROCESS,
2192 PROCESS__PTRACE, NULL);
2193 if (rc)
2194 return -EPERM;
2195 }
2196 }
2197
2198 /* Clear any possibly unsafe personality bits on exec: */
2199 bprm->per_clear |= PER_CLEAR_ON_SETID;
2200 }
2201
2202 return 0;
2203 }
2204
2205 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2206 {
2207 const struct task_security_struct *tsec = current_security();
2208 u32 sid, osid;
2209 int atsecure = 0;
2210
2211 sid = tsec->sid;
2212 osid = tsec->osid;
2213
2214 if (osid != sid) {
2215 /* Enable secure mode for SIDs transitions unless
2216 the noatsecure permission is granted between
2217 the two SIDs, i.e. ahp returns 0. */
2218 atsecure = avc_has_perm(osid, sid,
2219 SECCLASS_PROCESS,
2220 PROCESS__NOATSECURE, NULL);
2221 }
2222
2223 return (atsecure || cap_bprm_secureexec(bprm));
2224 }
2225
2226 static int match_file(const void *p, struct file *file, unsigned fd)
2227 {
2228 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2229 }
2230
2231 /* Derived from fs/exec.c:flush_old_files. */
2232 static inline void flush_unauthorized_files(const struct cred *cred,
2233 struct files_struct *files)
2234 {
2235 struct file *file, *devnull = NULL;
2236 struct tty_struct *tty;
2237 int drop_tty = 0;
2238 unsigned n;
2239
2240 tty = get_current_tty();
2241 if (tty) {
2242 spin_lock(&tty_files_lock);
2243 if (!list_empty(&tty->tty_files)) {
2244 struct tty_file_private *file_priv;
2245
2246 /* Revalidate access to controlling tty.
2247 Use file_path_has_perm on the tty path directly
2248 rather than using file_has_perm, as this particular
2249 open file may belong to another process and we are
2250 only interested in the inode-based check here. */
2251 file_priv = list_first_entry(&tty->tty_files,
2252 struct tty_file_private, list);
2253 file = file_priv->file;
2254 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2255 drop_tty = 1;
2256 }
2257 spin_unlock(&tty_files_lock);
2258 tty_kref_put(tty);
2259 }
2260 /* Reset controlling tty. */
2261 if (drop_tty)
2262 no_tty();
2263
2264 /* Revalidate access to inherited open files. */
2265 n = iterate_fd(files, 0, match_file, cred);
2266 if (!n) /* none found? */
2267 return;
2268
2269 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2270 if (IS_ERR(devnull))
2271 devnull = NULL;
2272 /* replace all the matching ones with this */
2273 do {
2274 replace_fd(n - 1, devnull, 0);
2275 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2276 if (devnull)
2277 fput(devnull);
2278 }
2279
2280 /*
2281 * Prepare a process for imminent new credential changes due to exec
2282 */
2283 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2284 {
2285 struct task_security_struct *new_tsec;
2286 struct rlimit *rlim, *initrlim;
2287 int rc, i;
2288
2289 new_tsec = bprm->cred->security;
2290 if (new_tsec->sid == new_tsec->osid)
2291 return;
2292
2293 /* Close files for which the new task SID is not authorized. */
2294 flush_unauthorized_files(bprm->cred, current->files);
2295
2296 /* Always clear parent death signal on SID transitions. */
2297 current->pdeath_signal = 0;
2298
2299 /* Check whether the new SID can inherit resource limits from the old
2300 * SID. If not, reset all soft limits to the lower of the current
2301 * task's hard limit and the init task's soft limit.
2302 *
2303 * Note that the setting of hard limits (even to lower them) can be
2304 * controlled by the setrlimit check. The inclusion of the init task's
2305 * soft limit into the computation is to avoid resetting soft limits
2306 * higher than the default soft limit for cases where the default is
2307 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2308 */
2309 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2310 PROCESS__RLIMITINH, NULL);
2311 if (rc) {
2312 /* protect against do_prlimit() */
2313 task_lock(current);
2314 for (i = 0; i < RLIM_NLIMITS; i++) {
2315 rlim = current->signal->rlim + i;
2316 initrlim = init_task.signal->rlim + i;
2317 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2318 }
2319 task_unlock(current);
2320 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2321 }
2322 }
2323
2324 /*
2325 * Clean up the process immediately after the installation of new credentials
2326 * due to exec
2327 */
2328 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2329 {
2330 const struct task_security_struct *tsec = current_security();
2331 struct itimerval itimer;
2332 u32 osid, sid;
2333 int rc, i;
2334
2335 osid = tsec->osid;
2336 sid = tsec->sid;
2337
2338 if (sid == osid)
2339 return;
2340
2341 /* Check whether the new SID can inherit signal state from the old SID.
2342 * If not, clear itimers to avoid subsequent signal generation and
2343 * flush and unblock signals.
2344 *
2345 * This must occur _after_ the task SID has been updated so that any
2346 * kill done after the flush will be checked against the new SID.
2347 */
2348 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2349 if (rc) {
2350 memset(&itimer, 0, sizeof itimer);
2351 for (i = 0; i < 3; i++)
2352 do_setitimer(i, &itimer, NULL);
2353 spin_lock_irq(&current->sighand->siglock);
2354 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2355 __flush_signals(current);
2356 flush_signal_handlers(current, 1);
2357 sigemptyset(&current->blocked);
2358 }
2359 spin_unlock_irq(&current->sighand->siglock);
2360 }
2361
2362 /* Wake up the parent if it is waiting so that it can recheck
2363 * wait permission to the new task SID. */
2364 read_lock(&tasklist_lock);
2365 __wake_up_parent(current, current->real_parent);
2366 read_unlock(&tasklist_lock);
2367 }
2368
2369 /* superblock security operations */
2370
2371 static int selinux_sb_alloc_security(struct super_block *sb)
2372 {
2373 return superblock_alloc_security(sb);
2374 }
2375
2376 static void selinux_sb_free_security(struct super_block *sb)
2377 {
2378 superblock_free_security(sb);
2379 }
2380
2381 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2382 {
2383 if (plen > olen)
2384 return 0;
2385
2386 return !memcmp(prefix, option, plen);
2387 }
2388
2389 static inline int selinux_option(char *option, int len)
2390 {
2391 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2392 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2393 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2394 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2395 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2396 }
2397
2398 static inline void take_option(char **to, char *from, int *first, int len)
2399 {
2400 if (!*first) {
2401 **to = ',';
2402 *to += 1;
2403 } else
2404 *first = 0;
2405 memcpy(*to, from, len);
2406 *to += len;
2407 }
2408
2409 static inline void take_selinux_option(char **to, char *from, int *first,
2410 int len)
2411 {
2412 int current_size = 0;
2413
2414 if (!*first) {
2415 **to = '|';
2416 *to += 1;
2417 } else
2418 *first = 0;
2419
2420 while (current_size < len) {
2421 if (*from != '"') {
2422 **to = *from;
2423 *to += 1;
2424 }
2425 from += 1;
2426 current_size += 1;
2427 }
2428 }
2429
2430 static int selinux_sb_copy_data(char *orig, char *copy)
2431 {
2432 int fnosec, fsec, rc = 0;
2433 char *in_save, *in_curr, *in_end;
2434 char *sec_curr, *nosec_save, *nosec;
2435 int open_quote = 0;
2436
2437 in_curr = orig;
2438 sec_curr = copy;
2439
2440 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2441 if (!nosec) {
2442 rc = -ENOMEM;
2443 goto out;
2444 }
2445
2446 nosec_save = nosec;
2447 fnosec = fsec = 1;
2448 in_save = in_end = orig;
2449
2450 do {
2451 if (*in_end == '"')
2452 open_quote = !open_quote;
2453 if ((*in_end == ',' && open_quote == 0) ||
2454 *in_end == '\0') {
2455 int len = in_end - in_curr;
2456
2457 if (selinux_option(in_curr, len))
2458 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2459 else
2460 take_option(&nosec, in_curr, &fnosec, len);
2461
2462 in_curr = in_end + 1;
2463 }
2464 } while (*in_end++);
2465
2466 strcpy(in_save, nosec_save);
2467 free_page((unsigned long)nosec_save);
2468 out:
2469 return rc;
2470 }
2471
2472 static int selinux_sb_remount(struct super_block *sb, void *data)
2473 {
2474 int rc, i, *flags;
2475 struct security_mnt_opts opts;
2476 char *secdata, **mount_options;
2477 struct superblock_security_struct *sbsec = sb->s_security;
2478
2479 if (!(sbsec->flags & SE_SBINITIALIZED))
2480 return 0;
2481
2482 if (!data)
2483 return 0;
2484
2485 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2486 return 0;
2487
2488 security_init_mnt_opts(&opts);
2489 secdata = alloc_secdata();
2490 if (!secdata)
2491 return -ENOMEM;
2492 rc = selinux_sb_copy_data(data, secdata);
2493 if (rc)
2494 goto out_free_secdata;
2495
2496 rc = selinux_parse_opts_str(secdata, &opts);
2497 if (rc)
2498 goto out_free_secdata;
2499
2500 mount_options = opts.mnt_opts;
2501 flags = opts.mnt_opts_flags;
2502
2503 for (i = 0; i < opts.num_mnt_opts; i++) {
2504 u32 sid;
2505 size_t len;
2506
2507 if (flags[i] == SBLABEL_MNT)
2508 continue;
2509 len = strlen(mount_options[i]);
2510 rc = security_context_to_sid(mount_options[i], len, &sid,
2511 GFP_KERNEL);
2512 if (rc) {
2513 printk(KERN_WARNING "SELinux: security_context_to_sid"
2514 "(%s) failed for (dev %s, type %s) errno=%d\n",
2515 mount_options[i], sb->s_id, sb->s_type->name, rc);
2516 goto out_free_opts;
2517 }
2518 rc = -EINVAL;
2519 switch (flags[i]) {
2520 case FSCONTEXT_MNT:
2521 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2522 goto out_bad_option;
2523 break;
2524 case CONTEXT_MNT:
2525 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2526 goto out_bad_option;
2527 break;
2528 case ROOTCONTEXT_MNT: {
2529 struct inode_security_struct *root_isec;
2530 root_isec = sb->s_root->d_inode->i_security;
2531
2532 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2533 goto out_bad_option;
2534 break;
2535 }
2536 case DEFCONTEXT_MNT:
2537 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2538 goto out_bad_option;
2539 break;
2540 default:
2541 goto out_free_opts;
2542 }
2543 }
2544
2545 rc = 0;
2546 out_free_opts:
2547 security_free_mnt_opts(&opts);
2548 out_free_secdata:
2549 free_secdata(secdata);
2550 return rc;
2551 out_bad_option:
2552 printk(KERN_WARNING "SELinux: unable to change security options "
2553 "during remount (dev %s, type=%s)\n", sb->s_id,
2554 sb->s_type->name);
2555 goto out_free_opts;
2556 }
2557
2558 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2559 {
2560 const struct cred *cred = current_cred();
2561 struct common_audit_data ad;
2562 int rc;
2563
2564 rc = superblock_doinit(sb, data);
2565 if (rc)
2566 return rc;
2567
2568 /* Allow all mounts performed by the kernel */
2569 if (flags & MS_KERNMOUNT)
2570 return 0;
2571
2572 ad.type = LSM_AUDIT_DATA_DENTRY;
2573 ad.u.dentry = sb->s_root;
2574 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2575 }
2576
2577 static int selinux_sb_statfs(struct dentry *dentry)
2578 {
2579 const struct cred *cred = current_cred();
2580 struct common_audit_data ad;
2581
2582 ad.type = LSM_AUDIT_DATA_DENTRY;
2583 ad.u.dentry = dentry->d_sb->s_root;
2584 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2585 }
2586
2587 static int selinux_mount(const char *dev_name,
2588 struct path *path,
2589 const char *type,
2590 unsigned long flags,
2591 void *data)
2592 {
2593 const struct cred *cred = current_cred();
2594
2595 if (flags & MS_REMOUNT)
2596 return superblock_has_perm(cred, path->dentry->d_sb,
2597 FILESYSTEM__REMOUNT, NULL);
2598 else
2599 return path_has_perm(cred, path, FILE__MOUNTON);
2600 }
2601
2602 static int selinux_umount(struct vfsmount *mnt, int flags)
2603 {
2604 const struct cred *cred = current_cred();
2605
2606 return superblock_has_perm(cred, mnt->mnt_sb,
2607 FILESYSTEM__UNMOUNT, NULL);
2608 }
2609
2610 /* inode security operations */
2611
2612 static int selinux_inode_alloc_security(struct inode *inode)
2613 {
2614 return inode_alloc_security(inode);
2615 }
2616
2617 static void selinux_inode_free_security(struct inode *inode)
2618 {
2619 inode_free_security(inode);
2620 }
2621
2622 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2623 struct qstr *name, void **ctx,
2624 u32 *ctxlen)
2625 {
2626 const struct cred *cred = current_cred();
2627 struct task_security_struct *tsec;
2628 struct inode_security_struct *dsec;
2629 struct superblock_security_struct *sbsec;
2630 struct inode *dir = dentry->d_parent->d_inode;
2631 u32 newsid;
2632 int rc;
2633
2634 tsec = cred->security;
2635 dsec = dir->i_security;
2636 sbsec = dir->i_sb->s_security;
2637
2638 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2639 newsid = tsec->create_sid;
2640 } else {
2641 rc = security_transition_sid(tsec->sid, dsec->sid,
2642 inode_mode_to_security_class(mode),
2643 name,
2644 &newsid);
2645 if (rc) {
2646 printk(KERN_WARNING
2647 "%s: security_transition_sid failed, rc=%d\n",
2648 __func__, -rc);
2649 return rc;
2650 }
2651 }
2652
2653 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2654 }
2655
2656 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2657 const struct qstr *qstr,
2658 const char **name,
2659 void **value, size_t *len)
2660 {
2661 const struct task_security_struct *tsec = current_security();
2662 struct inode_security_struct *dsec;
2663 struct superblock_security_struct *sbsec;
2664 u32 sid, newsid, clen;
2665 int rc;
2666 char *context;
2667
2668 dsec = dir->i_security;
2669 sbsec = dir->i_sb->s_security;
2670
2671 sid = tsec->sid;
2672 newsid = tsec->create_sid;
2673
2674 if ((sbsec->flags & SE_SBINITIALIZED) &&
2675 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2676 newsid = sbsec->mntpoint_sid;
2677 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2678 rc = security_transition_sid(sid, dsec->sid,
2679 inode_mode_to_security_class(inode->i_mode),
2680 qstr, &newsid);
2681 if (rc) {
2682 printk(KERN_WARNING "%s: "
2683 "security_transition_sid failed, rc=%d (dev=%s "
2684 "ino=%ld)\n",
2685 __func__,
2686 -rc, inode->i_sb->s_id, inode->i_ino);
2687 return rc;
2688 }
2689 }
2690
2691 /* Possibly defer initialization to selinux_complete_init. */
2692 if (sbsec->flags & SE_SBINITIALIZED) {
2693 struct inode_security_struct *isec = inode->i_security;
2694 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2695 isec->sid = newsid;
2696 isec->initialized = 1;
2697 }
2698
2699 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2700 return -EOPNOTSUPP;
2701
2702 if (name)
2703 *name = XATTR_SELINUX_SUFFIX;
2704
2705 if (value && len) {
2706 rc = security_sid_to_context_force(newsid, &context, &clen);
2707 if (rc)
2708 return rc;
2709 *value = context;
2710 *len = clen;
2711 }
2712
2713 return 0;
2714 }
2715
2716 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2717 {
2718 return may_create(dir, dentry, SECCLASS_FILE);
2719 }
2720
2721 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2722 {
2723 return may_link(dir, old_dentry, MAY_LINK);
2724 }
2725
2726 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2727 {
2728 return may_link(dir, dentry, MAY_UNLINK);
2729 }
2730
2731 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2732 {
2733 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2734 }
2735
2736 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2737 {
2738 return may_create(dir, dentry, SECCLASS_DIR);
2739 }
2740
2741 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2742 {
2743 return may_link(dir, dentry, MAY_RMDIR);
2744 }
2745
2746 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2747 {
2748 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2749 }
2750
2751 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2752 struct inode *new_inode, struct dentry *new_dentry)
2753 {
2754 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2755 }
2756
2757 static int selinux_inode_readlink(struct dentry *dentry)
2758 {
2759 const struct cred *cred = current_cred();
2760
2761 return dentry_has_perm(cred, dentry, FILE__READ);
2762 }
2763
2764 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2765 {
2766 const struct cred *cred = current_cred();
2767
2768 return dentry_has_perm(cred, dentry, FILE__READ);
2769 }
2770
2771 static noinline int audit_inode_permission(struct inode *inode,
2772 u32 perms, u32 audited, u32 denied,
2773 unsigned flags)
2774 {
2775 struct common_audit_data ad;
2776 struct inode_security_struct *isec = inode->i_security;
2777 int rc;
2778
2779 ad.type = LSM_AUDIT_DATA_INODE;
2780 ad.u.inode = inode;
2781
2782 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2783 audited, denied, &ad, flags);
2784 if (rc)
2785 return rc;
2786 return 0;
2787 }
2788
2789 static int selinux_inode_permission(struct inode *inode, int mask)
2790 {
2791 const struct cred *cred = current_cred();
2792 u32 perms;
2793 bool from_access;
2794 unsigned flags = mask & MAY_NOT_BLOCK;
2795 struct inode_security_struct *isec;
2796 u32 sid;
2797 struct av_decision avd;
2798 int rc, rc2;
2799 u32 audited, denied;
2800
2801 from_access = mask & MAY_ACCESS;
2802 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2803
2804 /* No permission to check. Existence test. */
2805 if (!mask)
2806 return 0;
2807
2808 validate_creds(cred);
2809
2810 if (unlikely(IS_PRIVATE(inode)))
2811 return 0;
2812
2813 perms = file_mask_to_av(inode->i_mode, mask);
2814
2815 sid = cred_sid(cred);
2816 isec = inode->i_security;
2817
2818 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2819 audited = avc_audit_required(perms, &avd, rc,
2820 from_access ? FILE__AUDIT_ACCESS : 0,
2821 &denied);
2822 if (likely(!audited))
2823 return rc;
2824
2825 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2826 if (rc2)
2827 return rc2;
2828 return rc;
2829 }
2830
2831 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2832 {
2833 const struct cred *cred = current_cred();
2834 unsigned int ia_valid = iattr->ia_valid;
2835 __u32 av = FILE__WRITE;
2836
2837 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2838 if (ia_valid & ATTR_FORCE) {
2839 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2840 ATTR_FORCE);
2841 if (!ia_valid)
2842 return 0;
2843 }
2844
2845 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2846 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2847 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2848
2849 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2850 av |= FILE__OPEN;
2851
2852 return dentry_has_perm(cred, dentry, av);
2853 }
2854
2855 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2856 {
2857 const struct cred *cred = current_cred();
2858 struct path path;
2859
2860 path.dentry = dentry;
2861 path.mnt = mnt;
2862
2863 return path_has_perm(cred, &path, FILE__GETATTR);
2864 }
2865
2866 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2867 {
2868 const struct cred *cred = current_cred();
2869
2870 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2871 sizeof XATTR_SECURITY_PREFIX - 1)) {
2872 if (!strcmp(name, XATTR_NAME_CAPS)) {
2873 if (!capable(CAP_SETFCAP))
2874 return -EPERM;
2875 } else if (!capable(CAP_SYS_ADMIN)) {
2876 /* A different attribute in the security namespace.
2877 Restrict to administrator. */
2878 return -EPERM;
2879 }
2880 }
2881
2882 /* Not an attribute we recognize, so just check the
2883 ordinary setattr permission. */
2884 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2885 }
2886
2887 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2888 const void *value, size_t size, int flags)
2889 {
2890 struct inode *inode = dentry->d_inode;
2891 struct inode_security_struct *isec = inode->i_security;
2892 struct superblock_security_struct *sbsec;
2893 struct common_audit_data ad;
2894 u32 newsid, sid = current_sid();
2895 int rc = 0;
2896
2897 if (strcmp(name, XATTR_NAME_SELINUX))
2898 return selinux_inode_setotherxattr(dentry, name);
2899
2900 sbsec = inode->i_sb->s_security;
2901 if (!(sbsec->flags & SBLABEL_MNT))
2902 return -EOPNOTSUPP;
2903
2904 if (!inode_owner_or_capable(inode))
2905 return -EPERM;
2906
2907 ad.type = LSM_AUDIT_DATA_DENTRY;
2908 ad.u.dentry = dentry;
2909
2910 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2911 FILE__RELABELFROM, &ad);
2912 if (rc)
2913 return rc;
2914
2915 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2916 if (rc == -EINVAL) {
2917 if (!capable(CAP_MAC_ADMIN)) {
2918 struct audit_buffer *ab;
2919 size_t audit_size;
2920 const char *str;
2921
2922 /* We strip a nul only if it is at the end, otherwise the
2923 * context contains a nul and we should audit that */
2924 if (value) {
2925 str = value;
2926 if (str[size - 1] == '\0')
2927 audit_size = size - 1;
2928 else
2929 audit_size = size;
2930 } else {
2931 str = "";
2932 audit_size = 0;
2933 }
2934 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2935 audit_log_format(ab, "op=setxattr invalid_context=");
2936 audit_log_n_untrustedstring(ab, value, audit_size);
2937 audit_log_end(ab);
2938
2939 return rc;
2940 }
2941 rc = security_context_to_sid_force(value, size, &newsid);
2942 }
2943 if (rc)
2944 return rc;
2945
2946 rc = avc_has_perm(sid, newsid, isec->sclass,
2947 FILE__RELABELTO, &ad);
2948 if (rc)
2949 return rc;
2950
2951 rc = security_validate_transition(isec->sid, newsid, sid,
2952 isec->sclass);
2953 if (rc)
2954 return rc;
2955
2956 return avc_has_perm(newsid,
2957 sbsec->sid,
2958 SECCLASS_FILESYSTEM,
2959 FILESYSTEM__ASSOCIATE,
2960 &ad);
2961 }
2962
2963 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2964 const void *value, size_t size,
2965 int flags)
2966 {
2967 struct inode *inode = dentry->d_inode;
2968 struct inode_security_struct *isec = inode->i_security;
2969 u32 newsid;
2970 int rc;
2971
2972 if (strcmp(name, XATTR_NAME_SELINUX)) {
2973 /* Not an attribute we recognize, so nothing to do. */
2974 return;
2975 }
2976
2977 rc = security_context_to_sid_force(value, size, &newsid);
2978 if (rc) {
2979 printk(KERN_ERR "SELinux: unable to map context to SID"
2980 "for (%s, %lu), rc=%d\n",
2981 inode->i_sb->s_id, inode->i_ino, -rc);
2982 return;
2983 }
2984
2985 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2986 isec->sid = newsid;
2987 isec->initialized = 1;
2988
2989 return;
2990 }
2991
2992 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2993 {
2994 const struct cred *cred = current_cred();
2995
2996 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2997 }
2998
2999 static int selinux_inode_listxattr(struct dentry *dentry)
3000 {
3001 const struct cred *cred = current_cred();
3002
3003 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3004 }
3005
3006 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3007 {
3008 if (strcmp(name, XATTR_NAME_SELINUX))
3009 return selinux_inode_setotherxattr(dentry, name);
3010
3011 /* No one is allowed to remove a SELinux security label.
3012 You can change the label, but all data must be labeled. */
3013 return -EACCES;
3014 }
3015
3016 /*
3017 * Copy the inode security context value to the user.
3018 *
3019 * Permission check is handled by selinux_inode_getxattr hook.
3020 */
3021 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3022 {
3023 u32 size;
3024 int error;
3025 char *context = NULL;
3026 struct inode_security_struct *isec = inode->i_security;
3027
3028 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3029 return -EOPNOTSUPP;
3030
3031 /*
3032 * If the caller has CAP_MAC_ADMIN, then get the raw context
3033 * value even if it is not defined by current policy; otherwise,
3034 * use the in-core value under current policy.
3035 * Use the non-auditing forms of the permission checks since
3036 * getxattr may be called by unprivileged processes commonly
3037 * and lack of permission just means that we fall back to the
3038 * in-core context value, not a denial.
3039 */
3040 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3041 SECURITY_CAP_NOAUDIT);
3042 if (!error)
3043 error = security_sid_to_context_force(isec->sid, &context,
3044 &size);
3045 else
3046 error = security_sid_to_context(isec->sid, &context, &size);
3047 if (error)
3048 return error;
3049 error = size;
3050 if (alloc) {
3051 *buffer = context;
3052 goto out_nofree;
3053 }
3054 kfree(context);
3055 out_nofree:
3056 return error;
3057 }
3058
3059 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3060 const void *value, size_t size, int flags)
3061 {
3062 struct inode_security_struct *isec = inode->i_security;
3063 u32 newsid;
3064 int rc;
3065
3066 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3067 return -EOPNOTSUPP;
3068
3069 if (!value || !size)
3070 return -EACCES;
3071
3072 rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3073 if (rc)
3074 return rc;
3075
3076 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3077 isec->sid = newsid;
3078 isec->initialized = 1;
3079 return 0;
3080 }
3081
3082 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3083 {
3084 const int len = sizeof(XATTR_NAME_SELINUX);
3085 if (buffer && len <= buffer_size)
3086 memcpy(buffer, XATTR_NAME_SELINUX, len);
3087 return len;
3088 }
3089
3090 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3091 {
3092 struct inode_security_struct *isec = inode->i_security;
3093 *secid = isec->sid;
3094 }
3095
3096 /* file security operations */
3097
3098 static int selinux_revalidate_file_permission(struct file *file, int mask)
3099 {
3100 const struct cred *cred = current_cred();
3101 struct inode *inode = file_inode(file);
3102
3103 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3104 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3105 mask |= MAY_APPEND;
3106
3107 return file_has_perm(cred, file,
3108 file_mask_to_av(inode->i_mode, mask));
3109 }
3110
3111 static int selinux_file_permission(struct file *file, int mask)
3112 {
3113 struct inode *inode = file_inode(file);
3114 struct file_security_struct *fsec = file->f_security;
3115 struct inode_security_struct *isec = inode->i_security;
3116 u32 sid = current_sid();
3117
3118 if (!mask)
3119 /* No permission to check. Existence test. */
3120 return 0;
3121
3122 if (sid == fsec->sid && fsec->isid == isec->sid &&
3123 fsec->pseqno == avc_policy_seqno())
3124 /* No change since file_open check. */
3125 return 0;
3126
3127 return selinux_revalidate_file_permission(file, mask);
3128 }
3129
3130 static int selinux_file_alloc_security(struct file *file)
3131 {
3132 return file_alloc_security(file);
3133 }
3134
3135 static void selinux_file_free_security(struct file *file)
3136 {
3137 file_free_security(file);
3138 }
3139
3140 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3141 unsigned long arg)
3142 {
3143 const struct cred *cred = current_cred();
3144 int error = 0;
3145
3146 switch (cmd) {
3147 case FIONREAD:
3148 /* fall through */
3149 case FIBMAP:
3150 /* fall through */
3151 case FIGETBSZ:
3152 /* fall through */
3153 case FS_IOC_GETFLAGS:
3154 /* fall through */
3155 case FS_IOC_GETVERSION:
3156 error = file_has_perm(cred, file, FILE__GETATTR);
3157 break;
3158
3159 case FS_IOC_SETFLAGS:
3160 /* fall through */
3161 case FS_IOC_SETVERSION:
3162 error = file_has_perm(cred, file, FILE__SETATTR);
3163 break;
3164
3165 /* sys_ioctl() checks */
3166 case FIONBIO:
3167 /* fall through */
3168 case FIOASYNC:
3169 error = file_has_perm(cred, file, 0);
3170 break;
3171
3172 case KDSKBENT:
3173 case KDSKBSENT:
3174 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3175 SECURITY_CAP_AUDIT);
3176 break;
3177
3178 /* default case assumes that the command will go
3179 * to the file's ioctl() function.
3180 */
3181 default:
3182 error = file_has_perm(cred, file, FILE__IOCTL);
3183 }
3184 return error;
3185 }
3186
3187 static int default_noexec;
3188
3189 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3190 {
3191 const struct cred *cred = current_cred();
3192 int rc = 0;
3193
3194 if (default_noexec &&
3195 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3196 /*
3197 * We are making executable an anonymous mapping or a
3198 * private file mapping that will also be writable.
3199 * This has an additional check.
3200 */
3201 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3202 if (rc)
3203 goto error;
3204 }
3205
3206 if (file) {
3207 /* read access is always possible with a mapping */
3208 u32 av = FILE__READ;
3209
3210 /* write access only matters if the mapping is shared */
3211 if (shared && (prot & PROT_WRITE))
3212 av |= FILE__WRITE;
3213
3214 if (prot & PROT_EXEC)
3215 av |= FILE__EXECUTE;
3216
3217 return file_has_perm(cred, file, av);
3218 }
3219
3220 error:
3221 return rc;
3222 }
3223
3224 static int selinux_mmap_addr(unsigned long addr)
3225 {
3226 int rc;
3227
3228 /* do DAC check on address space usage */
3229 rc = cap_mmap_addr(addr);
3230 if (rc)
3231 return rc;
3232
3233 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3234 u32 sid = current_sid();
3235 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3236 MEMPROTECT__MMAP_ZERO, NULL);
3237 }
3238
3239 return rc;
3240 }
3241
3242 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3243 unsigned long prot, unsigned long flags)
3244 {
3245 if (selinux_checkreqprot)
3246 prot = reqprot;
3247
3248 return file_map_prot_check(file, prot,
3249 (flags & MAP_TYPE) == MAP_SHARED);
3250 }
3251
3252 static int selinux_file_mprotect(struct vm_area_struct *vma,
3253 unsigned long reqprot,
3254 unsigned long prot)
3255 {
3256 const struct cred *cred = current_cred();
3257
3258 if (selinux_checkreqprot)
3259 prot = reqprot;
3260
3261 if (default_noexec &&
3262 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3263 int rc = 0;
3264 if (vma->vm_start >= vma->vm_mm->start_brk &&
3265 vma->vm_end <= vma->vm_mm->brk) {
3266 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3267 } else if (!vma->vm_file &&
3268 vma->vm_start <= vma->vm_mm->start_stack &&
3269 vma->vm_end >= vma->vm_mm->start_stack) {
3270 rc = current_has_perm(current, PROCESS__EXECSTACK);
3271 } else if (vma->vm_file && vma->anon_vma) {
3272 /*
3273 * We are making executable a file mapping that has
3274 * had some COW done. Since pages might have been
3275 * written, check ability to execute the possibly
3276 * modified content. This typically should only
3277 * occur for text relocations.
3278 */
3279 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3280 }
3281 if (rc)
3282 return rc;
3283 }
3284
3285 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3286 }
3287
3288 static int selinux_file_lock(struct file *file, unsigned int cmd)
3289 {
3290 const struct cred *cred = current_cred();
3291
3292 return file_has_perm(cred, file, FILE__LOCK);
3293 }
3294
3295 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3296 unsigned long arg)
3297 {
3298 const struct cred *cred = current_cred();
3299 int err = 0;
3300
3301 switch (cmd) {
3302 case F_SETFL:
3303 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3304 err = file_has_perm(cred, file, FILE__WRITE);
3305 break;
3306 }
3307 /* fall through */
3308 case F_SETOWN:
3309 case F_SETSIG:
3310 case F_GETFL:
3311 case F_GETOWN:
3312 case F_GETSIG:
3313 case F_GETOWNER_UIDS:
3314 /* Just check FD__USE permission */
3315 err = file_has_perm(cred, file, 0);
3316 break;
3317 case F_GETLK:
3318 case F_SETLK:
3319 case F_SETLKW:
3320 #if BITS_PER_LONG == 32
3321 case F_GETLK64:
3322 case F_SETLK64:
3323 case F_SETLKW64:
3324 #endif
3325 err = file_has_perm(cred, file, FILE__LOCK);
3326 break;
3327 }
3328
3329 return err;
3330 }
3331
3332 static int selinux_file_set_fowner(struct file *file)
3333 {
3334 struct file_security_struct *fsec;
3335
3336 fsec = file->f_security;
3337 fsec->fown_sid = current_sid();
3338
3339 return 0;
3340 }
3341
3342 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3343 struct fown_struct *fown, int signum)
3344 {
3345 struct file *file;
3346 u32 sid = task_sid(tsk);
3347 u32 perm;
3348 struct file_security_struct *fsec;
3349
3350 /* struct fown_struct is never outside the context of a struct file */
3351 file = container_of(fown, struct file, f_owner);
3352
3353 fsec = file->f_security;
3354
3355 if (!signum)
3356 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3357 else
3358 perm = signal_to_av(signum);
3359
3360 return avc_has_perm(fsec->fown_sid, sid,
3361 SECCLASS_PROCESS, perm, NULL);
3362 }
3363
3364 static int selinux_file_receive(struct file *file)
3365 {
3366 const struct cred *cred = current_cred();
3367
3368 return file_has_perm(cred, file, file_to_av(file));
3369 }
3370
3371 static int selinux_file_open(struct file *file, const struct cred *cred)
3372 {
3373 struct file_security_struct *fsec;
3374 struct inode_security_struct *isec;
3375
3376 fsec = file->f_security;
3377 isec = file_inode(file)->i_security;
3378 /*
3379 * Save inode label and policy sequence number
3380 * at open-time so that selinux_file_permission
3381 * can determine whether revalidation is necessary.
3382 * Task label is already saved in the file security
3383 * struct as its SID.
3384 */
3385 fsec->isid = isec->sid;
3386 fsec->pseqno = avc_policy_seqno();
3387 /*
3388 * Since the inode label or policy seqno may have changed
3389 * between the selinux_inode_permission check and the saving
3390 * of state above, recheck that access is still permitted.
3391 * Otherwise, access might never be revalidated against the
3392 * new inode label or new policy.
3393 * This check is not redundant - do not remove.
3394 */
3395 return file_path_has_perm(cred, file, open_file_to_av(file));
3396 }
3397
3398 /* task security operations */
3399
3400 static int selinux_task_create(unsigned long clone_flags)
3401 {
3402 return current_has_perm(current, PROCESS__FORK);
3403 }
3404
3405 /*
3406 * allocate the SELinux part of blank credentials
3407 */
3408 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3409 {
3410 struct task_security_struct *tsec;
3411
3412 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3413 if (!tsec)
3414 return -ENOMEM;
3415
3416 cred->security = tsec;
3417 return 0;
3418 }
3419
3420 /*
3421 * detach and free the LSM part of a set of credentials
3422 */
3423 static void selinux_cred_free(struct cred *cred)
3424 {
3425 struct task_security_struct *tsec = cred->security;
3426
3427 /*
3428 * cred->security == NULL if security_cred_alloc_blank() or
3429 * security_prepare_creds() returned an error.
3430 */
3431 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3432 cred->security = (void *) 0x7UL;
3433 kfree(tsec);
3434 }
3435
3436 /*
3437 * prepare a new set of credentials for modification
3438 */
3439 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3440 gfp_t gfp)
3441 {
3442 const struct task_security_struct *old_tsec;
3443 struct task_security_struct *tsec;
3444
3445 old_tsec = old->security;
3446
3447 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3448 if (!tsec)
3449 return -ENOMEM;
3450
3451 new->security = tsec;
3452 return 0;
3453 }
3454
3455 /*
3456 * transfer the SELinux data to a blank set of creds
3457 */
3458 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3459 {
3460 const struct task_security_struct *old_tsec = old->security;
3461 struct task_security_struct *tsec = new->security;
3462
3463 *tsec = *old_tsec;
3464 }
3465
3466 /*
3467 * set the security data for a kernel service
3468 * - all the creation contexts are set to unlabelled
3469 */
3470 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3471 {
3472 struct task_security_struct *tsec = new->security;
3473 u32 sid = current_sid();
3474 int ret;
3475
3476 ret = avc_has_perm(sid, secid,
3477 SECCLASS_KERNEL_SERVICE,
3478 KERNEL_SERVICE__USE_AS_OVERRIDE,
3479 NULL);
3480 if (ret == 0) {
3481 tsec->sid = secid;
3482 tsec->create_sid = 0;
3483 tsec->keycreate_sid = 0;
3484 tsec->sockcreate_sid = 0;
3485 }
3486 return ret;
3487 }
3488
3489 /*
3490 * set the file creation context in a security record to the same as the
3491 * objective context of the specified inode
3492 */
3493 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3494 {
3495 struct inode_security_struct *isec = inode->i_security;
3496 struct task_security_struct *tsec = new->security;
3497 u32 sid = current_sid();
3498 int ret;
3499
3500 ret = avc_has_perm(sid, isec->sid,
3501 SECCLASS_KERNEL_SERVICE,
3502 KERNEL_SERVICE__CREATE_FILES_AS,
3503 NULL);
3504
3505 if (ret == 0)
3506 tsec->create_sid = isec->sid;
3507 return ret;
3508 }
3509
3510 static int selinux_kernel_module_request(char *kmod_name)
3511 {
3512 u32 sid;
3513 struct common_audit_data ad;
3514
3515 sid = task_sid(current);
3516
3517 ad.type = LSM_AUDIT_DATA_KMOD;
3518 ad.u.kmod_name = kmod_name;
3519
3520 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3521 SYSTEM__MODULE_REQUEST, &ad);
3522 }
3523
3524 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3525 {
3526 return current_has_perm(p, PROCESS__SETPGID);
3527 }
3528
3529 static int selinux_task_getpgid(struct task_struct *p)
3530 {
3531 return current_has_perm(p, PROCESS__GETPGID);
3532 }
3533
3534 static int selinux_task_getsid(struct task_struct *p)
3535 {
3536 return current_has_perm(p, PROCESS__GETSESSION);
3537 }
3538
3539 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3540 {
3541 *secid = task_sid(p);
3542 }
3543
3544 static int selinux_task_setnice(struct task_struct *p, int nice)
3545 {
3546 int rc;
3547
3548 rc = cap_task_setnice(p, nice);
3549 if (rc)
3550 return rc;
3551
3552 return current_has_perm(p, PROCESS__SETSCHED);
3553 }
3554
3555 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3556 {
3557 int rc;
3558
3559 rc = cap_task_setioprio(p, ioprio);
3560 if (rc)
3561 return rc;
3562
3563 return current_has_perm(p, PROCESS__SETSCHED);
3564 }
3565
3566 static int selinux_task_getioprio(struct task_struct *p)
3567 {
3568 return current_has_perm(p, PROCESS__GETSCHED);
3569 }
3570
3571 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3572 struct rlimit *new_rlim)
3573 {
3574 struct rlimit *old_rlim = p->signal->rlim + resource;
3575
3576 /* Control the ability to change the hard limit (whether
3577 lowering or raising it), so that the hard limit can
3578 later be used as a safe reset point for the soft limit
3579 upon context transitions. See selinux_bprm_committing_creds. */
3580 if (old_rlim->rlim_max != new_rlim->rlim_max)
3581 return current_has_perm(p, PROCESS__SETRLIMIT);
3582
3583 return 0;
3584 }
3585
3586 static int selinux_task_setscheduler(struct task_struct *p)
3587 {
3588 int rc;
3589
3590 rc = cap_task_setscheduler(p);
3591 if (rc)
3592 return rc;
3593
3594 return current_has_perm(p, PROCESS__SETSCHED);
3595 }
3596
3597 static int selinux_task_getscheduler(struct task_struct *p)
3598 {
3599 return current_has_perm(p, PROCESS__GETSCHED);
3600 }
3601
3602 static int selinux_task_movememory(struct task_struct *p)
3603 {
3604 return current_has_perm(p, PROCESS__SETSCHED);
3605 }
3606
3607 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3608 int sig, u32 secid)
3609 {
3610 u32 perm;
3611 int rc;
3612
3613 if (!sig)
3614 perm = PROCESS__SIGNULL; /* null signal; existence test */
3615 else
3616 perm = signal_to_av(sig);
3617 if (secid)
3618 rc = avc_has_perm(secid, task_sid(p),
3619 SECCLASS_PROCESS, perm, NULL);
3620 else
3621 rc = current_has_perm(p, perm);
3622 return rc;
3623 }
3624
3625 static int selinux_task_wait(struct task_struct *p)
3626 {
3627 return task_has_perm(p, current, PROCESS__SIGCHLD);
3628 }
3629
3630 static void selinux_task_to_inode(struct task_struct *p,
3631 struct inode *inode)
3632 {
3633 struct inode_security_struct *isec = inode->i_security;
3634 u32 sid = task_sid(p);
3635
3636 isec->sid = sid;
3637 isec->initialized = 1;
3638 }
3639
3640 /* Returns error only if unable to parse addresses */
3641 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3642 struct common_audit_data *ad, u8 *proto)
3643 {
3644 int offset, ihlen, ret = -EINVAL;
3645 struct iphdr _iph, *ih;
3646
3647 offset = skb_network_offset(skb);
3648 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3649 if (ih == NULL)
3650 goto out;
3651
3652 ihlen = ih->ihl * 4;
3653 if (ihlen < sizeof(_iph))
3654 goto out;
3655
3656 ad->u.net->v4info.saddr = ih->saddr;
3657 ad->u.net->v4info.daddr = ih->daddr;
3658 ret = 0;
3659
3660 if (proto)
3661 *proto = ih->protocol;
3662
3663 switch (ih->protocol) {
3664 case IPPROTO_TCP: {
3665 struct tcphdr _tcph, *th;
3666
3667 if (ntohs(ih->frag_off) & IP_OFFSET)
3668 break;
3669
3670 offset += ihlen;
3671 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3672 if (th == NULL)
3673 break;
3674
3675 ad->u.net->sport = th->source;
3676 ad->u.net->dport = th->dest;
3677 break;
3678 }
3679
3680 case IPPROTO_UDP: {
3681 struct udphdr _udph, *uh;
3682
3683 if (ntohs(ih->frag_off) & IP_OFFSET)
3684 break;
3685
3686 offset += ihlen;
3687 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3688 if (uh == NULL)
3689 break;
3690
3691 ad->u.net->sport = uh->source;
3692 ad->u.net->dport = uh->dest;
3693 break;
3694 }
3695
3696 case IPPROTO_DCCP: {
3697 struct dccp_hdr _dccph, *dh;
3698
3699 if (ntohs(ih->frag_off) & IP_OFFSET)
3700 break;
3701
3702 offset += ihlen;
3703 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3704 if (dh == NULL)
3705 break;
3706
3707 ad->u.net->sport = dh->dccph_sport;
3708 ad->u.net->dport = dh->dccph_dport;
3709 break;
3710 }
3711
3712 default:
3713 break;
3714 }
3715 out:
3716 return ret;
3717 }
3718
3719 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3720
3721 /* Returns error only if unable to parse addresses */
3722 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3723 struct common_audit_data *ad, u8 *proto)
3724 {
3725 u8 nexthdr;
3726 int ret = -EINVAL, offset;
3727 struct ipv6hdr _ipv6h, *ip6;
3728 __be16 frag_off;
3729
3730 offset = skb_network_offset(skb);
3731 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3732 if (ip6 == NULL)
3733 goto out;
3734
3735 ad->u.net->v6info.saddr = ip6->saddr;
3736 ad->u.net->v6info.daddr = ip6->daddr;
3737 ret = 0;
3738
3739 nexthdr = ip6->nexthdr;
3740 offset += sizeof(_ipv6h);
3741 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3742 if (offset < 0)
3743 goto out;
3744
3745 if (proto)
3746 *proto = nexthdr;
3747
3748 switch (nexthdr) {
3749 case IPPROTO_TCP: {
3750 struct tcphdr _tcph, *th;
3751
3752 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3753 if (th == NULL)
3754 break;
3755
3756 ad->u.net->sport = th->source;
3757 ad->u.net->dport = th->dest;
3758 break;
3759 }
3760
3761 case IPPROTO_UDP: {
3762 struct udphdr _udph, *uh;
3763
3764 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3765 if (uh == NULL)
3766 break;
3767
3768 ad->u.net->sport = uh->source;
3769 ad->u.net->dport = uh->dest;
3770 break;
3771 }
3772
3773 case IPPROTO_DCCP: {
3774 struct dccp_hdr _dccph, *dh;
3775
3776 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3777 if (dh == NULL)
3778 break;
3779
3780 ad->u.net->sport = dh->dccph_sport;
3781 ad->u.net->dport = dh->dccph_dport;
3782 break;
3783 }
3784
3785 /* includes fragments */
3786 default:
3787 break;
3788 }
3789 out:
3790 return ret;
3791 }
3792
3793 #endif /* IPV6 */
3794
3795 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3796 char **_addrp, int src, u8 *proto)
3797 {
3798 char *addrp;
3799 int ret;
3800
3801 switch (ad->u.net->family) {
3802 case PF_INET:
3803 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3804 if (ret)
3805 goto parse_error;
3806 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3807 &ad->u.net->v4info.daddr);
3808 goto okay;
3809
3810 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3811 case PF_INET6:
3812 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3813 if (ret)
3814 goto parse_error;
3815 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3816 &ad->u.net->v6info.daddr);
3817 goto okay;
3818 #endif /* IPV6 */
3819 default:
3820 addrp = NULL;
3821 goto okay;
3822 }
3823
3824 parse_error:
3825 printk(KERN_WARNING
3826 "SELinux: failure in selinux_parse_skb(),"
3827 " unable to parse packet\n");
3828 return ret;
3829
3830 okay:
3831 if (_addrp)
3832 *_addrp = addrp;
3833 return 0;
3834 }
3835
3836 /**
3837 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3838 * @skb: the packet
3839 * @family: protocol family
3840 * @sid: the packet's peer label SID
3841 *
3842 * Description:
3843 * Check the various different forms of network peer labeling and determine
3844 * the peer label/SID for the packet; most of the magic actually occurs in
3845 * the security server function security_net_peersid_cmp(). The function
3846 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3847 * or -EACCES if @sid is invalid due to inconsistencies with the different
3848 * peer labels.
3849 *
3850 */
3851 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3852 {
3853 int err;
3854 u32 xfrm_sid;
3855 u32 nlbl_sid;
3856 u32 nlbl_type;
3857
3858 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3859 if (unlikely(err))
3860 return -EACCES;
3861 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3862 if (unlikely(err))
3863 return -EACCES;
3864
3865 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3866 if (unlikely(err)) {
3867 printk(KERN_WARNING
3868 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3869 " unable to determine packet's peer label\n");
3870 return -EACCES;
3871 }
3872
3873 return 0;
3874 }
3875
3876 /**
3877 * selinux_conn_sid - Determine the child socket label for a connection
3878 * @sk_sid: the parent socket's SID
3879 * @skb_sid: the packet's SID
3880 * @conn_sid: the resulting connection SID
3881 *
3882 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3883 * combined with the MLS information from @skb_sid in order to create
3884 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3885 * of @sk_sid. Returns zero on success, negative values on failure.
3886 *
3887 */
3888 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3889 {
3890 int err = 0;
3891
3892 if (skb_sid != SECSID_NULL)
3893 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3894 else
3895 *conn_sid = sk_sid;
3896
3897 return err;
3898 }
3899
3900 /* socket security operations */
3901
3902 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3903 u16 secclass, u32 *socksid)
3904 {
3905 if (tsec->sockcreate_sid > SECSID_NULL) {
3906 *socksid = tsec->sockcreate_sid;
3907 return 0;
3908 }
3909
3910 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3911 socksid);
3912 }
3913
3914 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3915 {
3916 struct sk_security_struct *sksec = sk->sk_security;
3917 struct common_audit_data ad;
3918 struct lsm_network_audit net = {0,};
3919 u32 tsid = task_sid(task);
3920
3921 if (sksec->sid == SECINITSID_KERNEL)
3922 return 0;
3923
3924 ad.type = LSM_AUDIT_DATA_NET;
3925 ad.u.net = &net;
3926 ad.u.net->sk = sk;
3927
3928 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3929 }
3930
3931 static int selinux_socket_create(int family, int type,
3932 int protocol, int kern)
3933 {
3934 const struct task_security_struct *tsec = current_security();
3935 u32 newsid;
3936 u16 secclass;
3937 int rc;
3938
3939 if (kern)
3940 return 0;
3941
3942 secclass = socket_type_to_security_class(family, type, protocol);
3943 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3944 if (rc)
3945 return rc;
3946
3947 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3948 }
3949
3950 static int selinux_socket_post_create(struct socket *sock, int family,
3951 int type, int protocol, int kern)
3952 {
3953 const struct task_security_struct *tsec = current_security();
3954 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3955 struct sk_security_struct *sksec;
3956 int err = 0;
3957
3958 isec->sclass = socket_type_to_security_class(family, type, protocol);
3959
3960 if (kern)
3961 isec->sid = SECINITSID_KERNEL;
3962 else {
3963 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3964 if (err)
3965 return err;
3966 }
3967
3968 isec->initialized = 1;
3969
3970 if (sock->sk) {
3971 sksec = sock->sk->sk_security;
3972 sksec->sid = isec->sid;
3973 sksec->sclass = isec->sclass;
3974 err = selinux_netlbl_socket_post_create(sock->sk, family);
3975 }
3976
3977 return err;
3978 }
3979
3980 /* Range of port numbers used to automatically bind.
3981 Need to determine whether we should perform a name_bind
3982 permission check between the socket and the port number. */
3983
3984 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3985 {
3986 struct sock *sk = sock->sk;
3987 u16 family;
3988 int err;
3989
3990 err = sock_has_perm(current, sk, SOCKET__BIND);
3991 if (err)
3992 goto out;
3993
3994 /*
3995 * If PF_INET or PF_INET6, check name_bind permission for the port.
3996 * Multiple address binding for SCTP is not supported yet: we just
3997 * check the first address now.
3998 */
3999 family = sk->sk_family;
4000 if (family == PF_INET || family == PF_INET6) {
4001 char *addrp;
4002 struct sk_security_struct *sksec = sk->sk_security;
4003 struct common_audit_data ad;
4004 struct lsm_network_audit net = {0,};
4005 struct sockaddr_in *addr4 = NULL;
4006 struct sockaddr_in6 *addr6 = NULL;
4007 unsigned short snum;
4008 u32 sid, node_perm;
4009
4010 if (family == PF_INET) {
4011 addr4 = (struct sockaddr_in *)address;
4012 snum = ntohs(addr4->sin_port);
4013 addrp = (char *)&addr4->sin_addr.s_addr;
4014 } else {
4015 addr6 = (struct sockaddr_in6 *)address;
4016 snum = ntohs(addr6->sin6_port);
4017 addrp = (char *)&addr6->sin6_addr.s6_addr;
4018 }
4019
4020 if (snum) {
4021 int low, high;
4022
4023 inet_get_local_port_range(sock_net(sk), &low, &high);
4024
4025 if (snum < max(PROT_SOCK, low) || snum > high) {
4026 err = sel_netport_sid(sk->sk_protocol,
4027 snum, &sid);
4028 if (err)
4029 goto out;
4030 ad.type = LSM_AUDIT_DATA_NET;
4031 ad.u.net = &net;
4032 ad.u.net->sport = htons(snum);
4033 ad.u.net->family = family;
4034 err = avc_has_perm(sksec->sid, sid,
4035 sksec->sclass,
4036 SOCKET__NAME_BIND, &ad);
4037 if (err)
4038 goto out;
4039 }
4040 }
4041
4042 switch (sksec->sclass) {
4043 case SECCLASS_TCP_SOCKET:
4044 node_perm = TCP_SOCKET__NODE_BIND;
4045 break;
4046
4047 case SECCLASS_UDP_SOCKET:
4048 node_perm = UDP_SOCKET__NODE_BIND;
4049 break;
4050
4051 case SECCLASS_DCCP_SOCKET:
4052 node_perm = DCCP_SOCKET__NODE_BIND;
4053 break;
4054
4055 default:
4056 node_perm = RAWIP_SOCKET__NODE_BIND;
4057 break;
4058 }
4059
4060 err = sel_netnode_sid(addrp, family, &sid);
4061 if (err)
4062 goto out;
4063
4064 ad.type = LSM_AUDIT_DATA_NET;
4065 ad.u.net = &net;
4066 ad.u.net->sport = htons(snum);
4067 ad.u.net->family = family;
4068
4069 if (family == PF_INET)
4070 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4071 else
4072 ad.u.net->v6info.saddr = addr6->sin6_addr;
4073
4074 err = avc_has_perm(sksec->sid, sid,
4075 sksec->sclass, node_perm, &ad);
4076 if (err)
4077 goto out;
4078 }
4079 out:
4080 return err;
4081 }
4082
4083 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4084 {
4085 struct sock *sk = sock->sk;
4086 struct sk_security_struct *sksec = sk->sk_security;
4087 int err;
4088
4089 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4090 if (err)
4091 return err;
4092
4093 /*
4094 * If a TCP or DCCP socket, check name_connect permission for the port.
4095 */
4096 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4097 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4098 struct common_audit_data ad;
4099 struct lsm_network_audit net = {0,};
4100 struct sockaddr_in *addr4 = NULL;
4101 struct sockaddr_in6 *addr6 = NULL;
4102 unsigned short snum;
4103 u32 sid, perm;
4104
4105 if (sk->sk_family == PF_INET) {
4106 addr4 = (struct sockaddr_in *)address;
4107 if (addrlen < sizeof(struct sockaddr_in))
4108 return -EINVAL;
4109 snum = ntohs(addr4->sin_port);
4110 } else {
4111 addr6 = (struct sockaddr_in6 *)address;
4112 if (addrlen < SIN6_LEN_RFC2133)
4113 return -EINVAL;
4114 snum = ntohs(addr6->sin6_port);
4115 }
4116
4117 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4118 if (err)
4119 goto out;
4120
4121 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4122 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4123
4124 ad.type = LSM_AUDIT_DATA_NET;
4125 ad.u.net = &net;
4126 ad.u.net->dport = htons(snum);
4127 ad.u.net->family = sk->sk_family;
4128 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4129 if (err)
4130 goto out;
4131 }
4132
4133 err = selinux_netlbl_socket_connect(sk, address);
4134
4135 out:
4136 return err;
4137 }
4138
4139 static int selinux_socket_listen(struct socket *sock, int backlog)
4140 {
4141 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4142 }
4143
4144 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4145 {
4146 int err;
4147 struct inode_security_struct *isec;
4148 struct inode_security_struct *newisec;
4149
4150 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4151 if (err)
4152 return err;
4153
4154 newisec = SOCK_INODE(newsock)->i_security;
4155
4156 isec = SOCK_INODE(sock)->i_security;
4157 newisec->sclass = isec->sclass;
4158 newisec->sid = isec->sid;
4159 newisec->initialized = 1;
4160
4161 return 0;
4162 }
4163
4164 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4165 int size)
4166 {
4167 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4168 }
4169
4170 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4171 int size, int flags)
4172 {
4173 return sock_has_perm(current, sock->sk, SOCKET__READ);
4174 }
4175
4176 static int selinux_socket_getsockname(struct socket *sock)
4177 {
4178 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4179 }
4180
4181 static int selinux_socket_getpeername(struct socket *sock)
4182 {
4183 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4184 }
4185
4186 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4187 {
4188 int err;
4189
4190 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4191 if (err)
4192 return err;
4193
4194 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4195 }
4196
4197 static int selinux_socket_getsockopt(struct socket *sock, int level,
4198 int optname)
4199 {
4200 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4201 }
4202
4203 static int selinux_socket_shutdown(struct socket *sock, int how)
4204 {
4205 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4206 }
4207
4208 static int selinux_socket_unix_stream_connect(struct sock *sock,
4209 struct sock *other,
4210 struct sock *newsk)
4211 {
4212 struct sk_security_struct *sksec_sock = sock->sk_security;
4213 struct sk_security_struct *sksec_other = other->sk_security;
4214 struct sk_security_struct *sksec_new = newsk->sk_security;
4215 struct common_audit_data ad;
4216 struct lsm_network_audit net = {0,};
4217 int err;
4218
4219 ad.type = LSM_AUDIT_DATA_NET;
4220 ad.u.net = &net;
4221 ad.u.net->sk = other;
4222
4223 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4224 sksec_other->sclass,
4225 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4226 if (err)
4227 return err;
4228
4229 /* server child socket */
4230 sksec_new->peer_sid = sksec_sock->sid;
4231 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4232 &sksec_new->sid);
4233 if (err)
4234 return err;
4235
4236 /* connecting socket */
4237 sksec_sock->peer_sid = sksec_new->sid;
4238
4239 return 0;
4240 }
4241
4242 static int selinux_socket_unix_may_send(struct socket *sock,
4243 struct socket *other)
4244 {
4245 struct sk_security_struct *ssec = sock->sk->sk_security;
4246 struct sk_security_struct *osec = other->sk->sk_security;
4247 struct common_audit_data ad;
4248 struct lsm_network_audit net = {0,};
4249
4250 ad.type = LSM_AUDIT_DATA_NET;
4251 ad.u.net = &net;
4252 ad.u.net->sk = other->sk;
4253
4254 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4255 &ad);
4256 }
4257
4258 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4259 u32 peer_sid,
4260 struct common_audit_data *ad)
4261 {
4262 int err;
4263 u32 if_sid;
4264 u32 node_sid;
4265
4266 err = sel_netif_sid(ifindex, &if_sid);
4267 if (err)
4268 return err;
4269 err = avc_has_perm(peer_sid, if_sid,
4270 SECCLASS_NETIF, NETIF__INGRESS, ad);
4271 if (err)
4272 return err;
4273
4274 err = sel_netnode_sid(addrp, family, &node_sid);
4275 if (err)
4276 return err;
4277 return avc_has_perm(peer_sid, node_sid,
4278 SECCLASS_NODE, NODE__RECVFROM, ad);
4279 }
4280
4281 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4282 u16 family)
4283 {
4284 int err = 0;
4285 struct sk_security_struct *sksec = sk->sk_security;
4286 u32 sk_sid = sksec->sid;
4287 struct common_audit_data ad;
4288 struct lsm_network_audit net = {0,};
4289 char *addrp;
4290
4291 ad.type = LSM_AUDIT_DATA_NET;
4292 ad.u.net = &net;
4293 ad.u.net->netif = skb->skb_iif;
4294 ad.u.net->family = family;
4295 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4296 if (err)
4297 return err;
4298
4299 if (selinux_secmark_enabled()) {
4300 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4301 PACKET__RECV, &ad);
4302 if (err)
4303 return err;
4304 }
4305
4306 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4307 if (err)
4308 return err;
4309 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4310
4311 return err;
4312 }
4313
4314 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4315 {
4316 int err;
4317 struct sk_security_struct *sksec = sk->sk_security;
4318 u16 family = sk->sk_family;
4319 u32 sk_sid = sksec->sid;
4320 struct common_audit_data ad;
4321 struct lsm_network_audit net = {0,};
4322 char *addrp;
4323 u8 secmark_active;
4324 u8 peerlbl_active;
4325
4326 if (family != PF_INET && family != PF_INET6)
4327 return 0;
4328
4329 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4330 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4331 family = PF_INET;
4332
4333 /* If any sort of compatibility mode is enabled then handoff processing
4334 * to the selinux_sock_rcv_skb_compat() function to deal with the
4335 * special handling. We do this in an attempt to keep this function
4336 * as fast and as clean as possible. */
4337 if (!selinux_policycap_netpeer)
4338 return selinux_sock_rcv_skb_compat(sk, skb, family);
4339
4340 secmark_active = selinux_secmark_enabled();
4341 peerlbl_active = selinux_peerlbl_enabled();
4342 if (!secmark_active && !peerlbl_active)
4343 return 0;
4344
4345 ad.type = LSM_AUDIT_DATA_NET;
4346 ad.u.net = &net;
4347 ad.u.net->netif = skb->skb_iif;
4348 ad.u.net->family = family;
4349 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4350 if (err)
4351 return err;
4352
4353 if (peerlbl_active) {
4354 u32 peer_sid;
4355
4356 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4357 if (err)
4358 return err;
4359 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4360 peer_sid, &ad);
4361 if (err) {
4362 selinux_netlbl_err(skb, err, 0);
4363 return err;
4364 }
4365 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4366 PEER__RECV, &ad);
4367 if (err) {
4368 selinux_netlbl_err(skb, err, 0);
4369 return err;
4370 }
4371 }
4372
4373 if (secmark_active) {
4374 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4375 PACKET__RECV, &ad);
4376 if (err)
4377 return err;
4378 }
4379
4380 return err;
4381 }
4382
4383 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4384 int __user *optlen, unsigned len)
4385 {
4386 int err = 0;
4387 char *scontext;
4388 u32 scontext_len;
4389 struct sk_security_struct *sksec = sock->sk->sk_security;
4390 u32 peer_sid = SECSID_NULL;
4391
4392 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4393 sksec->sclass == SECCLASS_TCP_SOCKET)
4394 peer_sid = sksec->peer_sid;
4395 if (peer_sid == SECSID_NULL)
4396 return -ENOPROTOOPT;
4397
4398 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4399 if (err)
4400 return err;
4401
4402 if (scontext_len > len) {
4403 err = -ERANGE;
4404 goto out_len;
4405 }
4406
4407 if (copy_to_user(optval, scontext, scontext_len))
4408 err = -EFAULT;
4409
4410 out_len:
4411 if (put_user(scontext_len, optlen))
4412 err = -EFAULT;
4413 kfree(scontext);
4414 return err;
4415 }
4416
4417 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4418 {
4419 u32 peer_secid = SECSID_NULL;
4420 u16 family;
4421
4422 if (skb && skb->protocol == htons(ETH_P_IP))
4423 family = PF_INET;
4424 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4425 family = PF_INET6;
4426 else if (sock)
4427 family = sock->sk->sk_family;
4428 else
4429 goto out;
4430
4431 if (sock && family == PF_UNIX)
4432 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4433 else if (skb)
4434 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4435
4436 out:
4437 *secid = peer_secid;
4438 if (peer_secid == SECSID_NULL)
4439 return -EINVAL;
4440 return 0;
4441 }
4442
4443 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4444 {
4445 struct sk_security_struct *sksec;
4446
4447 sksec = kzalloc(sizeof(*sksec), priority);
4448 if (!sksec)
4449 return -ENOMEM;
4450
4451 sksec->peer_sid = SECINITSID_UNLABELED;
4452 sksec->sid = SECINITSID_UNLABELED;
4453 selinux_netlbl_sk_security_reset(sksec);
4454 sk->sk_security = sksec;
4455
4456 return 0;
4457 }
4458
4459 static void selinux_sk_free_security(struct sock *sk)
4460 {
4461 struct sk_security_struct *sksec = sk->sk_security;
4462
4463 sk->sk_security = NULL;
4464 selinux_netlbl_sk_security_free(sksec);
4465 kfree(sksec);
4466 }
4467
4468 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4469 {
4470 struct sk_security_struct *sksec = sk->sk_security;
4471 struct sk_security_struct *newsksec = newsk->sk_security;
4472
4473 newsksec->sid = sksec->sid;
4474 newsksec->peer_sid = sksec->peer_sid;
4475 newsksec->sclass = sksec->sclass;
4476
4477 selinux_netlbl_sk_security_reset(newsksec);
4478 }
4479
4480 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4481 {
4482 if (!sk)
4483 *secid = SECINITSID_ANY_SOCKET;
4484 else {
4485 struct sk_security_struct *sksec = sk->sk_security;
4486
4487 *secid = sksec->sid;
4488 }
4489 }
4490
4491 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4492 {
4493 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4494 struct sk_security_struct *sksec = sk->sk_security;
4495
4496 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4497 sk->sk_family == PF_UNIX)
4498 isec->sid = sksec->sid;
4499 sksec->sclass = isec->sclass;
4500 }
4501
4502 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4503 struct request_sock *req)
4504 {
4505 struct sk_security_struct *sksec = sk->sk_security;
4506 int err;
4507 u16 family = req->rsk_ops->family;
4508 u32 connsid;
4509 u32 peersid;
4510
4511 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4512 if (err)
4513 return err;
4514 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4515 if (err)
4516 return err;
4517 req->secid = connsid;
4518 req->peer_secid = peersid;
4519
4520 return selinux_netlbl_inet_conn_request(req, family);
4521 }
4522
4523 static void selinux_inet_csk_clone(struct sock *newsk,
4524 const struct request_sock *req)
4525 {
4526 struct sk_security_struct *newsksec = newsk->sk_security;
4527
4528 newsksec->sid = req->secid;
4529 newsksec->peer_sid = req->peer_secid;
4530 /* NOTE: Ideally, we should also get the isec->sid for the
4531 new socket in sync, but we don't have the isec available yet.
4532 So we will wait until sock_graft to do it, by which
4533 time it will have been created and available. */
4534
4535 /* We don't need to take any sort of lock here as we are the only
4536 * thread with access to newsksec */
4537 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4538 }
4539
4540 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4541 {
4542 u16 family = sk->sk_family;
4543 struct sk_security_struct *sksec = sk->sk_security;
4544
4545 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4546 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4547 family = PF_INET;
4548
4549 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4550 }
4551
4552 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4553 {
4554 skb_set_owner_w(skb, sk);
4555 }
4556
4557 static int selinux_secmark_relabel_packet(u32 sid)
4558 {
4559 const struct task_security_struct *__tsec;
4560 u32 tsid;
4561
4562 __tsec = current_security();
4563 tsid = __tsec->sid;
4564
4565 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4566 }
4567
4568 static void selinux_secmark_refcount_inc(void)
4569 {
4570 atomic_inc(&selinux_secmark_refcount);
4571 }
4572
4573 static void selinux_secmark_refcount_dec(void)
4574 {
4575 atomic_dec(&selinux_secmark_refcount);
4576 }
4577
4578 static void selinux_req_classify_flow(const struct request_sock *req,
4579 struct flowi *fl)
4580 {
4581 fl->flowi_secid = req->secid;
4582 }
4583
4584 static int selinux_tun_dev_alloc_security(void **security)
4585 {
4586 struct tun_security_struct *tunsec;
4587
4588 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4589 if (!tunsec)
4590 return -ENOMEM;
4591 tunsec->sid = current_sid();
4592
4593 *security = tunsec;
4594 return 0;
4595 }
4596
4597 static void selinux_tun_dev_free_security(void *security)
4598 {
4599 kfree(security);
4600 }
4601
4602 static int selinux_tun_dev_create(void)
4603 {
4604 u32 sid = current_sid();
4605
4606 /* we aren't taking into account the "sockcreate" SID since the socket
4607 * that is being created here is not a socket in the traditional sense,
4608 * instead it is a private sock, accessible only to the kernel, and
4609 * representing a wide range of network traffic spanning multiple
4610 * connections unlike traditional sockets - check the TUN driver to
4611 * get a better understanding of why this socket is special */
4612
4613 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4614 NULL);
4615 }
4616
4617 static int selinux_tun_dev_attach_queue(void *security)
4618 {
4619 struct tun_security_struct *tunsec = security;
4620
4621 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4622 TUN_SOCKET__ATTACH_QUEUE, NULL);
4623 }
4624
4625 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4626 {
4627 struct tun_security_struct *tunsec = security;
4628 struct sk_security_struct *sksec = sk->sk_security;
4629
4630 /* we don't currently perform any NetLabel based labeling here and it
4631 * isn't clear that we would want to do so anyway; while we could apply
4632 * labeling without the support of the TUN user the resulting labeled
4633 * traffic from the other end of the connection would almost certainly
4634 * cause confusion to the TUN user that had no idea network labeling
4635 * protocols were being used */
4636
4637 sksec->sid = tunsec->sid;
4638 sksec->sclass = SECCLASS_TUN_SOCKET;
4639
4640 return 0;
4641 }
4642
4643 static int selinux_tun_dev_open(void *security)
4644 {
4645 struct tun_security_struct *tunsec = security;
4646 u32 sid = current_sid();
4647 int err;
4648
4649 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4650 TUN_SOCKET__RELABELFROM, NULL);
4651 if (err)
4652 return err;
4653 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4654 TUN_SOCKET__RELABELTO, NULL);
4655 if (err)
4656 return err;
4657 tunsec->sid = sid;
4658
4659 return 0;
4660 }
4661
4662 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4663 {
4664 int err = 0;
4665 u32 perm;
4666 struct nlmsghdr *nlh;
4667 struct sk_security_struct *sksec = sk->sk_security;
4668
4669 if (skb->len < NLMSG_HDRLEN) {
4670 err = -EINVAL;
4671 goto out;
4672 }
4673 nlh = nlmsg_hdr(skb);
4674
4675 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4676 if (err) {
4677 if (err == -EINVAL) {
4678 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4679 "SELinux: unrecognized netlink message"
4680 " type=%hu for sclass=%hu\n",
4681 nlh->nlmsg_type, sksec->sclass);
4682 if (!selinux_enforcing || security_get_allow_unknown())
4683 err = 0;
4684 }
4685
4686 /* Ignore */
4687 if (err == -ENOENT)
4688 err = 0;
4689 goto out;
4690 }
4691
4692 err = sock_has_perm(current, sk, perm);
4693 out:
4694 return err;
4695 }
4696
4697 #ifdef CONFIG_NETFILTER
4698
4699 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4700 u16 family)
4701 {
4702 int err;
4703 char *addrp;
4704 u32 peer_sid;
4705 struct common_audit_data ad;
4706 struct lsm_network_audit net = {0,};
4707 u8 secmark_active;
4708 u8 netlbl_active;
4709 u8 peerlbl_active;
4710
4711 if (!selinux_policycap_netpeer)
4712 return NF_ACCEPT;
4713
4714 secmark_active = selinux_secmark_enabled();
4715 netlbl_active = netlbl_enabled();
4716 peerlbl_active = selinux_peerlbl_enabled();
4717 if (!secmark_active && !peerlbl_active)
4718 return NF_ACCEPT;
4719
4720 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4721 return NF_DROP;
4722
4723 ad.type = LSM_AUDIT_DATA_NET;
4724 ad.u.net = &net;
4725 ad.u.net->netif = ifindex;
4726 ad.u.net->family = family;
4727 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4728 return NF_DROP;
4729
4730 if (peerlbl_active) {
4731 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4732 peer_sid, &ad);
4733 if (err) {
4734 selinux_netlbl_err(skb, err, 1);
4735 return NF_DROP;
4736 }
4737 }
4738
4739 if (secmark_active)
4740 if (avc_has_perm(peer_sid, skb->secmark,
4741 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4742 return NF_DROP;
4743
4744 if (netlbl_active)
4745 /* we do this in the FORWARD path and not the POST_ROUTING
4746 * path because we want to make sure we apply the necessary
4747 * labeling before IPsec is applied so we can leverage AH
4748 * protection */
4749 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4750 return NF_DROP;
4751
4752 return NF_ACCEPT;
4753 }
4754
4755 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4756 struct sk_buff *skb,
4757 const struct net_device *in,
4758 const struct net_device *out,
4759 int (*okfn)(struct sk_buff *))
4760 {
4761 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4762 }
4763
4764 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4765 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4766 struct sk_buff *skb,
4767 const struct net_device *in,
4768 const struct net_device *out,
4769 int (*okfn)(struct sk_buff *))
4770 {
4771 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4772 }
4773 #endif /* IPV6 */
4774
4775 static unsigned int selinux_ip_output(struct sk_buff *skb,
4776 u16 family)
4777 {
4778 struct sock *sk;
4779 u32 sid;
4780
4781 if (!netlbl_enabled())
4782 return NF_ACCEPT;
4783
4784 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4785 * because we want to make sure we apply the necessary labeling
4786 * before IPsec is applied so we can leverage AH protection */
4787 sk = skb->sk;
4788 if (sk) {
4789 struct sk_security_struct *sksec;
4790
4791 if (sk->sk_state == TCP_LISTEN)
4792 /* if the socket is the listening state then this
4793 * packet is a SYN-ACK packet which means it needs to
4794 * be labeled based on the connection/request_sock and
4795 * not the parent socket. unfortunately, we can't
4796 * lookup the request_sock yet as it isn't queued on
4797 * the parent socket until after the SYN-ACK is sent.
4798 * the "solution" is to simply pass the packet as-is
4799 * as any IP option based labeling should be copied
4800 * from the initial connection request (in the IP
4801 * layer). it is far from ideal, but until we get a
4802 * security label in the packet itself this is the
4803 * best we can do. */
4804 return NF_ACCEPT;
4805
4806 /* standard practice, label using the parent socket */
4807 sksec = sk->sk_security;
4808 sid = sksec->sid;
4809 } else
4810 sid = SECINITSID_KERNEL;
4811 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4812 return NF_DROP;
4813
4814 return NF_ACCEPT;
4815 }
4816
4817 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4818 struct sk_buff *skb,
4819 const struct net_device *in,
4820 const struct net_device *out,
4821 int (*okfn)(struct sk_buff *))
4822 {
4823 return selinux_ip_output(skb, PF_INET);
4824 }
4825
4826 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4827 int ifindex,
4828 u16 family)
4829 {
4830 struct sock *sk = skb->sk;
4831 struct sk_security_struct *sksec;
4832 struct common_audit_data ad;
4833 struct lsm_network_audit net = {0,};
4834 char *addrp;
4835 u8 proto;
4836
4837 if (sk == NULL)
4838 return NF_ACCEPT;
4839 sksec = sk->sk_security;
4840
4841 ad.type = LSM_AUDIT_DATA_NET;
4842 ad.u.net = &net;
4843 ad.u.net->netif = ifindex;
4844 ad.u.net->family = family;
4845 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4846 return NF_DROP;
4847
4848 if (selinux_secmark_enabled())
4849 if (avc_has_perm(sksec->sid, skb->secmark,
4850 SECCLASS_PACKET, PACKET__SEND, &ad))
4851 return NF_DROP_ERR(-ECONNREFUSED);
4852
4853 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4854 return NF_DROP_ERR(-ECONNREFUSED);
4855
4856 return NF_ACCEPT;
4857 }
4858
4859 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4860 u16 family)
4861 {
4862 u32 secmark_perm;
4863 u32 peer_sid;
4864 struct sock *sk;
4865 struct common_audit_data ad;
4866 struct lsm_network_audit net = {0,};
4867 char *addrp;
4868 u8 secmark_active;
4869 u8 peerlbl_active;
4870
4871 /* If any sort of compatibility mode is enabled then handoff processing
4872 * to the selinux_ip_postroute_compat() function to deal with the
4873 * special handling. We do this in an attempt to keep this function
4874 * as fast and as clean as possible. */
4875 if (!selinux_policycap_netpeer)
4876 return selinux_ip_postroute_compat(skb, ifindex, family);
4877
4878 secmark_active = selinux_secmark_enabled();
4879 peerlbl_active = selinux_peerlbl_enabled();
4880 if (!secmark_active && !peerlbl_active)
4881 return NF_ACCEPT;
4882
4883 sk = skb->sk;
4884
4885 #ifdef CONFIG_XFRM
4886 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4887 * packet transformation so allow the packet to pass without any checks
4888 * since we'll have another chance to perform access control checks
4889 * when the packet is on it's final way out.
4890 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4891 * is NULL, in this case go ahead and apply access control.
4892 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4893 * TCP listening state we cannot wait until the XFRM processing
4894 * is done as we will miss out on the SA label if we do;
4895 * unfortunately, this means more work, but it is only once per
4896 * connection. */
4897 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4898 !(sk != NULL && sk->sk_state == TCP_LISTEN))
4899 return NF_ACCEPT;
4900 #endif
4901
4902 if (sk == NULL) {
4903 /* Without an associated socket the packet is either coming
4904 * from the kernel or it is being forwarded; check the packet
4905 * to determine which and if the packet is being forwarded
4906 * query the packet directly to determine the security label. */
4907 if (skb->skb_iif) {
4908 secmark_perm = PACKET__FORWARD_OUT;
4909 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4910 return NF_DROP;
4911 } else {
4912 secmark_perm = PACKET__SEND;
4913 peer_sid = SECINITSID_KERNEL;
4914 }
4915 } else if (sk->sk_state == TCP_LISTEN) {
4916 /* Locally generated packet but the associated socket is in the
4917 * listening state which means this is a SYN-ACK packet. In
4918 * this particular case the correct security label is assigned
4919 * to the connection/request_sock but unfortunately we can't
4920 * query the request_sock as it isn't queued on the parent
4921 * socket until after the SYN-ACK packet is sent; the only
4922 * viable choice is to regenerate the label like we do in
4923 * selinux_inet_conn_request(). See also selinux_ip_output()
4924 * for similar problems. */
4925 u32 skb_sid;
4926 struct sk_security_struct *sksec = sk->sk_security;
4927 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4928 return NF_DROP;
4929 /* At this point, if the returned skb peerlbl is SECSID_NULL
4930 * and the packet has been through at least one XFRM
4931 * transformation then we must be dealing with the "final"
4932 * form of labeled IPsec packet; since we've already applied
4933 * all of our access controls on this packet we can safely
4934 * pass the packet. */
4935 if (skb_sid == SECSID_NULL) {
4936 switch (family) {
4937 case PF_INET:
4938 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4939 return NF_ACCEPT;
4940 break;
4941 case PF_INET6:
4942 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4943 return NF_ACCEPT;
4944 default:
4945 return NF_DROP_ERR(-ECONNREFUSED);
4946 }
4947 }
4948 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4949 return NF_DROP;
4950 secmark_perm = PACKET__SEND;
4951 } else {
4952 /* Locally generated packet, fetch the security label from the
4953 * associated socket. */
4954 struct sk_security_struct *sksec = sk->sk_security;
4955 peer_sid = sksec->sid;
4956 secmark_perm = PACKET__SEND;
4957 }
4958
4959 ad.type = LSM_AUDIT_DATA_NET;
4960 ad.u.net = &net;
4961 ad.u.net->netif = ifindex;
4962 ad.u.net->family = family;
4963 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4964 return NF_DROP;
4965
4966 if (secmark_active)
4967 if (avc_has_perm(peer_sid, skb->secmark,
4968 SECCLASS_PACKET, secmark_perm, &ad))
4969 return NF_DROP_ERR(-ECONNREFUSED);
4970
4971 if (peerlbl_active) {
4972 u32 if_sid;
4973 u32 node_sid;
4974
4975 if (sel_netif_sid(ifindex, &if_sid))
4976 return NF_DROP;
4977 if (avc_has_perm(peer_sid, if_sid,
4978 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4979 return NF_DROP_ERR(-ECONNREFUSED);
4980
4981 if (sel_netnode_sid(addrp, family, &node_sid))
4982 return NF_DROP;
4983 if (avc_has_perm(peer_sid, node_sid,
4984 SECCLASS_NODE, NODE__SENDTO, &ad))
4985 return NF_DROP_ERR(-ECONNREFUSED);
4986 }
4987
4988 return NF_ACCEPT;
4989 }
4990
4991 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4992 struct sk_buff *skb,
4993 const struct net_device *in,
4994 const struct net_device *out,
4995 int (*okfn)(struct sk_buff *))
4996 {
4997 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4998 }
4999
5000 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5001 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5002 struct sk_buff *skb,
5003 const struct net_device *in,
5004 const struct net_device *out,
5005 int (*okfn)(struct sk_buff *))
5006 {
5007 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
5008 }
5009 #endif /* IPV6 */
5010
5011 #endif /* CONFIG_NETFILTER */
5012
5013 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5014 {
5015 int err;
5016
5017 err = cap_netlink_send(sk, skb);
5018 if (err)
5019 return err;
5020
5021 return selinux_nlmsg_perm(sk, skb);
5022 }
5023
5024 static int ipc_alloc_security(struct task_struct *task,
5025 struct kern_ipc_perm *perm,
5026 u16 sclass)
5027 {
5028 struct ipc_security_struct *isec;
5029 u32 sid;
5030
5031 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5032 if (!isec)
5033 return -ENOMEM;
5034
5035 sid = task_sid(task);
5036 isec->sclass = sclass;
5037 isec->sid = sid;
5038 perm->security = isec;
5039
5040 return 0;
5041 }
5042
5043 static void ipc_free_security(struct kern_ipc_perm *perm)
5044 {
5045 struct ipc_security_struct *isec = perm->security;
5046 perm->security = NULL;
5047 kfree(isec);
5048 }
5049
5050 static int msg_msg_alloc_security(struct msg_msg *msg)
5051 {
5052 struct msg_security_struct *msec;
5053
5054 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5055 if (!msec)
5056 return -ENOMEM;
5057
5058 msec->sid = SECINITSID_UNLABELED;
5059 msg->security = msec;
5060
5061 return 0;
5062 }
5063
5064 static void msg_msg_free_security(struct msg_msg *msg)
5065 {
5066 struct msg_security_struct *msec = msg->security;
5067
5068 msg->security = NULL;
5069 kfree(msec);
5070 }
5071
5072 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5073 u32 perms)
5074 {
5075 struct ipc_security_struct *isec;
5076 struct common_audit_data ad;
5077 u32 sid = current_sid();
5078
5079 isec = ipc_perms->security;
5080
5081 ad.type = LSM_AUDIT_DATA_IPC;
5082 ad.u.ipc_id = ipc_perms->key;
5083
5084 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5085 }
5086
5087 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5088 {
5089 return msg_msg_alloc_security(msg);
5090 }
5091
5092 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5093 {
5094 msg_msg_free_security(msg);
5095 }
5096
5097 /* message queue security operations */
5098 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5099 {
5100 struct ipc_security_struct *isec;
5101 struct common_audit_data ad;
5102 u32 sid = current_sid();
5103 int rc;
5104
5105 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5106 if (rc)
5107 return rc;
5108
5109 isec = msq->q_perm.security;
5110
5111 ad.type = LSM_AUDIT_DATA_IPC;
5112 ad.u.ipc_id = msq->q_perm.key;
5113
5114 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5115 MSGQ__CREATE, &ad);
5116 if (rc) {
5117 ipc_free_security(&msq->q_perm);
5118 return rc;
5119 }
5120 return 0;
5121 }
5122
5123 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5124 {
5125 ipc_free_security(&msq->q_perm);
5126 }
5127
5128 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5129 {
5130 struct ipc_security_struct *isec;
5131 struct common_audit_data ad;
5132 u32 sid = current_sid();
5133
5134 isec = msq->q_perm.security;
5135
5136 ad.type = LSM_AUDIT_DATA_IPC;
5137 ad.u.ipc_id = msq->q_perm.key;
5138
5139 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5140 MSGQ__ASSOCIATE, &ad);
5141 }
5142
5143 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5144 {
5145 int err;
5146 int perms;
5147
5148 switch (cmd) {
5149 case IPC_INFO:
5150 case MSG_INFO:
5151 /* No specific object, just general system-wide information. */
5152 return task_has_system(current, SYSTEM__IPC_INFO);
5153 case IPC_STAT:
5154 case MSG_STAT:
5155 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5156 break;
5157 case IPC_SET:
5158 perms = MSGQ__SETATTR;
5159 break;
5160 case IPC_RMID:
5161 perms = MSGQ__DESTROY;
5162 break;
5163 default:
5164 return 0;
5165 }
5166
5167 err = ipc_has_perm(&msq->q_perm, perms);
5168 return err;
5169 }
5170
5171 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5172 {
5173 struct ipc_security_struct *isec;
5174 struct msg_security_struct *msec;
5175 struct common_audit_data ad;
5176 u32 sid = current_sid();
5177 int rc;
5178
5179 isec = msq->q_perm.security;
5180 msec = msg->security;
5181
5182 /*
5183 * First time through, need to assign label to the message
5184 */
5185 if (msec->sid == SECINITSID_UNLABELED) {
5186 /*
5187 * Compute new sid based on current process and
5188 * message queue this message will be stored in
5189 */
5190 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5191 NULL, &msec->sid);
5192 if (rc)
5193 return rc;
5194 }
5195
5196 ad.type = LSM_AUDIT_DATA_IPC;
5197 ad.u.ipc_id = msq->q_perm.key;
5198
5199 /* Can this process write to the queue? */
5200 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5201 MSGQ__WRITE, &ad);
5202 if (!rc)
5203 /* Can this process send the message */
5204 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5205 MSG__SEND, &ad);
5206 if (!rc)
5207 /* Can the message be put in the queue? */
5208 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5209 MSGQ__ENQUEUE, &ad);
5210
5211 return rc;
5212 }
5213
5214 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5215 struct task_struct *target,
5216 long type, int mode)
5217 {
5218 struct ipc_security_struct *isec;
5219 struct msg_security_struct *msec;
5220 struct common_audit_data ad;
5221 u32 sid = task_sid(target);
5222 int rc;
5223
5224 isec = msq->q_perm.security;
5225 msec = msg->security;
5226
5227 ad.type = LSM_AUDIT_DATA_IPC;
5228 ad.u.ipc_id = msq->q_perm.key;
5229
5230 rc = avc_has_perm(sid, isec->sid,
5231 SECCLASS_MSGQ, MSGQ__READ, &ad);
5232 if (!rc)
5233 rc = avc_has_perm(sid, msec->sid,
5234 SECCLASS_MSG, MSG__RECEIVE, &ad);
5235 return rc;
5236 }
5237
5238 /* Shared Memory security operations */
5239 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5240 {
5241 struct ipc_security_struct *isec;
5242 struct common_audit_data ad;
5243 u32 sid = current_sid();
5244 int rc;
5245
5246 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5247 if (rc)
5248 return rc;
5249
5250 isec = shp->shm_perm.security;
5251
5252 ad.type = LSM_AUDIT_DATA_IPC;
5253 ad.u.ipc_id = shp->shm_perm.key;
5254
5255 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5256 SHM__CREATE, &ad);
5257 if (rc) {
5258 ipc_free_security(&shp->shm_perm);
5259 return rc;
5260 }
5261 return 0;
5262 }
5263
5264 static void selinux_shm_free_security(struct shmid_kernel *shp)
5265 {
5266 ipc_free_security(&shp->shm_perm);
5267 }
5268
5269 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5270 {
5271 struct ipc_security_struct *isec;
5272 struct common_audit_data ad;
5273 u32 sid = current_sid();
5274
5275 isec = shp->shm_perm.security;
5276
5277 ad.type = LSM_AUDIT_DATA_IPC;
5278 ad.u.ipc_id = shp->shm_perm.key;
5279
5280 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5281 SHM__ASSOCIATE, &ad);
5282 }
5283
5284 /* Note, at this point, shp is locked down */
5285 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5286 {
5287 int perms;
5288 int err;
5289
5290 switch (cmd) {
5291 case IPC_INFO:
5292 case SHM_INFO:
5293 /* No specific object, just general system-wide information. */
5294 return task_has_system(current, SYSTEM__IPC_INFO);
5295 case IPC_STAT:
5296 case SHM_STAT:
5297 perms = SHM__GETATTR | SHM__ASSOCIATE;
5298 break;
5299 case IPC_SET:
5300 perms = SHM__SETATTR;
5301 break;
5302 case SHM_LOCK:
5303 case SHM_UNLOCK:
5304 perms = SHM__LOCK;
5305 break;
5306 case IPC_RMID:
5307 perms = SHM__DESTROY;
5308 break;
5309 default:
5310 return 0;
5311 }
5312
5313 err = ipc_has_perm(&shp->shm_perm, perms);
5314 return err;
5315 }
5316
5317 static int selinux_shm_shmat(struct shmid_kernel *shp,
5318 char __user *shmaddr, int shmflg)
5319 {
5320 u32 perms;
5321
5322 if (shmflg & SHM_RDONLY)
5323 perms = SHM__READ;
5324 else
5325 perms = SHM__READ | SHM__WRITE;
5326
5327 return ipc_has_perm(&shp->shm_perm, perms);
5328 }
5329
5330 /* Semaphore security operations */
5331 static int selinux_sem_alloc_security(struct sem_array *sma)
5332 {
5333 struct ipc_security_struct *isec;
5334 struct common_audit_data ad;
5335 u32 sid = current_sid();
5336 int rc;
5337
5338 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5339 if (rc)
5340 return rc;
5341
5342 isec = sma->sem_perm.security;
5343
5344 ad.type = LSM_AUDIT_DATA_IPC;
5345 ad.u.ipc_id = sma->sem_perm.key;
5346
5347 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5348 SEM__CREATE, &ad);
5349 if (rc) {
5350 ipc_free_security(&sma->sem_perm);
5351 return rc;
5352 }
5353 return 0;
5354 }
5355
5356 static void selinux_sem_free_security(struct sem_array *sma)
5357 {
5358 ipc_free_security(&sma->sem_perm);
5359 }
5360
5361 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5362 {
5363 struct ipc_security_struct *isec;
5364 struct common_audit_data ad;
5365 u32 sid = current_sid();
5366
5367 isec = sma->sem_perm.security;
5368
5369 ad.type = LSM_AUDIT_DATA_IPC;
5370 ad.u.ipc_id = sma->sem_perm.key;
5371
5372 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5373 SEM__ASSOCIATE, &ad);
5374 }
5375
5376 /* Note, at this point, sma is locked down */
5377 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5378 {
5379 int err;
5380 u32 perms;
5381
5382 switch (cmd) {
5383 case IPC_INFO:
5384 case SEM_INFO:
5385 /* No specific object, just general system-wide information. */
5386 return task_has_system(current, SYSTEM__IPC_INFO);
5387 case GETPID:
5388 case GETNCNT:
5389 case GETZCNT:
5390 perms = SEM__GETATTR;
5391 break;
5392 case GETVAL:
5393 case GETALL:
5394 perms = SEM__READ;
5395 break;
5396 case SETVAL:
5397 case SETALL:
5398 perms = SEM__WRITE;
5399 break;
5400 case IPC_RMID:
5401 perms = SEM__DESTROY;
5402 break;
5403 case IPC_SET:
5404 perms = SEM__SETATTR;
5405 break;
5406 case IPC_STAT:
5407 case SEM_STAT:
5408 perms = SEM__GETATTR | SEM__ASSOCIATE;
5409 break;
5410 default:
5411 return 0;
5412 }
5413
5414 err = ipc_has_perm(&sma->sem_perm, perms);
5415 return err;
5416 }
5417
5418 static int selinux_sem_semop(struct sem_array *sma,
5419 struct sembuf *sops, unsigned nsops, int alter)
5420 {
5421 u32 perms;
5422
5423 if (alter)
5424 perms = SEM__READ | SEM__WRITE;
5425 else
5426 perms = SEM__READ;
5427
5428 return ipc_has_perm(&sma->sem_perm, perms);
5429 }
5430
5431 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5432 {
5433 u32 av = 0;
5434
5435 av = 0;
5436 if (flag & S_IRUGO)
5437 av |= IPC__UNIX_READ;
5438 if (flag & S_IWUGO)
5439 av |= IPC__UNIX_WRITE;
5440
5441 if (av == 0)
5442 return 0;
5443
5444 return ipc_has_perm(ipcp, av);
5445 }
5446
5447 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5448 {
5449 struct ipc_security_struct *isec = ipcp->security;
5450 *secid = isec->sid;
5451 }
5452
5453 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5454 {
5455 if (inode)
5456 inode_doinit_with_dentry(inode, dentry);
5457 }
5458
5459 static int selinux_getprocattr(struct task_struct *p,
5460 char *name, char **value)
5461 {
5462 const struct task_security_struct *__tsec;
5463 u32 sid;
5464 int error;
5465 unsigned len;
5466
5467 if (current != p) {
5468 error = current_has_perm(p, PROCESS__GETATTR);
5469 if (error)
5470 return error;
5471 }
5472
5473 rcu_read_lock();
5474 __tsec = __task_cred(p)->security;
5475
5476 if (!strcmp(name, "current"))
5477 sid = __tsec->sid;
5478 else if (!strcmp(name, "prev"))
5479 sid = __tsec->osid;
5480 else if (!strcmp(name, "exec"))
5481 sid = __tsec->exec_sid;
5482 else if (!strcmp(name, "fscreate"))
5483 sid = __tsec->create_sid;
5484 else if (!strcmp(name, "keycreate"))
5485 sid = __tsec->keycreate_sid;
5486 else if (!strcmp(name, "sockcreate"))
5487 sid = __tsec->sockcreate_sid;
5488 else
5489 goto invalid;
5490 rcu_read_unlock();
5491
5492 if (!sid)
5493 return 0;
5494
5495 error = security_sid_to_context(sid, value, &len);
5496 if (error)
5497 return error;
5498 return len;
5499
5500 invalid:
5501 rcu_read_unlock();
5502 return -EINVAL;
5503 }
5504
5505 static int selinux_setprocattr(struct task_struct *p,
5506 char *name, void *value, size_t size)
5507 {
5508 struct task_security_struct *tsec;
5509 struct task_struct *tracer;
5510 struct cred *new;
5511 u32 sid = 0, ptsid;
5512 int error;
5513 char *str = value;
5514
5515 if (current != p) {
5516 /* SELinux only allows a process to change its own
5517 security attributes. */
5518 return -EACCES;
5519 }
5520
5521 /*
5522 * Basic control over ability to set these attributes at all.
5523 * current == p, but we'll pass them separately in case the
5524 * above restriction is ever removed.
5525 */
5526 if (!strcmp(name, "exec"))
5527 error = current_has_perm(p, PROCESS__SETEXEC);
5528 else if (!strcmp(name, "fscreate"))
5529 error = current_has_perm(p, PROCESS__SETFSCREATE);
5530 else if (!strcmp(name, "keycreate"))
5531 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5532 else if (!strcmp(name, "sockcreate"))
5533 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5534 else if (!strcmp(name, "current"))
5535 error = current_has_perm(p, PROCESS__SETCURRENT);
5536 else
5537 error = -EINVAL;
5538 if (error)
5539 return error;
5540
5541 /* Obtain a SID for the context, if one was specified. */
5542 if (size && str[1] && str[1] != '\n') {
5543 if (str[size-1] == '\n') {
5544 str[size-1] = 0;
5545 size--;
5546 }
5547 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5548 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5549 if (!capable(CAP_MAC_ADMIN)) {
5550 struct audit_buffer *ab;
5551 size_t audit_size;
5552
5553 /* We strip a nul only if it is at the end, otherwise the
5554 * context contains a nul and we should audit that */
5555 if (str[size - 1] == '\0')
5556 audit_size = size - 1;
5557 else
5558 audit_size = size;
5559 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5560 audit_log_format(ab, "op=fscreate invalid_context=");
5561 audit_log_n_untrustedstring(ab, value, audit_size);
5562 audit_log_end(ab);
5563
5564 return error;
5565 }
5566 error = security_context_to_sid_force(value, size,
5567 &sid);
5568 }
5569 if (error)
5570 return error;
5571 }
5572
5573 new = prepare_creds();
5574 if (!new)
5575 return -ENOMEM;
5576
5577 /* Permission checking based on the specified context is
5578 performed during the actual operation (execve,
5579 open/mkdir/...), when we know the full context of the
5580 operation. See selinux_bprm_set_creds for the execve
5581 checks and may_create for the file creation checks. The
5582 operation will then fail if the context is not permitted. */
5583 tsec = new->security;
5584 if (!strcmp(name, "exec")) {
5585 tsec->exec_sid = sid;
5586 } else if (!strcmp(name, "fscreate")) {
5587 tsec->create_sid = sid;
5588 } else if (!strcmp(name, "keycreate")) {
5589 error = may_create_key(sid, p);
5590 if (error)
5591 goto abort_change;
5592 tsec->keycreate_sid = sid;
5593 } else if (!strcmp(name, "sockcreate")) {
5594 tsec->sockcreate_sid = sid;
5595 } else if (!strcmp(name, "current")) {
5596 error = -EINVAL;
5597 if (sid == 0)
5598 goto abort_change;
5599
5600 /* Only allow single threaded processes to change context */
5601 error = -EPERM;
5602 if (!current_is_single_threaded()) {
5603 error = security_bounded_transition(tsec->sid, sid);
5604 if (error)
5605 goto abort_change;
5606 }
5607
5608 /* Check permissions for the transition. */
5609 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5610 PROCESS__DYNTRANSITION, NULL);
5611 if (error)
5612 goto abort_change;
5613
5614 /* Check for ptracing, and update the task SID if ok.
5615 Otherwise, leave SID unchanged and fail. */
5616 ptsid = 0;
5617 rcu_read_lock();
5618 tracer = ptrace_parent(p);
5619 if (tracer)
5620 ptsid = task_sid(tracer);
5621 rcu_read_unlock();
5622
5623 if (tracer) {
5624 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5625 PROCESS__PTRACE, NULL);
5626 if (error)
5627 goto abort_change;
5628 }
5629
5630 tsec->sid = sid;
5631 } else {
5632 error = -EINVAL;
5633 goto abort_change;
5634 }
5635
5636 commit_creds(new);
5637 return size;
5638
5639 abort_change:
5640 abort_creds(new);
5641 return error;
5642 }
5643
5644 static int selinux_ismaclabel(const char *name)
5645 {
5646 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5647 }
5648
5649 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5650 {
5651 return security_sid_to_context(secid, secdata, seclen);
5652 }
5653
5654 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5655 {
5656 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5657 }
5658
5659 static void selinux_release_secctx(char *secdata, u32 seclen)
5660 {
5661 kfree(secdata);
5662 }
5663
5664 /*
5665 * called with inode->i_mutex locked
5666 */
5667 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5668 {
5669 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5670 }
5671
5672 /*
5673 * called with inode->i_mutex locked
5674 */
5675 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5676 {
5677 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5678 }
5679
5680 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5681 {
5682 int len = 0;
5683 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5684 ctx, true);
5685 if (len < 0)
5686 return len;
5687 *ctxlen = len;
5688 return 0;
5689 }
5690 #ifdef CONFIG_KEYS
5691
5692 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5693 unsigned long flags)
5694 {
5695 const struct task_security_struct *tsec;
5696 struct key_security_struct *ksec;
5697
5698 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5699 if (!ksec)
5700 return -ENOMEM;
5701
5702 tsec = cred->security;
5703 if (tsec->keycreate_sid)
5704 ksec->sid = tsec->keycreate_sid;
5705 else
5706 ksec->sid = tsec->sid;
5707
5708 k->security = ksec;
5709 return 0;
5710 }
5711
5712 static void selinux_key_free(struct key *k)
5713 {
5714 struct key_security_struct *ksec = k->security;
5715
5716 k->security = NULL;
5717 kfree(ksec);
5718 }
5719
5720 static int selinux_key_permission(key_ref_t key_ref,
5721 const struct cred *cred,
5722 key_perm_t perm)
5723 {
5724 struct key *key;
5725 struct key_security_struct *ksec;
5726 u32 sid;
5727
5728 /* if no specific permissions are requested, we skip the
5729 permission check. No serious, additional covert channels
5730 appear to be created. */
5731 if (perm == 0)
5732 return 0;
5733
5734 sid = cred_sid(cred);
5735
5736 key = key_ref_to_ptr(key_ref);
5737 ksec = key->security;
5738
5739 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5740 }
5741
5742 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5743 {
5744 struct key_security_struct *ksec = key->security;
5745 char *context = NULL;
5746 unsigned len;
5747 int rc;
5748
5749 rc = security_sid_to_context(ksec->sid, &context, &len);
5750 if (!rc)
5751 rc = len;
5752 *_buffer = context;
5753 return rc;
5754 }
5755
5756 #endif
5757
5758 static struct security_operations selinux_ops = {
5759 .name = "selinux",
5760
5761 .ptrace_access_check = selinux_ptrace_access_check,
5762 .ptrace_traceme = selinux_ptrace_traceme,
5763 .capget = selinux_capget,
5764 .capset = selinux_capset,
5765 .capable = selinux_capable,
5766 .quotactl = selinux_quotactl,
5767 .quota_on = selinux_quota_on,
5768 .syslog = selinux_syslog,
5769 .vm_enough_memory = selinux_vm_enough_memory,
5770
5771 .netlink_send = selinux_netlink_send,
5772
5773 .bprm_set_creds = selinux_bprm_set_creds,
5774 .bprm_committing_creds = selinux_bprm_committing_creds,
5775 .bprm_committed_creds = selinux_bprm_committed_creds,
5776 .bprm_secureexec = selinux_bprm_secureexec,
5777
5778 .sb_alloc_security = selinux_sb_alloc_security,
5779 .sb_free_security = selinux_sb_free_security,
5780 .sb_copy_data = selinux_sb_copy_data,
5781 .sb_remount = selinux_sb_remount,
5782 .sb_kern_mount = selinux_sb_kern_mount,
5783 .sb_show_options = selinux_sb_show_options,
5784 .sb_statfs = selinux_sb_statfs,
5785 .sb_mount = selinux_mount,
5786 .sb_umount = selinux_umount,
5787 .sb_set_mnt_opts = selinux_set_mnt_opts,
5788 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5789 .sb_parse_opts_str = selinux_parse_opts_str,
5790
5791 .dentry_init_security = selinux_dentry_init_security,
5792
5793 .inode_alloc_security = selinux_inode_alloc_security,
5794 .inode_free_security = selinux_inode_free_security,
5795 .inode_init_security = selinux_inode_init_security,
5796 .inode_create = selinux_inode_create,
5797 .inode_link = selinux_inode_link,
5798 .inode_unlink = selinux_inode_unlink,
5799 .inode_symlink = selinux_inode_symlink,
5800 .inode_mkdir = selinux_inode_mkdir,
5801 .inode_rmdir = selinux_inode_rmdir,
5802 .inode_mknod = selinux_inode_mknod,
5803 .inode_rename = selinux_inode_rename,
5804 .inode_readlink = selinux_inode_readlink,
5805 .inode_follow_link = selinux_inode_follow_link,
5806 .inode_permission = selinux_inode_permission,
5807 .inode_setattr = selinux_inode_setattr,
5808 .inode_getattr = selinux_inode_getattr,
5809 .inode_setxattr = selinux_inode_setxattr,
5810 .inode_post_setxattr = selinux_inode_post_setxattr,
5811 .inode_getxattr = selinux_inode_getxattr,
5812 .inode_listxattr = selinux_inode_listxattr,
5813 .inode_removexattr = selinux_inode_removexattr,
5814 .inode_getsecurity = selinux_inode_getsecurity,
5815 .inode_setsecurity = selinux_inode_setsecurity,
5816 .inode_listsecurity = selinux_inode_listsecurity,
5817 .inode_getsecid = selinux_inode_getsecid,
5818
5819 .file_permission = selinux_file_permission,
5820 .file_alloc_security = selinux_file_alloc_security,
5821 .file_free_security = selinux_file_free_security,
5822 .file_ioctl = selinux_file_ioctl,
5823 .mmap_file = selinux_mmap_file,
5824 .mmap_addr = selinux_mmap_addr,
5825 .file_mprotect = selinux_file_mprotect,
5826 .file_lock = selinux_file_lock,
5827 .file_fcntl = selinux_file_fcntl,
5828 .file_set_fowner = selinux_file_set_fowner,
5829 .file_send_sigiotask = selinux_file_send_sigiotask,
5830 .file_receive = selinux_file_receive,
5831
5832 .file_open = selinux_file_open,
5833
5834 .task_create = selinux_task_create,
5835 .cred_alloc_blank = selinux_cred_alloc_blank,
5836 .cred_free = selinux_cred_free,
5837 .cred_prepare = selinux_cred_prepare,
5838 .cred_transfer = selinux_cred_transfer,
5839 .kernel_act_as = selinux_kernel_act_as,
5840 .kernel_create_files_as = selinux_kernel_create_files_as,
5841 .kernel_module_request = selinux_kernel_module_request,
5842 .task_setpgid = selinux_task_setpgid,
5843 .task_getpgid = selinux_task_getpgid,
5844 .task_getsid = selinux_task_getsid,
5845 .task_getsecid = selinux_task_getsecid,
5846 .task_setnice = selinux_task_setnice,
5847 .task_setioprio = selinux_task_setioprio,
5848 .task_getioprio = selinux_task_getioprio,
5849 .task_setrlimit = selinux_task_setrlimit,
5850 .task_setscheduler = selinux_task_setscheduler,
5851 .task_getscheduler = selinux_task_getscheduler,
5852 .task_movememory = selinux_task_movememory,
5853 .task_kill = selinux_task_kill,
5854 .task_wait = selinux_task_wait,
5855 .task_to_inode = selinux_task_to_inode,
5856
5857 .ipc_permission = selinux_ipc_permission,
5858 .ipc_getsecid = selinux_ipc_getsecid,
5859
5860 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5861 .msg_msg_free_security = selinux_msg_msg_free_security,
5862
5863 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5864 .msg_queue_free_security = selinux_msg_queue_free_security,
5865 .msg_queue_associate = selinux_msg_queue_associate,
5866 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5867 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5868 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5869
5870 .shm_alloc_security = selinux_shm_alloc_security,
5871 .shm_free_security = selinux_shm_free_security,
5872 .shm_associate = selinux_shm_associate,
5873 .shm_shmctl = selinux_shm_shmctl,
5874 .shm_shmat = selinux_shm_shmat,
5875
5876 .sem_alloc_security = selinux_sem_alloc_security,
5877 .sem_free_security = selinux_sem_free_security,
5878 .sem_associate = selinux_sem_associate,
5879 .sem_semctl = selinux_sem_semctl,
5880 .sem_semop = selinux_sem_semop,
5881
5882 .d_instantiate = selinux_d_instantiate,
5883
5884 .getprocattr = selinux_getprocattr,
5885 .setprocattr = selinux_setprocattr,
5886
5887 .ismaclabel = selinux_ismaclabel,
5888 .secid_to_secctx = selinux_secid_to_secctx,
5889 .secctx_to_secid = selinux_secctx_to_secid,
5890 .release_secctx = selinux_release_secctx,
5891 .inode_notifysecctx = selinux_inode_notifysecctx,
5892 .inode_setsecctx = selinux_inode_setsecctx,
5893 .inode_getsecctx = selinux_inode_getsecctx,
5894
5895 .unix_stream_connect = selinux_socket_unix_stream_connect,
5896 .unix_may_send = selinux_socket_unix_may_send,
5897
5898 .socket_create = selinux_socket_create,
5899 .socket_post_create = selinux_socket_post_create,
5900 .socket_bind = selinux_socket_bind,
5901 .socket_connect = selinux_socket_connect,
5902 .socket_listen = selinux_socket_listen,
5903 .socket_accept = selinux_socket_accept,
5904 .socket_sendmsg = selinux_socket_sendmsg,
5905 .socket_recvmsg = selinux_socket_recvmsg,
5906 .socket_getsockname = selinux_socket_getsockname,
5907 .socket_getpeername = selinux_socket_getpeername,
5908 .socket_getsockopt = selinux_socket_getsockopt,
5909 .socket_setsockopt = selinux_socket_setsockopt,
5910 .socket_shutdown = selinux_socket_shutdown,
5911 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5912 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5913 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5914 .sk_alloc_security = selinux_sk_alloc_security,
5915 .sk_free_security = selinux_sk_free_security,
5916 .sk_clone_security = selinux_sk_clone_security,
5917 .sk_getsecid = selinux_sk_getsecid,
5918 .sock_graft = selinux_sock_graft,
5919 .inet_conn_request = selinux_inet_conn_request,
5920 .inet_csk_clone = selinux_inet_csk_clone,
5921 .inet_conn_established = selinux_inet_conn_established,
5922 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5923 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5924 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5925 .req_classify_flow = selinux_req_classify_flow,
5926 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5927 .tun_dev_free_security = selinux_tun_dev_free_security,
5928 .tun_dev_create = selinux_tun_dev_create,
5929 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5930 .tun_dev_attach = selinux_tun_dev_attach,
5931 .tun_dev_open = selinux_tun_dev_open,
5932 .skb_owned_by = selinux_skb_owned_by,
5933
5934 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5935 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5936 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5937 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5938 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5939 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5940 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
5941 .xfrm_state_free_security = selinux_xfrm_state_free,
5942 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5943 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5944 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5945 .xfrm_decode_session = selinux_xfrm_decode_session,
5946 #endif
5947
5948 #ifdef CONFIG_KEYS
5949 .key_alloc = selinux_key_alloc,
5950 .key_free = selinux_key_free,
5951 .key_permission = selinux_key_permission,
5952 .key_getsecurity = selinux_key_getsecurity,
5953 #endif
5954
5955 #ifdef CONFIG_AUDIT
5956 .audit_rule_init = selinux_audit_rule_init,
5957 .audit_rule_known = selinux_audit_rule_known,
5958 .audit_rule_match = selinux_audit_rule_match,
5959 .audit_rule_free = selinux_audit_rule_free,
5960 #endif
5961 };
5962
5963 static __init int selinux_init(void)
5964 {
5965 if (!security_module_enable(&selinux_ops)) {
5966 selinux_enabled = 0;
5967 return 0;
5968 }
5969
5970 if (!selinux_enabled) {
5971 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5972 return 0;
5973 }
5974
5975 printk(KERN_INFO "SELinux: Initializing.\n");
5976
5977 /* Set the security state for the initial task. */
5978 cred_init_security();
5979
5980 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5981
5982 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5983 sizeof(struct inode_security_struct),
5984 0, SLAB_PANIC, NULL);
5985 avc_init();
5986
5987 if (register_security(&selinux_ops))
5988 panic("SELinux: Unable to register with kernel.\n");
5989
5990 if (selinux_enforcing)
5991 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5992 else
5993 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5994
5995 return 0;
5996 }
5997
5998 static void delayed_superblock_init(struct super_block *sb, void *unused)
5999 {
6000 superblock_doinit(sb, NULL);
6001 }
6002
6003 void selinux_complete_init(void)
6004 {
6005 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6006
6007 /* Set up any superblocks initialized prior to the policy load. */
6008 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6009 iterate_supers(delayed_superblock_init, NULL);
6010 }
6011
6012 /* SELinux requires early initialization in order to label
6013 all processes and objects when they are created. */
6014 security_initcall(selinux_init);
6015
6016 #if defined(CONFIG_NETFILTER)
6017
6018 static struct nf_hook_ops selinux_ipv4_ops[] = {
6019 {
6020 .hook = selinux_ipv4_postroute,
6021 .owner = THIS_MODULE,
6022 .pf = NFPROTO_IPV4,
6023 .hooknum = NF_INET_POST_ROUTING,
6024 .priority = NF_IP_PRI_SELINUX_LAST,
6025 },
6026 {
6027 .hook = selinux_ipv4_forward,
6028 .owner = THIS_MODULE,
6029 .pf = NFPROTO_IPV4,
6030 .hooknum = NF_INET_FORWARD,
6031 .priority = NF_IP_PRI_SELINUX_FIRST,
6032 },
6033 {
6034 .hook = selinux_ipv4_output,
6035 .owner = THIS_MODULE,
6036 .pf = NFPROTO_IPV4,
6037 .hooknum = NF_INET_LOCAL_OUT,
6038 .priority = NF_IP_PRI_SELINUX_FIRST,
6039 }
6040 };
6041
6042 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6043
6044 static struct nf_hook_ops selinux_ipv6_ops[] = {
6045 {
6046 .hook = selinux_ipv6_postroute,
6047 .owner = THIS_MODULE,
6048 .pf = NFPROTO_IPV6,
6049 .hooknum = NF_INET_POST_ROUTING,
6050 .priority = NF_IP6_PRI_SELINUX_LAST,
6051 },
6052 {
6053 .hook = selinux_ipv6_forward,
6054 .owner = THIS_MODULE,
6055 .pf = NFPROTO_IPV6,
6056 .hooknum = NF_INET_FORWARD,
6057 .priority = NF_IP6_PRI_SELINUX_FIRST,
6058 }
6059 };
6060
6061 #endif /* IPV6 */
6062
6063 static int __init selinux_nf_ip_init(void)
6064 {
6065 int err = 0;
6066
6067 if (!selinux_enabled)
6068 goto out;
6069
6070 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6071
6072 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6073 if (err)
6074 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6075
6076 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6077 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6078 if (err)
6079 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6080 #endif /* IPV6 */
6081
6082 out:
6083 return err;
6084 }
6085
6086 __initcall(selinux_nf_ip_init);
6087
6088 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6089 static void selinux_nf_ip_exit(void)
6090 {
6091 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6092
6093 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6094 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6095 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6096 #endif /* IPV6 */
6097 }
6098 #endif
6099
6100 #else /* CONFIG_NETFILTER */
6101
6102 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6103 #define selinux_nf_ip_exit()
6104 #endif
6105
6106 #endif /* CONFIG_NETFILTER */
6107
6108 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6109 static int selinux_disabled;
6110
6111 int selinux_disable(void)
6112 {
6113 if (ss_initialized) {
6114 /* Not permitted after initial policy load. */
6115 return -EINVAL;
6116 }
6117
6118 if (selinux_disabled) {
6119 /* Only do this once. */
6120 return -EINVAL;
6121 }
6122
6123 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6124
6125 selinux_disabled = 1;
6126 selinux_enabled = 0;
6127
6128 reset_security_ops();
6129
6130 /* Try to destroy the avc node cache */
6131 avc_disable();
6132
6133 /* Unregister netfilter hooks. */
6134 selinux_nf_ip_exit();
6135
6136 /* Unregister selinuxfs. */
6137 exit_sel_fs();
6138
6139 return 0;
6140 }
6141 #endif